{"generated":1792412924168,"kev":[{"id":"CVE-2026-102764","v":"BeyondTrust","p":"Remote Support","n":"BeyondTrust Remote Support Authentication Bypass by Spoofing Vulnerability","d":"2026-10-16","due":"2026-10-19","rw":0,"x":"BeyondTrust Remote Support contains an authentication bypass by spoofing vulnerability that could allow a remote attacker to perform file operations on the appliance.","ra":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","adv":["https://www.beyondtrust.com/trust-center/security-advisories/bt26-05","https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk","https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk"]},{"id":"CVE-2025-61624","v":"Fortinet","p":"Multiple Products","n":"Fortinet Multiple Products Path Traversal Vulnerability","d":"2026-10-16","due":"2026-10-19","rw":0,"x":"FortiOS, FortiPAM, FortiProxy, and FortiSwitchManager contain a path traversal vulnerability that may allow an authenticated attacker with admin profile and at least read-write permissions to write or delete arbitrary files via specific CLI commands.","ra":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","adv":["https://fortiguard.fortinet.com/psirt/FG-IR-26-122","https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk","https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk"]},{"id":"CVE-2026-21589","v":"Atlassian","p":"Multiple Products","n":"Atlassian Multiple Products Files or Directories Accessible to External Parties Vulnerability","d":"2026-10-15","due":"2026-10-18","rw":0,"x":"Multiple Atlassian products (Bitbucket Data Center ,Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center, Crowd Data Center, Crucible and Fisheye) contain a files or directories accessible to external parties vulnerability which could allow an unauthenticated…","ra":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","adv":["https://confluence.atlassian.com/security/cve-2026-21589-arbitrary-file-access-vulnerability-impacts-multiple-products-1870495748.html?ref=labs.watchtowr.com","https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk","https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk"]},{"id":"CVE-2026-105134","v":"Ahsay","p":"AhsayCBS","n":"Ahsay AhsayCBS Command Injection Vulnerability","d":"2026-10-14","due":"2026-10-17","rw":0,"x":"Ahsay AhsayCBS contains a command injection vulnerability that could allow a remote attacker to execute operating system commands via manipulation of the random parameter in the Replication Receiver component’s /rps/api/json/UpdateReceivers.do endpoint. This vulnerability can be chained with CVE-2026-105133.","ra":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","adv":["https://www.ahsay.com/en/company/announcements/patch-cve-105133-105134-update","https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk","https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk"]},{"id":"CVE-2026-76519","v":"Cisco","p":"Secure Email Gateway","n":"Cisco Secure Email Gateway Relative Path Traversal Vulnerability","d":"2026-10-14","due":"2026-10-17","rw":0,"x":"Cisco Secure Email Gateway contains a relative path traversal vulnerability that could allow an unauthenticated, remote attacker to write arbitrary files on the underlying operating system.","ra":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","adv":["https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-afw-zqYJkjxp","https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk","https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk"]},{"id":"CVE-2026-105133","v":"Ahsay","p":"AhsayCBS","n":"Ahsay AhsayCBS Improper Authentication Vulnerability","d":"2026-10-14","due":"2026-10-17","rw":0,"x":"Ahsay AhsayCBS contains an improper authentication vulnerability that could allow a remote attacker to bypass authentication via manipulation of the random parameter in the API component’s checkSysPwd function. This vulnerability can be chained with CVE-2026-105134.","ra":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","adv":["https://www.ahsay.com/en/company/announcements/patch-cve-105133-105134-update","https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk","https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk"]},{"id":"CVE-2026-0322","v":"Palo Alto Networks","p":"PAN-OS","n":"Palo Alto Networks PAN-OS Code Injection Vulnerability","d":"2026-10-14","due":"2026-10-17","rw":0,"x":"Palo Alto Networks PAN-OS contains a code injection vulnerability that could allow an authenticated attacker with network access to execute arbitrary code with root privileges on the firewall.","ra":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","adv":["https://security.paloaltonetworks.com/CVE-2026-0322","https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk","https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk"]},{"id":"CVE-2026-104935","v":"Ivanti","p":"Connect Secure","n":"Ivanti Connect Secure Authentication Bypass by Spoofing Vulnerability","d":"2026-10-13","due":"2026-10-16","rw":0,"x":"Ivanti Connect Secure contains an authentication bypass by spoofing vulnerability that allows a remote unauthenticated attacker to execute arbitrary commands.","ra":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","adv":[]},{"id":"CVE-2026-96951","v":"Microsoft","p":"Windows","n":"Microsoft Windows Command Injection Vulnerability","d":"2026-10-13","due":"2026-10-16","rw":0,"x":"Microsoft Windows Shell contains a command injection vulnerability that allows an unauthorized attacker to bypass a security feature over a network.","ra":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","adv":["https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-96951"]},{"id":"CVE-2015-5477","v":"ISC","p":"BIND","n":" ISC BIND Data Processing Errors Vulnerability","d":"2026-10-08","due":"2026-10-11","rw":0,"x":"ISC BIND contains a data processing errors vulnerability that could allow remote attackers to cause a denial of service via TKEY queries.","ra":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","adv":["https://web.archive.org/web/20150729014733/https://kb.isc.org/article/AA-01272","https://access.redhat.com/errata/RHSA-2015:1513.html","https://supportportal.juniper.net/s/article/2016-01-Security-Bulletin-Junos-Vulnerability-in-ISC-BIND-named-CVE-2015-5477"]},{"id":"CVE-2016-3081","v":"Apache","p":"Struts","n":"Apache Struts Command Injection Vulnerability","d":"2026-10-08","due":"2026-10-11","rw":0,"x":"Apache Struts contains a command injection vulnerability that could allow remote attackers to execute arbitrary code via method:prefix when Dynamic Method Invocation is enabled.","ra":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","adv":["https://cwiki.apache.org/confluence/display/WW/S2-032","https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk","https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk"]},{"id":"CVE-2023-22894","v":"Strapi","p":"Strapi","n":"Strapi Cleartext Storage of Sensitive Information Vulnerability","d":"2026-10-08","due":"2026-10-11","rw":0,"x":"Strapi contains a cleartext storage of sensitive information vulnerability that could allow attackers with access to the admin panel to discover sensitive user details via the query filter. The impacted product(s) could be end-of-life (EoL) and/or end-of-service (EoS). Users are advised to discontinue use and/or…","ra":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","adv":["https://strapi.io/blog/security-disclosure-of-vulnerabilities-cve","https://github.com/strapi/strapi/releases","https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk"]},{"id":"CVE-2021-3199","v":"ONLYOFFICE","p":"Docs","n":"ONLYOFFICE Docs Server Path Traversal Vulnerability","d":"2026-10-08","due":"2026-10-11","rw":0,"x":"ONLYOFFICE Docs contains a path traversal vulnerability that can occur when JWT is used, via a /.. sequence in an image upload parameter and could allow for remote code execution.","ra":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","adv":["https://github.com/ONLYOFFICE/DocumentServer/blob/903fe5ab7a275bd69c3c3346af2d21cf87ebeabf/CHANGELOG.md#563","https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk","https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk"]},{"id":"CVE-2015-3306","v":"ProFTPD","p":"ProFTPD","n":"ProFTPD Improper Access Control Vulnerability","d":"2026-10-08","due":"2026-10-11","rw":0,"x":"ProFTPD contains an improper access control vulnerability that could allow remote attackers to read and write to arbitrary files via the site cpfr and site cpto commands.","ra":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","adv":["http://www.proftpd.org/","https://lists.debian.org/debian-security-announce/2015/msg00154.html","https://lists.opensuse.org/archives/list/updates@lists.opensuse.org/message/WE6YZRG5UVXMGQ7IVDRYBPIWV4M6UUGM/"]},{"id":"CVE-2026-88779","v":"Citrix","p":"NetScaler","n":"Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability","d":"2026-10-04","due":"2026-10-07","rw":0,"x":"Citrix NetScaler ADC (formerly Citrix ADC) and Citrix NetScaler Gateway (formerly Citrix Gateway) contain an improper restriction of operations within the bounds of a memory buffer vulnerability that could allow for a denial of service.","ra":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","adv":["https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697174","https://community.citrix.com/techzone-blogs/110_security-updates/understanding-and-addressing-cve-2026-88779-in-citrix-netscaler-adc-and-citrix-netscaler-gateway/","https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk"]},{"id":"CVE-2026-102490","v":"Zammad GmbH","p":"Zammad","n":"Zammad GmbH Zammad Improper Privilege Management Vulnerability","d":"2026-10-02","due":"2026-10-05","rw":0,"x":"Zammad GmbH Zammad contains an improper privilege management vulnerability that can allow the local zammad user to escalate privileges to root. This vulnerability can be chained with CVE-2026-102489.","ra":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","adv":["https://zammad.com/en/product/releases/","https://community.zammad.org/t/take-care-local-privilege-escalation-cve-2026-102490-is-reported-as-being-actively-exploited/21297/2","https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk"]},{"id":"CVE-2026-102489","v":"Zammad GmbH","p":"Zammad","n":"Zammad GmbH Zammad Session Fixation Vulnerability","d":"2026-10-02","due":"2026-10-05","rw":0,"x":"Zammad GmbH Zammad contains a session fixation vulnerability that can lead to remote code execution as the zammad user. This vulnerability can be chained with CVE-2026-102490.","ra":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","adv":["https://zammad.com/en/product/releases/","https://community.zammad.org/t/take-care-local-privilege-escalation-cve-2026-102490-is-reported-as-being-actively-exploited/21297/2","https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk"]},{"id":"CVE-2026-104286","v":"Fortinet","p":"FortiMail","n":"Fortinet FortiMail Path Traversal Vulnerability","d":"2026-10-01","due":"2026-10-04","rw":0,"x":"Fortinet FortiMail contains a path traversal and an improper neutralization of NULL byte or NULL character vulnerability that may allow an unauthenticated attacker to write arbitrary files on the underlying system via crafted HTTP or HTTPS requests.","ra":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","adv":["https://fortiguard.fortinet.com/psirt/FG-IR-26-175","https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk","https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk"]},{"id":"CVE-2026-76504","v":"Cisco","p":"Catalyst SD-WAN Manager","n":"Cisco Catalyst SD-WAN Manager Hex Encoding Vulnerability","d":"2026-09-30","due":"2026-10-03","rw":0,"x":"Cisco Catalyst SD-WAN Manager contains a hex encoding vulnerability that could allow an unauthenticated, remote attacker to access an affected system with privileges of the admin user due to improper handling of URI encoding in an HTTP request.","ra":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","adv":["https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-webauth-xr8beuuU","https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk","https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk"]},{"id":"CVE-2026-86950","v":"Apple","p":"Multiple Products","n":"Apple Multiple Products Out-of-Bounds Write Vulnerability","d":"2026-09-29","due":"2026-10-13","rw":0,"x":"Apple iOS, macOS, and iPadOS contain an out-of-bounds write vulnerability in CoreGraphics that may lead to arbitrary code execution.","ra":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","adv":["https://support.apple.com/en-us/149226","https://support.apple.com/en-us/149228","https://support.apple.com/en-us/149229"]},{"id":"CVE-2026-88772","v":"Citrix","p":"NetScaler","n":"Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability","d":"2026-09-27","due":"2026-09-30","rw":0,"x":"Citrix NetScaler ADC and NetScaler Gateway contain an improper restriction of operations within the bounds of a memory buffer vulnerability that could allow for remote code execution or denial of service","ra":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","adv":["https://community.citrix.com/techzone-blogs/110_security-updates/netscaler-adc-and-netscaler-gateway-security-bulletin-for-cve-2026-88771-through-cve-2026-88778","https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697096","https://support.citrix.com/external/article/CTX694799/steps-to-take-if-netscaler-adc-is-suspec.html"]},{"id":"CVE-2026-88771","v":"Citrix","p":"NetScaler","n":"Citrix NetScaler Improper Input Validation Vulnerability","d":"2026-09-27","due":"2026-09-30","rw":0,"x":"Citrix NetScaler ADC and NetScaler Gateway contain an improper input validation vulnerability that could allow an unauthenticated attacker to execute arbitrary commands.","ra":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","adv":["https://community.citrix.com/techzone-blogs/110_security-updates/netscaler-adc-and-netscaler-gateway-security-bulletin-for-cve-2026-88771-through-cve-2026-88778","https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697096","https://support.citrix.com/external/article/CTX694799/steps-to-take-if-netscaler-adc-is-suspec.html"]},{"id":"CVE-2026-67279","v":"MikroTik","p":"RouterOS","n":"Mikrotik RouterOS Improper Enforcement of Behavioral Workflow Vulnerability","d":"2026-09-25","due":"2026-09-28","rw":0,"x":"Mikrotik RouterOS contains an improper enforcement of behavioral workflow vulnerability that could allow an unauthenticated client to open a session channel and send an exec request. This vulnerability can be chained to achieve unauthenticated exploitation of CVE-2026-86060.","ra":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","adv":["https://mikrotik.com/supportsec/september-2026-vulnerability/?utm_source=chatgpt.com","https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk","https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk"]},{"id":"CVE-2026-65660","v":"Microsoft","p":"SharePoint","n":"Microsoft SharePoint Code Injection Vulnerability","d":"2026-09-25","due":"2026-09-28","rw":0,"x":"Microsoft SharePoint contains a code injection vulnerability which could allow an authorized attacker to execute code over a network.","ra":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","adv":["https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-65660","https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk","https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk"]},{"id":"CVE-2026-87902","v":"WordPress","p":"Core","n":"WordPress Core Remote File Inclusion Vulnerability","d":"2026-09-25","due":"2026-09-28","rw":0,"x":"WordPress Core contains a remote file inclusion vulnerability which could allow an unauthenticated attacker to make page-template resolution include a chosen readable local `.php` file outside the active theme directories, leading to remote code execution.","ra":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","adv":["https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-7hp8-65ch-5whp","https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk","https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk"]},{"id":"CVE-2026-5430","v":"WSO2","p":"Multiple Products","n":"WSO2 Multiple Products Path Traversal Vulnerability ","d":"2026-09-24","due":"2026-09-27","rw":0,"x":"WSO2 API Control Plane, API Manager, Traffic Manager & Universal Gateway contain a path traversal vulnerability that could allow for unrestricted file upload and lead to remote code execution. ","ra":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","adv":["https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5328/","https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk","https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk"]},{"id":"CVE-2026-71362","v":"Adobe","p":"Commerce and Magento ","n":"Adobe Commerce and Magento Incorrect Authorization Vulnerability ","d":"2026-09-24","due":"2026-09-27","rw":0,"x":"Adobe Commerce and Magento contains an incorrect authorization vulnerability that could allow an attacker to leverage this vulnerability to gain elevated access to sensitive resources without any user interaction. ","ra":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","adv":["https://helpx.adobe.com/security/products/magento/apsb26-92.html","https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk","https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk"]},{"id":"CVE-2026-93952","v":"Arista","p":"VeloCloud Orchestrator","n":"Arista VeloCloud Orchestrator Improper Input Validation Vulnerability","d":"2026-09-22","due":"2026-09-25","rw":0,"x":"Arista VeloCloud Orchestrator (VCO) on-prem contains an improper input validation vulnerability that may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data…","ra":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","adv":["https://www.arista.com/en/support/advisories-notices/security-advisory/24765-security-advisory-0183","https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk","https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk"]},{"id":"CVE-2026-94127","v":"F5","p":"BIG-IP APM","n":"F5 BIG-IP APM Heap-based Buffer Overflow Vulnerability","d":"2026-09-22","due":"2026-09-25","rw":0,"x":"F5 BIG-IP APM contains a heap-based buffer overflow vulnerability when access policy and an OAuth profile are configured on a virtual server. This vulnerability could allow an unauthenticated attacker to perform remote code execution.","ra":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","adv":["https://my.f5.com/manage/s/article/K000162605","https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk","https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk"]},{"id":"CVE-2026-93616","v":"Check Point","p":"Multiple Products","n":"Check Point Multiple Products Path Traversal Vulnerability","d":"2026-09-22","due":"2026-09-25","rw":0,"x":"Check Point Security Management Server, Multi-Domain Security Management Server, Log Server, Multi-Domain Log Server, and SmartEvent contain a path traversal vulnerability that allows an unauthenticated attacker to upload and execute arbitrary scripts.","ra":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","adv":["https://support.checkpoint.com/results/sk/sk1000171/","https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk","https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk"]},{"id":"CVE-2026-85102","v":"Check Point","p":"Multiple Products","n":"Check Point Multiple Products Improper Certificate Validation Vulnerability","d":"2026-09-22","due":"2026-09-25","rw":0,"x":"Check Point Security Gateway and Check Point Spark Firewall using Site to Site VPN or Remote Access VPN contain an improper certificate validation vulnerability which could allow an unauthenticated remote attacker to execute arbitrary code on the Gateway.","ra":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","adv":["https://support.checkpoint.com/results/sk/sk1000117","https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk","https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk"]},{"id":"CVE-2026-7273","v":"Zyxel","p":"GS1900 Series Switches","n":"Zyxel GS1900 Series Switches Stack-Based Buffer Overflow Vulnerability","d":"2026-09-21","due":"2026-09-24","rw":0,"x":"Zyxel GS1900 series switches contain a stack-based buffer overflow vulnerability in the CGI program which could allow a LAN-based, unauthenticated attacker to exploit the flaw and potentially execute OS commands via a crafted HTTP request.","ra":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","adv":["https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-stack-based-buffer-overflow-vulnerability-in-gs1900-series-switches-06-16-2026","https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk","https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk"]},{"id":"CVE-2025-39964","v":"Linux","p":"Kernel","n":"Linux Kernel Race Condition Vulnerability","d":"2026-09-18","due":"2026-09-21","rw":0,"x":"Linux Kernel contains a race condition vulnerability which allows concurrent writes to the same AF_ALG socket causing data to be unpredictably interleaved and creating inconsistencies in the socket's internal state.","ra":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","adv":["https://git.kernel.org/stable/c/0f28c4adbc4a97437874c9b669fd7958a8c6d6ce","https://git.kernel.org/stable/c/e4c1ec11132ec466f7362a95f36a506ce4dc08c9","https://git.kernel.org/stable/c/1f323a48e9b5ebfe6dc7d130fdf5c3c0e92a07c8"]},{"id":"CVE-2026-53266","v":"Linux","p":"Kernel","n":"Linux Kernel Out-of-Bounds Write Vulnerability","d":"2026-09-18","due":"2026-09-21","rw":0,"x":"Linux Kernel contains an out-of-bounds write vulnerability in the ebtables SNAT target which allows an ARP sender hardware address rewrite to write directly into a nonlinear socket-buffer fragment backed by a splice-imported file page. The impacted product(s) could be end-of-life (EoL) and/or end-of-service (EoS).…","ra":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","adv":["https://git.kernel.org/stable/c/bf84ad7c7a9ede46e31afaa41a1ba06a159e8c87","https://git.kernel.org/stable/c/76280b78cc9f23bdc6438e10ad6dff148ef8375b","https://git.kernel.org/stable/c/b7e91939ba9be805a62a257fa4e227dffbb88fa0"]},{"id":"CVE-2025-39682","v":"Linux","p":"Kernel","n":"Linux Kernel Improper Check for Unusual or Exceptional Conditions Vulnerability","d":"2026-09-18","due":"2026-09-21","rw":0,"x":"Linux Kernel contains an improper check for unusual or exceptional conditions vulnerability in the TLS receive path which allows a zero-length record retrieved from the rx_list to bypass the intended recvmsg() record-type handling, potentially causing subsequent TLS records to be processed using incorrect zero-copy…","ra":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","adv":["https://git.kernel.org/stable/c/2902c3ebcca52ca845c03182000e8d71d3a5196f","https://git.kernel.org/stable/c/c09dd3773b5950e9cfb6c9b9a5f6e36d06c62677","https://git.kernel.org/stable/c/3439c15ae91a517cf3c650ea15a8987699416ad9"]},{"id":"CVE-2026-58704","v":"Google","p":"Pixel","n":"Google Pixel Improper Authorization Vulnerability","d":"2026-09-16","due":"2026-09-19","rw":0,"x":"Google Pixel devices contain an improper authorization vulnerability in the cellular modem. A logic error may allow an attacker to bypass permission checks and escalate privileges.","ra":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","adv":["https://source.android.com/docs/security/bulletin/pixel/2026/2026-09-01","https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk","https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk"]},{"id":"CVE-2026-76460","v":"Cisco","p":"Identity Services Engine","n":"Cisco Identity Services Engine Incorrect Use of Privileged APIs Vulnerability","d":"2026-09-16","due":"2026-09-19","rw":0,"x":"Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) contain an incorrect use of privileged APIs vulnerability that could allow an unauthenticated, remote attacker to gain unauthorized access to the affected device by bypassing the web-based management interface.","ra":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","adv":["https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ISE-ABP-VNSW7Tn5","https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk","https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk"]},{"id":"CVE-2026-87886","v":"Acronis","p":"Backup","n":"Acronis Backup Incorrect Default Permissions Vulnerability","d":"2026-09-16","due":"2026-09-19","rw":0,"x":"Acronis Backup plugin for cPanel & WHM and extension for Plesk contains an incorrect default permissions vulnerability that could allow for privilege escalation.","ra":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","adv":["https://security-advisory.acronis.com/advisories/SEC-10986","https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk","https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk"]},{"id":"CVE-2026-76461","v":"Cisco","p":"Secure Email Gateway","n":"Cisco Secure Email Gateway SQL Injection Vulnerability","d":"2026-09-14","due":"2026-09-17","rw":0,"x":"Cisco AsyncOS software for Cisco Secure Email Gateway (SEG) contains a SQL injection vulnerability that could allow an unauthenticated, remote attacker to execute arbitrary commands with root privileges on the underlying operating system.","ra":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","adv":["https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-inj-2bLVGmhX","https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk","https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk"]},{"id":"CVE-2026-84869","v":"ConnectWise","p":"ScreenConnect","n":"ConnectWise ScreenConnect Improper Privilege Management and Missing Authorization Vulnerability","d":"2026-09-11","due":"2026-09-14","rw":0,"x":"ConnectWise ScreenConnect contains both an improper privilege management and missing authorization vulnerability that may allow an attacker to transfer and execute files through an active remote session without authorization or host confirmation.","ra":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","adv":["https://www.connectwise.com/company/trust/security-bulletins/2026-09-08-screenconnect-bulletin","https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk","https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk"]},{"id":"CVE-2026-42016","v":"JFrog","p":"Artifactory","n":"JFrog Artifactory Incorrect Authorization Vulnerability","d":"2026-09-11","due":"2026-09-25","rw":0,"x":"JFrog Artifactory contains an incorrect authorization vulnerability that leads to a privilege escalation attack due to a validation check of the token signature/issuer and not the token’s scope.","ra":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","adv":["https://docs.jfrog.com/releases/docs/jfrog-security-advisories","https://docs.jfrog.com/releases/docs/artifactory-self-managed-releases","https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk"]},{"id":"CVE-2026-42018","v":"JFrog","p":"Artifactory","n":"JFrog Artifactory Improper Authentication Vulnerability","d":"2026-09-11","due":"2026-09-25","rw":0,"x":"JFrog Artifactory contains an improper authentication vulnerability that could return an internal anonymous-user token to an unauthenticated caller when anonymous access is disabled, potentially exposing sensitive resources.","ra":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","adv":["https://docs.jfrog.com/releases/docs/jfrog-security-advisories","https://docs.jfrog.com/releases/docs/artifactory-self-managed-releases","https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk"]},{"id":"CVE-2026-85706","v":"GitLab","p":"Community Edition and Enterprise Edition","n":"GitLab Community Edition and Enterprise Edition Path Traversal Vulnerability","d":"2026-09-11","due":"2026-09-14","rw":0,"x":"GitLab Community Edition and Enterprise Edition contains a path traversal vulnerability that allows an unauthenticated user to read arbitrary files due to an improper path confinement and missing authentication enforcement in the repository commits API.","ra":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","adv":["https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-3-2-released/","https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk","https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk"]},{"id":"CVE-2026-86060","v":"MikroTik","p":"RouterOS","n":"MikroTik RouterOS Improper Neutralization of Argument Delimiters in a Command Vulnerability","d":"2026-09-10","due":"2026-09-13","rw":0,"x":"MikroTik RouterOS contains an improper neutralization of argument delimiters in a command vulnerability which allows an attacker to change the trusted RouterOS policy mask, leading to privilege escalation.","ra":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","adv":["https://mikrotik.com/supportsec/september-2026-vulnerability","https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk","https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk"]},{"id":"CVE-2026-67277","v":"MikroTik","p":"RouterOS","n":"MikroTik RouterOS Missing Authentication for Critical Function Vulnerability","d":"2026-09-10","due":"2026-09-13","rw":0,"x":"MikroTik RouterOS contains a missing authentication for critical function vulnerability which allows kernel memory disclosure and denial of service in the btest service.","ra":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","adv":["https://mikrotik.com/supportsec/september-2026-vulnerability/","https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk","https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk"]},{"id":"CVE-2026-19490","v":"Citrix","p":"NetScaler","n":"Citrix NetScaler Authentication Bypass Using an Alternate Path or Channel Vulnerability","d":"2026-09-09","due":"2026-09-12","rw":0,"x":"Citrix NetScaler ADC and NetScaler Gateway contain an authentication-bypass vulnerability involving an alternate path or channel. When the NetScaler appliance is configured as an AAA virtual server or as a Gateway (SSL VPN, ICA Proxy, CVPN, or RDP Proxy), an unauthenticated remote threat actor may be able to bypass…","ra":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","adv":["https://support.citrix.com/external/article/CTX696939/netscaler-adc-and-netscaler-gateway-secu.html","https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk","https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk"]},{"id":"CVE-2025-25249","v":"Fortinet","p":"Multiple Products","n":"Fortinet Multiple Products Heap-based Buffer Overflow Vulnerability","d":"2026-09-09","due":"2026-09-12","rw":0,"x":"Fortinet FortiOS, FortiSwitchManager, and FortiSASE contain a heap-based buffer overflow vulnerability that allows an attacker to execute unauthorized code or commands via specially crafted packets.","ra":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","adv":["https://fortiguard.fortinet.com/psirt/FG-IR-25-084","https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk","https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk"]},{"id":"CVE-2026-87491","v":"Google","p":"Chromium V8","n":"Google Chromium V8 Out of Bounds Write Vulnerability","d":"2026-09-09","due":"2026-09-23","rw":0,"x":"Google Chromium V8 contains an out of bounds write vulnerability that allows a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.","ra":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","adv":["https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_0808145027.html","https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk","https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk"]},{"id":"CVE-2026-20079","v":"Cisco","p":"Secure Firewall Management Center (FMC) and Security Cloud Control (SCC) Firewall Management","n":"Cisco Firewall Management Center Authentication Bypass Using an Alternate Path or Channel Vulnerability","d":"2026-09-09","due":"2026-09-12","rw":0,"x":"Cisco Secure Firewall Management Center (FMC) Software and Cisco Security Cloud Control (SCC) Firewall Management contain an authentication Bypass using an alternate path or channel vulnerability that could allow an unauthenticated, remote attacker to bypass authentication and execute script files on an affected…","ra":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","adv":["https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-onprem-fmc-authbypass-5JPp45V2","https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk","https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk"]},{"id":"CVE-2026-75650","v":"Adobe","p":"Commerce and Magento","n":"Adobe Commerce and Magento Improper Neutralization of Special Elements Used in a Template Engine Vulnerability","d":"2026-09-08","due":"2026-09-11","rw":0,"x":"Adobe Commerce and Magento Open Source contain an improper neutralization of special elements used in a template engine vulnerability that could allow an attacker to execute arbitrary code.","ra":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","adv":["https://helpx.adobe.com/security/products/magento/apsb26-146.html","https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk","https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk"]},{"id":"CVE-2026-81963","v":"Microsoft","p":"Windows","n":"Microsoft Windows Link Following Vulnerability","d":"2026-09-08","due":"2026-09-22","rw":0,"x":"Microsoft Windows Update Stack contains a link following vulnerability that allows a local attacker to escalate privileges locally up to SYSTEM.","ra":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","adv":["https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-81963","https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk","https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk"]},{"id":"CVE-2026-86218","v":"N-able","p":"N-central","n":"N-able N-central Static Code Injection Vulnerability","d":"2026-09-08","due":"2026-09-11","rw":0,"x":"N-able N-central contains a static code injection vulnerability that could allow for pre-authentication remote code execution.","ra":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","adv":["https://status.n-able.com/2026/09/06/n-central-2026-3-hotfix-4-cve-2026-86218/","https://me.n-able.com/s/security-advisory/aArVy0000002Ld3KAE/cve202686218-preauthentication-remote-code-execution","https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk"]},{"id":"CVE-2026-85880","v":"Microsoft","p":"Windows","n":"Microsoft Windows Heap-Based Buffer Overflow Vulnerability","d":"2026-09-08","due":"2026-09-22","rw":0,"x":"Microsoft Windows Advanced Local Procedure Call contains a heap-based buffer overflow vulnerability that allows an attacker to elevate privileges locally.","ra":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","adv":["https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-85880","https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk","https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk"]},{"id":"CVE-2026-85046","v":"Google","p":"Chromium V8","n":"Google Chromium V8 Type Confusion Vulnerability","d":"2026-09-04","due":"2026-09-18","rw":0,"x":"Google Chromium V8 contains a type confusion vulnerability that allows a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.","ra":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","adv":["https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_01882797386.html","https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk","https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk"]},{"id":"CVE-2026-59822","v":"BerriAI","p":"LiteLLM","n":"BerriAI LiteLLM Improper Authentication Vulnerability","d":"2026-09-02","due":"2026-09-16","rw":0,"x":"BerriAI LiteLLM contains an improper authentication vulnerability in the MCP Streamable HTTP endpoint that could allow an unauthenticated attacker to establish an authenticated MCP session using an arbitrary Bearer token.","ra":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","adv":["https://github.com/BerriAI/litellm/security/advisories/GHSA-7488-6r32-c95q","https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk","https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk"]},{"id":"CVE-2026-48710","v":"Kludex","p":"Starlette","n":"Kludex Starlette HTTP Request/Response Smuggling Vulnerability","d":"2026-09-02","due":"2026-09-16","rw":0,"x":"Kludex Starlette contains a HTTP request/response smuggling vulnerability that could allow attackers to inject paths into the host part, prepending the actual path leading to issues such as authentication bypass when the authentication depends on the reconstructed URL’s path. This vulnerability could be chaned with…","ra":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","adv":["https://github.com/Kludex/starlette/security/advisories/GHSA-86qp-5c8j-p5mr","https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk","https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk"]},{"id":"CVE-2026-49869","v":"Kestra","p":"Kestra OSS","n":"Kestra OSS OS Command Injection Vulnerability","d":"2026-09-02","due":"2026-09-05","rw":0,"x":"Kestra OSS contains an OS command injection vulnerability that could allow an unauthenticated remote attacker to create and execute arbitrary workflows without credentials.","ra":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","adv":["https://github.com/kestra-io/kestra/security/advisories/GHSA-5vc5-wxxq-3fjx","https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk","https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk"]},{"id":"CVE-2026-82329","v":"JFrog","p":"Artifactory","n":"JFrog Artifactory Improper Authentication Vulnerability","d":"2026-09-02","due":"2026-09-05","rw":0,"x":"JFrog Artifactory contains an improper authentication vulnerability that under default configuration can allow an unauthenticated attacker with network access to obtain administrative privileges. ","ra":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","adv":["https://docs.jfrog.com/releases/docs/jfrog-security-advisories","https://docs.jfrog.com/releases/docs/artifactory-self-managed-releases","https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk"]},{"id":"CVE-2026-9586","v":"Sangoma","p":"Switchvox","n":"Sangoma Switchvox SQL Injection Vulnerability","d":"2026-09-02","due":"2026-09-05","rw":0,"x":"Sangoma Switchvox contains a SQL injection vulnerability which allows an unauthenticated remote attacker to execute arbitrary SQL statements against the backend PostgreSQL database using a single crafted request, including database operations and remote code execution.","ra":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","adv":["https://sangomakb.atlassian.net/wiki/spaces/Switchvox/pages/1802371073/Switchvox+-+Release+Notes+Version+8.4.0.2+July+14+2026","https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk","https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk"]},{"id":"CVE-2026-83548","v":"SonicWall","p":"SMA1000 Appliances","n":"SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability","d":"2026-09-02","due":"2026-09-05","rw":0,"x":"SonicWall SMA1000 Appliances contains a server-side request forgery vulnerability that could allow a remote unauthenticated attacker to gain unauthorized access to sensitive functionality and perform unauthorized operations.","ra":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","adv":["https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0016","https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk","https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk"]},{"id":"CVE-2026-83549","v":"SonicWall","p":"SMA1000 Appliances","n":"SonicWall SMA1000 Appliances OS Command Injection Vulnerability","d":"2026-09-02","due":"2026-09-05","rw":0,"x":"SonicWall SMA1000 Appliances contains an OS command injection vulnerability that could enable a remote authenticated attacker as administrator to execute arbitrary OS commands, resulting in remote code execution.","ra":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","adv":["https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0016","https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk","https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk"]},{"id":"CVE-2026-82078","v":"PaperCut","p":"NG/MF","n":"PaperCut NG/MF Unsafe Reflection Vulnerability","d":"2026-08-31","due":"2026-09-14","rw":0,"x":"PaperCut NG/MF contains an unsafe reflection vulnerability that allows an attacker to manipulate system configuration parameters and execute arbitrary Java bytecode residing on the application classpath under the security context of the PaperCut server process. This vulnerability can be chained with CVE-2026-81578.","ra":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","adv":["https://www.papercut.com/kb/Main/security-bulletin-27-aug-2026-urgent-security-advisory/?lid=2oneu2wt0ct4","https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk","https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk"]},{"id":"CVE-2026-81578","v":"PaperCut","p":"NG/MF","n":"PaperCut NG/MF Missing Authentication for Critical Function Vulnerability","d":"2026-08-31","due":"2026-09-14","rw":0,"x":"PaperCut NG/MF contains a missing authentication for critical function vulnerability which allows an unauthenticated remote attacker to modify certain system configurations. This vulnerability can be chained with CVE-2026-82078.","ra":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","adv":["https://www.papercut.com/kb/Main/security-bulletin-27-aug-2026-urgent-security-advisory/","https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk","https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk"]},{"id":"CVE-2023-49105","v":"ownCloud","p":"ownCloud","n":"ownCloud Improper Authentication Vulnerability","d":"2026-08-27","due":"2026-08-30","rw":0,"x":"ownCloud contains an improper authentication vulnerability that allows an attacker to access, modify, or delete any file without authentication if the username of a victim is known, and the victim has no signing-key configured.","ra":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","adv":["https://owncloud.org/security","https://owncloud.com/security-advisories/webdav-api-authentication-bypass-using-pre-signed-urls/","https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk"]},{"id":"CVE-2026-53362","v":"Linux","p":"Kernel","n":"Linux Kernel Unspecified Vulnerability","d":"2026-08-27","due":"2026-08-30","rw":0,"x":"Linux Kernel contains an unspecified vulnerability that can allow for privilege escalation via IPv6 networking subsystem. This vulnerability can impact multiple products, including but not limited to Suse, Red Hat, and other products using Linux. ","ra":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","adv":["https://git.kernel.org/stable/c/14200d435af9a9eeb444f529fc2f689a236b7962","https://git.kernel.org/stable/c/65fb14cbebb0cd0eff903a22d33537ddc8b95769","https://git.kernel.org/stable/c/46f201f8b4c39633a1fa3dc12459f506d470993d"]},{"id":"CVE-2026-66384","v":"JFrog","p":"Artifactory","n":"JFrog Artifactory Improper Limitation of a Pathname to a Restricted Directory Vulnerability","d":"2026-08-27","due":"2026-09-10","rw":0,"x":"JFrog Artifactory contains an improper limitation of a pathname to a restricted directory vulnerability. This can allow an authenticated user to write data outside the intended Docker cache path under specific remote-repository conditions.","ra":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","adv":["https://docs.jfrog.com/releases/docs/jfrog-security-advisories","https://docs.jfrog.com/releases/docs/artifactory-self-managed-releases","https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk"]},{"id":"CVE-2021-23758","v":"Ajax.NET Professional","p":"Ajax.NET Professional","n":"Ajax.NET Professional Deserialization of Untrusted Data Vulnerability","d":"2026-08-26","due":"2026-09-09","rw":0,"x":"Ajax.NET Professional (AjaxPro) contains a deserialization of untrusted data vulnerability that could allow for remote code execution via arbitrary .NET classes. The impacted product(s) could be end-of-life (EoL) and/or end-of-service (EoS). Users are advised to discontinue use and/or transition to a supported version.","ra":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","adv":["https://github.com/michaelschwarz/Ajax.NET-Professional/commit/b0e63be5f0bb20dfce507cb8a1a9568f6e73de57","https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk","https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk"]},{"id":"CVE-2015-3246","v":"Red Hat","p":"Libuser","n":"Red Hat Libuser Race Condition Vulnerability","d":"2026-08-26","due":"2026-09-09","rw":0,"x":"Red Hat libuser contains a race condition vulnerability that allows authenticated local users to corrupt the /etc/passwd file to cause a denial of service or privilege escalation. ","ra":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","adv":["https://access.redhat.com/articles/1537873","https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk","https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk"]},{"id":"CVE-2015-5287","v":"Red Hat","p":"Automatic Bug Reporting Tool","n":"Red Hat Automatic Bug Reporting Tool Privilege Escalation Vulnerability","d":"2026-08-26","due":"2026-09-09","rw":0,"x":"Red Hat Automatic Bug Reporting Tool (ABRT) contains a privilege escalation vulnerability that could allow local users with certain permissions to gain privileges via a symlink attack on a file with a predictable name. The impacted product(s) could be end-of-life (EoL) and/or end-of-service (EoS). Users are advised to…","ra":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","adv":["https://github.com/abrt/abrt/commit/3c1b60cfa62d39e5fff5a53a5bc53dae189e740e","https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk","https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk"]},{"id":"CVE-2022-0995","v":"Linux","p":"Kernel","n":"Linux Kernel Out-of-Bounds Write Vulnerability","d":"2026-08-26","due":"2026-08-29","rw":0,"x":"Linux Kernel contains an out-of-bounds memory write vulnerability which could allow a local user to gain privileged access or cause a denial of service on the system.","ra":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","adv":["https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=93ce93587d36493f2f86921fa79921b3cba63fbb","https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk","https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk"]},{"id":"CVE-2026-8452","v":"Citrix","p":"NetScaler ADC and NetScaler Gateway","n":"Citrix NetScaler ADC and NetScaler Gateway Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability","d":"2026-08-26","due":"2026-08-29","rw":0,"x":"Citrix NetScaler ADC and NetScaler Gateway contain an improper restriction of operations within the bounds of a memory buffer vulnerability which could lead to denial of service. ","ra":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","adv":["https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX696604","https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk","https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk"]},{"id":"CVE-2019-1068","v":"Microsoft","p":"SQL Server","n":"Microsoft SQL Server Remote Code Execution Vulnerability","d":"2026-08-26","due":"2026-08-29","rw":0,"x":"Microsoft SQL Server contains a remote code execution vulnerability that could allow an attacker to execute code in the context of the SQL Server Database Engine service account.","ra":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","adv":["https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1068","https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk","https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk"]},{"id":"CVE-2026-60004","v":"Gitea","p":"Gitea","n":"Gitea Code Injection Vulnerability","d":"2026-08-25","due":"2026-08-28","rw":0,"x":"Gitea contains a code injection vulnerability that allows an attacker with repository write access to send a malicious patch to the diffpatch API endpoint to plant an executable Git hook and run shell commands as the Gitea service account.","ra":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","adv":["https://github.com/go-gitea/gitea/security/advisories/GHSA-rcr6-4jqh-j84m","https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk","https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk"]},{"id":"CVE-2026-21962","v":"Oracle","p":"HTTP Server and Oracle Weblogic Server Proxy Plug-in","n":"Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in Improper Access Control Vulnerability","d":"2026-08-24","due":"2026-08-27","rw":0,"x":"Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in contain an improper access control vulnerability that can result in unauthorized creation, deletion or modification access to critical data as well as unauthorized access to critical data or complete access to all Oracle HTTP Server and Oracle Weblogic Server…","ra":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","adv":["https://www.oracle.com/security-alerts/cpujan2026.html","https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk","https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk"]},{"id":"CVE-2026-73570","v":"Synacor","p":"Zimbra Collaboration Suite (ZCS)","n":"Zimbra Collaboration Suite (ZCS) OS Command Injection Vulnerability","d":"2026-08-21","due":"2026-08-24","rw":0,"x":"Zimbra Collaboration Suite (ZCS) contains an OS command injection vulnerability which could allow an unauthenticated attacker to send specially crafted SMTP requests that may result in execution of arbitrary operating system commands as the Zimbra user.","ra":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","adv":["https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories","https://blog.zimbra.com/2026/07/patch-release-update-zimbra-10-1-20/","https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk"]},{"id":"CVE-2026-72530","v":"TrueConf","p":"Server","n":"TrueConf Server Code Injection Vulnerability","d":"2026-08-20","due":"2026-09-03","rw":0,"x":"TrueConf Server contains a code injection vulnerability that could allow an unauthorized remote attacker with network access via port 4307/TCP to use a specially crafted script to break out of the isolated environment and execute arbitrary code on the host system.","ra":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","adv":["https://trueconf.com/blog/news/security-fixes-updates-and-advisories","https://ics-cert.kaspersky.com/advisories/2026/08/11/trueconf-server-breakout-from-isolated-environment/","https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk"]},{"id":"CVE-2026-72529","v":"TrueConf","p":"Server","n":"TrueConf Server Missing Authentication for Critical Function Vulnerability","d":"2026-08-20","due":"2026-08-23","rw":0,"x":"TrueConf Server contains a missing authentication for critical function vulnerability which could allow a remote unauthorized attacker with network access via port 4307/TCP to execute an arbitrary script.","ra":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","adv":["https://trueconf.com/blog/news/security-fixes-updates-and-advisories","https://ics-cert.kaspersky.com/advisories/2026/08/11/trueconf-server-missing-authentication-for-critical-function/","https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk"]},{"id":"CVE-2026-64849","v":"MLflow","p":"MLflow","n":"MLflow Server-Side Request Forgery Vulnerability","d":"2026-08-19","due":"2026-09-02","rw":0,"x":"MLflow contains a server-side request forgery vulnerability that can allow attackers to reach internal or cloud metadata services and receive response_status and response_body.","ra":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","adv":["https://github.com/mlflow/mlflow/pull/24258","https://github.com/mlflow/mlflow/issues/24179","https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk"]},{"id":"CVE-2026-33824","v":"Microsoft","p":"Internet Key Exchange (IKE) Service Extensions","n":"Microsoft Internet Key Exchange (IKE) Service Extensions Double Free Vulnerability","d":"2026-08-18","due":"2026-08-21","rw":0,"x":"Microsoft Internet Key Exchange (IKE) Service Extensions contains a double free vulnerability that could enable remote code execution.","ra":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","adv":["https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-33824","https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk","https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk"]},{"id":"CVE-2026-59310","v":"Broadcom","p":"VMware vCenter","n":"Broadcom VMware vCenter Path Traversal Vulnerability","d":"2026-08-18","due":"2026-08-21","rw":1,"x":"Broadcom VMware vCenter contains a path traversal vulnerability which could allow a threat actor with network access to vCenter to execute arbitrary code.","ra":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","adv":["https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/38017","https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk","https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk"]},{"id":"CVE-2026-55040","v":"Microsoft","p":"SharePoint","n":"Microsoft SharePoint Weak Authentication Vulnerability","d":"2026-08-18","due":"2026-08-21","rw":0,"x":"Microsoft SharePoint contains a weak authentication vulnerability which allows an unauthorized attacker to bypass a security feature over a network.","ra":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","adv":["https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55040","https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk","https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk"]},{"id":"CVE-2026-65400","v":"Apple","p":"macOS","n":"Apple macOS Improper Authentication Vulnerability","d":"2026-08-18","due":"2026-08-21","rw":0,"x":"Apple macOS contains an improper authentication vulnerability that could allow an attacker on the network to authenticate to Screen Sharing without valid credentials.","ra":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","adv":["https://support.apple.com/en-us/148170","https://support.apple.com/en-us/148171","https://support.apple.com/en-us/148172"]},{"id":"CVE-2025-62593","v":"Ray-Project","p":"Ray","n":"Ray-Project Ray Code Injection Vulnerability","d":"2026-08-17","due":"2026-08-20","rw":0,"x":"Ray-Project Ray contains a code injection vulnerability that could allow remote code execution. Developers using Ray as a development tool may be exposed to this vulnerability exploitable through Firefox and Safari.","ra":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","adv":["https://github.com/ray-project/ray/security/advisories/GHSA-q279-jhrf-cc6v","https://github.com/ray-project/ray/commit/70e7c72780bdec075dba6cad1afe0832772bfe09","https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk"]},{"id":"CVE-2026-20349","v":"Cisco","p":"Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) ","n":"Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) Heap Inspection Vulnerability","d":"2026-08-11","due":"2026-08-14","rw":0,"x":"Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) contain a heap inspection vulnerability that could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly, resulting in a denial of service (DoS) condition.","ra":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","adv":["https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-vpn-dos-dzv4mQFF","https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk","https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk"]},{"id":"CVE-2026-68820","v":"Microsoft","p":"Windows Ancillary Function Driver for WinSock ","n":"Microsoft Windows Ancillary Function Driver for WinSock Use-After-Free Vulnerability","d":"2026-08-11","due":"2026-08-25","rw":0,"x":"Microsoft Windows Ancillary Function Driver for WinSock contains a use-after-free vulnerability that allows an authorized attacker to elevate privileges locally.","ra":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","adv":["https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-68820","https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk","https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk"]},{"id":"CVE-2026-72898","v":"Metabase","p":"Metabase","n":"Metabase SQL Injection Vulnerability","d":"2026-08-11","due":"2026-08-14","rw":0,"x":"Metabase contains a SQL Injection vulnerability that allows an unauthenticated remote attacker to inject arbitrary SQL into the Metabase application database, which can give them administrator access to the instance. From there, the attacker could change the application configuration, steal stored credentials for the…","ra":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","adv":["https://www.metabase.com/blog/security-update","https://github.com/metabase/metabase/security/advisories/GHSA-vwf4-m7j8-wcjf","https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk"]},{"id":"CVE-2026-8037","v":"Progress","p":"LoadMaster","n":"Progress LoadMaster Command Injection Vulnerability","d":"2026-08-07","due":"2026-08-10","rw":0,"x":"Progress LoadMaster contains a command injection vulnerability that allows an un-authenticated attacker to execute arbitrary commands on the LoadMaster appliance by exploiting unsanitized input in multiple command endpoints.","ra":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","adv":["https://community.progress.com/s/article/LoadMaster-Critical-Security-Bulletin-June-2026-CVE-2026-8037-CVE-2026-33691","https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk","https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk"]},{"id":"CVE-2026-63077","v":"JetBrains","p":"TeamCity","n":"JetBrains TeamCity Deserialization of Untrusted Data Vulnerability","d":"2026-08-05","due":"2026-08-08","rw":1,"x":"JetBrains TeamCity contains a deserialization of untrusted data vulnerability that could allow unauthenticated remote code execution via the agent polling protocol.","ra":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","adv":["https://blog.jetbrains.com/teamcity/2026/07/cve-2026-63077/","https://www.jetbrains.com/privacy-security/issues-fixed/","https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk"]},{"id":"CVE-2026-18556","v":"N-able","p":"N-central","n":"N-able N-central Authentication Bypass Using an Alternate Path or Channel Vulnerability","d":"2026-08-04","due":"2026-08-07","rw":0,"x":"N-able N-central contains an authentication bypass using an alternate path or channel that allows for authentication bypass.","ra":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","adv":["https://uptime.n-able.com/","https://status.n-able.com/2026/08/02/n-central-2026-3-hotfix-1-mitigation-for-cve-2026-18577/","https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk"]},{"id":"CVE-2026-34486","v":"Apache","p":"Tomcat","n":"Apache Tomcat Missing Encryption of Sensitive Data Vulnerability","d":"2026-08-04","due":"2026-08-07","rw":0,"x":"Apache Tomcat contains a missing encryption of sensitive data vulnerability that allows the bypass of the EncryptInterceptor. This vulnerability can be chained with CVE‑2025‑24813.","ra":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","adv":["https://lists.apache.org/thread/9510k5p5zdvt9pkkgtyp85mvwxo2qrly","https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk","https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk"]},{"id":"CVE-2026-9198","v":"IBM","p":"Langflow","n":"IBM Langflow Code Injection Vulnerability","d":"2026-08-04","due":"2026-08-07","rw":0,"x":"Langflow contains a code injection vulnerability that allows unauthenticated attackers to achieve full remote code execution on default Langflow deployments.","ra":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","adv":["https://www.ibm.com/support/pages/node/7278927","https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk","https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk"]},{"id":"CVE-2026-18577","v":"N-able","p":"N-central","n":"N-able N-central Authentication Bypass Using an Alternate Path or Channel Vulnerability","d":"2026-08-03","due":"2026-08-06","rw":0,"x":"N-able N-central contains an authentication bypass using an alternate path or channel allows for authentication bypass and account takeover in N-central. This vulnerability is the result of an incomplete patch for CVE-2026-18556.","ra":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","adv":["https://documentation.n-able.com/N-central/Release_Notes/GA/Content/N-central_2026.3_HF1_Release_Notes.htm","https://status.n-able.com/2026/08/02/n-central-2026-3-hotfix-1-mitigation-for-cve-2026-18577/","https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk"]},{"id":"CVE-2026-20316","v":"Cisco","p":"Secure Firewall Management Center (FMC)","n":"Cisco Secure Firewall Management Center Use of Hard-coded Password Vulnerability","d":"2026-07-29","due":"2026-08-01","rw":1,"x":"Cisco Secure Firewall Management Center (FMC) formerly known as Firepower Management Center contains a use of hard-coded password vulnerability that could allow an unauthenticated, remote attacker to log in to an affected device using a low-privileged account to access sensitive data within the impacted systems.","ra":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","adv":["https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fmc-static-cred-BET3Cjh","https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk","https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk"]},{"id":"CVE-2025-68686","v":"Fortinet","p":"FortiOS","n":"Fortinet FortiOS Exposure of Sensitive Information to an Unauthorized Actor Vulnerability","d":"2026-07-27","due":"2026-08-10","rw":0,"x":"Fortinet FortiOS contains an exposure of sensitive information to an unauthorized actor vulnerability. This may allow a remote unauthenticated attacker to bypass the patch developed for the symbolic link persistency mechanism observed in some post-exploit cases, via crafted HTTP requests. An attacker would need first…","ra":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","adv":["https://fortiguard.fortinet.com/psirt/FG-IR-25-934","https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk","https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk"]},{"id":"CVE-2026-16812","v":"Arista","p":"VeloCloud Orchestrator","n":"Arista VeloCloud Orchestrator On-Prem OS Command Injection Vulnerability","d":"2026-07-27","due":"2026-07-30","rw":0,"x":"Arista VeloCloud Orchestrator On-Prem contains an OS command injection vulnerability that may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the…","ra":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","adv":["https://www.arista.com/en/support/advisories-notices/security-advisory/24364-security-advisory-0144","https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk","https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk"]},{"id":"CVE-2026-16232","v":"Check Point","p":"SmartConsole","n":"Check Point SmartConsole Improper Authentication Vulnerability","d":"2026-07-22","due":"2026-07-25","rw":0,"x":"Check Point SmartConsole contains an improper authentication vulnerability which could allow an unauthenticated remote attacker to obtain an application login token and use it to authenticate with full administrative privileges.","ra":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","adv":["https://support.checkpoint.com/results/sk/sk185169/","https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk","https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk"]},{"id":"CVE-2026-50522","v":"Microsoft","p":"SharePoint","n":"Microsoft SharePoint Deserialization of Untrusted Data Vulnerability ","d":"2026-07-22","due":"2026-07-25","rw":0,"x":"Microsoft SharePoint contains a deserialization of untrusted data vulnerability which could allow an unauthorized attacker to execute code over a network.","ra":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","adv":["https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50522","https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk","https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk"]},{"id":"CVE-2026-60137","v":"WordPress","p":"Core","n":"WordPress Core SQL Injection Vulnerability","d":"2026-07-21","due":"2026-08-04","rw":0,"x":"WordPress Core contains a SQL injection vulnerability when a plugin or theme passes untrusted input to the parameter. This vulnerability can be chained with CVE-2026-63030 to allow an unauthenticated attacker to gain remote code execution on default WordPress installations.","ra":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","adv":["https://wordpress.org/news/2026/07/wordpress-7-0-2-release/","https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk","https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk"]},{"id":"CVE-2026-63030","v":"WordPress","p":"Core","n":"WordPress Core Interpretation Conflict Vulnerability","d":"2026-07-21","due":"2026-07-24","rw":0,"x":"WordPress Core contains an interpretation conflict vulnerability that could allow an attacker to perform SQL Injection and achieve Remote Code Execution. This vulnerability can be chained with CVE-2026-60137.","ra":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","adv":["https://wordpress.org/news/2026/07/wordpress-7-0-2-release/","https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk","https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk"]},{"id":"CVE-2026-0770","v":"Langflow","p":"Langflow","n":"Langflow Inclusion of Functionality from Untrusted Control Sphere Vulnerability","d":"2026-07-21","due":"2026-07-24","rw":0,"x":"Langflow contains an inclusion of functionality from untrusted control sphere vulnerability that allows remote attackers to execute arbitrary code on affected installations. ","ra":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","adv":["https://github.com/langflow-ai/langflow/releases/tag/v1.9.0","https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk","https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk"]},{"id":"CVE-2021-27137","v":"DD-WRT","p":"DD-WRT","n":"DD-WRT Stack-Based Buffer Overflow Vulnerability","d":"2026-07-21","due":"2026-07-24","rw":0,"x":"DD-WRT contains a stack-based buffer overflow vulnerability that could allow an unauthenticated attacker to overflow an internal buffer used by UPnP and trigger a code execution vulnerability.","ra":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","adv":["https://svn.dd-wrt.com/changeset/45724","https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk","https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk"]},{"id":"CVE-2026-58644","v":"Microsoft","p":"SharePoint","n":"Microsoft SharePoint Deserialization of Untrusted Data Vulnerability","d":"2026-07-16","due":"2026-07-19","rw":0,"x":"Microsoft SharePoint contains a deserialization of untrusted data vulnerability that allows an unauthorized attacker to execute code over a network.","ra":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","adv":["https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58644","https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk","https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk"]},{"id":"CVE-2026-25089","v":"Fortinet","p":"FortiSandbox","n":"Fortinet FortiSandbox OS Command Injection Vulnerability","d":"2026-07-16","due":"2026-07-19","rw":0,"x":"Fortinet FortiSandbox, FortiSandbox Cloud, and FortiSandbox PaaS contain an OS command injection vulnerability that allows an unauthenticated attacker to execute unauthorized commands via specifically crafted HTTP requests.","ra":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","adv":["https://fortiguard.fortinet.com/psirt/FG-IR-26-141","https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk","https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk"]},{"id":"CVE-2026-39808","v":"Fortinet","p":"FortiSandbox","n":"Fortinet FortiSandbox OS Command Injection Vulnerability","d":"2026-07-16","due":"2026-07-19","rw":0,"x":"Fortinet FortiSandbox contains an OS command injection vulnerability that could allow an unauthenticated attacker to execute unauthorized code or commands via crafted HTTP requests.","ra":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","adv":["https://fortiguard.fortinet.com/psirt/FG-IR-26-100","https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk","https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk"]},{"id":"CVE-2026-46817","v":"Oracle","p":"E-Business Suite","n":"Oracle E-Business Suite Improper Privilege Management Vulnerability","d":"2026-07-15","due":"2026-07-18","rw":0,"x":"Oracle E-Business Suite contains an improper privilege management vulnerability that allows an unauthenticated attacker with network access via HTTP to compromise Oracle Payments. Successful attacks of this vulnerability can result in takeover of Oracle Payments.","ra":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","adv":["https://www.oracle.com/security-alerts/cspumay2026.html","https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk","https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk"]},{"id":"CVE-2023-4346","v":"KNX Association","p":"KNX Protocol Connection Authorization Option 1","n":"KNX Association KNX Protocol Connection Authorization Option 1 Overly Restrictive Account Lockout Mechanism Vulnerability","d":"2026-07-15","due":"2026-07-29","rw":0,"x":"KNX Association KNX Protocol Connection Authorization Option 1 contains an overly restrictive account lockout mechanism vulnerability that could allow an attacker to purge all devices without additional security options enabled and set a BCU key to lock the device. ","ra":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","adv":["https://www.cisa.gov/news-events/ics-advisories/icsa-23-236-01","https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk","https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk"]},{"id":"CVE-2026-56155","v":"Microsoft","p":"Active Directory Federation Services","n":"Microsoft Active Directory Federation Services Insufficient Granularity of Access Control Vulnerability ","d":"2026-07-14","due":"2026-07-28","rw":0,"x":"Microsoft Active Directory Federation Services contains an insufficient granularity of access control vulnerability that allows an authorized attacker to elevate privileges locally.","ra":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","adv":["https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-56155","https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk","https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk"]},{"id":"CVE-2026-56164","v":"Microsoft","p":"SharePoint Server","n":"Microsoft SharePoint Server Missing Authentication for Critical Function Vulnerability","d":"2026-07-14","due":"2026-07-17","rw":0,"x":"Microsoft SharePoint contains a missing authentication for critical function vulnerability that allows an unauthorized attacker to elevate privileges over a network.","ra":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","adv":["https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-56164","https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk","https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk"]},{"id":"CVE-2026-15409","v":"SonicWall","p":"SMA1000 Appliances","n":"SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability","d":"2026-07-14","due":"2026-07-17","rw":1,"x":"SonicWall SMA1000 Appliances contain a server-side request forgery vulnerability that could allow a remote unauthenticated attacker to potentially cause the appliance to make requests to unintended location.","ra":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","adv":["https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0008","https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk","https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk"]},{"id":"CVE-2026-15410","v":"SonicWall","p":"SMA1000 Appliances","n":"SonicWall SMA1000 Appliances Code Injection Vulnerability","d":"2026-07-14","due":"2026-07-17","rw":1,"x":"SonicWall SMA1000 Appliances contain a code injection vulnerability which in specific conditions could potentially enable a remote authenticated attacker as administrator to execute arbitrary OS commands.","ra":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","adv":["https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0008","https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk","https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk"]},{"id":"CVE-2008-4128","v":"Cisco","p":"IOS","n":"Cisco IOS Cross-Site Request Forgery Vulnerability","d":"2026-07-13","due":"2026-07-16","rw":0,"x":"Cisco IOS 12.4 contains multiple cross-site forgery vulnerabilities that allows remote attackers to execute arbitrary commands via (1) a certain \"show privilege\" command to the /level/15/exec/- URI, and (2) a certain \"alias exec\" command to the /level/15/exec/-/configure/http URI.","ra":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","adv":["https://www.cisco.com/c/en/us/obsolete/ios-nx-os-software/cisco-ios-software-releases-12-4-mainline.html","https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk","https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk"]},{"id":"CVE-2026-56291","v":"Balbooa","p":"Forms","n":"Balbooa Forms Unrestricted Upload of File with Dangerous Type Vulnerability","d":"2026-07-10","due":"2026-07-13","rw":0,"x":"Balbooa Forms contains an unrestricted upload of file with dangerous type vulnerability that allows an unauthenticated arbitrary file upload which could allow uploading of executable files leading to full RCE.","ra":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","adv":["https://www.balbooa.com/joomla-forms","https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk","https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk"]},{"id":"CVE-2026-48939","v":"iCagenda","p":"iCagenda","n":"iCagenda Unrestricted Upload of File with Dangerous Type Vulnerability","d":"2026-07-10","due":"2026-07-13","rw":0,"x":"iCagenda contains an unrestricted upload of file with dangerous type vulnerability that allows the upload of arbitrary files in the file attachment feature, ultimately resulting in PHP code upload and execution.","ra":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","adv":["https://www.icagenda.com/#download","https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk","https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk"]},{"id":"CVE-2026-48908","v":"JoomShaper","p":"SP Page Builder","n":"JoomShaper SP Page Builder Unrestricted Upload of File with Dangerous Type Vulnerability","d":"2026-07-07","due":"2026-07-10","rw":0,"x":"JoomShaper SP Page Builder contains an unrestricted upload of file with dangerous type vulnerability that allows unauthenticated users to upload arbitrary files, ultimately resulting in the upload and execution of PHP code.","ra":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","adv":["https://extensions.joomla.org/extension/sp-page-builder/","https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk","https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk"]},{"id":"CVE-2026-55255","v":"Langflow","p":"Langflow","n":"Langflow Authorization Bypass Through User-Controlled Key Vulnerability","d":"2026-07-07","due":"2026-07-10","rw":0,"x":"Langflow contains an authorization bypass through user-controlled key vulnerability which allows an authenticated attacker to execute any flow belonging to another user by specifying the victim's flow ID in the request.","ra":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","adv":["https://github.com/langflow-ai/langflow/security/advisories/GHSA-qrpv-q767-xqq2","https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk","https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk"]},{"id":"CVE-2026-56290","v":"Joomlack","p":"Page Builder","n":"Joomlack Page Builder Improper Access Control Vulnerability","d":"2026-07-07","due":"2026-07-10","rw":0,"x":"Joomlack Page Builder contains an improper access control vulnerability that could allow for remote code execution via unauthenticated arbitrary file upload.","ra":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","adv":["https://www.joomlack.fr/en/joomla-extensions/page-builder-ck","https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk","https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk"]},{"id":"CVE-2026-48282","v":"Adobe","p":"ColdFusion","n":"Adobe ColdFusion Path Traversal Vulnerability","d":"2026-07-07","due":"2026-07-10","rw":0,"x":"Adobe ColdFusion contains a path traversal vulnerability that could lead to arbitrary code execution in the context of the current user.","ra":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","adv":["https://helpx.adobe.com/security/products/coldfusion/apsb26-68.html","https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk","https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk"]},{"id":"CVE-2026-45659","v":"Microsoft","p":"SharePoint Server","n":"Microsoft SharePoint Server Deserialization of Untrusted Data Vulnerability","d":"2026-07-01","due":"2026-07-04","rw":1,"x":"Microsoft SharePoint Server contains a deserialization of untrusted data vulnerability which allows an authorized attacker to execute code over a network.","ra":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","adv":["https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45659","https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk","https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk"]},{"id":"CVE-2026-48558","v":"SimpleHelp ","p":"SimpleHelp","n":"SimpleHelp Authentication Bypass Vulnerability","d":"2026-06-29","due":"2026-07-02","rw":0,"x":"SimpleHelp contains an authentication bypass vulnerability in the OIDC authentication flow. When OIDC authentication is configured, identity tokens submitted during login are accepted without verifying their cryptographic signature. In a vulnerable configuration, a remote, unauthenticated attacker can submit a forged…","ra":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","adv":["https://simple-help.com/security/simplehelp-security-update-2026-05","https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk","https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk"]},{"id":"CVE-2026-12569","v":"PTC","p":"Windchill and FlexPLM","n":"PTC Windchill and FlexPLM Improper Input Validation Vulnerability","d":"2026-06-25","due":"2026-06-28","rw":1,"x":"PTC Windchill and FlexPLM contains an improper input validation vulnerability allowing an unauthenticated, remote attacker to execute arbitrary code by sending a malicious request to the network.","ra":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","adv":["https://www.ptc.com/en/support/article/CS473270","https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk","https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk"]},{"id":"CVE-2026-20230","v":"Cisco","p":"Unified Communications Manager","n":"Cisco Unified Communications Manager Server-Side Request Forgery (SSRF) Vulnerability","d":"2026-06-25","due":"2026-06-28","rw":0,"x":"Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME) contain a server-side request forgery (SSRF) Vulnerability that could allow an unauthenticated, remote attacker to write files to the underlying operating system that could be used…","ra":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","adv":["https://www.cisco.com/c/en/us/support/docs/csa/cisco-sa-cucm-ssrf-cXPnHcW.html","https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk","https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk"]},{"id":"CVE-2025-67038","v":"Lantronix","p":"EDS5000","n":"Lantronix EDS5000 Code Injection Vulnerability","d":"2026-06-23","due":"2026-06-26","rw":0,"x":"Lantronix EDS5000 contains a code injection vulnerability that could allow attackers to inject arbitrary OS commands into the username parameter. Injected commands are executed with root privileges.","ra":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","adv":["https://ltrxdev.atlassian.net/wiki/spaces/LTRXTS/pages/2538438657/Latest+Firmware+for+the+EDS5000+series+EDS5008+EDS5016+EDS5032","https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk","https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk"]},{"id":"CVE-2026-34910","v":"Ubiquiti","p":"UniFi OS","n":"Ubiquiti UniFi OS Improper Input Validation Vulnerability","d":"2026-06-23","due":"2026-06-26","rw":0,"x":"Ubiquiti UniFi OS contains an improper input validation vulnerability which could allow a malicious actor with access to the network to conduct command injection.","ra":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","adv":["https://community.ui.com/releases/Security-Advisory-Bulletin-064-064/84811c09-4cf4-42ab-bd61-cc994445963b","https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk","https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk"]},{"id":"CVE-2026-34909","v":"Ubiquiti","p":"UniFi OS","n":"Ubiquiti UniFi OS Path Traversal Vulnerability","d":"2026-06-23","due":"2026-06-26","rw":0,"x":"Ubiquiti UniFi OS contains a path traversal vulnerability which could allow a malicious actor with access to the network to access files on the underlying system that could be manipulated to access an underlying account.","ra":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","adv":["https://community.ui.com/releases/Security-Advisory-Bulletin-064-064/84811c09-4cf4-42ab-bd61-cc994445963b","https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk","https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk"]},{"id":"CVE-2026-34908","v":"Ubiquiti","p":"UniFi OS","n":"Ubiquiti UniFi OS Improper Access Control Vulnerability","d":"2026-06-23","due":"2026-06-26","rw":0,"x":"Ubiquiti UniFi OS contains an improper access control vulnerability which could allow a malicious actor with access to the network to make unauthorized changes to the system.","ra":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","adv":["https://community.ui.com/releases/Security-Advisory-Bulletin-064-064/84811c09-4cf4-42ab-bd61-cc994445963b","https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk","https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk"]},{"id":"CVE-2026-20253","v":"Splunk","p":"Enterprise","n":"Splunk Enterprise Missing Authentication for Critical Function Vulnerability","d":"2026-06-18","due":"2026-06-21","rw":0,"x":"Splunk Enterprise contains a missing authentication for critical function vulnerability which could allow an unauthenticated user to create or truncate arbitrary files through a PostgreSQL sidecar service endpoint.","ra":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","adv":["https://advisory.splunk.com/advisories/SVD-2026-0603","https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk","https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk"]},{"id":"CVE-2026-48907","v":"Widget Factory","p":"Joomla Content Editor ","n":"Widget Factory Joomla Content Editor Improper Access Control Vulnerability","d":"2026-06-16","due":"2026-06-19","rw":0,"x":"Widget Factory Joomla Content Editor contains an improper access control vulnerability which could allow for upload and execution of PHP code via the creation of new editor profiles for unauthenticated users. ","ra":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","adv":["https://www.joomlacontenteditor.net/news/jce-security-update-and-a-free-patch-for-older-sites","https://www.joomlacontenteditor.net/support/changelog/editor","https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk"]},{"id":"CVE-2026-54420","v":"LiteSpeed","p":"cPanel Plugin","n":"LiteSpeed cPanel Plugin UNIX Symbolic Link (Symlink) Following Vulnerability","d":"2026-06-15","due":"2026-06-18","rw":0,"x":"LiteSpeed cPanel plugin contains a UNIX symbolic link (Symlink) following vulnerability that could allow a user with FTP or web shell access on a shared hosting server running CloudLinux/CageFS.","ra":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","adv":["https://blog.litespeedtech.com/2026/06/01/security-update-for-litespeed-cpanel-plugin-2/","https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk","https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk"]},{"id":"CVE-2026-20262","v":"Cisco","p":"Catalyst SD-WAN Manager","n":"Cisco Catalyst SD-WAN Manager Directory or Path Traversal Vulnerability","d":"2026-06-15","due":"2026-06-29","rw":0,"x":"Cisco Catalyst SD-WAN Manager contains a directory or path traversal vulnerability that could allow an authenticated, remote attacker to create a file or overwrite any file on the filesystem of an affected system.","ra":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","adv":["https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-arbfw-c2rZvQ","https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk","https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk"]},{"id":"CVE-2026-35273","v":"Oracle","p":" PeopleSoft Enterprise PeopleTools","n":"Oracle PeopleSoft Enterprise PeopleTools Missing Authentication for Critical Function Vulnerability","d":"2026-06-12","due":"2026-06-15","rw":1,"x":"Oracle PeopleSoft Enterprise PeopleTools contains a missing authentication for critical function vulnerability which could allow an unauthenticated attacker to obtain takeover of PeopleSoft Enterprise PeopleTools.","ra":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","adv":["https://www.oracle.com/security-alerts/alert-cve-2026-35273.html","https://support.oracle.com/signin/","https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk"]},{"id":"CVE-2026-10520","v":"Ivanti","p":"Sentry","n":"Ivanti Sentry OS Command Injection Vulnerability","d":"2026-06-11","due":"2026-06-14","rw":0,"x":"Ivanti Sentry (formerly known as MobileIron Sentry) contains an OS command injection vulnerability which could allow a remote unauthenticated user to achieve root-level remote code execution. This vulnerability can be successfully exploited in cases where the Sentry appliance is in an unmanaged state with its…","ra":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","adv":["https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Sentry-CVE-2026-10520-CVE-2026-10523?language=en_US","https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk","https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk"]},{"id":"CVE-2026-11645","v":"Google","p":"Chromium V8","n":"Google Chromium V8 Out-of-Bounds Read and Write Vulnerability","d":"2026-06-09","due":"2026-06-23","rw":0,"x":"Google Chromium V8 out-of-bounds read and write vulnerability that could allow a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.","ra":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","adv":["https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0153744567.html","https://issues.chromium.org/issues/506689381"]},{"id":"CVE-2026-7473","v":"Arista","p":"Extensible Operating System","n":"Arista Extensible Operating System Incomplete Comparison with Missing Factors Vulnerability","d":"2026-06-09","due":"2026-06-23","rw":0,"x":"Arista Extensible Operating System (EOS) contains an incomplete comparison with missing factors vulnerability when the switch incorrectly decapsulate and forwards other unexpected tunneled packet with a destination IP matching its configured decapsulation IP.","ra":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","adv":["https://www.arista.com/en/support/advisories-notices/security-advisory/24005-security-advisory-0137"]},{"id":"CVE-2026-20245","v":"Cisco","p":"Catalyst SD-WAN Manager","n":"Cisco Catalyst SD-WAN Manager Improper Encoding or Escaping of Output Vulnerability","d":"2026-06-09","due":"2026-06-23","rw":0,"x":"Cisco Catalyst SD-WAN Manager formerly SD-WAN vManage contains an improper encoding or escaping of output vulnerability. This vulnerability could allow an authenticated, local attacker to execute arbitrary commands as root by supplying a crafted file to the affected system.","ra":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","adv":["https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-privesc-4uxFrdzx"]},{"id":"CVE-2026-42271","v":"BerriAI","p":"LiteLLM","n":"BerriAI LiteLLM Command Injection Vulnerability","d":"2026-06-08","due":"2026-06-22","rw":0,"x":"BerriAI LiteLLM contains a command injection vulnerability that could allow any authenticated user, including holders of low-privilege internal-user keys, to run arbitrary commands on the host.","ra":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","adv":["https://github.com/BerriAI/litellm/security/advisories/GHSA-v4p8-mg3p-g94g","https://github.com/BerriAI/litellm/releases/tag/v1.83.7-stable"]},{"id":"CVE-2026-50751","v":"Check Point","p":"Security Gateway","n":"Check Point Security Gateway Improper Authentication Vulnerability","d":"2026-06-08","due":"2026-06-11","rw":1,"x":"Check Point Security Gateway contains an improper authentication vulnerability in IKEv1 key exchange that could allow an unauthenticated remote attacker to bypass user authentication and establish a remote access VPN connection without a valid user password.","ra":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","adv":["https://blog.checkpoint.com/security/check-point-releases-important-hotfix-for-vulnerabilities-in-deprecated-ikev1-vpn-protocol/","https://support.checkpoint.com/results/sk/sk185033?_gl=1*1wqeqhc*_gcl_au*MTI1MzE5MjI2LjE3ODA5MzQ1NTM."]},{"id":"CVE-2026-28318","v":"SolarWinds","p":"Serv-U","n":"SolarWinds Serv-U Uncontrolled Resource Consumption Vulnerability","d":"2026-06-05","due":"2026-06-19","rw":0,"x":"SolarWinds Serv-U contains an uncontrolled resource consumption vulnerability that allows specially crafted POST requests using the Content-Encoding: deflate header to crash the Serv-U service without authentication.","ra":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","adv":["https://www.solarwinds.com/trust-center/security-advisories/cve-2026-28318","https://documentation.solarwinds.com/en/success_center/servu/content/release_notes/servu_15-5-4-hotfix-1_release_notes.htm#link7"]},{"id":"CVE-2026-45247","v":"Mirasvit","p":"Mirasvit Full Page Cache Warmer","n":"Mirasvit Full Page Cache Warmer Deserialization of Untrusted Data Vulnerability","d":"2026-06-03","due":"2026-06-06","rw":0,"x":"Mirasvit Full Page Cache Warmer contains a deserialization of untrusted data vulnerability that could allow unauthenticated attackers to achieve remote code execution by supplying a crafted serialized PHP object in the CacheWarmer cookie.","ra":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","adv":["https://mirasvit.com/package/changelog/?package=mirasvit/module-cache-warmer"]},{"id":"CVE-2022-0492","v":"Linux","p":"Kernel","n":"Linux Kernel Improper Authentication Vulnerability","d":"2026-06-02","due":"2026-06-05","rw":0,"x":"Linux Kernel contains an improper authentication vulnerability which could allow for privilege escalation via the cgroups v1 release_agent feature.","ra":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","adv":["https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=24f6008564183aa120d07c03d9289519c2fe02af","https://www.kernel.org/"]},{"id":"CVE-2025-48595","v":"Android","p":"Framework","n":"Android Framework Integer Overflow Vulnerability","d":"2026-06-02","due":"2026-06-05","rw":0,"x":"Android Framework contains an integer overflow vulnerability that allows for code execution that could allow for local privilege escalation.","ra":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","adv":["https://source.android.com/docs/security/bulletin/2026/2026-06-01"]},{"id":"CVE-2024-21182","v":"Oracle","p":"WebLogic Server","n":"Oracle WebLogic Server Unspecified Vulnerability","d":"2026-06-01","due":"2026-06-04","rw":0,"x":"Oracle WebLogic contains an unspecified vulnerability that could allow an unauthenticated attacker with network access via T3, IIOP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle WebLogic Server…","ra":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","adv":["https://www.oracle.com/security-alerts/cpujul2024.html"]},{"id":"CVE-2026-0257","v":"Palo Alto Networks","p":"PAN-OS","n":"Palo Alto Networks PAN-OS Authentication Bypass Vulnerability","d":"2026-05-29","due":"2026-06-01","rw":1,"x":"Palo Alto Networks PAN-OS contains an authentication bypass vulnerability that allows attackers to bypass security restrictions and establish an unauthorized VPN connection.","ra":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","adv":["https://security.paloaltonetworks.com/CVE-2026-0257"]},{"id":"CVE-2026-48027","v":"Nx","p":"Nx Console","n":"Nx Console Embedded Malicious Code Vulnerability","d":"2026-05-27","due":"2026-06-10","rw":1,"x":"Nx Console contains an embedded malicious code vulnerability that allowed a malicious version of Nx Console to be published. The compromised extension fetched an obfuscated payload that could harvested credentials from multiple sources on disk and in memory.","ra":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","adv":["https://github.com/nrwl/nx-console/security/advisories/GHSA-c9j4-9m59-847w"]},{"id":"CVE-2026-45321","v":"TanStack","p":"TanStack","n":"TanStack Unspecified Vulnerability","d":"2026-05-27","due":"2026-06-10","rw":1,"x":"TanStack contains an unspecified vulnerability that allowed malicious versions of the product to be published to the npm registry to publish credential-stealing malware under a trusted identity.","ra":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","adv":["https://github.com/TanStack/router/security/advisories/GHSA-g7cv-rxg3-hmpx"]},{"id":"CVE-2026-8398","v":"Daemon","p":"Daemon Tools Lite","n":"Daemon Tools Lite Embedded Malicious Code Vulnerability","d":"2026-05-27","due":"2026-05-30","rw":0,"x":"Daemon Tools contains an unspecified vulnerability that has a high impact on confidentiality, integrity, and availability.","ra":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","adv":["https://blog.daemon-tools.cc/post/security-incident"]},{"id":"CVE-2026-48172","v":"LiteSpeed","p":"cPanel Plugin","n":"LiteSpeed cPanel Plugin Privilege Escalation Vulnerability","d":"2026-05-26","due":"2026-05-29","rw":0,"x":"LiteSpeed cPanel Plugin contains privilege escalation vulnerability that is exposed via the user-end cPanel plugin, which can be abused by any cPanel user account to execute arbitrary scripts with root privileges.","ra":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","adv":["https://blog.litespeedtech.com/2026/05/21/security-update-for-litespeed-cpanel-plugin/"]},{"id":"CVE-2026-9082","v":"Drupal","p":"Core","n":"Drupal Core SQL Injection Vulnerability","d":"2026-05-22","due":"2026-05-27","rw":0,"x":"Drupal Core contains a SQL injection vulnerability that could allow for privilege escalation and remote code execution via specially crafted requests sent with the database abstraction API.","ra":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","adv":["https://www.drupal.org/sa-core-2026-004"]},{"id":"CVE-2025-34291","v":"Langflow","p":"Langflow","n":"Langflow Origin Validation Error Vulnerability","d":"2026-05-21","due":"2026-06-04","rw":0,"x":"Langflow contains an origin validation error vulnerability in which an overly permissive CORS configuration combined with a refresh token cookie configured as SameSite=None allows a malicious webpage to perform cross-origin requests that include credentials and successfully call the refresh endpoint. This could allow…","ra":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","adv":["https://github.com/langflow-ai/langflow","https://github.com/langflow-ai/langflow/releases/tag/v1.9.3","https://github.com/langflow-ai/langflow/issues/11465#event-25774545848"]},{"id":"CVE-2026-34926","v":"Trend Micro","p":"Apex One","n":"Trend Micro Apex One (On-Premise) Directory Traversal Vulnerability","d":"2026-05-21","due":"2026-06-04","rw":0,"x":"Trend Micro Apex One (on-premise) contains a directory traversal vulnerability that could allow a pre-authenticated local attacker to modify a key table on the server to inject malicious code to deploy to agents on affected installations.","ra":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","adv":["https://success.trendmicro.com/en-US/solution/KA-0023430"]},{"id":"CVE-2008-4250","v":"Microsoft","p":"Windows","n":"Microsoft Windows Buffer Overflow Vulnerability","d":"2026-05-20","due":"2026-06-03","rw":0,"x":"Microsoft Windows contains a buffer overflow vulnerability in the Windows Server Service that allows remote attackers to execute arbitrary code via a crafted RPC request that triggers an overflow during path canonicalization.","ra":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","adv":["https://learn.microsoft.com/en-us/security-updates/securitybulletins/2008/ms08-067"]}],"kevIndex":{"CVE-2026-102764":"2026-10-16","CVE-2025-61624":"2026-10-16","CVE-2026-21589":"2026-10-15","CVE-2026-105134":"2026-10-14","CVE-2026-76519":"2026-10-14","CVE-2026-105133":"2026-10-14","CVE-2026-0322":"2026-10-14","CVE-2026-104935":"2026-10-13","CVE-2026-96951":"2026-10-13","CVE-2015-5477":"2026-10-08","CVE-2016-3081":"2026-10-08","CVE-2023-22894":"2026-10-08","CVE-2021-3199":"2026-10-08","CVE-2015-3306":"2026-10-08","CVE-2026-88779":"2026-10-04","CVE-2026-102490":"2026-10-02","CVE-2026-102489":"2026-10-02","CVE-2026-104286":"2026-10-01","CVE-2026-76504":"2026-09-30","CVE-2026-86950":"2026-09-29","CVE-2026-88772":"2026-09-27","CVE-2026-88771":"2026-09-27","CVE-2026-67279":"2026-09-25","CVE-2026-65660":"2026-09-25","CVE-2026-87902":"2026-09-25","CVE-2026-5430":"2026-09-24","CVE-2026-71362":"2026-09-24","CVE-2026-93952":"2026-09-22","CVE-2026-94127":"2026-09-22","CVE-2026-93616":"2026-09-22","CVE-2026-85102":"2026-09-22","CVE-2026-7273":"2026-09-21","CVE-2025-39964":"2026-09-18","CVE-2026-53266":"2026-09-18","CVE-2025-39682":"2026-09-18","CVE-2026-58704":"2026-09-16","CVE-2026-76460":"2026-09-16","CVE-2026-87886":"2026-09-16","CVE-2026-76461":"2026-09-14","CVE-2026-84869":"2026-09-11","CVE-2026-42016":"2026-09-11","CVE-2026-42018":"2026-09-11","CVE-2026-85706":"2026-09-11","CVE-2026-86060":"2026-09-10","CVE-2026-67277":"2026-09-10","CVE-2026-19490":"2026-09-09","CVE-2025-25249":"2026-09-09","CVE-2026-87491":"2026-09-09","CVE-2026-20079":"2026-09-09","CVE-2026-75650":"2026-09-08","CVE-2026-81963":"2026-09-08","CVE-2026-86218":"2026-09-08","CVE-2026-85880":"2026-09-08","CVE-2026-85046":"2026-09-04","CVE-2026-59822":"2026-09-02","CVE-2026-48710":"2026-09-02","CVE-2026-49869":"2026-09-02","CVE-2026-82329":"2026-09-02","CVE-2026-9586":"2026-09-02","CVE-2026-83548":"2026-09-02","CVE-2026-83549":"2026-09-02","CVE-2026-82078":"2026-08-31","CVE-2026-81578":"2026-08-31","CVE-2023-49105":"2026-08-27","CVE-2026-53362":"2026-08-27","CVE-2026-66384":"2026-08-27","CVE-2021-23758":"2026-08-26","CVE-2015-3246":"2026-08-26","CVE-2015-5287":"2026-08-26","CVE-2022-0995":"2026-08-26","CVE-2026-8452":"2026-08-26","CVE-2019-1068":"2026-08-26","CVE-2026-60004":"2026-08-25","CVE-2026-21962":"2026-08-24","CVE-2026-73570":"2026-08-21","CVE-2026-72530":"2026-08-20","CVE-2026-72529":"2026-08-20","CVE-2026-64849":"2026-08-19","CVE-2026-33824":"2026-08-18","CVE-2026-59310":"2026-08-18","CVE-2026-55040":"2026-08-18","CVE-2026-65400":"2026-08-18","CVE-2025-62593":"2026-08-17","CVE-2026-20349":"2026-08-11","CVE-2026-68820":"2026-08-11","CVE-2026-72898":"2026-08-11","CVE-2026-8037":"2026-08-07","CVE-2026-63077":"2026-08-05","CVE-2026-18556":"2026-08-04","CVE-2026-34486":"2026-08-04","CVE-2026-9198":"2026-08-04","CVE-2026-18577":"2026-08-03","CVE-2026-20316":"2026-07-29","CVE-2025-68686":"2026-07-27","CVE-2026-16812":"2026-07-27","CVE-2026-16232":"2026-07-22","CVE-2026-50522":"2026-07-22","CVE-2026-60137":"2026-07-21","CVE-2026-63030":"2026-07-21","CVE-2026-0770":"2026-07-21","CVE-2021-27137":"2026-07-21","CVE-2026-58644":"2026-07-16","CVE-2026-25089":"2026-07-16","CVE-2026-39808":"2026-07-16","CVE-2026-46817":"2026-07-15","CVE-2023-4346":"2026-07-15","CVE-2026-56155":"2026-07-14","CVE-2026-56164":"2026-07-14","CVE-2026-15409":"2026-07-14","CVE-2026-15410":"2026-07-14","CVE-2008-4128":"2026-07-13","CVE-2026-56291":"2026-07-10","CVE-2026-48939":"2026-07-10","CVE-2026-48908":"2026-07-07","CVE-2026-55255":"2026-07-07","CVE-2026-56290":"2026-07-07","CVE-2026-48282":"2026-07-07","CVE-2026-45659":"2026-07-01","CVE-2026-48558":"2026-06-29","CVE-2026-12569":"2026-06-25","CVE-2026-20230":"2026-06-25","CVE-2025-67038":"2026-06-23","CVE-2026-34910":"2026-06-23","CVE-2026-34909":"2026-06-23","CVE-2026-34908":"2026-06-23","CVE-2026-20253":"2026-06-18","CVE-2026-48907":"2026-06-16","CVE-2026-54420":"2026-06-15","CVE-2026-20262":"2026-06-15","CVE-2026-35273":"2026-06-12","CVE-2026-10520":"2026-06-11","CVE-2026-11645":"2026-06-09","CVE-2026-7473":"2026-06-09","CVE-2026-20245":"2026-06-09","CVE-2026-42271":"2026-06-08","CVE-2026-50751":"2026-06-08","CVE-2026-28318":"2026-06-05","CVE-2026-45247":"2026-06-03","CVE-2022-0492":"2026-06-02","CVE-2025-48595":"2026-06-02","CVE-2024-21182":"2026-06-01","CVE-2026-0257":"2026-05-29","CVE-2026-48027":"2026-05-27","CVE-2026-45321":"2026-05-27","CVE-2026-8398":"2026-05-27","CVE-2026-48172":"2026-05-26","CVE-2026-9082":"2026-05-22","CVE-2025-34291":"2026-05-21","CVE-2026-34926":"2026-05-21","CVE-2008-4250":"2026-05-20","CVE-2009-1537":"2026-05-20","CVE-2009-3459":"2026-05-20","CVE-2010-0249":"2026-05-20","CVE-2010-0806":"2026-05-20","CVE-2026-41091":"2026-05-20","CVE-2026-45498":"2026-05-20","CVE-2026-42897":"2026-05-15","CVE-2026-20182":"2026-05-14","CVE-2026-42208":"2026-05-08","CVE-2026-6973":"2026-05-07","CVE-2026-0300":"2026-05-06","CVE-2026-31431":"2026-05-01","CVE-2026-41940":"2026-04-30","CVE-2024-1708":"2026-04-28","CVE-2026-32202":"2026-04-28","CVE-2025-29635":"2026-04-24","CVE-2024-7399":"2026-04-24","CVE-2024-57728":"2026-04-24","CVE-2024-57726":"2026-04-24","CVE-2026-39987":"2026-04-23","CVE-2026-33825":"2026-04-22","CVE-2026-20122":"2026-04-20","CVE-2026-20133":"2026-04-20","CVE-2025-2749":"2026-04-20","CVE-2023-27351":"2026-04-20","CVE-2025-48700":"2026-04-20","CVE-2026-20128":"2026-04-20","CVE-2025-32975":"2026-04-20","CVE-2024-27199":"2026-04-20","CVE-2026-34197":"2026-04-16","CVE-2009-0238":"2026-04-14","CVE-2026-32201":"2026-04-14","CVE-2012-1854":"2026-04-13","CVE-2025-60710":"2026-04-13","CVE-2023-21529":"2026-04-13","CVE-2023-36424":"2026-04-13","CVE-2020-9715":"2026-04-13","CVE-2026-21643":"2026-04-13","CVE-2026-34621":"2026-04-13","CVE-2026-1340":"2026-04-08","CVE-2026-35616":"2026-04-06","CVE-2026-3502":"2026-04-02","CVE-2026-5281":"2026-04-01","CVE-2026-3055":"2026-03-30","CVE-2025-53521":"2026-03-27","CVE-2026-33634":"2026-03-26","CVE-2026-33017":"2026-03-25","CVE-2025-32432":"2026-03-20","CVE-2025-54068":"2026-03-20","CVE-2025-43510":"2026-03-20","CVE-2025-43520":"2026-03-20","CVE-2025-31277":"2026-03-20","CVE-2026-20131":"2026-03-19","CVE-2025-66376":"2026-03-18","CVE-2026-20963":"2026-03-18","CVE-2025-47813":"2026-03-16","CVE-2026-3910":"2026-03-13","CVE-2026-3909":"2026-03-13","CVE-2025-68613":"2026-03-11","CVE-2021-22054":"2026-03-09","CVE-2025-26399":"2026-03-09","CVE-2026-1603":"2026-03-09","CVE-2017-7921":"2026-03-05","CVE-2021-22681":"2026-03-05","CVE-2023-43000":"2026-03-05","CVE-2021-30952":"2026-03-05","CVE-2023-41974":"2026-03-05","CVE-2026-22719":"2026-03-03","CVE-2026-21385":"2026-03-03","CVE-2022-20775":"2026-02-25","CVE-2026-20127":"2026-02-25","CVE-2026-25108":"2026-02-24","CVE-2025-49113":"2026-02-20","CVE-2025-68461":"2026-02-20","CVE-2021-22175":"2026-02-18","CVE-2026-22769":"2026-02-18","CVE-2020-7796":"2026-02-17","CVE-2024-7694":"2026-02-17","CVE-2008-0015":"2026-02-17","CVE-2026-2441":"2026-02-17","CVE-2026-1731":"2026-02-13","CVE-2026-20700":"2026-02-12","CVE-2024-43468":"2026-02-12","CVE-2025-15556":"2026-02-12","CVE-2025-40536":"2026-02-12","CVE-2026-21513":"2026-02-10","CVE-2026-21525":"2026-02-10","CVE-2026-21510":"2026-02-10","CVE-2026-21533":"2026-02-10","CVE-2026-21519":"2026-02-10","CVE-2026-21514":"2026-02-10","CVE-2025-11953":"2026-02-05","CVE-2026-24423":"2026-02-05","CVE-2021-39935":"2026-02-03","CVE-2025-64328":"2026-02-03","CVE-2019-19006":"2026-02-03","CVE-2025-40551":"2026-02-03","CVE-2026-1281":"2026-01-29","CVE-2026-24858":"2026-01-27","CVE-2018-14634":"2026-01-26","CVE-2025-52691":"2026-01-26","CVE-2026-23760":"2026-01-26","CVE-2026-24061":"2026-01-26","CVE-2026-21509":"2026-01-26","CVE-2024-37079":"2026-01-23","CVE-2025-68645":"2026-01-22","CVE-2025-34026":"2026-01-22","CVE-2025-31125":"2026-01-22","CVE-2025-54313":"2026-01-22","CVE-2026-20045":"2026-01-21","CVE-2026-20805":"2026-01-13","CVE-2025-8110":"2026-01-12","CVE-2009-0556":"2026-01-07","CVE-2025-37164":"2026-01-07","CVE-2025-14847":"2025-12-29","CVE-2023-52163":"2025-12-22","CVE-2025-14733":"2025-12-19","CVE-2025-59374":"2025-12-17","CVE-2025-40602":"2025-12-17","CVE-2025-20393":"2025-12-17","CVE-2025-59718":"2025-12-16","CVE-2025-14611":"2025-12-15","CVE-2025-43529":"2025-12-15","CVE-2018-4063":"2025-12-12","CVE-2025-14174":"2025-12-12","CVE-2025-58360":"2025-12-11","CVE-2025-6218":"2025-12-09","CVE-2025-62221":"2025-12-09","CVE-2022-37055":"2025-12-08","CVE-2025-66644":"2025-12-08","CVE-2025-55182":"2025-12-05","CVE-2021-26828":"2025-12-03","CVE-2025-48633":"2025-12-02","CVE-2025-48572":"2025-12-02","CVE-2021-26829":"2025-11-28","CVE-2025-61757":"2025-11-21","CVE-2025-13223":"2025-11-19","CVE-2025-58034":"2025-11-18","CVE-2025-64446":"2025-11-14","CVE-2025-12480":"2025-11-12","CVE-2025-62215":"2025-11-12","CVE-2025-9242":"2025-11-12","CVE-2025-21042":"2025-11-10","CVE-2025-48703":"2025-11-04","CVE-2025-11371":"2025-11-04","CVE-2025-41244":"2025-10-30","CVE-2025-24893":"2025-10-30","CVE-2025-6204":"2025-10-28","CVE-2025-6205":"2025-10-28","CVE-2025-54236":"2025-10-24","CVE-2025-59287":"2025-10-24","CVE-2025-61932":"2025-10-22","CVE-2022-48503":"2025-10-20","CVE-2025-2746":"2025-10-20","CVE-2025-2747":"2025-10-20","CVE-2025-33073":"2025-10-20","CVE-2025-61884":"2025-10-20","CVE-2025-54253":"2025-10-15","CVE-2025-47827":"2025-10-14","CVE-2025-24990":"2025-10-14","CVE-2025-59230":"2025-10-14","CVE-2016-7836":"2025-10-14","CVE-2021-43798":"2025-10-09","CVE-2025-27915":"2025-10-07","CVE-2021-22555":"2025-10-06","CVE-2010-3962":"2025-10-06","CVE-2021-43226":"2025-10-06","CVE-2013-3918":"2025-10-06","CVE-2011-3402":"2025-10-06","CVE-2010-3765":"2025-10-06","CVE-2025-61882":"2025-10-06","CVE-2014-6278":"2025-10-02","CVE-2017-1000353":"2025-10-02","CVE-2015-7755":"2025-10-02","CVE-2025-21043":"2025-10-02","CVE-2025-4008":"2025-10-02","CVE-2025-32463":"2025-09-29","CVE-2025-59689":"2025-09-29","CVE-2025-10035":"2025-09-29","CVE-2025-20352":"2025-09-29","CVE-2021-21311":"2025-09-29","CVE-2025-20362":"2025-09-25","CVE-2025-20333":"2025-09-25","CVE-2025-10585":"2025-09-23","CVE-2025-5086":"2025-09-11","CVE-2025-38352":"2025-09-04","CVE-2025-48543":"2025-09-04","CVE-2025-53690":"2025-09-04","CVE-2023-50224":"2025-09-03","CVE-2025-9377":"2025-09-03","CVE-2020-24363":"2025-09-02","CVE-2025-55177":"2025-09-02","CVE-2025-57819":"2025-08-29","CVE-2025-7775":"2025-08-26","CVE-2025-48384":"2025-08-25","CVE-2024-8068":"2025-08-25","CVE-2024-8069":"2025-08-25","CVE-2025-43300":"2025-08-21","CVE-2025-54948":"2025-08-18","CVE-2025-8876":"2025-08-13","CVE-2025-8875":"2025-08-13","CVE-2025-8088":"2025-08-12","CVE-2007-0671":"2025-08-12","CVE-2013-3893":"2025-08-12","CVE-2020-25078":"2025-08-05","CVE-2020-25079":"2025-08-05","CVE-2022-40799":"2025-08-05","CVE-2023-2533":"2025-07-28","CVE-2025-20337":"2025-07-28","CVE-2025-20281":"2025-07-28","CVE-2025-2775":"2025-07-22","CVE-2025-2776":"2025-07-22","CVE-2025-6558":"2025-07-22","CVE-2025-54309":"2025-07-22","CVE-2025-49704":"2025-07-22","CVE-2025-49706":"2025-07-22","CVE-2025-53770":"2025-07-20","CVE-2025-25257":"2025-07-18","CVE-2025-47812":"2025-07-14","CVE-2025-5777":"2025-07-10","CVE-2019-9621":"2025-07-07","CVE-2019-5418":"2025-07-07","CVE-2016-10033":"2025-07-07","CVE-2014-3931":"2025-07-07","CVE-2025-6554":"2025-07-02","CVE-2025-48928":"2025-07-01","CVE-2025-48927":"2025-07-01","CVE-2025-6543":"2025-06-30","CVE-2019-6693":"2025-06-25","CVE-2024-0769":"2025-06-25","CVE-2024-54085":"2025-06-25","CVE-2023-0386":"2025-06-17","CVE-2023-33538":"2025-06-16","CVE-2025-43200":"2025-06-16","CVE-2025-33053":"2025-06-10","CVE-2025-24016":"2025-06-10","CVE-2024-42009":"2025-06-09","CVE-2025-32433":"2025-06-09","CVE-2025-5419":"2025-06-05","CVE-2025-21479":"2025-06-03","CVE-2025-21480":"2025-06-03","CVE-2025-27038":"2025-06-03","CVE-2021-32030":"2025-06-02","CVE-2025-3935":"2025-06-02","CVE-2025-35939":"2025-06-02","CVE-2024-56145":"2025-06-02","CVE-2023-39780":"2025-06-02","CVE-2025-4632":"2025-05-22","CVE-2023-38950":"2025-05-19","CVE-2024-27443":"2025-05-19","CVE-2025-27920":"2025-05-19","CVE-2024-11182":"2025-05-19","CVE-2025-4428":"2025-05-19","CVE-2025-4427":"2025-05-19","CVE-2025-42999":"2025-05-15","CVE-2024-12987":"2025-05-15","CVE-2025-32756":"2025-05-14","CVE-2025-32709":"2025-05-13","CVE-2025-30397":"2025-05-13","CVE-2025-32706":"2025-05-13","CVE-2025-32701":"2025-05-13","CVE-2025-30400":"2025-05-13","CVE-2025-47729":"2025-05-12","CVE-2024-11120":"2025-05-07","CVE-2024-6047":"2025-05-07","CVE-2025-27363":"2025-05-06","CVE-2025-3248":"2025-05-05","CVE-2025-34028":"2025-05-02","CVE-2024-58136":"2025-05-02","CVE-2024-38475":"2025-05-01","CVE-2023-44221":"2025-05-01","CVE-2025-31324":"2025-04-29","CVE-2025-1976":"2025-04-28","CVE-2025-42599":"2025-04-28","CVE-2025-3928":"2025-04-28","CVE-2025-24054":"2025-04-17","CVE-2025-31201":"2025-04-17","CVE-2025-31200":"2025-04-17","CVE-2021-20035":"2025-04-16","CVE-2024-53150":"2025-04-09","CVE-2024-53197":"2025-04-09","CVE-2025-29824":"2025-04-08","CVE-2025-30406":"2025-04-08","CVE-2025-31161":"2025-04-07","CVE-2025-22457":"2025-04-04","CVE-2025-24813":"2025-04-01","CVE-2024-20439":"2025-03-31","CVE-2025-2783":"2025-03-27","CVE-2019-9875":"2025-03-26","CVE-2019-9874":"2025-03-26","CVE-2025-30154":"2025-03-24","CVE-2017-12637":"2025-03-19","CVE-2024-48248":"2025-03-19","CVE-2025-1316":"2025-03-19","CVE-2025-30066":"2025-03-18","CVE-2025-24472":"2025-03-18","CVE-2025-21590":"2025-03-13","CVE-2025-24201":"2025-03-13","CVE-2025-24993":"2025-03-11","CVE-2025-24991":"2025-03-11","CVE-2025-24985":"2025-03-11","CVE-2025-24984":"2025-03-11","CVE-2025-24983":"2025-03-11","CVE-2025-26633":"2025-03-11","CVE-2024-13161":"2025-03-10","CVE-2024-13160":"2025-03-10","CVE-2024-13159":"2025-03-10","CVE-2024-57968":"2025-03-10","CVE-2025-25181":"2025-03-10","CVE-2025-22226":"2025-03-04","CVE-2025-22225":"2025-03-04","CVE-2025-22224":"2025-03-04","CVE-2024-50302":"2025-03-04","CVE-2024-4885":"2025-03-03","CVE-2018-8639":"2025-03-03","CVE-2022-43769":"2025-03-03","CVE-2022-43939":"2025-03-03","CVE-2023-20118":"2025-03-03","CVE-2023-34192":"2025-02-25","CVE-2024-49035":"2025-02-25","CVE-2024-20953":"2025-02-24","CVE-2017-3066":"2025-02-24","CVE-2025-24989":"2025-02-21","CVE-2025-0111":"2025-02-20","CVE-2025-23209":"2025-02-20","CVE-2025-0108":"2025-02-18","CVE-2024-53704":"2025-02-18","CVE-2024-57727":"2025-02-13","CVE-2025-24200":"2025-02-12","CVE-2024-41710":"2025-02-12","CVE-2024-40891":"2025-02-11","CVE-2024-40890":"2025-02-11","CVE-2025-21418":"2025-02-11","CVE-2025-21391":"2025-02-11","CVE-2025-0994":"2025-02-07","CVE-2020-15069":"2025-02-06","CVE-2020-29574":"2025-02-06","CVE-2024-21413":"2025-02-06","CVE-2022-23748":"2025-02-06","CVE-2025-0411":"2025-02-06","CVE-2024-53104":"2025-02-05","CVE-2018-19410":"2025-02-04","CVE-2018-9276":"2025-02-04","CVE-2024-29059":"2025-02-04","CVE-2024-45195":"2025-02-04","CVE-2025-24085":"2025-01-29","CVE-2025-23006":"2025-01-24","CVE-2020-11023":"2025-01-23","CVE-2024-50603":"2025-01-16","CVE-2025-21335":"2025-01-14","CVE-2025-21334":"2025-01-14","CVE-2025-21333":"2025-01-14","CVE-2024-55591":"2025-01-14","CVE-2023-48365":"2025-01-13","CVE-2024-12686":"2025-01-13","CVE-2025-0282":"2025-01-08","CVE-2020-2883":"2025-01-07","CVE-2024-55550":"2025-01-07","CVE-2024-41713":"2025-01-07","CVE-2024-3393":"2024-12-30","CVE-2021-44207":"2024-12-23","CVE-2024-12356":"2024-12-19","CVE-2021-40407":"2024-12-18","CVE-2019-11001":"2024-12-18","CVE-2022-23227":"2024-12-18","CVE-2018-14933":"2024-12-18","CVE-2024-55956":"2024-12-17","CVE-2024-35250":"2024-12-16","CVE-2024-20767":"2024-12-16","CVE-2024-50623":"2024-12-13","CVE-2024-49138":"2024-12-10","CVE-2024-51378":"2024-12-04","CVE-2024-11667":"2024-12-03","CVE-2024-11680":"2024-12-03","CVE-2023-45727":"2024-12-03","CVE-2023-28461":"2024-11-25","CVE-2024-21287":"2024-11-21","CVE-2024-44309":"2024-11-21","CVE-2024-44308":"2024-11-21","CVE-2024-38813":"2024-11-20","CVE-2024-38812":"2024-11-20","CVE-2024-9474":"2024-11-18","CVE-2024-0012":"2024-11-18","CVE-2024-1212":"2024-11-18","CVE-2024-9465":"2024-11-14","CVE-2024-9463":"2024-11-14","CVE-2021-26086":"2024-11-12","CVE-2014-2120":"2024-11-12","CVE-2021-41277":"2024-11-12","CVE-2024-43451":"2024-11-12","CVE-2024-49039":"2024-11-12","CVE-2019-16278":"2024-11-07","CVE-2024-51567":"2024-11-07","CVE-2024-43093":"2024-11-07","CVE-2024-5910":"2024-11-07","CVE-2024-8956":"2024-11-04","CVE-2024-8957":"2024-11-04","CVE-2024-37383":"2024-10-24","CVE-2024-20481":"2024-10-24","CVE-2024-47575":"2024-10-23","CVE-2024-38094":"2024-10-22","CVE-2024-9537":"2024-10-21","CVE-2024-40711":"2024-10-17","CVE-2024-28987":"2024-10-15","CVE-2024-9680":"2024-10-15","CVE-2024-30088":"2024-10-15","CVE-2024-9380":"2024-10-09","CVE-2024-9379":"2024-10-09","CVE-2024-23113":"2024-10-09","CVE-2024-43573":"2024-10-08","CVE-2024-43572":"2024-10-08","CVE-2024-43047":"2024-10-08","CVE-2024-45519":"2024-10-03","CVE-2024-29824":"2024-10-02","CVE-2019-0344":"2024-09-30","CVE-2020-15415":"2024-09-30","CVE-2023-25280":"2024-09-30","CVE-2024-7593":"2024-09-24","CVE-2024-8963":"2024-09-19","CVE-2020-14644":"2024-09-18","CVE-2022-21445":"2024-09-18","CVE-2020-0618":"2024-09-18","CVE-2024-27348":"2024-09-18","CVE-2014-0502":"2024-09-17","CVE-2013-0648":"2024-09-17","CVE-2013-0643":"2024-09-17","CVE-2014-0497":"2024-09-17","CVE-2024-6670":"2024-09-16","CVE-2024-43461":"2024-09-16","CVE-2024-8190":"2024-09-13","CVE-2024-38217":"2024-09-10","CVE-2024-38014":"2024-09-10","CVE-2024-38226":"2024-09-10","CVE-2024-40766":"2024-09-09","CVE-2017-1000253":"2024-09-09","CVE-2016-3714":"2024-09-09","CVE-2024-7262":"2024-09-03","CVE-2021-20124":"2024-09-03","CVE-2021-20123":"2024-09-03","CVE-2024-7965":"2024-08-28","CVE-2024-38856":"2024-08-27","CVE-2024-7971":"2024-08-26","CVE-2024-39717":"2024-08-23","CVE-2021-31196":"2024-08-21","CVE-2022-0185":"2024-08-21","CVE-2021-33045":"2024-08-21","CVE-2021-33044":"2024-08-21","CVE-2024-23897":"2024-08-19","CVE-2024-28986":"2024-08-15","CVE-2024-38107":"2024-08-13","CVE-2024-38106":"2024-08-13","CVE-2024-38193":"2024-08-13","CVE-2024-38213":"2024-08-13","CVE-2024-38178":"2024-08-13","CVE-2024-38189":"2024-08-13","CVE-2024-32113":"2024-08-07","CVE-2024-36971":"2024-08-07","CVE-2018-0824":"2024-08-05","CVE-2024-37085":"2024-07-30","CVE-2023-45249":"2024-07-29","CVE-2024-5217":"2024-07-29","CVE-2024-4879":"2024-07-29","CVE-2024-39891":"2024-07-23","CVE-2012-4792":"2024-07-23","CVE-2022-22948":"2024-07-17","CVE-2024-28995":"2024-07-17","CVE-2024-34102":"2024-07-17","CVE-2024-36401":"2024-07-15","CVE-2024-23692":"2024-07-09","CVE-2024-38080":"2024-07-09","CVE-2024-38112":"2024-07-09","CVE-2024-20399":"2024-07-02","CVE-2020-13965":"2024-06-26","CVE-2022-2586":"2024-06-26","CVE-2022-24816":"2024-06-26","CVE-2024-4358":"2024-06-13","CVE-2024-26169":"2024-06-13","CVE-2024-32896":"2024-06-13","CVE-2024-4577":"2024-06-12","CVE-2024-4610":"2024-06-12","CVE-2017-3506":"2024-06-03","CVE-2024-1086":"2024-05-30","CVE-2024-24919":"2024-05-30","CVE-2024-4978":"2024-05-29","CVE-2024-5274":"2024-05-28","CVE-2020-17519":"2024-05-23","CVE-2024-4947":"2024-05-20","CVE-2023-43208":"2024-05-20","CVE-2024-4761":"2024-05-16","CVE-2021-40655":"2024-05-16","CVE-2014-100005":"2024-05-16","CVE-2024-30040":"2024-05-14","CVE-2024-30051":"2024-05-14","CVE-2024-4671":"2024-05-13","CVE-2023-7028":"2024-05-01","CVE-2024-29988":"2024-04-30","CVE-2024-4040":"2024-04-24","CVE-2024-20359":"2024-04-24","CVE-2024-20353":"2024-04-24","CVE-2022-38028":"2024-04-23","CVE-2024-3400":"2024-04-12","CVE-2024-3273":"2024-04-11","CVE-2024-3272":"2024-04-11","CVE-2024-29748":"2024-04-04","CVE-2024-29745":"2024-04-04","CVE-2023-24955":"2024-03-26","CVE-2019-7256":"2024-03-25","CVE-2021-44529":"2024-03-25","CVE-2023-48788":"2024-03-25","CVE-2024-27198":"2024-03-07","CVE-2024-23225":"2024-03-06","CVE-2024-23296":"2024-03-06","CVE-2023-21237":"2024-03-05","CVE-2021-36380":"2024-03-05","CVE-2024-21338":"2024-03-04","CVE-2023-29360":"2024-02-29","CVE-2024-1709":"2024-02-22","CVE-2020-3259":"2024-02-15","CVE-2024-21410":"2024-02-15","CVE-2024-21412":"2024-02-13","CVE-2024-21351":"2024-02-13","CVE-2023-43770":"2024-02-12","CVE-2024-21762":"2024-02-09","CVE-2023-4762":"2024-02-06","CVE-2022-48618":"2024-01-31","CVE-2024-21893":"2024-01-31","CVE-2023-22527":"2024-01-24","CVE-2024-23222":"2024-01-23","CVE-2023-34048":"2024-01-22","CVE-2023-35082":"2024-01-18","CVE-2024-0519":"2024-01-17","CVE-2023-6549":"2024-01-17","CVE-2023-6548":"2024-01-17","CVE-2018-15133":"2024-01-16","CVE-2023-29357":"2024-01-10","CVE-2023-46805":"2024-01-10","CVE-2024-21887":"2024-01-10","CVE-2023-23752":"2024-01-08","CVE-2016-20017":"2024-01-08","CVE-2023-41990":"2024-01-08","CVE-2023-27524":"2024-01-08","CVE-2023-29300":"2024-01-08","CVE-2023-38203":"2024-01-08","CVE-2023-7101":"2024-01-02","CVE-2023-7024":"2024-01-02","CVE-2023-49897":"2023-12-21","CVE-2023-47565":"2023-12-21","CVE-2023-6448":"2023-12-11","CVE-2023-41266":"2023-12-07","CVE-2023-41265":"2023-12-07","CVE-2023-33107":"2023-12-05","CVE-2023-33106":"2023-12-05","CVE-2023-33063":"2023-12-05","CVE-2022-22071":"2023-12-05","CVE-2023-42917":"2023-12-04","CVE-2023-42916":"2023-12-04","CVE-2023-6345":"2023-11-30","CVE-2023-49103":"2023-11-30","CVE-2023-4911":"2023-11-21","CVE-2023-36584":"2023-11-16","CVE-2023-1671":"2023-11-16","CVE-2020-2551":"2023-11-16","CVE-2023-36033":"2023-11-14","CVE-2023-36025":"2023-11-14","CVE-2023-36036":"2023-11-14","CVE-2023-47246":"2023-11-13","CVE-2023-36844":"2023-11-13","CVE-2023-36845":"2023-11-13","CVE-2023-36846":"2023-11-13","CVE-2023-36847":"2023-11-13","CVE-2023-36851":"2023-11-13","CVE-2023-29552":"2023-11-08","CVE-2023-22518":"2023-11-07","CVE-2023-46604":"2023-11-02","CVE-2023-46748":"2023-10-31","CVE-2023-46747":"2023-10-31","CVE-2023-5631":"2023-10-26","CVE-2023-20273":"2023-10-23","CVE-2023-4966":"2023-10-18","CVE-2023-20198":"2023-10-16","CVE-2023-21608":"2023-10-10","CVE-2023-20109":"2023-10-10","CVE-2023-41763":"2023-10-10","CVE-2023-36563":"2023-10-10","CVE-2023-44487":"2023-10-10","CVE-2023-22515":"2023-10-05","CVE-2023-40044":"2023-10-05","CVE-2023-42824":"2023-10-05","CVE-2023-42793":"2023-10-04","CVE-2023-28229":"2023-10-04","CVE-2023-4211":"2023-10-03","CVE-2023-5217":"2023-10-02","CVE-2018-14667":"2023-09-28","CVE-2023-41991":"2023-09-25","CVE-2023-41992":"2023-09-25","CVE-2023-41993":"2023-09-25","CVE-2023-41179":"2023-09-21","CVE-2023-28434":"2023-09-19","CVE-2022-22265":"2023-09-18","CVE-2014-8361":"2023-09-18","CVE-2017-6884":"2023-09-18","CVE-2021-3129":"2023-09-18","CVE-2023-26369":"2023-09-14","CVE-2023-35674":"2023-09-13","CVE-2023-20269":"2023-09-13","CVE-2023-4863":"2023-09-13","CVE-2023-36761":"2023-09-12","CVE-2023-36802":"2023-09-12","CVE-2023-41064":"2023-09-11","CVE-2023-41061":"2023-09-11","CVE-2023-33246":"2023-09-06","CVE-2023-38831":"2023-08-24","CVE-2023-32315":"2023-08-24","CVE-2023-38035":"2023-08-22","CVE-2023-27532":"2023-08-22","CVE-2023-26359":"2023-08-21","CVE-2023-24489":"2023-08-16","CVE-2023-38180":"2023-08-09","CVE-2017-18368":"2023-08-07","CVE-2023-35081":"2023-07-31","CVE-2023-37580":"2023-07-27","CVE-2023-38606":"2023-07-26","CVE-2023-35078":"2023-07-25","CVE-2023-29298":"2023-07-20","CVE-2023-38205":"2023-07-20","CVE-2023-3519":"2023-07-19","CVE-2023-36884":"2023-07-17","CVE-2022-29303":"2023-07-13","CVE-2023-37450":"2023-07-13","CVE-2023-32046":"2023-07-11","CVE-2023-32049":"2023-07-11","CVE-2023-35311":"2023-07-11","CVE-2023-36874":"2023-07-11","CVE-2022-31199":"2023-07-11","CVE-2021-29256":"2023-07-07","CVE-2019-17621":"2023-06-29","CVE-2019-20500":"2023-06-29","CVE-2021-25487":"2023-06-29","CVE-2021-25489":"2023-06-29","CVE-2021-25394":"2023-06-29","CVE-2021-25395":"2023-06-29","CVE-2021-25371":"2023-06-29","CVE-2021-25372":"2023-06-29","CVE-2023-32434":"2023-06-23","CVE-2023-32435":"2023-06-23","CVE-2023-32439":"2023-06-23","CVE-2023-20867":"2023-06-23","CVE-2023-27992":"2023-06-23","CVE-2023-20887":"2023-06-22","CVE-2020-35730":"2023-06-22","CVE-2020-12641":"2023-06-22","CVE-2021-44026":"2023-06-22","CVE-2016-9079":"2023-06-22","CVE-2016-0165":"2023-06-22","CVE-2023-27997":"2023-06-13","CVE-2023-3079":"2023-06-07","CVE-2023-33009":"2023-06-05","CVE-2023-33010":"2023-06-05","CVE-2023-34362":"2023-06-02","CVE-2023-28771":"2023-05-31","CVE-2023-2868":"2023-05-26","CVE-2023-32409":"2023-05-22","CVE-2023-28204":"2023-05-22","CVE-2023-32373":"2023-05-22","CVE-2004-1464":"2023-05-19","CVE-2016-6415":"2023-05-19","CVE-2023-21492":"2023-05-19","CVE-2023-25717":"2023-05-12","CVE-2021-3560":"2023-05-12","CVE-2014-0196":"2023-05-12","CVE-2010-3904":"2023-05-12","CVE-2015-5317":"2023-05-12","CVE-2016-3427":"2023-05-12","CVE-2016-8735":"2023-05-12","CVE-2023-29336":"2023-05-09","CVE-2023-1389":"2023-05-01","CVE-2021-45046":"2023-05-01","CVE-2023-21839":"2023-05-01","CVE-2023-28432":"2023-04-21","CVE-2023-27350":"2023-04-21","CVE-2023-2136":"2023-04-21","CVE-2017-6742":"2023-04-19","CVE-2019-8526":"2023-04-17","CVE-2023-2033":"2023-04-17","CVE-2023-20963":"2023-04-13","CVE-2023-29492":"2023-04-13","CVE-2023-28252":"2023-04-11","CVE-2023-28205":"2023-04-10","CVE-2023-28206":"2023-04-10","CVE-2021-27876":"2023-04-07","CVE-2021-27877":"2023-04-07","CVE-2021-27878":"2023-04-07","CVE-2019-1388":"2023-04-07","CVE-2023-26083":"2023-04-07","CVE-2022-27926":"2023-04-03","CVE-2013-3163":"2023-03-30","CVE-2017-7494":"2023-03-30","CVE-2022-42948":"2023-03-30","CVE-2022-39197":"2023-03-30","CVE-2021-30900":"2023-03-30","CVE-2022-38181":"2023-03-30","CVE-2023-0266":"2023-03-30","CVE-2022-3038":"2023-03-30","CVE-2022-22706":"2023-03-30","CVE-2023-26360":"2023-03-15","CVE-2023-23397":"2023-03-14","CVE-2023-24880":"2023-03-14","CVE-2022-41328":"2023-03-14","CVE-2021-39144":"2023-03-10","CVE-2020-5741":"2023-03-10","CVE-2022-28810":"2023-03-07","CVE-2022-33891":"2023-03-07","CVE-2022-35914":"2023-03-07","CVE-2022-36537":"2023-02-27","CVE-2022-47986":"2023-02-21","CVE-2022-41223":"2023-02-21","CVE-2022-40765":"2023-02-21","CVE-2022-46169":"2023-02-16","CVE-2023-21715":"2023-02-14","CVE-2023-23376":"2023-02-14","CVE-2023-23529":"2023-02-14","CVE-2023-21823":"2023-02-14","CVE-2015-2291":"2023-02-10","CVE-2022-24990":"2023-02-10","CVE-2023-0669":"2023-02-10","CVE-2022-21587":"2023-02-02","CVE-2023-22952":"2023-02-02","CVE-2017-11357":"2023-01-26","CVE-2022-47966":"2023-01-23","CVE-2022-44877":"2023-01-17","CVE-2022-41080":"2023-01-10","CVE-2023-21674":"2023-01-10","CVE-2018-5430":"2022-12-29","CVE-2018-18809":"2022-12-29","CVE-2022-42856":"2022-12-14","CVE-2022-42475":"2022-12-13","CVE-2022-44698":"2022-12-13","CVE-2022-27518":"2022-12-13","CVE-2022-26500":"2022-12-13","CVE-2022-26501":"2022-12-13","CVE-2022-4262":"2022-12-05","CVE-2021-35587":"2022-11-28","CVE-2022-4135":"2022-11-28","CVE-2022-41049":"2022-11-14","CVE-2022-41091":"2022-11-08","CVE-2022-41073":"2022-11-08","CVE-2022-41125":"2022-11-08","CVE-2022-41128":"2022-11-08","CVE-2021-25337":"2022-11-08","CVE-2021-25369":"2022-11-08","CVE-2021-25370":"2022-11-08","CVE-2022-3723":"2022-10-28","CVE-2022-42827":"2022-10-25","CVE-2020-3433":"2022-10-24","CVE-2020-3153":"2022-10-24","CVE-2018-19323":"2022-10-24","CVE-2018-19322":"2022-10-24","CVE-2018-19321":"2022-10-24","CVE-2018-19320":"2022-10-24","CVE-2022-41352":"2022-10-20","CVE-2021-3493":"2022-10-20","CVE-2022-40684":"2022-10-11","CVE-2022-41033":"2022-10-11","CVE-2022-41082":"2022-09-30","CVE-2022-41040":"2022-09-30","CVE-2022-36804":"2022-09-30","CVE-2022-3236":"2022-09-23","CVE-2022-35405":"2022-09-22","CVE-2022-40139":"2022-09-15","CVE-2013-6282":"2022-09-15","CVE-2013-2597":"2022-09-15","CVE-2013-2596":"2022-09-15","CVE-2013-2094":"2022-09-15","CVE-2010-2568":"2022-09-15","CVE-2022-37969":"2022-09-14","CVE-2022-32917":"2022-09-14","CVE-2022-3075":"2022-09-08","CVE-2022-27593":"2022-09-08","CVE-2022-26258":"2022-09-08","CVE-2020-9934":"2022-09-08","CVE-2018-7445":"2022-09-08","CVE-2018-6530":"2022-09-08","CVE-2018-2628":"2022-09-08","CVE-2018-13374":"2022-09-08","CVE-2017-5521":"2022-09-08","CVE-2011-4723":"2022-09-08","CVE-2011-1823":"2022-09-08","CVE-2022-26352":"2022-08-25","CVE-2022-24706":"2022-08-25","CVE-2022-24112":"2022-08-25","CVE-2022-22963":"2022-08-25","CVE-2022-2294":"2022-08-25","CVE-2021-39226":"2022-08-25","CVE-2021-38406":"2022-08-25","CVE-2021-31010":"2022-08-25","CVE-2020-36193":"2022-08-25","CVE-2020-28949":"2022-08-25","CVE-2022-0028":"2022-08-22","CVE-2022-22536":"2022-08-18","CVE-2022-32894":"2022-08-18","CVE-2022-32893":"2022-08-18","CVE-2022-2856":"2022-08-18","CVE-2022-26923":"2022-08-18","CVE-2022-21971":"2022-08-18","CVE-2017-15944":"2022-08-18","CVE-2022-27925":"2022-08-11","CVE-2022-37042":"2022-08-11","CVE-2022-34713":"2022-08-09","CVE-2022-30333":"2022-08-09","CVE-2022-27924":"2022-08-04","CVE-2022-26138":"2022-07-29","CVE-2022-22047":"2022-07-12","CVE-2022-26925":"2022-07-01","CVE-2022-29499":"2022-06-27","CVE-2021-30533":"2022-06-27","CVE-2021-4034":"2022-06-27","CVE-2021-30983":"2022-06-27","CVE-2020-3837":"2022-06-27","CVE-2020-9907":"2022-06-27","CVE-2019-8605":"2022-06-27","CVE-2018-4344":"2022-06-27","CVE-2022-30190":"2022-06-14","CVE-2021-38163":"2022-06-09","CVE-2016-2386":"2022-06-09","CVE-2016-2388":"2022-06-09","CVE-2019-7195":"2022-06-08","CVE-2019-7194":"2022-06-08","CVE-2019-7193":"2022-06-08","CVE-2019-7192":"2022-06-08","CVE-2019-5825":"2022-06-08","CVE-2019-15271":"2022-06-08","CVE-2018-6065":"2022-06-08","CVE-2018-4990":"2022-06-08","CVE-2018-17480":"2022-06-08","CVE-2018-17463":"2022-06-08","CVE-2017-6862":"2022-06-08","CVE-2017-5070":"2022-06-08","CVE-2017-5030":"2022-06-08","CVE-2016-5198":"2022-06-08","CVE-2016-1646":"2022-06-08","CVE-2013-1331":"2022-06-08","CVE-2012-5054":"2022-06-08","CVE-2012-4969":"2022-06-08","CVE-2012-1889":"2022-06-08","CVE-2012-0767":"2022-06-08","CVE-2012-0754":"2022-06-08","CVE-2012-0151":"2022-06-08","CVE-2011-2462":"2022-06-08","CVE-2011-0609":"2022-06-08","CVE-2010-2883":"2022-06-08","CVE-2010-2572":"2022-06-08","CVE-2010-1297":"2022-06-08","CVE-2009-4324":"2022-06-08","CVE-2009-3953":"2022-06-08","CVE-2009-1862":"2022-06-08","CVE-2009-0563":"2022-06-08","CVE-2009-0557":"2022-06-08","CVE-2008-0655":"2022-06-08","CVE-2007-5659":"2022-06-08","CVE-2006-2492":"2022-06-08","CVE-2022-26134":"2022-06-02","CVE-2019-3010":"2022-05-25","CVE-2016-3393":"2022-05-25","CVE-2016-7256":"2022-05-25","CVE-2016-1010":"2022-05-25","CVE-2016-0984":"2022-05-25","CVE-2016-0034":"2022-05-25","CVE-2015-0310":"2022-05-25","CVE-2015-0016":"2022-05-25","CVE-2015-0071":"2022-05-25","CVE-2015-2360":"2022-05-25","CVE-2015-2425":"2022-05-25","CVE-2015-1769":"2022-05-25","CVE-2015-4495":"2022-05-25","CVE-2015-8651":"2022-05-25","CVE-2015-6175":"2022-05-25","CVE-2015-1671":"2022-05-25","CVE-2014-4148":"2022-05-25","CVE-2014-8439":"2022-05-25","CVE-2014-4123":"2022-05-25","CVE-2014-0546":"2022-05-25","CVE-2014-2817":"2022-05-25","CVE-2014-4077":"2022-05-25","CVE-2014-3153":"2022-05-25","CVE-2013-7331":"2022-05-25","CVE-2013-3993":"2022-05-25","CVE-2013-3896":"2022-05-25","CVE-2013-2423":"2022-05-25","CVE-2013-0431":"2022-05-25","CVE-2013-0422":"2022-05-25","CVE-2013-0074":"2022-05-25","CVE-2012-1710":"2022-05-25","CVE-2010-1428":"2022-05-25","CVE-2010-0840":"2022-05-25","CVE-2010-0738":"2022-05-25","CVE-2018-8611":"2022-05-24","CVE-2018-19953":"2022-05-24","CVE-2018-19949":"2022-05-24","CVE-2018-19943":"2022-05-24","CVE-2017-0147":"2022-05-24","CVE-2017-0022":"2022-05-24","CVE-2017-0005":"2022-05-24","CVE-2017-0149":"2022-05-24","CVE-2017-0210":"2022-05-24","CVE-2017-8291":"2022-05-24","CVE-2017-8543":"2022-05-24","CVE-2017-18362":"2022-05-24","CVE-2016-0162":"2022-05-24","CVE-2016-3351":"2022-05-24","CVE-2016-4655":"2022-05-24","CVE-2016-4656":"2022-05-24","CVE-2016-4657":"2022-05-24","CVE-2016-6366":"2022-05-24","CVE-2016-6367":"2022-05-24","CVE-2016-3298":"2022-05-24","CVE-2022-20821":"2022-05-23","CVE-2021-1048":"2022-05-23","CVE-2021-0920":"2022-05-23","CVE-2021-30883":"2022-05-23","CVE-2020-1027":"2022-05-23","CVE-2020-0638":"2022-05-23","CVE-2019-7286":"2022-05-23","CVE-2019-7287":"2022-05-23","CVE-2019-0676":"2022-05-23","CVE-2019-5786":"2022-05-23","CVE-2019-0703":"2022-05-23","CVE-2019-0880":"2022-05-23","CVE-2019-13720":"2022-05-23","CVE-2019-11707":"2022-05-23","CVE-2019-11708":"2022-05-23","CVE-2019-8720":"2022-05-23","CVE-2019-18426":"2022-05-23","CVE-2019-1385":"2022-05-23","CVE-2019-1130":"2022-05-23","CVE-2018-5002":"2022-05-23","CVE-2018-8589":"2022-05-23","CVE-2022-30525":"2022-05-16","CVE-2022-22947":"2022-05-16","CVE-2022-1388":"2022-05-10","CVE-2021-1789":"2022-05-04","CVE-2019-8506":"2022-05-04","CVE-2014-4113":"2022-05-04","CVE-2014-0322":"2022-05-04","CVE-2014-0160":"2022-05-04","CVE-2022-29464":"2022-04-25","CVE-2022-26904":"2022-04-25","CVE-2022-21919":"2022-04-25","CVE-2022-0847":"2022-04-25","CVE-2021-41357":"2022-04-25","CVE-2021-40450":"2022-04-25","CVE-2019-1003029":"2022-04-25","CVE-2018-6882":"2022-04-19","CVE-2019-3568":"2022-04-19","CVE-2022-22718":"2022-04-19","CVE-2022-22960":"2022-04-15","CVE-2022-1364":"2022-04-15","CVE-2019-3929":"2022-04-15","CVE-2019-16057":"2022-04-15","CVE-2018-7841":"2022-04-15","CVE-2016-4523":"2022-04-15","CVE-2014-0780":"2022-04-15","CVE-2010-5330":"2022-04-15","CVE-2007-3010":"2022-04-15","CVE-2022-22954":"2022-04-14","CVE-2022-24521":"2022-04-13","CVE-2018-7602":"2022-04-13","CVE-2018-20753":"2022-04-13","CVE-2015-5123":"2022-04-13","CVE-2015-5122":"2022-04-13","CVE-2015-3113":"2022-04-13","CVE-2015-2502":"2022-04-13","CVE-2015-0313":"2022-04-13","CVE-2015-0311":"2022-04-13","CVE-2014-9163":"2022-04-13","CVE-2022-23176":"2022-04-11","CVE-2021-42287":"2022-04-11","CVE-2021-42278":"2022-04-11","CVE-2021-39793":"2022-04-11","CVE-2021-27852":"2022-04-11","CVE-2021-22600":"2022-04-11","CVE-2020-2509":"2022-04-11","CVE-2017-11317":"2022-04-11","CVE-2021-3156":"2022-04-06","CVE-2021-31166":"2022-04-06","CVE-2017-0148":"2022-04-06","CVE-2022-22965":"2022-04-04","CVE-2022-22675":"2022-04-04","CVE-2022-22674":"2022-04-04","CVE-2021-45382":"2022-04-04","CVE-2022-26871":"2022-03-31","CVE-2022-1040":"2022-03-31","CVE-2021-34484":"2022-03-31","CVE-2021-28799":"2022-03-31","CVE-2021-21551":"2022-03-31","CVE-2018-10562":"2022-03-31","CVE-2018-10561":"2022-03-31","CVE-2022-1096":"2022-03-28","CVE-2022-0543":"2022-03-28","CVE-2021-38646":"2022-03-28","CVE-2021-34486":"2022-03-28","CVE-2021-26085":"2022-03-28","CVE-2021-20028":"2022-03-28","CVE-2019-7483":"2022-03-28","CVE-2018-8440":"2022-03-28","CVE-2018-8406":"2022-03-28","CVE-2018-8405":"2022-03-28","CVE-2017-0213":"2022-03-28","CVE-2017-0059":"2022-03-28","CVE-2017-0037":"2022-03-28","CVE-2016-7201":"2022-03-28","CVE-2016-7200":"2022-03-28","CVE-2016-0189":"2022-03-28","CVE-2016-0151":"2022-03-28","CVE-2016-0040":"2022-03-28","CVE-2015-2426":"2022-03-28","CVE-2015-2419":"2022-03-28","CVE-2015-1770":"2022-03-28","CVE-2013-3660":"2022-03-28","CVE-2013-2729":"2022-03-28","CVE-2013-2551":"2022-03-28","CVE-2013-2465":"2022-03-28","CVE-2013-1690":"2022-03-28","CVE-2012-5076":"2022-03-28","CVE-2012-2539":"2022-03-28","CVE-2012-2034":"2022-03-28","CVE-2012-0518":"2022-03-28","CVE-2011-2005":"2022-03-28","CVE-2010-4398":"2022-03-28","CVE-2022-26318":"2022-03-25","CVE-2022-26143":"2022-03-25","CVE-2022-21999":"2022-03-25","CVE-2021-42237":"2022-03-25","CVE-2021-22941":"2022-03-25","CVE-2020-9377":"2022-03-25","CVE-2020-9054":"2022-03-25","CVE-2020-7247":"2022-03-25","CVE-2020-5410":"2022-03-25","CVE-2020-25223":"2022-03-25","CVE-2020-2506":"2022-03-25","CVE-2020-2021":"2022-03-25","CVE-2020-1956":"2022-03-25","CVE-2020-1631":"2022-03-25","CVE-2019-6340":"2022-03-25","CVE-2019-2616":"2022-03-25","CVE-2019-16920":"2022-03-25","CVE-2019-15107":"2022-03-25","CVE-2019-12991":"2022-03-25","CVE-2019-12989":"2022-03-25","CVE-2019-11043":"2022-03-25","CVE-2019-10068":"2022-03-25","CVE-2019-1003030":"2022-03-25","CVE-2019-0903":"2022-03-25","CVE-2018-8414":"2022-03-25","CVE-2018-8373":"2022-03-25","CVE-2018-6961":"2022-03-25","CVE-2018-14839":"2022-03-25","CVE-2018-1273":"2022-03-25","CVE-2018-11138":"2022-03-25","CVE-2018-0147":"2022-03-25","CVE-2018-0125":"2022-03-25","CVE-2017-6334":"2022-03-25","CVE-2017-6316":"2022-03-25","CVE-2017-3881":"2022-03-25","CVE-2017-12617":"2022-03-25","CVE-2017-12615":"2022-03-25","CVE-2017-0146":"2022-03-25","CVE-2016-7892":"2022-03-25","CVE-2016-4171":"2022-03-25","CVE-2016-1555":"2022-03-25","CVE-2016-11021":"2022-03-25","CVE-2016-10174":"2022-03-25","CVE-2016-0752":"2022-03-25","CVE-2015-4068":"2022-03-25","CVE-2015-3035":"2022-03-25","CVE-2015-1427":"2022-03-25","CVE-2015-1187":"2022-03-25","CVE-2015-0666":"2022-03-25","CVE-2014-6332":"2022-03-25","CVE-2014-6324":"2022-03-25","CVE-2014-6287":"2022-03-25","CVE-2014-3120":"2022-03-25","CVE-2014-0130":"2022-03-25","CVE-2013-5223":"2022-03-25","CVE-2013-4810":"2022-03-25","CVE-2013-2251":"2022-03-25","CVE-2012-1823":"2022-03-25","CVE-2010-4345":"2022-03-25","CVE-2010-4344":"2022-03-25","CVE-2010-3035":"2022-03-25","CVE-2010-2861":"2022-03-25","CVE-2009-2055":"2022-03-25","CVE-2009-1151":"2022-03-25","CVE-2009-0927":"2022-03-25","CVE-2005-2773":"2022-03-25","CVE-2020-5135":"2022-03-15","CVE-2019-1405":"2022-03-15","CVE-2019-1322":"2022-03-15","CVE-2019-1315":"2022-03-15","CVE-2019-1253":"2022-03-15","CVE-2019-1132":"2022-03-15","CVE-2019-1129":"2022-03-15","CVE-2019-1069":"2022-03-15","CVE-2019-1064":"2022-03-15","CVE-2019-0841":"2022-03-15","CVE-2019-0543":"2022-03-15","CVE-2018-8120":"2022-03-15","CVE-2017-0101":"2022-03-15","CVE-2016-3309":"2022-03-15","CVE-2015-2546":"2022-03-15","CVE-2022-26486":"2022-03-07","CVE-2022-26485":"2022-03-07","CVE-2021-21973":"2022-03-07","CVE-2020-8218":"2022-03-07","CVE-2019-11581":"2022-03-07","CVE-2017-6077":"2022-03-07","CVE-2016-6277":"2022-03-07","CVE-2013-0631":"2022-03-07","CVE-2013-0629":"2022-03-07","CVE-2013-0625":"2022-03-07","CVE-2009-3960":"2022-03-07","CVE-2022-20708":"2022-03-03","CVE-2022-20703":"2022-03-03","CVE-2022-20701":"2022-03-03","CVE-2022-20700":"2022-03-03","CVE-2022-20699":"2022-03-03","CVE-2021-41379":"2022-03-03","CVE-2020-1938":"2022-03-03","CVE-2020-11899":"2022-03-03","CVE-2019-16928":"2022-03-03","CVE-2019-1652":"2022-03-03","CVE-2019-1297":"2022-03-03","CVE-2018-8581":"2022-03-03","CVE-2018-8298":"2022-03-03","CVE-2018-0180":"2022-03-03","CVE-2018-0179":"2022-03-03","CVE-2018-0175":"2022-03-03","CVE-2018-0174":"2022-03-03","CVE-2018-0173":"2022-03-03","CVE-2018-0172":"2022-03-03","CVE-2018-0167":"2022-03-03","CVE-2018-0161":"2022-03-03","CVE-2018-0159":"2022-03-03","CVE-2018-0158":"2022-03-03","CVE-2018-0156":"2022-03-03","CVE-2018-0155":"2022-03-03","CVE-2018-0154":"2022-03-03","CVE-2018-0151":"2022-03-03","CVE-2017-8540":"2022-03-03","CVE-2017-6744":"2022-03-03","CVE-2017-6743":"2022-03-03","CVE-2017-6740":"2022-03-03","CVE-2017-6739":"2022-03-03","CVE-2017-6738":"2022-03-03","CVE-2017-6737":"2022-03-03","CVE-2017-6736":"2022-03-03","CVE-2017-6663":"2022-03-03","CVE-2017-6627":"2022-03-03","CVE-2017-12319":"2022-03-03","CVE-2017-12240":"2022-03-03","CVE-2017-12238":"2022-03-03","CVE-2017-12237":"2022-03-03","CVE-2017-12235":"2022-03-03","CVE-2017-12234":"2022-03-03","CVE-2017-12233":"2022-03-03","CVE-2017-12232":"2022-03-03","CVE-2017-12231":"2022-03-03","CVE-2017-11826":"2022-03-03","CVE-2017-11292":"2022-03-03","CVE-2017-0261":"2022-03-03","CVE-2017-0001":"2022-03-03","CVE-2016-8562":"2022-03-03","CVE-2016-7855":"2022-03-03","CVE-2016-7262":"2022-03-03","CVE-2016-7193":"2022-03-03","CVE-2016-5195":"2022-03-03","CVE-2016-4117":"2022-03-03","CVE-2016-1019":"2022-03-03","CVE-2016-0099":"2022-03-03","CVE-2015-7645":"2022-03-03","CVE-2015-5119":"2022-03-03","CVE-2015-4902":"2022-03-03","CVE-2015-3043":"2022-03-03","CVE-2015-2590":"2022-03-03","CVE-2015-2545":"2022-03-03","CVE-2015-2424":"2022-03-03","CVE-2015-2387":"2022-03-03","CVE-2015-1701":"2022-03-03","CVE-2015-1642":"2022-03-03","CVE-2014-4114":"2022-03-03","CVE-2014-0496":"2022-03-03","CVE-2013-5065":"2022-03-03","CVE-2013-3897":"2022-03-03","CVE-2013-3346":"2022-03-03","CVE-2013-1675":"2022-03-03","CVE-2013-1347":"2022-03-03","CVE-2013-0641":"2022-03-03","CVE-2013-0640":"2022-03-03","CVE-2013-0632":"2022-03-03","CVE-2012-4681":"2022-03-03","CVE-2012-1856":"2022-03-03","CVE-2012-1723":"2022-03-03","CVE-2012-1535":"2022-03-03","CVE-2012-0507":"2022-03-03","CVE-2011-3544":"2022-03-03","CVE-2011-1889":"2022-03-03","CVE-2011-0611":"2022-03-03","CVE-2010-3333":"2022-03-03","CVE-2010-0232":"2022-03-03","CVE-2010-0188":"2022-03-03","CVE-2009-3129":"2022-03-03","CVE-2009-1123":"2022-03-03","CVE-2008-3431":"2022-03-03","CVE-2008-2992":"2022-03-03","CVE-2004-0210":"2022-03-03","CVE-2002-0367":"2022-03-03","CVE-2022-24682":"2022-02-25","CVE-2017-8570":"2022-02-25","CVE-2017-0222":"2022-02-25","CVE-2014-6352":"2022-02-25","CVE-2022-23131":"2022-02-22","CVE-2022-23134":"2022-02-22","CVE-2022-24086":"2022-02-15","CVE-2022-0609":"2022-02-15","CVE-2019-0752":"2022-02-15","CVE-2018-8174":"2022-02-15","CVE-2018-20250":"2022-02-15","CVE-2018-15982":"2022-02-15","CVE-2017-9841":"2022-02-15","CVE-2014-1761":"2022-02-15","CVE-2013-3906":"2022-02-15","CVE-2022-22620":"2022-02-11","CVE-2021-36934":"2022-02-10","CVE-2020-0796":"2022-02-10","CVE-2018-1000861":"2022-02-10","CVE-2017-9791":"2022-02-10","CVE-2017-8464":"2022-02-10","CVE-2017-10271":"2022-02-10","CVE-2017-0263":"2022-02-10","CVE-2017-0262":"2022-02-10","CVE-2017-0145":"2022-02-10","CVE-2017-0144":"2022-02-10","CVE-2016-3088":"2022-02-10","CVE-2015-2051":"2022-02-10","CVE-2015-1635":"2022-02-10","CVE-2015-1130":"2022-02-10","CVE-2014-4404":"2022-02-10","CVE-2022-21882":"2022-02-04","CVE-2022-22587":"2022-01-28","CVE-2021-20038":"2022-01-28","CVE-2020-5722":"2022-01-28","CVE-2020-0787":"2022-01-28","CVE-2017-5689":"2022-01-28","CVE-2014-1776":"2022-01-28","CVE-2014-6271":"2022-01-28","CVE-2014-7169":"2022-01-28","CVE-2006-1547":"2022-01-21","CVE-2012-0391":"2022-01-21","CVE-2018-8453":"2022-01-21","CVE-2021-35247":"2022-01-21","CVE-2021-32648":"2022-01-18","CVE-2021-25296":"2022-01-18","CVE-2021-25297":"2022-01-18","CVE-2021-25298":"2022-01-18","CVE-2021-40870":"2022-01-18","CVE-2021-33766":"2022-01-18","CVE-2021-21975":"2022-01-18","CVE-2021-21315":"2022-01-18","CVE-2021-22991":"2022-01-18","CVE-2020-14864":"2022-01-18","CVE-2020-13671":"2022-01-18","CVE-2020-11978":"2022-01-18","CVE-2020-13927":"2022-01-18","CVE-2021-22017":"2022-01-10","CVE-2021-36260":"2022-01-10","CVE-2020-6572":"2022-01-10","CVE-2019-1458":"2022-01-10","CVE-2013-3900":"2022-01-10","CVE-2019-2725":"2022-01-10","CVE-2019-9670":"2022-01-10","CVE-2018-13382":"2022-01-10","CVE-2018-13383":"2022-01-10","CVE-2019-1579":"2022-01-10","CVE-2019-10149":"2022-01-10","CVE-2015-7450":"2022-01-10","CVE-2017-1000486":"2022-01-10","CVE-2019-7609":"2022-01-10","CVE-2021-27860":"2022-01-10","CVE-2021-43890":"2021-12-15","CVE-2021-4102":"2021-12-15","CVE-2021-44515":"2021-12-10","CVE-2019-13272":"2021-12-10","CVE-2021-35394":"2021-12-10","CVE-2019-7238":"2021-12-10","CVE-2019-0193":"2021-12-10","CVE-2021-44168":"2021-12-10","CVE-2017-17562":"2021-12-10","CVE-2017-12149":"2021-12-10","CVE-2010-1871":"2021-12-10","CVE-2020-17463":"2021-12-10","CVE-2020-8816":"2021-12-10","CVE-2019-10758":"2021-12-10","CVE-2021-44228":"2021-12-10","CVE-2020-11261":"2021-12-01","CVE-2018-14847":"2021-12-01","CVE-2021-37415":"2021-12-01","CVE-2021-40438":"2021-12-01","CVE-2021-44077":"2021-12-01","CVE-2021-22204":"2021-11-17","CVE-2021-40449":"2021-11-17","CVE-2021-42321":"2021-11-17","CVE-2021-42292":"2021-11-17","CVE-2021-27104":"2021-11-03","CVE-2021-27102":"2021-11-03","CVE-2021-27101":"2021-11-03","CVE-2021-27103":"2021-11-03","CVE-2021-21017":"2021-11-03","CVE-2021-28550":"2021-11-03","CVE-2018-4939":"2021-11-03","CVE-2018-15961":"2021-11-03","CVE-2018-4878":"2021-11-03","CVE-2020-5735":"2021-11-03","CVE-2019-2215":"2021-11-03","CVE-2020-0041":"2021-11-03","CVE-2020-0069":"2021-11-03","CVE-2017-9805":"2021-11-03","CVE-2021-42013":"2021-11-03","CVE-2021-41773":"2021-11-03","CVE-2019-0211":"2021-11-03","CVE-2016-4437":"2021-11-03","CVE-2019-17558":"2021-11-03","CVE-2020-17530":"2021-11-03","CVE-2017-5638":"2021-11-03","CVE-2018-11776":"2021-11-03","CVE-2021-30858":"2021-11-03","CVE-2019-6223":"2021-11-03","CVE-2021-30860":"2021-11-03","CVE-2020-27930":"2021-11-03","CVE-2021-30807":"2021-11-03","CVE-2020-27950":"2021-11-03","CVE-2020-27932":"2021-11-03","CVE-2020-9818":"2021-11-03","CVE-2020-9819":"2021-11-03","CVE-2021-30762":"2021-11-03","CVE-2021-1782":"2021-11-03","CVE-2021-1870":"2021-11-03","CVE-2021-1871":"2021-11-03","CVE-2021-1879":"2021-11-03","CVE-2021-30661":"2021-11-03","CVE-2021-30666":"2021-11-03","CVE-2021-30713":"2021-11-03","CVE-2021-30657":"2021-11-03","CVE-2021-30665":"2021-11-03","CVE-2021-30663":"2021-11-03","CVE-2021-30761":"2021-11-03","CVE-2021-30869":"2021-11-03","CVE-2020-9859":"2021-11-03","CVE-2021-20090":"2021-11-03","CVE-2021-27562":"2021-11-03","CVE-2021-28664":"2021-11-03","CVE-2021-28663":"2021-11-03","CVE-2019-3398":"2021-11-03","CVE-2021-26084":"2021-11-03","CVE-2019-11580":"2021-11-03","CVE-2019-3396":"2021-11-03","CVE-2021-42258":"2021-11-03","CVE-2020-3452":"2021-11-03","CVE-2020-3580":"2021-11-03","CVE-2021-1497":"2021-11-03","CVE-2021-1498":"2021-11-03","CVE-2018-0171":"2021-11-03","CVE-2020-3118":"2021-11-03","CVE-2020-3566":"2021-11-03","CVE-2020-3569":"2021-11-03","CVE-2020-3161":"2021-11-03","CVE-2019-1653":"2021-11-03","CVE-2018-0296":"2021-11-03","CVE-2019-13608":"2021-11-03","CVE-2020-8193":"2021-11-03","CVE-2020-8195":"2021-11-03","CVE-2020-8196":"2021-11-03","CVE-2019-19781":"2021-11-03","CVE-2019-11634":"2021-11-03","CVE-2020-29557":"2021-11-03","CVE-2020-25506":"2021-11-03","CVE-2018-15811":"2021-11-03","CVE-2018-18325":"2021-11-03","CVE-2017-9822":"2021-11-03","CVE-2019-15752":"2021-11-03","CVE-2020-8515":"2021-11-03","CVE-2018-7600":"2021-11-03","CVE-2021-22205":"2021-11-03","CVE-2018-6789":"2021-11-03","CVE-2020-8657":"2021-11-03","CVE-2020-8655":"2021-11-03","CVE-2020-5902":"2021-11-03","CVE-2021-22986":"2021-11-03","CVE-2021-35464":"2021-11-03","CVE-2019-5591":"2021-11-03","CVE-2020-12812":"2021-11-03","CVE-2018-13379":"2021-11-03","CVE-2020-16010":"2021-11-03","CVE-2020-15999":"2021-11-03","CVE-2021-21166":"2021-11-03","CVE-2020-16017":"2021-11-03","CVE-2021-37976":"2021-11-03","CVE-2020-16009":"2021-11-03","CVE-2021-30632":"2021-11-03","CVE-2020-16013":"2021-11-03","CVE-2021-30633":"2021-11-03","CVE-2021-21148":"2021-11-03","CVE-2021-37973":"2021-11-03","CVE-2021-30551":"2021-11-03","CVE-2021-37975":"2021-11-03","CVE-2020-6418":"2021-11-03","CVE-2021-30554":"2021-11-03","CVE-2021-21206":"2021-11-03","CVE-2021-38000":"2021-11-03","CVE-2021-38003":"2021-11-03","CVE-2021-21224":"2021-11-03","CVE-2021-21193":"2021-11-03","CVE-2021-21220":"2021-11-03","CVE-2021-30563":"2021-11-03","CVE-2020-4430":"2021-11-03","CVE-2020-4427":"2021-11-03","CVE-2020-4428":"2021-11-03","CVE-2019-4716":"2021-11-03","CVE-2016-3715":"2021-11-03","CVE-2016-3718":"2021-11-03","CVE-2020-15505":"2021-11-03","CVE-2021-30116":"2021-11-03","CVE-2020-7961":"2021-11-03","CVE-2021-23874":"2021-11-03","CVE-2021-22506":"2021-11-03","CVE-2021-22502":"2021-11-03","CVE-2014-1812":"2021-11-03","CVE-2021-38647":"2021-11-03","CVE-2016-0167":"2021-11-03","CVE-2020-0878":"2021-11-03","CVE-2021-31955":"2021-11-03","CVE-2021-1647":"2021-11-03","CVE-2021-33739":"2021-11-03","CVE-2016-0185":"2021-11-03","CVE-2020-0683":"2021-11-03","CVE-2020-17087":"2021-11-03","CVE-2021-33742":"2021-11-03","CVE-2021-31199":"2021-11-03","CVE-2021-33771":"2021-11-03","CVE-2021-31956":"2021-11-03","CVE-2021-31201":"2021-11-03","CVE-2021-31979":"2021-11-03","CVE-2020-0938":"2021-11-03","CVE-2020-17144":"2021-11-03","CVE-2020-0986":"2021-11-03","CVE-2020-1020":"2021-11-03","CVE-2021-38645":"2021-11-03","CVE-2021-34523":"2021-11-03","CVE-2017-7269":"2021-11-03","CVE-2021-36948":"2021-11-03","CVE-2021-38649":"2021-11-03","CVE-2020-0688":"2021-11-03","CVE-2017-0143":"2021-11-03","CVE-2016-7255":"2021-11-03","CVE-2019-0708":"2021-11-03","CVE-2021-34473":"2021-11-03","CVE-2020-1464":"2021-11-03","CVE-2021-1732":"2021-11-03","CVE-2021-34527":"2021-11-03","CVE-2021-31207":"2021-11-03","CVE-2019-0803":"2021-11-03","CVE-2020-1040":"2021-11-03","CVE-2021-28310":"2021-11-03","CVE-2020-1350":"2021-11-03","CVE-2021-26411":"2021-11-03","CVE-2019-0859":"2021-11-03","CVE-2021-40444":"2021-11-03","CVE-2017-8759":"2021-11-03","CVE-2018-8653":"2021-11-03","CVE-2019-0797":"2021-11-03","CVE-2021-36942":"2021-11-03","CVE-2019-1215":"2021-11-03","CVE-2018-0798":"2021-11-03","CVE-2018-0802":"2021-11-03","CVE-2012-0158":"2021-11-03","CVE-2015-1641":"2021-11-03","CVE-2021-27085":"2021-11-03","CVE-2019-0541":"2021-11-03","CVE-2017-11882":"2021-11-03","CVE-2020-0674":"2021-11-03","CVE-2021-27059":"2021-11-03","CVE-2019-1367":"2021-11-03","CVE-2017-0199":"2021-11-03","CVE-2020-1380":"2021-11-03","CVE-2019-1429":"2021-11-03","CVE-2017-11774":"2021-11-03","CVE-2020-0968":"2021-11-03","CVE-2020-1472":"2021-11-03","CVE-2021-26855":"2021-11-03","CVE-2021-26858":"2021-11-03","CVE-2021-27065":"2021-11-03","CVE-2020-1054":"2021-11-03","CVE-2021-1675":"2021-11-03","CVE-2021-34448":"2021-11-03","CVE-2020-0601":"2021-11-03","CVE-2019-0604":"2021-11-03","CVE-2020-0646":"2021-11-03","CVE-2019-0808":"2021-11-03","CVE-2021-26857":"2021-11-03","CVE-2020-1147":"2021-11-03","CVE-2019-1214":"2021-11-03","CVE-2016-3235":"2021-11-03","CVE-2019-0863":"2021-11-03","CVE-2021-36955":"2021-11-03","CVE-2021-38648":"2021-11-03","CVE-2020-6819":"2021-11-03","CVE-2020-6820":"2021-11-03","CVE-2019-17026":"2021-11-03","CVE-2019-15949":"2021-11-03","CVE-2020-26919":"2021-11-03","CVE-2019-19356":"2021-11-03","CVE-2020-2555":"2021-11-03","CVE-2012-3152":"2021-11-03","CVE-2020-14871":"2021-11-03","CVE-2015-4852":"2021-11-03","CVE-2020-14750":"2021-11-03","CVE-2020-14882":"2021-11-03","CVE-2020-14883":"2021-11-03","CVE-2020-8644":"2021-11-03","CVE-2019-18935":"2021-11-03","CVE-2021-22893":"2021-11-03","CVE-2020-8243":"2021-11-03","CVE-2021-22900":"2021-11-03","CVE-2021-22894":"2021-11-03","CVE-2020-8260":"2021-11-03","CVE-2021-22899":"2021-11-03","CVE-2019-11510":"2021-11-03","CVE-2019-11539":"2021-11-03","CVE-2021-1906":"2021-11-03","CVE-2021-1905":"2021-11-03","CVE-2020-10221":"2021-11-03","CVE-2021-35395":"2021-11-03","CVE-2017-16651":"2021-11-03","CVE-2020-11652":"2021-11-03","CVE-2020-11651":"2021-11-03","CVE-2020-16846":"2021-11-03","CVE-2018-2380":"2021-11-03","CVE-2010-5326":"2021-11-03","CVE-2016-9563":"2021-11-03","CVE-2020-6287":"2021-11-03","CVE-2020-6207":"2021-11-03","CVE-2016-3976":"2021-11-03","CVE-2019-16256":"2021-11-03","CVE-2020-10148":"2021-11-03","CVE-2021-35211":"2021-11-03","CVE-2016-3643":"2021-11-03","CVE-2020-10199":"2021-11-03","CVE-2021-20021":"2021-11-03","CVE-2019-7481":"2021-11-03","CVE-2021-20022":"2021-11-03","CVE-2021-20023":"2021-11-03","CVE-2021-20016":"2021-11-03","CVE-2020-12271":"2021-11-03","CVE-2020-10181":"2021-11-03","CVE-2017-6327":"2021-11-03","CVE-2019-18988":"2021-11-03","CVE-2017-9248":"2021-11-03","CVE-2021-31755":"2021-11-03","CVE-2020-10987":"2021-11-03","CVE-2018-14558":"2021-11-03","CVE-2018-20062":"2021-11-03","CVE-2019-9082":"2021-11-03","CVE-2019-18187":"2021-11-03","CVE-2020-8467":"2021-11-03","CVE-2020-8468":"2021-11-03","CVE-2020-24557":"2021-11-03","CVE-2020-8599":"2021-11-03","CVE-2021-36742":"2021-11-03","CVE-2021-36741":"2021-11-03","CVE-2019-20085":"2021-11-03","CVE-2020-5849":"2021-11-03","CVE-2020-5847":"2021-11-03","CVE-2019-16759":"2021-11-03","CVE-2020-17496":"2021-11-03","CVE-2019-5544":"2021-11-03","CVE-2020-3992":"2021-11-03","CVE-2020-3950":"2021-11-03","CVE-2021-22005":"2021-11-03","CVE-2020-3952":"2021-11-03","CVE-2021-21972":"2021-11-03","CVE-2021-21985":"2021-11-03","CVE-2020-4006":"2021-11-03","CVE-2020-25213":"2021-11-03","CVE-2020-11738":"2021-11-03","CVE-2019-9978":"2021-11-03","CVE-2021-27561":"2021-11-03","CVE-2021-40539":"2021-11-03","CVE-2020-10189":"2021-11-03","CVE-2019-8394":"2021-11-03","CVE-2020-29583":"2021-11-03"},"info":{"CVE-2026-106931":{"s":8.5,"v":"HIGH","x":"SiteGuard Server Edition contains an OS command injection vulnerability, which may allow an attacker to execute arbitrary OS commands with root or SYSTEM privileges on the system running the affected product.","vp":"EG Secure Solutions Inc. SiteGuard Server Edition for Apache httpd","t":"","p":1791953107678},"CVE-2017-7170":{"x":"An issue was discovered in certain Apple products. macOS before 10.13.1 is affected. The issue involves the \"Security\" component. It allows attackers to execute arbitrary code in a privileged context via a crafted app.","vp":"n/a n/a","t":"","p":1522735200000},"CVE-2019-8521":{"x":"This issue was addressed with improved checks. This issue is fixed in iOS 12.2, macOS Mojave 10.14.4. A malicious application may be able to overwrite arbitrary files.","vp":"Apple iOS","t":"","p":1576690396000},"CVE-2019-8565":{"x":"A race condition was addressed with additional validation. This issue is fixed in iOS 12.2, macOS Mojave 10.14.4. A malicious application may be able to gain root privileges.","vp":"Apple iOS","t":"","p":1576690398000},"CVE-2026-0307":{"s":5.9,"v":"MEDIUM","x":"Multiple local privilege escalation vulnerabilities in the Palo Alto Networks GlobalProtect™ app allows a local user to escalate their privileges to NT AUTHORITY\\SYSTEM on Windows and root on macOS and Linux. This enables a non-administrative user to execute arbitrary commands with administrative privileges.\n\n\n\nThis…","vp":"Palo Alto Networks GlobalProtect App","t":"GlobalProtect App: Local Privilege Escalation Vulnerabilities","p":1789019513090},"CVE-2026-88771":{"s":9.8,"v":"CRITICAL","x":"Improper input validation vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway.\n\nThis issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP; Gateway: before 14.1-73.37 and before 13.1-64.23 leading to an unauthenticated attacker to execute…","vp":"Citrix NetScaler ADC","t":"A remote code execution vulnerability exists due to improper input validation, which can allow an unauthenticated attacker to execute arbitrary commands","p":1790524927001},"CVE-2026-107406":{"s":9.5,"v":"CRITICAL","x":"Memory overflow vulnerability leading to Remote Code Execution or Denial of Service Vulnerability in NetScaler ADC.\n\n\nNetScaler ADC or NetScaler Gateway must be configured as a SAML SP or SAML IdP, subject to the following version-specific requirements:\n\n\n\n \n\n  *  For the following versions: Applicable only when…","vp":"NetScaler ADC","t":"Memory overflow vulnerability leading to Remote Code Execution or Denial of Service","p":1791494288336},"CVE-2026-103849":{"s":10,"v":"CRITICAL","x":"Adobe Commerce is affected by an Improper Neutralization of Special Elements Used in a Template Engine vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue does not…","vp":"Adobe Adobe Commerce","t":"Adobe Commerce | Improper Neutralization of Special Elements Used in a Template Engine (CWE-1336)","p":1791915353468},"CVE-2026-16756":{"s":7.5,"v":"HIGH","x":"Missing connection and header-read timeouts and the absence of a concurrent-connection cap in the default serve() path of Amazon aws-smithy-http-server might allow remote attackers to cause a denial of service by opening many connections and sending partial requests that are never completed, exhausting server sockets…","vp":"AWS aws-smithy-http-server","t":"Allocation of resources without limits in the default aws-smithy-http-server serve() path allows unauthenticated Slowloris denial of service","p":1784831573792},"CVE-2025-4318":{"s":9,"v":"CRITICAL","x":"The AWS Amplify Studio UI component property expressions in the aws-amplify/amplify-codegen-ui package lack input validation. This could potentially allow an authenticated user who has access to create or modify components to run arbitrary JavaScript code during the component rendering and build process.","vp":"Amazon Amplify Studio","t":"Input validation issue in AWS Amplify Studio UI component properties","p":1746468994075},"CVE-2026-16317":{"s":6.5,"v":"MEDIUM","x":"Missing validation of the outer content_type byte on TLS 1.3 encrypted records in s2n-tls allows an active man-in-the-middle to silently discard individual application data records without either endpoint detecting the modification. RFC 8446 Section 5.2 requires that the outer content_type of all encrypted TLS 1.3…","vp":"AWS s2n-tls","t":"Silent Drop of TLS 1.3 Encrypted Records in s2n-tls","p":1784664768047},"CVE-2026-16318":{"s":5.3,"v":"MEDIUM","x":"The QUIC transport parameters extension handler in s2n-tls incorrectly uses s2n_alloc instead of s2n_realloc to store the peer's transport parameters. When a TLS 1.3 connection goes through a HelloRetryRequest, the handler is called twice on the same connection. On the second call, s2n_alloc zeroes the existing…","vp":"Amazon s2n-tls","t":"QUIC Transport Parameters Memory Leak During HelloRetryRequest in s2n-tls","p":1784664842363},"CVE-2026-18394":{"s":7.4,"v":"HIGH","x":"Incorrect authorization in the http_request tool in Strands Agents Tools before 0.8.2 might allow remote attackers to obtain credentials configured via HTTP_REQUEST_TOKEN_CONFIG by influencing the LLM to route requests through actor-controlled proxy infrastructure.\n\n\n\nTo remediate this issue, users should upgrade to…","vp":"AWS Strands Agents Tools","t":"Incorrect authorization in Strands Agents Tools http_request proxy credential exfiltration","p":1785526455007},"CVE-2026-102551":{"s":7.7,"v":"HIGH","x":"Improper verification of the source of a communication channel in the IPv6 Router Advertisement handler in Amazon FreeRTOS-Plus-TCP before V4.4.2 might allow a remote third-party to influence an endpoint's IPv6 default gateway, on-link prefix, and address configuration via a crafted Router Advertisement.\n\n\n\nTo…","vp":"FreeRTOS FreeRTOS-Plus-TCP","t":"Improper verification of the source of a communication channel in FreeRTOS-Plus-TCP Router Advertisement handling","p":1792171658483},"CVE-2026-102552":{"s":5.9,"v":"MEDIUM","x":"Improper verification of the source of a communication channel in the DNS resolver in Amazon FreeRTOS-Plus-TCP before V4.4.2 might allow remote third-party to insert a chosen address into the device's DNS cache via a forged DNS reply.\n\n\n\nTo remediate this issue, users should upgrade to version V4.4.2 and enable…","vp":"FreeRTOS FreeRTOS-Plus-TCP","t":"Improper verification of the source of a communication channel in FreeRTOS-Plus-TCP DNS resolver","p":1792171727578},"CVE-2026-105008":{"s":9,"v":"CRITICAL","x":"No cwe for this issue in Windows Schannel allows an unauthorized attacker to perform spoofing over a network.","vp":"Microsoft Windows 10 Version 1607","t":"Windows Schannel Spoofing Vulnerability","p":1791918097067},"CVE-2026-96044":{"s":8.8,"v":"HIGH","x":"No cwe for this issue in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.","vp":"Microsoft Microsoft SharePoint Server Subscription Edition","t":"Microsoft Office SharePoint Elevation of Privilege Vulnerability","p":1791918075330},"CVE-2026-108471":{"s":8.8,"v":"HIGH","x":"Untrusted pointer dereference in Windows Virtualization-Based Security (VBS) Enclave allows an authorized attacker to elevate privileges locally.","vp":"Microsoft Windows 10 Version 1809","t":"Windows Virtualization-Based Security (VBS) Enclave Elevation of Privilege Vulnerability","p":1791918105427},"CVE-2026-83518":{"s":7.8,"v":"HIGH","x":"Heap-based buffer overflow in RPC Runtime allows an authorized attacker to elevate privileges locally.","vp":"Microsoft Windows 11 version 23H2","t":"RPC Runtime Elevation of Privilege Vulnerability","p":1791917986324},"CVE-2026-108465":{"s":7,"v":"HIGH","x":"Use after free in Windows Update Delivery Optimization allows an authorized attacker to elevate privileges locally.","vp":"Microsoft Windows 10 Version 1809","t":"Windows Update Delivery Optimization Elevation of Privilege Vulnerability","p":1791917972271},"CVE-2026-83831":{},"CVE-2026-85890":{},"CVE-2026-85897":{},"CVE-2026-85898":{},"CVE-2026-96198":{},"CVE-2026-96199":{},"CVE-2026-106287":{"s":4.3,"v":"MEDIUM","x":"Information loss in CORS in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to bypass web origin policy via crafted network traffic. (Chromium security severity: Low)","vp":"Google Chrome","t":"","p":1791312096088},"CVE-2026-106288":{"s":5.4,"v":"MEDIUM","x":"Missing authorization in Browser in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Low)","vp":"Google Chrome","t":"","p":1791312100400},"CVE-2026-106289":{"s":6.5,"v":"MEDIUM","x":"Missing authorization in FedCM in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)","vp":"Google Chrome","t":"","p":1791312085919},"CVE-2026-106291":{"s":8.8,"v":"HIGH","x":"Use after free in GarbageCollection in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)","vp":"Google Chrome","t":"","p":1791312077228},"CVE-2026-106292":{"s":8.3,"v":"HIGH","x":"Buffer overflow in Fonts in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)","vp":"Google Chrome","t":"","p":1791312089084},"CVE-2026-106412":{"s":8.3,"v":"HIGH","x":"Race condition in Core in Google Chrome on on Mac prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)","vp":"Google Chrome","t":"","p":1791312068397},"CVE-2026-106293":{"s":8.3,"v":"HIGH","x":"Type confusion in ANGLE in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)","vp":"Google Chrome","t":"","p":1791312068068},"CVE-2026-106413":{"s":4.2,"v":"MEDIUM","x":"Race condition in Browser in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to spoof UI elements via a crafted HTML page. (Chromium security severity: Low)","vp":"Google Chrome","t":"","p":1791312101308},"CVE-2026-106294":{"s":9.1,"v":"CRITICAL","x":"Incomplete cleanup in Chromoting in Google Chrome on on Mac prior to 155.0.8059.39 allowed a remote attacker to bypass system access restrictions via crafted network traffic. (Chromium security severity: Low)","vp":"Google Chrome","t":"","p":1791312102565},"CVE-2026-106415":{"s":4.3,"v":"MEDIUM","x":"Information leak in Enterprise in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to leak sensitive information via a crafted HTML page. (Chromium security severity: Medium)","vp":"Google Chrome","t":"","p":1791312079402},"CVE-2026-106295":{"s":4.2,"v":"MEDIUM","x":"Incorrect authorization in Unbounded Element in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium)","vp":"Google Chrome","t":"","p":1791312091163},"CVE-2026-106416":{"s":5.4,"v":"MEDIUM","x":"Code injection in Extensions in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted Chrome extension. (Chromium security severity: Medium)","vp":"Google Chrome","t":"","p":1791312083509},"CVE-2026-106297":{"s":4.3,"v":"MEDIUM","x":"Incorrect authorization in Scheduling in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low)","vp":"Google Chrome","t":"","p":1791312096240},"CVE-2026-106417":{"s":9.6,"v":"CRITICAL","x":"Integer overflow in Media in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Low)","vp":"Google Chrome","t":"","p":1791312098420},"CVE-2026-106299":{"s":5.4,"v":"MEDIUM","x":"Improper input validation in WebAudio in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Low)","vp":"Google Chrome","t":"","p":1791312096984},"CVE-2026-106418":{"s":6.5,"v":"MEDIUM","x":"Missing authorization in Network in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to bypass web origin policy via crafted network traffic. (Chromium security severity: Low)","vp":"Google Chrome","t":"","p":1791312100709},"CVE-2026-106300":{"s":4.7,"v":"MEDIUM","x":"Race condition in CacheStorage in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)","vp":"Google Chrome","t":"","p":1791312077394},"CVE-2026-106420":{"s":5.4,"v":"MEDIUM","x":"Incorrect calculation in API in Google Chrome on on Windows prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted Chrome extension. (Chromium security severity: Medium)","vp":"Google Chrome","t":"","p":1791312075372},"CVE-2026-106301":{"s":8.1,"v":"HIGH","x":"Confused deputy in Contextual Tasks in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to bypass system access restrictions into a privileged page via a crafted HTML page. (Chromium security severity: Medium)","vp":"Google Chrome","t":"","p":1791312088939},"CVE-2026-106421":{"s":8.8,"v":"HIGH","x":"Use after free in PDF in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)","vp":"Google Chrome","t":"","p":1791312074440},"CVE-2026-106302":{"s":5.4,"v":"MEDIUM","x":"UI misrepresentation in PermissionElement in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium)","vp":"Google Chrome","t":"","p":1791312083359},"CVE-2026-106422":{"s":4.3,"v":"MEDIUM","x":"Incorrect authorization in API in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low)","vp":"Google Chrome","t":"","p":1791312097139},"CVE-2026-106303":{"s":5.3,"v":"MEDIUM","x":"Observable discrepancy in Autofill AI in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium)","vp":"Google Chrome","t":"","p":1791312085322},"CVE-2026-106423":{"s":8.8,"v":"HIGH","x":"Use after free in Media in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)","vp":"Google Chrome","t":"","p":1791312073206},"CVE-2026-106304":{"s":4.7,"v":"MEDIUM","x":"Out of bounds read in ANGLE in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)","vp":"Google Chrome","t":"","p":1791312090733},"CVE-2026-106424":{"s":4,"v":"MEDIUM","x":"Information leak in Audio in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted Chrome extension. (Chromium security severity: Medium)","vp":"Google Chrome","t":"","p":1791312082292},"CVE-2026-106306":{"s":5.4,"v":"MEDIUM","x":"Incorrect authorization in DevTools in Google Chrome prior to 155.0.8059.39 allowed a local attacker to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Low)","vp":"Google Chrome","t":"","p":1791312095647},"CVE-2026-106425":{"s":4.2,"v":"MEDIUM","x":"Missing authorization in BrowserTag in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to bypass site isolation via a crafted HTML page. (Chromium security severity: Medium)","vp":"Google Chrome","t":"","p":1791312078458},"CVE-2026-106307":{"s":6.5,"v":"MEDIUM","x":"Incorrect authorization in Network in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium)","vp":"Google Chrome","t":"","p":1791312089819},"CVE-2026-106426":{"s":8.3,"v":"HIGH","x":"Race condition in Fonts in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)","vp":"Google Chrome","t":"","p":1791312069159},"CVE-2026-106308":{"s":8.8,"v":"HIGH","x":"Incorrect reference resolution in Autofill in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted HTML page. (Chromium security severity: High)","vp":"Google Chrome","t":"","p":1791312067527},"CVE-2026-106309":{"s":8.8,"v":"HIGH","x":"Incorrect authorization in Selection in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Low)","vp":"Google Chrome","t":"","p":1791312095166},"CVE-2026-106310":{"s":6.5,"v":"MEDIUM","x":"Use of released resource in FontAccess in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low)","vp":"Google Chrome","t":"","p":1791312103215},"CVE-2026-106311":{"s":5.4,"v":"MEDIUM","x":"Clickjacking in PermissionElement in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium)","vp":"Google Chrome","t":"","p":1791312083048},"CVE-2026-106312":{"s":6.5,"v":"MEDIUM","x":"Missing authorization in SignIn in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted Chrome extension. (Chromium security severity: Low)","vp":"Google Chrome","t":"","p":1791312094692},"CVE-2026-106314":{"s":8.8,"v":"HIGH","x":"Incorrect authorization in Bluetooth in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium)","vp":"Google Chrome","t":"","p":1791312077542},"CVE-2026-106315":{"s":8.8,"v":"HIGH","x":"Use after free in Modularization in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)","vp":"Google Chrome","t":"","p":1791312076144},"CVE-2026-106316":{"s":5.4,"v":"MEDIUM","x":"UI misrepresentation in Chromoting in Google Chrome on on Mac prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to spoof UI elements via crafted network traffic. (Chromium security severity: Low)","vp":"Google Chrome","t":"","p":1791312101936},"CVE-2026-106318":{"s":8.8,"v":"HIGH","x":"Use after free in Media in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)","vp":"Google Chrome","t":"","p":1791312072875},"CVE-2026-106321":{"s":4.3,"v":"MEDIUM","x":"Information leak in Editing in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to leak sensitive information via a crafted HTML page. (Chromium security severity: Medium)","vp":"Google Chrome","t":"","p":1791312092678},"CVE-2026-106322":{"s":6.1,"v":"MEDIUM","x":"Open redirect in AppManifest in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)","vp":"Google Chrome","t":"","p":1791312084716},"CVE-2026-106324":{"s":6.1,"v":"MEDIUM","x":"Incorrect authorization in WebAppInstalls in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium)","vp":"Google Chrome","t":"","p":1791312075206},"CVE-2026-106325":{"s":4.3,"v":"MEDIUM","x":"Incorrect reference resolution in Core in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to leak cross-origin data via a crafted HTML page. (Chromium security severity: Low)","vp":"Google Chrome","t":"","p":1791312102238},"CVE-2026-106327":{"s":8.3,"v":"HIGH","x":"Incorrect authorization in Core in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to bypass system access restrictions via a crafted HTML page. (Chromium security severity: High)","vp":"Google Chrome","t":"","p":1791312066844},"CVE-2026-106328":{"s":5.9,"v":"MEDIUM","x":"Incorrect authorization in PDF in Google Chrome on on Android prior to 155.0.8059.39 allowed a local attacker leveraging social engineering to obtain sensitive information via a co-installed app. (Chromium security severity: Medium)","vp":"Google Chrome","t":"","p":1791312086830},"CVE-2026-106329":{"s":9.6,"v":"CRITICAL","x":"Incorrect authorization in FileSystem in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)","vp":"Google Chrome","t":"","p":1791312071824},"CVE-2026-110136":{"s":9.6,"v":"CRITICAL","x":"Use after free in PDF in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)","vp":"Google Chrome","t":"","p":1791925299987},"CVE-2026-106330":{"s":4.3,"v":"MEDIUM","x":"Information leak in Paint in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to leak sensitive information via a crafted HTML page. (Chromium security severity: Medium)","vp":"Google Chrome","t":"","p":1791312091025},"CVE-2026-15176":{"s":8.1,"v":"HIGH","x":"A vulnerability exists in NGINX Plus and NGINX Open Source when a location is configured that uses the alias directive together with rewrite and a set or return directive referencing the $request_filename variable. Alternatively, the same result could be achieved when the $request_filename variable is used in an…","vp":"F5 NGINX Plus","t":"NGINX ngx_http_core_module vulnerability","p":1791988826374},"CVE-2026-93479":{"s":8.1,"v":"HIGH","x":"A vulnerability exists in NGINX Plus and NGINX Open Source when a map directive uses regex matching and the root directive or access log format references the map's regex capture variables before referencing the map output variable. Alternatively, the same result could be achieved by using a non-cacheable variable in…","vp":"F5 NGINX Plus","t":"NGINX map directive and regex matching vulnerability","p":1791988827107},"CVE-2026-97229":{"s":10,"v":"CRITICAL","x":"GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server via a specially crafted regular expression in a CI/CD…","vp":"GitLab GitLab","t":"Integer Overflow or Wraparound in GitLab","p":1791853546166},"CVE-2025-61624":{"s":5.4,"v":"MEDIUM","x":"An Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') [CWE-22] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.4, FortiOS 7.4.0 through 7.4.9, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4 all versions, FortiPAM 1.7.0, FortiPAM 1.6 all versions, FortiPAM 1.5 all…","vp":"Fortinet FortiOS","t":"","p":1776181191445},"CVE-2026-102764":{"s":9.8,"v":"CRITICAL","x":"The vulnerability exists within internal components of BeyondTrust’s Remote Support product. The components did not adequately validate the origin of the messages it received. Under the right conditions, this could allow an attacker to perform file operations on the appliance.","vp":"BeyondTrust Remote Support","t":"Improper Origin Validation in Internal Messaging Components of BeyondTrust Remote Support","p":1792096232240},"CVE-2026-21589":{"s":9.3,"v":"CRITICAL","x":"This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center. Crowd Data Center, Crucible and Fisheye. This Arbitrary File Access vulnerability allows an unauthenticated attacker to access specific files within the web…","vp":"Atlassian Bamboo Data Center","t":"","p":1791235800390},"CVE-2026-93536":{},"CVE-2026-88794":{"s":8.2,"v":"HIGH","x":"Enterprise Architect is vulnerable to XML External Entity (XXE) injection in the XSLT Debugger feature. When a user loads a crafted XML file containing a `DOCTYPE` with an external DTD reference, the parser processes external entities, allowing an attacker to read arbitrary files from the victim's filesystem.\n\nBecause…","vp":"Sparx Systems Enterprise Architect","t":"XML External Entity injection in Sparx Enterprise Architect","p":1792067094903},"CVE-2026-63273":{"s":5.4,"v":"MEDIUM","x":"LibreOffice Draw can import PDF documents. A heap buffer overflow existed when importing an encrypted document. The length of the decryption key was taken from the document's own encryption dictionary and was used to fill a fixed size key buffer without being checked against it, so a length larger than that buffer…","vp":"The Document Foundation LibreOffice","t":"Heap buffer overflow in PDF import encryption handling","p":1790075413896},"CVE-2026-63274":{"s":5.4,"v":"MEDIUM","x":"LibreOffice Draw can import PDF documents. A heap buffer overflow existed when importing a stream object. The length of the stream was taken from the object's own dictionary and was not checked against the number of bytes actually present, so copying the stream read and wrote past the end of the buffer holding it. In…","vp":"The Document Foundation LibreOffice","t":"Heap buffer overflow in PDF import stream handling","p":1790075419486},"CVE-2026-6045":{"s":5.4,"v":"MEDIUM","x":"LibreOffice can import EMF+ graphics, which may be embedded in documents. A heap buffer overflow existed when importing an EMF+ gradient brush. The number of gradient blend points was read from the file and used to compute an allocation size, but that multiplication could overflow, so a small buffer was allocated and…","vp":"The Document Foundation LibreOffice","t":"Heap buffer overflow in EMF+ gradient brush import","p":1781540536574},"CVE-2026-58094":{"s":7.8,"v":"HIGH","x":"The FIOSSHMLPGCNF ioctl(2) operation configures the page size for a largepage shared memory object.  This is intended to be used immediately after creating the object, before any memory is allocated for the object.  The handler checked whether a page size had already been configured without holding the rangelock.  Two…","vp":"FreeBSD FreeBSD","t":"TOCTOU race in POSIX shared memory large page configuration","p":1787722782893},"CVE-2026-58093":{"s":7,"v":"HIGH","x":"The TIOCSCTTY ioctl handler drops the tty lock in order to acquire the process tree lock.  After reacquiring the tty lock, the handler did not revalidate the state of the terminal, and could proceed to link a terminal that was concurrently being destroyed to the calling process' session.\n\nAn unprivileged local user…","vp":"FreeBSD FreeBSD","t":"Kernel use-after-free via tty ioctls","p":1787722410605},"CVE-2026-81983":{"s":7.8,"v":"HIGH","x":"Acrobat Reader is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.","vp":"Adobe Adobe Acrobat","t":"Acrobat Reader | Out-of-bounds Write (CWE-787)","p":1788899449397},"CVE-2026-110447":{"s":9.2,"v":"CRITICAL","x":"Collabora Online Built-in CODE Server before 26.4.303 (richdocumentscode), a Nextcloud app, allows remote code execution, as exploited in the wild in September and October 2026, a different vulnerability than CVE-2025-66208. This is an OS command injection in proxy.php when the CODE server isn't running (e.g., the…","vp":"Collabora Collabora Online - Built-in CODE Server","t":"","p":1791944862315},"CVE-2026-99999":{"s":9.3,"v":"CRITICAL","x":"In the Linux kernel, the following vulnerability has been resolved:\n\nipv4: validate checksum_start before completing checksum\n\nIf a packet with bad checksum metadata gets into the ipv4 stack,\nskb_checksum_help can corrupt the network header and cause a bunch of\nmischief.\n\nThis was discovered and reported by Paulos,…","vp":"Linux Linux","t":"ipv4: validate checksum_start before completing checksum","p":1792066762784},"CVE-2026-76463":{"s":8.8,"v":"HIGH","x":"As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco networking engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities.\r\n\r\nThe vulnerabilities…","vp":"Cisco Cisco Campus Gateway Software","t":"Cisco Meraki Security Hardening Release: October 2026 - Improper Access Control Vulnerabilities","p":1791389922240},"CVE-2026-76464":{"s":9.6,"v":"CRITICAL","x":"As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco networking engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities.\r\n\r\nThe vulnerabilities…","vp":"Cisco Cisco Campus Gateway Software","t":"Cisco Meraki Hardening Release October 2026 - Buffer Management Vulnerabilities","p":1791389922243},"CVE-2026-76467":{"s":7.5,"v":"HIGH","x":"As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco networking engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities.\r\n\r\nThe vulnerabilities…","vp":"Cisco Cisco Campus Gateway Software","t":"Cisco Meraki Software Hardening Release - Resource Lifetime Management Vulnerabilities","p":1791389987709},"CVE-2026-76468":{"s":8.2,"v":"HIGH","x":"As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco networking engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities.\r\n\r\nThe vulnerabilities…","vp":"Cisco Cisco Campus Gateway Software","t":"Cisco Meraki Hardening Release - Input Validation Vulnerabilities","p":1791389944382},"CVE-2026-76469":{"s":7.4,"v":"HIGH","x":"As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco networking engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening releases that address multiple internally discovered vulnerabilities.\r\n\r\nThe vulnerabilities…","vp":"Cisco Cisco Campus Gateway Software","t":"Cisco Meraki Security Hardening Release: October 2026 Insufficient Control Flow Management Vulnerabilities","p":1791389960067},"CVE-2026-76470":{"s":8.8,"v":"HIGH","x":"As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco networking engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities.\r\n\r\nThe vulnerabilities…","vp":"Cisco Cisco Campus Gateway Software","t":"Cisco Meraki Hardening Release - Incorrect Calculation Vulnerabilities","p":1791389974043},"CVE-2026-76472":{"s":8.8,"v":"HIGH","x":"As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco networking engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities.\r\n\r\nThe vulnerabilities tracked…","vp":"Cisco Cisco Campus Gateway Software","t":"Cisco Meraki Security Hardening Release October 2026 - Improper Neutralization of Special Elements Vulnerabilities","p":1791389994726},"CVE-2026-0320":{"s":6.1,"v":"MEDIUM","x":"A command injection vulnerability in Palo Alto Networks PAN-OS® software enables an authenticated administrator to bypass system restrictions and run arbitrary commands as a root user. To be able to exploit this issue, the user must have access to the PAN-OS management interface.\n\n\n\n\nThe security risk posed by this…","vp":"Palo Alto Networks Cloud NGFW","t":"PAN-OS: Authenticated Admin Command Injection Vulnerability","p":1792008589697},"CVE-2026-0321":{"s":6.6,"v":"MEDIUM","x":"Denial of service vulnerabilities in Palo Alto Networks PAN-OS® software allow an unauthenticated attacker with network access to cause a denial of service (DoS) condition by sending specially crafted network traffic to or through a dataplane interface. Repeated attempts to trigger this condition result in the…","vp":"Palo Alto Networks Cloud NGFW","t":"PAN-OS: Denial of Service (DoS) Vulnerabilities in Network Services","p":1792007935823},"CVE-2026-0317":{"s":1.2,"v":"LOW","x":"A denial of service vulnerability in Palo Alto Networks PAN-OS software enables an authenticated user with a read-only administrator role to cause a denial of service (DoS) condition by sending a specially crafted API request.\n\nThe security risk posed by this issue is significantly minimized by restricting access to…","vp":"Palo Alto Networks Cloud NGFW","t":"PAN-OS: Denial of Service Vulnerability","p":1792009281338},"CVE-2026-15737":{"s":5.7,"v":"MEDIUM","x":"AWS Bedrock AgentCore Python SDK is an open-source Python library that provides client tools for building AI agents on the Amazon Bedrock AgentCore platform.\n\n\n\nUnintended logging of sensitive user content in the OpenTelemetry instrumentation in AWS Bedrock AgentCore Python SDK versions 1.4.8 and 1.5.0 might allow a…","vp":"AWS bedrock-agentcore","t":"Sensitive content disclosure via OpenTelemetry spans in AgentCore Python SDK","p":1784221395160},"CVE-2026-15415":{"s":5.5,"v":"MEDIUM","x":"AWS HealthOmics is a HIPAA-eligible service that fully manages the compute, storage, and workflow engine infrastructure required to run bioinformatics analyses at scale for clinical diagnostics, drug discovery, and agricultural research.\n\n\n\nImproper limitation of a pathname to a restricted directory in the linting…","vp":"AWS aws-healthomics-mcp-server","t":"Path traversal and arbitrary file write in the workflow linters of aws-healthomics-mcp-server","p":1784316973885},"CVE-2026-15746":{"s":6.5,"v":"MEDIUM","x":"Strands Agents is an open-source Python SDK for building and running AI agents. The strands-agents-tools package provides pre-built tools for use with the SDK, including the elasticsearch_memory tool for agent memory storage. We identified CVE-2026-15746, a server-side request forgery (SSRF) issue in the…","vp":"Amazon strands-agents-tools","t":"Credential disclosure in Strands Agents Tools elasticsearch_memory tool","p":1784140547382},"CVE-2026-9255":{"s":7.8,"v":"HIGH","x":"Missing input source validation in the tool authorization prompt in Kiro CLI before 1.28.0 allows a local attacker to execute arbitrary tools, including shell commands, without user approval by crafting content that is piped to kiro-cli via stdin.\n\n\n\nWe recommend you to upgrade to kiro-cli version 1.28.0 or later.","vp":"AWS Kiro CLI","t":"Tool Execution Without Authorization via Piped Stdin in Kiro CLI","p":1779467890522},"CVE-2026-10591":{"s":8.8,"v":"HIGH","x":"Insufficient access control restrictions in the file write tool in Amazon Kiro IDE before version 0.11 might allow remote unauthenticated actors to execute arbitrary commands via crafted instructions that cause writes to execution-sensitive paths  (such as .vscode/tasks.json), enabling auto-execution on folder open.…","vp":"AWS Kiro IDE","t":"Kiro IDE Insufficient File Write Restrictions to Execution-Sensitive Paths","p":1780414480106},"CVE-2026-8596":{"s":7.2,"v":"HIGH","x":"Cleartext storage of sensitive information in the ModelBuilder/Serve component in Amazon SageMaker Python SDK before v2.257.2 and v3 before v3.8.0 might allow a remote authenticated actor to extract the HMAC signing key from SageMaker API responses and forge valid integrity signatures for specially crafted model…","vp":"Amazon SageMaker Python SDK AWS","t":"Cleartext storage of HMAC signing key in Amazon SageMaker Python SDK ModelBuilder/Serve path","p":1778787351421},"CVE-2026-8597":{"s":7.2,"v":"HIGH","x":"Missing integrity verification in the Triton inference handler in Amazon SageMaker Python SDK v2 before v2.257.2 and v3 before v3.8.0 might allow a remote authenticated actor to achieve code execution in inference containers via replacement of model artifacts in S3 with a specially crafted pickle payload that is…","vp":"Amazon SageMaker Python SDK AWS","t":"Missing integrity verification in Triton inference handler in Amazon SageMaker Python SDK","p":1778787422187},"CVE-2026-8178":{"s":8.1,"v":"HIGH","x":"An issue exists in Amazon Redshift JDBC Driver versions prior to 2.2.2. Under certain conditions, the driver could load and execute arbitrary classes when processing JDBC connection URL parameters. An actor who can influence the connection URL could potentially execute code in the application context, provided a…","vp":"Amazon Amazon Redshift JDBC Driver","t":"Remote Code Execution via Unsafe Class Loading in Amazon Redshift JDBC Driver","p":1778265406950},"CVE-2026-31431":{"s":7.8,"v":"HIGH","x":"In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: algif_aead - Revert to operating out-of-place\n\nThis mostly reverts commit 72548b093ee3 except for the copying of\nthe associated data.\n\nThere is no benefit in operating in-place in algif_aead since the\nsource and destination come from…","vp":"Linux Linux","t":"crypto: algif_aead - Revert to operating out-of-place","p":1776845710123},"CVE-2026-107777":{"s":6.5,"v":"MEDIUM","x":"Thermo Fisher Torrent Suite Software is vulnerable to a path traversal, which could allow an authenticated attacker to read arbitrary files on the Torrent Server that are accessible to the web service account.","vp":"Thermo Fisher Torrent Suite Software","t":"Thermo Fisher Torrent Suite Software Path Traversal","p":1792161620840},"CVE-2026-97851":{"s":9.1,"v":"CRITICAL","x":"The storage status-change REST service allows location records still associated with DICOM instances to be changed to deletion-related states. Changing a location to TO_DELETE causes PurgeStorageScheduler to delete the referenced object from storage even though the corresponding instance record remains in the database.","vp":"J4Care dcm4chee-arc-light","t":"J4Care dcm4che Missing Authorization","p":1792160215229},"CVE-2026-107621":{"s":7.5,"v":"HIGH","x":"JPEGParser can enter an infinite loop while parsing a specially crafted or truncated stream.","vp":"J4Care dcm4chee-arc-light","t":"J4Care dcm4che Loop with Unreachable Exit Condition","p":1792160372673},"CVE-2026-105273":{"s":7.5,"v":"HIGH","x":"MP4Parser does not adequately validate MP4 box sizes. A malformed box can cause parsing to make no forward progress and repeatedly process the same input.","vp":"J4Care dcm4chee-arc-light","t":"J4Care dcm4che Loop with Unreachable Exit Condition","p":1792160472116},"CVE-2026-101021":{"s":7.5,"v":"HIGH","x":"MultipartInputStream performs inefficient boundary matching and unnecessary buffer copying. Crafted multipart input can force excessive boundary comparisons and repeated copying.","vp":"J4Care dcm4chee-arc-light","t":"J4Care dcm4che Inefficient Algorithmic Complexity","p":1792160934992},"CVE-2026-105279":{"s":9.1,"v":"CRITICAL","x":"In the default configuration, the archive accepts DICOM associations from an unregistered calling AE. A remote peer can use C-FIND and C-GET to enumerate and retrieve patient information and medical images. It can also use C-STORE to file fabricated study content under an existing patient identity.","vp":"J4Care dcm4chee-arc-light","t":"J4Care dcm4che Missing Authentication for Critical Function","p":1792161051439},"CVE-2026-105667":{"s":7.5,"v":"HIGH","x":"In the default configuration, the HL7 listener accepts ADT^A40 patient-merge messages without authenticating the sending application. A remote sender can reassign studies and related workflow records from one patient identity to another. The archive's unmerge does not reverse this.","vp":"J4Care dcm4chee-arc-light","t":"J4Care dcm4che Missing Authentication for Critical Function","p":1792161142216},"CVE-2026-107617":{"s":9.8,"v":"CRITICAL","x":"An attacker can use a hard-coded credential to log in to EseeCloud devices.","vp":"Guangzhou Juan IoT Technology Co., Ltd. EseeCloud App","t":"Guangzhou Juan IoT Technology EseeCloud Use of Hard-coded Credentials","p":1792159374778},"CVE-2026-97858":{"s":5.3,"v":"MEDIUM","x":"An attacker can cause the server to unbind the target device from its current owner and rebind it to the requesting account, regardless of whether the device is currently bound to a different account, allowing an attacker to obtain the device's full serial ID.","vp":"Guangzhou Juan IoT Technology Co., Ltd. EseeCloud App","t":"Guangzhou Juan IoT Technology EseeCloud Improperly Controlled Modification of Dynamically-Determined Object Attributes","p":1792159487580},"CVE-2026-105664":{"s":5.3,"v":"MEDIUM","x":"The endpoint exposes an observable response discrepancy when processing ID values. A request submitted with a nonexistent ID returns a distinct error response code from one submitted with a valid, registered ID, allowing an attacker holding a valid access token - but without further authentication or authorization -…","vp":"Guangzhou Juan IoT Technology Co., Ltd. EseeCloud App","t":"Guangzhou Juan IoT Technology EseeCloud Observable Response Discrepancy","p":1792159615903},"CVE-2026-63252":{"s":8.7,"v":"HIGH","x":"In Eclipse Milo versions 0.6.0 through 1.1.4, UASC server transport handlers fail to release retained partial message chunks when a channel disconnects, allowing a remote unauthenticated client to exhaust pooled direct memory by repeatedly sending incomplete chunks and disconnecting, potentially terminating the server.","vp":"Eclipse Foundation Eclipse Milo","t":"","p":1785844998647},"CVE-2026-63248":{"s":6.9,"v":"MEDIUM","x":"In Eclipse Milo versions 0.6.0 through 1.1.4, OPC UA server diagnostics nodes do not enforce access authorization. An anonymous client can enable diagnostics over a None/None endpoint without a certificate; with a trusted client application certificate over SignAndEncrypt, it can read security diagnostics for other…","vp":"Eclipse Foundation Eclipse Milo","t":"","p":1785845263820},"CVE-2026-60007":{"s":9.1,"v":"CRITICAL","x":"In Eclipse Milo versions 0.6.0 through 1.1.4, username-token processing returns distinguishable errors for invalid RSA PKCS#1 v1.5 padding and other authentication failures, allowing an on-path attacker who captures a victim's `Basic128Rsa15`-encrypted username token to use repeated unauthenticated `ActivateSession`…","vp":"Eclipse Foundation Eclipse Milo","t":"","p":1785844541934},"CVE-2026-62927":{"s":8.7,"v":"HIGH","x":"In Eclipse Milo versions 1.0.0 through 1.1.4, the Call service dispatches the original mixed batch to address-space handlers after calculating authorization, allowing an anonymous or otherwise low-privileged client to execute a denied method by batching it with an allowed method.","vp":"Eclipse Foundation Eclipse Milo","t":"","p":1785844679822},"CVE-2026-58080":{"s":8.8,"v":"HIGH","x":"In Eclipse Milo versions 1.0.0 through 1.1.4, `OpcUaServerConfig.copy()` fails to preserve a configured `RoleMapper`. On servers that rely on role permissions and construct the running configuration through `copy()`, sessions receive no role IDs and the default access controller skips role-permission checks, allowing…","vp":"Eclipse Foundation Eclipse Milo","t":"","p":1785845110547},"CVE-2026-61387":{"s":6.9,"v":"MEDIUM","x":"In Eclipse Milo versions 1.0.0 through 1.1.4, monitored-item quota accounting is not exception-safe: if item creation fails with an unchecked error, the server-global reservation is not restored. Deeply nested PubSub ExtensionObjects in a `CreateMonitoredItems` event filter can trigger a `StackOverflowError` during…","vp":"Eclipse Foundation Eclipse Milo","t":"","p":1785844358259},"CVE-2026-107336":{"s":6.5,"v":"MEDIUM","x":"Malcolm's front nginx reverse proxy defines a \"Dashboards → Arkime shortcut\" location using a case-insensitive regex matcher but a case-sensitive rewrite. A request whose path segment is not exact-lowercase (for example /IDDASH2ARK/...) enters the location (the matcher fires) but evades the rewrite (no redirect is…","vp":"CISA Malcolm","t":"Authentication Bypass by Spoofing in Malcolm","p":1791480046517},"CVE-2026-107361":{"s":4.2,"v":"MEDIUM","x":"The Arkime live capture service (arkime-live) in Malcolm runs with network_mode: host, exposing port 8005 on all network interfaces (viewHost=0.0.0.0). Arkime trusts the X-Forwarded-User header from any IP address (userAuthIps=::,0.0.0.0/0) and auto-creates users with full access. The passwordSecret is hardcoded to…","vp":"CISA Malcolm","t":"Authentication Bypass Using an Alternate Path or Channel in Malcolm","p":1791480423689},"CVE-2026-107337":{"s":7.1,"v":"HIGH","x":"The Malcolm kiosk Flask application exposes a POST /script_call/<script> endpoint with zero authentication and wildcard CORS (CORS(app)). An attacker can force the operator's browser to execute arbitrary management commands via CSRF, including control.py --wipe which permanently deletes all captured network traffic…","vp":"CISA Malcolm","t":"Cross-Site Request Forgery in Malcolm","p":1791480503458},"CVE-2026-107335":{"s":6.5,"v":"MEDIUM","x":"Malcolm's upload-processing pipeline (scripts/safe-extract.py) enforces entry-count, nesting-depth, and total-uncompressed-byte limits when extracting container archives (zip/tar/rar/7z via libarchive), but those limits are not applied when the uploaded file is a single-stream compressed format (.gz, .bz2, .xz, .lzma,…","vp":"CISA Malcolm","t":"Improper Handling of Highly Compressed Data in Malcolm","p":1791480612206},"CVE-2026-107334":{"s":5.4,"v":"MEDIUM","x":"Malcolm's nginx Lua role-based access control (RBAC) layer decides whether an authenticated user may reach a role-restricted path (e.g. /htadmin, /auth, /admin_login, /arkime/api/esadmin, NetBox, upload endpoints) by pattern-matching the raw, percent-encoded request URI. Nginx itself, however, selects which location…","vp":"CISA Malcolm","t":"Incorrect Authorization in Malcolm","p":1791480720480},"CVE-2026-107333":{"s":8.1,"v":"HIGH","x":"Malcolm's nginx based reverse proxy contains a URL path normalization inconsistency between its Lua based role-based access control (RBAC) authorization layer and nginx's own request routing logic. An authenticated user can craft a specially formatted request path to bypass role-based restrictions and reach…","vp":"CISA Malcolm","t":"Incorrect Authorization in Malcolm","p":1791480194455},"CVE-2026-107362":{"s":7.1,"v":"HIGH","x":"Malcolm file-upload component ships the upstream FilePond PHP server (pqina/filepond-server-php) largely unmodified: Dockerfile copies all upstream *.php files and Malcolm only overwrites config.php and submit.php. Upstream index.php exposes a fetch API route that instructs the server to download an arbitrary URL with…","vp":"CISA Malcolm","t":"Server-Side Request Forgery in Malcolm","p":1791480323511},"CVE-2026-35029":{"s":8.8,"v":"HIGH","x":"LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to 1.83.0, the /config/update endpoint does not enforce admin role authorization. A user who is already authenticated into the platform can then use this endpoint to modify proxy configuration and environment variables,…","vp":"BerriAI litellm","t":"LiteLLM affected by privilege escalation via unrestricted proxy configuration endpoint","p":1775493328974},"CVE-2026-59823":{"s":5.3,"v":"MEDIUM","x":"LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to 1.83.9, an authenticated LiteLLM Proxy caller with a valid virtual key can place api_base inside the user_config request body to bypass is_request_body_safe, which blocks top-level api_base and base_url but previously did…","vp":"BerriAI litellm","t":"LiteLLM: Server-side request forgery via the `user_config` request parameter in LiteLLM Proxy","p":1789583781105},"CVE-2026-0322":{"s":7.2,"v":"HIGH","x":"A remote code execution (RCE) vulnerability in the management interface of Palo Alto Networks PAN-OS® software enables an authenticated attacker with network access to execute arbitrary code with root privileges on the firewall.\n\n\n\nThe security risk posed by this issue is minimized by restricting access to the…","vp":"Palo Alto Networks Cloud NGFW","t":"PAN-OS: Authenticated Remote Code Execution (RCE) in the Management Interface","p":1791998812448},"CVE-2026-76519":{"s":9.8,"v":"CRITICAL","x":"A vulnerability in the Advanced Malware Protection (AMP) feature of Cisco Secure Email Gateway could allow an unauthenticated, remote attacker to write arbitrary files on the underlying operating system.\r\n\r\nThis vulnerability is due to improper handling of email attachments when the file reputation service is enabled.…","vp":"Cisco Cisco Secure Email","t":"Cisco Secure Email Gateway Arbitrary File Write Vulnerability","p":1791994071466},"CVE-2026-105133":{"s":7.3,"v":"HIGH","x":"A vulnerability was detected in Ahsay AhsayCBS up to 10.3.2. This affects the function checkSysPwd of the file com/ahsay/obs/api/ApiStructsAction.java of the component API. Performing a manipulation of the argument random results in improper authentication. It is possible to initiate the attack remotely. The exploit…","vp":"Ahsay AhsayCBS","t":"Ahsay AhsayCBS API ApiStructsAction.java checkSysPwd improper authentication","p":1791090914561},"CVE-2026-105134":{"s":10,"v":"CRITICAL","x":"A flaw has been found in Ahsay AhsayCBS up to 10.3.2. This vulnerability affects unknown code of the file /rps/api/json/UpdateReceivers.do of the component Replication Receiver. Executing a manipulation of the argument random can lead to os command injection. It is possible to launch the attack remotely. The exploit…","vp":"Ahsay AhsayCBS","t":"Ahsay AhsayCBS Replication Receiver UpdateReceivers.do os command injection","p":1791091812882},"CVE-2026-70111":{"s":8.1,"v":"HIGH","x":"Untrusted pointer dereference in Windows Kernel allows an unauthorized attacker to elevate privileges over a network.","vp":"Microsoft Windows 10 Version 1607","t":"Windows Kernel Elevation of Privilege Vulnerability","p":1791918069339},"CVE-2026-35616":{"s":9.1,"v":"CRITICAL","x":"A improper access control vulnerability in Fortinet FortiClientEMS 7.4.5 through 7.4.6 may allow an unauthenticated attacker to execute unauthorized code or commands via crafted requests.","vp":"Fortinet FortiClientEMS","t":"","p":1775263115828},"CVE-2026-105740":{"s":9.9,"v":"CRITICAL","x":"Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.9.0, any authenticated Langflow user can achieve Remote Code Execution (RCE) on the server by adding an MCP server with the \"Stdio\" transport. The user-supplied command field is passed directly to bash -c \"exec {command}\" with…","vp":"langflow-ai langflow","t":"Langflow: Authenticated RCE via MCP Stdio transport allows any user to execute arbitrary OS commands on the server","p":1791233178854},"CVE-2026-111105":{"s":7,"v":"HIGH","x":"Telegram rlottie Numeric Truncation Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Telegram. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe…","vp":"Telegram Telegram","t":"Telegram rlottie Numeric Truncation Remote Code Execution Vulnerability","p":1792086175996},"CVE-2018-10388":{"x":"Format string vulnerability in the logMess function in TFTP Server SP 1.66 and earlier allows remote attackers to perform a denial of service or execute arbitrary code via format string sequences in a TFTP error packet.","vp":"n/a n/a","t":"","p":1577141143000},"CVE-2018-10389":{"x":"Format string vulnerability in the logMess function in TFTP Server MT 1.65 and earlier allows remote attackers to perform a denial of service or execute arbitrary code via format string sequences in a TFTP error packet.","vp":"n/a n/a","t":"","p":1577141146000},"CVE-2026-111183":{},"CVE-2026-111185":{},"CVE-2026-111184":{},"CVE-2026-106170":{"s":4.9,"v":"MEDIUM","x":"An Uncaught Exception vulnerability [CWE-248] vulnerability in Fortinet FortiSandbox 5.2.0 through 5.2.1, FortiSandbox 5.0.0 through 5.0.6, FortiSandbox 4.4 all versions may allow  a privileged attacker to deny access to the GUI and CLI persistently via crafted HTTP requests.","vp":"Fortinet FortiSandbox","t":"","p":1791913030883},"CVE-2026-102257":{"s":7.2,"v":"HIGH","x":"A Zip Slip vulnerability in the in the SMA1000 Appliance Management Console (AMC) interface allows an attacker to extract files outside the intended destination directory using a specially crafted archive, resulting in remote code execution.","vp":"SonicWall SMA1000","t":"","p":1791378745319},"CVE-2026-93524":{},"CVE-2026-93523":{},"CVE-2026-93522":{},"CVE-2026-93521":{},"CVE-2026-93520":{},"CVE-2026-93519":{},"CVE-2026-93518":{},"CVE-2026-93517":{},"CVE-2026-93516":{},"CVE-2026-93515":{},"CVE-2026-88812":{},"CVE-2026-93325":{},"CVE-2026-95636":{"s":7.8,"v":"HIGH","x":"Photoshop Desktop is affected by an Integer Overflow or Wraparound vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.","vp":"Adobe Photoshop","t":"Photoshop Desktop | Integer Overflow or Wraparound (CWE-190)","p":1791923261834},"CVE-2026-83661":{"s":7.8,"v":"HIGH","x":"Photoshop Desktop is affected by an Integer Overflow or Wraparound vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.","vp":"Adobe Photoshop","t":"Photoshop Desktop | Integer Overflow or Wraparound (CWE-190)","p":1791923271447},"CVE-2026-69982":{"s":5.9,"v":"MEDIUM","x":"Weak authentication in Active Directory Federation Services (AD FS) allows an unauthorized attacker to bypass a security feature over a network.","vp":"Microsoft Windows 10 Version 1607","t":"Active Directory Federation Services (AD FS) Security Feature Bypass Vulnerability","p":1791918023596},"CVE-2026-96252":{"s":9.1,"v":"CRITICAL","x":"Improper verification of cryptographic signature in Active Directory Federation Services (AD FS) allows an unauthorized attacker to perform spoofing over a network.","vp":"Microsoft Windows 10 Version 1607","t":"Active Directory Federation Services (AD FS) Spoofing Vulnerability","p":1791918077411},"CVE-2026-108131":{"s":7.5,"v":"HIGH","x":"No cwe for this issue in Active Directory Federation Services (AD FS) allows an unauthorized attacker to perform spoofing over a network.","vp":"Microsoft Windows 10 Version 1607","t":"Active Directory Federation Services (AD FS) Spoofing Vulnerability","p":1791918104899},"CVE-2024-47575":{"s":9.8,"v":"CRITICAL","x":"A missing authentication for critical function in FortiManager 7.6.0, FortiManager 7.4.0 through 7.4.4, FortiManager 7.2.0 through 7.2.7, FortiManager 7.0.0 through 7.0.12, FortiManager 6.4.0 through 6.4.14, FortiManager 6.2.0 through 6.2.12, Fortinet FortiManager Cloud 7.4.1 through 7.4.4, FortiManager Cloud 7.2.1…","vp":"Fortinet FortiManager","t":"","p":1729695828798},"CVE-2026-13762":{"s":9.8,"v":"CRITICAL","x":"Inconsistent interpretation of HTTP/2 requests in Amazon CloudFront with AWS WAF enabled might allow remote actors to bypass AWS WAF managed rule body inspection via crafted HTTP/2 requests that fragment the request body across frames so that only a partial body is inspected.\n\n\n\nThis issue was remediated server-side.…","vp":"AWS Amazon CloudFront","t":"HTTP/2 Stream Parser Confusion Body-Inspection Bypass in Amazon CloudFront with AWS WAF","p":1782763386858},"CVE-2026-13763":{"s":9.8,"v":"CRITICAL","x":"Inconsistent interpretation of HTTP/2 requests in AWS Application Load Balancer with AWS WAF enabled might allow remote actors to bypass AWS WAF managed rule body inspection via crafted HTTP/2 requests that fragment the request body across frames so that only a partial body is inspected. This issue only impacts HTTP/2…","vp":"AWS AWS Application Load Balancer","t":"HTTP/2 Stream Parser Confusion Body-Inspection Bypass in AWS Application Load Balancer with AWS WAF","p":1782763437699},"CVE-2026-50195":{"s":5.6,"v":"MEDIUM","x":"containerd is an open-source container runtime. Versions prior to 2.3.2, 2.2.5 and 2.1.9 contain a vulnerability in the CRI checkpoint import process where it fails to validate the image references specified within a checkpoint image's configuration. An attacker with permissions to create pods can use a crafted…","vp":"containerd containerd","t":"containerd: CRI checkpoint import allows local image tag poisoning","p":1782928253072},"CVE-2026-53488":{"s":9.4,"v":"CRITICAL","x":"containerd is an open-source container runtime. In versions prior to 1.7.33, 2.3.2, 2.2.5, 2.1.9, and 2.0.10 the CRI plugin propagates labels from an image config (LABEL instruction in Dockerfile) to a container without validation. This may result in executing an arbitrary command on the host, via a plugin that…","vp":"containerd containerd","t":"containerd CRI plugin: — image-config `LABEL` flows to restart-monitor `binary://` logger: host-root command execution from an image pull","p":1782864680610},"CVE-2026-53492":{"s":8.4,"v":"HIGH","x":"containerd is an open-source container runtime. In Versions prior to 2.3.2, 2.2.5 and 2.1.9, the CRI implementation improperly trusts Container Device Interface (CDI) annotations found within untrusted checkpoint image metadata during container restoration. When restoring a container from a checkpoint, containerd…","vp":"containerd containerd","t":"containerd CRI checkpoint restore CDI annotation smuggling","p":1782928752552},"CVE-2026-53489":{"s":8.2,"v":"HIGH","x":"containerd is an open-source container runtime. Versions prior to 2.3.2, 2.2.5 and 2.1.9 contain a bug where the CRI plugin restores container.log from a checkpoint image without validating a symlinked path. This could result in reading an arbitrary file on the host via kubectl logs. This issue has been fixed in…","vp":"containerd containerd","t":"containerd: Arbitrary host CRI log file read via symlink following in CRI checkpoint restore","p":1782929441802},"CVE-2026-47262":{"s":5.3,"v":"MEDIUM","x":"containerd is an open-source container runtime. Versions prior to 1.7.33, 2.0.10, 2.1.9, 2.2.5 and 2.3.2, contain a vulnerability that allows a maliciously crafted image to cause a Denial of Service (DoS) condition. When creating a container from this image, memory exhaustion occurs, leading to an Out Of Memory (OOM)…","vp":"containerd containerd","t":"containerd image-triggered runtime DoS via unbounded group parsing","p":1782928123205},"CVE-2026-15643":{"s":7.3,"v":"HIGH","x":"AWS HealthLake MCP Server (awslabs.healthlake-mcp-server) is a Model Context Protocol server that enables AI assistants to interact with AWS HealthLake FHIR datastores. A server-side request forgery in the pagination handling component in AWS awslabs.healthlake-mcp-server before 0.0.14 on all platforms might allow a…","vp":"AWS awslabs.healthlake-mcp-server","t":"AWS HealthLake MCP Server SSRF via Pagination URL","p":1784059438729},"CVE-2026-12043":{"s":8.8,"v":"HIGH","x":"Improper handling of HPACK dynamic table size updates in the AWS Common Runtime aws-c-http library might allow a remote threat actor operating a server to cause memory corruption on a connecting client application, potentially leading to arbitrary code execution, via a crafted sequence of HTTP/2 HEADERS frames.\n\n\n\nTo…","vp":"AWS aws-c-http","t":"Heap double-free in AWS Common Runtime aws-c-http","p":1781289351420},"CVE-2026-14471":{"s":8.1,"v":"HIGH","x":"Improper Neutralization of Special Elements in the metrics-service retention policy management component in Amazon mcp-gateway-registry before 1.0.13 might allow an authenticated remote user to execute arbitrary SQL queries via a crafted table_name value that is interpolated into SQL statements in identifier position.…","vp":"AWS MCP Gateway & Registry","t":"Authenticated SQL injection in the metrics-service retention policy subsystem of mcp-gateway-registry","p":1783370005217},"CVE-2026-10740":{"s":5.3,"v":"MEDIUM","x":"Unbounded memory allocation in the CRYPTO frame reassembler in s2n-quic before 1.8.2 may allow an unauthenticated remote actor to cause a denial of service (degraded availability) by sending crafted QUIC Initial packets.\n\n\n\nTo remediate this issue, users should upgrade to v1.8.2.","vp":"AWS s2n-quic","t":"Excessive memory allocation in s2n-quic","p":1781114976070},"CVE-2026-5747":{"s":7.5,"v":"HIGH","x":"An out-of-bounds write issue in the virtio PCI transport in Firecracker 1.13.0 through 1.14.3 and 1.15.0 on x86_64 and aarch64 might allow a local guest user with root privileges to crash the Firecracker VMM process or potentially execute arbitrary code on the host via modification of virtio queue configuration…","vp":"AWS Firecracker","t":"Out-of-bounds Write in Firecracker virtio-pci Transport","p":1775603843944},"CVE-2026-6911":{"s":9.8,"v":"CRITICAL","x":"Missing JWT signature verification in AWS Ops Wheel allows unauthenticated attackers to forge JWT tokens and gain unintended administrative access to the application, including the ability to read, modify, and delete all application data across tenants and manage Cognito user accounts within the deployment's User…","vp":"AWS AWS Ops Wheel","t":"Authentication Bypass via Missing JWT Signature Verification in AWS Ops Wheel","p":1777046925808},"CVE-2026-6912":{"s":8.8,"v":"HIGH","x":"Improperly controlled modification of dynamically-determined object attributes in the Cognito User Pool configuration in AWS Ops Wheel before PR #165 allows remote authenticated users to escalate to deployment admin privileges and manage Cognito user accounts via a crafted UpdateUserAttributes API call that sets the…","vp":"AWS AWS Ops Wheel","t":"Privilege Escalation via Self-Writable Cognito Custom Attribute in AWS Ops Wheel","p":1777047105833},"CVE-2026-110310":{"s":5.3,"v":"MEDIUM","x":"A remote user who can read encrypted objects in the S3 bucket can force a padding downgrade by altering the padding scheme recorded in an object's metadata to legacy PKCS#1 v1.5. Since this padding scheme is susceptible to the well-known Bleichenbacher attack, the user can use a PKCS#1 v1.5 padding oracle to recover…","vp":"Amazon Amazon.Extensions.S3.Encryption","t":"RSA PKCS#1 v1.5 padding oracle via legacy envelope key format downgrade in Amazon S3 Encryption Client for .NET","p":1792006668420},"CVE-2026-13769":{"s":5.5,"v":"MEDIUM","x":"Overly permissive file permissions in AWS CLI before 1.44.78 (v1) and 2.34.29 (v2) on Unix-like systems where the umask has not been configured to restrict file permissions (the default on most systems) may allow other local users on the same host to read credentials written by certain CLI subcommands (aws…","vp":"AWS AWS CLI","t":"Overly permissive File Permissions in AWS CLI","p":1782930859112},"CVE-2026-7461":{"s":7.2,"v":"HIGH","x":"Improper neutralization of inputs used in an OS command in the FSx Windows File Server volume mounting component in Amazon ECS Agent on Windows before version 1.103.0 might allow a remote authenticated threat actor to execute shell commands with SYSTEM privileges on the underlying host via a specially crafted username…","vp":"AWS Amazon ECS Agent","t":"OS Command Injection in Amazon ECS Agent via FSx Windows File Server Volume Credentials","p":1777574117599},"CVE-2026-5190":{"s":7.5,"v":"HIGH","x":"Out-of-bounds write in the streaming decoder component in aws-c-event-stream before 0.6.0 might allow a third party operating a server to cause memory corruption leading to arbitrary code execution on a client application that processes crafted event-stream messages.\n\nTo remediate this issue, users should upgrade to…","vp":"AWS aws-c-event-stream","t":"AWS C Event Stream Streaming Decoder Stack Buffer Overflow","p":1774976759601},"CVE-2026-0312":{"s":4.3,"v":"MEDIUM","x":"Path traversal vulnerabilities in Palo Alto Networks Checkov by Prisma® Cloud enable an unauthenticated local user to write files to arbitrary locations on the scanning filesystem.","vp":"Palo Alto Networks Checkov by Prisma Cloud","t":"Checkov by Prisma Cloud: Path Traversal Vulnerabilities","p":1792009698276},"CVE-2026-0311":{"s":1.1,"v":"LOW","x":"A server-side request forgery vulnerability in Palo Alto Networks Checkov by Prisma® Cloud enables a local unauthenticated user to make unauthorized network requests from host to internal services.","vp":"Palo Alto Networks Checkov by Prisma Cloud","t":"Checkov by Prisma Cloud: Server-Side Request Forgery Vulnerability","p":1792009759297},"CVE-2026-0313":{"s":6.1,"v":"MEDIUM","x":"A command injection vulnerability in Palo Alto Networks Cortex XSOAR and Cortex XSIAM OS Query content pack enables an authenticated administrator to execute arbitrary OS commands on remote endpoints.","vp":"Palo Alto Networks Cortex XSOAR OS Query","t":"Cortex XSOAR: OS Command Injection Vulnerability","p":1792009639112},"CVE-2026-0314":{"s":4.3,"v":"MEDIUM","x":"A type confusion vulnerability in Palo Alto Networks GlobalProtect™ app on Windows enables a local user with low privileges to cause a denial of service (DoS) condition.\n\nThe GlobalProtect™ app on Linux, macOS, iOS, Android, and Chrome OS is not affected by this vulnerability.","vp":"Palo Alto Networks GlobalProtect App","t":"GlobalProtect App: Local Denial of Service (DoS) on Windows","p":1792009532075},"CVE-2026-0318":{"s":4.6,"v":"MEDIUM","x":"A stack-based buffer overflow vulnerability in the log processing functionality of Palo Alto Networks PAN-OS® software on Panorama enables an attacker to cause a denial of service (DoS) condition. Repeated attempts to trigger this condition result in the Panorama entering maintenance mode.\n\nCloud NGFW, Prisma® Access,…","vp":"Palo Alto Networks Cloud NGFW","t":"PAN-OS: Denial of Service (DoS) on Panorama","p":1792009168773},"CVE-2026-0315":{"s":5.9,"v":"MEDIUM","x":"A local privilege escalation vulnerability in the Palo Alto Networks GlobalProtect™ app enables a local user to escalate their privileges to root on macOS. This enables a non-administrative user to execute arbitrary commands with administrative privileges.\n\nThe GlobalProtect app on Linux, Windows, iOS, Android and…","vp":"Palo Alto Networks GlobalProtect App","t":"GlobalProtect App: Local Privilege Escalation Vulnerability on macOS","p":1792009461191},"CVE-2026-0316":{"s":1.1,"v":"LOW","x":"A stored cross-site scripting (XSS) vulnerability in Palo Alto Networks PAN-OS® software enables a malicious authenticated administrator to store or execute a JavaScript payload using the web interface.\n\n\n\nThe security risk posed by this issue is minimized when the management interface is restricted to only trusted…","vp":"Palo Alto Networks Cloud NGFW","t":"PAN-OS: Stored Cross-Site Scripting (XSS) Vulnerability","p":1792009383075},"CVE-2026-0319":{"s":4.9,"v":"MEDIUM","x":"An improper input handling vulnerability in the GlobalProtect™ gateway of Palo Alto Networks PAN-OS software enables an authenticated user to establish a GlobalProtect session using the identity of another user. \n\nCloud NGFW and Panorama are not affected by this vulnerability.","vp":"Palo Alto Networks Cloud NGFW","t":"PAN-OS: Improper Input Handling Vulnerability","p":1792008932174},"CVE-2026-93637":{"s":3.7,"v":"LOW","x":"An authentication rate-limit bypass in Zimbra Collaboration Suite 10.1.0 through 10.1.21 allows unauthenticated attackers to make repeated password guesses through GraphQL without incrementing Zimbra’s source-IP failure counter. GraphQL aliases allow multiple authentication attempts in one HTTP request.","vp":"Zimbra Zimbra Collaboration Suite","t":"Zimbra Collaboration Suite GraphQL Batched Authentication Bypasses Pre-Auth Rate Limiting","p":1791995123436},"CVE-2026-93635":{"s":5.3,"v":"MEDIUM","x":"LDAP filter injection in Zimbra Collaboration Suite 10.1.0 through 10.1.21 allows unauthenticated attackers to alter external LDAP search filters. On domains using search-filter authentication and lazy provisioning, this creates a password oracle for external directory users. Authenticated S/MIME lookups can also…","vp":"Zimbra Zimbra Collaboration Suite","t":"Zimbra Collaboration Suite LDAP Filter Injection via Unescaped computeDn() Template Substitution","p":1791995073121},"CVE-2026-73571":{"s":3.1,"v":"LOW","x":"An authorization bypass vulnerability exists in Zimbra Collaboration (ZCS) before 10.1.17 due to improper authorization validation in delegated email sending functionality. An authenticated attacker can send specially crafted SOAP requests to impersonate another user and send emails without possessing the required…","vp":"Zimbra Collaboration","t":"","p":1786634439678},"CVE-2026-10631":{"s":6.5,"v":"MEDIUM","x":"An authorization bypass in the EWS FindItem handler of Zimbra Collaboration Suite 10.1.0 through 10.1.19 allows an authenticated user with EWS enabled to read complete mailbox items, including raw MIME and attachments, from arbitrary local accounts without a share or delegation grant.","vp":"Zimbra Zimbra Collaboration Suite","t":"Zimbra Collaboration Suite EWS Extension Authorization Bypass via Crafted Composite Folder/Item Identifier","p":1791476727987},"CVE-2026-108065":{"s":9.8,"v":"CRITICAL","x":"SQL Injection (CWE-89) in the SOAP GetUser method of the /preapproval.asmx endpoint in Channel Software WebAlliance eCommerce [VERSION — missing] allows an unauthenticated remote attacker to read, write, and potentially execute commands on the backend Microsoft SQL Server via a crafted sUserID parameter value…","vp":"Channel Software WebAlliance eCommerce","t":"Unauthenticated SQL Injection in Channel Software WebAlliance eCommerce","p":1791985083563},"CVE-2026-85851":{"s":7.8,"v":"HIGH","x":"Use after free in Windows SmartScreen allows an authorized attacker to elevate privileges locally.","vp":"Microsoft Windows 11 version 23H2","t":"Windows SmartScreen Elevation of Privilege Vulnerability","p":1791918009064},"CVE-2026-104935":{"s":8.6,"v":"HIGH","x":"Authentication bypass by spoofing in ICS before version 25.1.3.0 allows a remote unauthenticated attacker to execute arbitrary commands. This does not impact ICS version 22.7R2.14 or prior.","vp":"Ivanti Connect Secure","t":"","p":1791905467757},"CVE-2026-74580":{"s":8.8,"v":"HIGH","x":"In the Linux kernel, the following vulnerability has been resolved:\n\nvhost: reset the vring metadata cache on vring reconfiguration\n\nvq->meta_iotlb[] caches the vhost_iotlb_map that backs each vring\nmetadata region, and iotlb_access_ok() returns early on a cache hit,\ntaking the hit as proof that the region has already…","vp":"Linux Linux","t":"vhost: reset the vring metadata cache on vring reconfiguration","p":1787329914076},"CVE-2026-85920":{"s":7,"v":"HIGH","x":"Time-of-check time-of-use (toctou) race condition in Windows BitLocker allows an authorized attacker to elevate privileges locally.","vp":"Microsoft Windows 10 Version 1607","t":"Windows BitLocker Elevation of Privilege Vulnerability","p":1791918010961},"CVE-2026-88070":{"s":7.8,"v":"HIGH","x":"Out-of-bounds read in Windows BitLocker allows an authorized attacker to elevate privileges locally.","vp":"Microsoft Windows 10 Version 1607","t":"Windows BitLocker Elevation of Privilege Vulnerability","p":1791918016708},"CVE-2026-83500":{"s":6.1,"v":"MEDIUM","x":"Url redirection to untrusted site ('open redirect') in Windows BitLocker allows an unauthorized attacker to bypass a security feature with a physical attack.","vp":"Microsoft Windows 10 Version 1607","t":"Windows BitLocker Security Feature Bypass Vulnerability","p":1791917985935},"CVE-2026-96951":{"s":8.8,"v":"HIGH","x":"Improper neutralization of special elements used in a command ('command injection') in Windows Shell allows an unauthorized attacker to bypass a security feature over a network.","vp":"Microsoft Outlook.com","t":"Windows Shell Security Feature Bypass Vulnerability","p":1791918086801},"CVE-2026-103572":{"s":8.8,"v":"HIGH","x":"Improper control of generation of code ('code injection') in Visual Studio Tools for Applications and SQL Server Management Studio allows an unauthorized attacker to execute code over a network.","vp":"Microsoft Microsoft Visual Studio 2022 version 17.14","t":"Visual Studio Tools for Applications and SQL Server Management Studio Remote Code Execution Vulnerability","p":1791917799614},"CVE-2026-107656":{},"CVE-2026-88772":{"s":8.1,"v":"HIGH","x":"Vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway.\n\nThis issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP; Gateway: before 14.1-73.37 and before 13.1-64.23 leading to Remote Code Execution or Denial of Service","vp":"Citrix NetScaler ADC","t":"Memory overflow vulnerability leading to Remote Code Execution or Denial of Service","p":1790525396033},"CVE-2026-105445":{"s":9.4,"v":"CRITICAL","x":"An Incorrect Privilege Assignment vulnerability in Docker Hub's account-to-organization conversion feature allowed an authenticated attacker to reassign a personal access token (PAT) they controlled to another Docker Hub user without rotating or revoking the token secret. The unchanged PAT then authenticated to the…","vp":"Docker Docker Hub","t":"Docker Hub account conversion could reassign an active personal access token to another user","p":1791912920071},"CVE-2026-58113":{"s":6.1,"v":"MEDIUM","x":"A vulnerability has been identified in Teamcenter V2412 (All versions < V2412.0013), Teamcenter V2506 (All versions < V2506.0010), Teamcenter V2512 (All versions < V2512.2607), Teamcenter V2606 (All versions < V2606.2607). Affected applications do not properly encode user-supplied input reflected into HTML attribute…","vp":"Siemens Teamcenter V2412","t":"","p":1788855081609},"CVE-2026-39919":{"s":9.8,"v":"CRITICAL","x":"Ghostscript before 10.08.0 contains a heap-based buffer overflow vulnerability in the JPEG 2000 output adapter (base/sjpx_openjpeg.c) that allows attackers to cause memory corruption by supplying a crafted PDF containing a JPEG 2000 image with mismatched component subsampling factors. When image components declare…","vp":"Artifex Software Ghostscript","t":"Ghostscript < 10.08.0 Heap Buffer Overflow via JPEG 2000 Output Adapter","p":1789482366697},"CVE-2026-107605":{"s":6.2,"v":"MEDIUM","x":"SWIFI-SE2KIC firmware versions 2.0.22 and prior are vulnerable to a Missing Authentication for Critical Function vulnerability that could allow an attacker on the local network to view live video feed without authentication.","vp":"Swann Communications SWIFI-SE2KIC","t":"Missing authentication for critical function in Swann Communications SWIFI-SE2KIC","p":1791915437966},"CVE-2026-107606":{"s":6.2,"v":"MEDIUM","x":"SWIFI-SE2KIC firmware versions 2.0.22 and prior are vulnerable to a Missing Authentication for Critical Function vulnerability that could allow an attacker on the local network to retrieve a snapshot of the live feed without authentication.","vp":"Swann Communications SWIFI-SE2KIC","t":"Missing authentication for critical function in Swann Communications SWIFI-SE2KIC","p":1791915541096},"CVE-2026-107607":{"s":6.2,"v":"MEDIUM","x":"SWIFI-SE2KIC firmware versions 2.0.22 and prior are vulnerable to a Missing Authentication for Critical Function vulnerability that could allow an attacker on the local network to access a real-time video stream without authentication.","vp":"Swann Communications SWIFI-SE2KIC","t":"Missing authentication for critical function in Swann Communications SWIFI-SE2KIC","p":1791915587325},"CVE-2026-92817":{"s":8.8,"v":"HIGH","x":"The Ignition Perspective module does not properly validate session privileges when determining Designer-level access. An authenticated user with access to a Vision project could provide their valid Vision session identifier and gain Designer-level privileges. An attacker could exploit these elevated privileges to…","vp":"Inductive Automation Ignition","t":"Inductive Automation Ignition Software Incorrect Authorization","p":1791933763516},"CVE-2026-8838":{"s":9.8,"v":"CRITICAL","x":"Unsafe use of Python's eval() on server-received data in the vector_in() function in amazon-redshift-python-driver before 2.1.14 allows a rogue server or man-in-the-middle actor to execute arbitrary code on the client. \n\n\n\nTo remediate this issue, users should upgrade to version 2.1.14.","vp":"AWS Amazon Redshift connector for Python","t":"Remote Code Execution via eval() Injection in amazon-redshift-python-driver","p":1779135337933},"CVE-2023-6317":{"s":7.2,"v":"HIGH","x":"A prompt bypass exists in the secondscreen.gateway service running on webOS version 4 through 7. An attacker can create a privileged account without asking the user for the security PIN. \n\nFull versions and TV models affected:\n\nwebOS 4.9.7 - 5.30.40 running on LG43UM7000PLA \nwebOS 5.5.0 - 04.50.51 running on…","vp":"LG WebOS","t":"PIN/prompt bypass on the secondscreen.gateway service allows access to the SSAP API without user interaction","p":1712670094843},"CVE-2023-6320":{"s":9.1,"v":"CRITICAL","x":"A command injection vulnerability exists in the com.webos.service.connectionmanager/tv/setVlanStaticAddress endpoint on webOS versions 5 and 6. A series of specially crafted requests can lead to command execution as the dbus user. An attacker can make authenticated requests to trigger this vulnerability.\n\nFull…","vp":"LG webOS","t":"Command injection in the com.webos.service.connectionmanager/tv/setVlanStaticAddress endpoint","p":1712670215166},"CVE-2026-85097":{"s":9.8,"v":"CRITICAL","x":"The Bricksforge plugin for WordPress is vulnerable to unauthenticated arbitrary file upload in versions up to, and including, 3.1.8.9. This is due to insufficient validation of the attacker-controlled URL field in the 'temporaryFileUploads' parameter during form submission. An unauthenticated attacker can first obtain…","vp":"Bricksforge Bricksforge","t":"Bricksforge <= 3.1.8.9 - Unauthenticated Arbitrary File Upload via 'temporaryFileUploads' Parameter","p":1791441729676},"CVE-2026-108096":{"s":6.5,"v":"MEDIUM","x":"Improper authorization in the query resolvers generated by @aws-amplify/graphql-index-transformer in AWS Amplify API Category before 3.1.2 might allow an authenticated remote user to read records owned by other users of the same application via crafted queries.\n\n\n\nThis issue has been addressed in…","vp":"AWS aws-amplify/graphql-index-transformer","t":"Improper authorization in query resolvers for SQL-backed models in AWS Amplify API Category","p":1791569424488},"CVE-2026-82077":{"s":7.3,"v":"HIGH","x":"An improper limitation of a pathname to a restricted directory (path traversal) vulnerability in the Scan-to-Fax component of PaperCut NG and PaperCut MF allows an authenticated administrator to execute arbitrary commands on the underlying host via crafted fax provider settings.","vp":"PaperCut PaperCut NG/MF","t":"PaperCut NG/MF: Remote Code Execution via Scan2Fax","p":1790232215197},"CVE-2026-82078":{"s":9.4,"v":"CRITICAL","x":"An unsafe dynamic class loading vulnerability exists in the database connection utilities of PaperCut MF and PaperCut NG. The application instantiates database driver classes based on configurable driver names without validating against an allowlist of approved drivers. If an attacker can manipulate system…","vp":"PaperCut PaperCut MF/NG","t":"PaperCut MF/NG: Unsafe Dynamic Class Loading in Database Connector","p":1787917525388},"CVE-2026-81578":{"s":8.8,"v":"HIGH","x":"An improper access control vulnerability exists in the web management interface of PaperCut MF and PaperCut NG. Under specific conditions, unauthenticated remote requests targeting administrative functions can trigger backend actions prior to the  completion of access validation checks. This allows an unauthenticated…","vp":"PaperCut PaperCut MF/NG","t":"PaperCut MF/NG: Authentication Bypass","p":1787917185402},"CVE-2026-107783":{"s":5.9,"v":"MEDIUM","x":"Insertion of sensitive information into log file in AWS Tools for PowerShell before 5.0.306 might allow local users to recover an IAM user's cleartext AWS Management Console password from command output and log artifacts.\n\n\n\nTo remediate this issue, users should upgrade to version 5.0.306 or later. After upgrading,…","vp":"AWS aws-tools-for-powershell","t":"Insertion of sensitive information into log file in AWS Tools for PowerShell","p":1791560300252},"CVE-2015-3306":{"s":10,"v":"CRITICAL","x":"The mod_copy module in ProFTPD 1.3.5 allows remote attackers to read and write to arbitrary files via the site cpfr and site cpto commands.","vp":"n/a n/a","t":"","p":1431961200000},"CVE-2026-85880":{"s":7.8,"v":"HIGH","x":"Heap-based buffer overflow in Windows ALPC allows an authorized attacker to elevate privileges locally.","vp":"Microsoft Windows 10 Version 1607","t":"Windows Advanced Local Procedure Call (ALPC) Elevation of Privilege Vulnerability","p":1788887661465},"CVE-2026-81963":{"s":7.8,"v":"HIGH","x":"Improper link resolution before file access ('link following') in Windows Update Stack allows an authorized attacker to elevate privileges locally.","vp":"Microsoft Windows 11 version 23H2","t":"Windows Update Stack Elevation of Privilege Vulnerability","p":1788887953121},"CVE-2026-107608":{"s":5.5,"v":"MEDIUM","x":"Improper link resolution before file access in the asset bundling output handling in AWS aws-cdk-lib before 2.267.0 might allow a context-dependent actor to cause files from the build host to be published as the deployed asset.\n\n\n\nTo remediate this issue, users should upgrade to version 2.267.0 or later.","vp":"AWS aws-cdk-lib","t":"Improper link resolution in asset bundling output handling in aws-cdk-lib","p":1791488213715},"CVE-2026-107322":{"s":7.8,"v":"HIGH","x":"An incomplete list of disallowed inputs in Amazon Agent Plugins for AWS databases-on-aws plugin before 1.7.1 might allow a remote unauthenticated actor to execute arbitrary operating system commands on the host running the helper via a crafted database command value introduced in the agent context.\n\n\n\nTo remediate…","vp":"aws databases-on-aws","t":"OS command injection in Amazon Agent Plugins for AWS databases-on-aws","p":1791484767623},"CVE-2026-102489":{"s":9.8,"v":"CRITICAL","x":"Zammad versions 6.3.0 to 6.5.4 are vulnerable a session hijack vulnerability that leads to remote code execution as the zammad user. The vulnerability is also present in version 7.0.0 to version 7.1.3, but not exploitable due to environment conditions.","vp":"Zammad GmbH Zammad","t":"Undisclosed RCE in Zammad v6.3 and higher","p":1790785279937},"CVE-2026-47483":{"s":8.2,"v":"HIGH","x":"NVIDIA DCGM Exporter for all platforms contains a vulnerability in the /debug/pprof endpoints, where an attacker could cause uncontrolled resource consumption by submitting concurrent unauthenticated profiling requests. A successful exploit of this vulnerability might lead to denial of service and information…","vp":"NVIDIA DCGM","t":"","p":1785254131369},"CVE-2026-107332":{"s":5.5,"v":"MEDIUM","x":"Insecure file permissions in the CodeCatalyst connection handler in AWS Toolkit for VS Code before 4.10.0 allowed local users to obtain CodeCatalyst bearer tokens via reading world-readable token cache files.\n\n\n\nTo mitigate this issue, users should upgrade to version 4.10.0 or later.","vp":"aws aws-toolkit-vscode","t":"Insecure Default File Permissions on Cached Credentials in AWS Toolkit for Visual Studio Code","p":1791480810417},"CVE-2026-32645":{"s":6,"v":"MEDIUM","x":"Default factory credentials with administrative access are enabled and persist even after configuring other administrator accounts.","vp":"Red Lion Controls 700 Series","t":"Red Lion Controls N-Tron 700 Series Use of Hard-Coded Credentials","p":1791555845664},"CVE-2026-39460":{"s":8.1,"v":"HIGH","x":"Usernames and passwords, including the default factory credentials, are stored in plaintext within the configuration file. With administrator rights, the configuration file can be viewed through the CLI or they can be exported from the device through a TFTP transfer from the web interface. A TFTP transfer can be…","vp":"Red Lion Controls 700 Series","t":"Red Lion Controls N-Tron 700 Series Insufficiently Protected Credentials","p":1791556247942},"CVE-2026-28745":{"s":7.5,"v":"HIGH","x":"Usernames and passwords, including the default credentials, are stored in the configuration file using weak encryption. If the default credentials are known by a malicious user, they could obtain other credentials on the system.","vp":"Red Lion Controls 700 Series","t":"Red Lion Controls N-Tron 700 Series Storing Passwords in a Recoverable Format","p":1791556582086},"CVE-2026-33367":{"s":8.1,"v":"HIGH","x":"SNMP can be used to perform administrative actions such as retrieving configuration files, modifying user accounts or device settings, and initiating firmware or bootloader upgrades or downgrades—all without any authentication.","vp":"Red Lion Controls 700 Series","t":"Red Lion Controls N-Tron 700 Series Missing Authentication for Critical Function","p":1791556717795},"CVE-2026-29797":{"s":7.1,"v":"HIGH","x":"No authentication is required when updating firmware or bootloader, making it easy for malicious files to be pushed to the device. Additionally, anyone with the same software can scan a network for N-Tron devices and push/pull firmware without authenticating by using SNMP/TFTP.","vp":"Red Lion Controls 700 Series","t":"Red Lion Controls N-Tron 700 Series Download of Code Without Integrity Check","p":1791556820991},"CVE-2026-39453":{"s":8.3,"v":"HIGH","x":"Navigating to a certain URL on the switch’s web server causes the switch to reboot. This can be automated using a tool like curl to create DoS conditions where the switch constantly reboots.","vp":"Red Lion Controls 700 Series","t":"Red Lion Controls N-Tron 700 Series Reachable Assertion","p":1791556938998},"CVE-2026-33272":{"s":4.9,"v":"MEDIUM","x":"A malicious user with physical access to the device can boot the switch from factory settings without authentication, use the default administrative credentials to obtain administrative access, and save changes to the configuration file so that they persist next time the switch boots normally.","vp":"Red Lion Controls 700 Series","t":"Red Lion Controls N-Tron 700 Series Authentication Bypass Using an Alternate Path or Channel","p":1791557066429},"CVE-2026-105269":{"s":6.8,"v":"MEDIUM","x":"Satel Netco Design versions prior to v2.1.7 contains a stored cross site scripting vulnerability. An authenticated user with Network Operator privileges could store untrusted content that is rendered without adequate neutralization. Successful exploitation could allow script execution in another user's browser when…","vp":"Satel Satel Netco Design","t":"Satel Netco Design Cross-site Scripting","p":1791494951114},"CVE-2026-104629":{"s":8.8,"v":"HIGH","x":"A component loading mechanism in openPDC and openHistorian will construct and run any specified type, which may be an invalid component to load. An attacker with an authenticated user account and the ability to place a file on the host filesystem can use this to run arbitrary constructor code, and this code runs with…","vp":"Grid Protection Alliance openPDC","t":"Grid Protection Alliance openPDC and openHistorian Use of Externally-Controlled Input to Select Classes or Code","p":1791554301233},"CVE-2026-100730":{"s":9.8,"v":"CRITICAL","x":"A service console interface on openPDC and openHistorian deserializes a client-supplied data structure. On systems using Windows Authentication, an attacker must already be authenticated to reach this function; on systems without Windows Authentication, this is reachable by an unauthenticated network attacker. This…","vp":"Grid Protection Alliance openPDC","t":"Grid Protection Alliance openPDC and openHistorian Deserialization of Untrusted Data","p":1791553479190},"CVE-2026-105281":{"s":7.5,"v":"HIGH","x":"The internal data publisher on openPDC accepts network connections without authentication in its default configuration. An unauthenticated network attacker can connect to this interface and retrieve the complete device and measurement topology of the system.","vp":"Grid Protection Alliance openPDC","t":"Grid Protection Alliance openPDC and openHistorian Missing Authentication for Critical Function","p":1791553746352},"CVE-2026-85479":{"s":5.3,"v":"MEDIUM","x":"The STTP-based data publisher on openPDC accepts network connections without authentication in its default configuration. An unauthenticated network attacker can connect to this interface and exchange data with it.","vp":"Grid Protection Alliance openPDC","t":"Grid Protection Alliance openPDC and openHistorian Missing Authentication for Critical Function","p":1791553921605},"CVE-2026-101022":{"s":4.3,"v":"MEDIUM","x":"A Modbus connection feature on openPDC accepts a caller-specified destination address and port with no restriction on which internal hosts may be targeted. An authenticated user can attempt connections to arbitrary internal network destinations, revealing which destinations are reachable. With repeated attempts, an…","vp":"Grid Protection Alliance openPDC","t":"Grid Protection Alliance openPDC and openHistorian Server-Side Request Forgery (SSRF)","p":1791554129163},"CVE-2026-105278":{"s":9.8,"v":"CRITICAL","x":"The published Docker image for openPDC includes a fixed administrative credential with no forced change on first use. An attacker with network access to the management interface can authenticate using this credential and gain full administrative control of the application.","vp":"Grid Protection Alliance openPDC (Docker image)","t":"Grid Protection Alliance openPDC (Docker image) Use of Hard-coded Credentials","p":1791554481533},"CVE-2014-6278":{"s":8.8,"v":"HIGH","x":"GNU Bash through 4.3 bash43-026 does not properly parse function definitions in the values of environment variables, which allows remote attackers to execute arbitrary commands via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the mod_cgi and mod_cgid modules in…","vp":"n/a n/a","t":"","p":1412071200000},"CVE-2015-5477":{"s":7.5,"v":"HIGH","x":"named in ISC BIND 9.x before 9.9.7-P2 and 9.10.x before 9.10.2-P3 allows remote attackers to cause a denial of service (REQUIRE assertion failure and daemon exit) via TKEY queries.","vp":"n/a n/a","t":"","p":1438178400000},"CVE-2016-3081":{"s":8.1,"v":"HIGH","x":"Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, allow remote attackers to execute arbitrary code via method: prefix, related to chained expressions.","vp":"n/a n/a","t":"","p":1461679200000},"CVE-2019-11510":{"s":9.9,"v":"CRITICAL","x":"In Pulse Secure Pulse Connect Secure (PCS) 8.2 before 8.2R12.1, 8.3 before 8.3R7.1, and 9.0 before 9.0R3.4, an unauthenticated remote attacker can send a specially crafted URI to perform an arbitrary file reading vulnerability .","vp":"n/a n/a","t":"","p":1557332308000},"CVE-2021-22205":{"s":10,"v":"CRITICAL","x":"An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.9. GitLab was not properly validating image files that were passed to a file parser which resulted in a remote command execution.","vp":"GitLab GitLab","t":"","p":1619199576000},"CVE-2021-3199":{"s":9.8,"v":"CRITICAL","x":"Directory traversal with remote code execution can occur in /upload in ONLYOFFICE Document Server before 5.6.3, when JWT is used, via a /.. sequence in an image upload parameter.","vp":"n/a n/a","t":"","p":1611283294000},"CVE-2023-22894":{"s":7.2,"v":"HIGH","x":"Strapi through 4.5.5 allows attackers (with access to the admin panel) to discover sensitive user details by exploiting the query filter. The attacker can filter users by columns that contain sensitive information and infer a value from API responses. If the attacker has super admin access, then this can be exploited…","vp":"n/a n/a","t":"","p":1681862400000},"CVE-2026-107352":{"s":7.7,"v":"HIGH","x":"Missing authorization checks in Amazon Athena engine version 3 request handling could have allowed an authenticated user to read limited query metadata (AWS account identifiers and SQL statement text) from other AWS accounts. Query results, credentials, and Amazon S3 data were not affected. AWS remediated the issue on…","vp":"AWS Amazon Athena","t":"Missing authorization checks in Amazon Athena engine version 3 request handling","p":1791404070288},"CVE-2026-105811":{"s":6.5,"v":"MEDIUM","x":"Authorization bypass through a user-controlled key in the optional Amazon Q Business Lambda hook sample ( q-business-lambda-hook https://github.com/aws-solutions-library-samples/qnabot-on-aws/blob/main/source/docs/lambda_hooks/README.md ), available with QnABot on AWS versions 7.0.0 through 7.4.5, might allow an…","vp":"aws qnabot-on-aws","t":"Authorization bypass through a user-controlled key in the Amazon Q Business Lambda hook sample in QnABot on AWS","p":1791317011155},"CVE-2026-76455":{"s":9.8,"v":"CRITICAL","x":"As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco NX-OS engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities.\r\n\r\nThe vulnerabilities tracked by…","vp":"Cisco Cisco NX-OS Software","t":"Cisco NX-OS Software Security Hardening Release: October 2026 - Improper Access Control Vulnerabilities","p":1791389727008},"CVE-2026-76456":{"s":8.6,"v":"HIGH","x":"As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco NX-OS engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities.\r\n\r\nThe vulnerabilities tracked by…","vp":"Cisco Cisco NX-OS Software","t":"Cisco NX-OS Software Security Hardening Release: October 2026 - Improper Input Validation Vulnerabilities","p":1791389711980},"CVE-2026-76457":{"s":8.6,"v":"HIGH","x":"As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco NX-OS engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities.\r\n\r\nThe vulnerabilities tracked by…","vp":"Cisco Cisco NX-OS Software","t":"Cisco NX-OS Software Security Hardening Release: October 2026 - Out-of-bounds Read Vulnerabilities","p":1791389722604},"CVE-2026-76459":{"s":9.8,"v":"CRITICAL","x":"As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco NX-OS engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities.\r\n\r\nThe vulnerabilities tracked by…","vp":"Cisco Cisco NX-OS Software","t":"Cisco NX-OS Software Security Hardening Release: October 2026 - Out-of-bounds Write Vulnerabilities","p":1791389743747},"CVE-2026-76458":{"s":8.6,"v":"HIGH","x":"As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco NX-OS engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities.\r\n\r\nThe vulnerabilities tracked by…","vp":"Cisco Cisco NX-OS Software","t":"Cisco NX-OS Software Security Hardening Release: October 2026 - Improper Handling of Exceptional Conditions Vulnerabilities","p":1791389749354},"CVE-2026-76453":{"s":8.8,"v":"HIGH","x":"As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco NX-OS engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities.\r\n\r\nThe vulnerabilities tracked by…","vp":"Cisco Cisco NX-OS Software","t":"Cisco NX-OS Software Security Hardening Release: October 2026 - Improper Neutralization Vulnerabilities","p":1791389544554},"CVE-2026-76465":{"s":9.8,"v":"CRITICAL","x":"A vulnerability in the MPLS Operation, Administration, and Maintenance (OAM) feature of Cisco NX-OS Software for Cisco Nexus 3000 Series Switches and Cisco Nexus 9000 Series Switches could allow an unauthenticated, remote attacker to execute arbitrary code with&nbsp;root privileges or cause a denial of service (DoS)…","vp":"Cisco Cisco NX-OS Software","t":"Cisco Nexus 3000 and 9000 Series Switches MPLS OAM Remote Code Execution Vulnerability","p":1791389666107},"CVE-2026-76485":{"s":9.8,"v":"CRITICAL","x":"A vulnerability in the VXLAN Operation, Administration, and Maintenance (OAM) feature of Cisco NX-OS Software, known as NGOAM, could allow an unauthenticated, remote attacker to execute arbitrary code with root privileges or cause a Denial-of-Service (DoS) on an affected device.\r\n\r\nThis vulnerability is due to…","vp":"Cisco Cisco NX-OS Software","t":"Cisco Nexus 3000 and 9000 Series Switches VXLAN OAM (NGOAM) Remote Code Execution Vulnerability","p":1791389828503},"CVE-2026-76486":{"s":9.8,"v":"CRITICAL","x":"A vulnerability in the VXLAN Operation, Administration, and Maintenance (OAM) feature of Cisco NX-OS Software, known as NGOAM, could allow an unauthenticated, remote attacker to execute arbitrary code with root privileges or cause a Denial-of-Service (DoS) on an affected device.\r\n\r\nThis vulnerability is due to…","vp":"Cisco Cisco NX-OS Software","t":"Cisco Nexus 3000 and 9000 Series Switches VXLAN OAM (NGOAM) Remote Code Execution Vulnerability","p":1791389836954},"CVE-2026-76501":{"s":9.8,"v":"CRITICAL","x":"A vulnerability in the Segment Routing over IPv6 (SRv6) Operation, Administration, and Maintenance (OAM) feature of Cisco NX-OS Software, known as NGOAM, could allow an unauthenticated, remote attacker to execute arbitrary code with root privileges or cause a denial of service (DoS) on an affected device.\r\n\r\nThis…","vp":"Cisco Cisco NX-OS Software","t":"Cisco Nexus 9000 Series Switches SRv6 OAM (NGOAM) Remote Code Execution Vulnerability","p":1791389855018},"CVE-2026-76471":{"s":9.8,"v":"CRITICAL","x":"A vulnerability in the NX-API feature of Cisco NX-OS Software could allow an unauthenticated, remote attacker to execute arbitrary code with root privileges or cause a denial of service (DoS) condition on an affected device.&nbsp;\r\n\r\nThe vulnerability is due to insufficient input validation of data that is sent to the…","vp":"Cisco Cisco NX-OS Software","t":"Cisco NX-OS Software NX-API Remote Code Execution Vulnerability","p":1791389735076},"CVE-2026-20362":{"s":7.2,"v":"HIGH","x":"A vulnerability in the web-based management interface of Cisco Finesse could allow an unauthenticated, remote attacker to conduct server-side request forgery (SSRF) attacks through an affected device.\r\n\r\nThis vulnerability is due to improper input validation for specific HTTP requests. An attacker could exploit this…","vp":"Cisco Cisco Finesse","t":"Cisco Finesse Server-Side Request Forgery Vulnerability","p":1791389532584},"CVE-2026-76480":{"s":9.8,"v":"CRITICAL","x":"As part of Cisco's ongoing commitment to proactive security and product quality, the engineering team for Cisco License On-Prem, formerly Cisco Smart Software Manager On-Prem (SSM On-Prem), has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple…","vp":"Cisco Cisco License On-Prem","t":"Cisco License On-Prem Security Hardening Release","p":1791389752636},"CVE-2026-76482":{"s":10,"v":"CRITICAL","x":"As part of Cisco's ongoing commitment to proactive security and product quality, the engineering team for Cisco License On-Prem, formerly Cisco Smart Software Manager On-Prem (SSM On-Prem), has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple…","vp":"Cisco Cisco License On-Prem","t":"Cisco License On-Prem Security Hardening Release","p":1791389760719},"CVE-2026-76483":{"s":9.1,"v":"CRITICAL","x":"As part of Cisco's ongoing commitment to proactive security and product quality, the engineering team for Cisco License On-Prem, formerly Cisco Smart Software Manager On-Prem (SSM On-Prem), has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple…","vp":"Cisco Cisco License On-Prem","t":"Cisco License On-Prem Security Hardening Release","p":1791389766849},"CVE-2026-76484":{"s":8.8,"v":"HIGH","x":"As part of Cisco's ongoing commitment to proactive security and product quality, the engineering team for Cisco License On-Prem, formerly Cisco Smart Software Manager On-Prem (SSM On-Prem), has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple…","vp":"Cisco Cisco License On-Prem","t":"Cisco License On-Prem Security Hardening Release","p":1791389828504},"CVE-2026-76498":{"s":9.8,"v":"CRITICAL","x":"As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Application Policy Infrastructure Controller (APIC) engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered…","vp":"Cisco Cisco Application Policy Infrastructure Controller (APIC)","t":"Cisco Application Policy Infrastructure Controller Hardening Release: October 2026 - Improper Access Control Vulnerabilities","p":1791389845677},"CVE-2026-76499":{"s":9.8,"v":"CRITICAL","x":"As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Application Policy Infrastructure Controller (APIC) engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered…","vp":"Cisco Cisco Application Policy Infrastructure Controller (APIC)","t":"Cisco Application Policy Infrastructure Controller Hardening Release: October 2026 - Improper Neutralization Vulnerabilities","p":1791389845662},"CVE-2026-76500":{"s":9.8,"v":"CRITICAL","x":"As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Application Policy Infrastructure Controller (APIC) engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered…","vp":"Cisco Cisco Application Policy Infrastructure Controller (APIC)","t":"Cisco Application Policy Infrastructure Controller Hardening Release: October 2026 - Improper Control of a Resource Through its Lifetime Vulnerabilities","p":1791389854991},"CVE-2026-20328":{"s":9.1,"v":"CRITICAL","x":"A vulnerability in the web-based management interface of Cisco License On-Prem, formerly Cisco Smart Software Manager On-Prem (SSM On-Prem), could allow an unauthenticated, remote attacker to gain unauthorized access to an affected application.\r\n\r\nThis vulnerability is due to improper checks during the password reset…","vp":"Cisco Cisco License On-Prem","t":"Cisco Smart Software Manager On-Prem Arbitrary Account Password Reset Vulnerability","p":1791389524453},"CVE-2026-76437":{"s":4.9,"v":"MEDIUM","x":"A vulnerability in the web-based user interface of Cisco License On-Prem, formerly Cisco Smart Software Manager On-Prem (SSM On-Prem), could allow an authenticated, remote attacker to execute arbitrary commands on the underlying operating system.\r\n\r\nThis vulnerability is due to improper validation of user-supplied…","vp":"Cisco Cisco License On-Prem","t":"Cisco Smart Software Manager On-Prem Command Injection Vulnerability","p":1791389542493},"CVE-2026-76452":{"s":4.9,"v":"MEDIUM","x":"A vulnerability in the web-based management interface of Cisco License On-Prem, formerly Cisco Smart Software Manager On-Prem (SSM On-Prem), could allow an authenticated, remote attacker to conduct SQL injection attacks against an affected application.\r\n\r\nThis vulnerability is due to insufficient validation of…","vp":"Cisco Cisco License On-Prem","t":"Cisco Smart Software Manager On-Prem SQL Injection Vulnerability","p":1791389532545},"CVE-2026-76454":{"s":9.1,"v":"CRITICAL","x":"A vulnerability in the Cisco Smart Licensing Utility API of Cisco License On-Prem, formerly Cisco Smart Software Manager On-Prem (SSM On-Prem), could allow an unauthenticated, remote attacker to write arbitrary files to the system or cause a DoS condition on an affected application.\r\n\r\nThis vulnerability is due to…","vp":"Cisco Cisco License On-Prem","t":"Cisco Smart Software Manager On-Prem Unauthenticated API Vulnerability","p":1791389551265},"CVE-2026-102255":{"s":10,"v":"CRITICAL","x":"A Pre-authentication SSRF vulnerability exists in the SMA1000 Appliance Work Place interface due to an unintended alternate access path. By abusing this path, a remote unauthenticated attacker could potentially exploit this vulnerability to direct the appliance to issue requests on their behalf and reach internal…","vp":"SonicWall SMA1000","t":"","p":1791378433384},"CVE-2026-42532":{"s":5.5,"v":"MEDIUM","x":"A path traversal vulnerability exists in the EmailSheet extract_parts functionality of VisiData (version(s): dev (commit 38b21f78)). A specially crafted .eml file can lead to arbitrary file write. An attacker can provide a malicious file to trigger this vulnerability.","vp":"visidata visidata","t":"","p":1791377693377},"CVE-2026-41958":{"s":6.5,"v":"MEDIUM","x":"A path traversal vulnerability exists in the unzip_http RemoteZipFile extract functionality of VisiData (version(s): dev (commit 38b21f78)). A specially crafted .zip file can lead to arbitrary file write. An attacker can provide a crafted URL to trigger this vulnerability.","vp":"visidata visidata","t":"","p":1791377694165},"CVE-2026-105812":{"s":9,"v":"CRITICAL","x":"Improper control of code generation in the agent import functionality of Amazon Bedrock AgentCore Starter Toolkit before 0.3.14 might allow an authenticated same-account actor to execute arbitrary code when a user imports and runs or deploys a Bedrock Agent, via crafted configuration values incorporated into generated…","vp":"aws bedrock-agentcore-starter-toolkit","t":"Code injection via unencoded configuration values during Python code generation in Bedrock AgentCore Starter Toolkit agent import","p":1791318848826},"CVE-2026-106032":{"s":5.7,"v":"MEDIUM","x":"Server-side request forgery in the OpenAPI schema processing of the agent import functionality in Amazon Bedrock AgentCore Starter Toolkit before 0.3.14 might allow an authenticated remote actor in the same AWS account to cause the environment of a user importing a Bedrock Agent to issue arbitrary outbound requests…","vp":"aws bedrock-agentcore-starter-toolkit","t":"Server-side request forgery and local file read via unrestricted external OpenAPI reference resolution in Bedrock AgentCore Starter Toolkit agent import","p":1791318894576},"CVE-2026-4637":{"s":5.1,"v":"MEDIUM","x":"Paessler PRTG Network Monitor before version 26.2.120.1449 is affected by a reflected Cross-Site Scripting (XSS) vulnerability. When a request is made for a non-existent resource ending in \\\".htm\\\", the web interface returns an HTTP 403 \\\"Forbidden Path\\\" error page that echoes the requested URL path into the HTML…","vp":"Paessler GmbH PRTG Network Monitor","t":"Reflected Cross-Site Scripting via URL Path in Paessler PRTG Network Monitor","p":1790244306998},"CVE-2026-4638":{"s":7.1,"v":"HIGH","x":"PRTG Network Monitor before version 26.2.120.1449 ships a demo EXE/Script sensor that multiplies two integer parameters using cscript.exe. If a non-numeric value is passed instead, cscript.exe raises a 'Type mismatch' runtime error that includes the offending parameter value in plaintext. PRTG provides a documented…","vp":"Paessler GmbH PRTG Network Monitor","t":"Plaintext Password Disclosure via VBScript Sensor Error Message in Paessler PRTG Network Monitor","p":1790247474203},"CVE-2024-8176":{"s":7.5,"v":"HIGH","x":"A stack overflow vulnerability exists in the libexpat library due to the way it handles recursive entity expansion in XML documents. When parsing an XML document with deeply nested entity references, libexpat can be forced to recurse indefinitely, exhausting the stack space and causing a crash. This issue could lead…","vp":"","t":"Libexpat: expat: improper restriction of xml entity expansion depth in libexpat","p":1741940388962},"CVE-2025-59375":{"s":7.5,"v":"HIGH","x":"libexpat in Expat before 2.7.2 allows attackers to trigger large dynamic memory allocations via a small document that is submitted for parsing.","vp":"libexpat project libexpat","t":"","p":1757894400000},"CVE-2026-7395":{"s":8.5,"v":"HIGH","x":"Asset Suite allows unauthenticated users to access HTTPPublishAdapterTestServlet that can be used for configuration file upload, leading to information disclosure and integrity compromise. The HTTPPublishAdapterTestServlet is specifically meant for testing purposes to be used in a non-production environment.","vp":"Hitachi Energy Asset Suite","t":"","p":1790675111581},"CVE-2026-11796":{"s":5.1,"v":"MEDIUM","x":"Asset Suite allows unauthenticated users to access PropertiesReloadServlet, CacheFlushServlet, MetadataCacheFlushServlet and ResourceBundleReloadServlet, which could result in denial-of-service conditions affecting application availability. These servlets are designed to perform specific functions within production…","vp":"Hitachi Energy Asset Suite","t":"","p":1790675434724},"CVE-2026-27872":{"s":5.6,"v":"MEDIUM","x":"- Improper Privilege Management vulnerability in Johnson Controls Easy IO FG allows (Brute Force).\n\nThis issue affects Easy IO FG: before 2.0b52.","vp":"Johnson Controls Easy IO FG","t":"EasyIO FG","p":1790881036163},"CVE-2026-27873":{"s":5.6,"v":"MEDIUM","x":"- Use of Hard-coded Credentials vulnerability in Johnson Controls EasyIO FG allows - Pasword Spraying.\n\nThis issue affects EasyIO FG: before 2.0b52.","vp":"Johnson Controls EasyIO FG","t":"","p":1790890053323},"CVE-2026-34197":{"s":8.8,"v":"HIGH","x":"Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ.\n\nApache ActiveMQ Classic exposes the Jolokia JMX-HTTP bridge at /api/jolokia/ on the web console. The default Jolokia access policy permits exec operations on all ActiveMQ…","vp":"Apache Software Foundation Apache ActiveMQ Broker","t":"Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Authenticated users could perform RCE via Jolokia MBeans","p":1775548210958},"CVE-2026-15340":{"s":9.8,"v":"CRITICAL","x":"lwIP SMTP client does not check the size of inputs, potentially allowing a buffer overflow.","vp":"Savannah lwIP SMTP client","t":"Savannah lwIP SMTP client Classic Buffer Overflow","p":1791557563517},"CVE-2026-86360":{"s":9.6,"v":"CRITICAL","x":"Dell System Update, versions prior to 2.3.0.0, contains an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Filesystem access for attacker. This vulnerability is…","vp":"Dell System Update","t":"","p":1791310429171},"CVE-2026-61500":{"s":9.8,"v":"CRITICAL","x":"Rejetto HFS 3.0.0 through 3.2.0 derives its session-cookie signing key from the non-cryptographic Math.random() generator and discloses outputs of the same generator to unauthenticated clients during login. A remote attacker can collect a small number of login responses, reconstruct the generator's state, recover the…","vp":"rejetto hfs","t":"Rejetto HFS < 3.2.1 Session Forgery via Predictable Signing Key","p":1783963315747},"CVE-2026-96940":{"s":8.8,"v":"HIGH","x":"Weak authorization in Microsoft Exchange Server allows an authenticated attacker to elevate privileges over a network.","vp":"Microsoft Microsoft Exchange Server 2016 Cumulative Update 23","t":"Microsoft Exchange Server Elevation of Privilege Vulnerability","p":1790967979061},"CVE-2026-88779":{"s":7.5,"v":"HIGH","x":"Vulnerability in NetScaler ADC and NetScaler Gateway.\n\nThis issue affects ADC: before 14.1-73.41, before 13.1-64.28, before 14.1-73.41 FIPS, and before 13.1-37.282; Gateway: before 14.1-73.41 and before 13.1-64.28.","vp":"NetScaler ADC","t":"Memory overflow vulnerability  leading to Denial of Service","p":1791081335525},"CVE-2026-90970":{"s":9.9,"v":"CRITICAL","x":"GitLab has remediated a vulnerability in the GitLab AI Gateway component affecting all versions of the AI Gateway from 18.1.6 before 19.2.4, 19.3 before 19.3.2, and 19.4 before 19.4.1 that, under certain conditions, could have allowed an authenticated user with Duo Agent Platform access to escape the prompt template…","vp":"GitLab GitLab AI Gateway","t":"Improper Neutralization of Special Elements Used in a Template Engine in GitLab AI Gateway","p":1790951689558},"CVE-2026-104019":{"s":9,"v":"CRITICAL","x":"OS command injection in the Studio Space startup validation script in Amazon SageMaker Distribution 2.x before 2.14.12, 3.x before 3.9.12, 4.0.x before 4.0.11, 4.1.x before 4.1.11, 4.2.x before 4.2.8, 4.3.x before 4.3.5, and 4.4.x before 4.4.3, as used by Amazon SageMaker Unified Studio, might allow an authenticated…","vp":"AWS sagemaker-distribution","t":"OS command injection in the Studio Space startup validation script in Amazon SageMaker Distribution when running on Amazon SageMaker Unified Studio","p":1790971690061},"CVE-2026-103956":{"s":10,"v":"CRITICAL","x":"Missing authentication for critical function in the authentication dependency in Loom for AWS before 1.6.1 allowed remote actors to obtain super-admin authority over the agent control plane, including registering tool servers, reading stored integration credentials, and rewriting the IAM role policies attached to…","vp":"AWS loom","t":"Missing authentication for critical function in Loom for AWS","p":1790967966883},"CVE-2026-103957":{"s":6.2,"v":"MEDIUM","x":"Server-side request forgery in the OAuth2 discovery handling in Loom for AWS before 1.7.0 might allow an authenticated remote user to obtain the access token of another user of the deployment and to cause the application to issue requests to arbitrary internal network locations, via a crafted discovery document…","vp":"AWS loom","t":"Server-side request forgery in the OAuth2 discovery handling in Loom for AWS","p":1790968012707},"CVE-2026-103958":{"s":7.6,"v":"HIGH","x":"Server-side request forgery in the tool server and remote agent connection handling in Loom for AWS before 1.7.0 might allow an authenticated remote user to obtain the credentials of the application's own container role and to read responses from arbitrary internal network locations, via a crafted connection address…","vp":"AWS loom","t":"Server-side request forgery in the tool server and remote agent connection handling in Loom for AWS","p":1790968050052},"CVE-2026-20267":{"s":9,"v":"CRITICAL","x":"As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco IOS XE Software engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities.\r\n\r\nThe vulnerabilities…","vp":"Cisco Cisco IOS XE Software","t":"Cisco IOS XE Software Security Hardening Release","p":1785946730636},"CVE-2026-20268":{"s":8.6,"v":"HIGH","x":"As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco IOS XE Software engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities.\r\n\r\nThe vulnerabilities…","vp":"Cisco Cisco IOS XE Software","t":"Cisco IOS XE Software Security Hardening Release","p":1785946734664},"CVE-2026-20269":{"s":8.6,"v":"HIGH","x":"As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco IOS XE Software engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities.\r\n\r\nThe vulnerabilities…","vp":"Cisco Cisco IOS XE Software","t":"Cisco IOS XE Software Security Hardening Release","p":1785946744799},"CVE-2026-20270":{"s":8.6,"v":"HIGH","x":"As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco IOS XE Software engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities.\r\n\r\nThe vulnerabilities…","vp":"Cisco Cisco IOS XE Software","t":"Cisco IOS XE Software Security Hardening Release","p":1785946749284},"CVE-2026-20271":{"s":8.6,"v":"HIGH","x":"As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco IOS XE Software engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities.\r\n\r\nThe vulnerabilities…","vp":"Cisco Cisco IOS XE Software","t":"Cisco IOS XE Software Security Hardening Release","p":1785946762991},"CVE-2026-20272":{"s":9.8,"v":"CRITICAL","x":"As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco IOS XE Software engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities.\r\n\r\nThe vulnerabilities…","vp":"Cisco Cisco IOS XE Software","t":"Cisco IOS XE Software Security Hardening Release","p":1785946766541},"CVE-2026-20273":{"s":8.6,"v":"HIGH","x":"As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco IOS XE Software engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities.\r\n\r\nThe vulnerabilities…","vp":"Cisco Cisco IOS XE Software","t":"Cisco IOS XE Software Security Hardening Release","p":1785946778482},"CVE-2026-63688":{"s":10,"v":"CRITICAL","x":"Dell Container Storage Modules (CSM), versions prior to v1.18.0, contains a Missing Authentication for Critical Function vulnerability in the csm-authorization-storage gRPC server. An unauthenticated remote attacker could potentially exploit this vulnerability, leading to unauthorized access to storage backend…","vp":"Dell Dell Container Storage Modules (CSM)","t":"","p":1791297178268},"CVE-2026-103505":{"s":6.5,"v":"MEDIUM","x":"Improper neutralization of argument delimiters in the volume handling component in AWS EFS CSI Driver (aws-efs-csi-driver) v3.1.0 through v3.4.2 might allow remote authenticated users with PersistentVolume creation permissions to inject arbitrary mount options via comma-separated values in the mounttargetipmap…","vp":"AWS aws-efs-csi-driver","t":"AWS EFS CSI Driver Mount Option Injection via mounttargetipmap","p":1790868964355},"CVE-2026-102490":{"s":9.8,"v":"CRITICAL","x":"All versions of Zammad including the latest alpha enable the local zammad user to escalate privileges to root.","vp":"Zammad GmbH Zammad","t":"Undisclosed LPE in Zammad v1.5.0 to v7.1.0-alpha","p":1790785280601},"CVE-2026-0250":{"s":5.2,"v":"MEDIUM","x":"A buffer overflow vulnerability exists in the Palo Alto Networks GlobalProtect™ app that enables a man in the middle attacker to disrupt system processes and potentially execute arbitrary code with SYSTEM privileges. This vulnerability is triggered during the processing of requests and responses exchanged between…","vp":"Palo Alto Networks GlobalProtect App","t":"GlobalProtect App: Buffer Overflow Vulnerability during connection to Portal or Gateway","p":1778696811927},"CVE-2026-104286":{"s":9.8,"v":"CRITICAL","x":"An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2.0 through 7.2.9 may allow an unauthenticated attacker to write arbitrary files on the underlying system…","vp":"Fortinet FortiMail","t":"","p":1790882258938},"CVE-2026-104002":{"s":5.3,"v":"MEDIUM","x":"A fail-open error handling issue within the data masking utility of Powertools for AWS Lambda (Python) might allow actors to read sensitive field values that the application intended to mask. \n\n\n\nTo remediate this issue, users should upgrade to version 3.35.0.","vp":"AWS powertools-lambda-python","t":"Fail-open error handling in the data masking utility in Powertools for AWS Lambda (Python)","p":1790888755109},"CVE-2026-104020":{"s":7.5,"v":"HIGH","x":"Uncontrolled recursion in the Ion reader in Amazon Ion Python before 0.15.0 might allow a remote unauthenticated actor to crash the application using the library, resulting in a denial of service, via a crafted, deeply nested Ion value.\n\n\n\nTo remediate this issue, users should upgrade to version 0.15.0 or later.","vp":"Amazon ion-python","t":"Uncontrolled recursion in the Ion reader in Amazon Ion Python","p":1790886993967},"CVE-2026-97662":{"s":8.2,"v":"HIGH","x":"An argument injection issue in the diff scan operation in AWS security-agent-mcp-server before version 0.2.0 might allow context-dependent threat actors to create, overwrite, or truncate arbitrary files on the host outside the intended workspace directory via a crafted reference value supplied to the diff scan…","vp":"AWS security-agent-mcp-server","t":"Argument injection in the diff scan operation in AWS security-agent-mcp-server allows arbitrary host file creation, overwrite, and truncation outside the intended workspace","p":1790876043924},"CVE-2026-93616":{"s":9.8,"v":"CRITICAL","x":"A directory traversal and file upload vulnerability allows an unauthenticated attacker to upload and execute arbitrary scripts on Check Point Management Server.","vp":"checkpoint Quantum Security Management","t":"Directory Traversal and File upload allows execution of arbitrary script on the Management Server","p":1790081941057},"CVE-2026-73570":{"s":8.9,"v":"HIGH","x":"A remote code execution vulnerability exists in Zimbra Collaboration (ZCS) before 10.1.20 when the optional zimbra-snmp package is installed and SNMP notifications are enabled. Due to improper sanitization of untrusted input during SNMP notification processing, an unauthenticated attacker can send specially crafted…","vp":"Zimbra Collaboration","t":"","p":1786634382195},"CVE-2026-86950":{"s":8.8,"v":"HIGH","x":"An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.7.1 and iPadOS 26.7.1, macOS Sequoia 15.8.1, macOS Tahoe 26.7.1. Processing a maliciously crafted file may lead to arbitrary code execution. Apple is aware of a report that this issue may have been exploited in an…","vp":"Apple iOS and iPadOS","t":"","p":1790622832603},"CVE-2026-90443":{"s":5.3,"v":"MEDIUM","x":"A web interface reflects a portion of the request URL into a script context and a hyperlink attribute without adequate encoding, and does not require authentication to reach. This allows an unauthenticated network attacker to craft a link that, when visited by a user, executes arbitrary script in the context of the…","vp":"CISA Malcolm","t":"","p":1789163127831},"CVE-2026-101104":{"s":7.7,"v":"HIGH","x":"The Meari IoT Cloud Platform OpenAPI Service is vulnerable to an authorization flaw that allows authenticated users to manipulate the configurations of devices they do not own. This vulnerability enables attackers to perform unauthorized actions, such as altering device settings or triggering unintended behaviors,…","vp":"Meari IoT Cloud Platform OpenAPI Service","t":"Missing Authorization in Meari IoT Cloud Platform OpenAPI Service","p":1790956701626},"CVE-2026-96613":{"s":6.5,"v":"MEDIUM","x":"The Meari IoT Cloud Platform OpenAPI Service is vulnerable to an authorization flaw that allows authenticated users to access the complete device shadow of any device by specifying its device ID. This vulnerability exposes sensitive information, such as device credentials, owner details, network data, and telemetry,…","vp":"Meari IoT Cloud Platform OpenAPI Service","t":"Missing Authorization in Meari IoT Cloud Platform OpenAPI Service","p":1790956984281},"CVE-2026-64893":{"s":7.3,"v":"HIGH","x":"- Cleartext Transmission of Sensitive Information vulnerability in Johnson Controls EasyIO NEO allows - Man In the Middle Attack.\n\nThis issue affects EasyIO NEO: before 3.3b25.","vp":"Johnson Controls EasyIO NEO","t":"","p":1790889926090},"CVE-2026-64892":{"s":6.3,"v":"MEDIUM","x":"- Exposure of Sensitive Information vulnerability in Johnson Controls Easy IO Neo allows Collect Data from Common Resource Locations.\n\nThis issue affects Easy IO Neo: before 3.3b63.","vp":"Johnson Controls Easy IO Neo","t":"","p":1790889813947},"CVE-2026-15952":{"s":6.4,"v":"MEDIUM","x":"Incorrect Permission Assignment for Critical Resource vulnerability in ABB Protection and control IED manager (PCM600).\n\nThis issue affects Protection and control IED manager (PCM600): through 2.14.","vp":"ABB Protection and control IED manager (PCM600)","t":"Improper Permission Assignment in Scheduler Service","p":1790601028374},"CVE-2026-15953":{"s":5,"v":"MEDIUM","x":"Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in ABB Protection and control IED manager (PCM600).\n\nThis issue affects Protection and control IED manager (PCM600): through 2.14.","vp":"ABB Protection and control IED manager (PCM600)","t":"Path Traversal During Project Archive Import","p":1790601466752},"CVE-2026-95102":{"s":9.4,"v":"CRITICAL","x":"WebSocket endpoints lack proper authentication mechanisms, enabling attackers to impersonate charging stations. As a result, attackers can exploit this weakness to gain unauthorized access to sensitive data or perform unauthorized actions. Given that no authentication is required, this can lead to privilege escalation…","vp":"Monta monta.app","t":"Monta monta.app Missing Authentication for Critical Function","p":1790976877182},"CVE-2026-97363":{"s":7.5,"v":"HIGH","x":"The WebSocket Application Programming Interface lacks restrictions on the number of authentication requests. This absence of rate limiting may allow an attacker to conduct denial-of-service attacks or brute-force attacks to gain unauthorized access.","vp":"Monta monta.app","t":"Monta monta.app Improper Restriction of Excessive Authentication Attempts","p":1790976750615},"CVE-2026-97212":{"s":7.3,"v":"HIGH","x":"The WebSocket backend uses charging station identifiers to uniquely associate sessions but allows multiple endpoints to connect using the same session identifier. This implementation results in predictable session identifiers. This vulnerability may allow unauthorized users to authenticate as other users or enable a…","vp":"Monta monta.app","t":"Monta monta.app Insufficient Session Expiration","p":1790976637104},"CVE-2026-93474":{"s":6.5,"v":"MEDIUM","x":"Charging station authentication identifiers are publicly accessible via web-based mapping platforms.","vp":"Monta monta.app","t":"Monta monta.app Insufficiently Protected Credentials","p":1790976479493},"CVE-2023-46604":{"s":10,"v":"CRITICAL","x":"The Java OpenWire protocol marshaller is vulnerable to Remote Code \nExecution. This vulnerability may allow a remote attacker with network \naccess to either a Java-based OpenWire broker or client to run arbitrary\n shell commands by manipulating serialized class types in the OpenWire \nprotocol to cause either the…","vp":"Apache Software Foundation Apache ActiveMQ","t":"Apache ActiveMQ, Apache ActiveMQ Legacy OpenWire Module: Unbounded deserialization causes ActiveMQ to be vulnerable to a remote code execution (RCE) attack","p":1698418771046},"CVE-2026-94591":{"s":8.4,"v":"HIGH","x":"Armatura One stores database and message-broker credentials in an install configuration file, encrypting them with AES-128-CBC when this protection is enabled. The encryption key and initialization vector are fixed values embedded in the software itself and are identical across every installation. An attacker with a…","vp":"Armatura LLC Armatura One","t":"Armatura LLC Armatura One Use of Hard-coded Cryptographic Key","p":1790978082665},"CVE-2026-94592":{"s":8.4,"v":"HIGH","x":"Armatura One's database initialization routine assigns a fixed, vendor-defined password to the database superuser account at creation time, rather than generating a unique password per installation. An individual with access to the server operating system and knowledge of this value can authenticate as the database…","vp":"Armatura LLC Armatura One","t":"Armatura LLC Armatura One Use of Hard-coded Credentials","p":1790977974438},"CVE-2026-94593":{"s":7.8,"v":"HIGH","x":"Armatura One's backup and restore routine records the full database connection command, including the superuser password, in plain text in a log file on the host. Credentials disclosed by this finding can be used to access the database when access to the server operating system is available.","vp":"Armatura LLC Armatura One","t":"Armatura LLC Armatura One Insertion of Sensitive Information into Log File","p":1790977860902},"CVE-2026-94594":{"s":4,"v":"MEDIUM","x":"Armatura One's message broker logs client connection credentials and the associated password in plain text during normal operation. Any party with read access to this log, or to a backup or support bundle that includes it, can obtain the logged credential.","vp":"Armatura LLC Armatura One","t":"Armatura LLC Armatura One Insertion of Sensitive Information into Log File","p":1790977694765},"CVE-2026-76504":{"s":9.8,"v":"CRITICAL","x":"A vulnerability in the API session-based authentication management of Cisco Catalyst SD-WAN Manager could allow an unauthenticated, remote attacker to access an affected system with privileges of the admin user.\r\n\r\nThis vulnerability is due to improper handling of URI encoding in an HTTP request, which allows the…","vp":"Cisco Cisco Catalyst SD-WAN Manager","t":"Cisco Catalyst SD-WAN Manager System Account Authorization Bypass Vulnerability","p":1790773472095},"CVE-2026-50375":{"s":6.3,"v":"MEDIUM","x":"Heap-based buffer overflow in Windows DirectX allows an authorized attacker to elevate privileges locally.","vp":"Microsoft Windows 10 Version 1809","t":"DirectX Graphics Kernel Elevation of Privilege Vulnerability","p":1784048808670},"CVE-2026-65669":{"s":9.6,"v":"CRITICAL","x":"Improper neutralization of special elements in output used by a downstream component ('injection') in SQL Server allows an unauthorized attacker to elevate privileges over a network.","vp":"Microsoft SQL Server Management Studio 22","t":"Microsoft SQL Server Elevation of Privilege Vulnerability","p":1788887630893},"CVE-2026-86131":{"s":9.2,"v":"CRITICAL","x":"A code injection vulnerability in WatchGuard Fireware OS's BOVPN Over TLS client configuration handling allows an attacker who controls the remote VPN server to execute arbitrary commands as root on the connecting Firebox.","vp":"WatchGuard Fireware OS","t":"Fireware OS Code Injection in BOVPN Over TLS Client Allows Remote Code Execution","p":1790723147700},"CVE-2026-18145":{"s":8.6,"v":"HIGH","x":"A stack-based buffer overflow vulnerability in the spamBlocker (spamd) service of WatchGuard Fireware OS allows an authenticated attacker with administrator privileges to crash the service or potentially execute arbitrary code by sending a specially crafted management request.","vp":"WatchGuard Fireware OS","t":"Fireware OS Stack-based Buffer Overflow in spamd Allows Remote Code Execution","p":1790723147947},"CVE-2026-13046":{"s":7.5,"v":"HIGH","x":"A deserialization of untrusted data vulnerability in WatchGuard Fireware OS's SAML single sign-on session handling (samld) allows an attacker who has already obtained the ability to write files on the appliance to execute arbitrary code in the context of the samld service by causing samld to load a maliciously crafted…","vp":"WatchGuard Fireware OS","t":"Fireware OS Deserialization of Untrusted Data in samld Allows Remote Code Execution","p":1790723147739},"CVE-2026-100308":{"s":7.8,"v":"HIGH","x":"Deserialization of untrusted data in the model loading component in Amazon GluonTS before 0.17.0 might allow context-dependent attackers to execute arbitrary operating system commands with the privileges of the loading process via a crafted serialized model directory.\n\n\n\nTo remediate this issue, users should upgrade…","vp":"AWS gluonts","t":"GluonTS arbitrary command execution during model deserialization","p":1790694353802},"CVE-2026-96274":{"s":7.4,"v":"HIGH","x":"In Baicells Nova 430H, an unauthenticated device within radio range can send a malformed uplink message during connection setup that contains an invalid NAS payload. Because the eNodeB does not properly validate this payload, it forwards the message to the core network, which can trigger a shutdown of the signaling…","vp":"Baicells Nova 430H eNodeB  (model pBS3101SH)","t":"Uncaught exception in Baicells Nova 430H","p":1790710153172},"CVE-2026-84411":{"s":9.8,"v":"CRITICAL","x":"The web management service in affected RouterOS versions contains an integer underflow in its HTTP request body handling that is reachable before authentication. This can be leveraged by an unauthenticated network attacker to achieve arbitrary code execution as root, or to cause a denial of service, using a single…","vp":"MikroTik RouterOS","t":"MikroTik RouterOS Integer Underflow","p":1790978988298},"CVE-2026-22755":{"s":9.3,"v":"CRITICAL","x":"Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Vivotek Affected device model numbers are FD8365, FD8365v2, FD9165, FD9171, FD9187, FD9189, FD9365, FD9371, FD9381, FD9387, FD9389, FD9391,FE9180,FE9181, FE9191, FE9381, FE9382, FE9391, FE9582, IB9365, IB93587LPR,…","vp":"Vivotek Affected device model numbers are FD8365, FD8365v2, FD9165, FD9171, FD9187, FD9189, FD9365, FD9371, FD9381, FD9387, FD9389, FD9391,FE9180,FE9181, FE9191, FE9381, FE9382, FE9391, FE9582, IB9365, IB93587LPR, IB9371,IB9381, IB9387, IB9389, IB939,IP9165,IP9171, IP9172, IP9181, IP9191, IT9389, MA9321, MA9322, MS9321, MS9390, TB9330","t":"Legacy Vivotek Camera Firmware Command Injection in upload_map.cgi","p":1768317173126},"CVE-2026-100291":{"s":9.8,"v":"CRITICAL","x":"In Anjvision YSSD‑RTMP‑H5 firmware version 3.3.2.4, several ONVIF service endpoints process management requests without enforcing required authentication. This could allow an unauthorized attacker to access sensitive device operations.","vp":"Anjvision YSSD-RTMP-H5","t":"Initialization of a resource with an insecure default in Anjvision YSSD-RTMP-H5","p":1790710463631},"CVE-2026-100292":{"s":8.8,"v":"HIGH","x":"In Anjvision YSSD‑RTMP‑H5 firmware version 3.3.2.4, a hidden debug interface can be enabled through an authenticated request, allowing additional commands to be sent to a backend service. Once active, this pathway can unintentionally expose system‑level functionality that could be misused if crafted inputs reach the…","vp":"Anjvision YSSD-RTMP-H5","t":"Improper neutralization of special elements used in an OS command ('OS command injection') in Anjvision YSSD-RTMP-H5","p":1790710535826},"CVE-2026-100293":{"s":8.8,"v":"HIGH","x":"In Anjvision YSSD‑RTMP‑H5 firmware version 3.3.2.4, both the local and cloud update mechanisms apply new firmware without any cryptographic verification, relying only on basic hashing. This design allows an attacker who can reach the update routine to introduce untrusted firmware images that the device will accept as…","vp":"Anjvision YSSD-RTMP-H5","t":"Improper verification of cryptographic signature in Anjvision YSSD-RTMP-H5","p":1790710633462},"CVE-2026-100294":{"s":7.5,"v":"HIGH","x":"In Anjvision YSSD‑RTMP‑H5 firmware version 3.3.2.4, the firmware embeds hardcoded cloud‑API credentials that are shared across deployed devices. Anyone obtaining the public firmware package can reuse these values to interact with the cloud service in ways not intended for normal operation.","vp":"Anjvision YSSD-RTMP-H5","t":"Use of Hard-coded Credentials in Anjvision YSSD-RTMP-H5","p":1790710812208},"CVE-2026-100295":{"s":6.3,"v":"MEDIUM","x":"In Anjvision YSSD‑RTMP‑H5 firmware version 3.3.2.4, an internal debug interface can be enabled through an undocumented pathway, exposing functions not intended for normal operation. When activated, this interface allows actions that could unintentionally provide elevated system access.","vp":"Anjvision YSSD-RTMP-H5","t":"Active debug code in Anjvision YSSD-RTMP-H5","p":1790711060461},"CVE-2026-100296":{"s":8.1,"v":"HIGH","x":"In Anjvision YSSD-RTMP-H5 firmware version 3.3.2.4, an empty-body POST to /setUserConfig, dispatched through the web server's SOAP-RPC handler, silently downgrades the administrator password to the default value and corrupts the in-memory authentication state until the device reloads. The handler does not verify the…","vp":"Anjvision YSSD-RTMP-H5","t":"Improper Check for Unusual or Exceptional Conditions in Anjvision YSSD-RTMP-H5","p":1790711195568},"CVE-2026-100297":{"s":5.3,"v":"MEDIUM","x":"In Anjvision YSSD‑RTMP‑H5 firmware version 3.3.2.4, an unauthenticated network check function can be triggered to probe arbitrary hosts from the device’s internal network. This may expose internal information or leak data via DNS queries.","vp":"Anjvision YSSD-RTMP-H5","t":"Server-Side request forgery (SSRF) in Anjvision YSSD-RTMP-H5","p":1790711322485},"CVE-2026-100298":{"s":8.8,"v":"HIGH","x":"In Anjvision YSSD‑RTMP‑H5 firmware version 3.3.2.4, two user‑information endpoints can reveal sensitive device and account details under conditions that are not intended for normal operation.","vp":"Anjvision YSSD-RTMP-H5","t":"Insufficiently Protected Credentials in Anjvision YSSD-RTMP-H5","p":1790711440036},"CVE-2026-100299":{"s":6.8,"v":"MEDIUM","x":"In Anjvision YSSD‑RTMP‑H5 firmware version 3.3.2.4, the device includes a legacy password hash on the serial console that relies on a weak DES‑based encryption.","vp":"Anjvision YSSD-RTMP-H5","t":"Use of Weak Credentials in Anjvision YSSD-RTMP-H5","p":1790711535385},"CVE-2026-94204":{"s":7.5,"v":"HIGH","x":"The central cloud storage backend for the entire dashcam platform is misconfigured with public-read permissions, allowing unrestricted access to all stored objects. Because this bucket serves as shared storage for the platform, sensitive user records, live dashcam footage, application packages, and firmware files are…","vp":"Viidure Dashcam Android Application","t":"Incorrect Permission Assignment for Critical Resource in Viidure Dashcam Android Application","p":1790714452681},"CVE-2026-96587":{"s":10,"v":"CRITICAL","x":"The Viidure Android application embeds permanent, plaintext cloud storage credentials within its compiled code. These credentials provide full access to critical platform storage, including the ability to read, modify, or delete operational files such as firmware and application binaries.","vp":"Viidure Dashcam Android Application","t":"Use of Hard-coded Credentials in Viidure Dashcam Android Application","p":1790714558270},"CVE-2026-71379":{"s":10,"v":"CRITICAL","x":"The file export endpoint allows any unauthenticated attacker to export arbitrary database tables by sending a crafted POST request.","vp":"Toptech Systems TMS7","t":"Toptech TMS7 and TopHAT Files or Directories Accessible to External Parties","p":1790717005412},"CVE-2026-70356":{"s":9.1,"v":"CRITICAL","x":"The TMS file upload endpoint fails to enforce server-side file type restrictions, allowing an attacker to upload and execute arbitrary PHP files on the web server.","vp":"Toptech Systems TMS7","t":"Toptech TMS7 and TopHAT Unrestricted Upload of File with Dangerous Type","p":1790717182603},"CVE-2026-72510":{"s":9,"v":"CRITICAL","x":"The \"supplier_no\" parameter used in the business allocation search feature is vulnerable to time-based blind SQL injection.","vp":"Toptech Systems TMS7","t":"Toptech TMS7 and TopHAT SQL Injection","p":1790717306762},"CVE-2026-63713":{"s":9,"v":"CRITICAL","x":"The \"search\" parameter in the view audit logs feature within the utilities section is susceptible to a time-based blind SQL injection vulnerability.","vp":"Toptech Systems TMS7","t":"Toptech TMS7 and TopHAT SQL Injection","p":1790717432531},"CVE-2026-68954":{"s":9,"v":"CRITICAL","x":"The \"pattern\" parameter used in search function in the home page of the TMS application is vulnerable to time-based blind SQL injection vulnerability.","vp":"Toptech Systems TMS7","t":"Toptech TMS7 and TopHAT SQL Injection","p":1790717525984},"CVE-2026-68068":{"s":9,"v":"CRITICAL","x":"The \"screenID\" parameter in the electronic transaction queue viewer feature within the manual transactions section is susceptible to a time-based blind SQL injection vulnerability.","vp":"Toptech Systems TMS7","t":"Toptech TMS7 and TopHAT SQL Injection","p":1790717627332},"CVE-2026-72507":{"s":9,"v":"CRITICAL","x":"The \"reportType\" parameter in the product summary report feature within the balancing reports section is susceptible to a time-based blind SQL injection vulnerability.","vp":"Toptech Systems TMS7","t":"Toptech TMS7 and TopHAT SQL Injection","p":1790717813928},"CVE-2026-71302":{"s":7.1,"v":"HIGH","x":"The application accepts user-supplied session identifiers and does not regenerate the session ID after authentication. This allows an attacker to predefine a session ID and reuse it after victim authentication, resulting in session takeover.","vp":"Toptech Systems TMS7","t":"Toptech TMS7 and TopHAT Session Fixation","p":1790718071253},"CVE-2026-69662":{"s":3.7,"v":"LOW","x":"The application uses unsafe functions that allow execution of inline scripts and string evaluation functions.","vp":"Toptech Systems TMS7","t":"Toptech TMS7 and TopHAT Eval Injection","p":1790718247903},"CVE-2026-71189":{"s":3.5,"v":"LOW","x":"An attacker can construct a request that, if issued by another application user, will cause JavaScript code supplied by the attacker to execute within the user's browser in the context of that user's session with the application.","vp":"Toptech Systems TMS7","t":"Toptech TMS7 and TopHAT Cross-site Scripting","p":1790718408138},"CVE-2026-84409":{"s":7.5,"v":"HIGH","x":"The device's update mechanism retrieves metadata for software updates over an unencrypted HTTP connection and stores portions of that metadata for later use. A management interface subsequently returns this stored value in a JSON response, and the web interface responsible for displaying update information inserts…","vp":"Lantronix G520 Series","t":"Lantronix G520 Series Cellular Gateway Cross-site Scripting","p":1790715729711},"CVE-2026-91191":{"s":7.5,"v":"HIGH","x":"The device's update mechanism includes conditions that allow unauthorized software packages to be accepted as authentic. During the boot process, the stock done function disables signature verification in the OPKG configuration before restoring optional packages from a writable, unsigned feed. Separately, the publicly…","vp":"Lantronix G520 Series","t":"Lantronix G520 Series Cellular Gateway Improper Verification of Cryptographic Signature","p":1790715892546},"CVE-2026-88773":{"s":10,"v":"CRITICAL","x":"Inconsistent interpretation of HTTP requests ('HTTP Request/Response smuggling') vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway.\n\nThis issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1-37.279 and NDcPP; Gateway: before 14.1-73.37 FIPS and before…","vp":"Citrix NetScaler ADC","t":"HTTP Request Smuggling","p":1790526008382},"CVE-2026-88774":{"s":7.2,"v":"HIGH","x":"Vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway.\n\nThis issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP; Gateway: before 14.1-73.37 and before 13.1-64.23 leading to a feature policy bypass due to improper HTTP URL based expression…","vp":"Citrix NetScaler ADC","t":"Feature policy bypass due to improper HTTP URL based expression usage","p":1790525642993},"CVE-2026-88775":{"s":9.8,"v":"CRITICAL","x":"Memory overflow vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway.\n\nThis issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP; Gateway: before 14.1-73.37 and before 13.1-64.23 leading Memory overflow vulnerability leading to…","vp":"Citrix NetScaler ADC","t":"Memory overflow vulnerability leading to unpredictable or erroneous behavior or Denial of Service","p":1790526072160},"CVE-2026-88776":{"s":9.8,"v":"CRITICAL","x":"Memory overflow vulnerability vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway.\nThis issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP; Gateway: before 14.1-73.37 and before 13.1-64.23  leading to unpredictable or erroneous behavior…","vp":"Citrix NetScaler ADC","t":"Memory overflow vulnerability leading to unpredictable or erroneous behavior or Denial of Service","p":1790527000034},"CVE-2026-88777":{"s":9.8,"v":"CRITICAL","x":"Memory overflow vulnerability vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway.\n\nThis issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP; Gateway: before 14.1-73.37 and before 13.1-64.23  leading to unpredictable or erroneous…","vp":"Citrix NetScaler ADC","t":"Memory overflow vulnerability leading to unpredictable or erroneous behavior or Denial of Service","p":1790527064345},"CVE-2026-88778":{"s":7.5,"v":"HIGH","x":"Predictable exact value from previous values vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway.\n\nThis issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP; Gateway: before 14.1-73.37 and before 13.1-64.23.","vp":"Citrix NetScaler ADC","t":"TCP Initial Sequence Number (ISN) prediction","p":1790527396503},"CVE-2026-19490":{"s":9.3,"v":"CRITICAL","x":"Vulnerability in NetScaler ADC and NetScaler Gateway.\n\nThis issue affects ADC: from 14.1 through 73.32 and from 13.1 through 63.21; Gateway: from 14.1 through 73.32 and from 13.1 through 63.21.","vp":"NetScaler ADC","t":"NetScaler ADC and NetScaler Gateway Security Bulletin for CVE-2026-19490","p":1787144079730},"CVE-2026-13742":{"s":5.9,"v":"MEDIUM","x":"Honeywell IQ MultiAccess, all versions prior to and including version 28, contain an improper digital signature verification vulnerability. An attacker could potentially exploit this vulnerability, leading to the replacement of downloaded file with a malicious one. Honeywell also recommends updating to the most recent…","vp":"Honeywell Technologies IQ MultiAccess","t":"Lack of signature verification before execution of downloaded content","p":1782746378949},"CVE-2026-35273":{"s":9.8,"v":"CRITICAL","x":"Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Updates Environment Management). Supported versions that are affected are 8.61 and 8.62. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise…","vp":"Oracle Corporation PeopleSoft Enterprise PeopleTools","t":"","p":1781144715375},"CVE-2026-28326":{"s":8.8,"v":"HIGH","x":"SolarWinds Access Rights Manager was reported to be affected by an unauthenticated remote code execution vulnerability. The issue stems from a hardcoded static key.","vp":"SolarWinds Access Rights Manager","t":"SolarWinds Access Rights Manager Unauthenticated Remote Code Execution Vulnerability","p":1789662631734},"CVE-2026-65660":{"s":8.8,"v":"HIGH","x":"Improper control of generation of code ('code injection') in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.","vp":"Microsoft Microsoft SharePoint Enterprise Server 2016","t":"Microsoft SharePoint Server Remote Code Execution Vulnerability","p":1786467895666},"CVE-2026-67279":{"s":6.9,"v":"MEDIUM","x":"RouterOS SSH enters the connection protocol after a client-requested rekey even though user authentication was never attempted, allowing an unauthenticated client to open a session channel and send an exec request. On affected builds the server dispatches the command, enabling unauthenticated creation, overwrite, and…","vp":"Mikrotik RouterOS","t":"SSH Pre-Authentication Rekey State Bypass in MikroTik RouterOS","p":1788638457894},"CVE-2026-87902":{"s":8.1,"v":"HIGH","x":"An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.php` file outside the active theme directories. If relevant pre-conditions for both the server and the active theme are met, this can lead to RCE.","vp":"WordPress WordPress","t":"","p":1790095455048},"CVE-2026-96883":{"s":8.8,"v":"HIGH","x":"pgcollection is an open source extension to PostgreSQL. A type confusion issue in AWS pgcollection 2.0.0 through 2.1.1 might allow an authenticated remote user to execute arbitrary code as the postgres operating system user via crafted SQL statements that rely on mismatched type metadata in collection value retrieval…","vp":"AWS pgcollection","t":"Type confusion in AWS pgcollection allows remote code execution","p":1790276749908},"CVE-2026-76439":{"s":5.3,"v":"MEDIUM","x":"A vulnerability in the endpoint posture status reporting functionality of the guest portal web application of Cisco ISE could allow an unauthenticated, remote attacker to submit forged posture status events into the endpoint posture pipeline.\r\n\r\nThis vulnerability is due to insufficient authentication on an internal…","vp":"Cisco Cisco Identity Services Engine Software","t":"Cisco Identity Services Engine Event Injection Vulnerability","p":1789589867616},"CVE-2026-76444":{"s":5.3,"v":"MEDIUM","x":"A vulnerability in an internal service of Cisco ISE and Cisco ISE-PIC could allow an unauthenticated, remote attacker to retrieve sensitive configuration information from an affected device.\r\n\r\nThis vulnerability is due to missing authentication on the Policy Runtime Repository Table (PRRT) service. An attacker could…","vp":"Cisco Cisco Identity Services Engine Software","t":"Cisco Identity Services Engine Information Disclosure Vulnerability","p":1789589952183},"CVE-2026-76446":{"s":4.9,"v":"MEDIUM","x":"A vulnerability in an API of Cisco ISE and Cisco ISE-PIC could allow an authenticated, remote attacker to read specific&nbsp;files on the underlying operating system of an affected device.\r\n\r\nThis vulnerability is due to improper restriction of XML external entity references. An attacker could exploit this…","vp":"Cisco Cisco Identity Services Engine Software","t":"Cisco Identity Services Engine External Entity Injection Vulnerability","p":1789590048577},"CVE-2026-76447":{"s":5.3,"v":"MEDIUM","x":"A vulnerability in the Online Certificate Status Protocol (OCSP) responder of Cisco ISE and Cisco ISE-PIC could allow an unauthenticated, remote attacker to cause an administrative reload of the OCSP responder certificate and key material.\r\n\r\nThis vulnerability is due to missing authentication on a function of the…","vp":"Cisco Cisco Identity Services Engine Software","t":"Cisco Identity Services Engine Certificate Reload Vulnerability","p":1789590282536},"CVE-2024-45519":{"s":10,"v":"CRITICAL","x":"The postjournal service in Zimbra Collaboration (ZCS) before 8.8.15 Patch 46, 9 before 9.0.0 Patch 41, 10 before 10.0.9, and 10.1 before 10.1.1 sometimes allows unauthenticated users to execute commands.","vp":"n/a n/a","t":"","p":1727827200000},"CVE-2026-5430":{"s":10,"v":"CRITICAL","x":"The JWT authentication mechanism accepts tokens signed with algorithms other than those explicitly configured or supported. This allows an attacker to craft a JWT with an unsupported algorithm, which is then incorrectly validated, leading to unauthorized access.\n\nSuccessful exploitation of this vulnerability may…","vp":"WSO2 WSO2 Universal Gateway","t":"Authentication Bypass via JWT Algorithm Mismatch in Multiple WSO2 Products Allows Account Takeover","p":1786001608156},"CVE-2026-71362":{"s":9.1,"v":"CRITICAL","x":"Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in privilege escalation. An attacker could leverage this vulnerability to gain elevated access to sensitive resources. Exploitation of this issue does not require user interaction.","vp":"Adobe Adobe Commerce","t":"Adobe Commerce | Incorrect Authorization (CWE-863)","p":1786470768311},"CVE-2026-84399":{"s":8.8,"v":"HIGH","x":"The Botslab G980H dash camera firmware contains an authorization vulnerability in its session based command functionality. The product does not sufficiently associate an authenticated session with the client connection that established it, and subsequent privileged operations rely on possession of a valid session…","vp":"Botslab G980H","t":"Botslab G980H Dashcams Incorrect Authorization","p":1790278067278},"CVE-2026-82566":{"s":8.8,"v":"HIGH","x":"The Botslab G980H dash camera firmware contains a session management vulnerability in which authentication state can remain valid after the associated client connection has been terminated or replaced. Under certain connection conditions, a newly established connection can displace an existing client while previously…","vp":"Botslab G980H","t":"Botslab G980H Dashcams Insufficient session expiration","p":1790278339662},"CVE-2026-85496":{"s":8.8,"v":"HIGH","x":"The Botslab G980H dash camera firmware generates session identifiers using a small sequential value space rather than a suitably unpredictable source. An unauthenticated attacker with adjacent network access and knowledge that an active session exists could potentially determine a valid session identifier and use it…","vp":"Botslab G980H","t":"Botslab G980H Dashcams Generation of Predictable Numbers or Identifiers","p":1790279253970},"CVE-2026-77967":{"s":8.1,"v":"HIGH","x":"The Botslab G980H dash camera firmware accepts a reusable authentication value without adequately verifying its freshness or association with the requesting client. An unauthenticated attacker with adjacent network access who captures a valid authentication value could replay it from another client to establish an…","vp":"Botslab G980H","t":"Botslab G980H Dashcams Authentication Bypass by Capture-replay","p":1790279487318},"CVE-2026-88761":{"s":5.3,"v":"MEDIUM","x":"The Botslab G980H dash camera firmware generates the default WiFi password using predictable device information, portions of which are advertised by the product. An unauthenticated attacker within WiFi range could potentially determine the remaining password characters through limited guessing and gain unauthorized…","vp":"Botslab G980H","t":"Botslab G980H Dashcams Use of Weak Credentials","p":1790279734395},"CVE-2026-82716":{"s":4.6,"v":"MEDIUM","x":"The Botslab G980H dash camera firmware includes sensitive configuration information, including WiFi credentials, in diagnostic logs generated during the support process. These logs remain accessible on removable storage after the support operation has completed. An unauthenticated attacker with physical access to the…","vp":"Botslab G980H","t":"Botslab G980H Dashcams Insertion of Sensitive Information into Log File","p":1790280177856},"CVE-2026-84403":{"s":6.2,"v":"MEDIUM","x":"The Botslab G980H dash camera firmware does not require authenticated pairing or client binding before permitting access to Bluetooth Low Energy communications and GATT characteristics. An unauthenticated attacker within Bluetooth range could intercept or directly retrieve sensitive device information, including…","vp":"Botslab G980H","t":"Botslab G980H Dashcams Missing Authentication for Critical Function","p":1790280450444},"CVE-2026-75558":{"s":5.3,"v":"MEDIUM","x":"The Botslab G980H dash camera firmware uses a hard-coded cryptographic key and initialization vector to protect WiFi credentials communicated by the device. An attacker who obtains the protected credential and extracts the cryptographic material from the firmware could recover the WiFi password and gain unauthorized…","vp":"Botslab G980H","t":"Botslab G980H Dashcams Use of Hard-coded Cryptographic Key","p":1790280679170},"CVE-2026-81630":{"s":8.1,"v":"HIGH","x":"The Botslab G980H dash camera firmware does not adequately verify the authenticity of firmware updates. The update process retrieves firmware through an unprotected connection and relies on an integrity value supplied with the firmware instead of a trusted cryptographic signature. A suitably positioned attacker who…","vp":"Botslab G980H","t":"Botslab G980H Dashcams Insufficient Verification of Data Authenticity","p":1790280882513},"CVE-2026-87118":{"s":5.7,"v":"MEDIUM","x":"The Botslab G980H dash camera firmware contains an out of bounds write vulnerability in its command processing functionality. An authenticated attacker with adjacent network access could submit crafted command data that corrupts memory, potentially disrupting authentication state or causing the affected process to…","vp":"Botslab G980H","t":"Botslab G980H Dashcams Out-of-bounds Write","p":1790281069712},"CVE-2026-82708":{"s":6.5,"v":"MEDIUM","x":"The Botslab G980H dash camera firmware contains a path traversal vulnerability in its HTTP server. An attacker with access to the device's WiFi network could submit a crafted request to access files within the device's removable storage that were not intended to be directly accessible through the web server. Exposed…","vp":"Botslab G980H","t":"Botslab G980H Dashcams Improper Limitation of a Pathname to a Restricted Directory","p":1790281295165},"CVE-2026-79959":{"s":6.8,"v":"MEDIUM","x":"The Botslab G980H dash camera firmware contains a hard-coded root account password that cannot be changed by the user. An attacker who obtains the firmware or has physical access to the device could recover the credential and use it to obtain root access through the UART interface.","vp":"Botslab G980H","t":"Botslab G980H Dashcams Use of Hard-coded Credentials","p":1790281502973},"CVE-2026-82585":{"s":6.5,"v":"MEDIUM","x":"The Botslab G980H dash camera firmware transmits sensitive information over unencrypted HTTP and RTSP connections. An attacker capable of intercepting communications on the device's WiFi network could obtain stored recordings, live video, location information, images, diagnostic logs, or other sensitive information…","vp":"Botslab G980H","t":"Botslab G980H Dashcams Cleartext Transmission of Sensitive Information","p":1790281727491},"CVE-2026-88956":{"s":6.8,"v":"MEDIUM","x":"The Botslab G980H dash camera firmware contains an authentication vulnerability in the root account exposed through the device's UART interface. The affected account does not require a password before granting access to a privileged system interface, and the interface also displays the device's WiFi password during…","vp":"Botslab G980H","t":"Botslab G980H Dashcams Missing Authentication for Critical Function","p":1790279990348},"CVE-2026-93289":{"s":7.5,"v":"HIGH","x":"The affected products are vulnerable to command injection attack that could allow an unauthenticated attacker to execute system commands during the pairing process.","vp":"Eufy Omni C20","t":"OS command injection in Eufy Omni C20, Omni X10 Pro","p":1790277880244},"CVE-2026-93290":{"s":5.5,"v":"MEDIUM","x":"Omni C20 uses hard-coded credentials that could allow an attacker to monitor log files to obtain credentials to access information like mapping data.","vp":"Eufy Omni C20","t":"Use of Hard-coded Credentials in Eufy Omni C20","p":1790277996445},"CVE-2026-93291":{"s":9.4,"v":"CRITICAL","x":"Omni C20 lacks proper certificate validation which could allow an attacker to perform a man-in-the-middle attack which could allow them to execute arbitrary code.","vp":"Eufy Omni C20","t":"Improper certificate validation in Eufy Omni C20","p":1790278074311},"CVE-2026-7891":{"x":"","vp":"","t":"","p":1778188042206},"CVE-2026-13795":{"s":6.5,"v":"MEDIUM","x":"Insufficient policy enforcement in Chrome for iOS in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. (Chromium security severity: High)","vp":"Google Chrome","t":"","p":1782859055817},"CVE-2024-0244":{"s":9.8,"v":"CRITICAL","x":"Buffer overflow in CPCA PCFAX number process of Office Multifunction Printers and Laser Printers(*) which may allow an attacker on the network segment to trigger the affected product being unresponsive or to execute arbitrary code.*:Satera MF750C Series firmware v03.07 and earlier sold in Japan. Color imageCLASS…","vp":"Canon Inc. Satera MF750C Series","t":"","p":1707179043211},"CVE-2025-39682":{"s":9.8,"v":"CRITICAL","x":"In the Linux kernel, the following vulnerability has been resolved:\n\ntls: fix handling of zero-length records on the rx_list\n\nEach recvmsg() call must process either\n - only contiguous DATA records (any number of them)\n - one non-DATA record\n\nIf the next record has different type than what has already been\nprocessed…","vp":"Linux Linux","t":"tls: fix handling of zero-length records on the rx_list","p":1757092848657},"CVE-2026-53266":{"s":8.8,"v":"HIGH","x":"In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: bridge: make ebt_snat ARP rewrite writable\n\nThe ebtables SNAT target keeps the Ethernet source address rewrite\nbehind skb_ensure_writable(skb, 0).  This is intentional: at the bridge\nebtables hooks the Ethernet header is addressed through…","vp":"Linux Linux","t":"netfilter: bridge: make ebt_snat ARP rewrite writable","p":1782376793190},"CVE-2025-39964":{"s":7.8,"v":"HIGH","x":"In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: af_alg - Disallow concurrent writes in af_alg_sendmsg\n\nIssuing two writes to the same af_alg socket is bogus as the\ndata will be interleaved in an unpredictable fashion.  Furthermore,\nconcurrent writes may create inconsistencies in the…","vp":"Linux Linux","t":"crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg","p":1760363310334},"CVE-2026-94127":{"s":9.8,"v":"CRITICAL","x":"When a BIG-IP APM access policy and an OAuth profile are configured on a virtual server, specific malicious traffic can lead to remote code execution (RCE). This vulnerability is only present when BIG-IP APM is configured as an OAuth Authorization Server. Deployments using APM strictly as an OAuth Client / Resource…","vp":"F5 BIG-IP","t":"BIG-IP APM OAuth vulnerability","p":1790086662730},"CVE-2026-92202":{},"CVE-2026-96417":{"s":5.5,"v":"MEDIUM","x":"RF4CE protocol dissector crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service","vp":"Wireshark Foundation Wireshark","t":"Heap-based Buffer Overflow in Wireshark","p":1790674258021},"CVE-2026-91818":{"s":7.8,"v":"HIGH","x":"A use-after-free vulnerability exists in Foxit PDF Editor/Reader’s JavaScript handling of PDF annotations. Reentrant page-event processing during annotation enumeration may release the associated page object, which is subsequently accessed, resulting in an application crash.","vp":"Foxit Software Inc. Foxit PDF Editor","t":"Foxit PDF Editor/Reader Annotation Use-After-Free Remote Code Execution Vulnerability","p":1790149751564},"CVE-2026-91817":{"s":6.1,"v":"MEDIUM","x":"A heap-based out-of-bounds read vulnerability exists in Foxit PDF Editor/Reader’s handling of wide strings in embedded PDF JavaScript. Insufficient validation of string-deletion ranges can cause an integer underflow, resulting in an out-of-bounds read and application crash.","vp":"Foxit Software Inc. Foxit PDF Editor","t":"Foxit PDF Editor/Reader AcroForm Out-of-Bounds Read Remote Code Execution Vulnerability","p":1790149755176},"CVE-2026-91816":{"s":7.8,"v":"HIGH","x":"A use-after-free vulnerability exists in Foxit PDF Editor/Reader’s handling of PDF annotations. Reentrant annotation deletion triggered by embedded JavaScript can cause the application to access an annotation object after it has been released, resulting in a use-after-free condition and application crash.","vp":"Foxit Software Inc. Foxit PDF Editor","t":"Foxit PDF Editor/Reader AcroForm Use-After-Free Remote Code Execution Vulnerability","p":1790149758608},"CVE-2026-91815":{"s":7.8,"v":"HIGH","x":"Foxit PDF Editor/Reader does not perform sufficient verification of the JPEG2000 image metadata in the PDF file, which leads to out-of-bounds write in the heap buffer during decoding, potentially causing the program to crash and introducing the risk of arbitrary code execution.","vp":"Foxit Software Inc. Foxit PDF Editor","t":"Foxit PDF Editor/Reader JPEG2000 Parsing Memory Corruption Remote Code Execution Vulnerability","p":1790149771304},"CVE-2026-91813":{"s":8.8,"v":"HIGH","x":"A vulnerability in Foxit PDF Editor/Reader’s update mechanism allows an update package to be replaced between download and high-privilege extraction due to insufficient file locking and integrity validation. This could enable local attackers to execute arbitrary code with elevated privileges.","vp":"Foxit Software Inc. Foxit PDF Editor","t":"Foxit PDF Editor/Reader FoxitUpdater Race Condition Local Privilege Escalation Vulnerability","p":1790149777376},"CVE-2026-91812":{"s":7.9,"v":"HIGH","x":"A vulnerability in Foxit PDF Editor/Reader’s update mechanism allows man-in-the-middle attackers to bypass certificate validation and package integrity checks, potentially enabling arbitrary code execution with system privileges.","vp":"Foxit Software Inc. Foxit PDF Editor","t":"Foxit PDF Editor/Reader FoxitUpdater Improper Certificate Validation Local Privilege Escalation Vulnerability","p":1790149791179},"CVE-2026-91811":{"s":7.8,"v":"HIGH","x":"A heap-based out-of-bounds write vulnerability exists in Foxit PDF Editor/Reader’s PRC parser due to insufficient validation of vertex indices in triangular fan texture meshes. Successful exploitation could result in memory corruption and an application crash.","vp":"Foxit Software Inc. Foxit PDF Editor","t":"Foxit PDF Editor/Reader PRC Stream Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability","p":1790149798872},"CVE-2026-91810":{"s":6.1,"v":"MEDIUM","x":"A heap-based out-of-bounds read vulnerability exists in Foxit PDF Editor/Reader’s handling of malformed PDF image masks. Inconsistent image metadata may cause incorrect alpha-channel processing during rendering, resulting in an out-of-bounds read and application crash.","vp":"Foxit Software Inc. Foxit PDF Editor","t":"Foxit PDF Editor/Reader Doc Object Out-Of-Bounds Read Information Disclosure Vulnerability","p":1790149802747},"CVE-2026-91809":{"s":7.8,"v":"HIGH","x":"A use-after-free vulnerability exists in Foxit PDF Editor/Reader’s handling of malformed PDF form fields. Improper validation during field-name traversal may cause the application to access a released object, resulting in an application crash.","vp":"Foxit Software Inc. Foxit PDF Editor","t":"Foxit PDF Editor/Reader Annotation Use-After-Free Information Disclosure Vulnerability","p":1790149746201},"CVE-2026-91808":{"s":6.1,"v":"MEDIUM","x":"A heap-based out-of-bounds read vulnerability exists in Foxit PDF Editor Reader’s handling of PDF image objects with inconsistent compression metadata. Insufficient validation during image decoding may result in an undersized buffer and an out-of-bounds read during rendering, causing an application crash.","vp":"Foxit Software Inc. Foxit PDF Editor","t":"Foxit PDF Editor/Reader JPEG File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability","p":1790149808809},"CVE-2026-91807":{"s":6.1,"v":"MEDIUM","x":"A heap-based out-of-bounds read vulnerability exists in Foxit PDF Editor/Reader’s handling of malformed image soft-mask data. Insufficient validation of the soft-mask data attribute during image parsing may cause an arithmetic underflow, resulting in an out-of-bounds read and application crash.","vp":"Foxit Software Inc. Foxit PDF Editor","t":"Foxit PDF Editor/Reader PDF File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability","p":1790149824382},"CVE-2026-91806":{"s":7.8,"v":"HIGH","x":"A use-after-free vulnerability exists in Foxit PDF Editor/Reader’s handling of PDF form fields. Embedded JavaScript may access form-field references after the corresponding fields have been released, resulting in an application crash.","vp":"Foxit Software Inc. Foxit PDF Editor","t":"Foxit PDF Editor/Reader Doc Object Use-After-Free Information Disclosure Vulnerability","p":1790149829071},"CVE-2026-91801":{"s":7.8,"v":"HIGH","x":"A path traversal vulnerability exists in Foxit PDF Editor/Reader's handling of embedded PDF resources. Insufficient validation of resource file paths may allow files to be written outside their intended locations, potentially enabling arbitrary code execution.","vp":"Foxit Software Inc. Foxit PDF Editor","t":"Foxit PDF Editor/Reader RichMedia Annotation Directory Traversal Remote Code Execution Vulnerability","p":1790149842535},"CVE-2026-91797":{"s":7.8,"v":"HIGH","x":"Foxit PDF Editor/Reader failed to validate the directory traversal path in the attachment file name, resulting in malicious attachments being able to be written to directories outside the expected secure area when the PDF is opened.","vp":"Foxit Software Inc. Foxit PDF Editor","t":"Foxit PDF Editor/Reader Portfolio Directory Traversal Remote Code Execution Vulnerability","p":1790149859659},"CVE-2026-91796":{"s":6.1,"v":"MEDIUM","x":"The interface of Foxit PDF Editor/Reader lacks the permission verification for secure reading mode, which allows specially crafted PDFs to trigger external SMB authentication without any security prompts and thereby leak the hash of the user's credentials.","vp":"Foxit Software Inc. Foxit PDF Editor","t":"Foxit PDF Editor/Reader importIcon NTLM Response Information Disclosure Vulnerability","p":1790149862709},"CVE-2026-91795":{"s":7.8,"v":"HIGH","x":"Foxit PDF Editor/Reader's FileOpen plugin did not adequately validate certain encryption metadata in specially crafted PDF files. This could leave an internal pointer in an invalid state, resulting in chained read and write access violations and potentially enabling arbitrary code execution.","vp":"Foxit Software Inc. Foxit PDF Editor","t":"Foxit PDF Editor/Reader FileOpen Uninitialized Variable Remote Code Execution Vulnerability","p":1790149866870},"CVE-2026-91794":{"s":7.8,"v":"HIGH","x":"An out-of-bounds write vulnerability exists in the PDF rendering process of Foxit PDF Editor/Reader due to insufficient consistency and boundary validation when processing malformed color space data, which may cause the program to crash and potentially lead to remote code execution.","vp":"Foxit Software Inc. Foxit PDF Editor","t":"Foxit PDF Editor/Reader DeviceN Colorspace Out-Of-Bounds Write Remote Code Execution Vulnerability","p":1790149871417},"CVE-2026-91793":{"s":7.8,"v":"HIGH","x":"When opening a specially crafted PDF, Foxit PDF Editor/Reader executes scripts that modify annotation rich-text attributes containing malformed font data. During subsequent annotation appearance reconstruction, it accesses an object after it has been released, resulting in a use-after-free condition and an application…","vp":"Foxit Software Inc. Foxit PDF Editor","t":"Foxit PDF Editor/Reader Doc Object Use-After-Free Information Disclosure Vulnerability","p":1790149876346},"CVE-2026-57238":{"s":7.8,"v":"HIGH","x":"After the application opened the PDF, JavaScript deleted the form field object. Subsequently, it attempted to access the invalid object, which caused the application to crash.","vp":"Foxit Software Inc. Foxit PDF Editor","t":"Foxit PDF Editor/Reader Annotation Use-After-Free Remote Code Execution Vulnerability","p":1783496188457},"CVE-2026-13128":{"s":7.8,"v":"HIGH","x":"Embedding JavaScript within a PDF file will cause the page to be deleted. Subsequent scripts will continue to access the relevant properties of the document view, eventually leading to the crash of the application.","vp":"Foxit Software Inc. Foxit PDF Editor","t":"Foxit PDF Editor/Reader Doc Object Use-After-Free Remote Code Execution Vulnerability","p":1783496194775},"CVE-2026-13129":{"s":7.8,"v":"HIGH","x":"When the application opens a PDF file, JavaScript uses the damaged field tree to trigger field traversal, resulting in the program holding an invalid form object when accessing the field property path. Eventually, the application crashes due to reading an invalid pointer.","vp":"Foxit Software Inc. Foxit PDF Editor","t":"Foxit PDF Editor/Reader Annotation Use-After-Free Remote Code Execution Vulnerability","p":1783496190034},"CVE-2026-91799":{"s":7.8,"v":"HIGH","x":"A use-after-free vulnerability exists in Foxit PDF Editor/Reader’s handling of JavaScript array objects. A specially crafted PDF may cause the application to access a released object during array processing, potentially resulting in application crashes or arbitrary code execution.","vp":"Foxit Software Inc. Foxit PDF Editor","t":"Foxit Editor/Reader Array resetForm Use-After-Free Vulnerability","p":1790149856187},"CVE-2026-94450":{"s":7.5,"v":"HIGH","x":"Improper validation of the Destination Connection ID length in s2n-quic 1.88.0 and earlier may allow an unauthenticated remote user to cause a denial of service by shutting down a server endpoint via a single crafted UDP datagram. Only server endpoints specifically configured to send Retry packets are affected.\n\n\n\nTo…","vp":"AWS s2n-quic","t":"Potential denial of service when configured to send Retry packets in s2n-quic","p":1790107484360},"CVE-2026-11400":{"s":8,"v":"HIGH","x":"An untrusted search path issue in the GlobalDatabasePlugin in the AWS Advanced JDBC Wrapper for Amazon Aurora PostgreSQL will allow a remote authenticated low-privilege actor to escalate privileges to those of another Amazon RDS user, including rds_superuser, via a crafted function created by the actor that runs when…","vp":"AWS AWS Advanced JDBC Wrapper","t":"Privilege Escalation in AWS Advanced JDBC Wrapper for Amazon Aurora PostgreSQL","p":1780686422459},"CVE-2026-11401":{"s":8,"v":"HIGH","x":"An untrusted search path issue in the GlobalDatabasePlugin in the AWS Advanced Go Wrapper for Amazon Aurora PostgreSQL will allow a remote authenticated low-privilege actor to escalate privileges to those of another Amazon RDS user, including rds_superuser, via a crafted function created by the actor that runs when…","vp":"AWS AWS Advanced Go Wrapper","t":"Privilege Escalation in AWS Advanced Go Wrapper for Amazon Aurora PostgreSQL","p":1780686476341},"CVE-2026-8686":{"s":7.5,"v":"HIGH","x":"Missing bounds validation in the MQTT v5.0 property parser in coreMQTT before 5.0.1 allows an MQTT broker to cause a denial of service by sending a crafted packet.\n\n\n\nTo remediate this issue, users should upgrade to v5.0.1.","vp":"FreeRTOS coreMQTT","t":"DoS from MQTT v5.0 Deserialization Fault in core MQTT","p":1778870290651},"CVE-2026-11931":{"s":5.5,"v":"MEDIUM","x":"Incorrect default permissions in Kiro IDE on macOS and Linux before version 0.11.133 could expose the authentication token cache file to other local users or processes via world-readable permissions (0644) instead of owner-restricted permissions (0600).\n\n\n\nTo remediate this issue, users should upgrade to Kiro IDE…","vp":"AWS Kiro IDE","t":"Insecure Permissions on Authentication Token Cache File in Kiro IDE","p":1781548407898},"CVE-2026-12957":{"s":7.8,"v":"HIGH","x":"Improper trust boundary enforcement in Language Servers for AWS before version 1.65.0 on all supported platforms may allow a for arbitrary code execution. If a local user opens a maliciously crafted workspace, any commands within the project configuration files may be automatically executed. This issue requires the…","vp":"Amazon Web Services Language Servers for AWS","t":"Arbitrary Code Execution in Language Servers for AWS","p":1782230573516},"CVE-2026-12958":{"s":7.8,"v":"HIGH","x":"Missing symlink validation in Language Servers for AWS may allow an arbitrary file write outside of the workspace trust boundary. This may occur when a local user opens a workspace with a maliciously crafted symlink that resolves to a file path outside the workspace trust boundary.\n\n\n\nTo remediate this issue, users…","vp":"Amazon Web Services Language Servers for AWS","t":"Arbitrary file write in Language Servers for AWS","p":1782230581746},"CVE-2026-14265":{"s":7.5,"v":"HIGH","x":"Deserialization of untrusted data in the RemoteQueryCachePlugin in Amazon Web Services AWS Advanced JDBC Wrapper 3.3.0 through 4.0.0 might allow an actor with write access to the shared cache infrastructure to execute arbitrary code on application servers that read cached query results via a crafted serialized Java…","vp":"AWS AWS Advanced JDBC Wrapper","t":"RCE via Deserialization in AWS Advanced JDBC Wrapper","p":1782934442095},"CVE-2026-13760":{"s":7.3,"v":"HIGH","x":"OS command injection in the NodejsFunction Docker bundling pipeline (OsCommand helper) in AWS aws-cdk-lib on all platforms might allow a actor who controls dependency version strings in a project's package.json file to execute arbitrary commands on the host running the CDK toolchain via injected shell metacharacters…","vp":"AWS AWS CDK","t":"OS Command Injection in aws-cdk-lib Docker Bundling","p":1782932718671},"CVE-2026-14904":{"s":6.5,"v":"MEDIUM","x":"AWS Research and Engineering Studio (RES) is an open-source solution that enables researchers and engineers to create and manage secure virtual desktops and computing resources on AWS.\n\n\n\nImproper link resolution before file access issue (CWE-59) in the Auth.GetUserPrivateKey API. An authenticated remote user could…","vp":"AWS res","t":"RES Auth.GetUserPrivateKey Arbitrary File Read","p":1783442278362},"CVE-2026-15895":{"s":7.8,"v":"HIGH","x":"OS command injection in the npm package loading component in AWS jsii-diff before 1.131.0 might allow context-dependent attackers to execute arbitrary commands via crafted package specifiers passed to the npm: source argument.\n\n\n\nTo mitigate this issue, users should upgrade to jsii-diff v1.131.0 or later.","vp":"AWS jsii","t":"OS command injection in jsii-diff in AWS jsii","p":1784142330204},"CVE-2026-16796":{"s":7.3,"v":"HIGH","x":"Improper neutralization of argument delimiters in the install_packages() method in AWS Bedrock AgentCore Python SDK before 1.18.1 might allow a remote authenticated user to execute arbitrary commands within the Code Interpreter sandbox via crafted package name arguments.\n\n\n\nTo mitigate this issue, users should upgrade…","vp":"AWS bedrock-agentcore 1.18.1","t":"Improper neutralization of argument delimiters in AWS Bedrock AgentCore Python SDK install_packages()","p":1784837192908},"CVE-2026-12283":{"s":6.8,"v":"MEDIUM","x":"Amazon Athena is a serverless, interactive query service that lets you analyze data directly in Amazon S3 using standard SQL. Athena Query Federation is a feature that allows you to connect to data sources outside of Amazon S3 like DynamoDB, Azure Synapse, and custom connectors using standard SQL syntax.\n\n\n\nImproper…","vp":"AWS aws-athena-query-federation","t":"SQL injection in Amazon Athena Synapse connector","p":1784315104209},"CVE-2026-15957":{"s":7.5,"v":"HIGH","x":"Smithy-RS is a Rust code generation and runtime framework that generates HTTP clients and servers from Smithy interface definitions, powering the AWS SDK for Rust and custom service implementations.\n\n\n\nUncontrolled recursion in the JSON, CBOR, and XML deserializer functions emitted by Amazon smithy-rs code generation…","vp":"AWS aws-sdk-rust","t":"Uncontrolled recursion in smithy-rs generated JSON, CBOR, and XML deserializers allows unauthenticated remote denial of service via recursive shapes","p":1784662435409},"CVE-2026-16584":{"s":7,"v":"HIGH","x":"Improper handling of an initialization failure in AWS API MCP Server from 0.2.13 through 1.3.46 might allow an actor to bypass the user-configured security policy and execute AWS API operations that the policy was set to deny or gate. When initialization of the security policy enforcement data fails at server startup,…","vp":"AWS aws-api-mcp-server","t":"AWS API MCP Server Security Policy Bypass via Startup Failure","p":1784820851317},"CVE-2026-87121":{"s":9.8,"v":"CRITICAL","x":"lwIP TCP/IP Stack MQTT is vulnerable to an out-of-bounds write, which may allow an attacker to gain full code execution on the device.","vp":"lwIP TCP/IP Stack MQTT","t":"Out-of-bounds write in lwIP TCP/IP Stack MQTT Client Application","p":1790106505046},"CVE-2026-89207":{"s":6.5,"v":"MEDIUM","x":"A vulnerability has been identified in WTV676-HB6035 Web Interface (All versions < V3.94), WTV776-HB6035 Web Interface (All versions < V4.17). Affected devices do not properly validate input received from backend services.\r\nThis could allow an unauthenticated remote attacker to force the device into protection mode,…","vp":"Siemens WTV676-HB6035 Web Interface","t":"","p":1789545548075},"CVE-2026-85102":{"s":9.8,"v":"CRITICAL","x":"Improper certificate trust validation during VPN negotiation in Check Point Quantum Security Gateway may allow an unauthenticated remote attacker to execute arbitrary code on the Gateway.","vp":"checkpoint Quantum Security Gateway","t":"Improper Certificate Validation in Quantum Security Gateway","p":1788958831206},"CVE-2026-93952":{"s":10,"v":"CRITICAL","x":"VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator.…","vp":"Arista Networks VeloCloud Orchestrator (VCO) On-Prem","t":"Security Advisory 0183","p":1790062644300},"CVE-2026-67367":{"s":8.6,"v":"HIGH","x":"A vulnerability has been identified in SIMOVE Fleetmanager V3.1 (All versions < V3.1.13), SIMOVE Fleetmanager V3.2 (All versions < V3.2.4), SIMOVE Fleetmanager V3.3 (All versions < V3.3.2), SIMOVE Fleetmanager V4.0 (All versions < V4.0.1), SIPLANT V1.7 (All versions), SIPLANT V2.2 (All versions), SIPLANT V3.0 (All…","vp":"Siemens SIMOVE Fleetmanager V3.1","t":"","p":1788855096311},"CVE-2026-34223":{"s":8.2,"v":"HIGH","x":"A vulnerability has been identified in Desigo CC ClickOnce Client V6 (All versions), Desigo CC ClickOnce Client V7 (All versions), Desigo CC family V8 (All versions), Desigo CC family V9 (All versions), Desigo CC Flex Client V6 (All versions), Desigo CC Flex Client V7 (All versions), Desigo CC Installed Client V6 (All…","vp":"Siemens Desigo CC ClickOnce Client V6","t":"","p":1788855077139},"CVE-2026-50093":{"s":9,"v":"CRITICAL","x":"A vulnerability has been identified in Siveillance Control Pro V3.0 (All versions < V3.0.12.2173), Siveillance Control Pro V4.0 (All versions < V4.0.9.2178), Siveillance Control V3.0 (All versions < V3.0.22.2177), Siveillance Control V4.0 (All versions < V4.0.11.2177). A vulnerability in the OIS web module allows an…","vp":"Siemens Siveillance Control Pro V3.0","t":"","p":1788855078207},"CVE-2026-18963":{"s":9.1,"v":"CRITICAL","x":"A flaw was found in the reset-credentials flow of the keycloak-services component, which is the core engine for identity and access management in Red Hat Build of Keycloak. The issue allows an unauthenticated attacker to force the password reset process for any user without needing to click the required email…","vp":"Red Hat Red Hat build of Keycloak 26.4","t":"Keycloak-services: keycloak-services: unauthenticated account takeover via reset-credentials flow bypass","p":1787072707478},"CVE-2026-91018":{"s":8.8,"v":"HIGH","x":"lwIP (Lightweight IP) has a double free vulnerability, which could crash the system, cause a DoS, memory corruption, or allow code execution on the victim system.","vp":"lwIP lwIP API","t":"Double Free in lwIP (lightweight IP)","p":1790108733530},"CVE-2026-88020":{"s":6.1,"v":"MEDIUM","x":"Autonomy Logic OpenPLC 3 is susceptible to an improper neutralization of input during web page generation vulnerability when the web interface attempts to route the program based on a query string parameter with no encoding.","vp":"Autonomy Logic OpenPLC Runtime","t":"Improper Neutralization of Input During Web Page Generation in OpenPLC Runtime v3","p":1790109626449},"CVE-2026-85046":{"s":8.8,"v":"HIGH","x":"Type confusion in V8 in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)","vp":"Google Chrome","t":"","p":1788463572609},"CVE-2026-87491":{"s":8.8,"v":"HIGH","x":"Out of bounds write in V8 in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)","vp":"Google Chrome","t":"","p":1788912578419},"CVE-2026-7273":{"s":8.8,"v":"HIGH","x":"A stack-based buffer overflow vulnerability in the CGI program of Zyxel GS1900-48HPv2 firmware versions through 2.90(ABTQ.1)C0 could allow a LAN-based, unauthenticated attacker to exploit the flaw and potentially execute OS commands via a crafted HTTP request.","vp":"Zyxel GS1900-48HPv2 firmware","t":"","p":1781576429847},"CVE-2026-66804":{"s":7.8,"v":"HIGH","x":"Improper access control in Windows Cross Device Service allows an authorized attacker to elevate privileges locally.","vp":"Microsoft Windows 10 Version 22H2","t":"Microsoft Windows Cross Device Service Elevation of Privilege Vulnerability","p":1786467936051},"CVE-2026-50343":{"s":7.8,"v":"HIGH","x":"Improper privilege management in Microsoft Install Service allows an authorized attacker to elevate privileges locally.","vp":"Microsoft Windows 10 Version 1809","t":"Microsoft Install Service Elevation of Privilege Vulnerability","p":1784048795076},"CVE-2026-58704":{"s":8.8,"v":"HIGH","x":"In Cellular Modem, there is a possible permission bypass due to a logic error in the code. This could lead to remote (proximal/adjacent) escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","vp":"Google Android","t":"","p":1789497277966},"CVE-2026-76460":{"s":10,"v":"CRITICAL","x":"A vulnerability in an API of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to bypass authentication.\r\n\r\nThis vulnerability is due to insufficient authentication control on an API endpoint. An attacker could exploit this vulnerability by sending a crafted request to an affected…","vp":"Cisco Cisco Identity Services Engine Software","t":"Cisco Identity Services Engine Authentication Bypass Vulnerability","p":1789589522131},"CVE-2026-87886":{"s":7.8,"v":"HIGH","x":"Local privilege escalation due to insecure file permissions. The following products are affected: Acronis Backup plugin for cPanel & WHM (Linux) before build 1.9.3.1021, Acronis Backup extension for Plesk (Linux) before build 1.8.11.638, Acronis Backup plugin for DirectAdmin (Linux) before build 1.2.3.238.","vp":"Acronis Acronis Backup plugin for cPanel & WHM","t":"","p":1789685838089},"CVE-2026-76461":{"s":9.8,"v":"CRITICAL","x":"A vulnerability in the email parsing of Cisco AsyncOS Software for Cisco Secure Email Gateway could allow an unauthenticated, remote attacker to execute arbitrary commands with root privileges on the underlying operating system.\r\n\r\nThis vulnerability is due to insufficient validation in the email parsing logic. An…","vp":"Cisco Cisco Secure Email","t":"Cisco Secure Email Gateway SQL Injection Vulnerability","p":1789402147839},"CVE-2026-84869":{"s":9.9,"v":"CRITICAL","x":"A condition in the ScreenConnect client may allow files to be transferred and executed through an active remote session without authorization or Host confirmation in certain circumstances. ScreenConnect servers are not impacted.","vp":"ConnectWise ScreenConnect","t":"ScreenConnect Client: Guest-to-Host File Execution via File-Transfer Actions","p":1788895773630},"CVE-2026-42016":{"s":8.1,"v":"HIGH","x":"JFrog Artifactory (Self Hosted) versions before 7.133.11 are vulnerable to a privilege escalation attack due to a validation check of the token signature/issuer and not the token’s scope.","vp":"jfrog artifactory","t":"Incorrect authorization validation of user token in JFrog Artifactory allows Privilege Escalation","p":1785180056352},"CVE-2026-42018":{"s":7.5,"v":"HIGH","x":"JFrog Artifactory could return an internal anonymous-user token to an unauthenticated caller when anonymous access is disabled, potentially exposing sensitive resources.","vp":"jfrog artifactory","t":"Anonymous user token generation exposure in JFrog Artifactory","p":1786556601289},"CVE-2026-85706":{"s":10,"v":"CRITICAL","x":"GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.7 before 18.11.12, 19.0 before 19.0.9, 19.1 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that, under certain conditions, an unauthenticated user could have read arbitrary files from the GitLab server due to improper path…","vp":"GitLab GitLab","t":"Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in GitLab","p":1789181191624},"CVE-2026-86060":{"s":9.2,"v":"CRITICAL","x":"RouterOS contains an argument-handling flaw in the SSH login\npath involving usernames that begin with a prohibited character, allowing for the trusted RouterOS policy mask to be changed, leading to privilege escalation. Exploitation requires an unauthenticated SSH session to reach the RouterOS login helper.This issue…","vp":"Mikrotik RouterOS","t":"SSH session privilege manipulation via a crafted username in Mikrotik RouterOS","p":1788638459107},"CVE-2026-67277":{"s":8.8,"v":"HIGH","x":"RouterOS accepts a \"related\" btest connection before the corresponding primary session has completed authentication. An unauthenticated client can use this state to start an IPv4 UDP test. With \"random-data=false\", the sender transmits an uninitialized tail from a kernel packet buffer. A separate unchecked, inverted…","vp":"Mikrotik RouterOS","t":"Kernel memory disclosure and denial of service in MikroTik RouterOS btest service","p":1788638456614},"CVE-2025-25249":{"s":7.4,"v":"HIGH","x":"A heap-based buffer overflow vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, FortiOS 7.2.0 through 7.2.11, FortiOS 7.0.0 through 7.0.17, FortiOS 6.4 all versions, FortiSwitchManager 7.2.0 through 7.2.6, FortiSwitchManager 7.0.0 through 7.0.5 allows attacker to execute unauthorized…","vp":"Fortinet FortiSwitchManager","t":"","p":1768321955662},"CVE-2026-20079":{"s":10,"v":"CRITICAL","x":"A vulnerability in the web interface of Cisco Secure Firewall Management Center (FMC) Software could allow an unauthenticated, remote attacker to bypass authentication and execute script files on an affected device to obtain root access to the underlying operating system.&nbsp;\r\n\r\nThis vulnerability is due to an…","vp":"Cisco Cisco Secure Firewall Management Center (FMC)","t":"Cisco Secure Firewall Management Center Authentication Bypass Remote Code Execution Vulnerability","p":1772644655838},"CVE-2026-75650":{"s":10,"v":"CRITICAL","x":"Adobe Commerce is affected by an Improper Neutralization of Special Elements Used in a Template Engine vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user…","vp":"Adobe Adobe Commerce","t":"Adobe Commerce | Improper Neutralization of Special Elements Used in a Template Engine (CWE-1336)","p":1788812236761},"CVE-2026-86218":{"s":10,"v":"CRITICAL","x":"N-central is vulnerable to a pre-auth remote code execution This issue affects N-central: before 2026.3.1.14.","vp":"N-able N-central","t":"pre-authentication remote code execution","p":1788660928824},"CVE-2026-59822":{"s":8.8,"v":"HIGH","x":"LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to 1.84.0, LiteLLM's MCP Streamable HTTP endpoint allowed an unauthenticated attacker to use a fabricated Authorization header to trigger an OAuth2 passthrough fallback path that replaced failed LiteLLM key validation with an…","vp":"BerriAI litellm","t":"LiteLLM: MCP Authentication Bypass via OAuth2 Passthrough Fallback","p":1783539138611},"CVE-2026-48710":{"s":6.5,"v":"MEDIUM","x":"Starlette is a lightweight ASGI framework/toolkit. Prior to version 1.0.1, the HTTP `Host` request header was not validated before being used to reconstruct `request.url`. Because the routing algorithm relies on the raw HTTP path while `request.url` is rebuilt from the `Host` header, a malformed header could make…","vp":"Kludex starlette","t":"Starlette has missing Host header validation that poisons request.url.path, bypassing path-based security checks","p":1779832494393},"CVE-2026-49869":{"s":10,"v":"CRITICAL","x":"Kestra is an open-source, event-driven orchestration platform. Prior to 1.0.45 and 1.3.21, AuthenticationFilter in Kestra OSS uses request.getPath().endsWith(\"/configs\") to whitelist the public configuration endpoint from Basic Auth. Because the check is a suffix match rather than an exact path match, any API path…","vp":"kestra-io kestra","t":"Kestra: Unauthenticated Remote Code Execution via Authentication Bypass in `AuthenticationFilter`","p":1782507499576},"CVE-2026-82329":{"s":9.8,"v":"CRITICAL","x":"JFrog Artifactory contains an authentication weakness that, under default configuration, may allow an unauthenticated attacker with network access to obtain administrative privileges.","vp":"jfrog artifactory","t":"Potential authentication bypass leading to administrative access in Artifactory","p":1787941663632},"CVE-2026-9586":{"s":9.3,"v":"CRITICAL","x":"An unauthenticated SQL injection vulnerability exists in Sangoma Switchvox SMB Edition 8.3 (104997). The /pa endpoint processes XML content beginning with <PolycomIPPhone> and directly concatenates the user-controlled PhoneIP value into PostgreSQL queries without sanitization or parameterization. An unauthenticated…","vp":"Sangoma Switchvox SMB Edition","t":"Unauthenticated SQL Injection Leading to Remote Code Execution in Switchvox SMB","p":1784303862879},"CVE-2026-83548":{"s":10,"v":"CRITICAL","x":"A Pre-authentication SSRF vulnerability exists in the SMA1000 Appliance Work Place interface due to an unintended alternate access path. A remote unauthenticated attacker could potentially exploit this vulnerability to gain unauthorized access to sensitive functionality and perform unauthorized operations.","vp":"SonicWall SMA1000","t":"","p":1788297945368},"CVE-2026-83549":{"s":7.8,"v":"HIGH","x":"Post-authentication Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability has been identified in the SMA1000 Appliance Management Console (AMC) which in specific conditions could potentially enable a remote authenticated attacker as administrator to execute arbitrary…","vp":"SonicWall SMA1000","t":"","p":1788298130717},"CVE-2023-49105":{"s":9.8,"v":"CRITICAL","x":"An issue was discovered in ownCloud owncloud/core before 10.13.1. An attacker can access, modify, or delete any file without authentication if the username of a victim is known, and the victim has no signing-key configured. This occurs because pre-signed URLs can be accepted even when no signing-key is configured for…","vp":"n/a n/a","t":"","p":1700524800000},"CVE-2026-53362":{"s":7.8,"v":"HIGH","x":"In the Linux kernel, the following vulnerability has been resolved:\n\nipv6: account for fraggap on the paged allocation path\n\nIn __ip6_append_data(), when the paged-allocation branch is taken\n(MSG_MORE / NETIF_F_SG / large fraglen), alloclen and pagedlen are\ncomputed as\n\n\talloclen = fragheaderlen + transhdrlen;…","vp":"Linux Linux","t":"ipv6: account for fraggap on the paged allocation path","p":1783166195864},"CVE-2026-66384":{"s":5.3,"v":"MEDIUM","x":"An authenticated user may write data outside the intended Docker cache path under specific remote-repository conditions.","vp":"jfrog artifactory","t":"Authenticated users may write data outside the intended Docker cache path","p":1786547644906},"CVE-2021-23758":{"s":8.1,"v":"HIGH","x":"All versions of package ajaxpro.2 are vulnerable to Deserialization of Untrusted Data due to the possibility of deserialization of arbitrary .NET classes, which can be abused to gain remote code execution.","vp":"n/a AjaxPro.2","t":"Deserialization of Untrusted Data","p":1638561912932},"CVE-2015-3246":{"s":5.1,"v":"MEDIUM","x":"libuser before 0.56.13-8 and 0.60 before 0.60-7, as used in the userhelper program in the usermode package, directly modifies /etc/passwd, which allows local users to cause a denial of service (inconsistent file state) by causing an error during the modification. NOTE: this issue can be combined with CVE-2015-3245 to…","vp":"n/a n/a","t":"","p":1439301600000},"CVE-2015-5287":{"s":7.8,"v":"HIGH","x":"The abrt-hook-ccpp help program in Automatic Bug Reporting Tool (ABRT) before 2.7.1 allows local users with certain permissions to gain privileges via a symlink attack on a file with a predictable name, as demonstrated by /var/tmp/abrt/abrt-hax-coredump or /var/spool/abrt/abrt-hax-coredump.","vp":"n/a n/a","t":"","p":1449511200000},"CVE-2022-0995":{"s":7.8,"v":"HIGH","x":"An out-of-bounds (OOB) memory write flaw was found in the Linux kernel’s watch_queue event notification subsystem. This flaw can overwrite parts of the kernel state, potentially allowing a local user to gain privileged access or cause a denial of service on the system.","vp":"n/a kernel","t":"","p":1648231388000},"CVE-2026-8452":{"s":8.8,"v":"HIGH","x":"Memory overflow vulnerability NetScaler ADC and NetScaler Gateway leading to unpredictable or erroneous behavior and Denial of Service if the appliance is configured as a Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server","vp":"NetScaler ADC","t":"Memory overflow vulnerability leading to unpredictable or erroneous behavior and Denial of Service","p":1782823267622},"CVE-2019-1068":{"s":8.8,"v":"HIGH","x":"A remote code execution vulnerability exists in Microsoft SQL Server when it incorrectly handles processing of internal functions, aka 'Microsoft SQL Server Remote Code Execution Vulnerability'.","vp":"Microsoft Microsoft SQL Server 2014 Service Pack 2 for 32-bit Systems (GDR)","t":"","p":1563216980000},"CVE-2026-60004":{"s":9.8,"v":"CRITICAL","x":"Gitea before 1.27.1 allows remote code execution via the diffpatch API through Git hook installation.","vp":"Gitea Gitea","t":"","p":1787773500000},"CVE-2026-21962":{"s":10,"v":"CRITICAL","x":"Vulnerability in the Oracle HTTP Server, Oracle Weblogic Server Proxy Plug-in product of Oracle Fusion Middleware (component: Weblogic Server Proxy Plug-in for Apache HTTP Server, Weblogic Server Proxy Plug-in for IIS).  Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0 and  14.1.2.0.0. Easily…","vp":"Oracle Corporation Oracle HTTP Server, Oracle Weblogic Server Proxy Plug-in","t":"","p":1768946192665},"CVE-2026-72530":{"s":9,"v":"CRITICAL","x":"A remote unauthorized attacker with network access via port 4307/TCP to the TrueConf server versions 5.3.X to 5.3.9, 5.4.X to 5.4.9, 5.5.X to 5.5.5, and earlier could use a specially crafted script to break out of the isolated environment and execute arbitrary code on the host system.","vp":"TrueConf TrueConf Server","t":"","p":1787158613099},"CVE-2026-72529":{"s":9.8,"v":"CRITICAL","x":"A remote unauthorized attacker with network access via port 4307/TCP to the TrueConf server versions 5.3.X to 5.3.9, 5.4.X to 5.4.9, 5.5.X to 5.5.5, and earlier could execute an arbitrary script by calling an undocumented function.","vp":"TrueConf TrueConf Server","t":"","p":1787158514949},"CVE-2026-64849":{"s":9.3,"v":"CRITICAL","x":"MLflow is an open source AI engineering platform for agents, large language models, and machine learning models. Prior to 3.15.0, the unauthenticated POST /api/2.0/mlflow/webhooks/{id}/test endpoint calls _validate_webhook_url() in mlflow/utils/validation.py only for the original URL while mlflow/webhooks/delivery.py…","vp":"mlflow mlflow","t":"MLflow: Unauthenticated full-read SSRF in webhook delivery: _validate_webhook_url bypassed via unvalidated HTTP redirects (and DNS rebinding)","p":1787001370612},"CVE-2026-33824":{"s":9.8,"v":"CRITICAL","x":"Double free in Windows IKE Extension allows an unauthorized attacker to execute code over a network.","vp":"Microsoft Windows 10 Version 1607","t":"Windows Internet Key Exchange (IKE) Service Extensions Remote Code Execution Vulnerability","p":1776185925469},"CVE-2026-59310":{"s":9.8,"v":"CRITICAL","x":"VMware vCenter contains a directory traversal vulnerability in the Syslog server. A malicious actor with network access to vCenter may exploit this issue to execute arbitrary code.","vp":"VMware Cloud Foundation","t":"vCenter directory-traversal vulnerability","p":1785413965296},"CVE-2026-55040":{"s":9.1,"v":"CRITICAL","x":"Weak authentication in Microsoft Office SharePoint allows an unauthorized attacker to bypass a security feature over a network.","vp":"Microsoft Microsoft SharePoint Enterprise Server 2016","t":"Microsoft SharePoint Server Security Feature Bypass Vulnerability","p":1784048940641},"CVE-2026-65400":{"s":9.8,"v":"CRITICAL","x":"An authentication issue was addressed with improved state management. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.7.9, macOS Sonoma 14.8.9, macOS Tahoe 26.6.1, macOS Tahoe 26.7. An attacker on the network may be able to authenticate to Screen Sharing without valid credentials.","vp":"Apple macOS","t":"","p":1786040238263},"CVE-2025-62593":{"s":9.4,"v":"CRITICAL","x":"Ray is an AI compute engine. Prior to version 2.52.0, developers working with Ray as a development tool can be exploited via a critical RCE vulnerability exploitable via Firefox and Safari. This vulnerability is due to an insufficient guard against browser-based attacks, as the current defense uses the User-Agent…","vp":"ray-project ray","t":"Ray is vulnerable to RCE via Safari & Firefox Browsers through DNS Rebinding Attack","p":1764196108577},"CVE-2026-20349":{"s":8.6,"v":"HIGH","x":"A vulnerability in the Remote Access SSL VPN service for Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly, resulting in a denial of service (DoS)…","vp":"Cisco Cisco Secure Firewall Adaptive Security Appliance (ASA) Software","t":"Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software Remote Access SSL VPN Denial of Service Vulnerability","p":1786467963091},"CVE-2026-68820":{"s":7,"v":"HIGH","x":"Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.","vp":"Microsoft Windows 10 Version 1607","t":"Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability","p":1786467915930},"CVE-2026-72898":{"s":10,"v":"CRITICAL","x":"Metabase allows a remote, unauthenticated attacker to inject arbitrary SQL via the '/reset_password' database endpoint and gain administrator access to the connected Metabase instance.","vp":"Metabase Metabase","t":"Metabase SQL injection via password reset endpoint","p":1786384554841},"CVE-2026-8037":{"s":9.6,"v":"CRITICAL","x":"OS Command Injection Remote Code Execution Vulnerability in API in Progress ADC Products allows an un-authenticated attacker to execute arbitrary commands on the LoadMaster appliance by exploiting unsanitized input in multiple command endpoints","vp":"Progress Software LoadMaster","t":"OS Command Injection Remote Code Execution Vulnerability in Progress LoadMaster, ECS Connection Manager, Object Scale Connection Manager & MOVEit WAF","p":1780578825793},"CVE-2026-63077":{"s":9.8,"v":"CRITICAL","x":"In JetBrains TeamCity before 2026.1.3, 2025.11.7 unauthenticated remote code execution was possible via the agent polling protocol","vp":"JetBrains TeamCity","t":"","p":1785170672290},"CVE-2026-18556":{"s":8.2,"v":"HIGH","x":"Authentication bypass using an alternate path or channel vulnerability in N-able N-central allows Authentication Bypass.\n\nThis issue affects N-central: through 2026.1.","vp":"N-able N-central","t":"Unauthenticated administrative account takeover","p":1785614370913},"CVE-2026-34486":{"s":7.5,"v":"HIGH","x":"Missing Encryption of Sensitive Data vulnerability in Apache Tomcat due to the fix for CVE-2026-29146 allowing the bypass of the EncryptInterceptor.\n\nThis issue affects Apache Tomcat: 11.0.20, 10.1.53, 9.0.116.\n\nUsers are recommended to upgrade to version 11.0.21, 10.1.54 or 9.0.117, which fix the issue.","vp":"Apache Software Foundation Apache Tomcat","t":"Apache Tomcat: Fix for CVE-2026-29146 allowed bypass of EncryptInterceptor","p":1775763335994},"CVE-2026-9198":{"s":9.8,"v":"CRITICAL","x":"IBM Langflow OSS 1.0.0 through 1.10.0 allows unauthenticated attackers to chain /api/v1/auto_login (mints SUPERUSER tokens to any network caller) with /api/v1/validate/code (executes user code via exec()) to achieve full RCE on default Langflow deployments","vp":"IBM Langflow OSS","t":"Unauthenticated Remote Code Execution via Auto-Login Bypass and Code Validation","p":1784309771246},"CVE-2026-18577":{"s":8.2,"v":"HIGH","x":"An incomplete patch for CVE-2026-18556 allows for authentication bypass and account takeover in N-central Versions through 2026.3.1","vp":"N-able N-central","t":"Incomplete patch leads to administrative account takeover","p":1785708378296},"CVE-2026-20316":{"s":5.3,"v":"MEDIUM","x":"A vulnerability in the web interface of Cisco Secure Firewall Management Center (FMC) Software could allow an unauthenticated, remote attacker to log in to an affected device using a low-privileged account to access sensitive data within the impacted systems.\r\n\r\nThis vulnerability is due to the presence of static user…","vp":"Cisco Cisco Secure Firewall Management Center (FMC)","t":"Cisco Secure Firewall Management Center Software Static Credential Vulnerability","p":1785342128888},"CVE-2025-68686":{"s":5.3,"v":"MEDIUM","x":"An Exposure of Sensitive Information to an Unauthorized Actor vulnerability [CWE-200] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.1, FortiOS 7.4.0 through 7.4.6, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4 all versions may allow a remote unauthenticated attacker to bypass the patch…","vp":"Fortinet FortiOS","t":"","p":1770737952777},"CVE-2026-16812":{"s":10,"v":"CRITICAL","x":"VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator.…","vp":"Arista Networks VeloCloud Orchestrator On-Prem","t":"VeloCloud Orchestrator OS Command Injection","p":1785168660968},"CVE-2026-16232":{"s":9.3,"v":"CRITICAL","x":"An authentication bypass vulnerability in the Check Point SmartConsole login process allows an unauthenticated remote attacker to obtain an application login token and use it to authenticate with full administrative privileges. Successful exploitation allows the attacker to modify security policies and security…","vp":"checkpoint Quantum Security Management","t":"Authentication Bypass in the SmartConsole Login Process Using an Application Token","p":1784728389830},"CVE-2026-50522":{"s":9.8,"v":"CRITICAL","x":"Deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attacker to execute code over a network.","vp":"Microsoft Microsoft SharePoint Enterprise Server 2016","t":"Microsoft SharePoint Remote Code Execution Vulnerability","p":1784048727656},"CVE-2026-60137":{"s":5.9,"v":"MEDIUM","x":"WordPress 6.8.x before 6.8.6, 6.9.x before 6.9.5, and 7.0.x before 7.0.2 does not properly sanitise the author__not_in parameter of WP_Query, which could allow SQL Injection when a plugin or theme passes untrusted input to the parameter.","vp":"WordPress WordPress","t":"WordPress < 7.0.2 - Facilitated SQL Injection via author__not_in in WP_Query","p":1784315652159},"CVE-2026-63030":{"s":9.8,"v":"CRITICAL","x":"WordPress 6.9.x before 6.9.5 and 7.0.x before 7.0.2 is affected by a REST API batch endpoint route confusion issue which, combined with the author__not_in WP_Query SQL Injection (CVE-2026-60137), could allow an attacker to perform SQL Injection and achieve Remote Code Execution.","vp":"WordPress WordPress","t":"WordPress < 7.0.2 - REST API batch-route confusion and SQL injection issue leading to Remote Code Execution","p":1784315652910},"CVE-2026-0770":{"s":9.8,"v":"CRITICAL","x":"Langflow exec_globals Inclusion of Functionality from Untrusted Control Sphere Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Langflow. Authentication is not required to exploit this vulnerability.\n\nThe specific flaw exists within…","vp":"Langflow Langflow","t":"Langflow exec_globals Inclusion of Functionality from Untrusted Control Sphere Remote Code Execution Vulnerability","p":1769138932286},"CVE-2021-27137":{"s":8.1,"v":"HIGH","x":"An issue was discovered in router/upnp/src/ssdp.c in DD-WRT before 45724. An unsafe strcpy in the UPnP handling functionality allows an unauthenticated remote attacker to send a request that would overflow an internal fixed buffer. Exploitation requires the DD-WRT user to enable UPnP (which is off by default, and only…","vp":"DD-WRT DD-WRT","t":"","p":1784160000000},"CVE-2026-58644":{"s":9.8,"v":"CRITICAL","x":"Deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attacker to execute code over a network.","vp":"Microsoft Microsoft SharePoint Enterprise Server 2016","t":"Microsoft SharePoint Remote Code Execution Vulnerability","p":1784048737431},"CVE-2026-25089":{"s":9.1,"v":"CRITICAL","x":"A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.5, FortiSandbox 4.4.0 through 4.4.8, FortiSandbox 4.2 all versions, FortiSandbox Cloud 5.0.4 through 5.0.5, FortiSandbox PaaS 5.0.4 through 5.0.5 may allow an…","vp":"Fortinet FortiSandbox","t":"","p":1781015267492},"CVE-2026-39808":{"s":9.1,"v":"CRITICAL","x":"A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiSandbox 4.4.0 through 4.4.8 may allow attacker to execute unauthorized code or commands via <insert attack vector here>","vp":"Fortinet FortiSandbox","t":"","p":1776181082089},"CVE-2026-46817":{"s":9.8,"v":"CRITICAL","x":"Vulnerability in the Oracle Payments product of Oracle E-Business Suite (component: File Transmission).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Payments.  Successful attacks of this…","vp":"Oracle Corporation Oracle Payments","t":"","p":1779999430861},"CVE-2023-4346":{"s":7.5,"v":"HIGH","x":"\nKNX devices that use KNX Connection Authorization and support Option 1 are, depending on the implementation, vulnerable to being locked and users being unable to reset them to gain access to the device. The BCU key feature on the devices can be used to create a password for the device, but this password can often not…","vp":"KNX Association KNX Protocol Connection Authorization Option 1","t":"","p":1693337935399},"CVE-2026-56155":{"s":7.8,"v":"HIGH","x":"Insufficient granularity of access control in Active Directory Federation Services (AD FS) allows an authorized attacker to elevate privileges locally.","vp":"Microsoft Windows 10 Version 1607","t":"Active Directory Federation Services Elevation of Privilege Vulnerability","p":1784048711702},"CVE-2026-56164":{"s":5.3,"v":"MEDIUM","x":"Missing authentication for critical function in Microsoft Office SharePoint allows an unauthorized attacker to elevate privileges over a network.","vp":"Microsoft Microsoft SharePoint Enterprise Server 2016","t":"Microsoft SharePoint Server Elevation of Privilege Vulnerability","p":1784048712313},"CVE-2026-15409":{"s":10,"v":"CRITICAL","x":"A Server-side request forgery (SSRF) vulnerability has been identified in the SMA1000 Appliance Work Place interface. A remote unauthenticated attacker could potentially cause the appliance to make requests to unintended location.","vp":"SonicWall SMA1000","t":"","p":1784057974808},"CVE-2026-15410":{"s":7.2,"v":"HIGH","x":"Post-authentication improper control of generation of code ('Code Injection') vulnerability has been identified in the SMA1000 Appliance Management Console (AMC) which in specific conditions could potentially enable a remote authenticated attacker as administrator to execute arbitrary OS commands.","vp":"SonicWall SMA1000","t":"","p":1784058183226},"CVE-2008-4128":{"s":8.1,"v":"HIGH","x":"Multiple cross-site request forgery (CSRF) vulnerabilities in the HTTP Administration component in Cisco IOS 12.4 on the 871 Integrated Services Router allow remote attackers to execute arbitrary commands via (1) a certain \"show privilege\" command to the /level/15/exec/- URI, and (2) a certain \"alias exec\" command to…","vp":"n/a n/a","t":"","p":1221768000000},"CVE-2026-56291":{"s":10,"v":"CRITICAL","x":"Joomla Extension - balbooa.com - Unauthenticated file upload in Balbooa Forms extension < 2.4.1 - The Joomla extension Balbooa Forms is vulnerable to an unauthenticated arbitrary file upload that allows uploading executable files and leads to full RCE.","vp":"balbooa.com balbooa.com Balbooa Forms extension for Joomla","t":"Joomla Extension - balbooa.com - Unauthenticated file upload in Balbooa Forms extension < 2.4.1","p":1783590837886},"CVE-2026-48939":{"s":10,"v":"CRITICAL","x":"A vulnerability in the iCagenda extension for Joomla allows the upload of arbitrary files in the file attachment feature, ultimately resulting in PHP code upload and execution.","vp":"icagenda.com iCagenda extension for Joomla","t":"Joomla Extension - icagenda.com - Remote Code Execution in iCaganda extension for Joomla < 4.0.8/3.9.15","p":1781956610752},"CVE-2026-48908":{"s":10,"v":"CRITICAL","x":"A vulnerability in SP Page Builder for Joomla allows unauthenticated users to upload arbitrary files, ultimately resulting in the upload and execution of PHP code.","vp":"joomshaper.net SP Page Builder extension for Joomla","t":"Joomla Extension - joomshaper.com - Remote Code Execution in SP Pagebuilder extension for Joomla < 6.6.2","p":1781956620501},"CVE-2026-55255":{"s":8.4,"v":"HIGH","x":"Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.9.1, an Insecure Direct Object Reference (IDOR) vulnerability in /api/v1/responses endpoint allows an authenticated attacker to execute any flow belonging to another user by specifying the victim's flow ID in the request. This…","vp":"langflow-ai langflow","t":"Langflow: IDOR Vulnerability in `/api/v1/responses` Endpoint Allows Authenticated Attackers to Access Another User's Flow","p":1782232100985},"CVE-2026-56290":{"s":10,"v":"CRITICAL","x":"Joomla Extension - joomlack.fr - Unauthenticated file upload in Page Builder CK extension < 3.6.0 - The Joomla extension Page Builder CK is vulnerable to an unauthenticated arbitrary file upload that allows uploading executable files and leads to full RCE.","vp":"joomlack.fr JoomlaCK.fr Page Builder CK extension for Joomla","t":"Joomla Extension - joomlack.fr - Unauthenticated file upload in Page Builder CK extension < 3.6.0","p":1782743497952},"CVE-2026-48282":{"s":10,"v":"CRITICAL","x":"ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction. Scope is changed.","vp":"Adobe ColdFusion 2025","t":"ColdFusion | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)","p":1782832317151},"CVE-2026-45659":{"s":8.8,"v":"HIGH","x":"Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.","vp":"Microsoft Microsoft SharePoint Enterprise Server 2016","t":"Microsoft SharePoint Remote Code Execution Vulnerability","p":1779487473517},"CVE-2026-48558":{"s":10,"v":"CRITICAL","x":"SimpleHelp versions 5.5.15 and prior and 6.0 pre-release versions contain an authentication bypass vulnerability in the OIDC authentication flow. When OIDC authentication is configured, identity tokens submitted during login are accepted without verifying their cryptographic signature. In a vulnerable configuration, a…","vp":"SimpleHelp SimpleHelp","t":"SimpleHelp Authentication Bypass via Missing OIDC JWT Signature Verification","p":1781284025453},"CVE-2026-12569":{"s":9.3,"v":"CRITICAL","x":"A critical remote code execution (RCE) vulnerability has been reported in PTC Windchill PDMlink and PTC FlexPLM. The vulnerability may be exploited through the deserialization of untrusted data.   *  This advisory also applies to all CPS versions\n  *  The identified vulnerability also impacts Windchill and FlexPLM…","vp":"PTC Windchill PDMLink","t":"Remote Code Execution (RCE) vulnerability in Windchill PDMlink","p":1781741495241},"CVE-2026-20230":{"s":8.6,"v":"HIGH","x":"A vulnerability in Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME) could allow an unauthenticated, remote attacker to conduct server-side request forgery (SSRF) attacks through an affected device.\r\n\r\nThis vulnerability is due to…","vp":"Cisco Cisco Unified Communications Manager","t":"Cisco Unified Communications Manager Server-Side Request Forgery Vulnerability","p":1780502985961},"CVE-2025-67038":{"s":9.8,"v":"CRITICAL","x":"An issue was discovered in Lantronix EDS5000 2.1.0.0R3. The HTTP RPC module executes a shell command to write logs when user's authentication fails. The username is directly concatenated with the command without any sanitization. This allow attackers to inject arbitrary OS commands into the username parameter.…","vp":"Lantronix EDS5000 series","t":"Lantronix EDS5000, G520, and X300 OS Command Injection","p":1773187200000},"CVE-2026-34910":{"s":10,"v":"CRITICAL","x":"A malicious actor with access to the network could exploit an Improper Input Validation vulnerability found in UniFi OS devices to execute a Command Injection.","vp":"Ubiquiti Inc UniFi OS Server","t":"","p":1779410629096},"CVE-2026-34909":{"s":10,"v":"CRITICAL","x":"A malicious actor with access to the network could exploit a Path Traversal vulnerability found in UniFi OS devices to access files on the underlying system that could be manipulated to access an underlying account.","vp":"Ubiquiti Inc UniFi OS Server","t":"","p":1779410629072},"CVE-2026-34908":{"s":10,"v":"CRITICAL","x":"A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi OS devices to make unauthorized changes to the system.","vp":"Ubiquiti Inc UniFi OS Server","t":"","p":1779410629077},"CVE-2026-20253":{"s":9.8,"v":"CRITICAL","x":"In Splunk Enterprise 10.2 versions below 10.2.4 and 10 versions below 10.0.7, an unauthenticated user could create or truncate arbitrary files through a PostgreSQL sidecar service endpoint. The vulnerability exists because the PostgreSQL sidecar service endpoint lacks authentication controls, allowing any…","vp":"Splunk Splunk Enterprise","t":"Unauthenticated Arbitrary File Creation and Truncation in a PostgreSQL Sidecar Service Endpoint in Splunk Enterprise","p":1781111781242},"CVE-2026-48907":{"s":10,"v":"CRITICAL","x":"A vulnerability in the JCE editor extension for Joomla allows the creation of new editor profiles for unauthenticated users, ultimately resulting in PHP code upload and execution.","vp":"joomlacontenteditor.net Joomla Content Editor (JCE) extension for Joomla","t":"Joomla Extension - joomlacontenteditor.net - Remote Code Execution in JCE extension for Joomla < 2.9.99.5","p":1780644690257},"CVE-2026-54420":{"s":8.5,"v":"HIGH","x":"LiteSpeed cPanel plugin before 2.4.8 (as distributed in LiteSpeed WHM PlugIn before 5.3.2.0) mishandles symlinks provided by a user with FTP or web shell access on a shared hosting server running CloudLinux/CageFS, as exploited in the wild in May 2026.","vp":"LiteSpeed Technologies cPanel Plugin","t":"","p":1781407392863},"CVE-2026-20262":{"s":6.5,"v":"MEDIUM","x":"A vulnerability in the web UI of Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, could allow an authenticated, remote attacker to create a file or overwrite any file on the filesystem of an affected system.\r\n\r\nThis vulnerability exists because the affected software does not properly validate user-supplied…","vp":"Cisco Cisco Catalyst SD-WAN Manager","t":"Cisco Catalyst SD-WAN Manager Arbitrary File Write Vulnerability","p":1781540469696},"CVE-2026-10520":{"s":10,"v":"CRITICAL","x":"An OS Command Injection vulnerability in Ivanti Sentry before the R10.5.2, R10.6.2 and R10.7.1 versions allows a remote unauthenticated user to achieve root-level remote code execution","vp":"ivanti Sentry","t":"","p":1781014221581},"CVE-2026-11645":{"s":8.8,"v":"HIGH","x":"Out of bounds read and write in V8 in Google Chrome prior to 149.0.7827.103 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)","vp":"Google Chrome","t":"","p":1780961251298},"CVE-2026-7473":{"s":5.8,"v":"MEDIUM","x":"On affected platforms running Arista EOS where a tunnel decapsulation configuration—such as VXLAN (Virtual Extensible LAN), decap-groups, or a GRE (Generic Routing Encapsulation) tunnel interface—is present, the switch will incorrectly decapsulate and forward other unexpected tunneled packet with a destination IP…","vp":"Arista Networks EOS","t":"Arista EOS Unexpected Tunnel Protocol Decapsulation and Forwarding Bypass","p":1780676567989},"CVE-2026-20245":{"s":7.8,"v":"HIGH","x":"A vulnerability in the CLI of Cisco Catalyst SD-WAN Controller, formerly SD-WAN vSmart, Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, and Cisco Catalyst SD-WAN Validator, formerly SD-WAN vBond, could allow an authenticated, local attacker to execute arbitrary commands as root by supplying a crafted file to…","vp":"Cisco Cisco Catalyst SD-WAN Controller","t":"Cisco Catalyst SD-WAN Controller Authenticated Privilege Escalation Vulnerability","p":1780612380748},"CVE-2026-42271":{"s":8.8,"v":"HIGH","x":"LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. From version 1.74.2 to before version 1.83.7, two endpoints used to preview an MCP server before saving it — POST /mcp-rest/test/connection and POST /mcp-rest/test/tools/list — accepted a full server configuration in the request…","vp":"BerriAI litellm","t":"LiteLLM: Authenticated command execution via MCP stdio test endpoints","p":1778211316758},"CVE-2026-50751":{"s":9.3,"v":"CRITICAL","x":"A logic flow weakness in Remote Access and Mobile Access certificate validation in deprecated IKEv1 key exchange allows an unauthenticated remote attacker to bypass user authentication and establish a remote access VPN connection without a valid user password.","vp":"checkpoint Quantum Security Gateway","t":"User Authentication Bypass in VPN Remote Access and Mobile Access","p":1780916835746},"CVE-2026-28318":{"s":7.5,"v":"HIGH","x":"SolarWinds Serv-U is susceptible to specially crafted POST requests that crash the Serv-U service without authentication using Content-Encoding: deflate. Mitigation steps are provided to secure customer environments in the SolarWinds Trust Center if you are unable to deploy the update","vp":"SolarWinds Serv-U","t":"SolarWinds Serv-U Unauthenticated Denial of Service Vulnerability","p":1780581958218},"CVE-2026-45247":{"s":9.8,"v":"CRITICAL","x":"Mirasvit Full Page Cache Warmer for Magento 2 before version 1.11.12 contains a PHP object injection vulnerability that allows unauthenticated attackers to achieve remote code execution by supplying a crafted serialized PHP object in the CacheWarmer cookie. Attackers can exploit the unrestricted call to PHP's native…","vp":"Mirasvit Full Page Cache Warmer for Magento 2","t":"Mirasvit Cache Warmer for Magento < 1.11.12 PHP Object Injection","p":1779804933596},"CVE-2022-0492":{"s":7.8,"v":"HIGH","x":"A vulnerability was found in the Linux kernel’s cgroup_release_agent_write in the kernel/cgroup/cgroup-v1.c function. This flaw, under certain circumstances, allows the use of the cgroups v1 release_agent feature to escalate privileges and bypass the namespace isolation unexpectedly.","vp":"n/a kernel","t":"","p":1646265600000},"CVE-2025-48595":{"s":8.4,"v":"HIGH","x":"In multiple locations, there is a possible way to achieve code execution due to an integer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","vp":"Google Android","t":"","p":1780348489921},"CVE-2024-21182":{"s":7.5,"v":"HIGH","x":"Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core).  Supported versions that are affected are 12.2.1.4.0 and  14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Oracle WebLogic Server.  Successful…","vp":"Oracle Corporation WebLogic Server","t":"","p":1721169611035},"CVE-2026-0257":{"s":7.8,"v":"HIGH","x":"Authentication bypass vulnerabilities in the GlobalProtect portal and gateway of Palo Alto Networks PAN-OS® software allows the attacker to bypass security restrictions and establish an unauthorized VPN connection.\n\nPanorama and Cloud NGFW are not impacted by these issues.","vp":"Palo Alto Networks Cloud NGFW","t":"PAN-OS: GlobalProtect Authentication Bypass Vulnerabilities","p":1778696110172},"CVE-2026-48027":{"s":9.3,"v":"CRITICAL","x":"Nx Console is the user interface for Nx & Lerna. On 19 May 2026, a malicious version of Nx Console, 18.95.0, was published at 12:30 PM UTC and removed soon after at 12:48 PM UTC, leaving it available for ~18 minutes in Visual Studio Marketplace. For OpenVSX, the problem was detected later, and the compromised version…","vp":"nrwl nx-console","t":"Compromised Nx Console version 18.95.0","p":1779897001143},"CVE-2026-45321":{"s":9.6,"v":"CRITICAL","x":"On 2026-05-11, between approximately 19:20 and 19:26 UTC, 84 malicious versions across 42 @tanstack/* packages were published to the npm registry. The publishes were authenticated via the legitimate GitHub Actions OIDC trusted-publisher binding for TanStack/router, but the publish workflow itself was not modified. The…","vp":"@tanstack arktype-adapter","t":"Malware in 42 @tanstack/* packages exfiltrates cloud credentials, GitHub tokens, and SSH keys","p":1778544755452},"CVE-2026-8398":{"s":9.8,"v":"CRITICAL","x":"A supply chain attack compromised the official installation packages of DAEMON Tools Lite (Windows versions 12.5.0.2421 through 12.5.0.2434), distributed from the legitimate website daemon-tools.cc between approximately April 8, 2026, and May 5, 2026. Attackers gained unauthorized access to the vendor's (AVB Disc…","vp":"AVB Disc Soft DAEMON Tools Lite","t":"","p":1778830229287},"CVE-2026-48172":{"s":10,"v":"CRITICAL","x":"LiteSpeed User-End cPanel Plugin before 2.4.5 allows privilege escalation (possibly to root), as exploited in the wild in May 2026. Detection is best done via a command line of grep -rE \"cpanel_jsonapi_func=redisAble\" /var/cpanel/logs /usr/local/cpanel/logs/ 2>/dev/null in Bash. If you get no output, you have not been…","vp":"LiteSpeed Technologies cPanel Plugin","t":"","p":1779323884489},"CVE-2026-9082":{"s":9.8,"v":"CRITICAL","x":"Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Drupal Drupal core allows SQL Injection.\n\nThis issue affects Drupal core: from 8.9.0 before 10.4.10, from 10.5.0 before 10.5.10, from 10.6.0 before 10.6.9, from 11.0.0 before 11.1.10, from 11.2.0 before 11.2.12, from…","vp":"Drupal Drupal core","t":"Drupal core - Highly critical - SQL injection - SA-CORE-2026-004","p":1779301252863},"CVE-2025-34291":{"s":9.4,"v":"CRITICAL","x":"Langflow versions up to and including 1.6.9 contain a chained vulnerability that enables account takeover and remote code execution. An overly permissive CORS configuration (allow_origins='*' with allow_credentials=True) combined with a refresh token cookie configured as SameSite=None allows a malicious webpage to…","vp":"Langflow Langflow","t":"Langflow <= 1.6.9 CORS Misconfiguration to Token Hijack & RCE","p":1764973646438},"CVE-2026-34926":{"s":6.7,"v":"MEDIUM","x":"A directory traversal vulnerability in the Apex One (on-premise) server could allow a pre-authenticated local attacker to modify a key table on the server to inject malicious code to deploy to agents on affected installations.\n\n\r\nThis vulnerability is only exploitable on the on-premise version of Apex One and a…","vp":"Trend Micro, Inc. TrendAI Apex One","t":"","p":1779368601164},"CVE-2008-4250":{"s":9.8,"v":"CRITICAL","x":"The Server service in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP1 and SP2, Vista Gold and SP1, Server 2008, and 7 Pre-Beta allows remote attackers to execute arbitrary code via a crafted RPC request that triggers the overflow during path canonicalization, as exploited in the wild by Gimmiv.A in October…","vp":"n/a n/a","t":"","p":1224795600000},"CVE-2017-0144":{"s":8.8,"v":"HIGH","x":"The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607; and Windows Server 2016 allows remote attackers to execute arbitrary code via crafted packets, aka \"Windows SMB Remote…","vp":"Microsoft Corporation Windows SMB","t":"","p":1489708800000},"CVE-2019-0708":{"s":9.8,"v":"CRITICAL","x":"A remote code execution vulnerability exists in Remote Desktop Services formerly known as Terminal Services when an unauthenticated attacker connects to the target system using RDP and sends specially crafted requests, aka 'Remote Desktop Services Remote Code Execution Vulnerability'.","vp":"Microsoft Windows","t":"","p":1558030620000},"CVE-2020-1472":{"s":5.5,"v":"MEDIUM","x":"An elevation of privilege vulnerability exists when an attacker establishes a vulnerable Netlogon secure channel connection to a domain controller, using the Netlogon Remote Protocol (MS-NRPC). An attacker who successfully exploited the vulnerability could run a specially crafted application on a device on the…","vp":"Microsoft Windows Server version 2004","t":"Netlogon Elevation of Privilege Vulnerability","p":1597691585000},"CVE-2021-34527":{"s":8.8,"v":"HIGH","x":"A remote code execution vulnerability exists when the Windows Print Spooler service improperly performs privileged file operations. An attacker who successfully exploited this vulnerability could run arbitrary code with SYSTEM privileges. An attacker could then install programs; view, change, or delete data; or create…","vp":"Microsoft Windows 10 Version 1507","t":"Windows Print Spooler Remote Code Execution Vulnerability","p":1625261111000},"CVE-2021-1675":{"s":7.8,"v":"HIGH","x":"Windows Print Spooler Remote Code Execution Vulnerability","vp":"Microsoft Windows 10 Version 1809","t":"Windows Print Spooler Remote Code Execution Vulnerability","p":1623192371000},"CVE-2021-36934":{"s":7.8,"v":"HIGH","x":"An elevation of privilege vulnerability exists because of overly permissive Access Control Lists (ACLs) on multiple system files, including the Security Accounts Manager (SAM) database. An attacker who successfully exploited this vulnerability could run arbitrary code with SYSTEM privileges. An attacker could then…","vp":"Microsoft Windows 10 Version 1809","t":"Windows Elevation of Privilege Vulnerability","p":1626937512000},"CVE-2021-36942":{"s":7.5,"v":"HIGH","x":"Windows LSA Spoofing Vulnerability","vp":"Microsoft Windows Server 2008 R2 Service Pack 1","t":"Windows LSA Spoofing Vulnerability","p":1628791949000},"CVE-2021-42278":{"s":7.5,"v":"HIGH","x":"Active Directory Domain Services Elevation of Privilege Vulnerability","vp":"Microsoft Windows Server 2008 R2 Service Pack 1","t":"Active Directory Domain Services Elevation of Privilege Vulnerability","p":1636505225000},"CVE-2021-42287":{"s":7.5,"v":"HIGH","x":"Active Directory Domain Services Elevation of Privilege Vulnerability","vp":"Microsoft Windows Server 2008 R2 Service Pack 1","t":"Active Directory Domain Services Elevation of Privilege Vulnerability","p":1636505240000},"CVE-2022-26923":{"s":8.8,"v":"HIGH","x":"Active Directory Domain Services Elevation of Privilege Vulnerability","vp":"Microsoft Windows 10 Version 1809","t":"Active Directory Domain Services Elevation of Privilege Vulnerability","p":1652214819000},"CVE-2020-0796":{"s":10,"v":"CRITICAL","x":"A remote code execution vulnerability exists in the way that the Microsoft Server Message Block 3.1.1 (SMBv3) protocol handles certain requests, aka 'Windows SMBv3 Client/Server Remote Code Execution Vulnerability'.","vp":"Microsoft Windows 10 Version 1903 for 32-bit Systems","t":"","p":1584028098000},"CVE-2020-1350":{"s":10,"v":"CRITICAL","x":"A remote code execution vulnerability exists in Windows Domain Name System servers when they fail to properly handle requests, aka 'Windows DNS Server Remote Code Execution Vulnerability'.","vp":"Microsoft Windows Server","t":"","p":1594767246000},"CVE-2020-0601":{"s":8.1,"v":"HIGH","x":"A spoofing vulnerability exists in the way Windows CryptoAPI (Crypt32.dll) validates Elliptic Curve Cryptography (ECC) certificates.An attacker could exploit the vulnerability by using a spoofed code-signing certificate to sign a malicious executable, making it appear the file was from a trusted, legitimate source,…","vp":"Microsoft Windows","t":"","p":1579043480000},"CVE-2016-5195":{"s":7,"v":"HIGH","x":"Race condition in mm/gup.c in the Linux kernel 2.x through 4.x before 4.8.3 allows local users to gain privileges by leveraging incorrect handling of a copy-on-write (COW) feature to write to a read-only memory mapping, as exploited in the wild in October 2016, aka \"Dirty COW.\"","vp":"n/a n/a","t":"","p":1478811600000},"CVE-2022-0847":{"s":7.8,"v":"HIGH","x":"A flaw was found in the way the \"flags\" member of the new pipe buffer structure was lacking proper initialization in copy_page_to_iter_pipe and push_pipe functions in the Linux kernel and could thus contain stale values. An unprivileged local user could use this flaw to write to pages in the page cache backed by read…","vp":"n/a kernel","t":"","p":1646611200000},"CVE-2021-4034":{"s":7.8,"v":"HIGH","x":"A local privilege escalation vulnerability was found on polkit's pkexec utility. The pkexec application is a setuid tool designed to allow unprivileged users to run commands as privileged users according predefined policies. The current version of pkexec doesn't handle the calling parameters count correctly and ends…","vp":"n/a polkit","t":"","p":1643328000000},"CVE-2021-3156":{"s":7.8,"v":"HIGH","x":"Sudo before 1.9.5p2 contains an off-by-one error that can result in a heap-based buffer overflow, which allows privilege escalation to root via \"sudoedit -s\" and a command-line argument that ends with a single backslash character.","vp":"n/a n/a","t":"","p":1611619200000},"CVE-2023-4911":{"s":7.8,"v":"HIGH","x":"A buffer overflow was discovered in the GNU C Library's dynamic loader ld.so while processing the GLIBC_TUNABLES environment variable. This issue could allow a local attacker to use maliciously crafted GLIBC_TUNABLES environment variables when launching binaries with SUID permission to execute code with elevated…","vp":"","t":"Glibc: buffer overflow in ld.so leading to privilege escalation","p":1696353908434},"CVE-2024-6387":{"s":8.1,"v":"HIGH","x":"A security regression (CVE-2006-5051) was discovered in OpenSSH's server (sshd). There is a race condition which can lead sshd to handle some signals in an unsafe manner. An unauthenticated, remote attacker may be able to trigger it by failing to authenticate within a set time period.","vp":"","t":"Openssh: regresshion - race condition in ssh allows rce/dos","p":1719837445431},"CVE-2024-3094":{"s":10,"v":"CRITICAL","x":"Malicious code was discovered in the upstream tarballs of xz, starting with version 5.6.0. \r\nThrough a series of complex obfuscations, the liblzma build process extracts a prebuilt object file from a disguised test file existing in the source code, which is then used to modify specific functions in the liblzma code.…","vp":"","t":"Xz: malicious code in distributed source","p":1711731072588},"CVE-2021-44228":{"s":10,"v":"CRITICAL","x":"Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can…","vp":"Apache Software Foundation Apache Log4j2","t":"Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints","p":1639094400000},"CVE-2017-5638":{"s":9.8,"v":"CRITICAL","x":"The Jakarta Multipart parser in Apache Struts 2 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1 has incorrect exception handling and error-message generation during file-upload attempts, which allows remote attackers to execute arbitrary commands via a crafted Content-Type, Content-Disposition, or Content-Length HTTP…","vp":"Apache Software Foundation Apache Struts","t":"","p":1489198260000},"CVE-2022-22965":{"s":9.8,"v":"CRITICAL","x":"A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding. The specific exploit requires the application to run on Tomcat as a WAR deployment. If the application is deployed as a Spring Boot executable jar, i.e. the default, it is not vulnerable to…","vp":"n/a Spring Framework","t":"","p":1648851450000},"CVE-2020-1938":{"s":9.8,"v":"CRITICAL","x":"When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat. Tomcat treats AJP connections as having higher trust than, for example, a similar HTTP connection. If such connections are available to an attacker, they can be exploited in ways that may be surprising.…","vp":"Apache Apache Tomcat","t":"","p":1582579158000},"CVE-2022-26134":{"s":9.8,"v":"CRITICAL","x":"In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an unauthenticated attacker to execute arbitrary code on a Confluence Server or Data Center instance. The affected versions are from 1.3.0 before 7.4.17, from 7.13.0 before 7.13.7, from 7.14.0 before…","vp":"Atlassian Confluence Data Center","t":"","p":1654293117134},"CVE-2023-34362":{"s":9.8,"v":"CRITICAL","x":"In Progress MOVEit Transfer before 2021.0.6 (13.0.6), 2021.1.4 (13.1.4), 2022.0.4 (14.0.4), 2022.1.5 (14.1.5), and 2023.0.1 (15.0.1), a SQL injection vulnerability has been found in the MOVEit Transfer web application that could allow an unauthenticated attacker to gain access to MOVEit Transfer's database. Depending…","vp":"n/a n/a","t":"","p":1685664000000},"CVE-2021-30116":{"s":10,"v":"CRITICAL","x":"Kaseya VSA before 9.5.7 allows credential disclosure, as exploited in the wild in July 2021. By default Kaseya VSA on premise offers a download page where the clients for the installation can be downloaded. The default URL for this page is https://x.x.x.x/dl.asp When an attacker download a client for Windows and…","vp":"n/a n/a","t":"Unauthenticated credential leak and business logic flaw in Kaseya VSA <= v9.5.6","p":1625788800000},"CVE-2024-1709":{"s":10,"v":"CRITICAL","x":"ConnectWise ScreenConnect 23.9.7 and prior are affected by an Authentication Bypass Using an Alternate Path or Channel\n\n vulnerability, which may allow an attacker direct access to confidential information or \n\ncritical systems.","vp":"ConnectWise ScreenConnect","t":"Authentication bypass using an alternate path or channel","p":1708529763960},"CVE-2024-1708":{"s":8.4,"v":"HIGH","x":"ConnectWise ScreenConnect 23.9.7 and prior are affected by path-traversal vulnerability, which may allow an attacker \n\nthe ability to execute remote code or directly impact confidential data or critical systems.\n\n","vp":"ConnectWise ScreenConnect","t":"Improper limitation of a pathname to a restricted directory (“path traversal”)","p":1708529350091},"CVE-2024-23897":{"s":9.8,"v":"CRITICAL","x":"Jenkins 2.441 and earlier, LTS 2.426.2 and earlier does not disable a feature of its CLI command parser that replaces an '@' character followed by a file path in an argument with the file's contents, allowing unauthenticated attackers to read arbitrary files on the Jenkins controller file system.","vp":"Jenkins Project Jenkins","t":"","p":1706118742842},"CVE-2021-26855":{"s":9.1,"v":"CRITICAL","x":"Microsoft Exchange Server Remote Code Execution Vulnerability","vp":"Microsoft Microsoft Exchange Server 2013 Cumulative Update 21","t":"Microsoft Exchange Server Remote Code Execution Vulnerability","p":1614729326000},"CVE-2021-27065":{"s":7.8,"v":"HIGH","x":"Microsoft Exchange Server Remote Code Execution Vulnerability","vp":"Microsoft Microsoft Exchange Server 2013 Cumulative Update 21","t":"Microsoft Exchange Server Remote Code Execution Vulnerability","p":1614729328000},"CVE-2021-34473":{"s":9.1,"v":"CRITICAL","x":"Microsoft Exchange Server Remote Code Execution Vulnerability","vp":"Microsoft Microsoft Exchange Server 2013 Cumulative Update 23","t":"Microsoft Exchange Server Remote Code Execution Vulnerability","p":1626285243000},"CVE-2021-34523":{"s":9,"v":"CRITICAL","x":"Microsoft Exchange Server Elevation of Privilege Vulnerability","vp":"Microsoft Microsoft Exchange Server 2013 Cumulative Update 23","t":"Microsoft Exchange Server Elevation of Privilege Vulnerability","p":1626285278000},"CVE-2021-31207":{"s":6.6,"v":"MEDIUM","x":"Microsoft Exchange Server Security Feature Bypass Vulnerability","vp":"Microsoft Microsoft Exchange Server 2013 Cumulative Update 23","t":"Microsoft Exchange Server Security Feature Bypass Vulnerability","p":1620760301000},"CVE-2022-41040":{"s":8.8,"v":"HIGH","x":"Microsoft Exchange Server Elevation of Privilege Vulnerability","vp":"Microsoft Microsoft Exchange Server 2013 Cumulative Update 23","t":"Microsoft Exchange Server Elevation of Privilege Vulnerability","p":1664755200000},"CVE-2022-41082":{"s":8,"v":"HIGH","x":"Microsoft Exchange Server Remote Code Execution Vulnerability","vp":"Microsoft Microsoft Exchange Server 2013 Cumulative Update 23","t":"Microsoft Exchange Server Remote Code Execution Vulnerability","p":1664755200000},"CVE-2023-23397":{"s":9.8,"v":"CRITICAL","x":"Microsoft Outlook Elevation of Privilege Vulnerability","vp":"Microsoft Microsoft Office LTSC 2021","t":"Microsoft Outlook Elevation of Privilege Vulnerability","p":1678812928168},"CVE-2023-2868":{"s":9.4,"v":"CRITICAL","x":"A remote command injection vulnerability exists in the Barracuda Email Security Gateway (appliance form factor only) product effecting versions 5.1.3.001-9.2.0.006. The vulnerability arises out of a failure to comprehensively sanitize the processing of .tar file (tape archives). The vulnerability stems from incomplete…","vp":"Barracuda Barracuda Email Security Gateway","t":"Remote Code injection in Barracuda Email Security Gateway","p":1684951252360},"CVE-2019-19781":{"s":9.8,"v":"CRITICAL","x":"An issue was discovered in Citrix Application Delivery Controller (ADC) and Gateway 10.5, 11.1, 12.0, 12.1, and 13.0. They allow Directory Traversal.","vp":"n/a n/a","t":"","p":1577452006000},"CVE-2023-4966":{"s":9.4,"v":"CRITICAL","x":"Sensitive information disclosure in NetScaler ADC and NetScaler Gateway when configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or AAA  virtual server.","vp":"Citrix NetScaler ADC","t":"Unauthenticated sensitive information disclosure","p":1696943537644},"CVE-2018-13379":{"s":9.1,"v":"CRITICAL","x":"An Improper Limitation of a Pathname to a Restricted Directory (\"Path Traversal\") in Fortinet FortiOS 6.0.0 to 6.0.4, 5.6.3 to 5.6.7 and 5.4.6 to 5.4.12 and FortiProxy 2.0.0, 1.2.0 to 1.2.8, 1.1.0 to 1.1.6, 1.0.0 to 1.0.7 under SSL VPN web portal allows an unauthenticated attacker to download system files via special…","vp":"Fortinet Fortinet FortiOS, FortiProxy","t":"","p":1559679488000},"CVE-2022-40684":{"s":9.8,"v":"CRITICAL","x":"An authentication bypass using an alternate path or channel [CWE-288] in Fortinet FortiOS version 7.2.0 through 7.2.1 and 7.0.0 through 7.0.6, FortiProxy version 7.2.0 and version 7.0.0 through 7.0.6 and FortiSwitchManager version 7.2.0 and 7.0.0 allows an unauthenticated atttacker to perform operations on the…","vp":"Fortinet Fortinet FortiOS, FortiProxy, FortiSwitchManager","t":"","p":1666051200000},"CVE-2023-46805":{"s":8.2,"v":"HIGH","x":"An authentication bypass vulnerability in the web component of Ivanti ICS 9.x, 22.x and Ivanti Policy Secure allows a remote attacker to access restricted resources by bypassing control checks.","vp":"Ivanti ICS","t":"","p":1705078936452},"CVE-2024-21887":{"s":9.1,"v":"CRITICAL","x":"A command injection vulnerability in web components of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x)  allows an authenticated administrator to send specially crafted requests and execute arbitrary commands on the appliance.","vp":"Ivanti ICS","t":"","p":1705078936481},"CVE-2024-3400":{"s":10,"v":"CRITICAL","x":"A command injection as a result of arbitrary file creation vulnerability in the GlobalProtect feature of Palo Alto Networks PAN-OS software for specific PAN-OS versions and distinct feature configurations may enable an unauthenticated attacker to execute arbitrary code with root privileges on the firewall.\n\nCloud…","vp":"Palo Alto Networks PAN-OS","t":"PAN-OS: Arbitrary File Creation Leads to OS Command Injection Vulnerability in GlobalProtect","p":1712906400707},"CVE-2020-5902":{"s":9.8,"v":"CRITICAL","x":"In BIG-IP versions 15.0.0-15.1.0.3, 14.1.0-14.1.2.5, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1, the Traffic Management User Interface (TMUI), also referred to as the Configuration utility, has a Remote Code Execution (RCE) vulnerability in undisclosed pages.","vp":"n/a BIG-IP","t":"","p":1593561600000},"CVE-2022-1388":{"s":9.8,"v":"CRITICAL","x":"On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13.1.x versions prior to 13.1.5, and all 12.1.x and 11.6.x versions, undisclosed requests may bypass iControl REST authentication. Note: Software versions which have reached End of Technical Support…","vp":"F5 BIG-IP","t":"","p":1651767484472},"CVE-2023-20198":{"s":10,"v":"CRITICAL","x":"Cisco is providing an update for the ongoing investigation into observed exploitation of the web UI feature in Cisco IOS XE Software. We are updating the list of fixed releases and adding the Software Checker. Our investigation has determined that the actors exploited two previously unknown issues. The attacker first…","vp":"Cisco Cisco IOS XE Software","t":"","p":1697469178735},"CVE-2021-21974":{"s":8.8,"v":"HIGH","x":"OpenSLP as used in ESXi (7.0 before ESXi70U1c-17325551, 6.7 before ESXi670-202102401-SG, 6.5 before ESXi650-202102101-SG) has a heap-overflow vulnerability. A malicious actor residing within the same network segment as ESXi who has access to port 427 may be able to trigger the heap-overflow issue in OpenSLP service…","vp":"n/a VMware ESXi","t":"","p":1614185853000},"CVE-2021-21972":{"s":9.8,"v":"CRITICAL","x":"The vSphere Client (HTML5) contains a remote code execution vulnerability in a vCenter Server plugin. A malicious actor with network access to port 443 may exploit this issue to execute commands with unrestricted privileges on the underlying operating system that hosts vCenter Server. This affects VMware vCenter…","vp":"n/a VMware vCenter Server","t":"","p":1614184925000},"CVE-2017-11882":{"s":7.8,"v":"HIGH","x":"Microsoft Office 2007 Service Pack 3, Microsoft Office 2010 Service Pack 2, Microsoft Office 2013 Service Pack 1, and Microsoft Office 2016 allow an attacker to run arbitrary code in the context of the current user by failing to properly handle objects in memory, aka \"Microsoft Office Memory Corruption Vulnerability\".…","vp":"Microsoft Corporation Microsoft Office","t":"","p":1510714800000},"CVE-2022-30190":{"s":7.8,"v":"HIGH","x":"A remote code execution vulnerability exists when MSDT is called using the URL protocol from a calling application such as Word. An attacker who successfully exploits this vulnerability can run arbitrary code with the privileges of the calling application. The attacker can then install programs, view, change, or…","vp":"Microsoft Windows 10 Version 1809","t":"Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution Vulnerability","p":1654114217000},"CVE-2023-38831":{"s":7.8,"v":"HIGH","x":"RARLAB WinRAR before 6.23 allows attackers to execute arbitrary code when a user attempts to view a benign file within a ZIP archive. The issue occurs because a ZIP archive may include a benign file (such as an ordinary .JPG file) and also a folder that has the same name as the benign file, and the contents of the…","vp":"n/a n/a","t":"","p":1692748800000},"CVE-2021-30860":{"s":7.8,"v":"HIGH","x":"An integer overflow was addressed with improved input validation. This issue is fixed in Security Update 2021-005 Catalina, iOS 14.8 and iPadOS 14.8, macOS Big Sur 11.6, watchOS 7.6.2. Processing a maliciously crafted PDF may lead to arbitrary code execution. Apple is aware of a report that this issue may have been…","vp":"Apple macOS","t":"","p":1629830965000},"CVE-2023-4863":{"s":8.8,"v":"HIGH","x":"Heap buffer overflow in libwebp in Google Chrome prior to 116.0.5845.187 and libwebp 1.3.2 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. (Chromium security severity: Critical)","vp":"Google Chrome","t":"","p":1694528699275},"CVE-2023-41064":{"s":7.8,"v":"HIGH","x":"A buffer overflow issue was addressed with improved memory handling. This issue is fixed in iOS 16.6.1 and iPadOS 16.6.1, macOS Monterey 12.6.9, macOS Ventura 13.5.2, iOS 15.7.9 and iPadOS 15.7.9, macOS Big Sur 11.7.10. Processing a maliciously crafted image may lead to arbitrary code execution. Apple is aware of a…","vp":"Apple macOS","t":"","p":1694107810904},"CVE-2017-5754":{"s":5.6,"v":"MEDIUM","x":"Systems with microprocessors utilizing speculative execution and indirect branch prediction may allow unauthorized disclosure of information to an attacker with local user access via a side-channel analysis of the data cache.","vp":"Intel Corporation Most Modern Operating Systems","t":"","p":1515070800000},"CVE-2017-5753":{"s":5.6,"v":"MEDIUM","x":"Systems with microprocessors utilizing speculative execution and branch prediction may allow unauthorized disclosure of information to an attacker with local user access via a side-channel analysis.","vp":"Intel Corporation Most Modern Operating Systems","t":"","p":1515070800000},"CVE-2017-5715":{"s":5.6,"v":"MEDIUM","x":"Systems with microprocessors utilizing speculative execution and indirect branch prediction may allow unauthorized disclosure of information to an attacker with local user access via a side-channel analysis.","vp":"Intel Corporation Microprocessors with Speculative Execution","t":"","p":1515070800000},"CVE-2017-13077":{"x":"Wi-Fi Protected Access (WPA and WPA2) allows reinstallation of the Pairwise Transient Key (PTK) Temporal Key (TK) during the four-way handshake, allowing an attacker within radio range to replay, decrypt, or spoof frames.","vp":"Wi-Fi Alliance Wi-Fi Protected Access (WPA and WPA2)","t":"","p":1508205600000},"CVE-2025-53770":{"s":9.8,"v":"CRITICAL","x":"Deserialization of untrusted data in on-premises Microsoft SharePoint Server allows an unauthorized attacker to execute code over a network.\nMicrosoft is aware that an exploit for CVE-2025-53770 exists in the wild.\nMicrosoft is preparing and fully testing a comprehensive update to address this vulnerability.  In the…","vp":"Microsoft Microsoft SharePoint Enterprise Server 2016","t":"Microsoft SharePoint Server Remote Code Execution Vulnerability","p":1752973593607},"CVE-2025-5777":{"s":9.3,"v":"CRITICAL","x":"Insufficient input validation leading to memory overread when the NetScaler is configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) OR AAA virtual server","vp":"NetScaler ADC","t":"NetScaler ADC and NetScaler Gateway - Insufficient input validation leading to memory overread","p":1750163374506},"CVE-2025-31324":{"s":10,"v":"CRITICAL","x":"SAP NetWeaver Visual Composer Metadata Uploader is not protected with a proper authorization, allowing unauthenticated agent to upload potentially malicious executable binaries that could severely harm the host system. This could significantly affect the confidentiality, integrity, and availability of the targeted…","vp":"SAP_SE SAP NetWeaver (Visual Composer development server)","t":"Missing Authorization check in SAP NetWeaver (Visual Composer development server)","p":1745513427706},"CVE-2025-1974":{"s":9.8,"v":"CRITICAL","x":"A security issue was discovered in Kubernetes where under certain conditions, an unauthenticated attacker with access to the pod network can achieve arbitrary code execution in the context of the ingress-nginx controller. This can lead to disclosure of Secrets accessible to the controller. (Note that in the default…","vp":"kubernetes ingress-nginx","t":"ingress-nginx admission controller RCE escalation","p":1742858928985},"CVE-2025-0282":{"s":9,"v":"CRITICAL","x":"A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.5, Ivanti Policy Secure before version 22.7R1.2, and Ivanti Neurons for ZTA gateways before version 22.7R2.3 allows a remote unauthenticated attacker to achieve remote code execution.","vp":"Ivanti Connect Secure","t":"","p":1736374509386},"CVE-2025-29824":{"s":7.8,"v":"HIGH","x":"Use after free in Windows Common Log File System Driver allows an authorized attacker to elevate privileges locally.","vp":"Microsoft Windows 10 Version 1507","t":"Windows Common Log File System Driver Elevation of Privilege Vulnerability","p":1744133014083},"CVE-2025-32433":{"s":10,"v":"CRITICAL","x":"Erlang/OTP is a set of libraries for the Erlang programming language. Prior to versions OTP-27.3.3, OTP-26.2.5.11, and OTP-25.3.2.20, a SSH server may allow an attacker to perform unauthenticated remote code execution (RCE). By exploiting a flaw in SSH protocol message handling, a malicious actor could gain…","vp":"erlang otp","t":"Erlang/OTP SSH Vulnerable to Pre-Authentication RCE","p":1744839277457},"CVE-2009-1537":{"s":8.8,"v":"HIGH","x":"Unspecified vulnerability in the QuickTime Movie Parser Filter in quartz.dll in DirectShow in Microsoft DirectX 7.0 through 9.0c on Windows 2000 SP4, Windows XP SP2 and SP3, and Windows Server 2003 SP2 allows remote attackers to execute arbitrary code via a crafted QuickTime media file, as exploited in the wild in May…","vp":"n/a n/a","t":"","p":1243620000000},"CVE-2009-3459":{"s":8.8,"v":"HIGH","x":"Heap-based buffer overflow in Adobe Reader and Acrobat 7.x before 7.1.4, 8.x before 8.1.7, and 9.x before 9.2 allows remote attackers to execute arbitrary code via a crafted PDF file that triggers memory corruption, as exploited in the wild in October 2009. NOTE: some of these details are obtained from third party…","vp":"n/a n/a","t":"","p":1255428000000},"CVE-2010-0249":{"s":8.8,"v":"HIGH","x":"Use-after-free vulnerability in Microsoft Internet Explorer 6, 6 SP1, 7, and 8 on Windows 2000 SP4; Windows XP SP2 and SP3; Windows Server 2003 SP2; Windows Vista Gold, SP1, and SP2; Windows Server 2008 Gold, SP2, and R2; and Windows 7 allows remote attackers to execute arbitrary code by accessing a pointer associated…","vp":"n/a n/a","t":"","p":1263574800000},"CVE-2010-0806":{"s":8.8,"v":"HIGH","x":"Use-after-free vulnerability in the Peer Objects component (aka iepeers.dll) in Microsoft Internet Explorer 6, 6 SP1, and 7 allows remote attackers to execute arbitrary code via vectors involving access to an invalid pointer after the deletion of an object, as exploited in the wild in March 2010, aka \"Uninitialized…","vp":"n/a n/a","t":"","p":1268258400000},"CVE-2026-41091":{"s":7.8,"v":"HIGH","x":"Improper link resolution before file access ('link following') in Microsoft Defender allows an authorized attacker to elevate privileges locally.","vp":"Microsoft Microsoft Malware Protection Engine","t":"Microsoft Defender Elevation of Privilege Vulnerability","p":1779282553634},"CVE-2026-45498":{"s":4,"v":"MEDIUM","x":"Microsoft Defender Denial of Service Vulnerability","vp":"Microsoft Microsoft Defender Antimalware Platform","t":"Microsoft Defender Denial of Service Vulnerability","p":1779282552903},"CVE-2026-42897":{"s":8.1,"v":"HIGH","x":"Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network.","vp":"Microsoft Microsoft Exchange Server 2016 Cumulative Update 23","t":"Microsoft Exchange Server Spoofing Vulnerability","p":1778778036515},"CVE-2026-20182":{"s":10,"v":"CRITICAL","x":"May 2026: This security advisory provides the details and fix information for a vulnerability that was discovered and fixed after the  was disclosed in February 2026. This new advisory is for a new vulnerability in the control connection handshaking. The  section of this advisory includes Show Control Connections…","vp":"Cisco Cisco Catalyst SD-WAN Controller","t":"Cisco Catalyst SD-WAN Controller Authentication Bypass Vulnerability","p":1778774905566},"CVE-2026-42208":{"s":9.8,"v":"CRITICAL","x":"LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. From version 1.81.16 to before version 1.83.7, a database query used during proxy API key checks mixed the caller-supplied key value into the query text instead of passing it as a separate parameter. An unauthenticated attacker could…","vp":"BerriAI litellm","t":"LiteLLM: SQL injection in Proxy API key verification","p":1778211494124},"CVE-2026-6973":{"s":7.2,"v":"HIGH","x":"An Improper Input Validation in Ivanti EPMM before versions 12.6.1.1, 12.7.0.1, and 12.8.0.1 allows a remotely authenticated user with administrative access to achieve remote code execution.","vp":"Ivanti Endpoint Manager Mobile","t":"","p":1778167284849},"CVE-2026-0300":{"s":9.3,"v":"CRITICAL","x":"A buffer overflow vulnerability in the User-ID™ Authentication Portal (aka Captive Portal) service of Palo Alto Networks PAN-OS software allows an unauthenticated attacker to execute arbitrary code with root privileges on the PA-Series and VM-Series firewalls by sending specially crafted packets. \n\nThe risk of this…","vp":"Palo Alto Networks Cloud NGFW","t":"PAN-OS: Unauthenticated user initiated Buffer Overflow Vulnerability in User-ID™ Authentication Portal","p":1778093859876},"CVE-2026-41940":{"s":9.8,"v":"CRITICAL","x":"cPanel and WHM versions after 11.40 contain an authentication bypass vulnerability in the login flow that allows unauthenticated remote attackers to gain unauthorized access to the control panel.","vp":"WebPros cPanel","t":"WebPros cPanel and WHM Authentication Bypass via Login Flow","p":1777475437899},"CVE-2026-32202":{"s":4.3,"v":"MEDIUM","x":"Protection mechanism failure in Windows Shell allows an unauthorized attacker to perform spoofing over a network.","vp":"Microsoft Windows 10 Version 1607","t":"Windows Shell Spoofing Vulnerability","p":1776185856996},"CVE-2025-29635":{"s":7.2,"v":"HIGH","x":"A command injection vulnerability in D-Link DIR-823X 240126 and 240802 allows an authorized attacker to execute arbitrary commands on remote devices by sending a POST request to /goform/set_prohibiting via the corresponding function, triggering remote command execution.","vp":"n/a n/a","t":"","p":1742860800000},"CVE-2024-7399":{"s":8.8,"v":"HIGH","x":"Improper limitation of a pathname to a restricted directory vulnerability in Samsung MagicINFO 9 Server version before 21.1050 allows attackers to write arbitrary file as system authority.","vp":"Samsung Electronics MagicINFO 9 Server","t":"","p":1723178609828},"CVE-2024-57728":{"s":7.2,"v":"HIGH","x":"SimpleHelp remote support software v5.5.7 and before allows admin users to upload arbitrary files anywhere on the file system by uploading a crafted zip file (i.e. zip slip). This can be exploited to execute arbitrary code on the host in the context of the SimpleHelp server user.","vp":"n/a n/a","t":"","p":1736899200000},"CVE-2024-57726":{"s":9.9,"v":"CRITICAL","x":"SimpleHelp remote support software v5.5.7 and before has a vulnerability that allows low-privileges technicians to create API keys with excessive permissions. These API keys can be used to escalate privileges to the server admin role.","vp":"n/a n/a","t":"","p":1736899200000},"CVE-2026-39987":{"s":9.3,"v":"CRITICAL","x":"marimo is a reactive Python notebook. Prior to 0.23.0, Marimo has a Pre-Auth RCE vulnerability. The terminal WebSocket endpoint /terminal/ws lacks authentication validation, allowing an unauthenticated attacker to obtain a full PTY shell and execute arbitrary system commands. Unlike other WebSocket endpoints (e.g.,…","vp":"marimo-team marimo","t":"marimo Affected by Pre-Auth Remote Code Execution via Terminal WebSocket Authentication Bypass","p":1775755015639},"CVE-2026-33825":{"s":7.8,"v":"HIGH","x":"Insufficient granularity of access control in Microsoft Defender allows an authorized attacker to elevate privileges locally.","vp":"Microsoft Microsoft Defender Antimalware Platform","t":"Microsoft Defender Elevation of Privilege Vulnerability","p":1776185869361},"CVE-2026-20122":{"s":5.4,"v":"MEDIUM","x":"A vulnerability in the API of Cisco Catalyst SD-WAN Manager could allow an authenticated, remote attacker to overwrite arbitrary files on the local file system. To exploit this vulnerability, the attacker must have valid read-only credentials with API access on the affected system.\r\n\r\nThis vulnerability is due to…","vp":"Cisco Cisco Catalyst SD-WAN Manager","t":"Cisco Catalyst SD-WAN Manager Arbitrary File Overwrite Vulnerability","p":1772036061256},"CVE-2026-20133":{"s":6.5,"v":"MEDIUM","x":"A vulnerability in Cisco Catalyst SD-WAN Software could allow an unauthenticated, remote attacker to view sensitive information on an affected system.\r\n\r This vulnerability is due to insufficient file system restrictions. An authenticated attacker with netadmin privileges could exploit this vulnerability by accessing…","vp":"Cisco Cisco Catalyst SD-WAN Manager","t":"","p":1772036036017},"CVE-2025-2749":{"s":7.2,"v":"HIGH","x":"An authenticated remote code execution in Kentico Xperience allows authenticated users Staging Sync Server to upload arbitrary data to path relative locations. This results in path traversal and arbitrary file upload, including content that can be executed server side leading to remote code execution.This issue…","vp":"Kentico Xperience","t":"Kentico Xperience <= 13.0.178 Staging Media File Upload Authenticated RCE","p":1742840287228},"CVE-2023-27351":{"s":8.2,"v":"HIGH","x":"This vulnerability allows remote attackers to bypass authentication on affected installations of PaperCut NG 22.0.5 (Build 63914). Authentication is not required to exploit this vulnerability. The specific flaw exists within the SecurityRequestFilter class. The issue results from improper implementation of the…","vp":"PaperCut NG","t":"","p":1681948800000},"CVE-2025-48700":{"s":6.1,"v":"MEDIUM","x":"An issue was discovered in Zimbra Collaboration (ZCS) 8.8.15 and 9.0 and 10.0 and 10.1. A Cross-Site Scripting (XSS) vulnerability in the Zimbra Classic UI allows attackers to execute arbitrary JavaScript within the user's session, potentially leading to unauthorized access to sensitive information. This issue arises…","vp":"n/a n/a","t":"","p":1750636800000},"CVE-2026-20128":{"s":7.5,"v":"HIGH","x":"A vulnerability in the Data Collection Agent (DCA) feature of Cisco Catalyst SD-WAN Manager could allow an unauthenticated, remote attacker to gain DCA user privileges on an affected system.\r\n\r\nThis vulnerability is due to the presence of a credential file for the DCA user on an affected system. An attacker could…","vp":"Cisco Cisco Catalyst SD-WAN Manager","t":"Cisco Catalyst SD-WAN Manager Information Disclosure Vulnerability","p":1772036052353},"CVE-2025-32975":{"s":10,"v":"CRITICAL","x":"Quest KACE Systems Management Appliance (SMA) 13.0.x before 13.0.385, 13.1.x before 13.1.81, 13.2.x before 13.2.183, 14.0.x before 14.0.341 (Patch 5), and 14.1.x before 14.1.101 (Patch 4) contains an authentication bypass vulnerability that allows attackers to impersonate legitimate users without valid credentials.…","vp":"n/a n/a","t":"","p":1750723200000},"CVE-2024-27199":{"s":7.3,"v":"HIGH","x":"In JetBrains TeamCity before 2023.11.4 path traversal allowing to perform limited admin actions  was possible","vp":"JetBrains TeamCity","t":"","p":1709572900081},"CVE-2009-0238":{"s":8.8,"v":"HIGH","x":"Microsoft Office Excel 2000 SP3, 2002 SP3, 2003 SP3, and 2007 SP1; Excel Viewer 2003 Gold and SP3; Excel Viewer; Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats SP1; and Excel in Microsoft Office 2004 and 2008 for Mac allow remote attackers to execute arbitrary code via a crafted Excel document…","vp":"n/a n/a","t":"","p":1235577600000},"CVE-2026-32201":{"s":6.5,"v":"MEDIUM","x":"Improper input validation in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network.","vp":"Microsoft Microsoft SharePoint Enterprise Server 2016","t":"Microsoft SharePoint Server Spoofing Vulnerability","p":1776185916981},"CVE-2012-1854":{"s":7.8,"v":"HIGH","x":"Untrusted search path vulnerability in VBE6.dll in Microsoft Office 2003 SP3, 2007 SP2 and SP3, and 2010 Gold and SP1; Microsoft Visual Basic for Applications (VBA); and Summit Microsoft Visual Basic for Applications SDK allows local users to gain privileges via a Trojan horse DLL in the current working directory, as…","vp":"n/a n/a","t":"","p":1341954000000},"CVE-2025-60710":{"s":7.8,"v":"HIGH","x":"Improper link resolution before file access ('link following') in Host Process for Windows Tasks allows an authorized attacker to elevate privileges locally.","vp":"Microsoft Windows 11 Version 24H2","t":"Host Process for Windows Tasks Elevation of Privilege Vulnerability","p":1762883965479},"CVE-2023-21529":{"s":8.8,"v":"HIGH","x":"Microsoft Exchange Server Remote Code Execution Vulnerability","vp":"Microsoft Microsoft Exchange Server 2013 Cumulative Update 23","t":"Microsoft Exchange Server Remote Code Execution Vulnerability","p":1676403180590},"CVE-2023-36424":{"s":7.8,"v":"HIGH","x":"Windows Common Log File System Driver Elevation of Privilege Vulnerability","vp":"Microsoft Windows 11 version 22H3","t":"Windows Common Log File System Driver Elevation of Privilege Vulnerability","p":1699984628919},"CVE-2020-9715":{"s":7.8,"v":"HIGH","x":"Adobe Acrobat and Reader versions 2020.009.20074 and earlier, 2020.001.30002, 2017.011.30171 and earlier, and 2015.006.30523 and earlier have an use-after-free vulnerability. Successful exploitation could lead to arbitrary code execution .","vp":"Adobe Adobe Acrobat and Reader","t":"","p":1597795200000},"CVE-2026-21643":{"s":9.1,"v":"CRITICAL","x":"An improper neutralization of special elements used in an sql command ('sql injection') vulnerability in Fortinet FortiClientEMS 7.4.4 may allow an unauthenticated attacker to execute unauthorized code or commands via specifically crafted HTTP requests.","vp":"Fortinet FortiClientEMS","t":"","p":1770366283877},"CVE-2026-34621":{"s":8.6,"v":"HIGH","x":"Acrobat Reader versions 24.001.30356, 26.001.21367 and earlier are affected by an Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user…","vp":"Adobe Acrobat DC","t":"Acrobat Reader | Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') (CWE-1321)","p":1775889943512},"CVE-2026-1340":{"s":9.8,"v":"CRITICAL","x":"A code injection in Ivanti Endpoint Manager Mobile allowing attackers to achieve unauthenticated remote code execution.","vp":"Ivanti Endpoint Manager Mobile","t":"","p":1769722391768},"CVE-2026-3502":{"s":7.8,"v":"HIGH","x":"TrueConf Client downloads application update code and applies it without performing verification. An attacker who is able to influence the update delivery path can substitute a tampered update payload. If the payload is executed or installed by the updater, this may result in arbitrary code execution in the context of…","vp":"TrueConf TrueConf Client","t":"TrueConf Client Update Integrity Verification Bypass","p":1774893942806},"CVE-2026-5281":{"s":8.8,"v":"HIGH","x":"Use after free in Dawn in Google Chrome prior to 146.0.7680.178 allowed a remote attacker who had compromised the renderer process to execute arbitrary code via a crafted HTML page. (Chromium security severity: High)","vp":"Google Chrome","t":"","p":1775018492723},"CVE-2026-3055":{"s":9.3,"v":"CRITICAL","x":"Insufficient input validation in NetScaler ADC and NetScaler Gateway when configured as a SAML IDP leading to memory overread","vp":"NetScaler ADC","t":"Insufficient input validation leading to memory overread","p":1774297287107},"CVE-2025-53521":{"s":9.8,"v":"CRITICAL","x":"When a BIG-IP APM access policy is configured on a virtual server, specific malicious traffic can lead to Remote Code Execution (RCE).  \n\nNote: Software versions which have reached End of Technical Support (EoTS) are not evaluated.","vp":"F5 BIG-IP","t":"BigIP APM Vulnerability","p":1760536552694},"CVE-2026-33634":{"s":9.4,"v":"CRITICAL","x":"Trivy is a security scanner. On March 19, 2026, a threat actor used compromised credentials to publish a malicious Trivy v0.69.4 release, force-push 76 of 77 version tags in `aquasecurity/trivy-action` to credential-stealing malware, and replace all 7 tags in `aquasecurity/setup-trivy` with malicious commits. This…","vp":"aquasecurity setup-trivy","t":"Trivy ecosystem supply chain briefly compromised","p":1774302449636},"CVE-2026-33017":{"s":9.3,"v":"CRITICAL","x":"Langflow is a tool for building and deploying AI-powered agents and workflows. In versions prior to 1.9.0, the POST /api/v1/build_public_tmp/{flow_id}/flow endpoint allows building public flows without requiring authentication. When the optional data parameter is supplied, the endpoint uses attacker-controlled flow…","vp":"langflow-ai langflow","t":"Langflow has Unauthenticated Remote Code Execution via Public Flow Build Endpoint","p":1773982372885},"CVE-2025-32432":{"s":10,"v":"CRITICAL","x":"Craft is a flexible, user-friendly CMS for creating custom digital experiences on the web and beyond. Starting from version 3.0.0-RC1 to before 3.9.15, 4.0.0-RC1 to before 4.14.15, and 5.0.0-RC1 to before 5.6.17, Craft is vulnerable to remote code execution. This is a high-impact, low-complexity attack vector. This…","vp":"craftcms cms","t":"Craft CMS Allows Remote Code Execution","p":1745593446272},"CVE-2025-54068":{"s":9.2,"v":"CRITICAL","x":"Livewire is a full-stack framework for Laravel. In Livewire v3 up to and including v3.6.3, a vulnerability allows unauthenticated attackers to achieve remote command execution in specific scenarios. The issue stems from how certain component property updates are hydrated. This vulnerability is unique to Livewire v3…","vp":"livewire livewire","t":"Livewire vulnerable to remote command execution during property update hydration","p":1752776216099},"CVE-2025-43510":{"s":7.8,"v":"HIGH","x":"A memory corruption issue was addressed with improved lock state checking. This issue is fixed in iOS 18.7.2 and iPadOS 18.7.2, iOS 26.1 and iPadOS 26.1, macOS Sequoia 15.7.2, macOS Sonoma 14.8.2, macOS Tahoe 26.1, tvOS 26.1, visionOS 26.1, watchOS 26.1. A malicious application may cause unexpected changes in memory…","vp":"Apple iOS and iPadOS","t":"","p":1765572998131},"CVE-2025-43520":{"s":5.5,"v":"MEDIUM","x":"A memory corruption issue was addressed with improved memory handling. This issue is fixed in iOS 18.7.2 and iPadOS 18.7.2, iOS 26.1 and iPadOS 26.1, macOS Sequoia 15.7.2, macOS Sonoma 14.8.2, macOS Tahoe 26.1, tvOS 26.1, visionOS 26.1, watchOS 26.1. A malicious application may be able to cause unexpected system…","vp":"Apple iOS and iPadOS","t":"","p":1765572985542},"CVE-2025-31277":{"s":8.8,"v":"HIGH","x":"The issue was addressed with improved memory handling. This issue is fixed in Safari 18.6, iOS 18.6 and iPadOS 18.6, macOS Sequoia 15.6, tvOS 18.6, visionOS 2.6, watchOS 11.6. Processing maliciously crafted web content may lead to memory corruption.","vp":"Apple Safari","t":"","p":1753831771341},"CVE-2026-20131":{"s":10,"v":"CRITICAL","x":"A vulnerability in the web-based management interface of Cisco Secure Firewall Management Center (FMC) Software could allow an unauthenticated, remote attacker to execute arbitrary Java code as root&nbsp;on an affected device.\r\n\r\nThis vulnerability is due to insecure deserialization of a user-supplied Java byte…","vp":"Cisco Cisco Secure Firewall Management Center (FMC)","t":"Cisco Secure Firewall Management Center Software Remote Code Execution Vulnerability","p":1772644676008},"CVE-2025-66376":{"s":7.2,"v":"HIGH","x":"Zimbra Collaboration (ZCS) 10 before 10.0.18 and 10.1 before 10.1.13 allows Classic UI stored XSS via Cascading Style Sheets (CSS) @import directives in an HTML e-mail message.","vp":"Zimbra Collaboration","t":"","p":1767571200000},"CVE-2026-20963":{"s":9.8,"v":"CRITICAL","x":"Deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attacker to execute code over a network.","vp":"Microsoft Microsoft SharePoint Enterprise Server 2016","t":"Microsoft SharePoint Remote Code Execution Vulnerability","p":1768327009798},"CVE-2025-47813":{"s":4.3,"v":"MEDIUM","x":"loginok.html in Wing FTP Server before 7.4.4 discloses the full local installation path of the application when using a long value in the UID cookie.","vp":"wftpserver Wing FTP Server","t":"","p":1752105600000},"CVE-2026-3910":{"s":8.8,"v":"HIGH","x":"Inappropriate implementation in V8 in Google Chrome prior to 146.0.7680.75 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)","vp":"Google Chrome","t":"","p":1773351051861},"CVE-2026-3909":{"s":8.8,"v":"HIGH","x":"Out of bounds write in Skia in Google Chrome prior to 146.0.7680.75 allowed a remote attacker to perform out of bounds memory access via a crafted HTML page. (Chromium security severity: High)","vp":"Google Chrome","t":"","p":1773351051265},"CVE-2025-68613":{"s":10,"v":"CRITICAL","x":"n8n is an open source workflow automation platform. Versions starting with 0.211.0 and prior to 1.120.4, 1.121.1, and 1.122.0 contain a critical Remote Code Execution (RCE) vulnerability in their workflow expression evaluation system. Under certain conditions, expressions supplied by authenticated users during…","vp":"n8n-io n8n","t":"n8n Vulnerable to Remote Code Execution via Expression Injection","p":1766183027777},"CVE-2021-22054":{"s":7.5,"v":"HIGH","x":"VMware Workspace ONE UEM console 20.0.8 prior to 20.0.8.37, 20.11.0 prior to 20.11.0.40, 21.2.0 prior to 21.2.0.27, and 21.5.0 prior to 21.5.0.37 contain an SSRF vulnerability. This issue may allow a malicious actor with network access to UEM to send their requests without authentication and to gain access to…","vp":"n/a VMware Workspace ONE UEM console","t":"","p":1639757418000},"CVE-2025-26399":{"s":9.8,"v":"CRITICAL","x":"SolarWinds Web Help Desk was found to be susceptible to an unauthenticated AjaxProxy deserialization remote code execution vulnerability that, if exploited, would allow an attacker to run commands on the host machine. This vulnerability is a patch bypass of CVE-2024-28988, which in turn is a patch bypass of…","vp":"SolarWinds Web Help Desk","t":"SolarWinds Web Help Desk Deserialization of Untrusted Data Privilege Escalation Vulnerability","p":1758604034702},"CVE-2026-1603":{"s":8.6,"v":"HIGH","x":"An authentication bypass in Ivanti Endpoint Manager before version 2024 SU5 allows a remote unauthenticated attacker to leak specific stored credential data.","vp":"Ivanti Endpoint Manager","t":"","p":1770736175459},"CVE-2017-7921":{"s":9.8,"v":"CRITICAL","x":"An Improper Authentication issue was discovered in Hikvision DS-2CD2xx2F-I Series V5.2.0 build 140721 to V5.4.0 build 160530, DS-2CD2xx0F-I Series V5.2.0 build 140721 to V5.4.0 Build 160401, DS-2CD2xx2FWD Series V5.3.1 build 150410 to V5.4.4 Build 161125, DS-2CD4x2xFWD Series V5.2.0 build 140721 to V5.4.0 Build…","vp":"n/a Hikvision Cameras","t":"","p":1494028800000},"CVE-2021-22681":{"s":9.8,"v":"CRITICAL","x":"Rockwell Automation Studio 5000 Logix Designer Versions 21 and later, and RSLogix 5000 Versions 16 through 20 use a key to verify Logix controllers are communicating with Rockwell Automation CompactLogix 1768, 1769, 5370, 5380, 5480: ControlLogix 5550, 5560, 5570, 5580; DriveLogix 5560, 5730, 1794-L34; Compact…","vp":"n/a Rockwell Automation Studio 5000 Logix Designer, RSLogix 5000, Logix Controllers","t":"","p":1614794383000},"CVE-2023-43000":{"s":8.8,"v":"HIGH","x":"A use-after-free issue was addressed with improved memory management. This issue is fixed in macOS Ventura 13.5, iOS 16.6 and iPadOS 16.6, Safari 16.6, iOS 15.8.7 and iPadOS 15.8.7. Processing maliciously crafted web content may lead to memory corruption.","vp":"Apple macOS","t":"","p":1762367603777},"CVE-2021-30952":{"s":8.8,"v":"HIGH","x":"An integer overflow was addressed with improved input validation. This issue is fixed in tvOS 15.2, macOS Monterey 12.1, Safari 15.2, iOS 15.2 and iPadOS 15.2, watchOS 8.3. Processing maliciously crafted web content may lead to arbitrary code execution.","vp":"Apple watchOS","t":"","p":1629831052000},"CVE-2023-41974":{"s":7.8,"v":"HIGH","x":"A use-after-free issue was addressed with improved memory management. This issue is fixed in iOS 17 and iPadOS 17, iOS 15.8.7 and iPadOS 15.8.7. An app may be able to execute arbitrary code with kernel privileges.","vp":"Apple iOS and iPadOS","t":"","p":1704924203430},"CVE-2026-22719":{"s":8.1,"v":"HIGH","x":"VMware Aria Operations contains a command injection vulnerability. A malicious unauthenticated actor may exploit this issue to execute arbitrary commands which may lead to remote code execution in VMware Aria Operations while support-assisted product migration is in progress. \n\nTo remediate CVE-2026-22719, apply the…","vp":"VMware VMware Aria Operations","t":"VMware Aria Operations command injection vulnerability","p":1772047139269},"CVE-2026-21385":{"s":7.8,"v":"HIGH","x":"Memory corruption while using alignments for memory allocation.","vp":"Qualcomm, Inc. Snapdragon","t":"Integer Overflow or Wraparound in Graphics","p":1772470439406},"CVE-2022-20775":{"s":7.8,"v":"HIGH","x":"A vulnerability in the CLI of Cisco SD-WAN Software could allow an authenticated, local attacker to gain elevated privileges.\r\n\r\nThis vulnerability is due to improper access controls on commands within the application CLI. An attacker could exploit this vulnerability by running a maliciously crafted command on the…","vp":"Cisco Cisco Catalyst SD-WAN","t":"Cisco SD-WAN Software Privilege Escalation Vulnerability","p":1664563526687},"CVE-2026-20127":{"s":10,"v":"CRITICAL","x":"A vulnerability in the peering authentication in Cisco Catalyst SD-WAN Controller, formerly SD-WAN vSmart, Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, and Cisco Catalyst SD-WAN Validator, formerly SD-WAN vBond, could allow an unauthenticated, remote attacker to bypass authentication and obtain…","vp":"Cisco Cisco Catalyst SD-WAN Manager","t":"Cisco Catalyst SD-WAN Controller Authentication Bypass Vulnerability","p":1772036060137},"CVE-2026-25108":{"s":8.7,"v":"HIGH","x":"FileZen contains an OS command injection vulnerability. When FileZen Antivirus Check Option is enabled, a logged-in user may send a specially crafted HTTP request to execute an arbitrary OS command.","vp":"Soliton Systems K.K. FileZen","t":"","p":1770953943795},"CVE-2025-49113":{"s":9.9,"v":"CRITICAL","x":"Roundcube Webmail before 1.5.10 and 1.6.x before 1.6.11 allows remote code execution by authenticated users because the _from parameter in a URL is not validated in program/actions/settings/upload.php, leading to PHP Object Deserialization.","vp":"Roundcube Webmail","t":"","p":1748822400000},"CVE-2025-68461":{"s":7.2,"v":"HIGH","x":"Roundcube Webmail before 1.5.12 and 1.6 before 1.6.12 is prone to a Cross-Site-Scripting (XSS) vulnerability via the animate tag in an SVG document.","vp":"Roundcube Webmail","t":"","p":1766034054423},"CVE-2021-22175":{"s":6.8,"v":"MEDIUM","x":"When requests to the internal network for webhooks are enabled, a server-side request forgery vulnerability in GitLab affecting all versions starting from 10.5 was possible to exploit for an unauthenticated attacker even on a GitLab instance where registration is disabled","vp":"GitLab GitLab","t":"","p":1623425412000},"CVE-2026-22769":{"s":10,"v":"CRITICAL","x":"Dell RecoverPoint for Virtual Machines, versions prior to 6.0.3.1 HF1, contain a hardcoded credential vulnerability. This is considered critical as an unauthenticated remote attacker with knowledge of the hardcoded credential could potentially exploit this vulnerability leading to unauthorized access to the underlying…","vp":"Dell RecoverPoint for Virtual Machines","t":"","p":1771355974178},"CVE-2020-7796":{"s":9.8,"v":"CRITICAL","x":"Zimbra Collaboration Suite (ZCS) before 8.8.15 Patch 7 allows SSRF when WebEx zimlet is installed and zimlet JSP is enabled.","vp":"n/a n/a","t":"","p":1582060462000},"CVE-2024-7694":{"s":7.2,"v":"HIGH","x":"ThreatSonar Anti-Ransomware from TeamT5 does not properly validate the content of uploaded files. Remote attackers with  administrator privileges on the product platform can upload malicious files, which can be used to execute arbitrary system command on the server.","vp":"TeamT5 ThreatSonar Anti-Ransomware","t":"TeamT5 ThreatSonar Anti-Ransomware - Arbitrary File Upload","p":1723431655680},"CVE-2008-0015":{"s":8.8,"v":"HIGH","x":"Stack-based buffer overflow in the CComVariant::ReadFromStream function in the Active Template Library (ATL), as used in the MPEG2TuneRequest ActiveX control in msvidctl.dll in DirectShow, in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP2, Vista Gold, SP1, and SP2, and Server 2008 Gold and SP2 allows…","vp":"n/a n/a","t":"","p":1247007600000},"CVE-2026-2441":{"s":8.8,"v":"HIGH","x":"Use after free in CSS in Google Chrome prior to 145.0.7632.75 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)","vp":"Google Chrome","t":"","p":1771007268355},"CVE-2026-1731":{"s":9.9,"v":"CRITICAL","x":"BeyondTrust Remote Support (RS) and certain older versions of Privileged Remote Access (PRA) contain a critical pre-authentication remote code execution vulnerability. By sending specially crafted requests, an unauthenticated remote attacker may be able to execute operating system commands in the context of the site…","vp":"BeyondTrust Remote Support(RS) & Privileged Remote Access(PRA)","t":"Remote code execution vulnerability in BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA)","p":1770414560844},"CVE-2026-20700":{"s":7.8,"v":"HIGH","x":"A memory corruption issue was addressed with improved state management. This issue is fixed in iOS 26.3 and iPadOS 26.3, macOS Tahoe 26.3, tvOS 26.3, visionOS 26.3, watchOS 26.3. An attacker with memory write capability may be able to execute arbitrary code. Apple is aware of a report that this issue may have been…","vp":"Apple iOS and iPadOS","t":"","p":1770850734448},"CVE-2024-43468":{"s":9.8,"v":"CRITICAL","x":"Microsoft Configuration Manager Remote Code Execution Vulnerability","vp":"Microsoft Microsoft Configuration Manager","t":"Microsoft Configuration Manager Remote Code Execution Vulnerability","p":1728408948428},"CVE-2025-15556":{"s":7.7,"v":"HIGH","x":"Notepad++ versions prior to 8.8.9, when using the WinGUp updater, contain an update integrity verification vulnerability where downloaded update metadata and installers are not cryptographically verified. An attacker able to intercept or redirect update traffic can cause the updater to download and execute an…","vp":"notepad-plus-plus notepad-plus-plus","t":"Notepad++ < 8.8.9 WinGUp Updater Lacks Update Integrity Verification","p":1770079829516},"CVE-2025-40536":{"s":8.1,"v":"HIGH","x":"SolarWinds Web Help Desk was found to be susceptible to a security control bypass vulnerability that if exploited, could allow an unauthenticated attacker to gain access to certain restricted functionality.","vp":"SolarWinds Web Help Desk","t":"SolarWinds Web Help Desk Security Control Bypass Vulnerability","p":1769585409503},"CVE-2026-21513":{"s":8.8,"v":"HIGH","x":"Protection mechanism failure in MSHTML Framework allows an unauthorized attacker to bypass a security feature over a network.","vp":"Microsoft Windows 10 Version 1607","t":"MSHTML Framework Security Feature Bypass Vulnerability","p":1770745886733},"CVE-2026-21525":{"s":6.2,"v":"MEDIUM","x":"Null pointer dereference in Windows Remote Access Connection Manager allows an unauthorized attacker to deny service locally.","vp":"Microsoft Windows 10 Version 1607","t":"Windows Remote Access Connection Manager Denial of Service Vulnerability","p":1770745894755},"CVE-2026-21510":{"s":8.8,"v":"HIGH","x":"Protection mechanism failure in Windows Shell allows an unauthorized attacker to bypass a security feature over a network.","vp":"Microsoft Windows 10 Version 1607","t":"Windows Shell Security Feature Bypass Vulnerability","p":1770745892210},"CVE-2026-21533":{"s":7.8,"v":"HIGH","x":"Improper privilege management in Windows Remote Desktop allows an authorized attacker to elevate privileges locally.","vp":"Microsoft Windows 10 Version 1607","t":"Windows Remote Desktop Services Elevation of Privilege Vulnerability","p":1770745886211},"CVE-2026-21519":{"s":7.8,"v":"HIGH","x":"Access of resource using incompatible type ('type confusion') in Desktop Window Manager allows an authorized attacker to elevate privileges locally.","vp":"Microsoft Windows 10 Version 1607","t":"Desktop Window Manager Elevation of Privilege Vulnerability","p":1770745873956},"CVE-2026-21514":{"s":7.8,"v":"HIGH","x":"Reliance on untrusted inputs in a security decision in Microsoft Office Word allows an unauthorized attacker to bypass a security feature locally.","vp":"Microsoft Microsoft 365 Apps for Enterprise","t":"Microsoft Word Security Feature Bypass Vulnerability","p":1770745894153},"CVE-2025-11953":{"s":9.8,"v":"CRITICAL","x":"The Metro Development Server, which is opened by the React Native Community CLI, binds to external interfaces by default. The server exposes an endpoint that is vulnerable to OS command injection. This allows unauthenticated network attackers to send a POST request to the server and run arbitrary executables. On…","vp":"","t":"Command injection in React Native Community CLI allows remote attackers to perform remote code execution by sending HTTP requests","p":1762187707168},"CVE-2026-24423":{"s":9.3,"v":"CRITICAL","x":"SmarterTools SmarterMail versions prior to build 9511 contain an unauthenticated remote code execution vulnerability in the ConnectToHub API method. The attacker could point the SmarterMail to the malicious HTTP server, which serves the malicious OS command. This command will be executed by the vulnerable application.","vp":"SmarterTools SmarterMail","t":"SmarterTools SmarterMail < Build 9511 Unauthenticated RCE via ConnectToHub API","p":1769187214951},"CVE-2021-39935":{"s":6.8,"v":"MEDIUM","x":"An issue has been discovered in GitLab CE/EE affecting all versions starting from 10.5 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting from 14.5 before 14.5.2. Unauthorized external users could perform Server Side Requests via the CI Lint API","vp":"GitLab GitLab","t":"","p":1639410479000},"CVE-2025-64328":{"s":8.6,"v":"HIGH","x":"FreePBX Endpoint Manager is a module for managing telephony endpoints in FreePBX systems. In versions 17.0.2.36 and above before 17.0.3, the filestore module within the Administrative interface is vulnerable to a post-authentication command injection by an authenticated known user via the testconnection ->…","vp":"FreePBX filestore","t":"FreePBX Administration GUI is Vulnerable to Authenticated Command Injection","p":1762486340670},"CVE-2019-19006":{"s":9.8,"v":"CRITICAL","x":"Sangoma FreePBX 115.0.16.26 and below, 14.0.13.11 and below, 13.0.197.13 and below have Incorrect Access Control.","vp":"n/a n/a","t":"","p":1574358674000},"CVE-2025-40551":{"s":9.8,"v":"CRITICAL","x":"SolarWinds Web Help Desk was found to be susceptible to an untrusted data deserialization vulnerability that could lead to remote code execution, which would allow an attacker to run commands on the host machine. This could be exploited without authentication.","vp":"SolarWinds Web Help Desk","t":"SolarWinds Web Help Desk Deserialization of Untrusted Data Remote Code Execution Vulnerability","p":1769585589603},"CVE-2026-1281":{"s":9.8,"v":"CRITICAL","x":"A code injection in Ivanti Endpoint Manager Mobile allowing attackers to achieve unauthenticated remote code execution.","vp":"Ivanti Endpoint Manager Mobile","t":"","p":1769722277041},"CVE-2026-24858":{"s":9.4,"v":"CRITICAL","x":"An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.5, FortiAnalyzer 7.4.0 through 7.4.9, FortiAnalyzer 7.2.0 through 7.2.11, FortiAnalyzer 7.0.0 through 7.0.15, FortiManager 7.6.0 through 7.6.5, FortiManager 7.4.0 through 7.4.9,…","vp":"Fortinet FortiWeb","t":"","p":1769541503591},"CVE-2018-14634":{"s":7.8,"v":"HIGH","x":"An integer overflow flaw was found in the Linux kernel's create_elf_tables() function. An unprivileged local user with access to SUID (or otherwise privileged) binary could use this flaw to escalate their privileges on the system. Kernel versions 2.6.x, 3.10.x and 4.14.x are believed to be vulnerable.","vp":"The Linux Foundation kernel","t":"","p":1537909200000},"CVE-2025-52691":{"s":10,"v":"CRITICAL","x":"Successful exploitation of the vulnerability could allow an unauthenticated attacker to upload arbitrary files to any location on the mail server, potentially enabling remote code execution.","vp":"SmarterTools SmarterMail","t":"Upload Arbitrary Files","p":1766974558200},"CVE-2026-23760":{"s":9.3,"v":"CRITICAL","x":"SmarterTools SmarterMail versions prior to build 9511 contain an authentication bypass vulnerability in the password reset API. The force-reset-password endpoint permits anonymous requests and fails to verify the existing password or a reset token when resetting system administrator accounts. An unauthenticated…","vp":"SmarterTools SmarterMail","t":"SmarterTools SmarterMail < Build 9511 Authentication Bypass via Password Reset API","p":1769092517235},"CVE-2026-24061":{"s":9.8,"v":"CRITICAL","x":"telnetd in GNU Inetutils through 2.7 allows remote authentication bypass via a \"-f root\" value for the USER environment variable.","vp":"GNU Inetutils","t":"","p":1768977737134},"CVE-2026-21509":{"s":7.8,"v":"HIGH","x":"Reliance on untrusted inputs in a security decision in Microsoft Office allows an unauthorized attacker to bypass a security feature locally.","vp":"Microsoft Microsoft 365 Apps for Enterprise","t":"Microsoft Office Security Feature Bypass Vulnerability","p":1769447195512},"CVE-2024-37079":{"s":9.8,"v":"CRITICAL","x":"vCenter Server contains a heap-overflow vulnerability in the implementation of the DCERPC protocol. A malicious actor with network access to vCenter Server may trigger this vulnerability by sending a specially crafted network packet potentially leading to remote code execution.","vp":"n/a VMware vCenter Server","t":"","p":1718689386619},"CVE-2025-68645":{"s":8.8,"v":"HIGH","x":"A Local File Inclusion (LFI) vulnerability exists in the Webmail Classic UI of Zimbra Collaboration (ZCS) 10.0 and 10.1 because of improper handling of user-supplied request parameters in the RestFilter servlet. An unauthenticated remote attacker can craft requests to the /h/rest endpoint to influence internal request…","vp":"n/a n/a","t":"","p":1766361600000},"CVE-2025-34026":{"s":9.2,"v":"CRITICAL","x":"The Versa Concerto SD-WAN orchestration platform is vulnerable to an authentication bypass in the Traefik reverse proxy configuration, allowing at attacker to access administrative endpoints. The internal Actuator endpoint can be leveraged for access to heap dumps and trace logs.This issue is known to affect Concerto…","vp":"Versa Concerto","t":"Versa Concerto Actuator Authentication Bypass Information Leak","p":1747865098832},"CVE-2025-31125":{"s":5.3,"v":"MEDIUM","x":"Vite is a frontend tooling framework for javascript. Vite exposes content of non-allowed files using ?inline&import or ?raw?import. Only apps explicitly exposing the Vite dev server to the network (using --host or server.host config option) are affected. This vulnerability is fixed in 6.2.4, 6.1.3, 6.0.13, 5.4.16, and…","vp":"vitejs vite","t":"Vite has a `server.fs.deny` bypassed for `inline` and `raw` with `?import` query","p":1743440790704},"CVE-2025-54313":{"s":7.5,"v":"HIGH","x":"eslint-config-prettier 8.10.1, 9.1.1, 10.1.6, and 10.1.7 has embedded malicious code for a supply chain compromise. Installing an affected package executes an install.js file that launches the node-gyp.dll malware on Windows.","vp":"prettier eslint-config-prettier","t":"","p":1752883200000},"CVE-2026-20045":{"s":8.2,"v":"HIGH","x":"A vulnerability in Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager Session Management Edition (Unified CM SME), Cisco Unified Communications Manager IM &amp; Presence Service (Unified CM IM&amp;P), Cisco Unity Connection, and Cisco Webex Calling Dedicated Instance could allow an…","vp":"Cisco Cisco Unified Communications Manager","t":"Cisco Unified Communications Products Remote Code Execution Vulnerability","p":1769012780312},"CVE-2026-20805":{"s":5.5,"v":"MEDIUM","x":"Exposure of sensitive information to an unauthorized actor in Desktop Windows Manager allows an authorized attacker to disclose information locally.","vp":"Microsoft Windows 10 Version 1607","t":"Desktop Window Manager Information Disclosure Vulnerability","p":1768326968339},"CVE-2025-8110":{"s":8.7,"v":"HIGH","x":"Improper Symbolic link handling in the PutContents API in Gogs allows Local Execution of Code.","vp":"Gogs Gogs","t":"File overwrite in file update API in Gogs","p":1765373026777},"CVE-2009-0556":{"s":8.8,"v":"HIGH","x":"Microsoft Office PowerPoint 2000 SP3, 2002 SP3, and 2003 SP3, and PowerPoint in Microsoft Office 2004 for Mac, allows remote attackers to execute arbitrary code via a PowerPoint file with an OutlineTextRefAtom containing an an invalid index value that triggers memory corruption, as exploited in the wild in April 2009…","vp":"n/a n/a","t":"","p":1238781600000},"CVE-2025-37164":{"s":10,"v":"CRITICAL","x":"A remote code execution issue exists in HPE OneView.","vp":"Hewlett Packard Enterprise (HPE) HPE OneView","t":"","p":1765902634524},"CVE-2025-14847":{"s":7.5,"v":"HIGH","x":"Mismatched length fields in Zlib compressed protocol headers may allow a read of uninitialized heap memory by an unauthenticated client. This issue affects all MongoDB Server v7.0 prior to 7.0.28 versions, MongoDB Server v8.0 versions prior to 8.0.17, MongoDB Server v8.2 versions prior to 8.2.3, MongoDB Server v6.0…","vp":"MongoDB Inc. MongoDB Server","t":"Zlib compressed protocol header length confusion may allow memory read","p":1766142022465},"CVE-2023-52163":{"s":8.8,"v":"HIGH","x":"Digiever DS-2105 Pro 3.1.0.71-11 devices allow time_tzsetup.cgi Command Injection. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.","vp":"n/a n/a","t":"","p":1738540800000},"CVE-2025-14733":{"s":9.3,"v":"CRITICAL","x":"An Out-of-bounds Write vulnerability in the WatchGuard Fireware OS iked process may allow a remote unauthenticated attacker to execute arbitrary code. This vulnerability affects both the mobile user VPN with IKEv2 and the branch office VPN using IKEv2 when configured with a dynamic gateway peer.\n\nIf the Firebox was…","vp":"WatchGuard Fireware OS","t":"WatchGuard Firebox iked Out of Bounds Write Vulnerability","p":1766102515722},"CVE-2025-59374":{"s":9.3,"v":"CRITICAL","x":"\"UNSUPPORTED WHEN ASSIGNED\" Certain versions of the ASUS Live Update client were distributed with unauthorized modifications introduced through a supply chain compromise. The modified builds could cause devices meeting specific targeting conditions to perform unintended actions. Only devices that met these conditions…","vp":"ASUS live update","t":"","p":1765945626885},"CVE-2025-40602":{"s":6.6,"v":"MEDIUM","x":"A local privilege escalation vulnerability due to insufficient authorization in the SonicWall SMA1000 appliance management console (AMC).","vp":"SonicWall SMA1000","t":"","p":1766055521668},"CVE-2025-20393":{"s":10,"v":"CRITICAL","x":"A vulnerability in the Spam Quarantine feature of Cisco AsyncOS Software for Cisco Secure Email Gateway and Cisco Secure Email and Web Manager could allow an unauthenticated, remote attacker to execute arbitrary system commands on an affected device with root privileges.\r\n\r\nThis vulnerability is due to insufficient…","vp":"Cisco Cisco Secure Email","t":"Cisco Secure Email Gateway and Cisco Secure Email and Web Manager Remote Command Execution Vulnerability","p":1765990033128},"CVE-2025-59718":{"s":9.1,"v":"CRITICAL","x":"A improper verification of cryptographic signature vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, FortiOS 7.2.0 through 7.2.11, FortiOS 7.0.0 through 7.0.17, FortiProxy 7.6.0 through 7.6.3, FortiProxy 7.4.0 through 7.4.10, FortiProxy 7.2.0 through 7.2.14, FortiProxy 7.0.0 through…","vp":"Fortinet FortiSwitchManager","t":"","p":1765300811783},"CVE-2025-14611":{"s":7.1,"v":"HIGH","x":"Gladinet CentreStack and Triofox prior to version 16.12.10420.56791 used hardcoded values for their implementation of the AES cryptoscheme. This degrades security for public exposed endpoints that may make use of it and may offer arbitrary local file inclusion when provided a specially crafted request without…","vp":"Gladinet CentreStack and TrioFox","t":"Gladinet CentreStack and TrioFox Hard Coded AES Keys","p":1765573273116},"CVE-2025-43529":{"s":8.8,"v":"HIGH","x":"A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.2, iOS 18.7.3 and iPadOS 18.7.3, iOS 26.2 and iPadOS 26.2, macOS Tahoe 26.2, tvOS 26.2, visionOS 26.2, watchOS 26.2. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of…","vp":"Apple Safari","t":"","p":1766004415691},"CVE-2018-4063":{"s":8.8,"v":"HIGH","x":"An exploitable remote code execution vulnerability exists in the upload.cgi functionality of Sierra Wireless AirLink ES450 FW 4.9.3. A specially crafted HTTP request can upload a file, resulting in executable code being uploaded, and routable, to the webserver. An attacker can make an authenticated HTTP request to…","vp":"n/a Sierra Wireless","t":"","p":1557168211000},"CVE-2025-14174":{"s":8.8,"v":"HIGH","x":"Out of bounds memory access in ANGLE in Google Chrome on Mac prior to 143.0.7499.110 allowed a remote attacker to perform out of bounds memory access via a crafted HTML page. (Chromium security severity: High)","vp":"Google Chrome","t":"","p":1765567241809},"CVE-2025-58360":{"s":8.2,"v":"HIGH","x":"GeoServer is an open source server that allows users to share and edit geospatial data. From version 2.26.0 to before 2.26.2 and before 2.25.6, an XML External Entity (XXE) vulnerability was identified. The application accepts XML input through a specific endpoint /geoserver/wms operation GetMap. However, this input…","vp":"geoserver geoserver","t":"GeoServer is vulnerable to an Unauthenticated XML External Entities (XXE) attack via WMS GetMap feature","p":1764101855254},"CVE-2025-6218":{"s":7.8,"v":"HIGH","x":"RARLAB WinRAR Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of RARLAB WinRAR. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.…","vp":"RARLAB WinRAR","t":"RARLAB WinRAR Directory Traversal Remote Code Execution Vulnerability","p":1750464542884},"CVE-2025-62221":{"s":7.8,"v":"HIGH","x":"Use after free in Windows Cloud Files Mini Filter Driver allows an authorized attacker to elevate privileges locally.","vp":"Microsoft Windows 10 Version 1809","t":"Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability","p":1765302970169},"CVE-2022-37055":{"s":9.8,"v":"CRITICAL","x":"D-Link Go-RT-AC750 GORTAC750_revA_v101b03 and GO-RT-AC750_revB_FWv200b02 are vulnerable to Buffer Overflow via cgibin, hnap_main,","vp":"n/a n/a","t":"","p":1661702721000},"CVE-2025-66644":{"s":7.2,"v":"HIGH","x":"Array Networks ArrayOS AG before 9.4.5.9 allows command injection, as exploited in the wild in August through December 2025.","vp":"Array Networks ArrayOS AG","t":"","p":1764892800000},"CVE-2025-55182":{"s":10,"v":"CRITICAL","x":"A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. The vulnerable code unsafely deserializes payloads from HTTP…","vp":"Meta react-server-dom-webpack","t":"","p":1764776456894},"CVE-2021-26828":{"s":8.8,"v":"HIGH","x":"OpenPLC ScadaBR through 0.9.1 on Linux and through 1.12.4 on Windows allows remote authenticated users to upload and execute arbitrary JSP files via view_edit.shtm.","vp":"n/a n/a","t":"","p":1623409858000},"CVE-2025-48633":{"s":5.5,"v":"MEDIUM","x":"In hasAccountsOnAnyUser of DevicePolicyManagerService.java, there is a possible way to add a Device Owner after provisioning due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","vp":"Google Android","t":"","p":1765213069260},"CVE-2025-48572":{"s":7.8,"v":"HIGH","x":"In multiple locations, there is a possible way to launch activities from the background due to a permissions bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","vp":"Google Android","t":"","p":1765213027461},"CVE-2021-26829":{"s":5.4,"v":"MEDIUM","x":"OpenPLC ScadaBR through 0.9.1 on Linux and through 1.12.4 on Windows allows stored XSS via system_settings.shtm.","vp":"n/a n/a","t":"","p":1623409523000},"CVE-2025-61757":{"s":9.8,"v":"CRITICAL","x":"Vulnerability in the Identity Manager product of Oracle Fusion Middleware (component: REST WebServices).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Identity Manager.  Successful…","vp":"Oracle Corporation Identity Manager","t":"","p":1761076991303},"CVE-2025-13223":{"s":8.8,"v":"HIGH","x":"Type Confusion in V8 in Google Chrome prior to 142.0.7444.175 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)","vp":"Google Chrome","t":"","p":1763420618938},"CVE-2025-58034":{"s":6.7,"v":"MEDIUM","x":"An Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability [CWE-78] vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.1, FortiWeb 7.6.0 through 7.6.5, FortiWeb 7.4.0 through 7.4.10, FortiWeb 7.2.0 through 7.2.11, FortiWeb 7.0.0 through 7.0.11 may allow an…","vp":"Fortinet FortiWeb","t":"","p":1763485273513},"CVE-2025-64446":{"s":9.4,"v":"CRITICAL","x":"A relative path traversal vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.1, FortiWeb 7.6.0 through 7.6.4, FortiWeb 7.4.0 through 7.4.9, FortiWeb 7.2.0 through 7.2.11, FortiWeb 7.0.0 through 7.0.11 may allow an attacker to execute administrative commands on the system via crafted HTTP or HTTPS requests.","vp":"Fortinet FortiWeb","t":"","p":1763135452778},"CVE-2025-12480":{"s":9.1,"v":"CRITICAL","x":"Triofox versions prior to 16.7.10368.56560, are vulnerable to an Improper Access Control flaw that allows access to initial setup pages even after setup is complete.","vp":"TrioFox TrioFox","t":"","p":1762784440677},"CVE-2025-62215":{"s":7,"v":"HIGH","x":"Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Kernel allows an authorized attacker to elevate privileges locally.","vp":"Microsoft Windows 10 Version 1809","t":"Windows Kernel Elevation of Privilege Vulnerability","p":1762883988205},"CVE-2025-9242":{"s":9.3,"v":"CRITICAL","x":"An Out-of-bounds Write vulnerability in the WatchGuard Fireware OS iked process may allow a remote unauthenticated attacker to execute arbitrary code. This vulnerability affects both the mobile user VPN with IKEv2 and the branch office VPN using IKEv2 when configured with a dynamic gateway peer.\nIf the Firebox was…","vp":"WatchGuard Fireware OS","t":"WatchGuard Firebox iked Out of Bounds Write Vulnerability","p":1758094163738},"CVE-2025-21042":{"s":8.8,"v":"HIGH","x":"Out-of-bounds write in libimagecodec.quram.so prior to SMR Apr-2025 Release 1 allows remote attackers to execute arbitrary code.","vp":"Samsung Mobile Samsung Mobile Devices","t":"","p":1757661709997},"CVE-2025-48703":{"s":9,"v":"CRITICAL","x":"CWP (aka Control Web Panel or CentOS Web Panel) before 0.9.8.1205 allows unauthenticated remote code execution via shell metacharacters in the t_total parameter in a filemanager changePerm request. A valid non-root username must be known.","vp":"centos-webpanel CentOS Web Panel","t":"","p":1758240000000},"CVE-2025-11371":{"s":7.5,"v":"HIGH","x":"In the default installation and configuration of Gladinet CentreStack and TrioFox, there is an unauthenticated Local File Inclusion Flaw that allows unintended disclosure of system files. Exploitation of this vulnerability has been observed in the wild. \n\nThis issue impacts Gladinet CentreStack and Triofox: All…","vp":"Gladinet CentreStack and TrioFox","t":"Gladinet CentreStack and TrioFox Local File Inclusion Flaw","p":1760028649117},"CVE-2025-41244":{"s":7.8,"v":"HIGH","x":"VMware Aria Operations and VMware Tools contain a local privilege escalation vulnerability. A malicious local actor with non-administrative privileges having access to a VM with VMware Tools installed and managed by Aria Operations with SDMP enabled may exploit this vulnerability to escalate privileges to root on the…","vp":"VMware VCF operations","t":"VMSA-2025-0015: VMware Aria Operations and VMware Tools updates address multiple vulnerabilities (CVE-2025-41244,CVE-2025-41245, CVE-2025-41246)","p":1759162191871},"CVE-2025-24893":{"s":9.8,"v":"CRITICAL","x":"XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any guest can perform arbitrary remote code execution through a request to `SolrSearch`. This impacts the confidentiality, integrity and availability of the whole XWiki installation. To reproduce on an instance,…","vp":"xwiki xwiki-platform","t":"Remote code execution as guest via SolrSearchMacros request in xwiki","p":1740079150597},"CVE-2025-6204":{"s":8,"v":"HIGH","x":"An Improper Control of Generation of Code (Code Injection) vulnerability affecting DELMIA Apriso from Release 2020 through Release 2025 could allow an attacker to execute arbitrary code.","vp":"Dassault Systèmes DELMIA Apriso","t":"Improper Control of Generation of Code (Code Injection) vulnerability affecting DELMIA Apriso from Release 2020 through Release 2025","p":1754298848343},"CVE-2025-6205":{"s":9.1,"v":"CRITICAL","x":"A missing authorization vulnerability affecting DELMIA Apriso from Release 2020 through Release 2025 could allow an attacker to gain privileged access to the application.","vp":"Dassault Systèmes DELMIA Apriso","t":"Missing authorization vulnerability affecting DELMIA Apriso from Release 2020 through Release 2025","p":1754298882308},"CVE-2025-54236":{"s":9.1,"v":"CRITICAL","x":"Adobe Commerce versions 2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14, 2.4.4-p15 and earlier are affected by an Improper Input Validation vulnerability. A successful attacker can abuse this to achieve session takeover, increasing the confidentiality, and integrity impact to high. Exploitation of this issue…","vp":"Adobe Adobe Commerce","t":"Adobe Commerce | Improper Input Validation (CWE-20)","p":1757424017939},"CVE-2025-59287":{"s":9.8,"v":"CRITICAL","x":"Deserialization of untrusted data in Windows Server Update Service allows an unauthorized attacker to execute code over a network.","vp":"Microsoft Windows Server 2012","t":"Windows Server Update Service (WSUS) Remote Code Execution Vulnerability","p":1760461307629},"CVE-2025-61932":{"s":9.3,"v":"CRITICAL","x":"Lanscope Endpoint Manager (On-Premises) (Client program (MR) and Detection agent (DA)) improperly verifies the origin of incoming requests, allowing an attacker to execute arbitrary code by sending specially crafted packets.","vp":"MOTEX Inc. Lanscope Endpoint Manager (On-Premises) (Client program (MR) and Detection agent (DA))","t":"","p":1760945139916},"CVE-2022-48503":{"s":8.8,"v":"HIGH","x":"The issue was addressed with improved bounds checks. This issue is fixed in tvOS 15.6, watchOS 8.7, iOS 15.6 and iPadOS 15.6, macOS Monterey 12.5, Safari 15.6. Processing web content may lead to arbitrary code execution.","vp":"Apple macOS","t":"","p":1692052849354},"CVE-2025-2746":{"s":9.8,"v":"CRITICAL","x":"An authentication bypass vulnerability in Kentico Xperience allows authentication bypass via the Staging Sync Server password handling of empty SHA1 usernames in digest authentication. Authentication bypass allows an attacker to control administrative objects.This issue affects Xperience through 13.0.172.","vp":"Kentico Xperience","t":"Kentico Xperience <= 13.0.172 Staging Sync Server Digest Password Authentication Bypass","p":1742840164022},"CVE-2025-2747":{"s":9.8,"v":"CRITICAL","x":"An authentication bypass vulnerability in Kentico Xperience allows authentication bypass via the Staging Sync Server component password handling for the server defined None type. Authentication bypass allows an attacker to control administrative objects.This issue affects Xperience through 13.0.178.","vp":"Kentico Xperience","t":"Kentico Xperience <= 13.0.178 Staging Sync Server None Password Type Authentication Bypass","p":1742840226079},"CVE-2025-33073":{"s":8.8,"v":"HIGH","x":"Improper access control in Windows SMB allows an authorized attacker to elevate privileges over a network.","vp":"Microsoft Windows 10 Version 1507","t":"Windows SMB Client Elevation of Privilege Vulnerability","p":1749574955874},"CVE-2025-61884":{"s":7.5,"v":"HIGH","x":"Vulnerability in the Oracle Configurator product of Oracle E-Business Suite (component: Runtime UI).  Supported versions that are affected are 12.2.3-12.2.14. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Configurator.  Successful attacks of this…","vp":"Oracle Corporation Oracle Configurator","t":"","p":1760236491603},"CVE-2025-54253":{"s":10,"v":"CRITICAL","x":"Adobe Experience Manager versions 6.5.23 and earlier are affected by a Misconfiguration vulnerability that could result in arbitrary code execution. An attacker could leverage this vulnerability to bypass security mechanisms and execute code. Exploitation of this issue does not require user interaction and scope is…","vp":"Adobe Adobe Experience Manager","t":"Adobe Experience Manager | Incorrect Authorization (CWE-863)","p":1754412820742},"CVE-2025-47827":{"s":4.6,"v":"MEDIUM","x":"In IGEL OS before 11, Secure Boot can be bypassed because the igel-flash-driver module improperly verifies a cryptographic signature. Ultimately, a crafted root filesystem can be mounted from an unverified SquashFS image.","vp":"n/a n/a","t":"","p":1749081600000},"CVE-2025-24990":{"s":7.8,"v":"HIGH","x":"Microsoft is aware of vulnerabilities in the third party Agere Modem driver that ships natively with supported Windows operating systems.  This is an announcement of the upcoming removal of ltmdm64.sys driver.  The driver has been removed in the October cumulative update.\nFax modem hardware dependent on this specific…","vp":"Microsoft Windows 10 Version 1507","t":"Windows Agere Modem Driver Elevation of Privilege Vulnerability","p":1760461210973},"CVE-2025-59230":{"s":7.8,"v":"HIGH","x":"Improper access control in Windows Remote Access Connection Manager allows an authorized attacker to elevate privileges locally.","vp":"Microsoft Windows 10 Version 1507","t":"Windows Remote Access Connection Manager Elevation of Privilege Vulnerability","p":1760461303397},"CVE-2016-7836":{"s":9.8,"v":"CRITICAL","x":"SKYSEA Client View Ver.11.221.03 and earlier allows remote code execution via a flaw in processing authentication on the TCP connection with the management console program.","vp":"Sky Co., LTD. SKYSEA Client View","t":"","p":1497024000000},"CVE-2021-43798":{"s":7.5,"v":"HIGH","x":"Grafana is an open-source platform for monitoring and observability. Grafana versions 8.0.0-beta1 through 8.3.0 (except for patched versions) iss vulnerable to directory traversal, allowing access to local files. The vulnerable URL path is: `<grafana_host_url>/public/plugins//`, where is the plugin ID for any…","vp":"grafana grafana","t":"Grafana path traversal","p":1638901510000},"CVE-2025-27915":{"s":5.4,"v":"MEDIUM","x":"An issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 10.0 and 10.1. A stored cross-site scripting (XSS) vulnerability exists in the Classic Web Client due to insufficient sanitization of HTML content in ICS files. When a user views an e-mail message containing a malicious ICS entry, its embedded JavaScript…","vp":"n/a n/a","t":"","p":1741737600000},"CVE-2021-22555":{"s":8.3,"v":"HIGH","x":"A heap out-of-bounds write affecting Linux since v2.6.19-rc1 was discovered in net/netfilter/x_tables.c. This allows an attacker to gain privileges or cause a DoS (via heap memory corruption) through user name space","vp":"n/a Linux Kernel","t":"Heap Out-Of-Bounds Write in Netfilter IP6T_SO_SET_REPLACE","p":1625656810668},"CVE-2010-3962":{"s":8.1,"v":"HIGH","x":"Use-after-free vulnerability in Microsoft Internet Explorer 6, 7, and 8 allows remote attackers to execute arbitrary code via vectors related to Cascading Style Sheets (CSS) token sequences and the clip attribute, aka an \"invalid flag reference\" issue or \"Uninitialized Memory Corruption Vulnerability,\" as exploited in…","vp":"n/a n/a","t":"","p":1288974480000},"CVE-2021-43226":{"s":7.8,"v":"HIGH","x":"Windows Common Log File System Driver Elevation of Privilege Vulnerability","vp":"Microsoft Windows 10 Version 1809","t":"Windows Common Log File System Driver Elevation of Privilege Vulnerability","p":1639577712000},"CVE-2013-3918":{"s":8.8,"v":"HIGH","x":"The InformationCardSigninHelper Class ActiveX control in icardie.dll in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows remote attackers to…","vp":"n/a n/a","t":"","p":1384218000000},"CVE-2011-3402":{"s":8.8,"v":"HIGH","x":"Unspecified vulnerability in the TrueType font parsing engine in win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 allows remote attackers to execute arbitrary code via crafted font…","vp":"n/a n/a","t":"","p":1320440400000},"CVE-2010-3765":{"s":9.8,"v":"CRITICAL","x":"Mozilla Firefox 3.5.x through 3.5.14 and 3.6.x through 3.6.11, Thunderbird 3.1.6 before 3.1.6 and 3.0.x before 3.0.10, and SeaMonkey 2.x before 2.0.10, when JavaScript is enabled, allows remote attackers to execute arbitrary code via vectors related to nsCSSFrameConstructor::ContentAppended, the appendChild method,…","vp":"n/a n/a","t":"","p":1288216800000},"CVE-2025-61882":{"s":9.8,"v":"CRITICAL","x":"Vulnerability in the Oracle Concurrent Processing product of Oracle E-Business Suite (component: BI Publisher Integration).  Supported versions that are affected are 12.2.3-12.2.14. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Concurrent Processing.…","vp":"Oracle Corporation Oracle Concurrent Processing","t":"","p":1759634221644},"CVE-2017-1000353":{"s":9.8,"v":"CRITICAL","x":"Jenkins versions 2.56 and earlier as well as 2.46.1 LTS and earlier are vulnerable to an unauthenticated remote code execution. An unauthenticated remote code execution vulnerability allowed attackers to transfer a serialized Java `SignedObject` object to the Jenkins CLI, that would be deserialized using a new…","vp":"n/a n/a","t":"","p":1517245200000},"CVE-2015-7755":{"s":9.8,"v":"CRITICAL","x":"Juniper ScreenOS 6.2.0r15 through 6.2.0r18, 6.3.0r12 before 6.3.0r12b, 6.3.0r13 before 6.3.0r13b, 6.3.0r14 before 6.3.0r14b, 6.3.0r15 before 6.3.0r15b, 6.3.0r16 before 6.3.0r16b, 6.3.0r17 before 6.3.0r17b, 6.3.0r18 before 6.3.0r18b, 6.3.0r19 before 6.3.0r19b, and 6.3.0r20 before 6.3.0r21 allows remote attackers to…","vp":"n/a n/a","t":"","p":1450522800000},"CVE-2025-21043":{"s":8.8,"v":"HIGH","x":"Out-of-bounds write in libimagecodec.quram.so prior to SMR Sep-2025 Release 1 allows remote attackers to execute arbitrary code.","vp":"Samsung Mobile Samsung Mobile Devices","t":"","p":1757661711025},"CVE-2025-4008":{"s":8.7,"v":"HIGH","x":"The Meteobridge web interface let meteobridge administrator manage their weather station data collection and administer their meteobridge system through a web application written in CGI shell scripts and C.\n\nThis web interface exposes an endpoint that is vulnerable to command injection.\n\nRemote unauthenticated…","vp":"Smartbedded MeteoBridge","t":"Arbitrary Command Injection in Smartbedded MeteoBridge","p":1747841483118},"CVE-2025-32463":{"s":9.3,"v":"CRITICAL","x":"Sudo before 1.9.17p1 allows local users to obtain root access because /etc/nsswitch.conf from a user-controlled directory is used with the --chroot option.","vp":"Sudo project Sudo","t":"","p":1751241600000},"CVE-2025-59689":{"s":6.1,"v":"MEDIUM","x":"Libraesva ESG 4.5 through 5.5.x before 5.5.7 allows command injection via a compressed e-mail attachment. For ESG 5.0 a fix has been released in 5.0.31. For ESG 5.1 a fix has been released in 5.1.20. For ESG 5.2 a fix has been released in 5.2.31. For ESG 5.4 a fix has been released in 5.4.8. For ESG 5.5. a fix has…","vp":"Libraesva Email Security Gateway","t":"","p":1758240000000},"CVE-2025-10035":{"s":10,"v":"CRITICAL","x":"A deserialization vulnerability in the License Servlet of Fortra's GoAnywhere MFT allows an actor with a validly forged license response signature to deserialize an arbitrary actor-controlled object, possibly leading to command injection.","vp":"Fortra GoAnywhere MFT","t":"Deserialization Vulnerability in GoAnywhere MFT's License Servlet","p":1758232911337},"CVE-2025-20352":{"s":7.7,"v":"HIGH","x":"A vulnerability in the Simple Network Management Protocol (SNMP) subsystem of Cisco IOS Software and Cisco IOS XE Software could allow the following:\r\n\r \r An authenticated, remote attacker with low privileges could cause a denial of service (DoS) condition on an affected device that is running Cisco IOS Software or…","vp":"Cisco IOS","t":"","p":1758733842891},"CVE-2021-21311":{"s":7.2,"v":"HIGH","x":"Adminer is an open-source database management in a single PHP file. In adminer from version 4.0.0 and before 4.7.9 there is a server-side request forgery vulnerability. Users of Adminer versions bundling all drivers (e.g. `adminer.php`) are affected. This is fixed in version 4.7.9.","vp":"vrana adminer","t":"SSRF in adminer","p":1613076915000},"CVE-2025-20362":{"s":6.5,"v":"MEDIUM","x":"Update: On November 5, 2025, Cisco became aware of a new attack variant against devices running Cisco Secure ASA Software or Cisco Secure FTD Software releases that are affected by CVE-2025-20333 and CVE-2025-20362. This attack can cause unpatched devices to unexpectedly reload, leading to denial of service (DoS)…","vp":"Cisco Cisco Secure Firewall Adaptive Security Appliance (ASA) Software","t":"","p":1758816755916},"CVE-2025-20333":{"s":9.9,"v":"CRITICAL","x":"A vulnerability in the VPN web server of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an authenticated, remote attacker to execute arbitrary code on an affected device.\r\n\r This vulnerability is due to improper validation of…","vp":"Cisco Cisco Secure Firewall Adaptive Security Appliance (ASA) Software","t":"","p":1758816734308},"CVE-2025-10585":{"s":8.8,"v":"HIGH","x":"Type confusion in V8 in Google Chrome prior to 140.0.7339.185 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)","vp":"Google Chrome","t":"","p":1758730631576},"CVE-2025-5086":{"s":9,"v":"CRITICAL","x":"A deserialization of untrusted data vulnerability affecting DELMIA Apriso from Release 2020 through Release 2025 could lead to a remote code execution.","vp":"Dassault Systèmes DELMIA Apriso","t":"Deserialization of Untrusted Data vulnerability affecting DELMIA Apriso from Release 2020 through Release 2025","p":1748886162620},"CVE-2025-38352":{"s":7.8,"v":"HIGH","x":"In the Linux kernel, the following vulnerability has been resolved:\n\nposix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del()\n\nIf an exiting non-autoreaping task has already passed exit_notify() and\ncalls handle_posix_cpu_timers() from IRQ, it can be reaped by its parent\nor debugger right…","vp":"Linux Linux","t":"posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del()","p":1753171465277},"CVE-2025-48543":{"s":8.8,"v":"HIGH","x":"In multiple locations, there is a possible way to escape chrome sandbox to attack android system_server due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","vp":"Google Android","t":"","p":1757010862655},"CVE-2025-53690":{"s":9,"v":"CRITICAL","x":"Deserialization of Untrusted Data vulnerability in Sitecore Experience Manager (XM), Sitecore Experience Platform (XP) allows Code Injection.This issue affects Experience Manager (XM): through 9.0; Experience Platform (XP): through 9.0.","vp":"Sitecore Experience Manager (XM)","t":"Sitecore Products ViewState Deserialization Vulnerability","p":1756929888223},"CVE-2023-50224":{"s":6.5,"v":"MEDIUM","x":"TP-Link TL-WR841N dropbearpwd Improper Authentication Information Disclosure Vulnerability. This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of TP-Link TL-WR841N routers. Authentication is not required to exploit this vulnerability. The specific flaw…","vp":"TP-Link TL-WR841N","t":"TP-Link TL-WR841N dropbearpwd Improper Authentication Information Disclosure Vulnerability","p":1714702482922},"CVE-2025-9377":{"s":8.6,"v":"HIGH","x":"The authenticated remote command execution (RCE) vulnerability exists  in the Parental Control page on TP-Link Archer C7(EU) V2 and TL-WR841N/ND(MS) V9.\n\nThis issue affects Archer C7(EU) V2: before 241108 and TL-WR841N/ND(MS) V9: before 241108.\n\nBoth products have reached the status of EOL (end-of-life).\nIt's…","vp":"TP-Link Systems Inc. Archer C7(EU) V2","t":"Authenticated RCE via Parental Control command injection","p":1756488633700},"CVE-2020-24363":{"s":8.8,"v":"HIGH","x":"TP-Link TL-WA855RE V5 20200415-rel37464 devices allow an unauthenticated attacker (on the same network) to submit a TDDP_RESET POST request for a factory reset and reboot. The attacker can then obtain incorrect access control by setting a new administrative password.","vp":"n/a n/a","t":"","p":1598888955000},"CVE-2025-55177":{"s":5.4,"v":"MEDIUM","x":"Incomplete authorization of linked device synchronization messages in WhatsApp for iOS prior to v2.25.21.73, WhatsApp Business for iOS v2.25.21.78, and WhatsApp for Mac v2.25.21.78 could have allowed an unrelated user to trigger processing of content from an arbitrary URL on a target’s device. We assess that this…","vp":"Facebook WhatsApp Desktop for Mac","t":"","p":1756482628578},"CVE-2025-57819":{"s":10,"v":"CRITICAL","x":"FreePBX is an open-source web-based graphical user interface. FreePBX 15, 16, and 17 endpoints are vulnerable due to insufficiently sanitized user-supplied data allowing unauthenticated access to FreePBX Administrator leading to arbitrary database manipulation and remote code execution. This issue has been patched in…","vp":"FreePBX endpoint","t":"FreePBX Affected by Authentication Bypass Leading to SQL Injection and RCE","p":1756399518749},"CVE-2025-7775":{"s":9.2,"v":"CRITICAL","x":"Memory overflow vulnerability leading to Remote Code Execution and/or Denial of Service in NetScaler ADC and NetScaler Gateway when NetScaler is configured as Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server\n\n(OR)\n\nNetScaler ADC and NetScaler Gateway 13.1, 14.1, 13.1-FIPS and NDcPP: LB…","vp":"NetScaler ADC","t":"Memory overflow vulnerability leading to Remote Code Execution and/or Denial of Service","p":1756213013794},"CVE-2025-48384":{"s":8.1,"v":"HIGH","x":"Git is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-level operations and full access to internals. When reading a config value, Git strips any trailing carriage return and line feed (CRLF). When writing a config entry, values with a trailing CR are…","vp":"git git","t":"Git allows arbitrary code execution through broken config quoting","p":1751999028710},"CVE-2024-8068":{"s":5.1,"v":"MEDIUM","x":"Privilege escalation to NetworkService Account access in Citrix Session Recording when an attacker is an authenticated user in the same Windows Active Directory domain as the session recording server domain","vp":"Citrix Citrix Session Recording","t":"Privilege escalation to NetworkService Account access","p":1731433794285},"CVE-2024-8069":{"s":5.1,"v":"MEDIUM","x":"Limited remote code execution with privilege of a NetworkService Account access in Citrix Session Recording if the attacker is an authenticated user on the same intranet as the session recording server","vp":"Citrix Session Recording Citrix Session Recording","t":"Limited remote code execution with privilege of a NetworkService Account access","p":1731434475375},"CVE-2025-43300":{"s":10,"v":"CRITICAL","x":"An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 15.8.5 and iPadOS 15.8.5, iOS 16.7.12 and iPadOS 16.7.12, iOS 18.6.2 and iPadOS 18.6.2, iPadOS 17.7.10, macOS Sequoia 15.6.1, macOS Sonoma 14.7.8, macOS Ventura 13.7.8. Processing a malicious image file may result in…","vp":"Apple iOS and iPadOS","t":"","p":1755736041442},"CVE-2025-54948":{"s":9.4,"v":"CRITICAL","x":"A vulnerability in Trend Micro Apex One (on-premise) management console could allow a pre-authenticated remote attacker to upload malicious code and execute commands on affected installations.","vp":"Trend Micro, Inc. Trend Micro Apex One","t":"","p":1754398819905},"CVE-2025-8876":{"s":9.4,"v":"CRITICAL","x":"Improper Input Validation vulnerability in N-able N-central allows OS Command Injection.This issue affects N-central: before 2025.3.1.","vp":"N-able N-central","t":"Command Injection Vulnerability","p":1755183235176},"CVE-2025-8875":{"s":9.4,"v":"CRITICAL","x":"Deserialization of Untrusted Data vulnerability in N-able N-central allows Local Execution of Code.This issue affects N-central: before 2025.3.1.","vp":"N-able N-central","t":"Insecure Deserialization Vulnerability","p":1755183371884},"CVE-2025-8088":{"s":8.4,"v":"HIGH","x":"A path traversal vulnerability affecting the Windows version of WinRAR allows the attackers to execute arbitrary code by crafting malicious archive files. This vulnerability was exploited in the wild and was discovered by Anton Cherepanov, Peter Košinár, and Peter Strýček\n     from ESET.","vp":"win.rar GmbH WinRAR","t":"Path traversal vulnerability in WinRAR","p":1754651501842},"CVE-2007-0671":{"s":8.8,"v":"HIGH","x":"Unspecified vulnerability in Microsoft Excel 2000, XP, 2003, and 2004 for Mac, and possibly other Office products, allows remote user-assisted attackers to execute arbitrary code via unknown attack vectors, as demonstrated by Exploit-MSExcel.h in targeted zero-day attacks.","vp":"n/a n/a","t":"","p":1170464400000},"CVE-2013-3893":{"s":8.8,"v":"HIGH","x":"Use-after-free vulnerability in the SetMouseCapture implementation in mshtml.dll in Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code via crafted JavaScript strings, as demonstrated by use of an ms-help: URL that triggers loading of hxds.dll.","vp":"n/a n/a","t":"","p":1379498400000},"CVE-2020-25078":{"s":7.5,"v":"HIGH","x":"An issue was discovered on D-Link DCS-2530L before 1.06.01 Hotfix and DCS-2670L through 2.02 devices. The unauthenticated /config/getuser endpoint allows for remote administrator password disclosure.","vp":"n/a n/a","t":"","p":1599060798000},"CVE-2020-25079":{"s":8.8,"v":"HIGH","x":"An issue was discovered on D-Link DCS-2530L before 1.06.01 Hotfix and DCS-2670L through 2.02 devices. cgi-bin/ddns_enc.cgi allows authenticated command injection.","vp":"n/a n/a","t":"","p":1599060787000},"CVE-2022-40799":{"s":8.8,"v":"HIGH","x":"Data Integrity Failure in 'Backup Config' in D-Link DNR-322L <= 2.60B15 allows an authenticated attacker to execute OS level commands on the device.","vp":"n/a n/a","t":"","p":1669680000000},"CVE-2023-2533":{"s":8.4,"v":"HIGH","x":"A Cross-Site Request Forgery (CSRF) vulnerability has been identified in\nPaperCut NG/MF, which, under specific conditions, could potentially enable\nan attacker to alter security settings or execute arbitrary code. This could\nbe exploited if the target is an admin with a current login session. Exploiting\nthis would…","vp":"PaperCut PaperCut NG/MF","t":"PaperCut MF/NG 22.0.10 (Build 65996 2023-03-27) - Remote code execution via CSRF","p":1687272314102},"CVE-2025-20337":{"s":10,"v":"CRITICAL","x":"A vulnerability in a specific API of Cisco ISE and Cisco ISE-PIC could allow an unauthenticated, remote attacker to execute arbitrary code on the underlying operating system as root. The attacker does not require any valid credentials to exploit this vulnerability.\r\n\r\nThis vulnerability is due to insufficient…","vp":"Cisco Cisco Identity Services Engine Software","t":"Cisco ISE API Unauthenticated Remote Code Execution Vulnerability","p":1752682624664},"CVE-2025-20281":{"s":10,"v":"CRITICAL","x":"A vulnerability in a specific API of Cisco ISE and Cisco ISE-PIC could allow an unauthenticated, remote attacker to execute arbitrary code on the underlying operating system as root. The attacker does not require any valid credentials to exploit this vulnerability.\r\n\r\nThis vulnerability is due to insufficient…","vp":"Cisco Cisco Identity Services Engine Software","t":"Cisco ISE API Unauthenticated Remote Code Execution Vulnerability","p":1750867902285},"CVE-2025-2775":{"s":9.3,"v":"CRITICAL","x":"SysAid On-Prem versions <= 23.3.40 are vulnerable to an unauthenticated XML External Entity (XXE) vulnerability in the Checkin processing functionality,  allowing for administrator account takeover and file read primitives.","vp":"SysAid SysAid On-Prem","t":"SysAid On-Prem <= 23.3.40 Checkin Proceessing XML External Entity Injection","p":1746629003817},"CVE-2025-2776":{"s":9.3,"v":"CRITICAL","x":"SysAid On-Prem versions <= 23.3.40 are vulnerable to an unauthenticated XML External Entity (XXE) vulnerability in the Server URL processing functionality, allowing for administrator account takeover and file read primitives.","vp":"SysAid SysAid On-Prem","t":"SysAid On-Prem <= 23.3.40 serverurl Proceessing XML External Entity Injection","p":1746629440717},"CVE-2025-6558":{"s":8.8,"v":"HIGH","x":"Insufficient validation of untrusted input in ANGLE and GPU in Google Chrome prior to 138.0.7204.157 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)","vp":"Google Chrome","t":"","p":1752603156848},"CVE-2025-54309":{"s":9,"v":"CRITICAL","x":"CrushFTP 10 before 10.8.5 and 11 before 11.3.4_23, when the DMZ proxy feature is not used, mishandles AS2 validation and consequently allows remote attackers to obtain admin access via HTTPS, as exploited in the wild in July 2025.","vp":"CrushFTP CrushFTP","t":"","p":1752796800000},"CVE-2025-49704":{"s":8.8,"v":"HIGH","x":"Improper control of generation of code ('code injection') in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.","vp":"Microsoft Microsoft SharePoint Enterprise Server 2016","t":"Microsoft SharePoint Remote Code Execution Vulnerability","p":1751993885908},"CVE-2025-49706":{"s":6.5,"v":"MEDIUM","x":"Improper authentication in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network.","vp":"Microsoft Microsoft SharePoint Enterprise Server 2016","t":"Microsoft SharePoint Server Spoofing Vulnerability","p":1751993887343},"CVE-2025-25257":{"s":9.6,"v":"CRITICAL","x":"An improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability [CWE-89] vulnerability in Fortinet FortiWeb 7.6.0 through 7.6.3, FortiWeb 7.4.0 through 7.4.7, FortiWeb 7.2.0 through 7.2.10, FortiWeb 7.0.0 through 7.0.10 allows an unauthenticated attacker to execute unauthorized…","vp":"Fortinet FortiWeb","t":"","p":1752765004532},"CVE-2025-47812":{"s":10,"v":"CRITICAL","x":"In Wing FTP Server before 7.4.4. the user and admin web interfaces mishandle '\\0' bytes, ultimately allowing injection of arbitrary Lua code into user session files. This can be used to execute arbitrary system commands with the privileges of the FTP service (root or SYSTEM by default). This is thus a remote code…","vp":"wftpserver Wing FTP Server","t":"","p":1752105600000},"CVE-2019-9621":{"s":7.5,"v":"HIGH","x":"Zimbra Collaboration Suite before 8.6 patch 13, 8.7.x before 8.7.11 patch 10, and 8.8.x before 8.8.10 patch 7 or 8.8.x before 8.8.11 patch 3 allows SSRF via the ProxyServlet component.","vp":"n/a n/a","t":"","p":1556646053000},"CVE-2019-5418":{"s":7.5,"v":"HIGH","x":"There is a File Content Disclosure vulnerability in Action View <5.2.2.1, <5.1.6.2, <5.0.7.2, <4.2.11.1 and v3 where specially crafted accept headers can cause contents of arbitrary files on the target system's filesystem to be exposed.","vp":"Rails https://github.com/rails/rails","t":"","p":1553693938000},"CVE-2016-10033":{"s":9.8,"v":"CRITICAL","x":"The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code via a \\\" (backslash double quote) in a crafted Sender property.","vp":"n/a n/a","t":"","p":1483124400000},"CVE-2014-3931":{"s":9.8,"v":"CRITICAL","x":"fastping.c in MRLG (aka Multi-Router Looking Glass) before 5.5.0 allows remote attackers to cause an arbitrary memory write and memory corruption.","vp":"n/a n/a","t":"","p":1490972400000},"CVE-2025-6554":{"s":8.1,"v":"HIGH","x":"Type confusion in V8 in Google Chrome prior to 138.0.7204.96 allowed a remote attacker to perform arbitrary read/write via a crafted HTML page. (Chromium security severity: High)","vp":"Google Chrome","t":"","p":1751318054799},"CVE-2025-48928":{"s":4,"v":"MEDIUM","x":"The TeleMessage service through 2025-05-05 is based on a JSP application in which the heap content is roughly equivalent to a \"core dump\" in which a password previously sent over HTTP would be included in this dump, as exploited in the wild in May 2025.","vp":"TeleMessage service","t":"","p":1748390400000},"CVE-2025-48927":{"s":5.3,"v":"MEDIUM","x":"The TeleMessage service through 2025-05-05 configures Spring Boot Actuator with an exposed heap dump endpoint at a /heapdump URI, as exploited in the wild in May 2025.","vp":"TeleMessage service","t":"","p":1748390400000},"CVE-2025-6543":{"s":9.2,"v":"CRITICAL","x":"Memory overflow vulnerability leading to unintended control flow and Denial of Service in NetScaler ADC and NetScaler Gateway when configured as Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) OR AAA virtual server","vp":"NetScaler ADC","t":"Memory overflow vulnerability leading to unintended control flow and Denial of Service","p":1750855797896},"CVE-2019-6693":{"s":6.5,"v":"MEDIUM","x":"Use of a hard-coded cryptographic key to cipher sensitive data in FortiOS configuration backup file may allow an attacker with access to the backup file to decipher the sensitive data, via knowledge of the hard-coded key. The aforementioned sensitive data includes users' passwords (except the administrator's…","vp":"Fortinet FortiGate","t":"","p":1574348885000},"CVE-2024-0769":{"s":5.3,"v":"MEDIUM","x":"** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in D-Link DIR-859 1.06B01. It has been rated as critical. Affected by this issue is some unknown functionality of the file /hedwig.cgi of the component HTTP POST Request Handler. The manipulation of the argument service with the input…","vp":"D-Link DIR-859","t":"D-Link DIR-859 HTTP POST Request hedwig.cgi path traversal","p":1705824005383},"CVE-2024-54085":{"s":10,"v":"CRITICAL","x":"AMI’s SPx contains\na vulnerability in the BMC where an Attacker may bypass authentication remotely through the Redfish Host Interface. A successful exploitation\nof this vulnerability may lead to a loss of confidentiality, integrity, and/or\navailability.","vp":"AMI MegaRAC-SPx","t":"Redfish Authentication Bypass","p":1741701658643},"CVE-2023-0386":{"s":7.8,"v":"HIGH","x":"A flaw was found in the Linux kernel, where unauthorized access to the execution of the setuid file with capabilities was found in the Linux kernel’s OverlayFS subsystem in how a user copies a capable file from a nosuid mount into another mount. This uid mapping bug allows a local user to escalate their privileges on…","vp":"n/a Kernel","t":"","p":1679443200000},"CVE-2023-33538":{"s":8.8,"v":"HIGH","x":"TP-Link TL-WR940N V2/V4, TL-WR841N V8/V10, and TL-WR740N V1/V2 was discovered to contain a command injection vulnerability via the component /userRpm/WlanNetworkRpm .","vp":"n/a n/a","t":"","p":1686096000000},"CVE-2025-43200":{"s":4.2,"v":"MEDIUM","x":"This issue was addressed with improved checks. This issue is fixed in iOS 15.8.4 and iPadOS 15.8.4, iOS 16.7.11 and iPadOS 16.7.11, iOS 18.3.1 and iPadOS 18.3.1, iPadOS 17.7.5, macOS Sequoia 15.3.1, macOS Sonoma 14.7.4, macOS Ventura 13.7.4, visionOS 2.3.1, watchOS 11.3.1. A logic issue existed when processing a…","vp":"Apple iOS and iPadOS","t":"","p":1750109785578},"CVE-2025-33053":{"s":8.8,"v":"HIGH","x":"External control of file name or path in Internet Shortcut Files allows an unauthorized attacker to execute code over a network.","vp":"Microsoft Windows 10 Version 1507","t":"Internet Shortcut Files Remote Code Execution Vulnerability","p":1749574951840},"CVE-2025-24016":{"s":9.9,"v":"CRITICAL","x":"Wazuh is a free and open source platform used for threat prevention, detection, and response. Starting in version 4.4.0 and prior to version 4.9.1, an unsafe deserialization vulnerability allows for remote code execution on Wazuh servers. DistributedAPI parameters are a serialized as JSON and deserialized using…","vp":"wazuh wazuh","t":"Remote code execution in Wazuh server","p":1739214489058},"CVE-2024-42009":{"s":9.3,"v":"CRITICAL","x":"A Cross-Site Scripting vulnerability in Roundcube through 1.5.7 and 1.6.x through 1.6.7 allows a remote attacker to steal and send emails of a victim via a crafted e-mail message that abuses a Desanitization issue in message_body() in program/actions/mail/show.php.","vp":"n/a n/a","t":"","p":1722816000000},"CVE-2025-5419":{"s":8.8,"v":"HIGH","x":"Out of bounds read and write in V8 in Google Chrome prior to 137.0.7151.68 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)","vp":"Google Chrome","t":"","p":1748907413221},"CVE-2025-21479":{"s":8.6,"v":"HIGH","x":"Memory corruption due to unauthorized command execution in GPU micronode while executing specific sequence of commands.","vp":"Qualcomm, Inc. Snapdragon","t":"Incorrect Authorization in Graphics","p":1748932962042},"CVE-2025-21480":{"s":8.6,"v":"HIGH","x":"Memory corruption due to unauthorized command execution in GPU micronode while executing specific sequence of commands.","vp":"Qualcomm, Inc. Snapdragon","t":"Incorrect Authorization in Graphics Windows","p":1748929980920},"CVE-2025-27038":{"s":7.5,"v":"HIGH","x":"Memory corruption while rendering graphics using Adreno GPU drivers in Chrome.","vp":"Qualcomm, Inc. Snapdragon","t":"Use After Free in Graphics","p":1748929986692},"CVE-2021-32030":{"s":9.8,"v":"CRITICAL","x":"The administrator application on ASUS GT-AC2900 devices before 3.0.0.4.386.42643 and Lyra Mini before 3.0.0.4_384_46630 allows authentication bypass when processing remote input from an unauthenticated user, leading to unauthorized access to the administrator interface. This relates to handle_request in…","vp":"n/a n/a","t":"","p":1620312871000},"CVE-2025-3935":{"s":8.1,"v":"HIGH","x":"ScreenConnect versions 25.2.3 and earlier versions may be susceptible to a ViewState code injection attack. ASP.NET Web Forms use ViewState to preserve page and control state, with data encoded using Base64 protected by machine keys. \nIt is important to note that to obtain these machine keys, privileged system level…","vp":"ConnectWise ScreenConnect","t":"ScreenConnect Exposure to ASP.NET ViewState Code Injection","p":1745605664244},"CVE-2025-35939":{"s":5.3,"v":"MEDIUM","x":"Craft CMS stores arbitrary content provided by unauthenticated users in session files. This content could be accessed and executed, possibly using an independent vulnerability. Craft CMS redirects requests that require authentication to the login page and generates a session file on the server at…","vp":"Craft CMS","t":"Craft CMS stores user-provided content in session files","p":1746657689728},"CVE-2024-56145":{"s":9.3,"v":"CRITICAL","x":"Craft is a flexible, user-friendly CMS for creating custom digital experiences on the web and beyond. Users of affected versions are affected by this vulnerability if their php.ini configuration has `register_argc_argv` enabled. For these users an unspecified remote code execution vector is present. Users are advised…","vp":"craftcms cms","t":"RCE when PHP `register_argc_argv` config setting is enabled in craftcms/cms","p":1734554254301},"CVE-2023-39780":{"s":8.8,"v":"HIGH","x":"On ASUS RT-AX55 3.0.0.4.386.51598 devices, authenticated attackers can perform OS command injection via the /start_apply.htm qos_bw_rulelist parameter. NOTE: for the similar \"token-generated module\" issue, see CVE-2023-41345; for the similar \"token-refresh module\" issue, see CVE-2023-41346; for the similar \"check…","vp":"ASUS RT-AX55","t":"","p":1694390400000},"CVE-2025-4632":{"s":9.8,"v":"CRITICAL","x":"Improper limitation of a pathname to a restricted directory vulnerability in Samsung MagicINFO 9 Server version before 21.1052 allows attackers to write arbitrary file as system authority.","vp":"Samsung Electronics MagicINFO 9 Server","t":"","p":1747113559254},"CVE-2023-38950":{"s":7.5,"v":"HIGH","x":"A path traversal vulnerability in the iclock API of ZKTeco BioTime v8.5.5 allows unauthenticated attackers to read arbitrary files via supplying a crafted payload. This vulnerability was fixed in version 9.0.120240617.19506 of ZKBioTime.","vp":"n/a n/a","t":"","p":1691020800000},"CVE-2024-27443":{"s":6.1,"v":"MEDIUM","x":"An issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 10.0. A Cross-Site Scripting (XSS) vulnerability exists in the CalendarInvite feature of the Zimbra webmail classic user interface, because of improper input validation in the handling of the calendar header. An attacker can exploit this via an email…","vp":"n/a n/a","t":"","p":1723420800000},"CVE-2025-27920":{"s":7.2,"v":"HIGH","x":"Output Messenger before 2.0.63 was vulnerable to a directory traversal attack through improper file path handling. By using ../ sequences in parameters, attackers could access sensitive files outside the intended directory, potentially leading to configuration leakage or arbitrary file access.","vp":"Srimax Output Messenger","t":"","p":1746403200000},"CVE-2024-11182":{"s":5.3,"v":"MEDIUM","x":"An XSS issue was discovered in \n\nMDaemon Email Server before version 24.5.1c. An attacker can send an HTML e-mail message \nwith \nJavaScript in an img tag. This could\n allow a remote attacker\n\nto load arbitrary JavaScript code in the context of a webmail user's browser window.","vp":"MDaemon Email Server","t":"Stored XSS vulnerability in MDaemon Email Server","p":1731667390960},"CVE-2025-4428":{"s":7.2,"v":"HIGH","x":"Remote Code Execution in API component in Ivanti Endpoint Manager Mobile 12.5.0.0 and prior on unspecified platforms allows authenticated attackers to execute arbitrary code via crafted API requests.","vp":"Ivanti Endpoint Manager Mobile","t":"Remote Code Execution","p":1747151215176},"CVE-2025-4427":{"s":5.3,"v":"MEDIUM","x":"An authentication bypass in the API component of Ivanti Endpoint Manager Mobile 12.5.0.0 and prior allows attackers to access protected resources without proper credentials via the API.","vp":"Ivanti Endpoint Manager Mobile","t":"Authentication Bypass","p":1747151135145},"CVE-2025-42999":{"s":9.1,"v":"CRITICAL","x":"SAP NetWeaver Visual Composer Metadata Uploader is vulnerable when a privileged user can upload untrusted or malicious content which, when deserialized, could potentially lead to a compromise of confidentiality, integrity, and availability of the host system.","vp":"SAP_SE SAP NetWeaver (Visual Composer development server)","t":"Insecure Deserialization in SAP NetWeaver (Visual Composer development server)","p":1747095463710},"CVE-2024-12987":{"s":7.3,"v":"HIGH","x":"A vulnerability, which was classified as critical, was found in DrayTek Vigor2960 and Vigor300B 1.5.1.4. Affected is an unknown function of the file /cgi-bin/mainfunction.cgi/apmcfgupload of the component Web Management Interface. The manipulation of the argument session leads to os command injection. It is possible…","vp":"DrayTek Vigor2960","t":"DrayTek Vigor2960/Vigor300B Web Management Interface apmcfgupload os command injection","p":1735315213600},"CVE-2025-32756":{"s":9.6,"v":"CRITICAL","x":"A stack-based buffer overflow vulnerability [CWE-121] vulnerability in Fortinet FortiCamera 2.1.0 through 2.1.3, FortiCamera 2.0 all versions, FortiCamera 1.1 all versions, FortiMail 7.6.0 through 7.6.2, FortiMail 7.4.0 through 7.4.4, FortiMail 7.2.0 through 7.2.7, FortiMail 7.0.0 through 7.0.8, FortiNDR 7.6.0,…","vp":"Fortinet FortiNDR","t":"","p":1747147604208},"CVE-2025-32709":{"s":7.8,"v":"HIGH","x":"Null pointer dereference in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.","vp":"Microsoft Windows 10 Version 1507","t":"Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability","p":1747155533790},"CVE-2025-30397":{"s":7.5,"v":"HIGH","x":"Access of resource using incompatible type ('type confusion') in Microsoft Scripting Engine allows an unauthorized attacker to execute code over a network.","vp":"Microsoft Windows 10 Version 1507","t":"Scripting Engine Memory Corruption Vulnerability","p":1747155550994},"CVE-2025-32706":{"s":7.8,"v":"HIGH","x":"Improper input validation in Windows Common Log File System Driver allows an authorized attacker to elevate privileges locally.","vp":"Microsoft Windows 10 Version 1507","t":"Windows Common Log File System Driver Elevation of Privilege Vulnerability","p":1747155531645},"CVE-2025-32701":{"s":7.8,"v":"HIGH","x":"Use after free in Windows Common Log File System Driver allows an authorized attacker to elevate privileges locally.","vp":"Microsoft Windows 10 Version 1507","t":"Windows Common Log File System Driver Elevation of Privilege Vulnerability","p":1747155530227},"CVE-2025-30400":{"s":7.8,"v":"HIGH","x":"Use after free in Windows DWM allows an authorized attacker to elevate privileges locally.","vp":"Microsoft Windows 10 Version 1809","t":"Microsoft DWM Core Library Elevation of Privilege Vulnerability","p":1747155529601},"CVE-2025-47729":{"s":1.9,"v":"LOW","x":"The TeleMessage archiving backend through 2025-05-05 holds cleartext copies of messages from TM SGNL (aka Archive Signal) app users, which is different functionality than described in the TeleMessage \"End-to-End encryption from the mobile phone through to the corporate archive\" documentation, as exploited in the wild…","vp":"TeleMessage archiving backend","t":"","p":1746662400000},"CVE-2024-11120":{"s":9.8,"v":"CRITICAL","x":"Certain EOL GeoVision devices have an OS Command Injection vulnerability. Unauthenticated remote attackers can exploit this vulnerability to inject and execute arbitrary system commands on the device. Moreover, this vulnerability has already been exploited by attackers, and we have received related reports.","vp":"GeoVision GV-VS12","t":"GeoVision EOL devices - OS Command Injection","p":1731636027361},"CVE-2024-6047":{"s":9.8,"v":"CRITICAL","x":"Certain EOL GeoVision devices fail to properly filter user input for the specific functionality. Unauthenticated remote attackers can exploit this vulnerability to inject and execute arbitrary system commands on the device.","vp":"GeoVision GV_DSP_LPR_V2","t":"GeoVision EOL device - OS Command Injection","p":1718603322779},"CVE-2025-27363":{"s":8.1,"v":"HIGH","x":"An out of bounds write exists in FreeType versions 2.13.0 and below (newer versions of FreeType are not vulnerable) when attempting to parse font subglyph structures related to TrueType GX and variable font files. The vulnerable code assigns a signed short value to an unsigned long and then adds a static value causing…","vp":"FreeType FreeType","t":"","p":1741699711705},"CVE-2025-3248":{"s":9.8,"v":"CRITICAL","x":"Langflow versions prior to 1.3.0 are susceptible to code injection in \nthe /api/v1/validate/code endpoint. A remote and unauthenticated attacker can send crafted HTTP requests to execute arbitrary\ncode.","vp":"langflow-ai langflow","t":"Langflow < 1.3.0 Unauthenticated RCE via /api/v1/validate/code","p":1744035758980},"CVE-2025-34028":{"s":9.3,"v":"CRITICAL","x":"The Commvault Command Center Innovation Release allows an unauthenticated actor to upload ZIP files that represent install packages that, when expanded by the target server, are vulnerable to path traversal vulnerability that can result in Remote Code Execution via malicious JSP.\n\n\n\n\n\nThis issue affects Command Center…","vp":"Commvault Command Center Innovation Release","t":"Commvault Command Center Innovation Release <= 11.38.25 Unathenticated Install Package Path Traversal","p":1745339543446},"CVE-2024-58136":{"s":9,"v":"CRITICAL","x":"Yii 2 before 2.0.52 mishandles the attaching of behavior that is defined by an __class array key, a CVE-2024-4990 regression, as exploited in the wild in February through April 2025.","vp":"yiiframework Yii","t":"","p":1744243200000},"CVE-2024-38475":{"s":9.1,"v":"CRITICAL","x":"Improper escaping of output in mod_rewrite in Apache HTTP Server 2.4.59 and earlier allows an attacker to map URLs to filesystem locations that are permitted to be served by the server but are not intentionally/directly reachable by any URL, resulting in code execution or source code disclosure. \n\nSubstitutions in…","vp":"Apache Software Foundation Apache HTTP Server","t":"Apache HTTP Server weakness in mod_rewrite when first segment of substitution matches filesystem path.","p":1719857712292},"CVE-2023-44221":{"s":7.2,"v":"HIGH","x":"Improper neutralization of special elements in the SMA100 SSL-VPN management interface allows a remote authenticated attacker with administrative privilege to inject arbitrary commands as a 'nobody' user, potentially leading to OS Command Injection Vulnerability.","vp":"SonicWall SMA100","t":"","p":1701807035186},"CVE-2025-1976":{"s":8.6,"v":"HIGH","x":"Brocade Fabric OS versions starting with 9.1.0 have root access removed, however, a local user with admin privilege can potentially execute arbitrary code with full root privileges on Fabric OS versions 9.1.0 through 9.1.1d6.","vp":"Brocade Fabric OS","t":"Code injection exposure in Fabric OS 9.1.0 through 9.1.1d6","p":1745463340225},"CVE-2025-42599":{"s":9.8,"v":"CRITICAL","x":"Active! mail 6 BuildInfo: 6.60.05008561 and earlier contains a stack-based buffer overflow vulnerability. Receiving a specially crafted request created and sent by a remote unauthenticated attacker may lead to arbitrary code execution and/or a denial-of-service (DoS) condition.","vp":"QUALITIA CO., LTD. Active! mail 6","t":"","p":1744948368607},"CVE-2025-3928":{"s":8.8,"v":"HIGH","x":"Commvault Web Server has an unspecified vulnerability that can be exploited by a remote, authenticated attacker. According to the Commvault advisory: \"Webservers can be compromised through bad actors creating and executing webshells.\" Fixed in version 11.36.46, 11.32.89, 11.28.141, and 11.20.217 for Windows and Linux…","vp":"Commvault Web Server","t":"Commvault Web Server unspecified vulnerability","p":1745596588112},"CVE-2025-24054":{"s":6.5,"v":"MEDIUM","x":"External control of file name or path in Windows NTLM allows an unauthorized attacker to perform spoofing over a network.","vp":"Microsoft Windows 10 Version 1507","t":"NTLM Hash Disclosure Spoofing Vulnerability","p":1741712349963},"CVE-2025-31201":{"s":9.8,"v":"CRITICAL","x":"This issue was addressed by removing the vulnerable code. This issue is fixed in iOS 18.4.1 and iPadOS 18.4.1, macOS Sequoia 15.4.1, tvOS 18.4.1, visionOS 2.4.1. An attacker with arbitrary read and write capability may be able to bypass Pointer Authentication. Apple is aware of a report that this issue may have been…","vp":"Apple iOS and iPadOS","t":"","p":1744827871230},"CVE-2025-31200":{"s":9.8,"v":"CRITICAL","x":"A memory corruption issue was addressed with improved bounds checking. This issue is fixed in iOS 18.4.1 and iPadOS 18.4.1, macOS Sequoia 15.4.1, tvOS 18.4.1, visionOS 2.4.1, watchOS 11.5. Processing an audio stream in a maliciously crafted media file may result in code execution. Apple is aware of a report that this…","vp":"Apple iOS and iPadOS","t":"","p":1744827871578},"CVE-2021-20035":{"s":6.5,"v":"MEDIUM","x":"Improper neutralization of special elements in the SMA100 management interface allows a remote authenticated attacker to inject arbitrary commands as a 'nobody' user which potentially leads to DoS.","vp":"SonicWall SMA100","t":"","p":1632763212000},"CVE-2024-53150":{"s":7.1,"v":"HIGH","x":"In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: usb-audio: Fix out of bounds reads when finding clock sources\n\nThe current USB-audio driver code doesn't check bLength of each\ndescriptor at traversing for clock descriptors.  That is, when a\ndevice provides a bogus descriptor with a shorter…","vp":"Linux Linux","t":"ALSA: usb-audio: Fix out of bounds reads when finding clock sources","p":1735039730175},"CVE-2024-53197":{"s":7.8,"v":"HIGH","x":"In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: usb-audio: Fix potential out-of-bound accesses for Extigy and Mbox devices\n\nA bogus device can provide a bNumConfigurations value that exceeds the\ninitial value used in usb_get_configuration for allocating dev->config.\n\nThis can lead to…","vp":"Linux Linux","t":"ALSA: usb-audio: Fix potential out-of-bound accesses for Extigy and Mbox devices","p":1735307379260},"CVE-2025-30406":{"s":9,"v":"CRITICAL","x":"Gladinet CentreStack through 16.1.10296.56315 (fixed in 16.4.10315.56368) has a deserialization vulnerability due to the CentreStack portal's hardcoded machineKey use, as exploited in the wild in March 2025. This enables threat actors (who know the machineKey) to serialize a payload for server-side deserialization to…","vp":"Gladinet CentreStack","t":"","p":1743638400000},"CVE-2025-31161":{"s":9.8,"v":"CRITICAL","x":"CrushFTP 10 before 10.8.4 and 11 before 11.3.1 allows authentication bypass and takeover of the crushadmin account (unless a DMZ proxy instance is used), as exploited in the wild in March and April 2025, aka \"Unauthenticated HTTP(S) port access.\" A race condition exists in the AWS4-HMAC (compatible with S3)…","vp":"CrushFTP CrushFTP","t":"","p":1743638400000},"CVE-2025-22457":{"s":9,"v":"CRITICAL","x":"A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.6, Ivanti Policy Secure before version 22.7R1.4, and Ivanti ZTA Gateways before version 22.8R2.2 allows a remote unauthenticated attacker to achieve remote code execution.","vp":"Ivanti Connect Secure","t":"","p":1743693623628},"CVE-2025-24813":{"s":10,"v":"CRITICAL","x":"Path Equivalence: 'file.Name' (Internal Dot) leading to Remote Code Execution and/or Information disclosure and/or malicious content added to uploaded files via write enabled Default Servlet in Apache Tomcat.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.2, from 10.1.0-M1 through 10.1.34, from…","vp":"Apache Software Foundation Apache Tomcat","t":"Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT","p":1741625043715},"CVE-2024-20439":{"s":9.8,"v":"CRITICAL","x":"A vulnerability in Cisco Smart Licensing Utility (CSLU) could allow an unauthenticated, remote attacker to log into an affected system by using a static administrative credential.\r\n\r This vulnerability is due to an undocumented static user credential for an administrative account. An attacker could exploit this…","vp":"Cisco Cisco Smart License Utility","t":"","p":1725467319669},"CVE-2025-2783":{"s":8.3,"v":"HIGH","x":"Incorrect handle provided in unspecified circumstances in Mojo in Google Chrome on Windows prior to 134.0.6998.177 allowed a remote attacker to perform a sandbox escape via a malicious file. (Chromium security severity: High)","vp":"Google Chrome","t":"","p":1743005271034},"CVE-2019-9875":{"s":8.8,"v":"HIGH","x":"Deserialization of Untrusted Data in the anti CSRF module in Sitecore through 9.1 allows an authenticated attacker to execute arbitrary code by sending a serialized .NET object in an HTTP POST parameter.","vp":"n/a n/a","t":"","p":1559334886000},"CVE-2019-9874":{"s":9.8,"v":"CRITICAL","x":"Deserialization of Untrusted Data in the Sitecore.Security.AntiCSRF (aka anti CSRF) module in Sitecore CMS 7.0 to 7.2 and Sitecore XP 7.5 to 8.2 allows an unauthenticated attacker to execute arbitrary code by sending a serialized .NET object in the HTTP POST parameter __CSRFTOKEN.","vp":"n/a n/a","t":"","p":1559333509000},"CVE-2025-30154":{"s":8.6,"v":"HIGH","x":"reviewdog/action-setup is a GitHub action that installs reviewdog. reviewdog/action-setup@v1 was compromised March 11, 2025, between 18:42 and 20:31 UTC, with malicious code added that dumps exposed secrets to Github Actions Workflow Logs. Other reviewdog actions that use `reviewdog/action-setup@v1` that would also be…","vp":"reviewdog reviewdog","t":"Multiple Reviewdog actions were compromised during a specific time period","p":1742397329113},"CVE-2017-12637":{"s":7.5,"v":"HIGH","x":"Directory traversal vulnerability in scheduler/ui/js/ffffffffbca41eb4/UIUtilJavaScriptJS in SAP NetWeaver Application Server Java 7.5 allows remote attackers to read arbitrary files via a .. (dot dot) in the query string, as exploited in the wild in August 2017, aka SAP Security Note 2486657.","vp":"n/a n/a","t":"","p":1502136000000},"CVE-2024-48248":{"s":8.6,"v":"HIGH","x":"NAKIVO Backup & Replication before 11.0.0.88174 allows absolute path traversal for reading files via getImageByPath to /c/router (this may lead to remote code execution across the enterprise because PhysicalDiscovery has cleartext credentials).","vp":"NAKIVO Backup & Replication Director","t":"","p":1741046400000},"CVE-2025-1316":{"s":9.8,"v":"CRITICAL","x":"Edimax IC-7100 does not properly neutralize requests. An attacker can create specially crafted requests to achieve remote code execution on the device","vp":"Edimax IC-7100 IP Camera","t":"Edimax IC-7100 IP Camera OS Command Injection","p":1741131419724},"CVE-2025-30066":{"s":8.6,"v":"HIGH","x":"tj-actions changed-files before 46 allows remote attackers to discover secrets by reading actions logs. (The tags v1 through v45.0.7 were affected on 2025-03-14 and 2025-03-15 because they were modified by a threat actor to point at commit 0e58ed8, which contained malicious updateFeatures code.)","vp":"tj-actions changed-files","t":"","p":1741996800000},"CVE-2025-24472":{"s":8.1,"v":"HIGH","x":"An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] affecting FortiOS 7.0.0 through 7.0.16 and FortiProxy 7.2.0 through 7.2.12, 7.0.0 through 7.0.19 may allow a remote unauthenticated attacker with prior knowledge of upstream and downstream devices serial numbers to gain super-admin…","vp":"Fortinet FortiOS","t":"","p":1739292642207},"CVE-2025-21590":{"s":4.4,"v":"MEDIUM","x":"An Improper Isolation or Compartmentalization vulnerability in the kernel of Juniper Networks Junos OS allows a local attacker with high privileges to compromise the integrity of the device.\n\nA local attacker with access to the shell is able to inject arbitrary code which can compromise an affected device.\nThis issue…","vp":"Juniper Networks Junos OS","t":"Junos OS: An local attacker with shell access can execute arbitrary code","p":1741787983038},"CVE-2025-24201":{"s":10,"v":"CRITICAL","x":"An out-of-bounds write issue was addressed with improved checks to prevent unauthorized actions. This issue is fixed in Safari 18.3.1, iOS 15.8.4 and iPadOS 15.8.4, iOS 16.7.11 and iPadOS 16.7.11, iOS 18.3.2 and iPadOS 18.3.2, iPadOS 17.7.6, macOS Sequoia 15.3.2, visionOS 2.3.2, watchOS 11.4. Maliciously crafted web…","vp":"Apple Safari","t":"","p":1741716441848},"CVE-2025-24993":{"s":7.8,"v":"HIGH","x":"Heap-based buffer overflow in Windows NTFS allows an unauthorized attacker to execute code locally.","vp":"Microsoft Windows 10 Version 1507","t":"Windows NTFS Remote Code Execution Vulnerability","p":1741712360302},"CVE-2025-24991":{"s":5.5,"v":"MEDIUM","x":"Out-of-bounds read in Windows NTFS allows an authorized attacker to disclose information locally.","vp":"Microsoft Windows 10 Version 1507","t":"Windows NTFS Information Disclosure Vulnerability","p":1741712359319},"CVE-2025-24985":{"s":7.8,"v":"HIGH","x":"Integer overflow or wraparound in Windows Fast FAT Driver allows an unauthorized attacker to execute code locally.","vp":"Microsoft Windows 10 Version 1507","t":"Windows Fast FAT File System Driver Remote Code Execution Vulnerability","p":1741712358750},"CVE-2025-24984":{"s":4.6,"v":"MEDIUM","x":"Insertion of sensitive information into log file in Windows NTFS allows an unauthorized attacker to disclose information with a physical attack.","vp":"Microsoft Windows 10 Version 1507","t":"Windows NTFS Information Disclosure Vulnerability","p":1741712358193},"CVE-2025-24983":{"s":7,"v":"HIGH","x":"Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally.","vp":"Microsoft Windows 10 Version 1507","t":"Windows Win32 Kernel Subsystem Elevation of Privilege Vulnerability","p":1741712357608},"CVE-2025-26633":{"s":7,"v":"HIGH","x":"Improper neutralization in Microsoft Management Console allows an unauthorized attacker to bypass a security feature locally.","vp":"Microsoft Windows 10 Version 1507","t":"Microsoft Management Console Security Feature Bypass Vulnerability","p":1741712364607},"CVE-2024-13161":{"s":9.8,"v":"CRITICAL","x":"Absolute path traversal in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote unauthenticated attacker to leak sensitive information.","vp":"Ivanti Endpoint Manager","t":"","p":1736874692061},"CVE-2024-13160":{"s":9.8,"v":"CRITICAL","x":"Absolute path traversal in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote unauthenticated attacker to leak sensitive information.","vp":"Ivanti Endpoint Manager","t":"","p":1736874743237},"CVE-2024-13159":{"s":9.8,"v":"CRITICAL","x":"Absolute path traversal in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote unauthenticated attacker to leak sensitive information.","vp":"Ivanti Endpoint Manager","t":"","p":1736874777652},"CVE-2024-57968":{"s":9.9,"v":"CRITICAL","x":"Advantive VeraCore before 2024.4.2.1 allows remote authenticated users to upload files to unintended folders (e.g., ones that are accessible during web browsing by other users). upload.aspx can be used for this.","vp":"Advantive VeraCore","t":"","p":1738540800000},"CVE-2025-25181":{"s":5.8,"v":"MEDIUM","x":"A SQL injection vulnerability in timeoutWarning.asp in Advantive VeraCore through 2025.1.0 allows remote attackers to execute arbitrary SQL commands via the PmSess1 parameter.","vp":"Advantive VeraCore","t":"","p":1738540800000},"CVE-2025-22226":{"s":7.1,"v":"HIGH","x":"VMware ESXi, Workstation, and Fusion contain an information disclosure vulnerability due to an out-of-bounds read in HGFS. A malicious actor with administrative privileges to a virtual machine may be able to exploit this issue to leak memory from the vmx process.","vp":"n/a ESXi","t":"","p":1741089417541},"CVE-2025-22225":{"s":8.2,"v":"HIGH","x":"VMware ESXi contains an arbitrary write vulnerability. A malicious actor with privileges within the VMX process may trigger an arbitrary kernel write leading to an escape of the sandbox.","vp":"n/a VMware ESXi","t":"","p":1741089387537},"CVE-2025-22224":{"s":9.3,"v":"CRITICAL","x":"VMware ESXi, and Workstation contain a TOCTOU (Time-of-Check Time-of-Use) vulnerability that leads to an out-of-bounds write. A malicious actor with local administrative privileges on a virtual machine may exploit this issue to execute code as the virtual machine's VMX process running on the host.","vp":"VMware ESXi","t":"","p":1741089372317},"CVE-2024-50302":{"s":5.5,"v":"MEDIUM","x":"In the Linux kernel, the following vulnerability has been resolved:\n\nHID: core: zero-initialize the report buffer\n\nSince the report buffer is used by all kinds of drivers in various ways, let's\nzero-initialize it during allocation to make sure that it can't be ever used\nto leak kernel memory via specially-crafted…","vp":"Linux Linux","t":"HID: core: zero-initialize the report buffer","p":1731979851300},"CVE-2024-4885":{"s":9.8,"v":"CRITICAL","x":"In WhatsUp Gold versions released before 2023.1.3, an unauthenticated Remote Code Execution vulnerability in Progress WhatsUpGold.  The \n\nWhatsUp.ExportUtilities.Export.GetFileWithoutZip\n\n\n\n allows execution of commands with iisapppool\\nmconsole privileges.","vp":"Progress Software Corporation WhatsUp Gold","t":"WhatsUp Gold GetFileWithoutZip Directory Traversal Remote Code Execution Vulnerability","p":1719344895268},"CVE-2018-8639":{"s":8.4,"v":"HIGH","x":"An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka \"Win32k Elevation of Privilege Vulnerability.\" This affects Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2008, Windows Server 2019, Windows Server 2012, Windows 8.1,…","vp":"Microsoft Windows 7","t":"","p":1544572800000},"CVE-2022-43769":{"s":8.8,"v":"HIGH","x":"Hitachi Vantara Pentaho Business Analytics Server prior to versions 9.4.0.1 and 9.3.0.2, including 8.3.x allow certain web services to set property values which contain Spring templates that are interpreted downstream.","vp":"Hitachi Vantara Pentaho Business Analytics Server","t":"Hitachi Vantara Pentaho Business Analytics Server - Failure to Sanitize Special Elements into a Different Plane (Special Element Injection)","p":1680544065737},"CVE-2022-43939":{"s":8.6,"v":"HIGH","x":"Hitachi Vantara Pentaho Business Analytics Server versions before 9.4.0.1 and 9.3.0.2, including 8.3.x contain security restrictions using non-canonical URLs which can be circumvented.","vp":"Hitachi Vantara Pentaho Business Analytics Server","t":"Hitachi Vantara Pentaho Business Analytics Server - Use of Non-Canonical URL Paths for Authorization Decisions","p":1680545432141},"CVE-2023-20118":{"s":6.5,"v":"MEDIUM","x":"A vulnerability in the web-based management interface of Cisco Small Business Routers RV016, RV042, RV042G, RV082, RV320, and RV325 Routers could allow an authenticated, remote attacker to execute arbitrary commands on an affected device.\r\n\r This vulnerability is due to improper validation of user input within…","vp":"Cisco Cisco Small Business RV Series Router Firmware","t":"","p":1680710741067},"CVE-2023-34192":{"s":9,"v":"CRITICAL","x":"Cross Site Scripting vulnerability in Zimbra ZCS v.8.8.15 allows a remote authenticated attacker to execute arbitrary code via a crafted script to the /h/autoSaveDraft function.","vp":"n/a n/a","t":"","p":1688601600000},"CVE-2024-49035":{"s":8.7,"v":"HIGH","x":"An improper access control vulnerability in Partner.Microsoft.com allows an a unauthenticated attacker to elevate privileges over a network.","vp":"Microsoft Microsoft Partner Center","t":"Partner.Microsoft.Com Elevation of Privilege Vulnerability","p":1732650045352},"CVE-2024-20953":{"s":8.8,"v":"HIGH","x":"Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: Export).   The supported version that is affected is 9.3.6. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Agile PLM.  Successful attacks of this vulnerability can result…","vp":"Oracle Corporation Agile PLM Framework","t":"","p":1708134616976},"CVE-2017-3066":{"s":9.8,"v":"CRITICAL","x":"Adobe ColdFusion 2016 Update 3 and earlier, ColdFusion 11 update 11 and earlier, ColdFusion 10 Update 22 and earlier have a Java deserialization vulnerability in the Apache BlazeDS library. Successful exploitation could lead to arbitrary code execution.","vp":"n/a Adobe ColdFusion ColdFusion 2016 Update 3 and earlier, ColdFusion 11 update 11 and earlier, ColdFusion 10 Update 22 and earlier","t":"","p":1493301600000},"CVE-2025-24989":{"s":8.2,"v":"HIGH","x":"An improper access control vulnerability in Power Pages allows an unauthorized attacker to elevate privileges over a network potentially bypassing the user registration control.\nThis vulnerability has already been mitigated in the service and all affected customers have been notified. This update addressed the…","vp":"Microsoft Microsoft Power Pages","t":"Microsoft Power Pages Elevation of Privilege Vulnerability","p":1740003501618},"CVE-2025-0111":{"s":7.1,"v":"HIGH","x":"An authenticated file read vulnerability in the Palo Alto Networks PAN-OS software enables an authenticated attacker with network access to the management web interface to read files on the PAN-OS filesystem that are readable by the “nobody” user.\n\nYou can greatly reduce the risk of this issue by restricting access to…","vp":"Palo Alto Networks Cloud NGFW","t":"PAN-OS: Authenticated File Read Vulnerability in the Management Web Interface","p":1739393923387},"CVE-2025-23209":{"s":8.1,"v":"HIGH","x":"Craft is a flexible, user-friendly CMS for creating custom digital experiences on the web and beyond. This is an remote code execution (RCE) vulnerability that affects Craft 4 and 5 installs where your security key has already been compromised. Anyone running an unpatched version of Craft with a compromised security…","vp":"craftcms cms","t":"Potential RCE with a compromised security key in craft/cms","p":1737160374954},"CVE-2025-0108":{"s":8.8,"v":"HIGH","x":"An authentication bypass in the Palo Alto Networks PAN-OS software enables an unauthenticated attacker with network access to the management web interface to bypass the authentication otherwise required by the PAN-OS management web interface and invoke certain PHP scripts. While invoking these PHP scripts does not…","vp":"Palo Alto Networks Cloud NGFW","t":"PAN-OS: Authentication Bypass in the Management Web Interface","p":1739393734610},"CVE-2024-53704":{"s":8.2,"v":"HIGH","x":"An Improper Authentication vulnerability in the SSLVPN authentication mechanism allows a remote attacker to bypass authentication.","vp":"SonicWall SonicOS","t":"","p":1736405536771},"CVE-2024-57727":{"s":9.1,"v":"CRITICAL","x":"SimpleHelp remote support software v5.5.7 and before is vulnerable to multiple path traversal vulnerabilities that enable unauthenticated remote attackers to download arbitrary files from the SimpleHelp host via crafted HTTP requests. These files include server configuration files containing various secrets and hashed…","vp":"n/a n/a","t":"","p":1736899200000},"CVE-2025-24200":{"s":6.1,"v":"MEDIUM","x":"An authorization issue was addressed with improved state management. This issue is fixed in iOS 15.8.4 and iPadOS 15.8.4, iOS 16.7.11 and iPadOS 16.7.11, iOS 18.3.1 and iPadOS 18.3.1, iPadOS 17.7.5. A physical attack may disable USB Restricted Mode on a locked device. Apple is aware of a report that this issue may…","vp":"Apple iOS and iPadOS","t":"","p":1739214285242},"CVE-2024-41710":{"s":6.8,"v":"MEDIUM","x":"A vulnerability in the Mitel 6800 Series, 6900 Series, and 6900w Series SIP Phones, including the 6970 Conference Unit, through R6.4.0.HF1 (R6.4.0.136) could allow an authenticated attacker with administrative privilege to conduct an argument injection attack, due to insufficient parameter sanitization during the boot…","vp":"n/a n/a","t":"","p":1723420800000},"CVE-2024-40891":{"s":8.8,"v":"HIGH","x":"**UNSUPPORTED WHEN ASSIGNED**\nA post-authentication command injection vulnerability in the management commands of the legacy DSL CPE Zyxel VMG4325-B10A firmware version 1.00(AAFR.4)C0_20170615 could allow an authenticated attacker to execute operating system (OS) commands on an affected device via Telnet.","vp":"Zyxel VMG4325-B10A firmware","t":"","p":1738663368018},"CVE-2024-40890":{"s":8.8,"v":"HIGH","x":"**UNSUPPORTED WHEN ASSIGNED**\nA post-authentication command injection vulnerability in the CGI program of the legacy DSL CPE Zyxel VMG4325-B10A firmware version 1.00(AAFR.4)C0_20170615 could allow an authenticated attacker to execute operating system (OS) commands on an affected device by sending a crafted HTTP POST…","vp":"Zyxel VMG4325-B10A firmware","t":"","p":1738662938908},"CVE-2025-21418":{"s":7.8,"v":"HIGH","x":"Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability","vp":"Microsoft Windows 10 Version 1507","t":"Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability","p":1739296697776},"CVE-2025-21391":{"s":7.1,"v":"HIGH","x":"Windows Storage Elevation of Privilege Vulnerability","vp":"Microsoft Windows 10 Version 1507","t":"Windows Storage Elevation of Privilege Vulnerability","p":1739296697297},"CVE-2025-0994":{"s":8.6,"v":"HIGH","x":"Trimble Cityworks versions prior to 15.8.9 and Cityworks with office companion versions prior to 23.10 are vulnerable to a deserialization vulnerability. This could allow an authenticated user to perform a remote code execution attack against a customer’s Microsoft Internet Information Services (IIS) web server.","vp":"Trimble Cityworks","t":"","p":1738857680000},"CVE-2020-15069":{"s":9.8,"v":"CRITICAL","x":"Sophos XG Firewall 17.x through v17.5 MR12 allows a Buffer Overflow and remote code execution via the HTTP/S Bookmarks feature for clientless access. Hotfix HF062020.1 was published for all firewalls running v17.x.","vp":"n/a n/a","t":"","p":1593451818000},"CVE-2020-29574":{"s":9.8,"v":"CRITICAL","x":"An SQL injection vulnerability in the WebAdmin of Cyberoam OS through 2020-12-04 allows unauthenticated attackers to execute arbitrary SQL statements remotely.","vp":"n/a n/a","t":"","p":1607702627000},"CVE-2024-21413":{"s":9.8,"v":"CRITICAL","x":"Microsoft Outlook Remote Code Execution Vulnerability","vp":"Microsoft Microsoft 365 Apps for Enterprise","t":"Microsoft Outlook Remote Code Execution Vulnerability","p":1707847344799},"CVE-2022-23748":{"s":7.8,"v":"HIGH","x":"mDNSResponder.exe is vulnerable to DLL Sideloading attack. Executable improperly specifies how to load the DLL, from which folder and under what conditions. In these scenarios, a malicious attacker could be using the valid and legitimate executable to load malicious files.","vp":"n/a Audinate Dante Application Library for Windows","t":"","p":1668643200000},"CVE-2025-0411":{"s":7,"v":"HIGH","x":"7-Zip Mark-of-the-Web Bypass Vulnerability. This vulnerability allows remote attackers to bypass the Mark-of-the-Web protection mechanism on affected installations of 7-Zip. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific…","vp":"7-Zip 7-Zip","t":"7-Zip Mark-of-the-Web Bypass Vulnerability","p":1737779304270},"CVE-2024-53104":{"s":7.8,"v":"HIGH","x":"In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: uvcvideo: Skip parsing frames of type UVC_VS_UNDEFINED in uvc_parse_format\n\nThis can lead to out of bounds writes since frames of this type were not\ntaken into account when calculating the size of the frames buffer in\nuvc_parse_streaming.","vp":"Linux Linux","t":"media: uvcvideo: Skip parsing frames of type UVC_VS_UNDEFINED in uvc_parse_format","p":1733124567261},"CVE-2018-19410":{"s":9.8,"v":"CRITICAL","x":"PRTG Network Monitor before 18.2.40.1683 allows remote unauthenticated attackers to create users with read-write privileges (including administrator). A remote unauthenticated user can craft an HTTP request and override attributes of the 'include' directive in /public/login.htm and perform a Local File Inclusion…","vp":"n/a n/a","t":"","p":1542816000000},"CVE-2018-9276":{"s":7.2,"v":"HIGH","x":"An issue was discovered in PRTG Network Monitor before 18.2.39. An attacker who has access to the PRTG System Administrator web console with administrative privileges can exploit an OS command injection vulnerability (both on the server and on devices) by sending malformed parameters in sensor or notification…","vp":"n/a n/a","t":"","p":1530547200000},"CVE-2024-29059":{"s":7.5,"v":"HIGH","x":".NET Framework Information Disclosure Vulnerability","vp":"Microsoft Microsoft .NET Framework 4.8","t":".NET Framework Information Disclosure Vulnerability","p":1711148945745},"CVE-2024-45195":{"s":9.8,"v":"CRITICAL","x":"Direct Request ('Forced Browsing') vulnerability in Apache OFBiz.\n\nThis issue affects Apache OFBiz: before 18.12.16.\n\nUsers are recommended to upgrade to version 18.12.16, which fixes the issue.","vp":"Apache Software Foundation Apache OFBiz","t":"Apache OFBiz: Confused controller-view authorization logic (forced browsing)","p":1725437339201},"CVE-2025-24085":{"s":10,"v":"CRITICAL","x":"A use after free issue was addressed with improved memory management. This issue is fixed in iOS 18.3 and iPadOS 18.3, iPadOS 17.7.6, macOS Sequoia 15.3, macOS Sonoma 14.7.5, macOS Ventura 13.7.5, tvOS 18.3, visionOS 2.3, watchOS 11.3. A malicious application may be able to elevate privileges. Apple is aware of a…","vp":"Apple iOS and iPadOS","t":"","p":1738014346555},"CVE-2025-23006":{"s":9.8,"v":"CRITICAL","x":"Pre-authentication deserialization of untrusted data vulnerability has been identified in the SMA1000 Appliance Management Console (AMC) and Central Management Console (CMC), which in specific conditions could potentially enable a remote unauthenticated attacker to execute arbitrary OS commands.","vp":"SonicWall SMA1000","t":"","p":1737632261148},"CVE-2020-11023":{"s":6.9,"v":"MEDIUM","x":"In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing <option> elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.","vp":"jquery jQuery","t":"Potential XSS vulnerability in jQuery","p":1588118400000},"CVE-2024-50603":{"s":10,"v":"CRITICAL","x":"An issue was discovered in Aviatrix Controller before 7.1.4191 and 7.2.x before 7.2.4996. Due to the improper neutralization of special elements used in an OS command, an unauthenticated attacker is able to execute arbitrary code. Shell metacharacters can be sent to /v1/api in cloud_type for…","vp":"Aviatrix Controller","t":"","p":1736294400000},"CVE-2025-21335":{"s":7.8,"v":"HIGH","x":"Windows Hyper-V NT Kernel Integration VSP Elevation of Privilege Vulnerability","vp":"Microsoft Windows 10 Version 21H2","t":"Windows Hyper-V NT Kernel Integration VSP Elevation of Privilege Vulnerability","p":1736877857808},"CVE-2025-21334":{"s":7.8,"v":"HIGH","x":"Windows Hyper-V NT Kernel Integration VSP Elevation of Privilege Vulnerability","vp":"Microsoft Windows 10 Version 21H2","t":"Windows Hyper-V NT Kernel Integration VSP Elevation of Privilege Vulnerability","p":1736877891608},"CVE-2025-21333":{"s":7.8,"v":"HIGH","x":"Windows Hyper-V NT Kernel Integration VSP Elevation of Privilege Vulnerability","vp":"Microsoft Windows 10 Version 21H2","t":"Windows Hyper-V NT Kernel Integration VSP Elevation of Privilege Vulnerability","p":1736877890962},"CVE-2024-55591":{"s":9.6,"v":"CRITICAL","x":"An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] affecting FortiOS version 7.0.0 through 7.0.16 and FortiProxy version 7.0.0 through 7.0.19 and 7.2.0 through 7.2.12 allows a remote attacker to gain super-admin privileges via crafted requests to Node.js websocket module.","vp":"Fortinet FortiOS","t":"","p":1736863714207},"CVE-2023-48365":{"s":9.6,"v":"CRITICAL","x":"Qlik Sense Enterprise for Windows before August 2023 Patch 2 allows unauthenticated remote code execution, aka QB-21683. Due to improper validation of HTTP headers, a remote attacker is able to elevate their privilege by tunneling HTTP requests, allowing them to execute HTTP requests on the backend server that hosts…","vp":"n/a n/a","t":"","p":1700006400000},"CVE-2024-12686":{"s":6.6,"v":"MEDIUM","x":"A vulnerability has been discovered in Privileged Remote Access (PRA) and Remote Support (RS) which can allow an attacker with existing administrative privileges to inject commands and run as a site user.","vp":"BeyondTrust Remote Support(RS) & Privileged Remote Access(PRA)","t":"Command Injection vulnerability in Remote Support(RS) & Privilege Remote Access (PRA)","p":1734553437909},"CVE-2020-2883":{"s":9.8,"v":"CRITICAL","x":"Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via IIOP, T3 to compromise Oracle WebLogic…","vp":"Oracle Corporation WebLogic Server","t":"","p":1586957390000},"CVE-2024-55550":{"s":4.4,"v":"MEDIUM","x":"Mitel MiCollab through 9.8 SP2 could allow an authenticated attacker with administrative privilege to conduct a local file read, due to insufficient input sanitization. A successful exploit could allow the authenticated admin attacker to access resources that are constrained to the admin access level, and the…","vp":"n/a n/a","t":"","p":1733788800000},"CVE-2024-41713":{"s":9.1,"v":"CRITICAL","x":"A vulnerability in the NuPoint Unified Messaging (NPM) component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201) could allow an unauthenticated attacker to conduct a path traversal attack, due to insufficient input validation. A successful exploit could allow unauthorized access, enabling the attacker to view,…","vp":"n/a n/a","t":"","p":1729468800000}},"epss":{"CVE-2026-99999":[0.0021,0.106],"CVE-2026-97229":[0.0055,0.447],"CVE-2026-96044":[0.0073,0.534],"CVE-2026-93479":[0.0055,0.451],"CVE-2026-88794":[0.0028,0.189],"CVE-2026-88771":[0.0108,0.646],"CVE-2026-83518":[0.0034,0.26],"CVE-2026-81983":[0.0026,0.161],"CVE-2026-76472":[0.0013,0.02],"CVE-2026-76470":[0.0018,0.074],"CVE-2026-76469":[0.0015,0.037],"CVE-2026-76468":[0.0023,0.126],"CVE-2026-76467":[0.0025,0.155],"CVE-2026-76464":[0.0019,0.083],"CVE-2026-76463":[0.0014,0.029],"CVE-2026-63274":[0.0019,0.077],"CVE-2026-63273":[0.0012,0.017],"CVE-2026-6045":[0.0017,0.056],"CVE-2026-58094":[0.0012,0.016],"CVE-2026-58093":[0.001,0.007],"CVE-2026-18394":[0.0052,0.43],"CVE-2026-16756":[0.0075,0.541],"CVE-2026-16318":[0.0053,0.435],"CVE-2026-16317":[0.0025,0.149],"CVE-2026-15176":[0.0052,0.427],"CVE-2026-110447":[0.0123,0.683],"CVE-2026-110136":[0.0034,0.256],"CVE-2026-108471":[0.0033,0.247],"CVE-2026-108465":[0.0025,0.155],"CVE-2026-107406":[0.0047,0.394],"CVE-2026-106931":[0.0066,0.507],"CVE-2026-106426":[0.0024,0.136],"CVE-2026-106425":[0.0016,0.05],"CVE-2026-106424":[0.0019,0.082],"CVE-2026-106423":[0.003,0.215],"CVE-2026-106422":[0.002,0.092],"CVE-2026-106421":[0.003,0.216],"CVE-2026-106420":[0.0018,0.074],"CVE-2026-106418":[0.0021,0.107],"CVE-2026-106417":[0.0034,0.256],"CVE-2026-106416":[0.0019,0.076],"CVE-2026-106415":[0.002,0.094],"CVE-2026-106413":[0.0014,0.029],"CVE-2026-106412":[0.0024,0.136],"CVE-2026-106330":[0.002,0.094],"CVE-2026-106329":[0.0036,0.277],"CVE-2026-106328":[0.0017,0.065],"CVE-2026-106327":[0.0019,0.083],"CVE-2026-106325":[0.0023,0.132],"CVE-2026-106324":[0.0018,0.071],"CVE-2026-106322":[0.0019,0.082],"CVE-2026-106321":[0.002,0.094],"CVE-2026-106318":[0.003,0.215],"CVE-2026-106316":[0.0018,0.073],"CVE-2026-106315":[0.003,0.215],"CVE-2026-106314":[0.0024,0.144],"CVE-2026-106312":[0.0022,0.116],"CVE-2026-106311":[0.0019,0.082],"CVE-2026-106310":[0.0023,0.13],"CVE-2026-106309":[0.0024,0.144],"CVE-2026-106308":[0.0028,0.187],"CVE-2026-106307":[0.0022,0.113],"CVE-2026-106306":[0.0014,0.028],"CVE-2026-106304":[0.002,0.094],"CVE-2026-106303":[0.0022,0.116],"CVE-2026-106302":[0.0021,0.106],"CVE-2026-106301":[0.0024,0.141],"CVE-2026-106300":[0.0016,0.049],"CVE-2026-106299":[0.0018,0.068],"CVE-2026-106297":[0.002,0.092],"CVE-2026-106295":[0.0017,0.057],"CVE-2026-106294":[0.0031,0.222],"CVE-2026-106293":[0.0032,0.238],"CVE-2026-106292":[0.0033,0.248],"CVE-2026-106291":[0.003,0.215],"CVE-2026-106289":[0.0023,0.128],"CVE-2026-106288":[0.0018,0.071],"CVE-2026-106287":[0.002,0.097],"CVE-2026-105008":[0.006,0.476],"CVE-2026-103849":[0.0078,0.55],"CVE-2026-102764":[0.0118,0.672],"CVE-2026-102552":[0.0023,0.132],"CVE-2026-102551":[0.0027,0.184],"CVE-2026-0321":[0.0033,0.241],"CVE-2026-0320":[0.0084,0.572],"CVE-2026-0317":[0.003,0.211],"CVE-2026-0307":[0.001,0.01],"CVE-2025-61624":[0.0108,0.646],"CVE-2025-4318":[0.0098,0.615],"CVE-2019-8565":[0.1351,0.964],"CVE-2019-8521":[0.0082,0.565],"CVE-2017-7170":[0.0121,0.681],"CVE-2026-97858":[0.0026,0.16],"CVE-2026-97851":[0.0032,0.231],"CVE-2026-96252":[0.0048,0.4],"CVE-2026-95636":[0.0022,0.122],"CVE-2026-93637":[0.0029,0.206],"CVE-2026-93635":[0.0022,0.115],"CVE-2026-9255":[0.0018,0.066],"CVE-2026-8597":[0.0062,0.484],"CVE-2026-8596":[0.008,0.558],"CVE-2026-85851":[0.0033,0.244],"CVE-2026-83661":[0.0022,0.122],"CVE-2026-8178":[0.0071,0.527],"CVE-2026-76519":[0.0157,0.75],"CVE-2026-7461":[0.0081,0.56],"CVE-2026-73571":[0.0026,0.163],"CVE-2026-70111":[0.0067,0.512],"CVE-2026-69982":[0.0057,0.458],"CVE-2026-6912":[0.0097,0.61],"CVE-2026-6911":[0.0042,0.35],"CVE-2026-63252":[0.0058,0.468],"CVE-2026-63248":[0.0026,0.165],"CVE-2026-62927":[0.0042,0.346],"CVE-2026-61387":[0.0062,0.486],"CVE-2026-60007":[0.0055,0.45],"CVE-2026-59823":[0.0044,0.367],"CVE-2026-58080":[0.0038,0.302],"CVE-2026-5747":[0.0021,0.098],"CVE-2026-53492":[0.0035,0.273],"CVE-2026-53489":[0.0017,0.065],"CVE-2026-53488":[0.0018,0.067],"CVE-2026-5190":[0.0053,0.436],"CVE-2026-50195":[0.003,0.216],"CVE-2026-47262":[0.0027,0.172],"CVE-2026-35616":[0.091,0.953],"CVE-2026-35029":[0.0398,0.904],"CVE-2026-31431":[0.0344,0.888],"CVE-2026-15746":[0.0042,0.351],"CVE-2026-15737":[0.0038,0.306],"CVE-2026-15643":[0.0039,0.316],"CVE-2026-15415":[0.0035,0.274],"CVE-2026-14471":[0.0058,0.467],"CVE-2026-13769":[0.0016,0.053],"CVE-2026-13763":[0.0068,0.513],"CVE-2026-13762":[0.0063,0.49],"CVE-2026-12043":[0.0035,0.266],"CVE-2026-111105":[0.0014,0.031],"CVE-2026-110310":[0.0051,0.421],"CVE-2026-108131":[0.0074,0.537],"CVE-2026-108065":[0.0076,0.546],"CVE-2026-107777":[0.0032,0.23],"CVE-2026-107621":[0.0034,0.263],"CVE-2026-107617":[0.0032,0.24],"CVE-2026-10740":[0.0029,0.203],"CVE-2026-107362":[0.0035,0.268],"CVE-2026-107361":[0.0023,0.128],"CVE-2026-107337":[0.0013,0.021],"CVE-2026-107336":[0.0024,0.142],"CVE-2026-107335":[0.0046,0.382],"CVE-2026-107334":[0.0021,0.108],"CVE-2026-107333":[0.0098,0.615],"CVE-2026-10631":[0.0021,0.109],"CVE-2026-106170":[0.0028,0.195],"CVE-2026-10591":[0.0069,0.52],"CVE-2026-105740":[0.0059,0.471],"CVE-2026-105667":[0.0021,0.105],"CVE-2026-105664":[0.0033,0.252],"CVE-2026-105279":[0.0024,0.142],"CVE-2026-105273":[0.0034,0.263],"CVE-2026-105134":[0.0478,0.918],"CVE-2026-105133":[0.0085,0.576],"CVE-2026-104935":[0.2598,0.98],"CVE-2026-102257":[0.0065,0.502],"CVE-2026-101021":[0.0034,0.263],"CVE-2026-0322":[0.0121,0.681],"CVE-2026-0319":[0.0028,0.19],"CVE-2026-0318":[0.0032,0.231],"CVE-2026-0316":[0.0027,0.172],"CVE-2026-0315":[0.001,0.01],"CVE-2026-0314":[0.001,0.008],"CVE-2026-0313":[0.0083,0.569],"CVE-2026-0312":[0.0014,0.031],"CVE-2026-0311":[0.0011,0.011],"CVE-2024-47575":[0.9477,0.999],"CVE-2018-10389":[0.0226,0.827],"CVE-2018-10388":[0.0436,0.911],"CVE-2026-96951":[0.0151,0.741],"CVE-2026-96940":[0.0049,0.404],"CVE-2026-92817":[0.0048,0.403],"CVE-2026-90970":[0.0094,0.604],"CVE-2026-88779":[0.0059,0.472],"CVE-2026-88772":[0.013,0.7],"CVE-2026-8838":[0.008,0.559],"CVE-2026-88070":[0.0032,0.236],"CVE-2026-86360":[0.0063,0.493],"CVE-2026-85920":[0.0016,0.045],"CVE-2026-85880":[0.0362,0.894],"CVE-2026-85479":[0.0025,0.155],"CVE-2026-85097":[0.0031,0.225],"CVE-2026-83500":[0.004,0.332],"CVE-2026-82078":[0.6353,0.992],"CVE-2026-82077":[0.0074,0.537],"CVE-2026-81963":[0.0039,0.32],"CVE-2026-81578":[0.8558,0.997],"CVE-2026-76501":[0.0051,0.422],"CVE-2026-76500":[0.0032,0.24],"CVE-2026-76499":[0.0031,0.22],"CVE-2026-76498":[0.003,0.213],"CVE-2026-76486":[0.0051,0.422],"CVE-2026-76485":[0.0051,0.422],"CVE-2026-76484":[0.0028,0.187],"CVE-2026-76483":[0.0022,0.119],"CVE-2026-76482":[0.002,0.093],"CVE-2026-76480":[0.0033,0.249],"CVE-2026-76471":[0.0052,0.431],"CVE-2026-76465":[0.0045,0.375],"CVE-2026-76459":[0.0031,0.22],"CVE-2026-76458":[0.0028,0.189],"CVE-2026-76457":[0.0028,0.189],"CVE-2026-76456":[0.0028,0.189],"CVE-2026-76455":[0.0028,0.196],"CVE-2026-76454":[0.0058,0.467],"CVE-2026-76453":[0.0034,0.254],"CVE-2026-76452":[0.0037,0.294],"CVE-2026-76437":[0.0052,0.429],"CVE-2026-74580":[0.0013,0.021],"CVE-2026-7395":[0.0025,0.149],"CVE-2026-61500":[0.0099,0.617],"CVE-2026-58113":[0.0039,0.318],"CVE-2026-47483":[0.0034,0.253],"CVE-2026-4638":[0.0027,0.177],"CVE-2026-4637":[0.0055,0.449],"CVE-2026-42532":[0.0013,0.021],"CVE-2026-41958":[0.0025,0.153],"CVE-2026-39919":[0.0078,0.552],"CVE-2026-39460":[0.0029,0.203],"CVE-2026-39453":[0.0029,0.201],"CVE-2026-34197":[0.1549,0.968],"CVE-2026-33367":[0.0029,0.201],"CVE-2026-33272":[0.0015,0.038],"CVE-2026-32645":[0.0012,0.015],"CVE-2026-29797":[0.0016,0.044],"CVE-2026-28745":[0.0022,0.113],"CVE-2026-27873":[0.0009,0.003],"CVE-2026-27872":[0.0009,0.003],"CVE-2026-20362":[0.0047,0.393],"CVE-2026-20328":[0.0052,0.428],"CVE-2026-15340":[0.006,0.475],"CVE-2026-11796":[0.0025,0.149],"CVE-2026-108096":[0.003,0.212],"CVE-2026-107783":[0.001,0.01],"CVE-2026-107608":[0.0014,0.031],"CVE-2026-107607":[0.0019,0.078],"CVE-2026-107606":[0.0019,0.078],"CVE-2026-107605":[0.0019,0.078],"CVE-2026-107352":[0.002,0.093],"CVE-2026-107332":[0.0011,0.01],"CVE-2026-107322":[0.0013,0.021],"CVE-2026-106032":[0.0023,0.131],"CVE-2026-105812":[0.0028,0.195],"CVE-2026-105811":[0.0033,0.249],"CVE-2026-105445":[0.0041,0.342],"CVE-2026-105281":[0.0031,0.226],"CVE-2026-105278":[0.0034,0.261],"CVE-2026-105269":[0.0036,0.287],"CVE-2026-104629":[0.0034,0.255],"CVE-2026-104019":[0.0142,0.724],"CVE-2026-103956":[0.0047,0.391],"CVE-2026-103572":[0.0082,0.565],"CVE-2026-102489":[0.0126,0.69],"CVE-2026-102255":[0.0048,0.398],"CVE-2026-101022":[0.0019,0.076],"CVE-2026-100730":[0.0063,0.489],"CVE-2025-59375":[0.0132,0.703],"CVE-2024-8176":[0.0135,0.711],"CVE-2023-6320":[0.0392,0.902],"CVE-2023-6317":[0.0108,0.645],"CVE-2023-22894":[0.0361,0.893],"CVE-2021-3199":[0.2014,0.974],"CVE-2021-22205":[0.9973,1],"CVE-2019-11510":[1,1],"CVE-2016-3081":[0.9605,0.999],"CVE-2015-5477":[0.9941,0.999],"CVE-2015-3306":[0.995,0.999],"CVE-2014-6278":[0.9968,1],"CVE-2026-97662":[0.0014,0.032],"CVE-2026-97363":[0.0032,0.236],"CVE-2026-97212":[0.0025,0.151],"CVE-2026-96883":[0.0065,0.501],"CVE-2026-96613":[0.0024,0.135],"CVE-2026-96587":[0.0034,0.263],"CVE-2026-96274":[0.0016,0.046],"CVE-2026-95102":[0.0034,0.26],"CVE-2026-94594":[0.0011,0.014],"CVE-2026-94593":[0.0011,0.014],"CVE-2026-94592":[0.0013,0.021],"CVE-2026-94591":[0.0009,0.003],"CVE-2026-94204":[0.0027,0.176],"CVE-2026-93616":[0.7587,0.995],"CVE-2026-93474":[0.002,0.095],"CVE-2026-91191":[0.0021,0.104],"CVE-2026-90443":[0.0018,0.067],"CVE-2026-88778":[0.0038,0.303],"CVE-2026-88777":[0.0038,0.309],"CVE-2026-88776":[0.0038,0.309],"CVE-2026-88775":[0.0038,0.309],"CVE-2026-88774":[0.0024,0.141],"CVE-2026-88773":[0.0036,0.284],"CVE-2026-88761":[0.0017,0.058],"CVE-2026-87902":[0.3998,0.986],"CVE-2026-87118":[0.0024,0.134],"CVE-2026-86950":[0.0124,0.687],"CVE-2026-86131":[0.0042,0.349],"CVE-2026-85496":[0.0025,0.152],"CVE-2026-84411":[0.0095,0.604],"CVE-2026-84409":[0.0039,0.317],"CVE-2026-84403":[0.0012,0.018],"CVE-2026-84399":[0.0019,0.085],"CVE-2026-82716":[0.0017,0.058],"CVE-2026-82566":[0.0028,0.188],"CVE-2026-81630":[0.0019,0.084],"CVE-2026-77967":[0.0024,0.134],"CVE-2026-76504":[0.0182,0.784],"CVE-2026-76447":[0.0038,0.3],"CVE-2026-76446":[0.003,0.215],"CVE-2026-76444":[0.0029,0.197],"CVE-2026-76439":[0.0032,0.239],"CVE-2026-75558":[0.0016,0.051],"CVE-2026-73570":[0.7166,0.994],"CVE-2026-72510":[0.0029,0.201],"CVE-2026-72507":[0.0029,0.201],"CVE-2026-71379":[0.0044,0.369],"CVE-2026-71362":[0.8751,0.998],"CVE-2026-71302":[0.0029,0.198],"CVE-2026-71189":[0.0019,0.077],"CVE-2026-70356":[0.004,0.321],"CVE-2026-69662":[0.0019,0.078],"CVE-2026-68954":[0.0029,0.201],"CVE-2026-68068":[0.0029,0.201],"CVE-2026-67279":[0.0103,0.63],"CVE-2026-65669":[0.0086,0.579],"CVE-2026-65660":[0.021,0.814],"CVE-2026-64893":[0.0012,0.016],"CVE-2026-64892":[0.0024,0.143],"CVE-2026-63713":[0.0029,0.201],"CVE-2026-63688":[0.0079,0.555],"CVE-2026-5430":[0.0059,0.47],"CVE-2026-50375":[0.0029,0.207],"CVE-2026-35273":[0.9668,0.999],"CVE-2026-28326":[0.0069,0.52],"CVE-2026-22755":[0.2018,0.974],"CVE-2026-20273":[0.0047,0.39],"CVE-2026-20272":[0.0057,0.462],"CVE-2026-20271":[0.0047,0.39],"CVE-2026-20270":[0.0047,0.39],"CVE-2026-20269":[0.0047,0.39],"CVE-2026-20268":[0.0047,0.39],"CVE-2026-20267":[0.0038,0.309],"CVE-2026-19490":[0.2316,0.977],"CVE-2026-18145":[0.0039,0.315],"CVE-2026-15953":[0.0011,0.014],"CVE-2026-15952":[0.0009,0.005],"CVE-2026-13742":[0.0012,0.016],"CVE-2026-13046":[0.0037,0.293],"CVE-2026-104286":[0.022,0.822],"CVE-2026-104020":[0.0044,0.368],"CVE-2026-104002":[0.0031,0.219],"CVE-2026-103958":[0.0033,0.248],"CVE-2026-103957":[0.0038,0.303],"CVE-2026-103505":[0.0043,0.361],"CVE-2026-102490":[0.0055,0.448],"CVE-2026-101104":[0.0027,0.177],"CVE-2026-100308":[0.0014,0.027],"CVE-2026-100299":[0.0009,0.003],"CVE-2026-100298":[0.0029,0.197],"CVE-2026-100297":[0.0019,0.078],"CVE-2026-100296":[0.0034,0.26],"CVE-2026-100295":[0.0021,0.1],"CVE-2026-100294":[0.0023,0.131],"CVE-2026-100293":[0.0018,0.068],"CVE-2026-100292":[0.0029,0.2],"CVE-2026-100291":[0.0033,0.247],"CVE-2026-0250":[0.0039,0.317],"CVE-2024-45519":[0.9991,1],"CVE-2023-46604":[0.9989,1],"CVE-2026-96417":[0.0015,0.035],"CVE-2026-9586":[0.1898,0.973],"CVE-2026-94450":[0.0194,0.798],"CVE-2026-94127":[0.0223,0.824],"CVE-2026-93952":[0.0106,0.64],"CVE-2026-93291":[0.0024,0.136],"CVE-2026-93290":[0.0011,0.012],"CVE-2026-93289":[0.0068,0.516],"CVE-2026-91818":[0.0011,0.011],"CVE-2026-91817":[0.0011,0.011],"CVE-2026-91816":[0.0012,0.015],"CVE-2026-91815":[0.0013,0.021],"CVE-2026-91813":[0.0009,0.004],"CVE-2026-91812":[0.0014,0.029],"CVE-2026-91811":[0.0012,0.015],"CVE-2026-91810":[0.0011,0.011],"CVE-2026-91809":[0.0012,0.015],"CVE-2026-91808":[0.0011,0.011],"CVE-2026-91807":[0.0011,0.011],"CVE-2026-91806":[0.0012,0.015],"CVE-2026-91801":[0.0015,0.041],"CVE-2026-91799":[0.0013,0.026],"CVE-2026-91797":[0.0022,0.111],"CVE-2026-91796":[0.0012,0.017],"CVE-2026-91795":[0.0008,0.003],"CVE-2026-91794":[0.0016,0.05],"CVE-2026-91793":[0.0013,0.02],"CVE-2026-91018":[0.0024,0.141],"CVE-2026-89207":[0.0043,0.362],"CVE-2026-88956":[0.0022,0.114],"CVE-2026-88020":[0.0027,0.187],"CVE-2026-87886":[0.0023,0.132],"CVE-2026-87491":[0.0314,0.877],"CVE-2026-87121":[0.0053,0.434],"CVE-2026-8686":[0.0068,0.516],"CVE-2026-86218":[0.1335,0.964],"CVE-2026-86060":[0.0639,0.936],"CVE-2026-85706":[0.9296,0.998],"CVE-2026-85102":[0.504,0.989],"CVE-2026-85046":[0.4888,0.989],"CVE-2026-84869":[0.0092,0.597],"CVE-2026-8452":[0.0101,0.625],"CVE-2026-83549":[0.0989,0.955],"CVE-2026-83548":[0.0804,0.947],"CVE-2026-82708":[0.0021,0.109],"CVE-2026-82585":[0.0013,0.02],"CVE-2026-82329":[0.1412,0.965],"CVE-2026-79959":[0.0017,0.064],"CVE-2026-76461":[0.2954,0.982],"CVE-2026-76460":[0.1403,0.965],"CVE-2026-75650":[0.0395,0.903],"CVE-2026-7273":[0.025,0.845],"CVE-2026-67367":[0.0111,0.653],"CVE-2026-67277":[0.0156,0.748],"CVE-2026-66804":[0.003,0.21],"CVE-2026-66384":[0.0066,0.508],"CVE-2026-60004":[0.2399,0.978],"CVE-2026-59822":[0.0084,0.569],"CVE-2026-58704":[0.0059,0.472],"CVE-2026-57238":[0.0017,0.06],"CVE-2026-53362":[0.0071,0.526],"CVE-2026-53266":[0.0083,0.567],"CVE-2026-50343":[0.003,0.21],"CVE-2026-50093":[0.0032,0.234],"CVE-2026-49869":[0.0209,0.813],"CVE-2026-48710":[0.0706,0.941],"CVE-2026-42018":[0.098,0.955],"CVE-2026-42016":[0.0864,0.951],"CVE-2026-34223":[0.0019,0.085],"CVE-2026-21962":[0.7319,0.995],"CVE-2026-20079":[0.8818,0.998],"CVE-2026-18963":[0.0318,0.879],"CVE-2026-16796":[0.0073,0.532],"CVE-2026-16584":[0.0023,0.125],"CVE-2026-15957":[0.0075,0.541],"CVE-2026-15895":[0.0108,0.645],"CVE-2026-14904":[0.0057,0.46],"CVE-2026-14265":[0.0073,0.533],"CVE-2026-13795":[0.0027,0.186],"CVE-2026-13760":[0.0116,0.666],"CVE-2026-13129":[0.0017,0.06],"CVE-2026-13128":[0.0017,0.06],"CVE-2026-12958":[0.0019,0.082],"CVE-2026-12957":[0.0023,0.132],"CVE-2026-12283":[0.0059,0.471],"CVE-2026-11931":[0.0012,0.018],"CVE-2026-11401":[0.0031,0.217],"CVE-2026-11400":[0.004,0.322],"CVE-2025-39964":[0.0136,0.713],"CVE-2025-39682":[0.0288,0.866],"CVE-2025-25249":[0.038,0.899],"CVE-2024-0244":[0.0138,0.717],"CVE-2023-49105":[0.4292,0.987],"CVE-2022-0995":[0.0886,0.952],"CVE-2021-23758":[0.8258,0.997],"CVE-2019-1068":[0.5727,0.991],"CVE-2015-5287":[0.05,0.921],"CVE-2015-3246":[0.085,0.95],"CVE-2026-9198":[0.2866,0.981],"CVE-2026-9082":[0.157,0.968],"CVE-2026-8398":[0.0096,0.61],"CVE-2026-8037":[0.7736,0.996],"CVE-2026-7473":[0.0065,0.501],"CVE-2026-72898":[0.9734,0.999],"CVE-2026-72530":[0.0169,0.766],"CVE-2026-72529":[0.0146,0.732],"CVE-2026-68820":[0.0033,0.248],"CVE-2026-65400":[0.0172,0.771],"CVE-2026-64849":[0.0984,0.955],"CVE-2026-63077":[0.8957,0.998],"CVE-2026-63030":[0.1065,0.958],"CVE-2026-60137":[0.0532,0.925],"CVE-2026-59310":[0.0256,0.849],"CVE-2026-58644":[0.1587,0.969],"CVE-2026-56291":[0.1485,0.967],"CVE-2026-56290":[0.3087,0.982],"CVE-2026-56164":[0.0101,0.625],"CVE-2026-56155":[0.0035,0.266],"CVE-2026-55255":[0.0089,0.586],"CVE-2026-55040":[0.6954,0.994],"CVE-2026-54420":[0.0081,0.56],"CVE-2026-50751":[0.8534,0.997],"CVE-2026-50522":[0.0304,0.873],"CVE-2026-48939":[0.2007,0.974],"CVE-2026-48908":[0.8851,0.998],"CVE-2026-48907":[0.1619,0.969],"CVE-2026-48558":[0.0572,0.929],"CVE-2026-48282":[0.4239,0.987],"CVE-2026-48172":[0.0101,0.625],"CVE-2026-48027":[0.0134,0.707],"CVE-2026-46817":[0.0081,0.562],"CVE-2026-45659":[0.027,0.857],"CVE-2026-45321":[0.0105,0.638],"CVE-2026-45247":[0.0209,0.813],"CVE-2026-42271":[0.9257,0.998],"CVE-2026-39808":[0.4736,0.988],"CVE-2026-34926":[0.0054,0.441],"CVE-2026-34910":[0.4577,0.988],"CVE-2026-34909":[0.0179,0.781],"CVE-2026-34908":[0.1521,0.967],"CVE-2026-34486":[0.0656,0.937],"CVE-2026-33824":[0.0162,0.757],"CVE-2026-28318":[0.0194,0.798],"CVE-2026-25089":[0.7611,0.995],"CVE-2026-20349":[0.0101,0.625],"CVE-2026-20316":[0.351,0.984],"CVE-2026-20262":[0.2817,0.981],"CVE-2026-20253":[0.9694,0.999],"CVE-2026-20245":[0.2532,0.979],"CVE-2026-20230":[0.882,0.998],"CVE-2026-18577":[0.1462,0.966],"CVE-2026-18556":[0.0788,0.947],"CVE-2026-16812":[0.01,0.622],"CVE-2026-16232":[0.7797,0.996],"CVE-2026-15410":[0.1179,0.96],"CVE-2026-15409":[0.0679,0.939],"CVE-2026-12569":[0.4605,0.988],"CVE-2026-11645":[0.0244,0.84],"CVE-2026-10520":[0.9991,1],"CVE-2026-0770":[0.6301,0.992],"CVE-2026-0257":[0.9689,0.999],"CVE-2025-68686":[0.295,0.982],"CVE-2025-67038":[0.1996,0.974],"CVE-2025-62593":[0.6246,0.992],"CVE-2025-48595":[0.0171,0.77],"CVE-2025-34291":[0.9281,0.998],"CVE-2024-6387":[0.9951,0.999],"CVE-2024-3094":[0.909,0.998],"CVE-2024-21182":[0.7416,0.995],"CVE-2023-4911":[0.6377,0.992],"CVE-2023-4346":[0.0129,0.698],"CVE-2023-34362":[0.9993,1],"CVE-2022-26923":[0.835,0.997],"CVE-2022-26134":[1,1],"CVE-2022-22965":[0.9964,1],"CVE-2022-0847":[0.928,0.998],"CVE-2022-0492":[0.0553,0.927],"CVE-2021-44228":[1,1],"CVE-2021-42287":[0.7717,0.996],"CVE-2021-42278":[0.733,0.995],"CVE-2021-4034":[0.9492,0.999],"CVE-2021-36942":[0.6602,0.993],"CVE-2021-36934":[0.6725,0.993],"CVE-2021-34527":[0.9979,1],"CVE-2021-3156":[0.9996,1],"CVE-2021-27137":[0.0399,0.904],"CVE-2021-1675":[0.853,0.997],"CVE-2020-1938":[0.9927,0.999],"CVE-2020-1472":[0.9939,0.999],"CVE-2020-1350":[0.9672,0.999],"CVE-2020-0796":[0.9981,1],"CVE-2020-0601":[0.8944,0.998],"CVE-2019-0708":[1,1],"CVE-2017-5638":[1,1],"CVE-2017-0144":[0.9923,0.999],"CVE-2016-5195":[0.8352,0.997],"CVE-2008-4250":[0.9875,0.999],"CVE-2008-4128":[0.3387,0.984],"CVE-2026-6973":[0.0254,0.847],"CVE-2026-5281":[0.007,0.524],"CVE-2026-45498":[0.0127,0.693],"CVE-2026-42897":[0.0052,0.429],"CVE-2026-42208":[0.0577,0.93],"CVE-2026-41940":[0.9853,0.999],"CVE-2026-41091":[0.0044,0.371],"CVE-2026-39987":[0.3786,0.985],"CVE-2026-3910":[0.0107,0.642],"CVE-2026-3909":[0.0234,0.834],"CVE-2026-3502":[0.0033,0.244],"CVE-2026-34621":[0.0218,0.821],"CVE-2026-33825":[0.004,0.326],"CVE-2026-33634":[0.0168,0.766],"CVE-2026-33017":[0.2475,0.979],"CVE-2026-32202":[0.049,0.92],"CVE-2026-32201":[0.4338,0.987],"CVE-2026-3055":[0.0404,0.905],"CVE-2026-21643":[0.9387,0.998],"CVE-2026-20963":[0.292,0.982],"CVE-2026-20182":[0.9182,0.998],"CVE-2026-20133":[0.3243,0.983],"CVE-2026-20131":[0.4317,0.987],"CVE-2026-20128":[0.0722,0.943],"CVE-2026-20122":[0.2548,0.979],"CVE-2026-1603":[0.8833,0.998],"CVE-2026-1340":[0.9864,0.999],"CVE-2026-0300":[0.3172,0.983],"CVE-2025-68613":[0.9899,0.999],"CVE-2025-66376":[0.2023,0.974],"CVE-2025-60710":[0.0461,0.916],"CVE-2025-5777":[0.9997,1],"CVE-2025-54068":[0.9628,0.999],"CVE-2025-53770":[1,1],"CVE-2025-53521":[0.023,0.83],"CVE-2025-48700":[0.0171,0.77],"CVE-2025-47813":[0.6251,0.992],"CVE-2025-43520":[0.0043,0.353],"CVE-2025-43510":[0.0036,0.277],"CVE-2025-32975":[0.0249,0.844],"CVE-2025-32433":[0.9879,0.999],"CVE-2025-32432":[0.9979,1],"CVE-2025-31324":[0.9949,0.999],"CVE-2025-31277":[0.016,0.754],"CVE-2025-29824":[0.139,0.965],"CVE-2025-29635":[0.8794,0.998],"CVE-2025-2749":[0.0402,0.905],"CVE-2025-26399":[0.9012,0.998],"CVE-2025-1974":[0.9938,0.999],"CVE-2025-0282":[0.9998,1],"CVE-2024-7399":[0.9194,0.998],"CVE-2024-57728":[0.6466,0.992],"CVE-2024-57726":[0.666,0.993],"CVE-2024-3400":[1,1],"CVE-2024-27199":[0.9999,1],"CVE-2024-23897":[1,1],"CVE-2024-21887":[1,1],"CVE-2024-1709":[0.9998,1],"CVE-2024-1708":[0.9544,0.999],"CVE-2023-4966":[1,1],"CVE-2023-4863":[0.9998,1],"CVE-2023-46805":[0.9999,1],"CVE-2023-41064":[0.534,0.99],"CVE-2023-38831":[0.9981,1],"CVE-2023-36424":[0.1209,0.961],"CVE-2023-2868":[0.8684,0.997],"CVE-2023-27351":[0.7805,0.996],"CVE-2023-23397":[0.9716,0.999],"CVE-2023-21529":[0.5929,0.991],"CVE-2023-20198":[0.9961,0.999],"CVE-2022-41082":[0.9997,1],"CVE-2022-41040":[0.9996,1],"CVE-2022-40684":[0.9998,1],"CVE-2022-30190":[0.9916,0.999],"CVE-2022-1388":[0.9995,1],"CVE-2021-34523":[0.9999,1],"CVE-2021-34473":[1,1],"CVE-2021-31207":[0.9978,1],"CVE-2021-30860":[0.7599,0.995],"CVE-2021-30116":[0.8573,0.997],"CVE-2021-27065":[0.9988,1],"CVE-2021-26855":[1,1],"CVE-2021-22054":[0.9968,1],"CVE-2021-21974":[0.4506,0.988],"CVE-2021-21972":[0.9987,1],"CVE-2020-9715":[0.3349,0.984],"CVE-2020-5902":[1,1],"CVE-2019-19781":[1,1],"CVE-2018-13379":[1,1],"CVE-2017-5754":[0.8417,0.997],"CVE-2017-5753":[0.9384,0.998],"CVE-2017-5715":[0.7404,0.995],"CVE-2017-13077":[0.0239,0.837],"CVE-2017-11882":[0.9994,1],"CVE-2012-1854":[0.2087,0.975],"CVE-2010-0806":[0.8224,0.997],"CVE-2010-0249":[0.9194,0.998],"CVE-2009-3459":[0.8665,0.997],"CVE-2009-1537":[0.5136,0.989],"CVE-2009-0238":[0.4294,0.987],"CVE-2026-25108":[0.0525,0.924],"CVE-2026-24858":[0.858,0.997],"CVE-2026-24423":[0.8818,0.998],"CVE-2026-2441":[0.5496,0.99],"CVE-2026-24061":[0.9898,0.999],"CVE-2026-23760":[0.9643,0.999],"CVE-2026-22769":[0.1353,0.964],"CVE-2026-22719":[0.1808,0.972],"CVE-2026-21533":[0.0415,0.907],"CVE-2026-21525":[0.0483,0.919],"CVE-2026-21519":[0.0248,0.843],"CVE-2026-21514":[0.0159,0.752],"CVE-2026-21513":[0.1585,0.969],"CVE-2026-21510":[0.2454,0.979],"CVE-2026-21509":[0.7079,0.994],"CVE-2026-21385":[0.0126,0.693],"CVE-2026-20805":[0.0746,0.944],"CVE-2026-20700":[0.0139,0.719],"CVE-2026-20127":[0.8848,0.998],"CVE-2026-20045":[0.0454,0.915],"CVE-2026-1731":[0.9246,0.998],"CVE-2026-1281":[0.9869,0.999],"CVE-2025-9242":[0.918,0.998],"CVE-2025-8110":[0.852,0.997],"CVE-2025-68645":[0.4887,0.989],"CVE-2025-68461":[0.2684,0.98],"CVE-2025-66644":[0.0341,0.887],"CVE-2025-64446":[0.9196,0.998],"CVE-2025-64328":[0.8462,0.997],"CVE-2025-62221":[0.025,0.845],"CVE-2025-62215":[0.0446,0.913],"CVE-2025-6218":[0.9048,0.998],"CVE-2025-6205":[0.7357,0.995],"CVE-2025-6204":[0.792,0.996],"CVE-2025-61932":[0.0277,0.861],"CVE-2025-61884":[0.9589,0.999],"CVE-2025-61757":[0.8865,0.998],"CVE-2025-59718":[0.6829,0.993],"CVE-2025-59374":[0.012,0.676],"CVE-2025-59287":[0.9998,1],"CVE-2025-59230":[0.0266,0.854],"CVE-2025-58360":[0.6052,0.991],"CVE-2025-58034":[0.5558,0.99],"CVE-2025-55182":[0.998,1],"CVE-2025-54313":[0.0493,0.92],"CVE-2025-54253":[0.8826,0.998],"CVE-2025-54236":[0.9466,0.999],"CVE-2025-52691":[0.8566,0.997],"CVE-2025-49113":[0.9897,0.999],"CVE-2025-48703":[0.9966,1],"CVE-2025-48633":[0.0026,0.168],"CVE-2025-48572":[0.0026,0.164],"CVE-2025-47827":[0.0493,0.92],"CVE-2025-43529":[0.0876,0.951],"CVE-2025-41244":[0.0844,0.949],"CVE-2025-40602":[0.0276,0.86],"CVE-2025-40551":[0.8418,0.997],"CVE-2025-40536":[0.7356,0.995],"CVE-2025-37164":[0.9019,0.998],"CVE-2025-34026":[0.8178,0.996],"CVE-2025-33073":[0.827,0.997],"CVE-2025-31125":[0.6519,0.992],"CVE-2025-2747":[0.9717,0.999],"CVE-2025-2746":[0.7406,0.995],"CVE-2025-24990":[0.0637,0.936],"CVE-2025-24893":[0.9986,1],"CVE-2025-21042":[0.3317,0.984],"CVE-2025-20393":[0.3239,0.983],"CVE-2025-15556":[0.0177,0.778],"CVE-2025-14847":[0.8322,0.997],"CVE-2025-14733":[0.2651,0.98],"CVE-2025-14611":[0.533,0.99],"CVE-2025-14174":[0.2233,0.977],"CVE-2025-13223":[0.049,0.92],"CVE-2025-12480":[0.9575,0.999],"CVE-2025-11953":[0.9398,0.998],"CVE-2025-11371":[0.9214,0.998],"CVE-2024-7694":[0.0179,0.78],"CVE-2024-43468":[0.8104,0.996],"CVE-2024-37079":[0.2238,0.977],"CVE-2023-52163":[0.9692,0.999],"CVE-2023-43000":[0.0404,0.905],"CVE-2023-41974":[0.0196,0.799],"CVE-2022-48503":[0.0321,0.88],"CVE-2022-37055":[0.5553,0.99],"CVE-2022-20775":[0.1247,0.962],"CVE-2021-39935":[0.3614,0.985],"CVE-2021-30952":[0.0696,0.941],"CVE-2021-26829":[0.4805,0.988],"CVE-2021-26828":[0.3936,0.986],"CVE-2021-22681":[0.6363,0.992],"CVE-2021-22175":[0.5337,0.99],"CVE-2020-7796":[0.8442,0.997],"CVE-2019-19006":[0.5595,0.99],"CVE-2018-4063":[0.2726,0.98],"CVE-2018-14634":[0.1469,0.966],"CVE-2017-7921":[1,1],"CVE-2016-7836":[0.1923,0.973],"CVE-2009-0556":[0.6731,0.993],"CVE-2008-0015":[0.7658,0.995],"CVE-2025-9377":[0.3773,0.985],"CVE-2025-8876":[0.0345,0.888],"CVE-2025-8875":[0.019,0.793],"CVE-2025-8088":[0.9451,0.999],"CVE-2025-7775":[0.2028,0.974],"CVE-2025-6558":[0.1093,0.958],"CVE-2025-6554":[0.1414,0.965],"CVE-2025-6543":[0.1056,0.957],"CVE-2025-61882":[0.9973,1],"CVE-2025-59689":[0.0186,0.789],"CVE-2025-57819":[0.9502,0.999],"CVE-2025-55177":[0.0473,0.917],"CVE-2025-54948":[0.2392,0.978],"CVE-2025-54309":[0.9511,0.999],"CVE-2025-5419":[0.0782,0.946],"CVE-2025-53690":[0.606,0.991],"CVE-2025-5086":[0.9691,0.999],"CVE-2025-49706":[0.9909,0.999],"CVE-2025-49704":[1,1],"CVE-2025-48928":[0.0055,0.45],"CVE-2025-48927":[0.111,0.959],"CVE-2025-48543":[0.0063,0.494],"CVE-2025-48384":[0.0438,0.912],"CVE-2025-47812":[0.9388,0.998],"CVE-2025-47729":[0.0045,0.374],"CVE-2025-4632":[0.2407,0.978],"CVE-2025-4428":[0.8698,0.997],"CVE-2025-4427":[0.9992,1],"CVE-2025-43300":[0.325,0.983],"CVE-2025-43200":[0.0119,0.675],"CVE-2025-42999":[0.1274,0.962],"CVE-2025-4008":[0.9332,0.998],"CVE-2025-3935":[0.0354,0.891],"CVE-2025-38352":[0.0134,0.709],"CVE-2025-35939":[0.0135,0.71],"CVE-2025-33053":[0.8701,0.997],"CVE-2025-32756":[0.307,0.982],"CVE-2025-32709":[0.0182,0.784],"CVE-2025-32706":[0.0233,0.833],"CVE-2025-32701":[0.0142,0.723],"CVE-2025-32463":[0.555,0.99],"CVE-2025-30400":[0.0192,0.795],"CVE-2025-30397":[0.2704,0.98],"CVE-2025-27920":[0.0186,0.789],"CVE-2025-27915":[0.0406,0.905],"CVE-2025-2776":[0.6473,0.992],"CVE-2025-2775":[0.4261,0.987],"CVE-2025-27363":[0.2777,0.981],"CVE-2025-27038":[0.0102,0.627],"CVE-2025-25257":[0.9992,1],"CVE-2025-24016":[0.9384,0.998],"CVE-2025-21480":[0.0046,0.384],"CVE-2025-21479":[0.0084,0.572],"CVE-2025-21043":[0.0214,0.817],"CVE-2025-20362":[0.8709,0.998],"CVE-2025-20352":[0.415,0.987],"CVE-2025-20337":[0.745,0.995],"CVE-2025-20333":[0.7121,0.994],"CVE-2025-20281":[0.976,0.999],"CVE-2025-10585":[0.0539,0.926],"CVE-2025-10035":[0.998,1],"CVE-2024-8069":[0.1464,0.966],"CVE-2024-8068":[0.0348,0.889],"CVE-2024-6047":[0.1007,0.956],"CVE-2024-56145":[0.974,0.999],"CVE-2024-54085":[0.6075,0.991],"CVE-2024-42009":[0.8288,0.997],"CVE-2024-27443":[0.2461,0.979],"CVE-2024-12987":[0.9816,0.999],"CVE-2024-11182":[0.3135,0.983],"CVE-2024-11120":[0.2839,0.981],"CVE-2024-0769":[0.8271,0.997],"CVE-2023-50224":[0.2002,0.974],"CVE-2023-39780":[0.3951,0.986],"CVE-2023-38950":[0.9247,0.998],"CVE-2023-33538":[0.4161,0.987],"CVE-2023-2533":[0.2862,0.981],"CVE-2023-0386":[0.0788,0.947],"CVE-2022-40799":[0.3365,0.984],"CVE-2021-43798":[0.885,0.998],"CVE-2021-43226":[0.0328,0.882],"CVE-2021-32030":[0.9939,0.999],"CVE-2021-22555":[0.7868,0.996],"CVE-2021-21311":[0.9846,0.999],"CVE-2020-25079":[0.5401,0.99],"CVE-2020-25078":[0.9751,0.999],"CVE-2020-24363":[0.2219,0.977],"CVE-2019-9621":[0.8104,0.996],"CVE-2019-6693":[0.0664,0.938],"CVE-2019-5418":[0.9851,0.999],"CVE-2017-1000353":[0.9968,1],"CVE-2016-10033":[0.9971,1],"CVE-2015-7755":[0.6114,0.992],"CVE-2014-3931":[0.2898,0.981],"CVE-2013-3918":[0.7369,0.995],"CVE-2013-3893":[0.8753,0.998],"CVE-2011-3402":[0.7814,0.996],"CVE-2010-3962":[0.9683,0.999],"CVE-2010-3765":[0.8316,0.997],"CVE-2007-0671":[0.4324,0.987],"CVE-2026-109892":[0.0027,0.177],"CVE-2026-109702":[0.0015,0.035],"CVE-2026-109698":[0.0029,0.203],"CVE-2026-109693":[0.0029,0.197],"CVE-2026-109692":[0.0016,0.049],"CVE-2026-109688":[0.0024,0.136],"CVE-2026-109686":[0.0031,0.227],"CVE-2026-109685":[0.0015,0.035],"CVE-2026-107416":[0.0027,0.177],"CVE-2026-104025":[0.0016,0.046],"CVE-2025-42599":[0.033,0.883],"CVE-2025-3928":[0.0248,0.843],"CVE-2025-34028":[0.976,0.999],"CVE-2025-3248":[0.9999,1],"CVE-2025-31201":[0.1397,0.965],"CVE-2025-31200":[0.209,0.975],"CVE-2025-31161":[0.9997,1],"CVE-2025-30406":[0.9434,0.999],"CVE-2025-30154":[0.0249,0.844],"CVE-2025-30066":[0.7209,0.994],"CVE-2025-2783":[0.0924,0.953],"CVE-2025-26633":[0.3039,0.982],"CVE-2025-25181":[0.5555,0.99],"CVE-2025-24993":[0.0222,0.823],"CVE-2025-24991":[0.0202,0.806],"CVE-2025-24989":[0.0162,0.757],"CVE-2025-24985":[0.0389,0.901],"CVE-2025-24984":[0.0199,0.804],"CVE-2025-24983":[0.0138,0.716],"CVE-2025-24813":[0.9993,1],"CVE-2025-24472":[0.0723,0.943],"CVE-2025-24201":[0.0385,0.9],"CVE-2025-24200":[0.0442,0.912],"CVE-2025-24085":[0.1751,0.971],"CVE-2025-24054":[0.6227,0.992],"CVE-2025-23209":[0.2178,0.976],"CVE-2025-23006":[0.2343,0.978],"CVE-2025-22457":[0.9998,1],"CVE-2025-22226":[0.0177,0.778],"CVE-2025-22225":[0.0102,0.627],"CVE-2025-22224":[0.0156,0.748],"CVE-2025-21590":[0.0174,0.773],"CVE-2025-21418":[0.0157,0.749],"CVE-2025-21391":[0.023,0.83],"CVE-2025-21335":[0.0139,0.719],"CVE-2025-21334":[0.0156,0.748],"CVE-2025-21333":[0.0999,0.956],"CVE-2025-1976":[0.0069,0.519],"CVE-2025-1316":[0.7448,0.995],"CVE-2025-0994":[0.3109,0.983],"CVE-2025-0411":[0.6707,0.993],"CVE-2025-0111":[0.02,0.804],"CVE-2025-0108":[0.9846,0.999],"CVE-2024-58136":[0.8776,0.998],"CVE-2024-57968":[0.3228,0.983],"CVE-2024-57727":[0.9658,0.999],"CVE-2024-55591":[0.9415,0.998],"CVE-2024-55550":[0.3816,0.985],"CVE-2024-53704":[0.9531,0.999],"CVE-2024-53197":[0.0412,0.907],"CVE-2024-53150":[0.0135,0.711],"CVE-2024-53104":[0.034,0.887],"CVE-2024-50603":[0.9852,0.999],"CVE-2024-50302":[0.0081,0.561],"CVE-2024-49035":[0.013,0.7],"CVE-2024-4885":[0.9929,0.999],"CVE-2024-48248":[0.9436,0.999],"CVE-2024-45195":[0.9998,1],"CVE-2024-41713":[0.9721,0.999],"CVE-2024-41710":[0.4165,0.987],"CVE-2024-40891":[0.217,0.976],"CVE-2024-40890":[0.207,0.975],"CVE-2024-38475":[0.9996,1],"CVE-2024-29059":[0.9862,0.999],"CVE-2024-21413":[0.9466,0.999],"CVE-2024-20953":[0.0393,0.902],"CVE-2024-20439":[0.9709,0.999],"CVE-2024-13161":[0.9008,0.998],"CVE-2024-13160":[0.9125,0.998],"CVE-2024-13159":[0.9999,1],"CVE-2024-12686":[0.137,0.965],"CVE-2023-48365":[0.4745,0.988],"CVE-2023-44221":[0.7625,0.995],"CVE-2023-34192":[0.7727,0.996],"CVE-2023-20118":[0.5411,0.99],"CVE-2022-43939":[0.9227,0.998],"CVE-2022-43769":[0.9767,0.999],"CVE-2022-23748":[0.0833,0.949],"CVE-2021-20035":[0.0418,0.908],"CVE-2020-29574":[0.047,0.917],"CVE-2020-2883":[0.9458,0.999],"CVE-2020-15069":[0.1067,0.958],"CVE-2020-11023":[0.8489,0.997],"CVE-2019-9875":[0.1379,0.965],"CVE-2019-9874":[0.8374,0.997],"CVE-2018-9276":[0.87,0.997],"CVE-2018-8639":[0.2218,0.977],"CVE-2018-19410":[0.9794,0.999],"CVE-2017-3066":[0.906,0.998],"CVE-2017-12637":[0.9511,0.999],"CVE-2026-97712":[0.0027,0.172],"CVE-2026-97665":[0.0028,0.193],"CVE-2026-97394":[0.0043,0.354],"CVE-2026-97370":[0.004,0.329],"CVE-2026-9703":[0.0019,0.085],"CVE-2026-95179":[0.0042,0.346],"CVE-2026-95155":[0.0034,0.263],"CVE-2026-93649":[0.0016,0.043],"CVE-2026-92982":[0.0039,0.31],"CVE-2026-87018":[0.0018,0.074],"CVE-2026-85634":[0.0041,0.342],"CVE-2026-84731":[0.0128,0.696],"CVE-2026-79840":[0.0009,0.006],"CVE-2026-79839":[0.0009,0.006],"CVE-2026-79838":[0.0009,0.006],"CVE-2026-79837":[0.001,0.007],"CVE-2026-77470":[0.0045,0.378],"CVE-2026-77467":[0.0027,0.177],"CVE-2026-77466":[0.0044,0.367],"CVE-2026-71490":[0.0038,0.305],"CVE-2026-63442":[0.0029,0.197],"CVE-2026-62679":[0.0035,0.274],"CVE-2026-61838":[0.0042,0.35],"CVE-2026-61611":[0.0035,0.272],"CVE-2026-58390":[0.0048,0.397],"CVE-2026-57496":[0.0035,0.275],"CVE-2026-57155":[0.0086,0.577],"CVE-2026-55872":[0.0023,0.127],"CVE-2026-55587":[0.0015,0.037],"CVE-2026-55246":[0.0022,0.118],"CVE-2026-55240":[0.0058,0.464],"CVE-2026-55239":[0.0034,0.259],"CVE-2026-55103":[0.002,0.092],"CVE-2026-53582":[0.0073,0.532],"CVE-2026-53574":[0.0021,0.105],"CVE-2026-47218":[0.0039,0.32],"CVE-2026-47168":[0.0042,0.351],"CVE-2026-45452":[0.0027,0.176],"CVE-2026-45451":[0.0029,0.201],"CVE-2026-45450":[0.0027,0.176],"CVE-2026-45449":[0.0082,0.565],"CVE-2026-45165":[0.0021,0.101],"CVE-2026-36436":[0.0034,0.259],"CVE-2026-111235":[0.0038,0.3],"CVE-2026-111231":[0.0092,0.596],"CVE-2026-111229":[0.0637,0.936],"CVE-2026-111226":[0.0655,0.937],"CVE-2026-111224":[0.0537,0.926],"CVE-2026-111223":[0.0076,0.544],"CVE-2026-111220":[0.0073,0.532],"CVE-2026-111218":[0.0844,0.95],"CVE-2026-111217":[0.0705,0.941],"CVE-2026-111216":[0.0655,0.937],"CVE-2026-111215":[0.0705,0.941],"CVE-2026-111214":[0.0863,0.951],"CVE-2026-111160":[0.0042,0.346],"CVE-2026-111094":[0.0038,0.308],"CVE-2026-111093":[0.0037,0.297],"CVE-2026-111091":[0.0014,0.027],"CVE-2026-110958":[0.011,0.65],"CVE-2026-110957":[0.0346,0.889],"CVE-2026-110812":[0.0037,0.288],"CVE-2026-110746":[0.0021,0.107],"CVE-2026-110724":[0.0027,0.183],"CVE-2026-110723":[0.0034,0.256],"CVE-2026-109869":[0.0034,0.263],"CVE-2026-109829":[0.0015,0.036],"CVE-2026-109449":[0.0052,0.432],"CVE-2026-109413":[0.0051,0.419],"CVE-2026-109383":[0.0018,0.07],"CVE-2026-108426":[0.0044,0.369],"CVE-2026-108334":[0.0033,0.241],"CVE-2026-108116":[0.0024,0.146],"CVE-2026-108082":[0.0037,0.29],"CVE-2026-106708":[0.003,0.21],"CVE-2026-106700":[0.003,0.216],"CVE-2026-105474":[0.0045,0.379],"CVE-2026-105065":[0.0015,0.035],"CVE-2026-105040":[0.0035,0.268],"CVE-2026-105039":[0.0029,0.205],"CVE-2026-105038":[0.0065,0.499],"CVE-2026-105037":[0.004,0.327],"CVE-2026-105036":[0.0024,0.135],"CVE-2026-105035":[0.002,0.091],"CVE-2026-105034":[0.0056,0.453],"CVE-2026-105033":[0.0035,0.275],"CVE-2026-105032":[0.009,0.59],"CVE-2026-104828":[0.0026,0.171],"CVE-2026-104827":[0.0043,0.354],"CVE-2026-104150":[0.0037,0.29],"CVE-2026-103936":[0.0052,0.43],"CVE-2026-103509":[0.0023,0.127],"CVE-2026-103508":[0.0042,0.352],"CVE-2026-102946":[0.0012,0.015],"CVE-2026-100409":[0.0031,0.218],"CVE-2026-100354":[0.0043,0.363],"CVE-2026-100353":[0.0034,0.253],"CVE-2026-100352":[0.0043,0.354],"CVE-2026-100351":[0.0049,0.407],"CVE-2026-100349":[0.0037,0.295],"CVE-2026-97339":[0.0025,0.159],"CVE-2026-96570":[0.0031,0.228],"CVE-2026-95809":[0.0025,0.148],"CVE-2026-95686":[0.0028,0.189],"CVE-2026-94134":[0.003,0.212],"CVE-2026-93953":[0.0034,0.258],"CVE-2026-92629":[0.001,0.009],"CVE-2026-89079":[0.0029,0.205],"CVE-2026-89051":[0.0019,0.081],"CVE-2026-85659":[0.0037,0.29],"CVE-2026-84823":[0.0034,0.261],"CVE-2026-75941":[0.0026,0.171],"CVE-2026-111451":[0.0014,0.031],"CVE-2026-111447":[0.0028,0.189],"CVE-2026-111446":[0.0026,0.167],"CVE-2026-111445":[0.0028,0.189],"CVE-2026-111444":[0.0026,0.166],"CVE-2026-111389":[0.0022,0.121],"CVE-2026-111382":[0.0029,0.205],"CVE-2026-111381":[0.0012,0.019],"CVE-2026-111380":[0.0026,0.162],"CVE-2026-111379":[0.0013,0.023],"CVE-2026-111378":[0.0033,0.243],"CVE-2026-111369":[0.0025,0.148],"CVE-2026-111366":[0.0042,0.348],"CVE-2026-111359":[0.002,0.091],"CVE-2026-111357":[0.0025,0.149],"CVE-2026-111356":[0.0034,0.261],"CVE-2026-111352":[0.0036,0.283],"CVE-2026-111329":[0.0053,0.438],"CVE-2026-111322":[0.0069,0.519],"CVE-2026-111312":[0.0045,0.378],"CVE-2026-111283":[0.0043,0.353],"CVE-2026-111282":[0.0047,0.395],"CVE-2026-111281":[0.0056,0.455],"CVE-2026-111280":[0.0043,0.354],"CVE-2026-111279":[0.0049,0.404],"CVE-2026-111277":[0.0036,0.287],"CVE-2026-111210":[0.0029,0.202],"CVE-2026-111122":[0.0024,0.136],"CVE-2026-111114":[0.0029,0.201],"CVE-2026-110922":[0.0025,0.15],"CVE-2026-110921":[0.0022,0.12],"CVE-2026-110920":[0.0022,0.12],"CVE-2026-110919":[0.0022,0.12],"CVE-2026-110916":[0.003,0.212],"CVE-2026-110915":[0.0027,0.177],"CVE-2026-110914":[0.0027,0.177],"CVE-2026-110913":[0.0029,0.199],"CVE-2026-110590":[0.0032,0.24],"CVE-2026-109998":[0.0027,0.182],"CVE-2026-109990":[0.0033,0.248],"CVE-2026-109813":[0.0015,0.04],"CVE-2026-109515":[0.0044,0.367],"CVE-2026-109513":[0.0024,0.142],"CVE-2026-109468":[0.0065,0.499],"CVE-2026-109447":[0.0034,0.253],"CVE-2026-109400":[0.0035,0.271],"CVE-2026-109232":[0.0025,0.148],"CVE-2026-109221":[0.0079,0.554],"CVE-2026-109219":[0.0069,0.517],"CVE-2026-109207":[0.0031,0.22],"CVE-2026-108452":[0.0063,0.494],"CVE-2026-108451":[0.0044,0.369],"CVE-2026-108450":[0.0044,0.369],"CVE-2026-108449":[0.0044,0.369],"CVE-2026-108448":[0.0035,0.268],"CVE-2026-108447":[0.0044,0.369],"CVE-2026-108446":[0.0044,0.369],"CVE-2026-108445":[0.0044,0.369],"CVE-2026-108444":[0.0044,0.369],"CVE-2026-108443":[0.0044,0.369],"CVE-2026-108442":[0.0044,0.369],"CVE-2026-108441":[0.0044,0.369],"CVE-2026-108440":[0.0044,0.369],"CVE-2026-108439":[0.0044,0.369],"CVE-2026-108437":[0.0044,0.369],"CVE-2026-108433":[0.0032,0.233],"CVE-2026-108432":[0.0045,0.377],"CVE-2026-108431":[0.0045,0.377],"CVE-2026-108430":[0.0045,0.377],"CVE-2026-108429":[0.0045,0.377],"CVE-2026-108428":[0.0045,0.377],"CVE-2026-108427":[0.0046,0.387],"CVE-2026-107764":[0.0024,0.136],"CVE-2026-107758":[0.0036,0.278],"CVE-2026-107746":[0.0032,0.231],"CVE-2026-107659":[0.003,0.215],"CVE-2026-105228":[0.0031,0.221],"CVE-2026-105227":[0.0031,0.221],"CVE-2026-104932":[0.0029,0.202],"CVE-2026-104798":[0.0089,0.587],"CVE-2026-104745":[0.0052,0.428],"CVE-2026-104000":[0.0024,0.136],"CVE-2026-103999":[0.0026,0.164],"CVE-2026-103896":[0.0046,0.388],"CVE-2026-103895":[0.0043,0.355],"CVE-2026-103768":[0.0058,0.464],"CVE-2026-103525":[0.0037,0.299],"CVE-2026-100186":[0.0024,0.142],"CVE-2026-97640":[0.0024,0.144],"CVE-2026-97380":[0.0057,0.458],"CVE-2026-97296":[0.0026,0.162],"CVE-2026-96768":[0.0019,0.081],"CVE-2026-96424":[0.0011,0.01],"CVE-2026-96339":[0.0015,0.035],"CVE-2026-95859":[0.0029,0.203],"CVE-2026-95182":[0.0053,0.438],"CVE-2026-94388":[0.0024,0.136],"CVE-2026-94169":[0.0098,0.617],"CVE-2026-92766":[0.0033,0.245],"CVE-2026-92553":[0.0057,0.463],"CVE-2026-92263":[0.0036,0.276],"CVE-2026-92262":[0.0068,0.513],"CVE-2026-92115":[0.0147,0.734],"CVE-2026-88755":[0.0021,0.105],"CVE-2026-87111":[0.0019,0.081],"CVE-2026-86047":[0.0032,0.233],"CVE-2026-86009":[0.003,0.21],"CVE-2026-86008":[0.0031,0.227],"CVE-2026-85748":[0.0055,0.446],"CVE-2026-85746":[0.0063,0.49],"CVE-2026-77630":[0.0035,0.266],"CVE-2026-77474":[0.0012,0.019],"CVE-2026-75903":[0.005,0.417],"CVE-2026-68907":[0.0037,0.295],"CVE-2026-68906":[0.0037,0.295],"CVE-2026-68571":[0.0023,0.131],"CVE-2026-63618":[0.0043,0.359],"CVE-2026-57488":[0.0032,0.233],"CVE-2026-57487":[0.0034,0.258],"CVE-2026-57486":[0.0041,0.339],"CVE-2026-57169":[0.003,0.217],"CVE-2026-55543":[0.0015,0.037],"CVE-2026-49868":[0.0037,0.295],"CVE-2026-48741":[0.0043,0.36],"CVE-2026-48503":[0.0046,0.383],"CVE-2026-46472":[0.0031,0.221],"CVE-2026-44977":[0.0034,0.263],"CVE-2026-42270":[0.0054,0.443],"CVE-2026-42269":[0.0047,0.392],"CVE-2026-41582":[0.0043,0.356],"CVE-2026-18516":[0.0029,0.202],"CVE-2026-16453":[0.0019,0.077],"CVE-2026-14452":[0.0029,0.207],"CVE-2026-14177":[0.0024,0.146],"CVE-2026-111690":[0.0044,0.37],"CVE-2026-111687":[0.01,0.623],"CVE-2026-111686":[0.0043,0.353],"CVE-2026-111685":[0.0043,0.353],"CVE-2026-111684":[0.0018,0.066],"CVE-2026-111681":[0.0028,0.195],"CVE-2026-111680":[0.0026,0.164],"CVE-2026-111675":[0.0041,0.337],"CVE-2026-111673":[0.0055,0.448],"CVE-2026-111671":[0.0031,0.222],"CVE-2026-111663":[0.0029,0.197],"CVE-2026-111650":[0.0032,0.239],"CVE-2026-111644":[0.0037,0.292],"CVE-2026-111643":[0.0044,0.373],"CVE-2026-111642":[0.0036,0.282],"CVE-2026-111641":[0.0043,0.362],"CVE-2026-111639":[0.0038,0.304],"CVE-2026-111638":[0.0031,0.226],"CVE-2026-111636":[0.004,0.329],"CVE-2026-111634":[0.0026,0.169],"CVE-2026-111633":[0.0034,0.259],"CVE-2026-111627":[0.0057,0.463],"CVE-2026-111626":[0.0044,0.373],"CVE-2026-111613":[0.0047,0.395],"CVE-2026-111612":[0.0049,0.405],"CVE-2026-111607":[0.0025,0.151],"CVE-2026-111606":[0.0024,0.139],"CVE-2026-111605":[0.0025,0.152],"CVE-2026-111472":[0.0023,0.126],"CVE-2026-111413":[0.0013,0.025],"CVE-2026-111399":[0.0026,0.166],"CVE-2026-111396":[0.002,0.096],"CVE-2026-111391":[0.0045,0.378],"CVE-2026-111311":[0.0052,0.426],"CVE-2026-110701":[0.0025,0.148],"CVE-2026-110135":[0.0027,0.172],"CVE-2026-110015":[0.0015,0.036],"CVE-2026-109588":[0.0012,0.018],"CVE-2026-109587":[0.0014,0.028],"CVE-2026-109224":[0.0028,0.191],"CVE-2026-109193":[0.0036,0.285],"CVE-2026-109119":[0.0038,0.304],"CVE-2026-107768":[0.003,0.209],"CVE-2026-107648":[0.0024,0.142],"CVE-2026-107564":[0.0033,0.252],"CVE-2026-106705":[0.0025,0.147],"CVE-2026-105959":[0.004,0.331],"CVE-2026-105958":[0.0025,0.148],"CVE-2026-104730":[0.0051,0.423],"CVE-2026-104715":[0.0015,0.035],"CVE-2026-102941":[0.0028,0.19],"CVE-2026-102693":[0.0023,0.123],"CVE-2026-102692":[0.0035,0.271],"CVE-2026-101300":[0.0021,0.101],"CVE-2026-96660":[0.0023,0.128],"CVE-2026-96627":[0.0029,0.201],"CVE-2026-96626":[0.0022,0.112],"CVE-2026-96620":[0.0058,0.464],"CVE-2026-96534":[0.0016,0.05],"CVE-2026-92798":[0.0037,0.292],"CVE-2026-81452":[0.0011,0.013],"CVE-2026-68498":[0.0091,0.593],"CVE-2026-62439":[0.0018,0.075],"CVE-2026-61726":[0.0023,0.129],"CVE-2026-59970":[0.0031,0.224],"CVE-2026-59963":[0.0021,0.107],"CVE-2026-49410":[0.0016,0.044],"CVE-2026-30971":[0.0106,0.641],"CVE-2026-111927":[0.0021,0.098],"CVE-2026-111924":[0.0036,0.281],"CVE-2026-111923":[0.0036,0.281],"CVE-2026-111911":[0.0042,0.35],"CVE-2026-111909":[0.0027,0.185],"CVE-2026-111908":[0.0029,0.204],"CVE-2026-111907":[0.0011,0.014],"CVE-2026-111901":[0.0034,0.263],"CVE-2026-111898":[0.0034,0.261],"CVE-2026-111897":[0.0027,0.183],"CVE-2026-111884":[0.0027,0.186],"CVE-2026-111882":[0.0039,0.312],"CVE-2026-111881":[0.002,0.093],"CVE-2026-111880":[0.0032,0.235],"CVE-2026-111873":[0.0026,0.169],"CVE-2026-111872":[0.0026,0.169],"CVE-2026-111871":[0.0026,0.169],"CVE-2026-111866":[0.0039,0.319],"CVE-2026-111855":[0.0049,0.409],"CVE-2026-111854":[0.0039,0.316],"CVE-2026-111853":[0.0086,0.577],"CVE-2026-111823":[0.0037,0.295],"CVE-2026-111723":[0.0028,0.195],"CVE-2026-111722":[0.003,0.215],"CVE-2026-111711":[0.0049,0.409],"CVE-2026-111710":[0.0029,0.202],"CVE-2026-111708":[0.0058,0.464],"CVE-2026-111706":[0.0035,0.267],"CVE-2026-111704":[0.0051,0.421],"CVE-2026-111702":[0.0043,0.354],"CVE-2026-111701":[0.003,0.212],"CVE-2026-111700":[0.0022,0.118],"CVE-2026-111695":[0.0027,0.18],"CVE-2026-111693":[0.0038,0.302],"CVE-2026-111692":[0.0061,0.48],"CVE-2026-111691":[0.0041,0.337],"CVE-2026-111110":[0.0028,0.189],"CVE-2026-111044":[0.0016,0.045],"CVE-2026-110981":[0.0017,0.062],"CVE-2026-110889":[0.0034,0.261],"CVE-2026-110653":[0.004,0.33],"CVE-2026-110384":[0.0019,0.081],"CVE-2026-110031":[0.0013,0.025],"CVE-2026-109701":[0.0019,0.081],"CVE-2026-109208":[0.0029,0.196],"CVE-2026-108374":[0.0024,0.141],"CVE-2026-108372":[0.0022,0.12],"CVE-2026-108123":[0.0032,0.231],"CVE-2026-107762":[0.004,0.322],"CVE-2026-104736":[0.0044,0.366],"CVE-2026-104734":[0.0047,0.389],"CVE-2026-103899":[0.0024,0.142],"CVE-2026-102917":[0.001,0.007],"CVE-2026-102834":[0.0034,0.253],"CVE-2026-102608":[0.0029,0.199],"CVE-2026-102607":[0.0045,0.374],"CVE-2026-100316":[0.0027,0.182]},"poc":{"CVE-2026-88771":{"n":11,"first":1790532938000,"top":[{"n":"watchtowrlabs/watchTowr-vs-Citrix-Netscaler-CVE-2026-88771","u":"https://github.com/watchtowrlabs/watchTowr-vs-Citrix-Netscaler-CVE-2026-88771","s":23,"c":1790532938000,"d":""},{"n":"ThomasPoppelgaard/netscaler-ctx697096-checker","u":"https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker","s":19,"c":1790594430000,"d":"Am I fixed? Was I hacked? Read-only checker for Citrix NetScaler CTX697096 (CVE-2026-88771–88778), CTX697174 (CVE-2026-88779) and CTX697191 "},{"n":"technion/netscaler_scanner","u":"https://github.com/technion/netscaler_scanner","s":1,"c":1790571371000,"d":"Tooling related to CVE-2026-88771 and CVE-2026-88772"},{"n":"craigsblackie/cve-2026-88771-netscaler","u":"https://github.com/craigsblackie/cve-2026-88771-netscaler","s":1,"c":1790590014000,"d":""},{"n":"grupooruss/netscaler-defensive-checker","u":"https://github.com/grupooruss/netscaler-defensive-checker","s":1,"c":1791420183000,"d":"Defensive security checker for Citrix NetScaler ADC & Gateway — CVE-2026-88771 through CVE-2026-88778"}]},"CVE-2026-107406":{"n":2,"first":1791520729000,"top":[{"n":"techupdate24/citrix-netscaler-rce-cve-2026-107406","u":"https://github.com/techupdate24/citrix-netscaler-rce-cve-2026-107406","s":0,"c":1791520729000,"d":"A complete guide and workflow for integrating Agile sprints with DevOps CI/CD pipelines."},{"n":"ctroy999/CVE-2026-107406","u":"https://github.com/ctroy999/CVE-2026-107406","s":0,"c":1791709871000,"d":""}]},"CVE-2026-103849":{"n":1,"first":1792311161000,"top":[{"n":"dinosn/cve-2026-103849-blockstrap-lab","u":"https://github.com/dinosn/cve-2026-103849-blockstrap-lab","s":3,"c":1792311161000,"d":"CVE-2026-103849 (BlockStrap) reproduction lab: unauthenticated {{block}} injection on Magento 2.4.9 via guest GraphQL, A/B vs APSB26-153; co"}]},"CVE-2026-97229":{"n":4,"first":1791877906000,"top":[{"n":"jburgess-r7/CVE-2026-97229-PoC","u":"https://github.com/jburgess-r7/CVE-2026-97229-PoC","s":59,"c":1791884357000,"d":" GitLab CI lint integer-overflow RCE PoC for CVE-2026-97229, validated against the official 19.4.1 CE amd64 image"},{"n":"OppositDeer/Gitlab-RCE-CVE-2026-97229","u":"https://github.com/OppositDeer/Gitlab-RCE-CVE-2026-97229","s":1,"c":1792149059000,"d":"CVE-2026-97229: GitLab RCE Unauthenticated via CI Lint"},{"n":"AmpedWasTaken/CVE-2026-97229-GitLab-CI-CD-Regex-Compiler-RCE","u":"https://github.com/AmpedWasTaken/CVE-2026-97229-GitLab-CI-CD-Regex-Compiler-RCE","s":0,"c":1791877906000,"d":"CVE-2026-97229 — GitLab CI/CD Regex Compiler RCE"},{"n":"gandli/cve-2026-97229-lab","u":"https://github.com/gandli/cve-2026-97229-lab","s":0,"c":1792260239000,"d":"CVE-2026-97229 GitLab CI lint regex integer overflow RCE — InstaBox version matrix reproduction & libruby gadget reverse engineering"}]},"CVE-2026-102764":{"n":1,"first":1792178088000,"top":[{"n":"Worthes/CVE-2026-102764-Proof-of-concept","u":"https://github.com/Worthes/CVE-2026-102764-Proof-of-concept","s":2,"c":1792178088000,"d":"CVE-2026-102764 BeyondTrust Remote Support unauthenticated file write / RCE proof of concept"}]},"CVE-2026-21589":{"n":12,"first":1791283259000,"top":[{"n":"watchtowrlabs/watchTowr-vs-Atlassian-CVE-2026-21589","u":"https://github.com/watchtowrlabs/watchTowr-vs-Atlassian-CVE-2026-21589","s":15,"c":1791283259000,"d":""},{"n":"MarcusProgram/CVE-2026-21589","u":"https://github.com/MarcusProgram/CVE-2026-21589","s":10,"c":1791301414000,"d":""},{"n":"tc4dy/CVE-2026-21589-PoC-Exploit","u":"https://github.com/tc4dy/CVE-2026-21589-PoC-Exploit","s":10,"c":1791310910000,"d":"CVE-2026-21589 - Atlassian Data Center Unauth Arbitrary File Read (CVSS 9.3). Red/Blue Team suite with 2 tools: Full Exploit (path traversal"},{"n":"ynsmroztas/AtlasSniper","u":"https://github.com/ynsmroztas/AtlasSniper","s":8,"c":1791396843000,"d":"CVE-2026-21589 detector for Atlassian Data Center webresource traversal. Pre-auth webroot file read confirm for Jira, Confluence and Bitbuck"},{"n":"murrez/CVE-2026-21589","u":"https://github.com/murrez/CVE-2026-21589","s":1,"c":1791448263000,"d":"CVE-2026-21589 — Atlassian DC pre-auth arbitrary file read (CVSS 4.0 9.3). PoCbit PoC: atlassian-plugins-webresource ..:: traversal on /down"}]},"CVE-2026-110447":{"n":1,"first":1792005755000,"top":[{"n":"adriyansyah-mf/cve-2026-110447","u":"https://github.com/adriyansyah-mf/cve-2026-110447","s":0,"c":1792005755000,"d":""}]},"CVE-2026-99999":{"n":7,"first":1792173136000,"top":[{"n":"PeronGH/CVE-2026-99999","u":"https://github.com/PeronGH/CVE-2026-99999","s":8,"c":1792218115000,"d":"PoC for CVE-2026-99999 (PwnEscape) on a prepared TAP."},{"n":"Quaerendir/cve-2026-99999-audit","u":"https://github.com/Quaerendir/cve-2026-99999-audit","s":2,"c":1792227506000,"d":"cve-2026-99999-audit script (PwnEscape)"},{"n":"MChorfa/csumguard","u":"https://github.com/MChorfa/csumguard","s":1,"c":1792173136000,"d":"Restricted eBPF TC ingress guard, CO-RE detector, verified loader, and C11 VMM launch supervisor for CVE-2026-99999"},{"n":"01luyicheng/CVE-2026-99999","u":"https://github.com/01luyicheng/CVE-2026-99999","s":1,"c":1792329372000,"d":"CVE-2026-99999 PwnEscape PoC - Linux kernel IPv4 csum_start validation bug guest-to-host memory leak (CVSS 9.3)"},{"n":"kingahmadr/CVE-2026-99999-kernel-check","u":"https://github.com/kingahmadr/CVE-2026-99999-kernel-check","s":0,"c":1792316643000,"d":""}]},"CVE-2026-31431":{"n":324,"first":1772991611000,"top":[{"n":"theori-io/copy-fail-CVE-2026-31431","u":"https://github.com/theori-io/copy-fail-CVE-2026-31431","s":4081,"c":1777464928000,"d":"Copy Fail (CVE-2026-31431): 9-year-old Linux kernel LPE found by Theori's Xint Code"},{"n":"tgies/copy-fail-c","u":"https://github.com/tgies/copy-fail-c","s":448,"c":1777505354000,"d":"Cross-platform C port of the Copy Fail Linux LPE (CVE-2026-31431). Disclosed 2026-04-29 by Theori / Xint."},{"n":"badsectorlabs/copyfail-go","u":"https://github.com/badsectorlabs/copyfail-go","s":360,"c":1777503084000,"d":"A Go implementation of copyfail (CVE-2026-31431)"},{"n":"Percivalll/Copy-Fail-CVE-2026-31431-Kubernetes-PoC","u":"https://github.com/Percivalll/Copy-Fail-CVE-2026-31431-Kubernetes-PoC","s":192,"c":1777548802000,"d":"PoC: fully unprivileged container escape to node-level code execution on Kubernetes via CVE-2026-31431 page-cache corruption + shared image "},{"n":"Sndav/CVE-2026-31431-Advanced-Exploit","u":"https://github.com/Sndav/CVE-2026-31431-Advanced-Exploit","s":114,"c":1777517703000,"d":"CVE-2026-31431 纯文件利用"}]},"CVE-2026-35029":{"n":1,"first":1779199338000,"top":[{"n":"learner202649/CVE-2026-35029-PoC","u":"https://github.com/learner202649/CVE-2026-35029-PoC","s":0,"c":1779199338000,"d":"The code for personally reproducing the corresponding vulnerability"}]},"CVE-2026-0322":{"n":1,"first":1792034190000,"top":[{"n":"Ife-ella/CVE-vulnerability","u":"https://github.com/Ife-ella/CVE-vulnerability","s":0,"c":1792034190000,"d":"CVE-2026-0322"}]},"CVE-2026-76519":{"n":1,"first":1792008407000,"top":[{"n":"Mickysalivan/CVE-2026-76519-Proof-of-concept","u":"https://github.com/Mickysalivan/CVE-2026-76519-Proof-of-concept","s":0,"c":1792008407000,"d":"Unauthenticated remote code execution on Cisco Secure Email Gateway via crafted email attachment. Path traversal in AMP File Reputation hand"}]},"CVE-2026-105133":{"n":1,"first":1791985485000,"top":[{"n":"horizon3ai/AhsayCBS-Auth-Bypass-RCE","u":"https://github.com/horizon3ai/AhsayCBS-Auth-Bypass-RCE","s":4,"c":1791985485000,"d":"A proof of concept exploit for CVE-2026-105133 and CVE-2026-105134 affecting AhsayCBS"}]},"CVE-2026-105134":{"n":1,"first":1791205251000,"top":[{"n":"RayanAlmulhim/CVE-2026-105134-lab","u":"https://github.com/RayanAlmulhim/CVE-2026-105134-lab","s":0,"c":1791205251000,"d":"Educational lab and clean-room reproduction demonstrating the OS command injection pattern in CVE-2026-105134. For defensive research only."}]},"CVE-2026-35616":{"n":8,"first":1775292180000,"top":[{"n":"Alaatk/CVE-2026-35616","u":"https://github.com/Alaatk/CVE-2026-35616","s":44,"c":1776592010000,"d":"Fortinet FortiClientEMS improper access control"},{"n":"BishopFox/CVE-2026-35616-check","u":"https://github.com/BishopFox/CVE-2026-35616-check","s":2,"c":1775509466000,"d":""},{"n":"0xBlackash/CVE-2026-35616","u":"https://github.com/0xBlackash/CVE-2026-35616","s":1,"c":1775292180000,"d":"CVE-2026-35616"},{"n":"keraattin/CVE-2026-35616","u":"https://github.com/keraattin/CVE-2026-35616","s":1,"c":1776106140000,"d":"CVE-2026-35616 - FortiClient EMS Pre-Authentication API Bypass (CVSS 9.1, CISA KEV). Python & Nmap NSE detection scripts with full technical"},{"n":"wa6n3r/CVE-2026-35616","u":"https://github.com/wa6n3r/CVE-2026-35616","s":1,"c":1776708482000,"d":""}]},"CVE-2018-10388":{"n":1,"first":1589381563000,"top":[{"n":"0xddaa/CVE-2018-10388","u":"https://github.com/0xddaa/CVE-2018-10388","s":3,"c":1589381563000,"d":"practice"}]},"CVE-2024-47575":{"n":3,"first":1731013410000,"top":[{"n":"watchtowrlabs/Fortijump-Exploit-CVE-2024-47575","u":"https://github.com/watchtowrlabs/Fortijump-Exploit-CVE-2024-47575","s":97,"c":1731013410000,"d":"Fortinet Fortimanager Unauthenticated Remote Code Execution AKA FortiJump CVE-2024-47575"},{"n":"revanslbw/CVE-2024-47575-POC","u":"https://github.com/revanslbw/CVE-2024-47575-POC","s":0,"c":1736107569000,"d":"CVE POC Exploit"},{"n":"AnnnNix/CVE-2024-47575","u":"https://github.com/AnnnNix/CVE-2024-47575","s":0,"c":1752959236000,"d":"PoC for CVE-2024-47575"}]},"CVE-2026-104935":{"n":2,"first":1791921231000,"top":[{"n":"ApexBreach/CVE-2026-104935-Proof-of-concept","u":"https://github.com/ApexBreach/CVE-2026-104935-Proof-of-concept","s":0,"c":1791921231000,"d":"Unauthenticated remote code execution in Ivanti Connect Secure (CWE-290, CVSS 8.6)"},{"n":"0x45dd/ivanti-cve-2026-104935-check","u":"https://github.com/0x45dd/ivanti-cve-2026-104935-check","s":0,"c":1792023034000,"d":"Detection-only check for the Ivanti Connect Secure authentication bypass (CVE-2026-104935)"}]},"CVE-2026-74580":{"n":3,"first":1791984463000,"top":[{"n":"ABC00012345/CVE-2026-74580","u":"https://github.com/ABC00012345/CVE-2026-74580","s":2,"c":1791987999000,"d":""},{"n":"V01DL1NG/vghost-watch","u":"https://github.com/V01DL1NG/vghost-watch","s":1,"c":1792276390000,"d":"Passive internet-wide discovery + responsible-disclosure helper for CVE-2026-74580 (Linux vhost metadata-cache bug) — queries existing scan "},{"n":"techupdate24/linux-kernel-cve-2026-74580-vghost","u":"https://github.com/techupdate24/linux-kernel-cve-2026-74580-vghost","s":0,"c":1791984463000,"d":"A complete guide and workflow for integrating Agile sprints with DevOps CI/CD pipelines."}]},"CVE-2026-88772":{"n":3,"first":1790532955000,"top":[{"n":"murrez/CVE-2026-88772","u":"https://github.com/murrez/CVE-2026-88772","s":13,"c":1790540696000,"d":"CVE-2026-88772 PoC: Citrix NetScaler ADC/Gateway DTLS memory overflow (RCE/DoS, CVSS 9.5). Fingerprints Gateway, build vs 14.1-73.37 / 13.1-"},{"n":"watchtowrlabs/watchTowr-vs-Citrix-Netscaler-CVE-2026-88772","u":"https://github.com/watchtowrlabs/watchTowr-vs-Citrix-Netscaler-CVE-2026-88772","s":11,"c":1790532955000,"d":""},{"n":"FollowerSeize/CVE-2026-88772-POC","u":"https://github.com/FollowerSeize/CVE-2026-88772-POC","s":0,"c":1790589496000,"d":"CVE-2026-88772 - Citrix NetScaler ADC/Gateway DTLS memory overflow (RCE/DoS)"}]},"CVE-2026-8838":{"n":2,"first":1779194489000,"top":[{"n":"Maxime288/CVE-2026-8838-RCE","u":"https://github.com/Maxime288/CVE-2026-8838-RCE","s":0,"c":1779194489000,"d":""},{"n":"Sana-404/CVE-2026-8838-Mitigation-and-Detection","u":"https://github.com/Sana-404/CVE-2026-8838-Mitigation-and-Detection","s":0,"c":1784185304000,"d":""}]},"CVE-2026-85097":{"n":6,"first":1791607892000,"top":[{"n":"tc4dy/CVE-2026-85097-Toolkit","u":"https://github.com/tc4dy/CVE-2026-85097-Toolkit","s":7,"c":1791821751000,"d":"CVE-2026-85097 – Bricksforge WordPress Plugin Unauth File Upload to RCE Toolkit (CVSS 10.0) | Red/Blue Team suite for Bricksforge Pro Forms "},{"n":"Wayang1337/CVE-2026-85097","u":"https://github.com/Wayang1337/CVE-2026-85097","s":1,"c":1791607892000,"d":" Bricksforge <= 3.1.8.9 Unauthenticated Arbitrary File Upload"},{"n":"Masriyan/CVE-2026-85097","u":"https://github.com/Masriyan/CVE-2026-85097","s":1,"c":1791869980000,"d":"POC CVE-2026-85097"},{"n":"BlackHatExploitation/CVE-2026-85097","u":"https://github.com/BlackHatExploitation/CVE-2026-85097","s":1,"c":1792068073000,"d":"CVE-2026-85097 — Bricksforge <= 3.1.8.9 unauth file upload to RCE. GIF/PHP polyglot + temporaryFileUploads.url mismatch. python3 exploit.py "},{"n":"RootMantap/CVE-2026-85097","u":"https://github.com/RootMantap/CVE-2026-85097","s":0,"c":1791940091000,"d":"For WordPress "}]},"CVE-2026-81578":{"n":2,"first":1788009153000,"top":[{"n":"yora1928/PaperCut-CVE-2026-81578-82078","u":"https://github.com/yora1928/PaperCut-CVE-2026-81578-82078","s":4,"c":1788009153000,"d":"Security research tool for PaperCut CVE-2026-81578 & CVE-2026-82078"},{"n":"virologi-info/papercut-toolkit","u":"https://github.com/virologi-info/papercut-toolkit","s":2,"c":1788016123000,"d":"#PaperCut CVE-2026-81578 + CVE-2026-82078 Defense Toolkit 2 3 A **defensive** toolkit to check and understand exposure to the chained"}]},"CVE-2015-3306":{"n":18,"first":1429620711000,"top":[{"n":"t0kx/exploit-CVE-2015-3306","u":"https://github.com/t0kx/exploit-CVE-2015-3306","s":152,"c":1483885191000,"d":"ProFTPd 1.3.5 - (mod_copy) Remote Command Execution exploit and vulnerable container"},{"n":"nootropics/propane","u":"https://github.com/nootropics/propane","s":2,"c":1430057674000,"d":"Exploits the arbitrary file write bug in proftpd (CVE-2015-3306) attempts code execution"},{"n":"xyk0x/cpx_proftpd","u":"https://github.com/xyk0x/cpx_proftpd","s":1,"c":1429620711000,"d":"Tool for exploit CVE-2015-3306"},{"n":"davidtavarez/CVE-2015-3306","u":"https://github.com/davidtavarez/CVE-2015-3306","s":1,"c":1501302670000,"d":"ProFTPd 1.3.5 - File Copy"},{"n":"cd6629/CVE-2015-3306-Python-PoC","u":"https://github.com/cd6629/CVE-2015-3306-Python-PoC","s":1,"c":1602878293000,"d":"Converted with tweaks from a metasploit module as an exercise for OSCP studying and exploit development"}]},"CVE-2026-102489":{"n":3,"first":1791313236000,"top":[{"n":"horizon3ai/CVE-2026-102489","u":"https://github.com/horizon3ai/CVE-2026-102489","s":7,"c":1791313236000,"d":"Zammad Session Leak to Remote Code Execution"},{"n":"1xPwn/CVE-2026-102489","u":"https://github.com/1xPwn/CVE-2026-102489","s":7,"c":1791751852000,"d":"CVE-2026-102489 exploit in golang"},{"n":"Hunt-Benito/the-cookie-in-the-error-message-cve-2026-102489-zammad-session-hijack-to-rce","u":"https://github.com/Hunt-Benito/the-cookie-in-the-error-message-cve-2026-102489-zammad-session-hijack-to-rce","s":0,"c":1791366863000,"d":""}]},"CVE-2015-5477":{"n":7,"first":1438385383000,"top":[{"n":"robertdavidgraham/cve-2015-5477","u":"https://github.com/robertdavidgraham/cve-2015-5477","s":64,"c":1438385383000,"d":"PoC exploit for CVE-2015-5477 BIND9 TKEY assertion failure"},{"n":"elceef/tkeypoc","u":"https://github.com/elceef/tkeypoc","s":14,"c":1438421243000,"d":"PoC exploit code for CVE-2015-5477 BIND9 TKEY remote DoS vulnerability"},{"n":"hmlio/vaas-cve-2015-5477","u":"https://github.com/hmlio/vaas-cve-2015-5477","s":1,"c":1438722705000,"d":"Vulnerability as a service: showcasing CVS-2015-5447, a DDoS condition in the bind9 software"},{"n":"knqyf263/cve-2015-5477","u":"https://github.com/knqyf263/cve-2015-5477","s":1,"c":1439136592000,"d":"PoC for BIND9 TKEY assert DoS (CVE-2015-5477)"},{"n":"ilanyu/cve-2015-5477","u":"https://github.com/ilanyu/cve-2015-5477","s":1,"c":1439951736000,"d":"PoC exploit for CVE-2015-5477 in php"}]},"CVE-2019-11510":{"n":13,"first":1566376826000,"top":[{"n":"projectzeroindia/CVE-2019-11510","u":"https://github.com/projectzeroindia/CVE-2019-11510","s":359,"c":1566376826000,"d":"Exploit for Arbitrary File Read on Pulse Secure SSL VPN (CVE-2019-11510)"},{"n":"BishopFox/pwn-pulse","u":"https://github.com/BishopFox/pwn-pulse","s":132,"c":1568044719000,"d":"Exploit for Pulse Connect Secure SSL VPN arbitrary file read vulnerability (CVE-2019-11510)"},{"n":"jas502n/CVE-2019-11510-1","u":"https://github.com/jas502n/CVE-2019-11510-1","s":52,"c":1566897670000,"d":"SSL VPN Rce"},{"n":"imjdl/CVE-2019-11510-poc","u":"https://github.com/imjdl/CVE-2019-11510-poc","s":50,"c":1566461899000,"d":"Pulse Secure SSL VPN  pre-auth file reading"},{"n":"cisagov/check-your-pulse","u":"https://github.com/cisagov/check-your-pulse","s":28,"c":1587054767000,"d":"This utility can help determine if indicators of compromise (IOCs) exist in the log files of a Pulse Secure VPN Appliance for CVE-2019-11510"}]},"CVE-2021-22205":{"n":26,"first":1622907736000,"top":[{"n":"Al1ex/CVE-2021-22205","u":"https://github.com/Al1ex/CVE-2021-22205","s":287,"c":1635481845000,"d":"CVE-2021-22205& GitLab CE/EE RCE"},{"n":"inspiringz/CVE-2021-22205","u":"https://github.com/inspiringz/CVE-2021-22205","s":238,"c":1636605247000,"d":"GitLab CE/EE Preauth RCE using ExifTool"},{"n":"mr-r3bot/Gitlab-CVE-2021-22205","u":"https://github.com/mr-r3bot/Gitlab-CVE-2021-22205","s":181,"c":1622907736000,"d":""},{"n":"XTeam-Wing/CVE-2021-22205","u":"https://github.com/XTeam-Wing/CVE-2021-22205","s":86,"c":1635402577000,"d":"Pocsuite3 For CVE-2021-22205"},{"n":"r0eXpeR/CVE-2021-22205","u":"https://github.com/r0eXpeR/CVE-2021-22205","s":69,"c":1635429771000,"d":"CVE-2021-22205 Unauthorized RCE"}]},"CVE-2023-22894":{"n":2,"first":1682378773000,"top":[{"n":"Saboor-Hakimi/CVE-2023-22894","u":"https://github.com/Saboor-Hakimi/CVE-2023-22894","s":13,"c":1682378773000,"d":"CVE-2023-22894"},{"n":"maxntv/CVE-2023-22894-PoC","u":"https://github.com/maxntv/CVE-2023-22894-PoC","s":0,"c":1753978560000,"d":""}]},"CVE-2026-102255":{"n":2,"first":1791812596000,"top":[{"n":"HORKimhab/CVE-2026-102255","u":"https://github.com/HORKimhab/CVE-2026-102255","s":0,"c":1791812596000,"d":"CVE-2026-102255 - Draft or TODO"},{"n":"techupdate24/sonicwall-sma-1000-cve-2026-102255","u":"https://github.com/techupdate24/sonicwall-sma-1000-cve-2026-102255","s":0,"c":1791825748000,"d":"A complete guide and workflow for integrating Agile sprints with DevOps CI/CD pipelines."}]},"CVE-2024-8176":{"n":1,"first":1743590340000,"top":[{"n":"uthrasri/Expat_2.6.2_CVE-2024-8176","u":"https://github.com/uthrasri/Expat_2.6.2_CVE-2024-8176","s":0,"c":1743590340000,"d":""}]},"CVE-2026-34197":{"n":15,"first":1775633329000,"top":[{"n":"Catherines77/ActiveMQ-EXPtools","u":"https://github.com/Catherines77/ActiveMQ-EXPtools","s":86,"c":1776652730000,"d":"Apache ActiveMQ漏洞综合利用工具(CVE-2015-5254，CVE-2016-3088，CVE-2022-41678，CVE-2023-46604，CVE-2024-32114，CVE-2026-34197，CVE-2026-40466， CVE-2026-425"},{"n":"dinosn/apache-activemq-rce-research","u":"https://github.com/dinosn/apache-activemq-rce-research","s":9,"c":1783147518000,"d":"Apache ActiveMQ Classic RCE research: CVE-2026-34197 / CVE-2026-42588 bypass chain + hardened-6.2.6 audit findings + Crowdfense comparison "},{"n":"dinosn/CVE-2026-34197","u":"https://github.com/dinosn/CVE-2026-34197","s":8,"c":1775639913000,"d":"CVE-2026-34197 activemq PoC"},{"n":"DEVSECURITYSPRO/CVE-2026-34197","u":"https://github.com/DEVSECURITYSPRO/CVE-2026-34197","s":4,"c":1775678821000,"d":"CVE-2026-34197 - Apache ActiveMQ RCE via Jolokia Endpoint PoC"},{"n":"AtoposX-J/CVE-2026-34197-Apache-ActiveMQ-RCE","u":"https://github.com/AtoposX-J/CVE-2026-34197-Apache-ActiveMQ-RCE","s":2,"c":1775727848000,"d":"CVE-2026-34197"}]},"CVE-2026-61500":{"n":1,"first":1790436221000,"top":[{"n":"aramosf/CVE-2026-61500","u":"https://github.com/aramosf/CVE-2026-61500","s":0,"c":1790436221000,"d":"CVE-2026-61500 Rejetto HFS predictable PRNG session forgery to RCE PoC and Docker lab"}]},"CVE-2026-96940":{"n":1,"first":1791250645000,"top":[{"n":"HORKimhab/CVE-2026-96940","u":"https://github.com/HORKimhab/CVE-2026-96940","s":1,"c":1791250645000,"d":"CVE-2026-96940"}]},"CVE-2026-90970":{"n":1,"first":1791025352000,"top":[{"n":"techupdate24/gitlab-ai-gateway-cve-2026-90970","u":"https://github.com/techupdate24/gitlab-ai-gateway-cve-2026-90970","s":0,"c":1791025352000,"d":"A complete guide and workflow for integrating Agile sprints with DevOps CI/CD pipelines."}]},"CVE-2026-103956":{"n":1,"first":1791064450000,"top":[{"n":"abraxas/cve-2026-103956-loom-unauth","u":"https://github.com/abraxas/cve-2026-103956-loom-unauth","s":8,"c":1791064450000,"d":"CVE-2026-103956 - Loom for AWS - Critical - Auth bypass - unauthenticated super-admin when no IdP is configured"}]},"CVE-2026-104286":{"n":4,"first":1790892942000,"top":[{"n":"ShadowForge-Cyber/CVE-2026-104286-POC","u":"https://github.com/ShadowForge-Cyber/CVE-2026-104286-POC","s":0,"c":1790892942000,"d":""},{"n":"techupdate24/fortimail-zero-day-cve-2026-104286","u":"https://github.com/techupdate24/fortimail-zero-day-cve-2026-104286","s":0,"c":1790945277000,"d":"A complete guide and workflow for integrating Agile sprints with DevOps CI/CD pipelines."},{"n":"kh20134/fortimail-cve-2026-104286-response","u":"https://github.com/kh20134/fortimail-cve-2026-104286-response","s":0,"c":1791603389000,"d":"FortiMail CVE-2026-104286 (CVSS 9.8) 점검·대응 도구 (버전 확인, IoC 점검, 완화·패치 체크리스트)"},{"n":"0xREBYTE/CVE-2026-104286-PoC","u":"https://github.com/0xREBYTE/CVE-2026-104286-PoC","s":0,"c":1791743162000,"d":"PoC CVE-2026-104286 FortiMail "}]},"CVE-2026-93616":{"n":2,"first":1790094521000,"top":[{"n":"WadesWeaponShed/CVE-2026-93616_Checks","u":"https://github.com/WadesWeaponShed/CVE-2026-93616_Checks","s":0,"c":1790094521000,"d":"Simple Checks to look for indicators of compromise"},{"n":"BishopFox/CVE-2026-93616-check","u":"https://github.com/BishopFox/CVE-2026-93616-check","s":0,"c":1790865151000,"d":"Safely detect Check Point CPM RCE CVE-2026-93616"}]},"CVE-2026-73570":{"n":9,"first":1787282303000,"top":[{"n":"HORKimhab/CVE-2026-73570","u":"https://github.com/HORKimhab/CVE-2026-73570","s":5,"c":1787282303000,"d":"CVE-2026-73570"},{"n":"gabrielunknown/CVE-2026-73570","u":"https://github.com/gabrielunknown/CVE-2026-73570","s":4,"c":1787715014000,"d":"Zimbra SNMP Notification OS Command Injection — Unauthenticated RCE via SMTP exploit (Poc)"},{"n":"jishino567/CVE-2026-73570","u":"https://github.com/jishino567/CVE-2026-73570","s":2,"c":1787653553000,"d":"PoC for CVE-2026-73570 (Zimbra SMTP Command Injection)"},{"n":"dahnutz/zimbra-cve-2026-73570-ir","u":"https://github.com/dahnutz/zimbra-cve-2026-73570-ir","s":2,"c":1788518732000,"d":"Detection-first, evidence-preserving incident-response toolkit for Zimbra CVE-2026-73570. Includes read-only host checks, IOC feeds, triage,"},{"n":"0xBlackash/CVE-2026-73570","u":"https://github.com/0xBlackash/CVE-2026-73570","s":2,"c":1790802806000,"d":"CVE-2026-73570"}]},"CVE-2026-86950":{"n":5,"first":1790859662000,"top":[{"n":"msuiche/hotcell","u":"https://github.com/msuiche/hotcell","s":9,"c":1790878407000,"d":"Runtime exploit monitor for Apple document/image pipelines (iOS/macOS) — EXPMON concept: Frida agent + behavioral rules. First target: the C"},{"n":"decalage2/detect_CVE-2026-86950","u":"https://github.com/decalage2/detect_CVE-2026-86950","s":5,"c":1790969407000,"d":"A python tool to detect PDF files exploiting CVE-2026-86950"},{"n":"34zY/CVE-2026-86950","u":"https://github.com/34zY/CVE-2026-86950","s":0,"c":1790859662000,"d":""},{"n":"java99999/CVE-2026-86950-POC","u":"https://github.com/java99999/CVE-2026-86950-POC","s":0,"c":1790911822000,"d":"Out-of-bounds Write (CWE-787)"},{"n":"0xBlackash/CVE-2026-86950","u":"https://github.com/0xBlackash/CVE-2026-86950","s":0,"c":1791203534000,"d":"CVE-2026-86950"}]},"CVE-2023-46604":{"n":40,"first":1698290705000,"top":[{"n":"SaumyajeetDas/CVE-2023-46604-RCE-Reverse-Shell-Apache-ActiveMQ","u":"https://github.com/SaumyajeetDas/CVE-2023-46604-RCE-Reverse-Shell-Apache-ActiveMQ","s":126,"c":1699049169000,"d":" Achieving a Reverse Shell Exploit for Apache ActiveMQ (CVE_2023-46604) "},{"n":"Catherines77/ActiveMQ-EXPtools","u":"https://github.com/Catherines77/ActiveMQ-EXPtools","s":86,"c":1776652730000,"d":"Apache ActiveMQ漏洞综合利用工具(CVE-2015-5254，CVE-2016-3088，CVE-2022-41678，CVE-2023-46604，CVE-2024-32114，CVE-2026-34197，CVE-2026-40466， CVE-2026-425"},{"n":"Arlenhiack/ActiveMQ-RCE-Exploit","u":"https://github.com/Arlenhiack/ActiveMQ-RCE-Exploit","s":44,"c":1709622561000,"d":"ActiveMQ RCE (CVE-2023-46604) 回显利用工具"},{"n":"evkl1d/CVE-2023-46604","u":"https://github.com/evkl1d/CVE-2023-46604","s":41,"c":1699099101000,"d":""},{"n":"trganda/ActiveMQ-RCE","u":"https://github.com/trganda/ActiveMQ-RCE","s":28,"c":1698290705000,"d":"CVE-2023-46604"}]},"CVE-2026-76504":{"n":1,"first":1790797215000,"top":[{"n":"ShadowForge-Cyber/CVE-2026-76504-Proof-of-concept","u":"https://github.com/ShadowForge-Cyber/CVE-2026-76504-Proof-of-concept","s":2,"c":1790797215000,"d":"EUVD-2026-89950  Improper Handling of URL Encoding (Hex Encoding) (CWE-177)"}]},"CVE-2026-84411":{"n":2,"first":1791647949000,"top":[{"n":"maxprog-svg/CVE-2026-84411","u":"https://github.com/maxprog-svg/CVE-2026-84411","s":0,"c":1791647949000,"d":" CVE-2026-84411 — MikroTik RouterOS WebFig Integer Underflow Exploit"},{"n":"Apiratchai/CVE-2026-84411-reproduction","u":"https://github.com/Apiratchai/CVE-2026-84411-reproduction","s":0,"c":1791835878000,"d":"CVE-2026-84411 root cause notes and a non-destructive probe (RouterOS before 7.24)"}]},"CVE-2026-88773":{"n":1,"first":1790971199000,"top":[{"n":"Scyrix-LLC/CVE-2026-88773","u":"https://github.com/Scyrix-LLC/CVE-2026-88773","s":1,"c":1790971199000,"d":"CVE-2026-88773"}]},"CVE-2026-88776":{"n":1,"first":1791557049000,"top":[{"n":"Scyrix-LLC/CVE-2026-88776","u":"https://github.com/Scyrix-LLC/CVE-2026-88776","s":2,"c":1791557049000,"d":"Write-up for CVE-2026-88776"}]},"CVE-2026-19490":{"n":2,"first":1788363833000,"top":[{"n":"TarPeg007/CVE-2026-19490","u":"https://github.com/TarPeg007/CVE-2026-19490","s":18,"c":1788363833000,"d":"NetScaler ADC/Gateway SAML unsigned-assertion bypass via HTTP-Redirect binding (CTX696939) - root cause analysis + PoC"},{"n":"BishopFox/CVE-2026-19490-check","u":"https://github.com/BishopFox/CVE-2026-19490-check","s":1,"c":1789053183000,"d":"Safely detect Citrix NetScaler SAML auth bypass CVE-2026-19490"}]},"CVE-2026-35273":{"n":3,"first":1781229079000,"top":[{"n":"HORKimhab/CVE-2026-35273","u":"https://github.com/HORKimhab/CVE-2026-35273","s":4,"c":1781229079000,"d":"CVE-2026-35273"},{"n":"0xBlackash/CVE-2026-35273","u":"https://github.com/0xBlackash/CVE-2026-35273","s":3,"c":1781255954000,"d":"CVE-2026-35273"},{"n":"12hrformat/CVE-2026-35273-POC","u":"https://github.com/12hrformat/CVE-2026-35273-POC","s":1,"c":1782451268000,"d":"CVE-2026-35273 - Oracle PeopleSoft PeopleTools Unauthenticated RCE Scanner"}]},"CVE-2026-28326":{"n":1,"first":1790161285000,"top":[{"n":"BishopFox/CVE-2026-28326-check","u":"https://github.com/BishopFox/CVE-2026-28326-check","s":0,"c":1790161285000,"d":"Safely detect SolarWinds ARM RCE CVE-2026-28326"}]},"CVE-2026-65660":{"n":2,"first":1790306573000,"top":[{"n":"ShadowForge-Cyber/CVE-2026-65660-Poc","u":"https://github.com/ShadowForge-Cyber/CVE-2026-65660-Poc","s":1,"c":1790368047000,"d":"Malicious Register Directive Code Injection Exploit"},{"n":"HORKimhab/CVE-2026-65660","u":"https://github.com/HORKimhab/CVE-2026-65660","s":0,"c":1790306573000,"d":"CVE-2026-65660 - Draft or TODO"}]},"CVE-2026-67279":{"n":4,"first":1790394409000,"top":[{"n":"HackSpeak/CVE-2026-67279","u":"https://github.com/HackSpeak/CVE-2026-67279","s":4,"c":1790394409000,"d":"MikroTrick (MikroTik RouterOS SSH takeover chain) PoC mirror - CVE-2026-67279 + CVE-2026-86060 (+67276); for authorized lab testing"},{"n":"tc4dy/CVE-2026-67279-86060-Toolkit","u":"https://github.com/tc4dy/CVE-2026-67279-86060-Toolkit","s":3,"c":1790510622000,"d":"CVE-2026-67279 + CVE-2026-86060 – MikroTrick MikroTik RouterOS SSH Pre-Auth Takeover (CVSS 9.2) | Red/Blue Team suite. 2 tools: Full Exploit"},{"n":"shmaki4/CVE-2026-67279-Mikrotik-6.42-POC","u":"https://github.com/shmaki4/CVE-2026-67279-Mikrotik-6.42-POC","s":0,"c":1791491486000,"d":"Laboratory proof of concept and research notes for CVE-2026-67279 on MikroTik RouterOS 6.42."},{"n":"GoldAden/mikrotrick-verifier","u":"https://github.com/GoldAden/mikrotrick-verifier","s":0,"c":1792271675000,"d":"Non-destructive behavioral verifier for the MikroTik RouterOS SSH auth-bypass (CVE-2026-67279 / MikroTrick). Measures server reaction only —"}]},"CVE-2026-87902":{"n":25,"first":1790100828000,"top":[{"n":"ressl/cve-2026-87902-poc","u":"https://github.com/ressl/cve-2026-87902-poc","s":39,"c":1790102426000,"d":"PoC for CVE-2026-87902 — unauthenticated path traversal in WordPress page-template resolution (local PHP inclusion, conditional RCE) with a "},{"n":"abraxas/CVE-2026-87902","u":"https://github.com/abraxas/CVE-2026-87902","s":35,"c":1790100828000,"d":"CVE-2026-87902 - WordPress - WordPress Core - Critical 9.2 - Unauthenticated Local File Inclusion (conditional RCE)"},{"n":"dinosn/cve-2026-87902-wordpress-lfi-lab","u":"https://github.com/dinosn/cve-2026-87902-wordpress-lfi-lab","s":14,"c":1790140808000,"d":"Reproduction lab + URL-list scanner + PoC for CVE-2026-87902 / GHSA-7hp8-65ch-5whp — WordPress get_page_template() unauthenticated LFI to co"},{"n":"tc4dy/CVE-2026-87902-Toolkit","u":"https://github.com/tc4dy/CVE-2026-87902-Toolkit","s":14,"c":1790191308000,"d":"CVE-2026-87902 – WordPress Core LFI→RCE Toolkit (CVSS 9.2) - Red/Blue Team suite for WordPress 4.7–7.1.1. | 2 tools: Full Exploit (LFI, PEAR"},{"n":"vulpecuna/CVE-2026-87902","u":"https://github.com/vulpecuna/CVE-2026-87902","s":9,"c":1790101976000,"d":"Unauthenticated RCE on Wordpress"}]},"CVE-2024-45519":{"n":4,"first":1727512146000,"top":[{"n":"Chocapikk/CVE-2024-45519","u":"https://github.com/Chocapikk/CVE-2024-45519","s":140,"c":1728087318000,"d":"Zimbra - Remote Command Execution (CVE-2024-45519)"},{"n":"p33d/CVE-2024-45519","u":"https://github.com/p33d/CVE-2024-45519","s":42,"c":1727512146000,"d":""},{"n":"sec13b/CVE-2024-45519","u":"https://github.com/sec13b/CVE-2024-45519","s":0,"c":1741467357000,"d":"Zimbra CVE-2024-45519"},{"n":"lionels-cyber/CVE-2024-45519-Zimbra-Real-Fix","u":"https://github.com/lionels-cyber/CVE-2024-45519-Zimbra-Real-Fix","s":0,"c":1786788176000,"d":"Zimbra CVE-2024-45519 real fix - Official patch is incomplete"}]},"CVE-2026-5430":{"n":4,"first":1789538215000,"top":[{"n":"abraxas/CVE-2026-5430","u":"https://github.com/abraxas/CVE-2026-5430","s":1,"c":1790369631000,"d":"CVE-2026-5430 - WSO2 API Manager - Critical 10.0 - Unauthenticated Account Takeover - WSO2 API Control Plane, WSO2 API Manager, WSO2 Traffic"},{"n":"HORKimhab/CVE-2026-5430","u":"https://github.com/HORKimhab/CVE-2026-5430","s":0,"c":1789538215000,"d":"CVE-2026-5430 - Draft or TODO"},{"n":"davidvrns/CVE-2026-5430-WSO2","u":"https://github.com/davidvrns/CVE-2026-5430-WSO2","s":0,"c":1791420127000,"d":"Detection PoC for CVE-2026-5430 — unauthenticated JWT algorithm bypass (CVSS 10.0) affecting WSO2 API Manager 4.1.0–4.6.0. Read-only assessm"},{"n":"getdrive/wso2_cve-2026-5430_lab","u":"https://github.com/getdrive/wso2_cve-2026-5430_lab","s":0,"c":1791451692000,"d":"Уязвимая лаборатория WSO2 API Manager 4.5.0 в Docker, сканер и эксплойт для CVE-2026-5430 (обход аутентификации через поддельный HS256 JWT)"}]},"CVE-2026-71362":{"n":1,"first":1786803693000,"top":[{"n":"dinosn/cve-2026-71362-magento-lab","u":"https://github.com/dinosn/cve-2026-71362-magento-lab","s":5,"c":1786803693000,"d":"One-command Docker lab reproducing CVE-2026-71362 (Adobe Commerce / Magento Open Source customer-session identity-switch account takeover, A"}]},"CVE-2025-39682":{"n":2,"first":1760428743000,"top":[{"n":"khoatran107/cve-2025-39682","u":"https://github.com/khoatran107/cve-2025-39682","s":6,"c":1760428743000,"d":"A variant of CVE-2024-58239"},{"n":"suominen/CVE-2025-39682","u":"https://github.com/suominen/CVE-2025-39682","s":0,"c":1789883889000,"d":"Tracking CVE-2025-39682, the Linux kernel kTLS zero-length record use-after-free"}]},"CVE-2026-53266":{"n":1,"first":1789884220000,"top":[{"n":"suominen/CVE-2026-53266","u":"https://github.com/suominen/CVE-2026-53266","s":0,"c":1789884220000,"d":"Tracking CVE-2026-53266, the Linux kernel ebtables SNAT ARP-rewrite page-cache write"}]},"CVE-2025-39964":{"n":2,"first":1763039239000,"top":[{"n":"n1k0oowang/CVE-2025-39964_EXP","u":"https://github.com/n1k0oowang/CVE-2025-39964_EXP","s":3,"c":1763039239000,"d":"CVE-2025-39964 EXP"},{"n":"suominen/CVE-2025-39964","u":"https://github.com/suominen/CVE-2025-39964","s":0,"c":1789883714000,"d":"Tracking CVE-2025-39964, the Linux kernel AF_ALG concurrent-write race"}]},"CVE-2026-94127":{"n":2,"first":1790159909000,"top":[{"n":"watchtowrlabs/watchTowr-vs-f5-bigip-PreAuth-RCE-CVE-2026-94127","u":"https://github.com/watchtowrlabs/watchTowr-vs-f5-bigip-PreAuth-RCE-CVE-2026-94127","s":15,"c":1790277733000,"d":""},{"n":"FurkanKAYAPINAR/CVE-2026-94127","u":"https://github.com/FurkanKAYAPINAR/CVE-2026-94127","s":0,"c":1790159909000,"d":"CVE-2026-94127"}]},"CVE-2026-85102":{"n":1,"first":1791359464000,"top":[{"n":"aduli198/CVE-2026-85102","u":"https://github.com/aduli198/CVE-2026-85102","s":0,"c":1791359464000,"d":"Authentication Bypass and Remote Code Execution in Remote Access and Site-to-Site VPN"}]},"CVE-2026-18963":{"n":18,"first":1787217927000,"top":[{"n":"ynsmroztas/KeySniper","u":"https://github.com/ynsmroztas/KeySniper","s":119,"c":1788722747000,"d":"**CVE-2026-18963** — unauthenticated Keycloak account takeover via the reset-credentials flow."},{"n":"Snizi/CVE-2026-18963-Exploit","u":"https://github.com/Snizi/CVE-2026-18963-Exploit","s":46,"c":1787263271000,"d":"Exploit for KeyCloak CVE-2026-18963"},{"n":"Red-Darkin/CVE-2026-18963-keycloak","u":"https://github.com/Red-Darkin/CVE-2026-18963-keycloak","s":20,"c":1787614817000,"d":"CVE-2026-18963"},{"n":"EQSTLab/CVE-2026-18963","u":"https://github.com/EQSTLab/CVE-2026-18963","s":18,"c":1788253719000,"d":"Keycloak reset-credentials flow bypass"},{"n":"kyos-public/keycloak-cve-2026-18963-hunt","u":"https://github.com/kyos-public/keycloak-cve-2026-18963-hunt","s":16,"c":1787217927000,"d":"Hunt for CVE-2026-18963 exploitation traces (Keycloak unauthenticated account takeover) in the Keycloak database"}]},"CVE-2026-85046":{"n":7,"first":1788509494000,"top":[{"n":"atiilla/CVE-2026-85046","u":"https://github.com/atiilla/CVE-2026-85046","s":8,"c":1788895137000,"d":"CVE-2026-85046 | Chrome V8 Type Confusion in Inline Array.prototype.sort (Maglev/Turbofan) | CVSS 8.8 | CWE-843 | Chrome < 152.0.7977.82"},{"n":"adriyansyah-mf/cve-2026-85046-poc","u":"https://github.com/adriyansyah-mf/cve-2026-85046-poc","s":6,"c":1788618438000,"d":""},{"n":"HORKimhab/CVE-2026-85046","u":"https://github.com/HORKimhab/CVE-2026-85046","s":1,"c":1788509494000,"d":"CVE-2026-85046"},{"n":"SneakyNachos/CVE-2026-85046-who-put-the-silverback-guerilla-in-the-wasm","u":"https://github.com/SneakyNachos/CVE-2026-85046-who-put-the-silverback-guerilla-in-the-wasm","s":1,"c":1788893695000,"d":""},{"n":"ubitquity/CVE-2026-85046-Patch-confusion-zero-day-vulnerability-in-Google-Chrome-s-V8-engine","u":"https://github.com/ubitquity/CVE-2026-85046-Patch-confusion-zero-day-vulnerability-in-Google-Chrome-s-V8-engine","s":0,"c":1788521327000,"d":"Conceptual C++ patch and structural analysis for CVE-2026-85046, a critical type confusion zero-day vulnerability in Google Chrome's V8 engi"}]},"CVE-2026-87491":{"n":1,"first":1789076832000,"top":[{"n":"SneakyNachos/CVE-2026-87491-and-CVE-2026-85046-the-bagel-fell-off-the-counter","u":"https://github.com/SneakyNachos/CVE-2026-87491-and-CVE-2026-85046-the-bagel-fell-off-the-counter","s":5,"c":1789076832000,"d":""}]},"CVE-2026-66804":{"n":4,"first":1784504247000,"top":[{"n":"Rat5ak/CVE-2026-66804-CrossDevice-Service-EoP","u":"https://github.com/Rat5ak/CVE-2026-66804-CrossDevice-Service-EoP","s":25,"c":1786585363000,"d":"CVE-2026-66804 Windows Cross Device virtual camera EoP - Standard user to SYSTEM"},{"n":"DavidCarliez/CVE-2026-66804-CrossDevice-LPE","u":"https://github.com/DavidCarliez/CVE-2026-66804-CrossDevice-LPE","s":15,"c":1784807513000,"d":""},{"n":"ZeroDayVPN/CVE-2026-66804-CrossDevice-Service-EoP","u":"https://github.com/ZeroDayVPN/CVE-2026-66804-CrossDevice-Service-EoP","s":2,"c":1784504247000,"d":"sadsadsa"},{"n":"CypherHippie/CVE-2026-66804","u":"https://github.com/CypherHippie/CVE-2026-66804","s":1,"c":1784997647000,"d":""}]},"CVE-2026-50343":{"n":1,"first":1780476632000,"top":[{"n":"Rat5ak/CVE-2026-50343-InstallService-EoP","u":"https://github.com/Rat5ak/CVE-2026-50343-InstallService-EoP","s":48,"c":1780476632000,"d":"CVE-2026-50343 InstallService StaticPluginMap EoP - standard user to SYSTEM"}]},"CVE-2026-76460":{"n":1,"first":1789646416000,"top":[{"n":"S3v3n-JG/CVE-2026-76460","u":"https://github.com/S3v3n-JG/CVE-2026-76460","s":2,"c":1789646416000,"d":"CVE-2026-76460"}]},"CVE-2026-76461":{"n":4,"first":1789452817000,"top":[{"n":"0xBlackash/CVE-2026-76461","u":"https://github.com/0xBlackash/CVE-2026-76461","s":2,"c":1789463516000,"d":"CVE-2026-76461"},{"n":"S3v3n-JG/CVE-2026-76461","u":"https://github.com/S3v3n-JG/CVE-2026-76461","s":1,"c":1789649237000,"d":"CVE-2026-76461"},{"n":"HORKimhab/CVE-2026-76461","u":"https://github.com/HORKimhab/CVE-2026-76461","s":0,"c":1789452817000,"d":"CVE-2026-76461 - Draft or TODO"},{"n":"fevar54/CVE-2026-76461-Detection-Kit-","u":"https://github.com/fevar54/CVE-2026-76461-Detection-Kit-","s":0,"c":1789482785000,"d":""}]},"CVE-2026-85706":{"n":13,"first":1789127707000,"top":[{"n":"guneykabel/cve-2026-85706","u":"https://github.com/guneykabel/cve-2026-85706","s":43,"c":1789140262000,"d":"Exploit poc for CVE-2026-85706 an unauthenticated arbitrary file read on Gitlab CE-EE affecting versions: 18.7–19.1.7; 19.2.0–19.2.5; 19.3.0"},{"n":"EQSTLab/CVE-2026-85706","u":"https://github.com/EQSTLab/CVE-2026-85706","s":27,"c":1790570830000,"d":"GitLab Unauthenticated Arbitrary File Read"},{"n":"ynsmroztas/GitLabSniper","u":"https://github.com/ynsmroztas/GitLabSniper","s":9,"c":1789162015000,"d":"CVE-2026-85706 Unauthenticated File Read"},{"n":"0xlyvio/cve-2026-85706-poc-exploit-gitlab","u":"https://github.com/0xlyvio/cve-2026-85706-poc-exploit-gitlab","s":4,"c":1789245656000,"d":"cve-2026-85706-poc-exploit-gitlab"},{"n":"FlowerWitch/CVE-2026-85706_docker_exp","u":"https://github.com/FlowerWitch/CVE-2026-85706_docker_exp","s":2,"c":1789127707000,"d":"CVE-2026-85706_docker_exp"}]},"CVE-2026-86060":{"n":3,"first":1789010378000,"top":[{"n":"digiprosec/MicroTrick","u":"https://github.com/digiprosec/MicroTrick","s":55,"c":1790083434000,"d":"cve-2026-86060 PoC"},{"n":"gagaltotal/CVE-2026-mikrotik-poc","u":"https://github.com/gagaltotal/CVE-2026-mikrotik-poc","s":3,"c":1790351974000,"d":"MikroTik RouterOS PoC Collection - CVE-2026-86060 - CVE-2026-67279 - CVE-2026-67276 RouterOS SSH"},{"n":"bahirul/cve-2026-86060","u":"https://github.com/bahirul/cve-2026-86060","s":1,"c":1789010378000,"d":"Mikrotik CVE-2026-86060 Score 9.2 Critical"}]},"CVE-2026-20079":{"n":3,"first":1774703296000,"top":[{"n":"CyberAuth/CVE-2026-20079","u":"https://github.com/CyberAuth/CVE-2026-20079","s":6,"c":1786991795000,"d":"Python proof of concept for CVE-2026-20079 affecting Cisco Secure Firewall Management Center."},{"n":"0xBlackash/CVE-2026-20079","u":"https://github.com/0xBlackash/CVE-2026-20079","s":0,"c":1774703296000,"d":"CVE-2026-20079"},{"n":"DiegoArias008/CVE-2026-20079-checker","u":"https://github.com/DiegoArias008/CVE-2026-20079-checker","s":0,"c":1789337379000,"d":""}]},"CVE-2026-75650":{"n":6,"first":1788781135000,"top":[{"n":"fortbridge/stylesmuggler","u":"https://github.com/fortbridge/stylesmuggler","s":8,"c":1789223222000,"d":"Private HTTP-only reproduction of CVE-2026-75650 StyleSmuggler"},{"n":"dinosn/cve-2026-75650-magento-validation-lab","u":"https://github.com/dinosn/cve-2026-75650-magento-validation-lab","s":6,"c":1788845997000,"d":"Docker lab reproducing the complete CVE-2026-75650 StyleSmuggler unauthenticated HTTP RCE and validating Adobe VULN-39341."},{"n":"disrex-group/stylesmuggler-adobe-patches","u":"https://github.com/disrex-group/stylesmuggler-adobe-patches","s":5,"c":1788854342000,"d":"composer require delivery of Adobe's official APSB26-146 (CVE-2026-75650) fix for Magento, via cweagans/composer-patches. Auto-selects the p"},{"n":"jithinkrishnanrs/stylesmuggler-ioc-toolkit","u":"https://github.com/jithinkrishnanrs/stylesmuggler-ioc-toolkit","s":0,"c":1788781135000,"d":"StyleSmuggler (CVE-2026-75650) IOC toolkit for Magento Open Source and Adobe Commerce. Detect compromised stores, Rust implants, PHP web she"},{"n":"disrex-group/stylesmuggler-adobe-patches-mageos","u":"https://github.com/disrex-group/stylesmuggler-adobe-patches-mageos","s":0,"c":1788857240000,"d":"composer require delivery of Adobe's official APSB26-146 (CVE-2026-75650) fix for Mage-OS stores, via cweagans/composer-patches. Companion t"}]},"CVE-2026-86218":{"n":3,"first":1788771242000,"top":[{"n":"HORKimhab/CVE-2026-86218","u":"https://github.com/HORKimhab/CVE-2026-86218","s":0,"c":1788771242000,"d":"CVE-2026-86218 - Draft or TODO - N-central is vulnerable to a pre-auth remote code execution"},{"n":"Udyz/CVE-2026-86218","u":"https://github.com/Udyz/CVE-2026-86218","s":0,"c":1789374856000,"d":"CVE-2026-86218 - N-able N-central Struts BeanUtils Unauthenticated RCE"},{"n":"super-meuw/CVE-2026-86218","u":"https://github.com/super-meuw/CVE-2026-86218","s":0,"c":1790166768000,"d":"CVE-2026-86218 "}]},"CVE-2026-59822":{"n":1,"first":1788415822000,"top":[{"n":"HORKimhab/CVE-2026-59822","u":"https://github.com/HORKimhab/CVE-2026-59822","s":0,"c":1788415822000,"d":"CVE-2026-59822 - Draft or TODO"}]},"CVE-2026-48710":{"n":5,"first":1775009520000,"top":[{"n":"eris-ths/supply-chain-guard","u":"https://github.com/eris-ths/supply-chain-guard","s":3,"c":1775009520000,"d":"Detect, assess, and respond to supply chain attacks across npm/yarn and Python (pip/poetry/uv). Claude Code skill + standalone scripts. Buil"},{"n":"xtremebeing/starlette-host-header-lab","u":"https://github.com/xtremebeing/starlette-host-header-lab","s":1,"c":1779850719000,"d":"Starlette Host-Header URL Confusion Lab (X41-2026-002) - CVE-2026-48710"},{"n":"Bhanunamikaze/BadHost-CVE-2026-48710-Exploit","u":"https://github.com/Bhanunamikaze/BadHost-CVE-2026-48710-Exploit","s":1,"c":1779962263000,"d":"Detection scanner for CVE-2026-48710 - Host-header auth bypass in Starlette/FastAPI"},{"n":"sb-ox/repro-OXDEV-77637-uv-workspace","u":"https://github.com/sb-ox/repro-OXDEV-77637-uv-workspace","s":0,"c":1785774090000,"d":"OXDEV-77637 repro fixture: uv workspace whose transitive CVE (starlette 0.25.0 / CVE-2026-48710) is dropped when the lean clone omits worksp"},{"n":"CuteeCat/CVE-2026-48710","u":"https://github.com/CuteeCat/CVE-2026-48710","s":0,"c":1786436496000,"d":"CVE-2026-48710漏洞验证代码"}]},"CVE-2026-49869":{"n":2,"first":1782828784000,"top":[{"n":"EQSTLab/CVE-2026-49869","u":"https://github.com/EQSTLab/CVE-2026-49869","s":4,"c":1790659473000,"d":"Kestra Unauthenticated RCE"},{"n":"Ap0dexMe0/CVE-2026-49869","u":"https://github.com/Ap0dexMe0/CVE-2026-49869","s":3,"c":1782828784000,"d":"Kestra Auth-Bypass Vulnerability Checker"}]},"CVE-2026-82329":{"n":8,"first":1788243307000,"top":[{"n":"dinosn/cve-2026-82329-jfrog-artifactory","u":"https://github.com/dinosn/cve-2026-82329-jfrog-artifactory","s":12,"c":1788272234000,"d":"CVE-2026-82329 JFrog Artifactory unauthenticated auth-bypass: reproducible Docker lab + URL-parameter validator PoC + patch-diff analysis"},{"n":"ynsmroztas/CVE-2026-82329-JFrog-Artifactory-Auth-Bypass","u":"https://github.com/ynsmroztas/CVE-2026-82329-JFrog-Artifactory-Auth-Bypass","s":6,"c":1788380054000,"d":"CVE-2026-82329 — JFrog Artifactory (self-hosted)  Auth Bypass"},{"n":"tc4dy/CVE-2026-82329-PoC-Exploit","u":"https://github.com/tc4dy/CVE-2026-82329-PoC-Exploit","s":4,"c":1789503328000,"d":"CVE-2026-82329 – JFrog Artifactory Auth Bypass Toolkit (CVSS 9.8) | Red/Blue Team suite for self-hosted Artifactory 7.x (111-161). 2 tools: "},{"n":"0xTerror/CVE-2026-82329-JFrog-Artifactory-","u":"https://github.com/0xTerror/CVE-2026-82329-JFrog-Artifactory-","s":2,"c":1788785707000,"d":"CVE-2026-82329 — JFrog Artifactory Auth Bypass"},{"n":"realalexandergeorgiev/artifactory-CVE-2026-82329-poc.py","u":"https://github.com/realalexandergeorgiev/artifactory-CVE-2026-82329-poc.py","s":1,"c":1788331952000,"d":"CVE-2026-82329 — JFrog Artifactory unauthenticated authentication bypass (\"phantom join key\" -> forged service admin token)"}]},"CVE-2026-9586":{"n":2,"first":1788333526000,"top":[{"n":"fromABUV/CVE-2026-9586_POC_EXPLOIT","u":"https://github.com/fromABUV/CVE-2026-9586_POC_EXPLOIT","s":1,"c":1791771437000,"d":"For new CVEs without existing/working/non-mangled POCs"},{"n":"HORKimhab/CVE-2026-9586","u":"https://github.com/HORKimhab/CVE-2026-9586","s":0,"c":1788333526000,"d":"CVE-2026-9586 - Draft or TODO"}]},"CVE-2026-83548":{"n":3,"first":1788433416000,"top":[{"n":"xoessie/CVE-2026-83548-SonicWall-SMA1000-Analysis","u":"https://github.com/xoessie/CVE-2026-83548-SonicWall-SMA1000-Analysis","s":0,"c":1788433416000,"d":"Vulnerability Analysis of CVE-2026-83548 affecting SonicWall SMA1000 security systems."},{"n":"xcoy0te/CVE-2026-83548-checker","u":"https://github.com/xcoy0te/CVE-2026-83548-checker","s":0,"c":1788539421000,"d":"Non-intrusive detector for SonicWall SMA 1000 exposure to CVE-2026-83548/-83549 (version/patch-state check; no exploitation)"},{"n":"HORKimhab/CVE-2026-83548-CVE-2026-83549","u":"https://github.com/HORKimhab/CVE-2026-83548-CVE-2026-83549","s":0,"c":1788849840000,"d":"CVE-2026-83548, CVE-2026-83549, - Draft or TODO - https://github.com/rapid7/metasploit-framework/pull/21883"}]},"CVE-2023-49105":{"n":1,"first":1701776112000,"top":[{"n":"ambionics/owncloud-exploits","u":"https://github.com/ambionics/owncloud-exploits","s":41,"c":1701776112000,"d":"ownCloud exploits for CVE-2023-49105"}]},"CVE-2026-53362":{"n":1,"first":1783078256000,"top":[{"n":"suominen/ipv6_frag_escape","u":"https://github.com/suominen/ipv6_frag_escape","s":0,"c":1783078256000,"d":"Tracking IPV6_FRAG_ESCAPE (CVE-2026-53362, CVE-2026-53366), the IPv6 fragmentation container escape"}]},"CVE-2026-66384":{"n":1,"first":1787933204000,"top":[{"n":"HORKimhab/CVE-2026-66384","u":"https://github.com/HORKimhab/CVE-2026-66384","s":0,"c":1787933204000,"d":"CVE-2026-66384 - Draft or TODO"}]},"CVE-2021-23758":{"n":1,"first":1639582845000,"top":[{"n":"numanturle/CVE-2021-23758-POC","u":"https://github.com/numanturle/CVE-2021-23758-POC","s":18,"c":1639582845000,"d":""}]},"CVE-2015-3246":{"n":1,"first":1787819401000,"top":[{"n":"HORKimhab/CVE-2015-3246","u":"https://github.com/HORKimhab/CVE-2015-3246","s":0,"c":1787819401000,"d":"CVE-2015-3246"}]},"CVE-2015-5287":{"n":1,"first":1787818460000,"top":[{"n":"HORKimhab/CVE-2015-5287","u":"https://github.com/HORKimhab/CVE-2015-5287","s":0,"c":1787818460000,"d":"CVE-2015-5287"}]},"CVE-2022-0995":{"n":4,"first":1648331169000,"top":[{"n":"Bonfee/CVE-2022-0995","u":"https://github.com/Bonfee/CVE-2022-0995","s":498,"c":1648331169000,"d":"CVE-2022-0995 exploit"},{"n":"1nzag/CVE-2022-0995","u":"https://github.com/1nzag/CVE-2022-0995","s":2,"c":1704279825000,"d":"CVE-2022-0995 exploit"},{"n":"AndreevSemen/CVE-2022-0995","u":"https://github.com/AndreevSemen/CVE-2022-0995","s":1,"c":1678431945000,"d":"Реализация средств повышения привилегий в Linux"},{"n":"A1b2rt/cve-2022-0995","u":"https://github.com/A1b2rt/cve-2022-0995","s":0,"c":1750866777000,"d":""}]},"CVE-2026-8452":{"n":5,"first":1689869107000,"top":[{"n":"securekomodo/citrixInspector","u":"https://github.com/securekomodo/citrixInspector","s":96,"c":1689869107000,"d":"Passively fingerprint Citrix ADC / NetScaler ADC & Gateway builds and detect known CVEs — CVE-2023-3519, CitrixBleed 2/3, CVE-2026-8452, and"},{"n":"watchtowrlabs/watchTowr-vs-Citrix-Netscaler-PreAuth-RCE-CVE-2026-8452","u":"https://github.com/watchtowrlabs/watchTowr-vs-Citrix-Netscaler-PreAuth-RCE-CVE-2026-8452","s":65,"c":1786719685000,"d":"CVE-2026-8452 PreAuth RCE"},{"n":"BishopFox/CVE-2026-8452-check","u":"https://github.com/BishopFox/CVE-2026-8452-check","s":1,"c":1787225084000,"d":"Safely detect Citrix NetScaler CVE-2026-8452"},{"n":"maxprog-svg/CitrixBleedCVE-2026-8452-2025-5777","u":"https://github.com/maxprog-svg/CitrixBleedCVE-2026-8452-2025-5777","s":0,"c":1788095998000,"d":"CitrixBleed Exploit Tool - CVE-2025-5777 & CVE-2026-8452. Unauthenticated remote memory read from Citrix NetScaler ADC & Gateway. Steal admi"},{"n":"techupdate24/citrix-netscaler-cve-2026-8452-rce","u":"https://github.com/techupdate24/citrix-netscaler-cve-2026-8452-rce","s":0,"c":1790494189000,"d":"A complete guide and workflow for integrating Agile sprints with DevOps CI/CD pipelines."}]},"CVE-2019-1068":{"n":1,"first":1612474856000,"top":[{"n":"Vulnerability-Playground/CVE-2019-1068","u":"https://github.com/Vulnerability-Playground/CVE-2019-1068","s":1,"c":1612474856000,"d":"Root cause analysis and PoC for a Microsoft SQL Server Stack Overflow Vulnerability by reversing svl.dll."}]},"CVE-2026-60004":{"n":11,"first":1785314116000,"top":[{"n":"imbas007/CVE-2026-60004-POC","u":"https://github.com/imbas007/CVE-2026-60004-POC","s":17,"c":1785743319000,"d":"CVE-2026-60004 Pre-Auth RCE Exploit — Gitea <= 1.27.0 diffpatch git hook injection (CVSS 9.8)"},{"n":"0xBlackash/CVE-2026-60004","u":"https://github.com/0xBlackash/CVE-2026-60004","s":6,"c":1785450256000,"d":"CVE-2026-60004"},{"n":"HORKimhab/CVE-2026-60004","u":"https://github.com/HORKimhab/CVE-2026-60004","s":5,"c":1785314116000,"d":"CVE-2026-60004"},{"n":"HackSpeak/CVE-2026-60004","u":"https://github.com/HackSpeak/CVE-2026-60004","s":2,"c":1785845819000,"d":"Gitea diffpatch RCE (CVE-2026-60004) PoC - repo-write to RCE as Gitea service account"},{"n":"gagaltotal/CVE-2026-60004-poc-gitea","u":"https://github.com/gagaltotal/CVE-2026-60004-poc-gitea","s":2,"c":1786194511000,"d":"CVE-2026-60004 — Gitea Pre-Auth RCE via diffpatch hook injection"}]},"CVE-2026-21962":{"n":10,"first":1769054365000,"top":[{"n":"samael0x4/CVE-2026-21962","u":"https://github.com/samael0x4/CVE-2026-21962","s":6,"c":1769054365000,"d":"Unauthenticated vulnerability that may allow remote attackers to compromise confidentiality and integrity, potentially leading to full syste"},{"n":"boroeurnprach/Ashwesker-CVE-2026-21962","u":"https://github.com/boroeurnprach/Ashwesker-CVE-2026-21962","s":6,"c":1769065859000,"d":"CVE-2026-21962"},{"n":"gregk4sec/cve-2026-21962","u":"https://github.com/gregk4sec/cve-2026-21962","s":4,"c":1772954413000,"d":""},{"n":"George0Papasotiriou/CVE-2026-21962-Oracle-HTTP-Server-WebLogic-Proxy-Plug-in-Critical-","u":"https://github.com/George0Papasotiriou/CVE-2026-21962-Oracle-HTTP-Server-WebLogic-Proxy-Plug-in-Critical-","s":3,"c":1770680622000,"d":"Oracle Fusion Middleware Oracle HTTP Server / WebLogic Server Proxy Plug-in has an easily exploitable, unauthenticated, network-reachable fl"},{"n":"zeetee1235/CVE-2026-21962","u":"https://github.com/zeetee1235/CVE-2026-21962","s":3,"c":1787799541000,"d":""}]},"CVE-2026-72530":{"n":1,"first":1787692460000,"top":[{"n":"fevar54/CVE-2026-72530-TrueConf-Sandbox-Escape-","u":"https://github.com/fevar54/CVE-2026-72530-TrueConf-Sandbox-Escape-","s":0,"c":1787692460000,"d":"Este repositorio contiene una demostración educativa de la mitigación y detección para **CVE-2026-72530**, una vulnerabilidad crítica de **C"}]},"CVE-2026-64849":{"n":4,"first":1787091743000,"top":[{"n":"codeb0ssx/CVE-2026-64849-PoC","u":"https://github.com/codeb0ssx/CVE-2026-64849-PoC","s":0,"c":1787091743000,"d":""},{"n":"BiuTrap/CVE-2026-64849","u":"https://github.com/BiuTrap/CVE-2026-64849","s":0,"c":1787102482000,"d":"CVE-2026-64849 PoC"},{"n":"zavisco/CVE-2026-64849.yaml","u":"https://github.com/zavisco/CVE-2026-64849.yaml","s":0,"c":1787148996000,"d":""},{"n":"isaca0315/CVE-2026-64849-poc-lab","u":"https://github.com/isaca0315/CVE-2026-64849-poc-lab","s":0,"c":1788654340000,"d":"este laboratorio puede estar bien o mal preguntale a la IA estoy probando pero debe funcionar hahahah"}]},"CVE-2026-33824":{"n":2,"first":1776785396000,"top":[{"n":"EpSiLoNPoInTOrI/IKEV2-POC","u":"https://github.com/EpSiLoNPoInTOrI/IKEV2-POC","s":6,"c":1779111871000,"d":"IKEv2, ikeext.dll, CVE-2026-33824, double free, heap grooming, ROP, SKF fragmentation, Windows exploit, anti-debug, obfuscation, API hooking"},{"n":"kaleth4/CVE-2026-33824","u":"https://github.com/kaleth4/CVE-2026-33824","s":1,"c":1776785396000,"d":""}]},"CVE-2026-59310":{"n":5,"first":1786953106000,"top":[{"n":"chu0119/vc-strike","u":"https://github.com/chu0119/vc-strike","s":8,"c":1790818150000,"d":"VC-Strike — VMware vCenter CVE-2026-59310 (unauth root RCE) & CVE-2026-59309 (SRP auth bypass) authorized pentest suite. GUI+CLI, multi-sess"},{"n":"zgsfsec/CVE-2026-59310-POC","u":"https://github.com/zgsfsec/CVE-2026-59310-POC","s":7,"c":1790352326000,"d":"CVE-2026-59310-POC 仅用于自测，请勿用于攻击"},{"n":"BiuTrap/CVE-2026-59310","u":"https://github.com/BiuTrap/CVE-2026-59310","s":2,"c":1786961391000,"d":"CVE-2026-59310 PoC"},{"n":"HORKimhab/CVE-2026-59310","u":"https://github.com/HORKimhab/CVE-2026-59310","s":0,"c":1786953106000,"d":"CVE-2026-59310"},{"n":"vpxuser/CVE-2026-59310","u":"https://github.com/vpxuser/CVE-2026-59310","s":0,"c":1790646873000,"d":"ChinaRan0/CVE-2026-59310-POC 的优化版本。子命令、一次性 cron、带远端 PTY 的交互 shell。仅限授权测试。"}]},"CVE-2026-55040":{"n":5,"first":1785228375000,"top":[{"n":"sfewer-r7/CVE-2026-55040","u":"https://github.com/sfewer-r7/CVE-2026-55040","s":59,"c":1786016794000,"d":"Microsoft SharePoint JWT Authentication Bypass (CVE-2026-55040)"},{"n":"l0ggg/CVE-2026-55040","u":"https://github.com/l0ggg/CVE-2026-55040","s":3,"c":1785228375000,"d":"Exploit code for CVE-2026-55040, it can create auth header for any validate account."},{"n":"zenzue/CVE-2026-55040","u":"https://github.com/zenzue/CVE-2026-55040","s":0,"c":1787727330000,"d":""},{"n":"maxprog-svg/CVE-2026-55040-Mass-Exploit","u":"https://github.com/maxprog-svg/CVE-2026-55040-Mass-Exploit","s":0,"c":1787824410000,"d":"CVE-2026-55040"},{"n":"virologi-info/mssharepoint-scanner","u":"https://github.com/virologi-info/mssharepoint-scanner","s":0,"c":1787837235000,"d":"A scanner for CVE-2026-55040 and CVE-2026-63520, designed to determine whether the server is affected by these two CVEs."}]},"CVE-2026-65400":{"n":3,"first":1787017539000,"top":[{"n":"acheong08/CVE-2026-65400","u":"https://github.com/acheong08/CVE-2026-65400","s":8,"c":1787388866000,"d":"Apple MacOS Screen Sharing Arbitrary File read/write -> RCE"},{"n":"panchocosil/CVE-2026-65400-poc","u":"https://github.com/panchocosil/CVE-2026-65400-poc","s":7,"c":1787336557000,"d":"Read-only PoC for CVE-2026-65400 — macOS Screen Sharing (screensharingd) pre-auth SRP bypass giving root file read. Patched in macOS 26.6.1 "},{"n":"HORKimhab/CVE-2026-65400","u":"https://github.com/HORKimhab/CVE-2026-65400","s":3,"c":1787017539000,"d":"CVE-2026-65400"}]},"CVE-2025-62593":{"n":2,"first":1787083891000,"top":[{"n":"Boreas37/CVE-2025-62593-PoC","u":"https://github.com/Boreas37/CVE-2025-62593-PoC","s":2,"c":1787083891000,"d":"PoC for CVE-2025-62593: unauthenticated RCE in Ray (CISA KEV). Stdlib-only Python."},{"n":"maxprog-svg/CVE-2026-33017","u":"https://github.com/maxprog-svg/CVE-2026-33017","s":0,"c":1788287380000,"d":"CVE-2025-62593 — Ray Unauthenticated RCE Exploit is an unauthenticated remote code execution vulnerability in the Ray distributed AI compute"}]},"CVE-2026-20349":{"n":1,"first":1792324680000,"top":[{"n":"ekacs/predicted-cve-2026-20349","u":"https://github.com/ekacs/predicted-cve-2026-20349","s":1,"c":1792324680000,"d":"Panduan Praktikum Edukasi: Deteksi Versi Cisco ASA & FTD (CVE-2026-20349)"}]},"CVE-2026-68820":{"n":4,"first":1786583060000,"top":[{"n":"ubitquity/Windows-WinSock-UAF-Mitigation","u":"https://github.com/ubitquity/Windows-WinSock-UAF-Mitigation","s":1,"c":1786790291000,"d":"This repository contains a conceptual patch demonstrating the mitigation for CVE-2026-68820, a critical Use-After-Free (UAF) vulnerability i"},{"n":"fevar54/CVE-2026-68820-Mitigation-PoC-","u":"https://github.com/fevar54/CVE-2026-68820-Mitigation-PoC-","s":1,"c":1787583470000,"d":"Demostracion educativa de mitigacion de CVE-2026-68820: Use-After-Free en afd.sys de Windows."},{"n":"HORKimhab/CVE-2026-68820","u":"https://github.com/HORKimhab/CVE-2026-68820","s":0,"c":1786583060000,"d":"CVE-2026-68820 - Draft or TODO"},{"n":"maxprog-svg/CVE-2026-68820_Mass_Exploit","u":"https://github.com/maxprog-svg/CVE-2026-68820_Mass_Exploit","s":0,"c":1787680758000,"d":"CVE-2026-68820 — Mass Exploit Framework Edition."}]},"CVE-2026-72898":{"n":12,"first":1786542886000,"top":[{"n":"EQSTLab/CVE-2026-72898","u":"https://github.com/EQSTLab/CVE-2026-72898","s":22,"c":1787813518000,"d":"Metabase SQLi"},{"n":"4minx/CVE-2026-72898","u":"https://github.com/4minx/CVE-2026-72898","s":9,"c":1786784816000,"d":"CVE-2026-72898 PoC : Metabase Unauthenticated SQL Injection"},{"n":"0xBlackash/CVE-2026-72898","u":"https://github.com/0xBlackash/CVE-2026-72898","s":8,"c":1786542886000,"d":"CVE-2026-72898"},{"n":"VuxNx/CVE-2026-72898","u":"https://github.com/VuxNx/CVE-2026-72898","s":2,"c":1786795166000,"d":"PoC for CVE-2026-72898"},{"n":"ubitquity/Metabase-Setup-Endpoint-SQLi-Fix","u":"https://github.com/ubitquity/Metabase-Setup-Endpoint-SQLi-Fix","s":1,"c":1786790696000,"d":"CVE-2026-72898-Metabase-SQLi-Fix"}]},"CVE-2026-8037":{"n":2,"first":1782806274000,"top":[{"n":"HORKimhab/CVE-2026-8037","u":"https://github.com/HORKimhab/CVE-2026-8037","s":0,"c":1782806274000,"d":"CVE-2026-8037 - Draft"},{"n":"Caster-chen/CVE-2026-8037-POC","u":"https://github.com/Caster-chen/CVE-2026-8037-POC","s":0,"c":1783597783000,"d":"包括能执行的命令探测和一键getshell（需要服务器部署服务）"}]},"CVE-2026-63077":{"n":6,"first":1785442333000,"top":[{"n":"sfewer-r7/CVE-2026-63077","u":"https://github.com/sfewer-r7/CVE-2026-63077","s":20,"c":1786091881000,"d":"Unauthenticated Remote Code Execution in JetBrains TeamCity (CVE-2026-63077)"},{"n":"unveiledhistory49/teamcity-cve-2026-63077-remediation","u":"https://github.com/unveiledhistory49/teamcity-cve-2026-63077-remediation","s":0,"c":1785442333000,"d":"JetBrains TeamCity On-Premises CVE-2026-63077 Emergency Hardening & Patch Runbook Package"},{"n":"BoredHackerBlog/teamcity-CVE-2026-63077-pcap","u":"https://github.com/BoredHackerBlog/teamcity-CVE-2026-63077-pcap","s":0,"c":1786147831000,"d":"teamcity teamcity-CVE-2026-63077 exploitation pcap"},{"n":"AnggaTechI/CVE-2026-63077","u":"https://github.com/AnggaTechI/CVE-2026-63077","s":0,"c":1786170729000,"d":"CVE-2026-63077 — Unauthenticated Remote Code Execution in JetBrains TeamCity via agent polling protocol deserialization. CVSS 9.8 CRITICAL. "},{"n":"bakos-sandor-nx/teamcity-cve-2026-63077-remediation","u":"https://github.com/bakos-sandor-nx/teamcity-cve-2026-63077-remediation","s":0,"c":1787121240000,"d":"JetBrains TeamCity On-Premises CVE-2026-63077 Emergency Hardening & Patch Runbook Package"}]},"CVE-2026-18556":{"n":1,"first":1785974466000,"top":[{"n":"CreamyG31337/ncentral-compromise-ioc-triage","u":"https://github.com/CreamyG31337/ncentral-compromise-ioc-triage","s":0,"c":1785974466000,"d":"Read-only N-able N-central CVE-2026-18556/CVE-2026-18577 post-exploitation IoC hunter for Windows endpoints"}]},"CVE-2026-34486":{"n":5,"first":1776238215000,"top":[{"n":"striga-ai/CVE-2026-34486","u":"https://github.com/striga-ai/CVE-2026-34486","s":70,"c":1778508466000,"d":"EncryptInterceptor fail-open bypass in Apache Tomcat Tribes clustering leading to unauthenticated RCE via Java deserialization."},{"n":"AirSkye/CVE-2026-34486-poc","u":"https://github.com/AirSkye/CVE-2026-34486-poc","s":12,"c":1776238215000,"d":"CVE-2026-34486 Apache Tomcat EncryptInterceptor 绕过漏洞复现（使用GLM5.1复现完成）"},{"n":"404-src/CVE-2026-34486","u":"https://github.com/404-src/CVE-2026-34486","s":10,"c":1776261355000,"d":"Apache Tomcat EncryptInterceptor Bypass → Unauthenticated RCE (CVE-2026-34486)"},{"n":"razureink/cve-2026-34486-tomcat_encrypt_bypass_reproduction","u":"https://github.com/razureink/cve-2026-34486-tomcat_encrypt_bypass_reproduction","s":0,"c":1784778381000,"d":"CVE Reproduction: cve-2026-34486-tomcat_encrypt_bypass_reproduction"},{"n":"CypherHippie/CVE-2026-34486---unauthenticated-RCE-via-Java-deserialization","u":"https://github.com/CypherHippie/CVE-2026-34486---unauthenticated-RCE-via-Java-deserialization","s":0,"c":1787099958000,"d":"EncryptInterceptor fail-open bypass in Apache Tomcat Tribes clustering leading to unauthenticated RCE via Java deserialization."}]},"CVE-2026-9198":{"n":9,"first":1784632499000,"top":[{"n":"0xgh057r3c0n/CVE-2026-9198","u":"https://github.com/0xgh057r3c0n/CVE-2026-9198","s":3,"c":1784926204000,"d":"IBM Langflow Unauthenticated RCE via Auto-Login Bypass"},{"n":"0xdak/CVE-2026-9198_exploit","u":"https://github.com/0xdak/CVE-2026-9198_exploit","s":1,"c":1784632499000,"d":""},{"n":"rmhowe425/PoC-CVE-2026-9198","u":"https://github.com/rmhowe425/PoC-CVE-2026-9198","s":1,"c":1785951848000,"d":"Proof of concept exploit code for CVE-2026-9198"},{"n":"ywh-jfellus/CVE-2026-9198","u":"https://github.com/ywh-jfellus/CVE-2026-9198","s":0,"c":1784885370000,"d":"Proof of Concept for CVE-2026-9198 - IBM Langflow Unauthenticated RCE via Auto-Login Bypass"},{"n":"Procjevt/CVE-2026-9198","u":"https://github.com/Procjevt/CVE-2026-9198","s":0,"c":1786363829000,"d":""}]},"CVE-2026-18577":{"n":1,"first":1785829405000,"top":[{"n":"HORKimhab/CVE-2026-18577","u":"https://github.com/HORKimhab/CVE-2026-18577","s":0,"c":1785829405000,"d":"CVE-2026-18577 - Draft"}]},"CVE-2026-16232":{"n":3,"first":1784679797000,"top":[{"n":"sfewer-r7/CVE-2026-16232","u":"https://github.com/sfewer-r7/CVE-2026-16232","s":11,"c":1785255571000,"d":"A proof-of-concept script to exploit CVE-2026-16232, an authentication bypass via the SmartConsole login process using an application token."},{"n":"HackSpeak/CVE-2026-16232","u":"https://github.com/HackSpeak/CVE-2026-16232","s":3,"c":1785761737000,"d":"CVE-2026-16232 (Check Point SmartConsole authentication bypass) PoC - unauth to admin; for authorized security testing"},{"n":"WadesWeaponShed/Check-Point-Trusted-Access-Review","u":"https://github.com/WadesWeaponShed/Check-Point-Trusted-Access-Review","s":0,"c":1784679797000,"d":"Local web app for conducting a Check Point Trusted Access Review. This scanner is built specifically to look for configuration issues around"}]},"CVE-2026-50522":{"n":5,"first":1784682293000,"top":[{"n":"4minx/CVE-2026-50522","u":"https://github.com/4minx/CVE-2026-50522","s":43,"c":1784967808000,"d":"CVE-2026-50522 PoC"},{"n":"WismanSec/sharepoint-2026-poc","u":"https://github.com/WismanSec/sharepoint-2026-poc","s":2,"c":1785083272000,"d":"PoC, IOCs, and detection logic for the SharePoint /_trust WS-Federation BinaryFormatter deserialization chain. Lab reconstruction covering u"},{"n":"HORKimhab/CVE-2026-50522","u":"https://github.com/HORKimhab/CVE-2026-50522","s":0,"c":1784682293000,"d":"CVE-2026-50522"},{"n":"ChPratik/CVE-2026-50522","u":"https://github.com/ChPratik/CVE-2026-50522","s":0,"c":1785168836000,"d":"Deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attacker to execute code over a network."},{"n":"darses/CVE-2026-50522","u":"https://github.com/darses/CVE-2026-50522","s":0,"c":1785262528000,"d":"Microsoft SharePoint CVE-2026-50522"}]},"CVE-2026-60137":{"n":11,"first":1784392566000,"top":[{"n":"codeb0ssx/Ultimate-wp2shell","u":"https://github.com/codeb0ssx/Ultimate-wp2shell","s":10,"c":1784409418000,"d":"wp2shell — Pre-authentication RCE in WordPress Core (CVE-2026-60137 + CVE-2026-63030). Chains an SQL injection in author__not_in with batch-"},{"n":"Colere-Sys/wp2shell-poc","u":"https://github.com/Colere-Sys/wp2shell-poc","s":4,"c":1784656181000,"d":"Analysis and end-to-end implementation of the patched wordpress RCE vulnerability - CVE-2026-60137 and CVE-2026-63030"},{"n":"h4cd0c/wp2shell","u":"https://github.com/h4cd0c/wp2shell","s":0,"c":1784392566000,"d":"wp2shell — Pre-authentication RCE in WordPress Core (CVE-2026-60137 + CVE-2026-63030). Chains an SQL injection in author__not_in with batch-"},{"n":"mrmtwoj/Fix-CVE-2026-60137-CVE-2026-63030-in-wordpress","u":"https://github.com/mrmtwoj/Fix-CVE-2026-60137-CVE-2026-63030-in-wordpress","s":0,"c":1784655849000,"d":"CVE-2026-60137Temporary Emergency Mitigation for CVE-2026-60137 & CVE-2026-63030 (wp2shell)"},{"n":"northsia/CVE-2026-60137-With-Skip-SSL","u":"https://github.com/northsia/CVE-2026-60137-With-Skip-SSL","s":0,"c":1785066725000,"d":"Adding --insecure to skip ssl"}]},"CVE-2026-63030":{"n":77,"first":1784319513000,"top":[{"n":"Icex0/wp2shell-poc","u":"https://github.com/Icex0/wp2shell-poc","s":797,"c":1784319513000,"d":"wp2shell (CVE-2026-63030 & CVE-2026-60137) - full RCE chain"},{"n":"gichirimaku/wp2shell-PoC","u":"https://github.com/gichirimaku/wp2shell-PoC","s":386,"c":1792085344000,"d":"CVE-2026-63030 + CVE-2026-60137 exploit RCE chain."},{"n":"0xsha/wp2shell","u":"https://github.com/0xsha/wp2shell","s":115,"c":1784384861000,"d":"CVE-2026-63030 + CVE-2026-60137 - “wp2shell”: unauthenticated RCE in WordPress core"},{"n":"ZephrFish/wp2shell-scanner","u":"https://github.com/ZephrFish/wp2shell-scanner","s":66,"c":1784330157000,"d":"CVE-2026-63030, CVE-2026-60137, wp2shell scanner"},{"n":"dinosn/wp2shell-lab","u":"https://github.com/dinosn/wp2shell-lab","s":64,"c":1784343890000,"d":"Non-destructive detector + Docker lab for wp2shell (CVE-2026-63030 REST /batch/v1 route confusion + CVE-2026-60137 author__not_in SQLi) in W"}]},"CVE-2026-0770":{"n":7,"first":1770507108000,"top":[{"n":"affix/CVE-2026-0770-PoC","u":"https://github.com/affix/CVE-2026-0770-PoC","s":6,"c":1770507108000,"d":"Proof of Concept for CVE-2026-0770 - Langflow Remote Code Execution"},{"n":"0xgh057r3c0n/CVE-2026-0770","u":"https://github.com/0xgh057r3c0n/CVE-2026-0770","s":1,"c":1771964883000,"d":"Langflow Remote Code Execution (RCE) Proof-of-Concept"},{"n":"0xBlackash/CVE-2026-0770","u":"https://github.com/0xBlackash/CVE-2026-0770","s":1,"c":1775200510000,"d":"CVE-2026-0770"},{"n":"Yetazyyy/CVE-2026-0770","u":"https://github.com/Yetazyyy/CVE-2026-0770","s":0,"c":1772964438000,"d":""},{"n":"Ez4rd1x1/CVE-2026-0770","u":"https://github.com/Ez4rd1x1/CVE-2026-0770","s":0,"c":1778827793000,"d":"LangFlow RCE | CVE-2026-0770 | Proof-Of-Concept"}]},"CVE-2026-25089":{"n":2,"first":1781058711000,"top":[{"n":"HORKimhab/CVE-2026-25089","u":"https://github.com/HORKimhab/CVE-2026-25089","s":6,"c":1781058711000,"d":"CVE-2026-25089 - Fortinet FortiSandbox"},{"n":"0xBlackash/CVE-2026-25089","u":"https://github.com/0xBlackash/CVE-2026-25089","s":3,"c":1781291013000,"d":"CVE-2026-25089"}]},"CVE-2026-39808":{"n":6,"first":1776262225000,"top":[{"n":"ynsmroztas/FortiSandbox-RCE-Exploit-CVE-2026-39808","u":"https://github.com/ynsmroztas/FortiSandbox-RCE-Exploit-CVE-2026-39808","s":27,"c":1776810108000,"d":"FortiSandbox RCE Scanner — CVE-2026-39808"},{"n":"samu-delucas/CVE-2026-39808","u":"https://github.com/samu-delucas/CVE-2026-39808","s":9,"c":1776262225000,"d":"PoC for Unauthenticated RCE in FortiSandbox via CVE-2026-39808"},{"n":"0xBlackash/CVE-2026-39808","u":"https://github.com/0xBlackash/CVE-2026-39808","s":2,"c":1776503736000,"d":"CVE-2026-39808"},{"n":"gotr00t0day/CVE-2026-39808","u":"https://github.com/gotr00t0day/CVE-2026-39808","s":2,"c":1791042623000,"d":"An unauthenticated OS command injection vulnerability"},{"n":"HORKimhab/CVE-2026-39808","u":"https://github.com/HORKimhab/CVE-2026-39808","s":0,"c":1781660522000,"d":"CVE-2026-39808 - Fortinet Sandbox - Draft"}]},"CVE-2026-46817":{"n":2,"first":1782776577000,"top":[{"n":"0xBlackash/CVE-2026-46817","u":"https://github.com/0xBlackash/CVE-2026-46817","s":1,"c":1782776577000,"d":"CVE-2026-46817"},{"n":"HORKimhab/CVE-2026-46817","u":"https://github.com/HORKimhab/CVE-2026-46817","s":0,"c":1782806459000,"d":"CVE-2026-46817 - Draft"}]},"CVE-2026-56164":{"n":2,"first":1784105580000,"top":[{"n":"sentinel-aidefense/CVE-2026-56164-EXP","u":"https://github.com/sentinel-aidefense/CVE-2026-56164-EXP","s":12,"c":1784105580000,"d":"CVE-2026-56164 EOP Exploit"},{"n":"sam00/POC-CVE-2026-56164-exploit","u":"https://github.com/sam00/POC-CVE-2026-56164-exploit","s":2,"c":1786023007000,"d":"CVE-2026-56164 is a critical missing-authentication vulnerability affecting on-premises Microsoft SharePoint Server. It allows unauthenticat"}]},"CVE-2026-15409":{"n":6,"first":1784082650000,"top":[{"n":"remmons-r7/rapid7-CVE-2026-15409","u":"https://github.com/remmons-r7/rapid7-CVE-2026-15409","s":28,"c":1784129831000,"d":"This repo contains a proof-of-concept exploit for CVE-2026-15409. It establishes non-root remote code execution on SonicWall SMA 1000 by imp"},{"n":"tc4dy/CVE-2026-15409-15410-Framework","u":"https://github.com/tc4dy/CVE-2026-15409-15410-Framework","s":6,"c":1784309402000,"d":"CVE-2026-15409/15410 SonicWall SMA1000 multi-exploit Framework - SSRF→Erlang RPC→RCE→root privesc. Features: --detect safe check, --exec, --"},{"n":"0xBlackash/CVE-2026-15409","u":"https://github.com/0xBlackash/CVE-2026-15409","s":3,"c":1784134313000,"d":"CVE-2026-15409"},{"n":"Ch4120N/CVE-2026-15409","u":"https://github.com/Ch4120N/CVE-2026-15409","s":3,"c":1785769144000,"d":"Proof-of-Concept exploit for CVE-2026-15409 (SonicWall SMA 1000 RCE) via Erlang distribution over WebSocket. Achieves unauthenticated remote"},{"n":"HORKimhab/CVE-2026-15409","u":"https://github.com/HORKimhab/CVE-2026-15409","s":0,"c":1784082650000,"d":"CVE-2026-15409 - Dectect"}]},"CVE-2026-15410":{"n":1,"first":1784082707000,"top":[{"n":"HORKimhab/CVE-2026-15410","u":"https://github.com/HORKimhab/CVE-2026-15410","s":0,"c":1784082707000,"d":"CVE-2026-15410 - More: https://github.com/HORKimhab/poc-cve-collection"}]},"CVE-2026-56291":{"n":5,"first":1783767054000,"top":[{"n":"shinthink/CVE-2026-56291","u":"https://github.com/shinthink/CVE-2026-56291","s":2,"c":1783767054000,"d":"Balbooa Forms (com_baforms) < 2.4.1 — Unauthenticated File Upload to RCE via form.uploadAttachmentFile | CVSS 9.8 | CISA KEV"},{"n":"0xdenis77/CVE-2026-56291","u":"https://github.com/0xdenis77/CVE-2026-56291","s":1,"c":1783972206000,"d":"Mendeteksi versi (passive detection) & Exploitation CVE POC"},{"n":"rimbadirgantara/CVE-2026-56291.yaml","u":"https://github.com/rimbadirgantara/CVE-2026-56291.yaml","s":0,"c":1783954200000,"d":"nuclei template for CVE-2026-56291"},{"n":"ChiefYoru/CVE-2026-56291_PoC","u":"https://github.com/ChiefYoru/CVE-2026-56291_PoC","s":0,"c":1784412724000,"d":"The Joomla extension Balbooa Forms is vulnerable to an unauthenticated arbitrary file upload that allows uploading executable files and lead"},{"n":"theendofabbys/CVE-2026-56291","u":"https://github.com/theendofabbys/CVE-2026-56291","s":0,"c":1791430292000,"d":""}]},"CVE-2026-48939":{"n":3,"first":1782731378000,"top":[{"n":"shinthink/CVE-2026-48939","u":"https://github.com/shinthink/CVE-2026-48939","s":2,"c":1783285008000,"d":"Pre-auth arbitrary file upload RCE exploit for iCagenda Joomla extension < 4.0.8 (CVSS 10.0)"},{"n":"Polosss/By-Poloss..-..CVE-2026-48939","u":"https://github.com/Polosss/By-Poloss..-..CVE-2026-48939","s":1,"c":1782731378000,"d":"iCagenda Unauthenticated File Upload to RCE"},{"n":"ChiefYoru/CVE-2026-48939_PoC","u":"https://github.com/ChiefYoru/CVE-2026-48939_PoC","s":0,"c":1784412148000,"d":"iCagenda extension for Joomla allows the upload of arbitrary files in the file attachment feature, ultimately resulting in PHP code upload a"}]},"CVE-2026-48908":{"n":12,"first":1782120687000,"top":[{"n":"papageo75/CVE-2026-48908-PoC","u":"https://github.com/papageo75/CVE-2026-48908-PoC","s":18,"c":1782120687000,"d":"Unauthenticated RCE PoC for CVE-2026-48908 — SP Page Builder for Joomla (≤ 6.6.1): arbitrary file upload via asset.uploadCustomIcon. Self-cl"},{"n":"Jenderal92/CVE-2026-48908","u":"https://github.com/Jenderal92/CVE-2026-48908","s":3,"c":1783387874000,"d":"CVE-2026-48908 — PoC exploit for unauthenticated RCE in SP Page Builder (Joomla) via arbitrary file upload. Multi‑threaded, case‑bypass, she"},{"n":"0xBlackash/CVE-2026-48908","u":"https://github.com/0xBlackash/CVE-2026-48908","s":2,"c":1782344005000,"d":"CVE-2026-48908"},{"n":"imXur/CVE-2026-48908-Joomla-SP-Page-Builder-RCE","u":"https://github.com/imXur/CVE-2026-48908-Joomla-SP-Page-Builder-RCE","s":2,"c":1784984120000,"d":"Technical analysis and advisory for CVE-2026-48908: Unauthenticated Arbitrary File Upload to RCE in JoomShaper SP Page Builder."},{"n":"yora1928/CVE-2026-48908-by-yora","u":"https://github.com/yora1928/CVE-2026-48908-by-yora","s":2,"c":1786551133000,"d":"Passive security checker for CVE-2026-48908 affecting SP Page Builder."}]},"CVE-2026-55255":{"n":1,"first":1782830962000,"top":[{"n":"rootdirective-sec/CVE-2026-55255-Lab","u":"https://github.com/rootdirective-sec/CVE-2026-55255-Lab","s":0,"c":1782830962000,"d":""}]},"CVE-2026-56290":{"n":5,"first":1783039956000,"top":[{"n":"Jenderal92/CVE-2026-56290","u":"https://github.com/Jenderal92/CVE-2026-56290","s":5,"c":1783485025000,"d":"CVE-2026-56290 - Mass Exploit for Joomla Com_pagebuilderck component (Unrestricted File Upload → RCE). Multi-threaded, automatic CSRF bypass"},{"n":"shinthink/pbck-exploit","u":"https://github.com/shinthink/pbck-exploit","s":3,"c":1783123291000,"d":"📤 Mass exploitation framework for CVE-2026-56290 — Page Builder CK Joomla unauthenticated file upload to RCE"},{"n":"sagsooz/PageBuilderCK-CVE-2026-56290-Exploit","u":"https://github.com/sagsooz/PageBuilderCK-CVE-2026-56290-Exploit","s":2,"c":1783039956000,"d":"Page Builder CK for Joomla - Unauthenticated SSRF / Remote File Write leading to PHP execution Exploiter"},{"n":"ChiefYoru/CVE-2026-56290_PoC","u":"https://github.com/ChiefYoru/CVE-2026-56290_PoC","s":0,"c":1784448446000,"d":"The Joomla extension Page Builder CK is vulnerable to an unauthenticated arbitrary file upload that allows uploading executable files and le"},{"n":"katranSefa/CVE-2026-56290","u":"https://github.com/katranSefa/CVE-2026-56290","s":0,"c":1788604527000,"d":""}]},"CVE-2026-48282":{"n":3,"first":1783342657000,"top":[{"n":"imbas007/CVE-2026-48282","u":"https://github.com/imbas007/CVE-2026-48282","s":24,"c":1783342657000,"d":""},{"n":"g0thamRabb1t/CVE-2026-48282-coldfusion-rds-detection","u":"https://github.com/g0thamRabb1t/CVE-2026-48282-coldfusion-rds-detection","s":0,"c":1783463037000,"d":"Laboratory validation of CVE-2026-48282 in Adobe ColdFusion RDS, covering arbitrary CFM file write, code execution as the ColdFusion service"},{"n":"arpit-bansal15/cve-2026-48282-pentest-lab","u":"https://github.com/arpit-bansal15/cve-2026-48282-pentest-lab","s":0,"c":1784103962000,"d":""}]},"CVE-2026-45659":{"n":1,"first":1779845103000,"top":[{"n":"HORKimhab/CVE-2026-45659","u":"https://github.com/HORKimhab/CVE-2026-45659","s":1,"c":1779845103000,"d":"CVE-2026-45659"}]},"CVE-2026-48558":{"n":1,"first":1783008710000,"top":[{"n":"J4ck3LSyN-Gen2/CVE-2026-48558","u":"https://github.com/J4ck3LSyN-Gen2/CVE-2026-48558","s":7,"c":1783008710000,"d":"SimpleHelp OIDC Authentication Bypass PoC"}]},"CVE-2026-20230":{"n":3,"first":1780622273000,"top":[{"n":"HORKimhab/CVE-2026-20230","u":"https://github.com/HORKimhab/CVE-2026-20230","s":1,"c":1780622273000,"d":"CVE-2026-20230 - Cisco Unified CM"},{"n":"W5M1n9/Cisco-Unified-Communications-Manager-Server-Side-Forgery-Request-Vulnerability-CVE-2026-20230","u":"https://github.com/W5M1n9/Cisco-Unified-Communications-Manager-Server-Side-Forgery-Request-Vulnerability-CVE-2026-20230","s":1,"c":1782381386000,"d":""},{"n":"HalilDeniz/CVE-2026-20230-Scanner","u":"https://github.com/HalilDeniz/CVE-2026-20230-Scanner","s":0,"c":1781293649000,"d":"Cisco Unified Communications Manager (Unified CM) deployments affected by CVE-2026-20230."}]},"CVE-2025-67038":{"n":1,"first":1782367578000,"top":[{"n":"HORKimhab/CVE-2025-67038","u":"https://github.com/HORKimhab/CVE-2025-67038","s":0,"c":1782367578000,"d":"CVE-2025-67038 - Draft"}]},"CVE-2026-34910":{"n":2,"first":1786294680000,"top":[{"n":"Boreas37/CVE-2026-34910-PoC","u":"https://github.com/Boreas37/CVE-2026-34910-PoC","s":14,"c":1786294680000,"d":"CVE-2026-34910/34909 — UniFi OS unauth RCE + file read via ..%2f auth bypass (CVSS 10.0, KEV, Mirai ITW)"},{"n":"gagaltotal/CVE-2026-34910-unifi-poc","u":"https://github.com/gagaltotal/CVE-2026-34910-unifi-poc","s":0,"c":1787397753000,"d":"CVE-2026-34910 - CVE-2026-34909 Unifi OS"}]},"CVE-2026-34908":{"n":1,"first":1780691318000,"top":[{"n":"BishopFox/CVE-2026-34908-check","u":"https://github.com/BishopFox/CVE-2026-34908-check","s":65,"c":1780691318000,"d":"Safely detect whether a UniFi OS Server is vulnerable to CVE-2026-34908"}]},"CVE-2026-20253":{"n":7,"first":1781258672000,"top":[{"n":"watchtowrlabs/watchTowr-vs-Splunk-CVE-2026-20253","u":"https://github.com/watchtowrlabs/watchTowr-vs-Splunk-CVE-2026-20253","s":13,"c":1781258672000,"d":""},{"n":"0xBlackash/CVE-2026-20253","u":"https://github.com/0xBlackash/CVE-2026-20253","s":5,"c":1781374172000,"d":"CVE-2026-20253"},{"n":"HORKimhab/CVE-2026-20253","u":"https://github.com/HORKimhab/CVE-2026-20253","s":0,"c":1781410698000,"d":"CVE-2026-20253 - Splunk Enterprise"},{"n":"fevar54/CVE-2026-20253-Splunk-Enterprise-Pre-Auth-RCE-","u":"https://github.com/fevar54/CVE-2026-20253-Splunk-Enterprise-Pre-Auth-RCE-","s":0,"c":1782497611000,"d":"PoC de CVE-2026-20253: RCE pre-autenticacion en Splunk Enterprise."},{"n":"pssec-io/CVE-2026-20253","u":"https://github.com/pssec-io/CVE-2026-20253","s":0,"c":1782719635000,"d":"POC for CVE-2026-20253"}]},"CVE-2026-48907":{"n":21,"first":1781183656000,"top":[{"n":"gh1mau/masta-cve-2026-48907","u":"https://github.com/gh1mau/masta-cve-2026-48907","s":64,"c":1782535689000,"d":"cve-2026-48907 scanner"},{"n":"ywh-jfellus/CVE-2026-48907","u":"https://github.com/ywh-jfellus/CVE-2026-48907","s":16,"c":1781183656000,"d":"PoC for CVE-2026-48907 - Joomla! JCE extension < 2.9.99.5 unauthenticated RCE"},{"n":"0xBlackash/CVE-2026-48907","u":"https://github.com/0xBlackash/CVE-2026-48907","s":3,"c":1781256127000,"d":"CVE-2026-48907"},{"n":"0xgh057r3c0n/CVE-2026-48907","u":"https://github.com/0xgh057r3c0n/CVE-2026-48907","s":3,"c":1782153086000,"d":"CVE-2025-48907 - Unauthenticated RCE exploit for Joomla JCE < 2.9.99.5"},{"n":"g0thamRabb1t/CVE-2026-48907-Joomla-JCE-detection","u":"https://github.com/g0thamRabb1t/CVE-2026-48907-Joomla-JCE-detection","s":1,"c":1781820735000,"d":"Defensive lab validation and SOC detection guidance for CVE-2026-48907 in Joomla JCE <= 2.9.99.4, including Apache/Joomla/auditd telemetry, "}]},"CVE-2026-54420":{"n":4,"first":1781590143000,"top":[{"n":"mahfuzreham/litespeed-cpanel-cve-2026-54420-fix","u":"https://github.com/mahfuzreham/litespeed-cpanel-cve-2026-54420-fix","s":3,"c":1781595549000,"d":""},{"n":"HORKimhab/CVE-2026-54420","u":"https://github.com/HORKimhab/CVE-2026-54420","s":1,"c":1781590143000,"d":"CVE-2026-54420"},{"n":"Resellnom/litespeed-cpanel-cve-2026-54420-fix","u":"https://github.com/Resellnom/litespeed-cpanel-cve-2026-54420-fix","s":0,"c":1781594060000,"d":""},{"n":"fevar54/CVE-2026-54420-LiteSpeed-Symlink-Exploit","u":"https://github.com/fevar54/CVE-2026-54420-LiteSpeed-Symlink-Exploit","s":0,"c":1781795935000,"d":"PoC de CVE-2026-54420: explotacion via symlink en el plugin LiteSpeed de cPanel/WHM."}]},"CVE-2026-20262":{"n":2,"first":1781591051000,"top":[{"n":"fevar54/CVE-2026-20262-Cisco-Catalyst-SD-WAN-Manager-Arbitrary-File-Write-","u":"https://github.com/fevar54/CVE-2026-20262-Cisco-Catalyst-SD-WAN-Manager-Arbitrary-File-Write-","s":1,"c":1781714193000,"d":"PoC de CVE-2026-20262: escritura arbitraria de archivos por path traversal en Cisco Catalyst SD-WAN Manager (autenticado)."},{"n":"HORKimhab/CVE-2026-20262","u":"https://github.com/HORKimhab/CVE-2026-20262","s":0,"c":1781591051000,"d":"CVE-2026-20262 - Draft"}]},"CVE-2026-10520":{"n":8,"first":1781042107000,"top":[{"n":"watchtowrlabs/watchTowr-vs-Ivanti-Sentry-RCE-CVE-2026-10520-CVE-2026-10523","u":"https://github.com/watchtowrlabs/watchTowr-vs-Ivanti-Sentry-RCE-CVE-2026-10520-CVE-2026-10523","s":14,"c":1781042107000,"d":""},{"n":"0xBlackash/CVE-2026-10520","u":"https://github.com/0xBlackash/CVE-2026-10520","s":4,"c":1781173596000,"d":"CVE-2026-10520"},{"n":"HORKimhab/CVE-2026-10520-10523","u":"https://github.com/HORKimhab/CVE-2026-10520-10523","s":0,"c":1781145577000,"d":"CVE-2026-10520 and CVE-2026-10523"},{"n":"error-inside/CVE-2026-10520","u":"https://github.com/error-inside/CVE-2026-10520","s":0,"c":1781814055000,"d":"Root-Level RCE via OS Command Injection in Ivanti Sentry"},{"n":"emilliewatson96/spryCVE-2026-10520","u":"https://github.com/emilliewatson96/spryCVE-2026-10520","s":0,"c":1782919719000,"d":""}]},"CVE-2026-11645":{"n":3,"first":1781103776000,"top":[{"n":"fevar54/CVE-2026-11645-Out-of-bounds-Read-Write","u":"https://github.com/fevar54/CVE-2026-11645-Out-of-bounds-Read-Write","s":3,"c":1781103776000,"d":"PoC de CVE-2026-11645: lectura/escritura fuera de limites en Chrome V8 (CVSS 8.8)."},{"n":"0xBlackash/CVE-2026-11645","u":"https://github.com/0xBlackash/CVE-2026-11645","s":1,"c":1781191067000,"d":"CVE-2026-11645"},{"n":"adamshaikhma/CVE-2026-11645","u":"https://github.com/adamshaikhma/CVE-2026-11645","s":0,"c":1781132807000,"d":""}]},"CVE-2026-7473":{"n":1,"first":1781108470000,"top":[{"n":"fevar54/CVE-2026-7473---Arista-EOS-Tunnel-Decapsulation-Bypass","u":"https://github.com/fevar54/CVE-2026-7473---Arista-EOS-Tunnel-Decapsulation-Bypass","s":1,"c":1781108470000,"d":"PoC de CVE-2026-7473: bypass de decapsulacion de tunel en Arista EOS."}]},"CVE-2026-20245":{"n":3,"first":1780719976000,"top":[{"n":"0xBlackash/CVE-2026-20245","u":"https://github.com/0xBlackash/CVE-2026-20245","s":4,"c":1781432616000,"d":"CVE-2026-20245"},{"n":"HORKimhab/CVE-2026-20245","u":"https://github.com/HORKimhab/CVE-2026-20245","s":0,"c":1780719976000,"d":"CVE-2026-20245 - Cisco SD-WAN - Draft"},{"n":"fevar54/CVE-2026-20245---Cisco-SD-WAN-Privilege-Escalation-Exploit","u":"https://github.com/fevar54/CVE-2026-20245---Cisco-SD-WAN-Privilege-Escalation-Exploit","s":0,"c":1781106172000,"d":"PoC de CVE-2026-20245: escalada de privilegios en Cisco SD-WAN. Solo fines educativos y pruebas autorizadas."}]},"CVE-2026-42271":{"n":2,"first":1779239577000,"top":[{"n":"learner202649/CVE-2026-42271-PoC","u":"https://github.com/learner202649/CVE-2026-42271-PoC","s":1,"c":1779239577000,"d":"The code for personally reproducing the corresponding vulnerability"},{"n":"HORKimhab/CVE-2026-42271","u":"https://github.com/HORKimhab/CVE-2026-42271","s":0,"c":1780992792000,"d":"CVE-2026-42271 - Draft"}]},"CVE-2026-50751":{"n":8,"first":1780925198000,"top":[{"n":"watchtowrlabs/watchTowr-vs-Check-Point-CVE-2026-50751","u":"https://github.com/watchtowrlabs/watchTowr-vs-Check-Point-CVE-2026-50751","s":6,"c":1781125844000,"d":""},{"n":"0xBlackash/CVE-2026-50751","u":"https://github.com/0xBlackash/CVE-2026-50751","s":2,"c":1780929304000,"d":"CVE-2026-50751"},{"n":"WadesWeaponShed/CVE-2026-50751-Mitigation-Scripts","u":"https://github.com/WadesWeaponShed/CVE-2026-50751-Mitigation-Scripts","s":1,"c":1780925198000,"d":"Mitigation scripts for CVE-2026-50751"},{"n":"fevar54/CVE-2026-50751---Check-Point-IKEv1-Authentication-Bypass-Exploit","u":"https://github.com/fevar54/CVE-2026-50751---Check-Point-IKEv1-Authentication-Bypass-Exploit","s":1,"c":1781100982000,"d":"PoC de CVE-2026-50751: bypass de autenticacion IKEv1 en Check Point Remote/Mobile Access."},{"n":"WadesWeaponShed/CheckPoint-CVE-Webscanner","u":"https://github.com/WadesWeaponShed/CheckPoint-CVE-Webscanner","s":1,"c":1781819156000,"d":"A web version of the bash scripts wrote for Check Point CVE-2026-50751 and CVE-2026-50752.  This uses a local server to scan and make change"}]},"CVE-2026-28318":{"n":2,"first":1781074967000,"top":[{"n":"EaEa0001/servu-cve-2026-28318-poc","u":"https://github.com/EaEa0001/servu-cve-2026-28318-poc","s":1,"c":1781074967000,"d":"SolarWinds Serv-U CVE-2026-28318: unauthenticated Content-Encoding: deflate crash. Root-cause analysis (invalid free of an interior pointer "},{"n":"BishopFox/CVE-2026-28318-check","u":"https://github.com/BishopFox/CVE-2026-28318-check","s":1,"c":1781294997000,"d":"Safely detect whether a SolarWinds Serv-U host is vulnerable to CVE-2026-28318"}]},"CVE-2026-45247":{"n":2,"first":1780579376000,"top":[{"n":"HORKimhab/CVE-2026-45247","u":"https://github.com/HORKimhab/CVE-2026-45247","s":0,"c":1780579376000,"d":"CVE-2026-45247 - Draft"},{"n":"fevar54/PoC-Funcional---CVE-2026-45247-Mirasvit-Full-Page-Cache-Warmer-RCE-","u":"https://github.com/fevar54/PoC-Funcional---CVE-2026-45247-Mirasvit-Full-Page-Cache-Warmer-RCE-","s":0,"c":1781041173000,"d":"PoC funcional de CVE-2026-45247: PHP Object Injection a RCE no autenticado en Mirasvit Full Page Cache (Magento 2)."}]},"CVE-2022-0492":{"n":8,"first":1646011526000,"top":[{"n":"PaloAltoNetworks/can-ctr-escape-cve-2022-0492","u":"https://github.com/PaloAltoNetworks/can-ctr-escape-cve-2022-0492","s":47,"c":1646011526000,"d":"Test whether a container environment is vulnerable to container escapes via CVE-2022-0492"},{"n":"chenaotian/CVE-2022-0492","u":"https://github.com/chenaotian/CVE-2022-0492","s":35,"c":1646985766000,"d":"CVE-2022-0492 EXP and Analysis write up"},{"n":"SofianeHamlaoui/CVE-2022-0492-Checker","u":"https://github.com/SofianeHamlaoui/CVE-2022-0492-Checker","s":13,"c":1646564229000,"d":"A script to check if a container environment is vulnerable to container escapes via CVE-2022-0492"},{"n":"T1erno/CVE-2022-0492-Docker-Breakout-Checker-and-PoC","u":"https://github.com/T1erno/CVE-2022-0492-Docker-Breakout-Checker-and-PoC","s":8,"c":1676695705000,"d":"Docker Breakout Checker and PoC via CAP_SYS_ADMIN and via user namespaces (CVE-2022-0492)"},{"n":"KianaBin/CVE-2022-0492-Container-Escape","u":"https://github.com/KianaBin/CVE-2022-0492-Container-Escape","s":2,"c":1661572944000,"d":"CVE-2022-0492-Container-Escape"}]},"CVE-2025-48595":{"n":3,"first":1780446651000,"top":[{"n":"HORKimhab/CVE-2025-48595","u":"https://github.com/HORKimhab/CVE-2025-48595","s":1,"c":1780446651000,"d":"CVE-2025-48595 - Draft"},{"n":"fevar54/CVE-2025-48595-Android-Framework-Integer-Overflow-","u":"https://github.com/fevar54/CVE-2025-48595-Android-Framework-Integer-Overflow-","s":1,"c":1781036275000,"d":"PoC de CVE-2025-48595: desbordamiento de entero en multiples ubicaciones del Framework de Android."},{"n":"XiaoBaiLovesStirring/CVE-2025-48595-Exploit","u":"https://github.com/XiaoBaiLovesStirring/CVE-2025-48595-Exploit","s":0,"c":1787561359000,"d":"CVE-2025-48595 Android Framework Integer Overflow PoC - 优化版"}]},"CVE-2024-21182":{"n":4,"first":1735487283000,"top":[{"n":"dinosn/CVE-2024-21182","u":"https://github.com/dinosn/CVE-2024-21182","s":3,"c":1780409472000,"d":"Reproducible Docker lab for CVE-2024-21182 — Oracle WebLogic T3/IIOP OpaqueReference JNDI injection → unauthenticated RCE (CVE-2023-21839 pa"},{"n":"kursadalsan/CVE-2024-21182","u":"https://github.com/kursadalsan/CVE-2024-21182","s":2,"c":1735497922000,"d":"PoC for CVE-2024-21182"},{"n":"k4it0k1d/CVE-2024-21182","u":"https://github.com/k4it0k1d/CVE-2024-21182","s":1,"c":1735487283000,"d":"PoC for CVE-2024-21182"},{"n":"fevar54/CVE-2024-21182---Oracle-WebLogic-Server-JNDI-Injection-RCE","u":"https://github.com/fevar54/CVE-2024-21182---Oracle-WebLogic-Server-JNDI-Injection-RCE","s":0,"c":1781038481000,"d":"PoC de CVE-2024-21182: RCE por inyeccion JNDI en Oracle WebLogic Server."}]},"CVE-2026-0257":{"n":7,"first":1780055215000,"top":[{"n":"sfewer-r7/CVE-2026-0257","u":"https://github.com/sfewer-r7/CVE-2026-0257","s":30,"c":1780055215000,"d":"Proof-of-concept script to leverage the PAN-OS GlobalProtect authentication bypass CVE-2026-0257"},{"n":"0xBlackash/CVE-2026-0257","u":"https://github.com/0xBlackash/CVE-2026-0257","s":3,"c":1780131869000,"d":"CVE-2026-0257"},{"n":"tushargurav28/CVE-2026-0257","u":"https://github.com/tushargurav28/CVE-2026-0257","s":3,"c":1780473276000,"d":"Palo Alto Networks PAN-OS contains an authentication bypass caused by flaws in the GlobalProtect portal and gateway, letting attackers estab"},{"n":"akashsingh0454/CVE-2026-0257-PoC","u":"https://github.com/akashsingh0454/CVE-2026-0257-PoC","s":2,"c":1780086464000,"d":""},{"n":"grayxploit/CVE-2026-0257","u":"https://github.com/grayxploit/CVE-2026-0257","s":2,"c":1781076870000,"d":"GrayXploit Security research and defensive team validate this toolkit for CVE-2026-0257 (PAN-OS GlobalProtect Authentication Bypass). Includ"}]},"CVE-2026-45321":{"n":12,"first":1778577090000,"top":[{"n":"Intrudify/mini-shai-hulud-scanner","u":"https://github.com/Intrudify/mini-shai-hulud-scanner","s":2,"c":1778670770000,"d":"Scanner for the Mini Shai-Hulud npm/PyPI supply chain worm (NHS CC-4781 · CVE-2026-45321). Detects gh-token-monitor persistence, payload art"},{"n":"fabriziosalmi/tanstack-compromise-checker","u":"https://github.com/fabriziosalmi/tanstack-compromise-checker","s":2,"c":1778918500000,"d":"Shell script to detect TanStack npm supply chain attack indicators (CVE-2026-45321 / GHSA-g7cv-rxg3-hmpx)"},{"n":"qi-scape/scan-shai-hulud","u":"https://github.com/qi-scape/scan-shai-hulud","s":1,"c":1778617098000,"d":"Detect CVE-2026-45321 Mini Shai-Hulud supply chain compromise — scans for 170 npm + 2 PyPI poisoned packages across TanStack, Mistral AI, Ui"},{"n":"shayr1/shai-hulud-scan","u":"https://github.com/shayr1/shai-hulud-scan","s":1,"c":1778630099000,"d":"Claude Code skill to scan machines for Mini Shai-Hulud (CVE-2026-45321) supply chain worm IOCs"},{"n":"nkopylov/tanscript-exploit-check","u":"https://github.com/nkopylov/tanscript-exploit-check","s":1,"c":1779095807000,"d":"IOC checker for the TanStack/Mini Shai-Hulud npm supply chain attack (CVE-2026-45321)"}]},"CVE-2026-48172":{"n":3,"first":1779523237000,"top":[{"n":"HORKimhab/CVE-2026-48172","u":"https://github.com/HORKimhab/CVE-2026-48172","s":2,"c":1779523237000,"d":"CVE-2026-48172"},{"n":"retmakarunia/CVE-2026-48172","u":"https://github.com/retmakarunia/CVE-2026-48172","s":0,"c":1779570630000,"d":"cPanel user run arbitrary scripts as root"},{"n":"fevar54/CVE-2026-48172---LiteSpeed-cPanel-Plugin-Version-Auditor","u":"https://github.com/fevar54/CVE-2026-48172---LiteSpeed-cPanel-Plugin-Version-Auditor","s":0,"c":1779986853000,"d":"Auditor de version para CVE-2026-48172: verifica localmente si el plugin LiteSpeed de cPanel es vulnerable, sin explotar."}]},"CVE-2026-9082":{"n":12,"first":1779336222000,"top":[{"n":"7h30th3r0n3/CVE-2026-9082-Drupal-PoC","u":"https://github.com/7h30th3r0n3/CVE-2026-9082-Drupal-PoC","s":24,"c":1779360150000,"d":"Drupal Core PostgreSQL SQL Injection PoC - CVE-2026-9082. Ethical PoC for the Drupal vulnerability allowing anonymous SQL injection through "},{"n":"ambionics/cve-2026-9082-drupal-postgresql-rce","u":"https://github.com/ambionics/cve-2026-9082-drupal-postgresql-rce","s":11,"c":1779815360000,"d":""},{"n":"N45HT/drupal-cve-2026-9082-checker","u":"https://github.com/N45HT/drupal-cve-2026-9082-checker","s":8,"c":1779588004000,"d":"Drupal CVE-2026-9082 Blind SQL Injection Checker"},{"n":"HORKimhab/CVE-2026-9082","u":"https://github.com/HORKimhab/CVE-2026-9082","s":2,"c":1779336222000,"d":"CVE-2026-9082 | SA-CORE-2026-004"},{"n":"ridhinva/drupal-jsonapi-sqli-scanner","u":"https://github.com/ridhinva/drupal-jsonapi-sqli-scanner","s":2,"c":1779479346000,"d":"Scanner: CVE-2026-9082 Drupal PostgreSQL SQLi via JSON:API — Python scanner for unauthenticated SQLi leading to RCE (CISA KEV)"}]},"CVE-2025-34291":{"n":2,"first":1779107163000,"top":[{"n":"amnnrth/CVE-2025-34291_cors_security_scanner","u":"https://github.com/amnnrth/CVE-2025-34291_cors_security_scanner","s":0,"c":1779107163000,"d":"A lightweight Python-based security assessment tool for detecting dangerous Cross-Origin Resource Sharing (CORS) misconfigurations - CVE-202"},{"n":"ridhinva/langflow-cors-scanner","u":"https://github.com/ridhinva/langflow-cors-scanner","s":0,"c":1779482668000,"d":"Scanner: CVE-2025-34291 Langflow Origin Validation Error / CORS Misconfiguration — Python checker (CISA KEV)"}]},"CVE-2026-34926":{"n":1,"first":1779443884000,"top":[{"n":"HORKimhab/CVE-2026-34926","u":"https://github.com/HORKimhab/CVE-2026-34926","s":0,"c":1779443884000,"d":"CVE-2026-34926"}]},"CVE-2008-4250":{"n":4,"first":1539855526000,"top":[{"n":"BinRacer/ms08-067.py","u":"https://github.com/BinRacer/ms08-067.py","s":3,"c":1757138430000,"d":"This repository contains some python scripts implementation for the MS08-067 Windows Server Service vulnerability (CVE-2008-4250). This is a"},{"n":"thunderstrike9090/Conflicker_analysis_scripts","u":"https://github.com/thunderstrike9090/Conflicker_analysis_scripts","s":1,"c":1539855526000,"d":"Scripts to analyze conflicker worm which exploits famous netapi vulnerability (CVE-2008-4250) i.e MS08-067"},{"n":"NoTrustedx/Exploit_MS08-067","u":"https://github.com/NoTrustedx/Exploit_MS08-067","s":1,"c":1748897723000,"d":"MS08-067 | CVE-2008-4250"},{"n":"BinRacer/ms08-067","u":"https://github.com/BinRacer/ms08-067","s":0,"c":1757138875000,"d":"This repository contains a Metasploit module implementation for the MS08-067 Windows Server Service vulnerability (CVE-2008-4250). This is a"}]},"CVE-2017-0144":{"n":25,"first":1500234244000,"top":[{"n":"peterpt/eternal_scanner","u":"https://github.com/peterpt/eternal_scanner","s":339,"c":1500234244000,"d":"An internet scanner for exploit CVE-2017-0144 (Eternal Blue) & CVE-2017-0145 (Eternal Romance)"},{"n":"EEsshq/CVE-2017-0144---EtneralBlue-MS17-010-Remote-Code-Execution","u":"https://github.com/EEsshq/CVE-2017-0144---EtneralBlue-MS17-010-Remote-Code-Execution","s":18,"c":1616405631000,"d":""},{"n":"AdityaBhatt3010/VAPT-Report-on-SMB-Exploitation-in-Windows-10-Finance-Endpoint","u":"https://github.com/AdityaBhatt3010/VAPT-Report-on-SMB-Exploitation-in-Windows-10-Finance-Endpoint","s":15,"c":1752155161000,"d":"This report outlines a structured VAPT engagement focusing on PCI DSS compliance, SMB service enumeration, and exploitation of CVE-2017-0144"},{"n":"AtithKhawas/autoblue","u":"https://github.com/AtithKhawas/autoblue","s":5,"c":1735565309000,"d":"AutoBlue - Automated EternalBlue (CVE-2017-0144 / MS17-010) exploitation tool leveraging Nmap and Metasploit for ethical hacking, penetratio"},{"n":"0xBlackash/CVE-2017-0144","u":"https://github.com/0xBlackash/CVE-2017-0144","s":3,"c":1781449215000,"d":"CVE-2017-0144"}]},"CVE-2019-0708":{"n":122,"first":1557867650000,"top":[{"n":"Ekultek/BlueKeep","u":"https://github.com/Ekultek/BlueKeep","s":1186,"c":1559148834000,"d":"Proof of concept for CVE-2019-0708"},{"n":"robertdavidgraham/rdpscan","u":"https://github.com/robertdavidgraham/rdpscan","s":923,"c":1558651812000,"d":"A quick scanner for the CVE-2019-0708 \"BlueKeep\" vulnerability."},{"n":"n1xbyte/CVE-2019-0708","u":"https://github.com/n1xbyte/CVE-2019-0708","s":495,"c":1558421839000,"d":"dump"},{"n":"k8gege/CVE-2019-0708","u":"https://github.com/k8gege/CVE-2019-0708","s":389,"c":1557932498000,"d":"3389远程桌面代码执行漏洞CVE-2019-0708批量检测工具(Rdpscan Bluekeep Check)"},{"n":"algo7/bluekeep_CVE-2019-0708_poc_to_exploit","u":"https://github.com/algo7/bluekeep_CVE-2019-0708_poc_to_exploit","s":342,"c":1559261052000,"d":"An Attempt to Port BlueKeep PoC from @Ekultek to actual exploits"}]},"CVE-2020-1472":{"n":75,"first":1597235756000,"top":[{"n":"bvcyber/CVE-2020-1472","u":"https://github.com/bvcyber/CVE-2020-1472","s":1841,"c":1599555517000,"d":"Test tool for CVE-2020-1472"},{"n":"dirkjanm/CVE-2020-1472","u":"https://github.com/dirkjanm/CVE-2020-1472","s":1331,"c":1600102611000,"d":"PoC for Zerologon - all research credits go to Tom Tervoort of Secura"},{"n":"risksense/zerologon","u":"https://github.com/risksense/zerologon","s":709,"c":1600111147000,"d":"Exploit for zerologon cve-2020-1472"},{"n":"VoidSec/CVE-2020-1472","u":"https://github.com/VoidSec/CVE-2020-1472","s":399,"c":1600102669000,"d":"Exploit Code for CVE-2020-1472 aka Zerologon"},{"n":"bb00/zer0dump","u":"https://github.com/bb00/zer0dump","s":179,"c":1600111634000,"d":"Abuse CVE-2020-1472 (Zerologon) to take over a domain and then repair the local stored machine account password."}]},"CVE-2021-34527":{"n":29,"first":1625141536000,"top":[{"n":"byt3bl33d3r/ItWasAllADream","u":"https://github.com/byt3bl33d3r/ItWasAllADream","s":803,"c":1625516029000,"d":"A PrintNightmare (CVE-2021-34527) Python Scanner. Scan entire subnets for hosts vulnerable to the PrintNightmare RCE"},{"n":"JohnHammond/CVE-2021-34527","u":"https://github.com/JohnHammond/CVE-2021-34527","s":325,"c":1625227849000,"d":""},{"n":"nemo-wq/PrintNightmare-CVE-2021-34527","u":"https://github.com/nemo-wq/PrintNightmare-CVE-2021-34527","s":177,"c":1625325312000,"d":"PrintNightmare - Windows Print Spooler RCE/LPE Vulnerability (CVE-2021-34527, CVE-2021-1675) proof of concept exploits"},{"n":"m8sec/CVE-2021-34527","u":"https://github.com/m8sec/CVE-2021-34527","s":119,"c":1661286045000,"d":"PrintNightmare (CVE-2021-34527) PoC Exploit"},{"n":"hackerhouse-opensource/cve-2021-34527","u":"https://github.com/hackerhouse-opensource/cve-2021-34527","s":23,"c":1662421724000,"d":"CVE-2021-34527 AddPrinterDriverEx() Privilege Escalation"}]},"CVE-2021-1675":{"n":50,"first":1624976670000,"top":[{"n":"cube0x0/CVE-2021-1675","u":"https://github.com/cube0x0/CVE-2021-1675","s":2005,"c":1624987454000,"d":"C# and Impacket implementation of PrintNightmare CVE-2021-1675/CVE-2021-34527"},{"n":"calebstewart/CVE-2021-1675","u":"https://github.com/calebstewart/CVE-2021-1675","s":1110,"c":1625183158000,"d":"Pure PowerShell implementation of CVE-2021-1675 Print Spooler Local Privilege Escalation (PrintNightmare)"},{"n":"hlldz/CVE-2021-1675-LPE","u":"https://github.com/hlldz/CVE-2021-1675-LPE","s":326,"c":1625132833000,"d":"Local Privilege Escalation Edition for CVE-2021-1675/CVE-2021-34527"},{"n":"LaresLLC/CVE-2021-1675","u":"https://github.com/LaresLLC/CVE-2021-1675","s":215,"c":1625077937000,"d":"CVE-2021-1675 Detection Info"},{"n":"ly4k/PrintNightmare","u":"https://github.com/ly4k/PrintNightmare","s":215,"c":1632664390000,"d":"Python implementation for PrintNightmare (CVE-2021-1675 / CVE-2021-34527)"}]},"CVE-2021-36934":{"n":24,"first":1626819409000,"top":[{"n":"HuskyHacks/ShadowSteal","u":"https://github.com/HuskyHacks/ShadowSteal","s":208,"c":1626819409000,"d":"Pure Nim implementation for exploiting CVE-2021-36934, the SeriousSAM local privilege escalation"},{"n":"WiredPulse/Invoke-HiveNightmare","u":"https://github.com/WiredPulse/Invoke-HiveNightmare","s":35,"c":1626923276000,"d":"PoC for CVE-2021-36934, which enables a standard user to be able to retrieve the SAM, Security, and Software Registry hives in Windows 10 ve"},{"n":"JoranSlingerland/CVE-2021-36934","u":"https://github.com/JoranSlingerland/CVE-2021-36934","s":9,"c":1626872811000,"d":"Fix for the CVE-2021-36934"},{"n":"romarroca/SeriousSam","u":"https://github.com/romarroca/SeriousSam","s":9,"c":1626940169000,"d":"HiveNightmare a.k.a. SeriousSam Local Privilege Escalation in Windows – CVE-2021-36934"},{"n":"Wh04m1001/VSSCopy","u":"https://github.com/Wh04m1001/VSSCopy","s":8,"c":1626915323000,"d":"Small and dirty PoC for CVE-2021-36934"}]},"CVE-2021-42278":{"n":6,"first":1639235430000,"top":[{"n":"safebuffer/sam-the-admin","u":"https://github.com/safebuffer/sam-the-admin","s":1070,"c":1639235430000,"d":"Exploiting CVE-2021-42278 and CVE-2021-42287 to impersonate DA from standard domain user "},{"n":"Ridter/noPac","u":"https://github.com/Ridter/noPac","s":1023,"c":1639391292000,"d":"Exploiting CVE-2021-42278 and CVE-2021-42287 to impersonate DA from standard domain user "},{"n":"ly4k/Pachine","u":"https://github.com/ly4k/Pachine","s":278,"c":1639437305000,"d":"Python implementation for CVE-2021-42278 (Active Directory Privilege Escalation)"},{"n":"waterrr/noPac","u":"https://github.com/waterrr/noPac","s":6,"c":1639409099000,"d":"Exploiting CVE-2021-42278 and CVE-2021-42287"},{"n":"cybersecurityworks553/noPac-detection","u":"https://github.com/cybersecurityworks553/noPac-detection","s":2,"c":1640610645000,"d":"Detection script for CVE-2021-42278 and CVE-2021-42287"}]},"CVE-2021-42287":{"n":7,"first":1639250850000,"top":[{"n":"cube0x0/noPac","u":"https://github.com/cube0x0/noPac","s":1415,"c":1639250850000,"d":"CVE-2021-42287/CVE-2021-42278 Scanner & Exploiter."},{"n":"knightswd/NoPacScan","u":"https://github.com/knightswd/NoPacScan","s":87,"c":1641556795000,"d":"NoPacScan is a CVE-2021-42287/CVE-2021-42278 Scanner,it scan for more domain controllers than  other script"},{"n":"ricardojba/Invoke-noPac","u":"https://github.com/ricardojba/Invoke-noPac","s":62,"c":1639422078000,"d":".Net Assembly loader for the [CVE-2021-42287 - CVE-2021-42278] Scanner & Exploit noPac"},{"n":"XiaoliChan/Invoke-sAMSpoofing","u":"https://github.com/XiaoliChan/Invoke-sAMSpoofing","s":39,"c":1648804214000,"d":"CVE-2021-42287/CVE-2021-42278 exploits in powershell"},{"n":"TryA9ain/noPac","u":"https://github.com/TryA9ain/noPac","s":15,"c":1671691147000,"d":"CVE-2021-42287/CVE-2021-42278 Exploiter"}]},"CVE-2022-26923":{"n":9,"first":1652322710000,"top":[{"n":"evilashz/PIGADVulnScanner","u":"https://github.com/evilashz/PIGADVulnScanner","s":81,"c":1697524184000,"d":"检测域内常见一把梭漏洞，包括：NoPac、ZeroLogon、CVE-2022-26923、PrintNightMare"},{"n":"LudovicPatho/CVE-2022-26923_AD-Certificate-Services","u":"https://github.com/LudovicPatho/CVE-2022-26923_AD-Certificate-Services","s":41,"c":1652520426000,"d":"The vulnerability allowed a low-privileged user to escalate privileges to domain administrator in a default Active Directory environment wit"},{"n":"lsecqt/CVE-2022-26923-Powershell-POC","u":"https://github.com/lsecqt/CVE-2022-26923-Powershell-POC","s":17,"c":1660770829000,"d":"A powershell poc to load and automatically run Certify and Rubeus from memory."},{"n":"r1skkam/TryHackMe-CVE-2022-26923","u":"https://github.com/r1skkam/TryHackMe-CVE-2022-26923","s":6,"c":1652322710000,"d":"Walkthrough on the exploitation of CVE-2022-26923, a vulnerability in AD Certificate Services"},{"n":"Gh-Badr/CVE-2022-26923","u":"https://github.com/Gh-Badr/CVE-2022-26923","s":2,"c":1701188016000,"d":"A proof of concept exploiting CVE-2022-26923."}]},"CVE-2020-0796":{"n":86,"first":1574182299000,"top":[{"n":"danigargu/CVE-2020-0796","u":"https://github.com/danigargu/CVE-2020-0796","s":1360,"c":1585568576000,"d":"CVE-2020-0796 - Windows SMBv3 LPE exploit #SMBGhost"},{"n":"ly4k/SMBGhost","u":"https://github.com/ly4k/SMBGhost","s":724,"c":1583940087000,"d":"Scanner for CVE-2020-0796 - SMBv3 RCE"},{"n":"jamf/CVE-2020-0796-RCE-POC","u":"https://github.com/jamf/CVE-2020-0796-RCE-POC","s":571,"c":1587393348000,"d":"CVE-2020-0796 Remote Code Execution POC"},{"n":"Barriuso/SMBGhost_AutomateExploitation","u":"https://github.com/Barriuso/SMBGhost_AutomateExploitation","s":360,"c":1591807479000,"d":"SMBGhost (CVE-2020-0796) Automate Exploitation and Detection"},{"n":"eerykitty/CVE-2020-0796-PoC","u":"https://github.com/eerykitty/CVE-2020-0796-PoC","s":332,"c":1584038080000,"d":"PoC for triggering buffer overflow via CVE-2020-0796"}]},"CVE-2020-1350":{"n":15,"first":1583949089000,"top":[{"n":"ZephrFish/CVE-2020-1350_HoneyPoC","u":"https://github.com/ZephrFish/CVE-2020-1350_HoneyPoC","s":280,"c":1594753345000,"d":"HoneyPoC: Proof-of-Concept (PoC) script to exploit SIGRed (CVE-2020-1350). Achieves Domain Admin on Domain Controllers running Windows Serve"},{"n":"maxpl0it/CVE-2020-1350-DoS","u":"https://github.com/maxpl0it/CVE-2020-1350-DoS","s":238,"c":1594854000000,"d":"A denial-of-service proof-of-concept for CVE-2020-1350"},{"n":"psc4re/NSE-scripts","u":"https://github.com/psc4re/NSE-scripts","s":162,"c":1583949089000,"d":"NSE scripts to detect CVE-2020-1350 SIGRED and CVE-2020-0796 SMBGHOST, CVE-2021-21972, proxyshell, CVE-2021-34473"},{"n":"captainGeech42/CVE-2020-1350","u":"https://github.com/captainGeech42/CVE-2020-1350","s":18,"c":1594918008000,"d":"Denial of Service PoC for CVE-2020-1350 (SIGRed)"},{"n":"T13nn3s/CVE-2020-1350","u":"https://github.com/T13nn3s/CVE-2020-1350","s":15,"c":1594791991000,"d":"This Powershell Script is checking if your server is vulnerable for the CVE-2020-1350 Remote Code Execution flaw in the Windows DNS Service"}]},"CVE-2020-0601":{"n":35,"first":1579045998000,"top":[{"n":"ly4k/CurveBall","u":"https://github.com/ly4k/CurveBall","s":890,"c":1579129661000,"d":"PoC for CVE-2020-0601- Windows CryptoAPI (Crypt32.dll)"},{"n":"kudelskisecurity/chainoffools","u":"https://github.com/kudelskisecurity/chainoffools","s":336,"c":1579130132000,"d":"A PoC for CVE-2020-0601"},{"n":"gentilkiwi/curveball","u":"https://github.com/gentilkiwi/curveball","s":78,"c":1579537460000,"d":"CVE-2020-0601 #curveball - Alternative Key Calculator"},{"n":"saleemrashid/badecparams","u":"https://github.com/saleemrashid/badecparams","s":66,"c":1579218277000,"d":"Proof of Concept for CVE-2020-0601"},{"n":"0xxon/cve-2020-0601","u":"https://github.com/0xxon/cve-2020-0601","s":35,"c":1579046489000,"d":"Zeek package to detect CVE-2020-0601"}]},"CVE-2016-5195":{"n":63,"first":1477029965000,"top":[{"n":"timwr/CVE-2016-5195","u":"https://github.com/timwr/CVE-2016-5195","s":1016,"c":1477048761000,"d":"CVE-2016-5195 (dirtycow/dirtyc0w) proof of concept for Android"},{"n":"firefart/dirtycow","u":"https://github.com/firefart/dirtycow","s":933,"c":1480108081000,"d":"Dirty Cow exploit - CVE-2016-5195"},{"n":"scumjr/dirtycow-vdso","u":"https://github.com/scumjr/dirtycow-vdso","s":511,"c":1477149934000,"d":"PoC for Dirty COW (CVE-2016-5195)"},{"n":"gbonacini/CVE-2016-5195","u":"https://github.com/gbonacini/CVE-2016-5195","s":342,"c":1477181793000,"d":"A CVE-2016-5195 exploit example."},{"n":"r1is/CVE-2022-0847","u":"https://github.com/r1is/CVE-2022-0847","s":282,"c":1646678210000,"d":"CVE-2022-0847-DirtyPipe-Exploit   CVE-2022-0847 是存在于 Linux内核 5.8 及之后版本中的本地提权漏洞。攻击者通过利用此漏洞，可覆盖重写任意可读文件中的数据，从而可将普通权限的用户提升到特权 root。    CVE-2022"}]},"CVE-2022-0847":{"n":109,"first":1646668218000,"top":[{"n":"Arinerron/CVE-2022-0847-DirtyPipe-Exploit","u":"https://github.com/Arinerron/CVE-2022-0847-DirtyPipe-Exploit","s":1135,"c":1646679320000,"d":"A root exploit for CVE-2022-0847 (Dirty Pipe)"},{"n":"AlexisAhmed/CVE-2022-0847-DirtyPipe-Exploits","u":"https://github.com/AlexisAhmed/CVE-2022-0847-DirtyPipe-Exploits","s":738,"c":1647118644000,"d":"A collection of exploits and documentation that can be used to exploit the Linux Dirty Pipe vulnerability."},{"n":"r1is/CVE-2022-0847","u":"https://github.com/r1is/CVE-2022-0847","s":282,"c":1646678210000,"d":"CVE-2022-0847-DirtyPipe-Exploit   CVE-2022-0847 是存在于 Linux内核 5.8 及之后版本中的本地提权漏洞。攻击者通过利用此漏洞，可覆盖重写任意可读文件中的数据，从而可将普通权限的用户提升到特权 root。    CVE-2022"},{"n":"Al1ex/CVE-2022-0847","u":"https://github.com/Al1ex/CVE-2022-0847","s":90,"c":1646794028000,"d":"CVE-2022-0847"},{"n":"DataDog/dirtypipe-container-breakout-poc","u":"https://github.com/DataDog/dirtypipe-container-breakout-poc","s":77,"c":1646854724000,"d":"Container Excape PoC for CVE-2022-0847 \"DirtyPipe\""}]},"CVE-2021-4034":{"n":183,"first":1643152290000,"top":[{"n":"berdav/CVE-2021-4034","u":"https://github.com/berdav/CVE-2021-4034","s":2046,"c":1643154697000,"d":"CVE-2021-4034 1day"},{"n":"ly4k/PwnKit","u":"https://github.com/ly4k/PwnKit","s":1332,"c":1643207170000,"d":"Self-contained exploit for CVE-2021-4034 - Pkexec Local Privilege Escalation"},{"n":"arthepsy/CVE-2021-4034","u":"https://github.com/arthepsy/CVE-2021-4034","s":1169,"c":1643158596000,"d":"PoC for PwnKit: Local Privilege Escalation Vulnerability in polkit’s pkexec (CVE-2021-4034)"},{"n":"PwnFunction/CVE-2021-4034","u":"https://github.com/PwnFunction/CVE-2021-4034","s":353,"c":1643294637000,"d":"Proof of concept for pwnkit vulnerability"},{"n":"joeammond/CVE-2021-4034","u":"https://github.com/joeammond/CVE-2021-4034","s":180,"c":1643219596000,"d":"Python exploit code for CVE-2021-4034 (pwnkit)"}]},"CVE-2021-3156":{"n":88,"first":1611690784000,"top":[{"n":"blasty/CVE-2021-3156","u":"https://github.com/blasty/CVE-2021-3156","s":1026,"c":1612039198000,"d":""},{"n":"worawit/CVE-2021-3156","u":"https://github.com/worawit/CVE-2021-3156","s":810,"c":1615829822000,"d":"Sudo Baron Samedit Exploit"},{"n":"stong/CVE-2021-3156","u":"https://github.com/stong/CVE-2021-3156","s":430,"c":1611976924000,"d":"PoC for CVE-2021-3156 (sudo heap overflow)"},{"n":"LiveOverflow/pwnedit","u":"https://github.com/LiveOverflow/pwnedit","s":227,"c":1619677766000,"d":"CVE-2021-3156 - Sudo Baron Samedit"},{"n":"Rvn0xsy/CVE-2021-3156-plus","u":"https://github.com/Rvn0xsy/CVE-2021-3156-plus","s":204,"c":1612898718000,"d":"CVE-2021-3156非交互式执行命令"}]},"CVE-2023-4911":{"n":21,"first":1696420738000,"top":[{"n":"leesh3288/CVE-2023-4911","u":"https://github.com/leesh3288/CVE-2023-4911","s":393,"c":1696428736000,"d":"PoC for CVE-2023-4911"},{"n":"RickdeJager/CVE-2023-4911","u":"https://github.com/RickdeJager/CVE-2023-4911","s":167,"c":1696429969000,"d":"CVE-2023-4911 proof of concept"},{"n":"chaudharyarjun/LooneyPwner","u":"https://github.com/chaudharyarjun/LooneyPwner","s":43,"c":1697528656000,"d":"Exploit tool for CVE-2023-4911, targeting the 'Looney Tunables' glibc vulnerability in various Linux distributions."},{"n":"hadrian3689/looney-tunables-CVE-2023-4911","u":"https://github.com/hadrian3689/looney-tunables-CVE-2023-4911","s":29,"c":1696975463000,"d":""},{"n":"ruycr4ft/CVE-2023-4911","u":"https://github.com/ruycr4ft/CVE-2023-4911","s":19,"c":1697035762000,"d":"CVE-2023-4911"}]},"CVE-2024-6387":{"n":94,"first":1719830522000,"top":[{"n":"xaitax/CVE-2024-6387_Check","u":"https://github.com/xaitax/CVE-2024-6387_Check","s":527,"c":1719866000000,"d":"CVE-2024-6387_Check is a lightweight, efficient tool designed to identify servers running vulnerable versions of OpenSSH"},{"n":"zgzhang/cve-2024-6387-poc","u":"https://github.com/zgzhang/cve-2024-6387-poc","s":496,"c":1719831329000,"d":"a signal handler race condition in OpenSSH's server (sshd)"},{"n":"acrono/cve-2024-6387-poc","u":"https://github.com/acrono/cve-2024-6387-poc","s":376,"c":1719836181000,"d":"32-bit PoC for CVE-2024-6387 — mirror of the original 7etsuo/cve-2024-6387-poc"},{"n":"Karmakstylez/CVE-2024-6387","u":"https://github.com/Karmakstylez/CVE-2024-6387","s":196,"c":1720438069000,"d":"Remote Unauthenticated Code Execution Vulnerability in OpenSSH server (CVE-2024-6387)"},{"n":"lflare/cve-2024-6387-poc","u":"https://github.com/lflare/cve-2024-6387-poc","s":129,"c":1719836800000,"d":"MIRROR of the original 32-bit PoC for CVE-2024-6387 \"regreSSHion\" by 7etsuo/cve-2024-6387-poc"}]},"CVE-2024-3094":{"n":85,"first":1711731781000,"top":[{"n":"amlweems/xzbot","u":"https://github.com/amlweems/xzbot","s":3550,"c":1711981689000,"d":"notes, honeypot, and exploit demo for the xz backdoor (CVE-2024-3094)"},{"n":"lockness-Ko/xz-vulnerable-honeypot","u":"https://github.com/lockness-Ko/xz-vulnerable-honeypot","s":147,"c":1711836444000,"d":"An ssh honeypot with the XZ backdoor. CVE-2024-3094"},{"n":"FabioBaroni/CVE-2024-3094-checker","u":"https://github.com/FabioBaroni/CVE-2024-3094-checker","s":72,"c":1711744097000,"d":"Quick and dirty PoC for checking whether a vulnerable version of xz-utils is installed (CVE-2024-3094)"},{"n":"robertdfrench/ifuncd-up","u":"https://github.com/robertdfrench/ifuncd-up","s":60,"c":1720204576000,"d":"GNU IFUNC is the real culprit behind CVE-2024-3094"},{"n":"byinarie/CVE-2024-3094-info","u":"https://github.com/byinarie/CVE-2024-3094-info","s":54,"c":1711731781000,"d":"Information for CVE-2024-3094"}]},"CVE-2021-44228":{"n":457,"first":1639063658000,"top":[{"n":"fullhunt/log4j-scan","u":"https://github.com/fullhunt/log4j-scan","s":3428,"c":1639367870000,"d":"A fully automated, accurate, and extensive scanner for finding log4j RCE CVE-2021-44228 "},{"n":"kozmer/log4j-shell-poc","u":"https://github.com/kozmer/log4j-shell-poc","s":1847,"c":1639178368000,"d":"A Proof-Of-Concept for the CVE-2021-44228 vulnerability. "},{"n":"christophetd/log4shell-vulnerable-app","u":"https://github.com/christophetd/log4shell-vulnerable-app","s":1143,"c":1639139900000,"d":"Spring Boot web application vulnerable to Log4Shell (CVE-2021-44228)."},{"n":"Puliczek/CVE-2021-44228-PoC-log4j-bypass-words","u":"https://github.com/Puliczek/CVE-2021-44228-PoC-log4j-bypass-words","s":952,"c":1639175700000,"d":"🐱‍💻 ✂️ 🤬 CVE-2021-44228 - LOG4J Java exploit - WAF bypass tricks"},{"n":"logpresso/CVE-2021-44228-Scanner","u":"https://github.com/logpresso/CVE-2021-44228-Scanner","s":863,"c":1639221526000,"d":"Vulnerability scanner and mitigation patch for Log4j2 CVE-2021-44228"}]},"CVE-2017-5638":{"n":86,"first":1488864630000,"top":[{"n":"mazen160/struts-pwn","u":"https://github.com/mazen160/struts-pwn","s":442,"c":1489284145000,"d":"An exploit for Apache Struts CVE-2017-5638"},{"n":"Flyteas/Struts2-045-Exp","u":"https://github.com/Flyteas/Struts2-045-Exp","s":61,"c":1488882620000,"d":"Struts2 S2-045（CVE-2017-5638）Exp with GUI"},{"n":"immunio/apache-struts2-CVE-2017-5638","u":"https://github.com/immunio/apache-struts2-CVE-2017-5638","s":34,"c":1489181605000,"d":"Demo Application and Exploit"},{"n":"jas502n/S2-045-EXP-POC-TOOLS","u":"https://github.com/jas502n/S2-045-EXP-POC-TOOLS","s":25,"c":1489088447000,"d":"S2-045 漏洞 POC-TOOLS   CVE-2017-5638"},{"n":"PolarisLab/S2-045","u":"https://github.com/PolarisLab/S2-045","s":23,"c":1488864630000,"d":"Struts2 S2-045（CVE-2017-5638）Vulnerability environment - http://www.mottoin.com/97954.html"}]},"CVE-2022-22965":{"n":99,"first":1648626885000,"top":[{"n":"BobTheShoplifter/Spring4Shell-POC","u":"https://github.com/BobTheShoplifter/Spring4Shell-POC","s":378,"c":1648626885000,"d":"Spring4Shell Proof Of Concept/And vulnerable application CVE-2022-22965"},{"n":"reznok/Spring4Shell-POC","u":"https://github.com/reznok/Spring4Shell-POC","s":326,"c":1648686268000,"d":"Dockerized Spring4Shell (CVE-2022-22965) PoC application and exploit"},{"n":"tpt11fb/SpringVulScan","u":"https://github.com/tpt11fb/SpringVulScan","s":155,"c":1655644615000,"d":"burpsuite 的Spring漏洞扫描插件。SpringVulScan：支持检测：路由泄露|CVE-2022-22965|CVE-2022-22963|CVE-2022-22947|CVE-2016-4977"},{"n":"TheGejr/SpringShell","u":"https://github.com/TheGejr/SpringShell","s":131,"c":1648659946000,"d":"Spring4Shell - Spring Core RCE - CVE-2022-22965"},{"n":"zangcc/CVE-2022-22965-rexbb","u":"https://github.com/zangcc/CVE-2022-22965-rexbb","s":102,"c":1672203016000,"d":"CVE-2022-22965\\Spring-Core-RCE核弹级别漏洞的rce图形化GUI一键利用工具，基于JavaFx开发，图形化操作更简单，提高效率。"}]},"CVE-2020-1938":{"n":40,"first":1582218002000,"top":[{"n":"00theway/Ghostcat-CNVD-2020-10487","u":"https://github.com/00theway/Ghostcat-CNVD-2020-10487","s":423,"c":1582388180000,"d":"Ghostcat read file/code execute,CNVD-2020-10487(CVE-2020-1938) "},{"n":"lizhianyuguangming/TomcatScanPro","u":"https://github.com/lizhianyuguangming/TomcatScanPro","s":296,"c":1724913496000,"d":"tomcat自动化漏洞扫描利用工具，支持批量弱口令检测、后台部署war包getshell、CVE-2017-12615 文件上传、CVE-2020-1938/CNVD-2020-10487 文件包含"},{"n":"bkfish/CNVD-2020-10487-Tomcat-Ajp-lfi-Scanner","u":"https://github.com/bkfish/CNVD-2020-10487-Tomcat-Ajp-lfi-Scanner","s":294,"c":1582232415000,"d":"Cnvd-2020-10487 / cve-2020-1938, scanner tool"},{"n":"tpt11fb/AttackTomcat","u":"https://github.com/tpt11fb/AttackTomcat","s":258,"c":1668337301000,"d":"Tomcat常见漏洞GUI利用工具。CVE-2017-12615 PUT文件上传漏洞、tomcat-pass-getshell 弱认证部署war包、弱口令爆破、CVE-2020-1938 Tomcat AJP文件读取/包含"},{"n":"sv3nbeast/CVE-2020-1938-Tomact-file_include-file_read","u":"https://github.com/sv3nbeast/CVE-2020-1938-Tomact-file_include-file_read","s":57,"c":1582271330000,"d":"Tomcat的文件包含及文件读取漏洞利用POC"}]},"CVE-2022-26134":{"n":72,"first":1653983041000,"top":[{"n":"W01fh4cker/Serein","u":"https://github.com/W01fh4cker/Serein","s":1247,"c":1653983041000,"d":"【懒人神器】一款图形化、批量采集url、批量对采集的url进行各种nday检测的工具。可用于src挖掘、cnvd挖掘、0day利用、打造自己的武器库等场景。可以批量利用Actively Exploited Atlassian Confluence 0Day CVE-2022-26"},{"n":"BeichenDream/CVE-2022-26134-Godzilla-MEMSHELL","u":"https://github.com/BeichenDream/CVE-2022-26134-Godzilla-MEMSHELL","s":338,"c":1654593542000,"d":""},{"n":"jbaines-r7/through_the_wire","u":"https://github.com/jbaines-r7/through_the_wire","s":174,"c":1654264759000,"d":"CVE-2022-26134 Proof of Concept"},{"n":"hev0x/CVE-2022-26134","u":"https://github.com/hev0x/CVE-2022-26134","s":44,"c":1654483386000,"d":"Confluence Pre-Auth Remote Code Execution via OGNL Injection (CVE-2022-26134)"},{"n":"crowsec-edtech/CVE-2022-26134","u":"https://github.com/crowsec-edtech/CVE-2022-26134","s":31,"c":1654284270000,"d":"CVE-2022-26134 - Confluence Pre-Auth RCE | OGNL injection"}]},"CVE-2023-34362":{"n":15,"first":1686065629000,"top":[{"n":"horizon3ai/CVE-2023-34362","u":"https://github.com/horizon3ai/CVE-2023-34362","s":140,"c":1686337652000,"d":"MOVEit CVE-2023-34362"},{"n":"sfewer-r7/CVE-2023-34362","u":"https://github.com/sfewer-r7/CVE-2023-34362","s":64,"c":1686574572000,"d":"CVE-2023-34362: MOVEit Transfer Unauthenticated RCE"},{"n":"Malwareman007/CVE-2023-34362","u":"https://github.com/Malwareman007/CVE-2023-34362","s":10,"c":1688928262000,"d":"POC for CVE-2023-34362 affecting MOVEit Transfer"},{"n":"kenbuckler/MOVEit-CVE-2023-34362","u":"https://github.com/kenbuckler/MOVEit-CVE-2023-34362","s":6,"c":1686875977000,"d":"Repository with everything I have tracking the impact of MOVEit CVE-2023-34362"},{"n":"deepinstinct/MOVEit_CVE-2023-34362_IOCs","u":"https://github.com/deepinstinct/MOVEit_CVE-2023-34362_IOCs","s":2,"c":1686065629000,"d":"CVE-2023-34362-IOCs. More information on Deep Instinct's blog site."}]},"CVE-2024-1709":{"n":5,"first":1708508524000,"top":[{"n":"W01fh4cker/ScreenConnect-AuthBypass-RCE","u":"https://github.com/W01fh4cker/ScreenConnect-AuthBypass-RCE","s":114,"c":1708508524000,"d":"ScreenConnect AuthBypass(cve-2024-1709) --> RCE!!!"},{"n":"HussainFathy/CVE-2024-1709","u":"https://github.com/HussainFathy/CVE-2024-1709","s":3,"c":1708709188000,"d":"A Scanner for CVE-2024-1709 - ConnectWise SecureConnect Authentication Bypass Vulnerability"},{"n":"sxyrxyy/CVE-2024-1709-ConnectWise-ScreenConnect-Authentication-Bypass","u":"https://github.com/sxyrxyy/CVE-2024-1709-ConnectWise-ScreenConnect-Authentication-Bypass","s":1,"c":1711142419000,"d":""},{"n":"cjybao/CVE-2024-1709-and-CVE-2024-1708","u":"https://github.com/cjybao/CVE-2024-1709-and-CVE-2024-1708","s":1,"c":1712033918000,"d":""},{"n":"AhmedMansour93/Event-ID-229-Rule-Name-SOC262-CVE-2024-1709-","u":"https://github.com/AhmedMansour93/Event-ID-229-Rule-Name-SOC262-CVE-2024-1709-","s":0,"c":1726173079000,"d":"Event ID 229 Rule Name SOC262 ScreenConnect Authentication Bypass Exploitation Detected (CVE-2024-1709)"}]},"CVE-2024-1708":{"n":1,"first":1784874953000,"top":[{"n":"razureink/cve-2024-1708-connectwise_rce_reproduction","u":"https://github.com/razureink/cve-2024-1708-connectwise_rce_reproduction","s":0,"c":1784874953000,"d":"Reproduction of cve-2024-1708-connectwise_rce_reproduction"}]},"CVE-2024-23897":{"n":49,"first":1706037544000,"top":[{"n":"h4x0r-dz/CVE-2024-23897","u":"https://github.com/h4x0r-dz/CVE-2024-23897","s":209,"c":1706262272000,"d":"CVE-2024-23897"},{"n":"binganao/CVE-2024-23897","u":"https://github.com/binganao/CVE-2024-23897","s":101,"c":1706256120000,"d":""},{"n":"wjlin0/CVE-2024-23897","u":"https://github.com/wjlin0/CVE-2024-23897","s":87,"c":1706384088000,"d":"CVE-2024-23897 - Jenkins 任意文件读取 利用工具"},{"n":"xaitax/CVE-2024-23897","u":"https://github.com/xaitax/CVE-2024-23897","s":81,"c":1706295603000,"d":"CVE-2024-23897 | Jenkins <= 2.441 & <= LTS 2.426.2 PoC and scanner. "},{"n":"godylockz/CVE-2024-23897","u":"https://github.com/godylockz/CVE-2024-23897","s":46,"c":1708067764000,"d":"Proof of concept for CVE-2024-23897: Jenkins arbitrary file read"}]},"CVE-2021-26855":{"n":51,"first":1614783016000,"top":[{"n":"Flangvik/SharpProxyLogon","u":"https://github.com/Flangvik/SharpProxyLogon","s":247,"c":1617052234000,"d":"C# POC for CVE-2021-26855 aka ProxyLogon, supports the classically semi-interactive web shell as well as shellcode injection "},{"n":"hosch3n/ProxyVulns","u":"https://github.com/hosch3n/ProxyVulns","s":176,"c":1618398750000,"d":"[ProxyLogon] CVE-2021-26855 & CVE-2021-27065 Fixed RawIdentity Bug Exploit. [ProxyOracle] CVE-2021-31195 & CVE-2021-31196 Exploit Chains. [P"},{"n":"dwisiswant0/proxylogscan","u":"https://github.com/dwisiswant0/proxylogscan","s":166,"c":1615204472000,"d":"A fast tool to mass scan for a vulnerability on Microsoft Exchange Server that allows an attacker bypassing the authentication and impersona"},{"n":"p0wershe11/ProxyLogon","u":"https://github.com/p0wershe11/ProxyLogon","s":124,"c":1615953414000,"d":"ProxyLogon(CVE-2021-26855+CVE-2021-27065) Exchange Server RCE(SSRF->GetWebShell)"},{"n":"cert-lv/exchange_webshell_detection","u":"https://github.com/cert-lv/exchange_webshell_detection","s":98,"c":1614932527000,"d":"Detect webshells dropped on Microsoft Exchange servers exploited through \"proxylogon\" group of vulnerabilites (CVE-2021-26855, CVE-2021-2685"}]},"CVE-2021-27065":{"n":1,"first":1615006055000,"top":[{"n":"adamrpostjr/cve-2021-27065","u":"https://github.com/adamrpostjr/cve-2021-27065","s":11,"c":1615006055000,"d":"Quick One Line Powershell scripts to detect for webshells, possible zips, and logs."}]},"CVE-2021-34473":{"n":9,"first":1628607662000,"top":[{"n":"horizon3ai/proxyshell","u":"https://github.com/horizon3ai/proxyshell","s":121,"c":1630769643000,"d":"Proof of Concept for CVE-2021-34473, CVE-2021-34523, and CVE-2021-31207"},{"n":"cyberheartmi9/Proxyshell-Scanner","u":"https://github.com/cyberheartmi9/Proxyshell-Scanner","s":46,"c":1628607662000,"d":"nuclei scanner for proxyshell ( CVE-2021-34473 )"},{"n":"kh4sh3i/ProxyShell","u":"https://github.com/kh4sh3i/ProxyShell","s":43,"c":1656506251000,"d":"CVE-2021-34473 Microsoft Exchange Server Remote Code Execution Vulnerability"},{"n":"p2-98/CVE-2021-34473","u":"https://github.com/p2-98/CVE-2021-34473","s":30,"c":1629113233000,"d":"CVE-2021-34473 Microsoft Exchange Server Remote Code Execution Vulnerability"},{"n":"je6k/CVE-2021-34473-Exchange-ProxyShell","u":"https://github.com/je6k/CVE-2021-34473-Exchange-ProxyShell","s":16,"c":1637567229000,"d":"对Exchange Proxyshell 做了二次修改，精确的拆分、实现辅助性安全测试。"}]},"CVE-2021-34523":{"n":2,"first":1633159764000,"top":[{"n":"mithridates1313/ProxyShell_POC","u":"https://github.com/mithridates1313/ProxyShell_POC","s":16,"c":1633159764000,"d":"POC for scanning ProxyShell(CVE-2021-34523,CVE-2021-34473,CVE-2021-31207)"},{"n":"SUPRAAA-1337/CVE-2021-34523","u":"https://github.com/SUPRAAA-1337/CVE-2021-34523","s":2,"c":1693657578000,"d":"test-yaml"}]},"CVE-2022-41040":{"n":9,"first":1664710017000,"top":[{"n":"kljunowsky/CVE-2022-41040-POC","u":"https://github.com/kljunowsky/CVE-2022-41040-POC","s":90,"c":1665329260000,"d":"CVE-2022-41040 - Server Side Request Forgery (SSRF) in Microsoft Exchange Server"},{"n":"TaroballzChen/CVE-2022-41040-metasploit-ProxyNotShell","u":"https://github.com/TaroballzChen/CVE-2022-41040-metasploit-ProxyNotShell","s":35,"c":1666235463000,"d":"the metasploit script(POC) about CVE-2022-41040. Microsoft Exchange are vulnerable to a server-side request forgery (SSRF) attack. An authen"},{"n":"numanturle/CVE-2022-41040","u":"https://github.com/numanturle/CVE-2022-41040","s":19,"c":1664710017000,"d":"CVE-2022-41040 nuclei template"},{"n":"r3dcl1ff/CVE-2022-41040","u":"https://github.com/r3dcl1ff/CVE-2022-41040","s":5,"c":1664892438000,"d":"mitigation script for MS Exchange server vuln"},{"n":"d3duct1v/CVE-2022-41040","u":"https://github.com/d3duct1v/CVE-2022-41040","s":5,"c":1665019232000,"d":"Code set relating to CVE-2022-41040"}]},"CVE-2022-41082":{"n":9,"first":1664625194000,"top":[{"n":"balki97/OWASSRF-CVE-2022-41082-POC","u":"https://github.com/balki97/OWASSRF-CVE-2022-41082-POC","s":92,"c":1671701726000,"d":"PoC for the CVE-2022-41080 , CVE-2022-41082 and CVE-2022-41076 Vulnerabilities Affecting Microsoft Exchange Servers"},{"n":"Diverto/nse-exchange","u":"https://github.com/Diverto/nse-exchange","s":82,"c":1664625194000,"d":"Nmap scripts to detect exchange 0-day (CVE-2022-41082) vulnerability"},{"n":"notareaperbutDR34P3r/http-vuln-CVE-2022-41082","u":"https://github.com/notareaperbutDR34P3r/http-vuln-CVE-2022-41082","s":3,"c":1668414676000,"d":"Microsoft Exchange Server Remote Code Execution Vulnerability."},{"n":"soltanali0/CVE-2022-41082","u":"https://github.com/soltanali0/CVE-2022-41082","s":3,"c":1729774612000,"d":"CVE-2022-41082-poc"},{"n":"sikkertech/CVE-2022-41082","u":"https://github.com/sikkertech/CVE-2022-41082","s":2,"c":1669927733000,"d":"Exchange CVE '22"}]},"CVE-2023-23397":{"n":29,"first":1678899818000,"top":[{"n":"api0cradle/CVE-2023-23397-POC-Powershell","u":"https://github.com/api0cradle/CVE-2023-23397-POC-Powershell","s":344,"c":1678995819000,"d":""},{"n":"sqrtZeroKnowledge/CVE-2023-23397_EXPLOIT_0DAY","u":"https://github.com/sqrtZeroKnowledge/CVE-2023-23397_EXPLOIT_0DAY","s":158,"c":1678899818000,"d":"Exploit for the CVE-2023-23397"},{"n":"Trackflaw/CVE-2023-23397","u":"https://github.com/Trackflaw/CVE-2023-23397","s":132,"c":1679329914000,"d":"Simple PoC of the CVE-2023-23397 vulnerability with the payload sent by email."},{"n":"ka7ana/CVE-2023-23397","u":"https://github.com/ka7ana/CVE-2023-23397","s":40,"c":1678993837000,"d":"Simple PoC in PowerShell for CVE-2023-23397"},{"n":"tiepologian/CVE-2023-23397","u":"https://github.com/tiepologian/CVE-2023-23397","s":25,"c":1679423880000,"d":"Proof of Concept for CVE-2023-23397 in Python"}]},"CVE-2023-2868":{"n":3,"first":1687286634000,"top":[{"n":"cfielding-r7/poc-cve-2023-2868","u":"https://github.com/cfielding-r7/poc-cve-2023-2868","s":11,"c":1687286634000,"d":""},{"n":"cashapp323232/CVE-2023-2868CVE-2023-2868","u":"https://github.com/cashapp323232/CVE-2023-2868CVE-2023-2868","s":0,"c":1690735347000,"d":""},{"n":"krmxd/CVE-2023-2868","u":"https://github.com/krmxd/CVE-2023-2868","s":0,"c":1692968871000,"d":""}]},"CVE-2019-19781":{"n":44,"first":1578696995000,"top":[{"n":"trustedsec/cve-2019-19781","u":"https://github.com/trustedsec/cve-2019-19781","s":574,"c":1578701307000,"d":"This is a tool published for the Citrix ADC (NetScaler) vulnerability. We are only disclosing this due to others publishing the exploit code"},{"n":"projectzeroindia/CVE-2019-19781","u":"https://github.com/projectzeroindia/CVE-2019-19781","s":369,"c":1578696995000,"d":"Remote Code Execution Exploit for Citrix Application Delivery Controller and Citrix Gateway [ CVE-2019-19781 ]"},{"n":"mpgn/CVE-2019-19781","u":"https://github.com/mpgn/CVE-2019-19781","s":157,"c":1578736157000,"d":"CVE-2019-19781 - Remote Code Execution on Citrix ADC Netscaler exploit"},{"n":"MalwareTech/CitrixHoneypot","u":"https://github.com/MalwareTech/CitrixHoneypot","s":120,"c":1578910171000,"d":"Detect and log CVE-2019-19781 scan and exploitation attempts."},{"n":"cisagov/check-cve-2019-19781","u":"https://github.com/cisagov/check-cve-2019-19781","s":110,"c":1578702376000,"d":"Test a host for susceptibility to CVE-2019-19781"}]},"CVE-2023-4966":{"n":14,"first":1698167972000,"top":[{"n":"Chocapikk/CVE-2023-4966","u":"https://github.com/Chocapikk/CVE-2023-4966","s":78,"c":1698167972000,"d":"Sensitive information disclosure in NetScaler ADC and NetScaler Gateway when configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, R"},{"n":"dinosn/citrix_cve-2023-4966","u":"https://github.com/dinosn/citrix_cve-2023-4966","s":10,"c":1698207317000,"d":"Citrix CVE-2023-4966 from assetnote modified for parallel and file handling"},{"n":"RevoltSecurities/CVE-2023-4966","u":"https://github.com/RevoltSecurities/CVE-2023-4966","s":10,"c":1698593497000,"d":"An Exploitation script developed to exploit the CVE-2023-4966 bleed citrix information disclosure vulnerability"},{"n":"mlynchcogent/CVE-2023-4966-POC","u":"https://github.com/mlynchcogent/CVE-2023-4966-POC","s":8,"c":1698237476000,"d":"Proof Of Concept for te NetScaler Vuln"},{"n":"certat/citrix-logchecker","u":"https://github.com/certat/citrix-logchecker","s":5,"c":1698493482000,"d":"Parse citrix netscaler logs to check for signs of CVE-2023-4966 exploitation"}]},"CVE-2018-13379":{"n":14,"first":1565516677000,"top":[{"n":"milo2012/CVE-2018-13379","u":"https://github.com/milo2012/CVE-2018-13379","s":253,"c":1565516677000,"d":"CVE-2018-13379"},{"n":"Blazz3/cve2018-13379-nmap-script","u":"https://github.com/Blazz3/cve2018-13379-nmap-script","s":12,"c":1571026184000,"d":"CVE-2018-13379 Script for Nmap NSE."},{"n":"Zeop-CyberSec/fortios_vpnssl_traversal_leak","u":"https://github.com/Zeop-CyberSec/fortios_vpnssl_traversal_leak","s":9,"c":1606725545000,"d":"This module massively scan and exploit a path traversal vulnerability in the FortiOS SSL VPN web portal may allow an unauthenticated attacke"},{"n":"B1anda0/CVE-2018-13379","u":"https://github.com/B1anda0/CVE-2018-13379","s":9,"c":1607948223000,"d":"Fortinet FortiOS路径遍历漏洞 （CVE-2018-13379）批量检测脚本"},{"n":"0xHunter/FortiOS-Credentials-Disclosure","u":"https://github.com/0xHunter/FortiOS-Credentials-Disclosure","s":6,"c":1569314986000,"d":"CVE-2018-13379 Exploit"}]},"CVE-2022-40684":{"n":31,"first":1665671052000,"top":[{"n":"horizon3ai/CVE-2022-40684","u":"https://github.com/horizon3ai/CVE-2022-40684","s":358,"c":1665671052000,"d":"A proof of concept exploit for CVE-2022-40684 affecting Fortinet FortiOS, FortiProxy, and FortiSwitchManager"},{"n":"carlosevieira/CVE-2022-40684","u":"https://github.com/carlosevieira/CVE-2022-40684","s":87,"c":1665684839000,"d":"PoC for CVE-2022-40684 - Authentication bypass lead to Full device takeover (Read-only)"},{"n":"arsolutioner/fortigate-belsen-leak","u":"https://github.com/arsolutioner/fortigate-belsen-leak","s":87,"c":1737010455000,"d":"Research repository tracking affected IPs from the Fortigate CVE-2022-40684 configuration leak by Belsen Group"},{"n":"Filiplain/Fortinet-PoC-Auth-Bypass","u":"https://github.com/Filiplain/Fortinet-PoC-Auth-Bypass","s":16,"c":1665690797000,"d":"Bash PoC for Fortinet Auth Bypass - CVE-2022-40684"},{"n":"kljunowsky/CVE-2022-40684-POC","u":"https://github.com/kljunowsky/CVE-2022-40684-POC","s":16,"c":1665695270000,"d":"Exploit for CVE-2022-40684 affecting Fortinet FortiOS, FortiProxy, and FortiSwitchManager"}]},"CVE-2023-46805":{"n":9,"first":1705257011000,"top":[{"n":"duy-31/CVE-2023-46805_CVE-2024-21887","u":"https://github.com/duy-31/CVE-2023-46805_CVE-2024-21887","s":23,"c":1705434059000,"d":"An authentication bypass vulnerability in the web component of Ivanti ICS 9.x, 22.x and Ivanti Policy Secure allows a remote attacker to acc"},{"n":"Chocapikk/CVE-2023-46805","u":"https://github.com/Chocapikk/CVE-2023-46805","s":14,"c":1705630993000,"d":"Ivanti Pulse Secure CVE-2023-46805 Scanner - Based on Assetnote's Research"},{"n":"seajaysec/Ivanti-Connect-Around-Scan","u":"https://github.com/seajaysec/Ivanti-Connect-Around-Scan","s":12,"c":1705630331000,"d":"Mitigation validation utility for the Ivanti Connect Around attack chain. Runs multiple checks. CVE-2023-46805, CVE-2024-21887."},{"n":"yoryio/CVE-2023-46805","u":"https://github.com/yoryio/CVE-2023-46805","s":10,"c":1705257011000,"d":"Scanner for CVE-2023-46805 - Ivanti Connect Secure"},{"n":"Hexastrike/Ivanti-Connect-Secure-Logs-Parser","u":"https://github.com/Hexastrike/Ivanti-Connect-Secure-Logs-Parser","s":6,"c":1737277357000,"d":"A Python script for examining Ivanti Secure Connect (ICS) event logs, designed to support investigations into vulnerabilities CVE-2025-0282,"}]},"CVE-2024-21887":{"n":8,"first":1705224356000,"top":[{"n":"Chocapikk/CVE-2024-21887","u":"https://github.com/Chocapikk/CVE-2024-21887","s":58,"c":1705438778000,"d":"A command injection vulnerability in web components of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) allows an auth"},{"n":"duy-31/CVE-2023-46805_CVE-2024-21887","u":"https://github.com/duy-31/CVE-2023-46805_CVE-2024-21887","s":23,"c":1705434059000,"d":"An authentication bypass vulnerability in the web component of Ivanti ICS 9.x, 22.x and Ivanti Policy Secure allows a remote attacker to acc"},{"n":"seajaysec/Ivanti-Connect-Around-Scan","u":"https://github.com/seajaysec/Ivanti-Connect-Around-Scan","s":12,"c":1705630331000,"d":"Mitigation validation utility for the Ivanti Connect Around attack chain. Runs multiple checks. CVE-2023-46805, CVE-2024-21887."},{"n":"oways/ivanti-CVE-2024-21887","u":"https://github.com/oways/ivanti-CVE-2024-21887","s":7,"c":1705224356000,"d":"POC Checker for ivanti CVE-2024-21887 Command injcetion"},{"n":"Hexastrike/Ivanti-Connect-Secure-Logs-Parser","u":"https://github.com/Hexastrike/Ivanti-Connect-Secure-Logs-Parser","s":6,"c":1737277357000,"d":"A Python script for examining Ivanti Secure Connect (ICS) event logs, designed to support investigations into vulnerabilities CVE-2025-0282,"}]},"CVE-2024-3400":{"n":44,"first":1712985381000,"top":[{"n":"h4x0r-dz/CVE-2024-3400","u":"https://github.com/h4x0r-dz/CVE-2024-3400","s":162,"c":1713277088000,"d":"CVE-2024-3400 Palo Alto OS Command Injection"},{"n":"W01fh4cker/CVE-2024-3400-RCE-Scan","u":"https://github.com/W01fh4cker/CVE-2024-3400-RCE-Scan","s":90,"c":1713284336000,"d":"CVE-2024-3400-RCE"},{"n":"0x0d3ad/CVE-2024-3400","u":"https://github.com/0x0d3ad/CVE-2024-3400","s":71,"c":1713016831000,"d":"CVE-2024-3400"},{"n":"ihebski/CVE-2024-3400","u":"https://github.com/ihebski/CVE-2024-3400","s":34,"c":1713302655000,"d":"CVE-2024-3400 PAN-OS: OS Command Injection Vulnerability in GlobalProtect"},{"n":"Chocapikk/CVE-2024-3400","u":"https://github.com/Chocapikk/CVE-2024-3400","s":15,"c":1713302501000,"d":""}]},"CVE-2020-5902":{"n":55,"first":1593871977000,"top":[{"n":"jas502n/CVE-2020-5902","u":"https://github.com/jas502n/CVE-2020-5902","s":374,"c":1593967112000,"d":"CVE-2020-5902 BIG-IP"},{"n":"yassineaboukir/CVE-2020-5902","u":"https://github.com/yassineaboukir/CVE-2020-5902","s":70,"c":1593968487000,"d":"Proof of concept for CVE-2020-5902"},{"n":"theLSA/f5-bigip-rce-cve-2020-5902","u":"https://github.com/theLSA/f5-bigip-rce-cve-2020-5902","s":62,"c":1594395180000,"d":"F5 BIG-IP RCE CVE-2020-5902 automatic check tool"},{"n":"aqhmal/CVE-2020-5902-Scanner","u":"https://github.com/aqhmal/CVE-2020-5902-Scanner","s":55,"c":1593929949000,"d":"Automated script for F5 BIG-IP scanner (CVE-2020-5902) using hosts retrieved from Shodan API."},{"n":"yasserjanah/CVE-2020-5902","u":"https://github.com/yasserjanah/CVE-2020-5902","s":43,"c":1593997943000,"d":"exploit code for  F5-Big-IP (CVE-2020-5902)"}]},"CVE-2022-1388":{"n":64,"first":1651746935000,"top":[{"n":"horizon3ai/CVE-2022-1388","u":"https://github.com/horizon3ai/CVE-2022-1388","s":230,"c":1652096805000,"d":"POC for CVE-2022-1388"},{"n":"doocop/CVE-2022-1388-EXP","u":"https://github.com/doocop/CVE-2022-1388-EXP","s":92,"c":1651946048000,"d":"CVE-2022-1388 F5 BIG-IP RCE 批量检测"},{"n":"alt3kx/CVE-2022-1388_PoC","u":"https://github.com/alt3kx/CVE-2022-1388_PoC","s":87,"c":1652092478000,"d":"F5 BIG-IP RCE exploitation (CVE-2022-1388)"},{"n":"0xf4n9x/CVE-2022-1388","u":"https://github.com/0xf4n9x/CVE-2022-1388","s":84,"c":1652091751000,"d":"CVE-2022-1388 F5 BIG-IP iControl REST Auth Bypass RCE"},{"n":"ZephrFish/F5-CVE-2022-1388-Exploit","u":"https://github.com/ZephrFish/F5-CVE-2022-1388-Exploit","s":59,"c":1652095809000,"d":"Exploit and Check Script for CVE 2022-1388"}]},"CVE-2023-20198":{"n":35,"first":1697528150000,"top":[{"n":"smokeintheshell/CVE-2023-20198","u":"https://github.com/smokeintheshell/CVE-2023-20198","s":66,"c":1700152778000,"d":"CVE-2023-20198 Exploit PoC"},{"n":"W01fh4cker/CVE-2023-20198-RCE","u":"https://github.com/W01fh4cker/CVE-2023-20198-RCE","s":44,"c":1714028393000,"d":"CVE-2023-20198-RCE, support adding/deleting users and executing cli commands/system commands."},{"n":"fox-it/cisco-ios-xe-implant-detection","u":"https://github.com/fox-it/cisco-ios-xe-implant-detection","s":41,"c":1698072738000,"d":"Cisco IOS XE implant scanning & detection (CVE-2023-20198, CVE-2023-20273)"},{"n":"Shadow0ps/CVE-2023-20198-Scanner","u":"https://github.com/Shadow0ps/CVE-2023-20198-Scanner","s":33,"c":1698089129000,"d":"This is a webshell fingerprinting scanner designed to identify implants on Cisco IOS XE WebUI's affected by CVE-2023-20198 and CVE-2023-2027"},{"n":"ZephrFish/CVE-2023-20198-Checker","u":"https://github.com/ZephrFish/CVE-2023-20198-Checker","s":32,"c":1697582474000,"d":"CVE-2023-20198 & 0Day Implant Scanner"}]},"CVE-2021-21974":{"n":7,"first":1621962878000,"top":[{"n":"Shadow0ps/CVE-2021-21974","u":"https://github.com/Shadow0ps/CVE-2021-21974","s":188,"c":1621962878000,"d":"POC for CVE-2021-21974 VMWare ESXi RCE Exploit"},{"n":"Aiyakami/CVE-2021-21974","u":"https://github.com/Aiyakami/CVE-2021-21974","s":5,"c":1783497121000,"d":"自研针对ESXI 堆栈溢出的CVE-2021-21974 POC，只支持项目给出的的目标和环境，用于学习和研究"},{"n":"n2x4/Feb2023-CVE-2021-21974-OSINT","u":"https://github.com/n2x4/Feb2023-CVE-2021-21974-OSINT","s":2,"c":1675545800000,"d":"Analysis of the ransom demands from Shodan results"},{"n":"CYBERTHREATANALYSIS/ESXi-Ransomware-Scanner-mi","u":"https://github.com/CYBERTHREATANALYSIS/ESXi-Ransomware-Scanner-mi","s":2,"c":1675853197000,"d":"ESXi EZ - A custom scanner that takes list of IPs either in JSON, CSV or individually  and checks for infection CVE-2021-21974"},{"n":"hateme021202/cve-2021-21974","u":"https://github.com/hateme021202/cve-2021-21974","s":0,"c":1697681024000,"d":"Nmap NSE script for cve-2021-21974"}]},"CVE-2021-21972":{"n":27,"first":1583949089000,"top":[{"n":"Schira4396/VcenterKiller","u":"https://github.com/Schira4396/VcenterKiller","s":1484,"c":1664854767000,"d":"一款针对Vcenter的综合利用工具，包含目前最主流的CVE-2021-21972、CVE-2021-21985以及CVE-2021-22005、One Access的CVE-2022-22954、CVE-2022-22972/31656以及log4j，提供一键上传webshel"},{"n":"NS-Sp4ce/CVE-2021-21972","u":"https://github.com/NS-Sp4ce/CVE-2021-21972","s":498,"c":1614165298000,"d":"CVE-2021-21972 Exploit"},{"n":"horizon3ai/CVE-2021-21972","u":"https://github.com/horizon3ai/CVE-2021-21972","s":270,"c":1614184294000,"d":"Proof of Concept Exploit for vCenter CVE-2021-21972"},{"n":"psc4re/NSE-scripts","u":"https://github.com/psc4re/NSE-scripts","s":162,"c":1583949089000,"d":"NSE scripts to detect CVE-2020-1350 SIGRED and CVE-2020-0796 SMBGHOST, CVE-2021-21972, proxyshell, CVE-2021-34473"},{"n":"QmF0c3UK/CVE-2021-21972-vCenter-6.5-7.0-RCE-POC","u":"https://github.com/QmF0c3UK/CVE-2021-21972-vCenter-6.5-7.0-RCE-POC","s":136,"c":1614160581000,"d":""}]},"CVE-2017-11882":{"n":35,"first":1511103461000,"top":[{"n":"Ridter/CVE-2017-11882","u":"https://github.com/Ridter/CVE-2017-11882","s":535,"c":1511243753000,"d":"CVE-2017-11882 from https://github.com/embedi/CVE-2017-11882"},{"n":"embedi/CVE-2017-11882","u":"https://github.com/embedi/CVE-2017-11882","s":495,"c":1511195730000,"d":"Proof-of-Concept exploits for CVE-2017-11882"},{"n":"rip1s/CVE-2017-11882","u":"https://github.com/rip1s/CVE-2017-11882","s":330,"c":1511277761000,"d":"CVE-2017-11882 Exploit accepts over 17k bytes long command/code in maximum."},{"n":"rxwx/CVE-2018-0802","u":"https://github.com/rxwx/CVE-2018-0802","s":270,"c":1515663826000,"d":"PoC Exploit for CVE-2018-0802 (and optionally CVE-2017-11882)"},{"n":"Ridter/RTF_11882_0802","u":"https://github.com/Ridter/RTF_11882_0802","s":166,"c":1515757113000,"d":"PoC for CVE-2018-0802 And CVE-2017-11882"}]},"CVE-2022-30190":{"n":94,"first":1653934658000,"top":[{"n":"komomon/CVE-2022-30190-follina-Office-MSDT-Fixed","u":"https://github.com/komomon/CVE-2022-30190-follina-Office-MSDT-Fixed","s":390,"c":1654173198000,"d":"CVE-2022-30190-follina.py-修改版，可以自定义word模板，方便实战中钓鱼使用。"},{"n":"JMousqueton/PoC-CVE-2022-30190","u":"https://github.com/JMousqueton/PoC-CVE-2022-30190","s":158,"c":1653934658000,"d":"POC CVE-2022-30190 : CVE 0-day MS Offic RCE aka msdt follina"},{"n":"onecloudemoji/CVE-2022-30190","u":"https://github.com/onecloudemoji/CVE-2022-30190","s":104,"c":1653979525000,"d":"CVE-2022-30190  Follina POC"},{"n":"doocop/CVE-2022-30190","u":"https://github.com/doocop/CVE-2022-30190","s":60,"c":1653999318000,"d":"Microsoft Office Word Rce 复现(CVE-2022-30190)"},{"n":"Malwareman007/Deathnote","u":"https://github.com/Malwareman007/Deathnote","s":38,"c":1654685903000,"d":"Proof of Concept of CVE-2022-30190"}]},"CVE-2023-38831":{"n":60,"first":1692892987000,"top":[{"n":"b1tg/CVE-2023-38831-winrar-exploit","u":"https://github.com/b1tg/CVE-2023-38831-winrar-exploit","s":783,"c":1692956648000,"d":"CVE-2023-38831 winrar exploit generator"},{"n":"Garck3h/cve-2023-38831","u":"https://github.com/Garck3h/cve-2023-38831","s":126,"c":1693145316000,"d":"一款用于生成winrar程序RCE（即cve-2023-38831）的POC的工具。"},{"n":"ignis-sec/CVE-2023-38831-RaRCE","u":"https://github.com/ignis-sec/CVE-2023-38831-RaRCE","s":113,"c":1693172977000,"d":"An easy to install and easy to run tool for generating exploit payloads for CVE-2023-38831, WinRAR RCE before versions 6.23"},{"n":"BoredHackerBlog/winrar_CVE-2023-38831_lazy_poc","u":"https://github.com/BoredHackerBlog/winrar_CVE-2023-38831_lazy_poc","s":91,"c":1692892987000,"d":"lazy way to create CVE-2023-38831 winrar file for testing"},{"n":"HDCE-inc/CVE-2023-38831","u":"https://github.com/HDCE-inc/CVE-2023-38831","s":89,"c":1693198570000,"d":"CVE-2023-38831 PoC (Proof Of Concept)"}]},"CVE-2021-30860":{"n":2,"first":1632003257000,"top":[{"n":"jeffssh/CVE-2021-30860","u":"https://github.com/jeffssh/CVE-2021-30860","s":102,"c":1640401201000,"d":"Collection of materials relating to FORCEDENTRY"},{"n":"Levilutz/CVE-2021-30860","u":"https://github.com/Levilutz/CVE-2021-30860","s":13,"c":1632003257000,"d":"Scan for evidence of CVE-2021-30860 (FORCEDENTRY) exploit"}]},"CVE-2023-4863":{"n":14,"first":1695273771000,"top":[{"n":"mistymntncop/CVE-2023-4863","u":"https://github.com/mistymntncop/CVE-2023-4863","s":319,"c":1695273771000,"d":""},{"n":"LiveOverflow/webp-CVE-2023-4863","u":"https://github.com/LiveOverflow/webp-CVE-2023-4863","s":56,"c":1702941145000,"d":""},{"n":"caoweiquan322/NotEnough","u":"https://github.com/caoweiquan322/NotEnough","s":25,"c":1702949565000,"d":"This tool calculates tricky canonical huffman histogram for CVE-2023-4863."},{"n":"murphysecurity/libwebp-checker","u":"https://github.com/murphysecurity/libwebp-checker","s":21,"c":1696476503000,"d":"A tool for finding vulnerable libwebp(CVE-2023-4863)"},{"n":"bbaranoff/CVE-2023-4863","u":"https://github.com/bbaranoff/CVE-2023-4863","s":6,"c":1695637989000,"d":""}]},"CVE-2023-41064":{"n":3,"first":1698685404000,"top":[{"n":"MrR0b0t19/CVE-2023-41064","u":"https://github.com/MrR0b0t19/CVE-2023-41064","s":3,"c":1699895222000,"d":""},{"n":"MrR0b0t19/vulnerabilidad-LibWebP-CVE-2023-41064","u":"https://github.com/MrR0b0t19/vulnerabilidad-LibWebP-CVE-2023-41064","s":0,"c":1698685404000,"d":"longitudes de código para desencadenar esta vulnerabilidad"},{"n":"K4Der11000/k4_cve-2023-41064","u":"https://github.com/K4Der11000/k4_cve-2023-41064","s":0,"c":1745591772000,"d":""}]},"CVE-2017-5754":{"n":6,"first":1515040346000,"top":[{"n":"ionescu007/SpecuCheck","u":"https://github.com/ionescu007/SpecuCheck","s":586,"c":1515040346000,"d":"SpecuCheck is a Windows utility for checking the state of the software mitigations and hardware against  CVE-2017-5754 (Meltdown), CVE-2017-"},{"n":"raphaelsc/Am-I-affected-by-Meltdown","u":"https://github.com/raphaelsc/Am-I-affected-by-Meltdown","s":539,"c":1515109872000,"d":"Meltdown Exploit / Proof-of-concept / checks whether system is affected by Variant 3: rogue data cache load (CVE-2017-5754), a.k.a MELTDOWN."},{"n":"Viralmaniar/In-Spectre-Meltdown","u":"https://github.com/Viralmaniar/In-Spectre-Meltdown","s":96,"c":1515145384000,"d":"This tool allows to check speculative execution side-channel attacks that affect many modern processors and operating systems designs. CVE-2"},{"n":"speecyy/Am-I-affected-by-Meltdown","u":"https://github.com/speecyy/Am-I-affected-by-Meltdown","s":1,"c":1515208593000,"d":"Proof-of-concept / Exploit / checks whether system is affected by Variant 3: rogue data cache load (CVE-2017-5754), a.k.a "},{"n":"jdmulloy/meltdown-aws-scanner","u":"https://github.com/jdmulloy/meltdown-aws-scanner","s":1,"c":1517001493000,"d":"Naive shell script to verify Meltdown (CVE-2017-5754) patch status of EC2 instances"}]},"CVE-2017-5753":{"n":7,"first":1515025730000,"top":[{"n":"Eugnis/spectre-attack","u":"https://github.com/Eugnis/spectre-attack","s":772,"c":1515025730000,"d":"Example of using revealed \"Spectre\" exploit (CVE-2017-5753 and CVE-2017-5715)"},{"n":"00052/spectre-attack-example","u":"https://github.com/00052/spectre-attack-example","s":12,"c":1515131494000,"d":"2018年1月2日 (CVE-2017-5753 和 CVE-2017-5715) \"幽灵\" Spectre 漏洞利用"},{"n":"ixtal23/spectreScope","u":"https://github.com/ixtal23/spectreScope","s":7,"c":1515263223000,"d":"The demo of the speculative execution attack Spectre (CVE-2017-5753, CVE-2017-5715)."},{"n":"EdwardOwusuAdjei/Spectre-PoC","u":"https://github.com/EdwardOwusuAdjei/Spectre-PoC","s":4,"c":1515075613000,"d":"Spectre  (CVE-2017-5753) (CVE-2017-5715). Not By Me. Collected from Book."},{"n":"pedrolucasoliva/spectre-attack-demo","u":"https://github.com/pedrolucasoliva/spectre-attack-demo","s":1,"c":1515200895000,"d":"Example of using revealed \"Spectre\" exploit (CVE-2017-5753 and CVE-2017-5715)"}]},"CVE-2017-5715":{"n":5,"first":1515474372000,"top":[{"n":"opsxcq/exploit-cve-2017-5715","u":"https://github.com/opsxcq/exploit-cve-2017-5715","s":54,"c":1515474372000,"d":"Spectre exploit"},{"n":"mathse/meltdown-spectre-bios-list","u":"https://github.com/mathse/meltdown-spectre-bios-list","s":17,"c":1515930758000,"d":"a list of BIOS/Firmware fixes adressing CVE-2017-5715, CVE-2017-5753, CVE-2017-5754"},{"n":"GregAskew/SpeculativeExecutionAssessment","u":"https://github.com/GregAskew/SpeculativeExecutionAssessment","s":0,"c":1516043670000,"d":"Assesses a system for the \"speculative execution\" vulnerabilities described in CVE-2017-5715, CVE-2017-5753, CVE-2017-5754"},{"n":"GalloLuigi/Analisi-CVE-2017-5715","u":"https://github.com/GalloLuigi/Analisi-CVE-2017-5715","s":0,"c":1715012140000,"d":""},{"n":"iamshivambhatt/Hardware-Vulnerability-with-Proof-of-Concept-","u":"https://github.com/iamshivambhatt/Hardware-Vulnerability-with-Proof-of-Concept-","s":0,"c":1783221741000,"d":"Research and hands-on PoC of Spectre Variant 2 (CVE-2017-5715), a hardware side-channel vulnerability exploiting CPU speculative execution a"}]},"CVE-2025-53770":{"n":45,"first":1753072870000,"top":[{"n":"soltanali0/CVE-2025-53770-Exploit","u":"https://github.com/soltanali0/CVE-2025-53770-Exploit","s":316,"c":1753105717000,"d":"SharePoint WebPart Injection Exploit Tool"},{"n":"MuhammadWaseem29/CVE-2025-53770","u":"https://github.com/MuhammadWaseem29/CVE-2025-53770","s":57,"c":1753212023000,"d":"Unauthenticated Remote Code Execution via unsafe deserialization in Microsoft SharePoint Server (CVE-2025-53770)"},{"n":"hazcod/CVE-2025-53770","u":"https://github.com/hazcod/CVE-2025-53770","s":45,"c":1753107590000,"d":"Scanner for the SharePoint CVE-2025-53770 RCE zero day vulnerability."},{"n":"kaizensecurity/CVE-2025-53770","u":"https://github.com/kaizensecurity/CVE-2025-53770","s":43,"c":1753079961000,"d":"POC"},{"n":"ZephrFish/CVE-2025-53770-Scanner","u":"https://github.com/ZephrFish/CVE-2025-53770-Scanner","s":18,"c":1753114617000,"d":"ToolShell scanner - CVE-2025-53770 and detection information"}]},"CVE-2025-5777":{"n":26,"first":1751281366000,"top":[{"n":"win3zz/CVE-2025-5777","u":"https://github.com/win3zz/CVE-2025-5777","s":50,"c":1751983965000,"d":"CVE-2025-5777 (CitrixBleed 2) - Critical memory leak vulnerability affecting Citrix NetScaler ADC and Gateway devices"},{"n":"bughuntar/CVE-2025-5777","u":"https://github.com/bughuntar/CVE-2025-5777","s":31,"c":1752131707000,"d":"CVE-2025-5777 Citrix NetScaler Memory Leak Exploit (CitrixBleed 2)"},{"n":"mingshenhk/CitrixBleed-2-CVE-2025-5777-PoC-","u":"https://github.com/mingshenhk/CitrixBleed-2-CVE-2025-5777-PoC-","s":17,"c":1751281366000,"d":"详细讲解CitrixBleed 2 — CVE-2025-5777（越界泄漏）PoC 和检测套件"},{"n":"Chocapikk/CVE-2025-5777","u":"https://github.com/Chocapikk/CVE-2025-5777","s":7,"c":1751970436000,"d":"CitrixBleed 2 (CVE-2025-5777)"},{"n":"Shivshantp/CVE-2025-5777-TrendMicro-ApexCentral-RCE","u":"https://github.com/Shivshantp/CVE-2025-5777-TrendMicro-ApexCentral-RCE","s":5,"c":1753272305000,"d":"PoC for CVE-2025-5777 – Auth Bypass and RCE in Trend Micro Apex Central"}]},"CVE-2025-31324":{"n":22,"first":1745594579000,"top":[{"n":"redrays-io/CVE-2025-31324","u":"https://github.com/redrays-io/CVE-2025-31324","s":25,"c":1745753966000,"d":"CVE-2025-31324, SAP Exploit"},{"n":"antichainalysis/sap-netweaver-0day-CVE-2025-31324","u":"https://github.com/antichainalysis/sap-netweaver-0day-CVE-2025-31324","s":21,"c":1755272743000,"d":"sap netweaver 0day poc by shinyhunters (scattered lapsus$ hunters) affecting all 7.x CVE-2025-31324"},{"n":"Onapsis/Onapsis_CVE-2025-31324_Scanner_Tools","u":"https://github.com/Onapsis/Onapsis_CVE-2025-31324_Scanner_Tools","s":12,"c":1745772045000,"d":""},{"n":"Onapsis/Onapsis-Mandiant-CVE-2025-31324-Vuln-Compromise-Assessment","u":"https://github.com/Onapsis/Onapsis-Mandiant-CVE-2025-31324-Vuln-Compromise-Assessment","s":9,"c":1746125060000,"d":"CVE-2025-31324 & CVE-2025-42999 vulnerability and compromise assessment tool"},{"n":"NULLTRACE0X/CVE-2025-31324","u":"https://github.com/NULLTRACE0X/CVE-2025-31324","s":9,"c":1746598989000,"d":""}]},"CVE-2025-1974":{"n":24,"first":1742853064000,"top":[{"n":"Esonhugh/ingressNightmare-CVE-2025-1974-exps","u":"https://github.com/Esonhugh/ingressNightmare-CVE-2025-1974-exps","s":98,"c":1742971416000,"d":"IngressNightmare POC. world first non-blind remote execution exploitation with multi-advanced exploitation methods. allow on disk exploitati"},{"n":"sandumjacob/IngressNightmare-POCs","u":"https://github.com/sandumjacob/IngressNightmare-POCs","s":91,"c":1742853064000,"d":"CVE-2025-1974"},{"n":"yoshino-s/CVE-2025-1974","u":"https://github.com/yoshino-s/CVE-2025-1974","s":53,"c":1742908981000,"d":""},{"n":"zwxxb/CVE-2025-1974","u":"https://github.com/zwxxb/CVE-2025-1974","s":8,"c":1743000569000,"d":"Poc for Ingress RCE "},{"n":"hi-unc1e/CVE-2025-1974-poc","u":"https://github.com/hi-unc1e/CVE-2025-1974-poc","s":4,"c":1743008077000,"d":"PoC of CVE-2025-1974, modified from the world-first PoC~"}]},"CVE-2025-0282":{"n":10,"first":1736561211000,"top":[{"n":"absholi7ly/CVE-2025-0282-Ivanti-exploit","u":"https://github.com/absholi7ly/CVE-2025-0282-Ivanti-exploit","s":53,"c":1736561211000,"d":"CVE-2025-0282 is a critical vulnerability found in Ivanti Connect Secure, allowing Remote Command Execution (RCE) through a buffer overflow "},{"n":"sfewer-r7/CVE-2025-0282","u":"https://github.com/sfewer-r7/CVE-2025-0282","s":49,"c":1737038753000,"d":"PoC for CVE-2025-0282: A remote unauthenticated stack based buffer overflow affecting Ivanti Connect Secure, Ivanti Policy Secure, and Ivant"},{"n":"watchtowrlabs/CVE-2025-0282","u":"https://github.com/watchtowrlabs/CVE-2025-0282","s":31,"c":1736965632000,"d":"Ivanti Connect Secure IFT TLS Stack Overflow pre-auth RCE (CVE-2025-0282)"},{"n":"Hexastrike/Ivanti-Connect-Secure-Logs-Parser","u":"https://github.com/Hexastrike/Ivanti-Connect-Secure-Logs-Parser","s":6,"c":1737277357000,"d":"A Python script for examining Ivanti Secure Connect (ICS) event logs, designed to support investigations into vulnerabilities CVE-2025-0282,"},{"n":"AnonStorks/CVE-2025-0282-Full-version","u":"https://github.com/AnonStorks/CVE-2025-0282-Full-version","s":4,"c":1736683120000,"d":"# CVE-2025-0282: Remote Code Execution Vulnerability in [StorkS]"}]},"CVE-2025-29824":{"n":4,"first":1747187150000,"top":[{"n":"encrypter15/CVE-2025-29824","u":"https://github.com/encrypter15/CVE-2025-29824","s":31,"c":1747187150000,"d":""},{"n":"AfanPan/CVE-2025-29824-Exploit","u":"https://github.com/AfanPan/CVE-2025-29824-Exploit","s":21,"c":1753862667000,"d":"Use after free in Windows Common Log File System Driver allows an authorized attacker to elevate privileges locally."},{"n":"zmkeh/CVE-2025-29824-CLFS-Local-privilege-escalation","u":"https://github.com/zmkeh/CVE-2025-29824-CLFS-Local-privilege-escalation","s":2,"c":1761558366000,"d":"note"},{"n":"uname1able/CVE-2025-29824","u":"https://github.com/uname1able/CVE-2025-29824","s":1,"c":1773724244000,"d":""}]},"CVE-2025-32433":{"n":41,"first":1744936511000,"top":[{"n":"ProDefense/CVE-2025-32433","u":"https://github.com/ProDefense/CVE-2025-32433","s":142,"c":1744936511000,"d":"CVE-2025-32433 https://github.com/erlang/otp/security/advisories/GHSA-37cp-fgq5-7wc2"},{"n":"omer-efe-curkus/CVE-2025-32433-Erlang-OTP-SSH-RCE-PoC","u":"https://github.com/omer-efe-curkus/CVE-2025-32433-Erlang-OTP-SSH-RCE-PoC","s":16,"c":1745010704000,"d":"The vulnerability allows an attacker with network access to an Erlang/OTP SSH server to execute arbitrary code without prior authentication."},{"n":"NiteeshPujari/CVE-2025-32433-PoC","u":"https://github.com/NiteeshPujari/CVE-2025-32433-PoC","s":7,"c":1755059680000,"d":"CVE-2025-32433 PoC: Unauthenticated Remote Code Execution (RCE) in Erlang/OTP SSH. A proof-of-concept exploit for CVE-2025-32433"},{"n":"m0usem0use/erl_mouse","u":"https://github.com/m0usem0use/erl_mouse","s":6,"c":1745009985000,"d":"python script to find vulnerable targets of CVE-2025-32433 "},{"n":"0xPThree/cve-2025-32433","u":"https://github.com/0xPThree/cve-2025-32433","s":6,"c":1745075604000,"d":""}]},"CVE-2026-41091":{"n":4,"first":1779390985000,"top":[{"n":"0xBlackash/CVE-2026-41091","u":"https://github.com/0xBlackash/CVE-2026-41091","s":12,"c":1779390985000,"d":"CVE-2026-41091"},{"n":"tc4dy/CVE-2026-41091-PoC-Exploit","u":"https://github.com/tc4dy/CVE-2026-41091-PoC-Exploit","s":5,"c":1781951134000,"d":"CVE-2026-41091 RedSun | Microsoft Defender LPE exploit. Low-privileged users gain NT AUTHORITY\\SYSTEM - via Cloud Files API + NTFS junction "},{"n":"s4m98/RedSun-","u":"https://github.com/s4m98/RedSun-","s":1,"c":1786274626000,"d":"Windwos Zero Day Local PrivESc Exploit (CVE-2026-41091)"},{"n":"ridhinva/defender-privilege-escalation-scanner","u":"https://github.com/ridhinva/defender-privilege-escalation-scanner","s":0,"c":1779493370000,"d":"Scanner: CVE-2026-41091/45498 Microsoft Defender LPE/DoS — Python scanner for Windows Defender privilege escalation (CISA KEV)"}]},"CVE-2026-45498":{"n":1,"first":1782992574000,"top":[{"n":"salihuahmad105-creator/Vulnerability-scanner","u":"https://github.com/salihuahmad105-creator/Vulnerability-scanner","s":0,"c":1782992574000,"d":"DESIGN AND IMPLEMENTATION OF A VULNERABILITY SCANNER FOR CVE-2026-45498 IN MICROSOFT DEFENDER"}]},"CVE-2026-42897":{"n":1,"first":1778844276000,"top":[{"n":"atiilla/CVE-2026-42897","u":"https://github.com/atiilla/CVE-2026-42897","s":5,"c":1778844276000,"d":"CVE-2026-42897 - Exchange Health Checker blind spot: outbound IIS URL Rewrite rules silently ignored, making EOMT mitigations invisible in d"}]},"CVE-2026-20182":{"n":3,"first":1779484621000,"top":[{"n":"portbuster1337/CVE-2026-20182","u":"https://github.com/portbuster1337/CVE-2026-20182","s":3,"c":1779484621000,"d":"CVE-2026-20182 PoC - Cisco Catalyst SD-WAN Controller / Manager Authentication Bypass (CVSS 10.0)"},{"n":"Nxploited/CVE-2026-20182","u":"https://github.com/Nxploited/CVE-2026-20182","s":1,"c":1779819008000,"d":"Cisco Catalyst SD-WAN Peering Authentication Bypass"},{"n":"HORKimhab/CVE-2026-20182","u":"https://github.com/HORKimhab/CVE-2026-20182","s":0,"c":1779600506000,"d":"CVE-2026-20182"}]},"CVE-2026-42208":{"n":6,"first":1777395473000,"top":[{"n":"ridhinva/litellm-sqli-scanner","u":"https://github.com/ridhinva/litellm-sqli-scanner","s":1,"c":1779492124000,"d":"Scanner: CVE-2026-42208 LiteLLM SQL Injection — Python scanner for BerriAI LiteLLM proxy instances"},{"n":"imjdl/CVE-2026-42208_lab","u":"https://github.com/imjdl/CVE-2026-42208_lab","s":0,"c":1777395473000,"d":"CVE-2026-42208 lab"},{"n":"0xBlackash/CVE-2026-42208","u":"https://github.com/0xBlackash/CVE-2026-42208","s":0,"c":1777805734000,"d":"CVE-2026-40487"},{"n":"Zeltoc/threat-intel-brief-cve-2026-42208-litellm","u":"https://github.com/Zeltoc/threat-intel-brief-cve-2026-42208-litellm","s":0,"c":1778378845000,"d":"Threat intelligence brief on CVE-2026-42208, a critical pre-auth SQL injection in BerriAI LiteLLM exploited within 36 hours of disclosure. C"},{"n":"rootdirective-sec/CVE-2026-42208-Lab","u":"https://github.com/rootdirective-sec/CVE-2026-42208-Lab","s":0,"c":1778415104000,"d":""}]},"CVE-2026-0300":{"n":10,"first":1778041989000,"top":[{"n":"p3Nt3st3r-sTAr/CVE-2026-0300-POC","u":"https://github.com/p3Nt3st3r-sTAr/CVE-2026-0300-POC","s":22,"c":1778111812000,"d":""},{"n":"matad0r-maghribi/CVE-2026-0300-PANOS","u":"https://github.com/matad0r-maghribi/CVE-2026-0300-PANOS","s":4,"c":1778076867000,"d":"Security Research and Proof-of-Concept (PoC) for CVE-2026-0300 : Unauthenticated Remote Code Execution (RCE) in Palo Alto Networks PAN-OS Us"},{"n":"qassam-315/PAN-OS-User-ID-Buffer-Overflow-PoC","u":"https://github.com/qassam-315/PAN-OS-User-ID-Buffer-Overflow-PoC","s":3,"c":1778041989000,"d":"A research-grade Proof-of-Concept (PoC) for CVE-2026-0300, targeting the Buffer Overflow vulnerability in Palo Alto Networks PAN-OS User-ID™"},{"n":"ridhinva/panos-captive-portal-rce","u":"https://github.com/ridhinva/panos-captive-portal-rce","s":2,"c":1779482651000,"d":"Scanner: CVE-2026-0300 PAN-OS User-ID Captive Portal Buffer Overflow RCE — Python CLI for detecting actively exploited BOF vulnerability in "},{"n":"mr-r3b00t/CVE-2026-0300","u":"https://github.com/mr-r3b00t/CVE-2026-0300","s":1,"c":1778046317000,"d":"a honeypot for CVE-2026-0300"}]},"CVE-2026-41940":{"n":74,"first":1777484672000,"top":[{"n":"ynsmroztas/cPanelSniper","u":"https://github.com/ynsmroztas/cPanelSniper","s":508,"c":1777637366000,"d":"CVE-2026-41940 — cPanel & WHM Authentication Bypass via Session-File CRLF Injection"},{"n":"sakidekin/CVE-2026-41940-PoC","u":"https://github.com/sakidekin/CVE-2026-41940-PoC","s":420,"c":1791705258000,"d":"cPanel & WHM Authentication Bypass via CVE-2026-41940 explotation"},{"n":"assetnote/cpanel2shell-scanner","u":"https://github.com/assetnote/cpanel2shell-scanner","s":92,"c":1777536683000,"d":"High fidelity scanner for CVE-2026-41940 (cPanel & WHM authentication bypass)"},{"n":"XsanFlip/poc-cpanel-cve-2026-41940","u":"https://github.com/XsanFlip/poc-cpanel-cve-2026-41940","s":63,"c":1777652858000,"d":""},{"n":"adriyansyah-mf/cve-2026-41940-poc","u":"https://github.com/adriyansyah-mf/cve-2026-41940-poc","s":28,"c":1777516717000,"d":""}]},"CVE-2026-32202":{"n":3,"first":1777543950000,"top":[{"n":"virus-or-not/CVE-2026-32202","u":"https://github.com/virus-or-not/CVE-2026-32202","s":8,"c":1777570492000,"d":"Windows Shell Spoofing Vulnerability"},{"n":"solarlynxsqueeze/CVE-2026-32202","u":"https://github.com/solarlynxsqueeze/CVE-2026-32202","s":0,"c":1777543950000,"d":""},{"n":"f0xox/CVE-2026-32202","u":"https://github.com/f0xox/CVE-2026-32202","s":0,"c":1782060693000,"d":""}]},"CVE-2024-7399":{"n":1,"first":1748619754000,"top":[{"n":"davidxbors/CVE-2024-7399-POC","u":"https://github.com/davidxbors/CVE-2024-7399-POC","s":0,"c":1748619754000,"d":""}]},"CVE-2026-39987":{"n":27,"first":1776028355000,"top":[{"n":"Th3Purge/CVE-2026-39987","u":"https://github.com/Th3Purge/CVE-2026-39987","s":9,"c":1788896660000,"d":"Marimo Pre Authentication RCE"},{"n":"M3PH1569/CVE-2026-39987-POC","u":"https://github.com/M3PH1569/CVE-2026-39987-POC","s":5,"c":1779645633000,"d":"CVE-2026-39987 Exploitation Tool - Marimo < 0.23.0 Pre-Auth RCE (WebSocket)"},{"n":"keraattin/CVE-2026-39987","u":"https://github.com/keraattin/CVE-2026-39987","s":1,"c":1776240594000,"d":"CVE-2026-39987: Marimo Python Notebook Pre-Auth RCE (CVSS 9.3). Python & Nmap NSE detection scripts. Missing authentication on /terminal/ws "},{"n":"Nxploited/CVE-2026-39987","u":"https://github.com/Nxploited/CVE-2026-39987","s":1,"c":1776498403000,"d":"marimo is a reactive Python notebook. Prior to 0.23.0, Marimo has a Pre-Auth RCE vulnerability"},{"n":"h3raklez/CVE-2026-39987","u":"https://github.com/h3raklez/CVE-2026-39987","s":1,"c":1777135834000,"d":"Marimo Pre-Auth RCE"}]},"CVE-2026-33825":{"n":6,"first":1776459128000,"top":[{"n":"Letlaka/redsun-bluehammer-undefend-detection-pack","u":"https://github.com/Letlaka/redsun-bluehammer-undefend-detection-pack","s":10,"c":1776459128000,"d":"Microsoft Defender XDR KQL detections for RedSun, BlueHammer, UnDefend, and CVE-2026-33825-related Defender abuse behaviors."},{"n":"0xBlackash/CVE-2026-33825","u":"https://github.com/0xBlackash/CVE-2026-33825","s":9,"c":1779121727000,"d":"CVE-2026-33825"},{"n":"Joe1sn/CVE-2026-33825","u":"https://github.com/Joe1sn/CVE-2026-33825","s":4,"c":1777704722000,"d":"RedSun PoC for self use"},{"n":"Bilal3755/Detecting_blue_hammer_vuln","u":"https://github.com/Bilal3755/Detecting_blue_hammer_vuln","s":0,"c":1776677886000,"d":"Threat hunting query for bluehammer CVE windows CVE-2026-33825"},{"n":"kaleth4/CVE-2026-33825","u":"https://github.com/kaleth4/CVE-2026-33825","s":0,"c":1776860979000,"d":""}]},"CVE-2026-32201":{"n":1,"first":1776893380000,"top":[{"n":"B1tBit/CVE-2026-32201-exploit","u":"https://github.com/B1tBit/CVE-2026-32201-exploit","s":1,"c":1776893380000,"d":"A spoofing vulnerability exists in Microsoft SharePoint Server due to improper input validation. An unauthenticated attacker can send a spec"}]},"CVE-2025-60710":{"n":2,"first":1762884528000,"top":[{"n":"redpack-kr/CVE-2025-60710","u":"https://github.com/redpack-kr/CVE-2025-60710","s":25,"c":1762942246000,"d":""},{"n":"Wh04m1001/CVE-2025-60710","u":"https://github.com/Wh04m1001/CVE-2025-60710","s":6,"c":1762884528000,"d":""}]},"CVE-2023-36424":{"n":1,"first":1711057164000,"top":[{"n":"zerozenxlabs/CVE-2023-36424","u":"https://github.com/zerozenxlabs/CVE-2023-36424","s":129,"c":1711057164000,"d":"Windows Kernel Pool (clfs.sys) Corruption Privilege Escalation"}]},"CVE-2020-9715":{"n":2,"first":1641802985000,"top":[{"n":"lsw29475/CVE-2020-9715","u":"https://github.com/lsw29475/CVE-2020-9715","s":5,"c":1641802985000,"d":""},{"n":"f8al/PoC-CVE-2020-9715","u":"https://github.com/f8al/PoC-CVE-2020-9715","s":2,"c":1776200879000,"d":""}]},"CVE-2026-21643":{"n":2,"first":1774638675000,"top":[{"n":"0xBlackash/CVE-2026-21643","u":"https://github.com/0xBlackash/CVE-2026-21643","s":18,"c":1774724978000,"d":"CVE-2026-21643"},{"n":"alirezac0/CVE-2026-21643","u":"https://github.com/alirezac0/CVE-2026-21643","s":5,"c":1774638675000,"d":"Python PoC and Nuclei template for CVE-2026-21643 (Pre-Authentication SQL Injection in FortiClient EMS 7.4.4)"}]},"CVE-2026-34621":{"n":5,"first":1776085237000,"top":[{"n":"azefzafyoussef/CVE-2026-34621","u":"https://github.com/azefzafyoussef/CVE-2026-34621","s":26,"c":1778619523000,"d":""},{"n":"NULL200OK/cve_2026_34621_advanced","u":"https://github.com/NULL200OK/cve_2026_34621_advanced","s":13,"c":1776267006000,"d":"A sophisticated, cross-platform exploit generator for **CVE-2026-34621** – a critical prototype pollution vulnerability in Adobe Acrobat and"},{"n":"ercihan/CVE-2026-34621","u":"https://github.com/ercihan/CVE-2026-34621","s":2,"c":1776085237000,"d":""},{"n":"ercihan/CVE-2026-34621_PDF_SAMPLE","u":"https://github.com/ercihan/CVE-2026-34621_PDF_SAMPLE","s":2,"c":1776413262000,"d":""},{"n":"KeulenR01/Remediate-AdobeAcrobat-CVE-2026-34621","u":"https://github.com/KeulenR01/Remediate-AdobeAcrobat-CVE-2026-34621","s":1,"c":1776179679000,"d":""}]},"CVE-2026-3502":{"n":2,"first":1775342393000,"top":[{"n":"fevar54/CVE-2026-3502---TrueConf-Client-Update-Hijacking-PoC","u":"https://github.com/fevar54/CVE-2026-3502---TrueConf-Client-Update-Hijacking-PoC","s":0,"c":1775342393000,"d":"PoC de CVE-2026-3502: hijacking de actualizacion en TrueConf Client para RCE (Operacion TrueChaos)."},{"n":"fevar54/CVE-2026-3502-Scanner---TrueConf-Vulnerability-Detection-Tool","u":"https://github.com/fevar54/CVE-2026-3502-Scanner---TrueConf-Vulnerability-Detection-Tool","s":0,"c":1775343054000,"d":"Scanner de CVE-2026-3502: detecta clientes TrueConf vulnerables e IOCs de TrueChaos. Reportes JSON/HTML/CSV."}]},"CVE-2026-5281":{"n":4,"first":1775094688000,"top":[{"n":"umair-aziz025/CVE-2026-5281-Research-Toolkit","u":"https://github.com/umair-aziz025/CVE-2026-5281-Research-Toolkit","s":4,"c":1775094688000,"d":"Chrome WebGPU Use-After-Free (CWE-416)  This toolkit is for security research and defensive verification around CVE-2026-5281. Patched Chrom"},{"n":"TheMalwareGuardian/CVE-2026-5281","u":"https://github.com/TheMalwareGuardian/CVE-2026-5281","s":2,"c":1775475006000,"d":"CVE-2026-5281 (Chrome Dawn WebGPU UAF) analysis, lab validation tools, and reproducible environment for vulnerable vs patched builds."},{"n":"jaf0rk/CVE-2026-5281","u":"https://github.com/jaf0rk/CVE-2026-5281","s":0,"c":1779439843000,"d":""},{"n":"jaf0rk/CVE-2026-5281-CVE-2026-11057-fullchain","u":"https://github.com/jaf0rk/CVE-2026-5281-CVE-2026-11057-fullchain","s":0,"c":1787628429000,"d":""}]},"CVE-2026-3055":{"n":5,"first":1774781893000,"top":[{"n":"fevar54/CVE-2026-3055---Citrix-NetScaler-Memory-Overread-PoC","u":"https://github.com/fevar54/CVE-2026-3055---Citrix-NetScaler-Memory-Overread-PoC","s":1,"c":1774973258000,"d":"PoC de CVE-2026-3055: memory overread en Citrix NetScaler ADC/Gateway para filtrar session IDs."},{"n":"fevar54/CVE-2026-3055-Scanner---Herramienta-de-Detecci-n","u":"https://github.com/fevar54/CVE-2026-3055-Scanner---Herramienta-de-Detecci-n","s":1,"c":1774974192000,"d":"Scanner de CVE-2026-3055: detecta NetScaler ADC/Gateway vulnerables a memory overread. Reportes JSON/HTML/CSV."},{"n":"l0lsec/check-cve-2026-3055-netscaler","u":"https://github.com/l0lsec/check-cve-2026-3055-netscaler","s":1,"c":1775073205000,"d":"Low-impact probe for Citrix NetScaler CVE-2026-3055 (SAML IdP memory overread)"},{"n":"0xBlackash/CVE-2026-3055","u":"https://github.com/0xBlackash/CVE-2026-3055","s":0,"c":1774781893000,"d":"CVE-2026-3055"},{"n":"NetVanguard-cmd/CVE-2026-3055","u":"https://github.com/NetVanguard-cmd/CVE-2026-3055","s":0,"c":1776579761000,"d":""}]},"CVE-2026-33634":{"n":5,"first":1774397323000,"top":[{"n":"ugurrates/teampcp-supply-chain-attack","u":"https://github.com/ugurrates/teampcp-supply-chain-attack","s":12,"c":1774397323000,"d":"CVE-2026-33634 (CVSS 9.4) — The most impactful CI/CD supply chain attack of 2026 so far."},{"n":"fevar54/CVE-2026-33634-Scanner","u":"https://github.com/fevar54/CVE-2026-33634-Scanner","s":0,"c":1774885423000,"d":"Scanner de IOCs del ataque de cadena de suministro TeamPCP (CVE-2026-33634)."},{"n":"AshleyT3/docker-socket-risk-demos","u":"https://github.com/AshleyT3/docker-socket-risk-demos","s":0,"c":1774947499000,"d":"Companion source for YouTube video \"Stop Mounting docker.sock — Run Trivy Without Giving Away Root Access — (inspired by CVE-2026-33634)\""},{"n":"dfs333/trivysupplychainanalysis","u":"https://github.com/dfs333/trivysupplychainanalysis","s":0,"c":1784098054000,"d":"Formally verified, quantitative reconstruction of the Trivy/TeamPCP GitHub Actions supply-chain attack (CVE-2026-33634): a TLA+/TLC incident"},{"n":"joaovicdev/EXPLOIT-CVE-2026-33634","u":"https://github.com/joaovicdev/EXPLOIT-CVE-2026-33634","s":0,"c":1790029269000,"d":""}]},"CVE-2026-33017":{"n":27,"first":1774080668000,"top":[{"n":"EQSTLab/CVE-2026-33017","u":"https://github.com/EQSTLab/CVE-2026-33017","s":12,"c":1774923040000,"d":"Langflow RCE"},{"n":"MaxMnMl/langflow-CVE-2026-33017-poc","u":"https://github.com/MaxMnMl/langflow-CVE-2026-33017-poc","s":10,"c":1774080668000,"d":"CVE-2026-33017 - An unauthenticated remote code execution in Langflow <= 1.8.1 via Public Flow Build Endpoint"},{"n":"z4yd3/PoC-CVE-2026-33017","u":"https://github.com/z4yd3/PoC-CVE-2026-33017","s":5,"c":1774595707000,"d":"CVE-2026-33017: Unauthenticated RCE in Langflow"},{"n":"c0gnit00/CVE-2026-33017","u":"https://github.com/c0gnit00/CVE-2026-33017","s":2,"c":1782985678000,"d":"Python POC, Exploit for CVE-2026-33017"},{"n":"CerberusMrXi/Langflow-cve-2026-33017-exploit","u":"https://github.com/CerberusMrXi/Langflow-cve-2026-33017-exploit","s":2,"c":1784457859000,"d":"CVE-2026-33017 exploitation tool for Langflow <1.9.0. Features reverse shells, command execution, file operations, persistence, and automate"}]},"CVE-2025-32432":{"n":15,"first":1745710438000,"top":[{"n":"Sachinart/CVE-2025-32432","u":"https://github.com/Sachinart/CVE-2025-32432","s":27,"c":1745743852000,"d":"This repository contains a proof-of-concept exploit script for CVE-2025-32432, a pre-authentication Remote Code Execution (RCE) vulnerabilit"},{"n":"Chocapikk/CVE-2025-32432","u":"https://github.com/Chocapikk/CVE-2025-32432","s":10,"c":1745710438000,"d":"CraftCMS RCE Checker (CVE-2025-32432)"},{"n":"CTY-Research-1/CVE-2025-32432-PoC","u":"https://github.com/CTY-Research-1/CVE-2025-32432-PoC","s":8,"c":1748791148000,"d":""},{"n":"P34NUT2/CVE-2025-32432-exploit-by-P34NUT","u":"https://github.com/P34NUT2/CVE-2025-32432-exploit-by-P34NUT","s":8,"c":1789601529000,"d":"Reliable CVE-2025-32432 pre-auth RCE exploit for Craft CMS 3.x/4.x/5.x, works where other public PoCs fail"},{"n":"c0gnit00/CVE-2025-32432","u":"https://github.com/c0gnit00/CVE-2025-32432","s":5,"c":1784652742000,"d":"Exploit, POC for CVE-2025-32432, CraftCMS2Shell"}]},"CVE-2025-54068":{"n":7,"first":1766483694000,"top":[{"n":"synacktiv/Livepyre","u":"https://github.com/synacktiv/Livepyre","s":153,"c":1766483694000,"d":"A tool designed to exploit CVE-2025-54068 and Remote Command Execution if the APP_KEY of the Livewire project is known."},{"n":"HelgeSverre/livewire-honeypot","u":"https://github.com/HelgeSverre/livewire-honeypot","s":7,"c":1775812886000,"d":"High-interaction honeypot mimicking a vulnerable Laravel/Livewire app. Captures RCE exploits and webshells targeting CVE-2024-47823, CVE-202"},{"n":"haxorstars/CVE-2025-54068","u":"https://github.com/haxorstars/CVE-2025-54068","s":5,"c":1768918256000,"d":"A tool designed to exploit CVE-2025-54068 and Remote Command Execution of the Livewire project."},{"n":"e4zyy/Project-CVE-2025-54068","u":"https://github.com/e4zyy/Project-CVE-2025-54068","s":4,"c":1767270502000,"d":"Fast Python scanner detects vulnerable Laravel Livewire v3 sites (CVE-2025-54068, CVSS 9.2). Separates risky sites into vuln.txt, safe sites"},{"n":"flame-11/CVE-2025-54068-livewire","u":"https://github.com/flame-11/CVE-2025-54068-livewire","s":1,"c":1767843728000,"d":""}]},"CVE-2025-31277":{"n":1,"first":1774637720000,"top":[{"n":"stationedK-06/DarkSword_analysis","u":"https://github.com/stationedK-06/DarkSword_analysis","s":2,"c":1774637720000,"d":"Static analysis of the DarkSword iOS WebKit exploit chain — delivery, staging, and CVE breakdown   (CVE-2025-31277, CVE-2025-43529)"}]},"CVE-2026-20131":{"n":5,"first":1772780816000,"top":[{"n":"sak110/CVE-2026-20131","u":"https://github.com/sak110/CVE-2026-20131","s":3,"c":1773192651000,"d":""},{"n":"Hassan-Pouladi/Cisco-FMC-honeypot","u":"https://github.com/Hassan-Pouladi/Cisco-FMC-honeypot","s":2,"c":1775532937000,"d":"Originally a Honeypot for CVE-2026-20131"},{"n":"p3Nt3st3r-sTAr/CVE-2026-20131-POC","u":"https://github.com/p3Nt3st3r-sTAr/CVE-2026-20131-POC","s":0,"c":1772780816000,"d":""},{"n":"0xBlackash/CVE-2026-20131","u":"https://github.com/0xBlackash/CVE-2026-20131","s":0,"c":1778421739000,"d":"CVE-2026-20131"},{"n":"Jwa7470/CVE-2026-20131-Post-Incident-Written-Report","u":"https://github.com/Jwa7470/CVE-2026-20131-Post-Incident-Written-Report","s":0,"c":1787876671000,"d":"Post-incident report on CVE-2026-20131 (CVSS 10.0), a Cisco FMC insecure deserialization vulnerability exploited by Interlock ransomware. De"}]},"CVE-2026-3910":{"n":1,"first":1777459001000,"top":[{"n":"5o1z/CVE-2026-3910","u":"https://github.com/5o1z/CVE-2026-3910","s":0,"c":1777459001000,"d":""}]},"CVE-2026-3909":{"n":1,"first":1775798407000,"top":[{"n":"jaf0rk/CVE-2026-3909","u":"https://github.com/jaf0rk/CVE-2026-3909","s":2,"c":1775798407000,"d":""}]},"CVE-2025-68613":{"n":37,"first":1766385956000,"top":[{"n":"wioui/n8n-CVE-2025-68613-exploit","u":"https://github.com/wioui/n8n-CVE-2025-68613-exploit","s":105,"c":1766440176000,"d":"CVE-2025-68613: n8n RCE vulnerability exploit and documentation"},{"n":"ZeroDayEvil/CVE-2026-21858-n8n-FullChain","u":"https://github.com/ZeroDayEvil/CVE-2026-21858-n8n-FullChain","s":88,"c":1789171387000,"d":"🛡️ Official AI Security Tool module for CVE-2026-21858 + CVE-2025-68613 (n8n \"Ni8mare\" Unauthenticated Arbitrary File Read & Expression Inj"},{"n":"TheStingR/CVE-2025-68613-POC","u":"https://github.com/TheStingR/CVE-2025-68613-POC","s":29,"c":1766428865000,"d":"Public PoC + Scanner and research for CVE-2025-68613: Critical RCE in n8n Workflow Automation via Expression Injection (CVSS 10.0). Includes"},{"n":"rxerium/CVE-2025-68613","u":"https://github.com/rxerium/CVE-2025-68613","s":27,"c":1766385956000,"d":"Detection for CVE-2025-68613"},{"n":"LingerANR/n8n-CVE-2025-68613","u":"https://github.com/LingerANR/n8n-CVE-2025-68613","s":7,"c":1766789987000,"d":"This laboratory provides a controlled environment to analyze and reproduce CVE-2025-68613 in a vulnerable n8n instance."}]},"CVE-2021-22054":{"n":1,"first":1654265162000,"top":[{"n":"MKSx/CVE-2021-22054","u":"https://github.com/MKSx/CVE-2021-22054","s":5,"c":1654265162000,"d":"Generate SSRF payloads"}]},"CVE-2025-26399":{"n":1,"first":1758627244000,"top":[{"n":"rxerium/CVE-2025-26399","u":"https://github.com/rxerium/CVE-2025-26399","s":2,"c":1758627244000,"d":"Detection for CVE-2025-26399"}]},"CVE-2017-7921":{"n":24,"first":1587988180000,"top":[{"n":"chrisjd20/hikvision_CVE-2017-7921_auth_bypass_config_decryptor","u":"https://github.com/chrisjd20/hikvision_CVE-2017-7921_auth_bypass_config_decryptor","s":116,"c":1611936515000,"d":"This python file will decrypt the configurationFile used by hikvision cameras vulnerable to CVE-2017-7921."},{"n":"JrDw0/CVE-2017-7921-EXP","u":"https://github.com/JrDw0/CVE-2017-7921-EXP","s":103,"c":1587988180000,"d":"Hikvision camera CVE-2017-7921-EXP"},{"n":"BurnyMcDull/CVE-2017-7921","u":"https://github.com/BurnyMcDull/CVE-2017-7921","s":35,"c":1605171730000,"d":"海康威视未授权访问检测poc及口令爆破"},{"n":"voidsshadows/Hikvision-City-Hunter","u":"https://github.com/voidsshadows/Hikvision-City-Hunter","s":19,"c":1763512294000,"d":"This tool is a modern evolution of older PoCs like those for CVE-2017-7921 and ICSA-17-124-01, updated for 2025 with live console output, th"},{"n":"MisakaMikato/cve-2017-7921-golang","u":"https://github.com/MisakaMikato/cve-2017-7921-golang","s":13,"c":1605240931000,"d":"Hikvision IP camera access bypass exploit, developed by golang. "}]},"CVE-2021-22681":{"n":1,"first":1785524711000,"top":[{"n":"pcrosby-1990/cip-security-poc","u":"https://github.com/pcrosby-1990/cip-security-poc","s":0,"c":1785524711000,"d":"▎ Open, runnable proof of concept + IEC 62443-4-2 (SL 2) mapping + a phased rollout for CVE-2021-22681 — the unpatchable Rockwell Logix hard"}]},"CVE-2026-21385":{"n":1,"first":1773342639000,"top":[{"n":"DaRkZ2012/qualcomm-vulnerability-scanner","u":"https://github.com/DaRkZ2012/qualcomm-vulnerability-scanner","s":3,"c":1773342639000,"d":"A tool to scan Android devices for the recently exploited Qualcomm flaw CVE-2026-21385, providing a simple and efficient way to identify vul"}]},"CVE-2026-20127":{"n":9,"first":1772587217000,"top":[{"n":"zerozenxlabs/CVE-2026-20127---Cisco-SD-WAN-Preauth-RCE","u":"https://github.com/zerozenxlabs/CVE-2026-20127---Cisco-SD-WAN-Preauth-RCE","s":29,"c":1772587217000,"d":""},{"n":"sfewer-r7/CVE-2026-20127","u":"https://github.com/sfewer-r7/CVE-2026-20127","s":24,"c":1773067104000,"d":"An exploit for the Cisco Catalyst SD-WAN Controller authentication bypass vulnerability, CVE-2026-20127"},{"n":"BugFor-Pings/CVE-2026-20127_EXP","u":"https://github.com/BugFor-Pings/CVE-2026-20127_EXP","s":4,"c":1772724511000,"d":"Cisco Catalyst SD-WAN 身份验证绕过漏洞(CVE-2026-20127)利用EXP"},{"n":"yonathanpy/CVE-2026-20127-Cisco-SD-WAN-Preauth-RCE","u":"https://github.com/yonathanpy/CVE-2026-20127-Cisco-SD-WAN-Preauth-RCE","s":2,"c":1772876369000,"d":""},{"n":"gigachadusers/cve-2026-20127","u":"https://github.com/gigachadusers/cve-2026-20127","s":2,"c":1776270946000,"d":""}]},"CVE-2025-49113":{"n":23,"first":1748977457000,"top":[{"n":"fearsoff-org/CVE-2025-49113","u":"https://github.com/fearsoff-org/CVE-2025-49113","s":108,"c":1749052183000,"d":""},{"n":"hakaioffsec/CVE-2025-49113-exploit","u":"https://github.com/hakaioffsec/CVE-2025-49113-exploit","s":93,"c":1749191473000,"d":"Proof of Concept demonstrating Remote Code Execution through insecure deserialization in Roundcube (CVE-2025-49113)."},{"n":"00xCanelo/CVE-2025-49113","u":"https://github.com/00xCanelo/CVE-2025-49113","s":8,"c":1752964527000,"d":"💥 Python Exploit for CVE-2025-49113 | Roundcube Webmail RCE via PHP Object Injection"},{"n":"BiiTts/Roundcube-CVE-2025-49113","u":"https://github.com/BiiTts/Roundcube-CVE-2025-49113","s":6,"c":1749568885000,"d":"Proof-of-concept to CVE-2025-49113"},{"n":"rxerium/CVE-2025-49113","u":"https://github.com/rxerium/CVE-2025-49113","s":5,"c":1748977457000,"d":"Detection for CVE-2025-49113"}]},"CVE-2025-68461":{"n":2,"first":1766143156000,"top":[{"n":"rxerium/CVE-2025-68461","u":"https://github.com/rxerium/CVE-2025-68461","s":16,"c":1766143156000,"d":"Detection for CVE-2025-68461"},{"n":"gotr00t0day/CVE-2025-68461","u":"https://github.com/gotr00t0day/CVE-2025-68461","s":6,"c":1766424773000,"d":"A C++ security scanner tool to detect Cross-Site Scripting (XSS) vulnerabilities in Roundcube Webmail installations."}]},"CVE-2026-2441":{"n":6,"first":1771415200000,"top":[{"n":"huseyinstif/CVE-2026-2441-PoC","u":"https://github.com/huseyinstif/CVE-2026-2441-PoC","s":137,"c":1771415200000,"d":""},{"n":"theemperorspath/CVE-2026-2441-PoC","u":"https://github.com/theemperorspath/CVE-2026-2441-PoC","s":0,"c":1771544913000,"d":""},{"n":"atiilla/CVE-2026-2441_PoC","u":"https://github.com/atiilla/CVE-2026-2441_PoC","s":0,"c":1771836196000,"d":""},{"n":"NetVanguard-cmd/CVE-2026-2441","u":"https://github.com/NetVanguard-cmd/CVE-2026-2441","s":0,"c":1771953955000,"d":""},{"n":"D3b0j33t/CVE-2026-2441-PoC","u":"https://github.com/D3b0j33t/CVE-2026-2441-PoC","s":0,"c":1772390058000,"d":""}]},"CVE-2026-1731":{"n":5,"first":1770801513000,"top":[{"n":"win3zz/CVE-2026-1731","u":"https://github.com/win3zz/CVE-2026-1731","s":37,"c":1770801513000,"d":"CVE-2026-1731 - Critical command injection vulnerability in BeyondTrust Remote Support and Privileged Remote Access due to unsafe Bash arith"},{"n":"jakubie07/CVE-2026-1731","u":"https://github.com/jakubie07/CVE-2026-1731","s":6,"c":1771394746000,"d":"CVE-2026-1731 PoC"},{"n":"cybrdude/cve-2026-1731-scanner","u":"https://github.com/cybrdude/cve-2026-1731-scanner","s":4,"c":1771012093000,"d":"Passive vulnerability scanner for CVE-2026-1731 — BeyondTrust RS/PRA pre-auth RCE (CVSS 9.9). Educational & defensive use only."},{"n":"hex0user/CVE-2026-1731","u":"https://github.com/hex0user/CVE-2026-1731","s":1,"c":1771754702000,"d":"CVE-2026-1731 — BeyondTrust Remote Code Execution Vulnerability"},{"n":"ridhinva/beyondtrust-rce-scanner","u":"https://github.com/ridhinva/beyondtrust-rce-scanner","s":0,"c":1779482664000,"d":"Scanner: CVE-2026-1731 BeyondTrust Remote Support Pre-auth RCE — Python checker for actively exploited vulnerability (CISA KEV)"}]},"CVE-2026-20700":{"n":2,"first":1779567902000,"top":[{"n":"R3n3r0/CVE-2026-20700","u":"https://github.com/R3n3r0/CVE-2026-20700","s":17,"c":1779567902000,"d":""},{"n":"notthemystery/CVE-2026-20700-POC-that-ll-never-work","u":"https://github.com/notthemystery/CVE-2026-20700-POC-that-ll-never-work","s":0,"c":1779720973000,"d":""}]},"CVE-2024-43468":{"n":2,"first":1732624784000,"top":[{"n":"synacktiv/CVE-2024-43468","u":"https://github.com/synacktiv/CVE-2024-43468","s":96,"c":1732624784000,"d":""},{"n":"nikallass/CVE-2024-43468_mTLS_go","u":"https://github.com/nikallass/CVE-2024-43468_mTLS_go","s":5,"c":1737116409000,"d":"CVE-2024-43468 SCCM SQL Injection Exploit (mTLS unextractable client cert from MacOS keychain version)"}]},"CVE-2025-15556":{"n":2,"first":1770640704000,"top":[{"n":"renat0z3r0/notepadpp-supply-chain-iocs","u":"https://github.com/renat0z3r0/notepadpp-supply-chain-iocs","s":1,"c":1770640704000,"d":"IoCs and detection rules for the Notepad++ supply chain attack (CVE-2025-15556) — Lotus Blossom APT, June–December 2025. Includes Falcon Log"},{"n":"George0Papasotiriou/CVE-2025-15556-Notepad-WinGUp-Updater-RCE","u":"https://github.com/George0Papasotiriou/CVE-2025-15556-Notepad-WinGUp-Updater-RCE","s":1,"c":1770683028000,"d":""}]},"CVE-2025-40536":{"n":1,"first":1780339104000,"top":[{"n":"victoriaalicex/CVE-2025-40536-Analysis","u":"https://github.com/victoriaalicex/CVE-2025-40536-Analysis","s":0,"c":1780339104000,"d":"CVE analysis of CVE-2025-40536, SolarWinds Web Help Desk security control bypass (CVSS 8.1). Covers vulnerability mechanics, attack chain wi"}]},"CVE-2026-21510":{"n":2,"first":1770850926000,"top":[{"n":"andreassudo/CVE-2026-21510-CVSS-8.8-Important-Windows-Shell-security-feature-bypass","u":"https://github.com/andreassudo/CVE-2026-21510-CVSS-8.8-Important-Windows-Shell-security-feature-bypass","s":7,"c":1770850926000,"d":"CVE-2026-21510 (CVSS 8.8, Important) — Windows Shell security feature bypass. An attacker can trick a user into clicking a malicious link or"},{"n":"EpSiLoNPoInTOrI/EpSiLoNPoInTlnk","u":"https://github.com/EpSiLoNPoInTOrI/EpSiLoNPoInTlnk","s":2,"c":1778338250000,"d":" CVE-2026-21510 LNK generator PoC"}]},"CVE-2026-21533":{"n":2,"first":1770814680000,"top":[{"n":"fevar54/CVE-2026-21533_Scanner.py","u":"https://github.com/fevar54/CVE-2026-21533_Scanner.py","s":2,"c":1773090458000,"d":"Detector de CVE-2026-21533: escalada de privilegios a SYSTEM en Servicios de Escritorio Remoto (RDS) de Windows."},{"n":"Pairs34/RDPVulnarableCheck","u":"https://github.com/Pairs34/RDPVulnarableCheck","s":1,"c":1770814680000,"d":"CVE-2026-21533 Zaafiyet tarama aracı"}]},"CVE-2026-21514":{"n":1,"first":1777916294000,"top":[{"n":"ChaitanyaHaritash/CVE-2026-21514_CVE-2026-21510","u":"https://github.com/ChaitanyaHaritash/CVE-2026-21514_CVE-2026-21510","s":7,"c":1777916294000,"d":"CVE-2026-21514 & CVE-2026-21510 (Because MS-Office Fascinates me)"}]},"CVE-2025-11953":{"n":3,"first":1762279055000,"top":[{"n":"SaidBenaissa/cve-2025-11953-vulnerability-demo","u":"https://github.com/SaidBenaissa/cve-2025-11953-vulnerability-demo","s":4,"c":1762279055000,"d":"CVE-2025-11953 demonstration: Critical RCE vulnerability in React Native CLI (CVSS 9.8). Educational security research with proof-of-concept"},{"n":"Mr-In4inci3le/CVE-2025-11953-POC-","u":"https://github.com/Mr-In4inci3le/CVE-2025-11953-POC-","s":0,"c":1768211603000,"d":"CVE-2025-11953 is a critical Remote Code Execution (RCE) vulnerability in the React Native CLI's Metro development server"},{"n":"boroeurnprach/CVE-2025-11953-PoC","u":"https://github.com/boroeurnprach/CVE-2025-11953-PoC","s":0,"c":1768470366000,"d":"CVE-2025-11953 - The React Native Metro server's default external binding exposes a vulnerable endpoint, allowing unauthenticated attackers "}]},"CVE-2026-24423":{"n":2,"first":1769689818000,"top":[{"n":"aavamin/CVE-2026-24423","u":"https://github.com/aavamin/CVE-2026-24423","s":8,"c":1769689818000,"d":"CVE-2026-24423 exp"},{"n":"CyberAlp0/SmarterMail-CVE-2026-24423","u":"https://github.com/CyberAlp0/SmarterMail-CVE-2026-24423","s":0,"c":1788352795000,"d":"Unauthenticated RCE PoC for CVE-2026-24423 in SmarterTools SmarterMail (ConnectToHub). For authorized security testing, CTFs, and research o"}]},"CVE-2025-64328":{"n":1,"first":1763221779000,"top":[{"n":"mcorybillington/CVE-2025-64328_FreePBX-framework-Command-Injection","u":"https://github.com/mcorybillington/CVE-2025-64328_FreePBX-framework-Command-Injection","s":0,"c":1763221779000,"d":"CVE-2025-64328 FreePBX Authenticated Command Injection in the framework module."}]},"CVE-2026-1281":{"n":2,"first":1770463727000,"top":[{"n":"MehdiLeDeaut/CVE-2026-1281-Ivanti-EPMM-RCE","u":"https://github.com/MehdiLeDeaut/CVE-2026-1281-Ivanti-EPMM-RCE","s":6,"c":1770463727000,"d":"Proof of Concept for CVE-2026-1281 & CVE-2026-1340 - Ivanti EPMM Pre-Auth RCE via Bash Arithmetic Expansion"},{"n":"YunfeiGE18/CVE-2026-1281-CVE-2026-1340-Ivanti-EPMM-RCE","u":"https://github.com/YunfeiGE18/CVE-2026-1281-CVE-2026-1340-Ivanti-EPMM-RCE","s":3,"c":1771536579000,"d":"A simple demo application that shows how to reproduce the Ivanti EPMM pre-auth RCE vulnerability (CVE-2026-1281 / CVE-2026-1340) for educati"}]},"CVE-2026-24858":{"n":5,"first":1769610890000,"top":[{"n":"absholi7ly/CVE-2026-24858-FortiCloud-SSO-Authentication-Bypass","u":"https://github.com/absholi7ly/CVE-2026-24858-FortiCloud-SSO-Authentication-Bypass","s":9,"c":1769743744000,"d":"CVE-2026-24858 FortiCloud Single Sign On (SSO)  a factory default enabled feature once you register any FortiGate/FortiManager/FortiAnalyzer"},{"n":"gagaltotal/cve-2026-24858","u":"https://github.com/gagaltotal/cve-2026-24858","s":1,"c":1770745867000,"d":"CVE-2026-24858 - Administrative FortiCloud SSO authentication bypass"},{"n":"m0d0ri205/CVE-2026-24858","u":"https://github.com/m0d0ri205/CVE-2026-24858","s":0,"c":1769610890000,"d":"아직 제로데이인거 같아, 공개되거나 천천히 분석할 예정...."},{"n":"SimoesCTT/-CTT-NSP-Convergent-Time-Theory---Network-Stack-Projection-CVE-2026-24858-","u":"https://github.com/SimoesCTT/-CTT-NSP-Convergent-Time-Theory---Network-Stack-Projection-CVE-2026-24858-","s":0,"c":1769747244000,"d":" A Proof-of-Concept demonstrating the application of 3D Navier-Stokes CTT formulations to packet flow optimization and defensive bypass."},{"n":"SimoesCTT/SCTT-2026-33-0004-FortiCloud-SSO-Identity-Singularity","u":"https://github.com/SimoesCTT/SCTT-2026-33-0004-FortiCloud-SSO-Identity-Singularity","s":0,"c":1769852464000,"d":"While Fortinet's January 27, 2026 mitigation for **CVE-2026-24858** focuses on blocking specific accounts like `cloud-noc@mail.io`, it fails"}]},"CVE-2018-14634":{"n":1,"first":1539022323000,"top":[{"n":"luan0ap/cve-2018-14634","u":"https://github.com/luan0ap/cve-2018-14634","s":8,"c":1539022323000,"d":"proof-of-concept (PoC) for linux dists based on Debian, CentOS and RedHat - exploit 1"}]},"CVE-2025-52691":{"n":9,"first":1767075190000,"top":[{"n":"rxerium/CVE-2025-52691","u":"https://github.com/rxerium/CVE-2025-52691","s":19,"c":1767075190000,"d":"Detection for CVE-2025-52691"},{"n":"watchtowrlabs/watchTowr-vs-SmarterMail-CVE-2025-52691","u":"https://github.com/watchtowrlabs/watchTowr-vs-SmarterMail-CVE-2025-52691","s":19,"c":1767872521000,"d":""},{"n":"DeathShotXD/CVE-2025-52691-APT-PoC","u":"https://github.com/DeathShotXD/CVE-2025-52691-APT-PoC","s":5,"c":1767118889000,"d":"An enhanced proof-of-concept exploit for CVE-2025-52691 (SmarterMail Arbitrary File Upload RCE) with APT-level features like stealth obfusca"},{"n":"rimbadirgantara/CVE-2025-52691-poc","u":"https://github.com/rimbadirgantara/CVE-2025-52691-poc","s":3,"c":1768096839000,"d":""},{"n":"you-ssef9/CVE-2025-52691","u":"https://github.com/you-ssef9/CVE-2025-52691","s":1,"c":1767106729000,"d":"This repository contains a safe Proof of Concept (PoC) to detect vulnerable SmarterMail versions affected by CVE‑2025‑52691.  The script per"}]},"CVE-2026-23760":{"n":2,"first":1769257834000,"top":[{"n":"MaxMnMl/smartermail-CVE-2026-23760-poc","u":"https://github.com/MaxMnMl/smartermail-CVE-2026-23760-poc","s":8,"c":1769257834000,"d":"CVE-2026-23760 - An authentication bypass via password reset API in SmarterMail."},{"n":"HORKimhab/CVE-2026-0001","u":"https://github.com/HORKimhab/CVE-2026-0001","s":0,"c":1778654296000,"d":"CVE-2026-0001. Do with your own risk"}]},"CVE-2026-24061":{"n":69,"first":1768992557000,"top":[{"n":"SafeBreach-Labs/CVE-2026-24061","u":"https://github.com/SafeBreach-Labs/CVE-2026-24061","s":208,"c":1769106617000,"d":"Exploitation of CVE-2026-24061"},{"n":"JayGLXR/CVE-2026-24061-POC","u":"https://github.com/JayGLXR/CVE-2026-24061-POC","s":68,"c":1769092070000,"d":""},{"n":"ZeroDayEvil/CVE-2026-24061","u":"https://github.com/ZeroDayEvil/CVE-2026-24061","s":22,"c":1790621522000,"d":""},{"n":"parameciumzhang/Tell-Me-Root","u":"https://github.com/parameciumzhang/Tell-Me-Root","s":21,"c":1769089494000,"d":"基于cve-2026-24061 telnet远程认证绕过漏洞的批量检测利用工具"},{"n":"Lingzesec/CVE-2026-24061-GUI","u":"https://github.com/Lingzesec/CVE-2026-24061-GUI","s":17,"c":1769421484000,"d":"CVE-2026-24061 GNU Inetutils telnetd 身份验证绕过漏洞检测与利用 GUI 工具"}]},"CVE-2026-21509":{"n":13,"first":1769515400000,"top":[{"n":"gavz/CVE-2026-21509-PoC","u":"https://github.com/gavz/CVE-2026-21509-PoC","s":20,"c":1769647878000,"d":"Educational PoC for CVE‑2026‑21509 (Microsoft Office security feature bypass). Generates a harmless DOCX with dummy OLE artifacts to study E"},{"n":"kimstars/Ashwesker-CVE-2026-21509","u":"https://github.com/kimstars/Ashwesker-CVE-2026-21509","s":12,"c":1769515400000,"d":"CVE-2026-21509"},{"n":"suuhm/CVE-2026-21509-handler","u":"https://github.com/suuhm/CVE-2026-21509-handler","s":8,"c":1772384437000,"d":"PowerShell script to check, apply, and test the Kill-Bit protection for the CVE-2026-21509 Microsoft Office zero-day vulnerability affecting"},{"n":"SimoesCTT/CTT-NFS-Vortex-RCE","u":"https://github.com/SimoesCTT/CTT-NFS-Vortex-RCE","s":3,"c":1769835133000,"d":"New Physics Disclosure This repository contains a full weaponized exploit for **CVE-2026-21509**, targeting the Windows Network File System "},{"n":"SimoesCTT/CTT-MICROSOFT-OFFICE-OLE-MANIFOLD-BYPASS-CVE-2026-21509","u":"https://github.com/SimoesCTT/CTT-MICROSOFT-OFFICE-OLE-MANIFOLD-BYPASS-CVE-2026-21509","s":3,"c":1769967084000,"d":"CVE-2026-21509 is a critical bypass in the Microsoft Office OLE (Object Linking and Embedding) validation engine. While standard \"laminar\" e"}]},"CVE-2025-68645":{"n":7,"first":1767136188000,"top":[{"n":"MaxMnMl/zimbramail-CVE-2025-68645-poc","u":"https://github.com/MaxMnMl/zimbramail-CVE-2025-68645-poc","s":3,"c":1767263383000,"d":"CVE-2025-68645 - A Local File Inclusion (LFI) vulnerability in the Webmail Classic UI of Zimbra Collaboration"},{"n":"codeb0ssx/CVE-2025-68645-PoC","u":"https://github.com/codeb0ssx/CVE-2025-68645-PoC","s":2,"c":1767136188000,"d":"Academic proof-of-concept demonstrating CVE-2025-68645 for authorized security research."},{"n":"0xBlackash/CVE-2025-68645","u":"https://github.com/0xBlackash/CVE-2025-68645","s":2,"c":1777067542000,"d":"CVE-2025-68645"},{"n":"HarisAidhin/Poc_CVE-2025-68645","u":"https://github.com/HarisAidhin/Poc_CVE-2025-68645","s":1,"c":1778052104000,"d":"Zimbra Path Traversal (CVE-2025-68645) - Unauthenticated   file read vulnerability in Zimbra Collaboration Suite  "},{"n":"faysalferdous/CVE-2025-68645-Exploiting-Zimbra-Webmail-LFI-Vulnerability","u":"https://github.com/faysalferdous/CVE-2025-68645-Exploiting-Zimbra-Webmail-LFI-Vulnerability","s":0,"c":1770697732000,"d":""}]},"CVE-2025-31125":{"n":4,"first":1743517484000,"top":[{"n":"sunhuiHi666/CVE-2025-31125","u":"https://github.com/sunhuiHi666/CVE-2025-31125","s":6,"c":1743517484000,"d":"Vite 任意文件读取漏洞POC"},{"n":"MuhammadWaseem29/Vitejs-exploit","u":"https://github.com/MuhammadWaseem29/Vitejs-exploit","s":0,"c":1746297702000,"d":" Vite Development Server's @fs endpoint (CVE-2025-31125) to access sensitive files like /etc/passwd and /etc/hosts via crafted URLs."},{"n":"0xgh057r3c0n/CVE-2025-31125","u":"https://github.com/0xgh057r3c0n/CVE-2025-31125","s":0,"c":1746603910000,"d":"Vite WASM Import Path Traversal 🛡️"},{"n":"harshgupptaa/Path-Transversal-CVE-2025-31125-","u":"https://github.com/harshgupptaa/Path-Transversal-CVE-2025-31125-","s":0,"c":1752424961000,"d":"Vite is a frontend tooling framework for javascript. Vite exposes content of non-allowed files using ?inline&import or ?raw?import. Only app"}]},"CVE-2025-54313":{"n":2,"first":1753529540000,"top":[{"n":"nihilor/cve-2025-54313","u":"https://github.com/nihilor/cve-2025-54313","s":0,"c":1753529540000,"d":"Checks projects for compromised packages, suspicious files, and import statements."},{"n":"Paspke/scavenger_scanner","u":"https://github.com/Paspke/scavenger_scanner","s":0,"c":1753569915000,"d":"Detect CVE-2025-54313 eslint-config-prettier supply chain attack IOCs on Windows"}]},"CVE-2026-20045":{"n":1,"first":1769302891000,"top":[{"n":"dkstar11q/Ashwesker-CVE-2026-20045","u":"https://github.com/dkstar11q/Ashwesker-CVE-2026-20045","s":6,"c":1769302891000,"d":"CVE-2026-20045"}]},"CVE-2026-20805":{"n":6,"first":1768397186000,"top":[{"n":"ZeroDayEvil/CVE-2026-20805-PoC","u":"https://github.com/ZeroDayEvil/CVE-2026-20805-PoC","s":92,"c":1789039718000,"d":"🛡️ Official AI Security Tool module for CVE-2026-20805 (Desktop Window Manager / dwm.exe Information Disclosure & Memory Leak Diagnostic)."},{"n":"fevar54/CVE-2026-20805-POC","u":"https://github.com/fevar54/CVE-2026-20805-POC","s":7,"c":1768397186000,"d":"PoC de CVE-2026-20805: divulgacion de informacion en Desktop Window Manager (dwm.exe) de Windows."},{"n":"Uzair-Baig0900/CVE-2026-20805-PoC","u":"https://github.com/Uzair-Baig0900/CVE-2026-20805-PoC","s":2,"c":1768850185000,"d":"The PoC of information disclosure in Microsoft Desktop Windows Management."},{"n":"SimoesCTT/-SCTT-2026-33-0002-DWM-Visual-Field-Singularity","u":"https://github.com/SimoesCTT/-SCTT-2026-33-0002-DWM-Visual-Field-Singularity","s":1,"c":1769841656000,"d":"### 📡 Theoretical Classification **ID:** SCTT-2026-33-0002   **Researcher:** Americo Simoes (SimoesCTT)   **Physics:** Theorem 4.2 - Turbul"},{"n":"mrk336/Inside-CVE-2026-20805-How-a-Windows-DWM-Flaw-Exposed-Sensitive-Data","u":"https://github.com/mrk336/Inside-CVE-2026-20805-How-a-Windows-DWM-Flaw-Exposed-Sensitive-Data","s":0,"c":1769572236000,"d":"CVE‑2026‑20805: A Windows Desktop Window Manager flaw causing local information disclosure. Requires low privileges, no user interaction. Ra"}]},"CVE-2025-8110":{"n":21,"first":1765449478000,"top":[{"n":"zAbuQasem/gogs-CVE-2025-8110","u":"https://github.com/zAbuQasem/gogs-CVE-2025-8110","s":30,"c":1765599323000,"d":"CVE-2025-8110 PoC"},{"n":"rxerium/CVE-2025-8110","u":"https://github.com/rxerium/CVE-2025-8110","s":22,"c":1765449478000,"d":"Detection template for CVE-2025-8110"},{"n":"Ghxstsec/CVE-2025-8110","u":"https://github.com/Ghxstsec/CVE-2025-8110","s":5,"c":1775947207000,"d":""},{"n":"joaquinrrr/CVE-2025-8110","u":"https://github.com/joaquinrrr/CVE-2025-8110","s":5,"c":1782406098000,"d":"PoC exploit for CVE-2025-8110"},{"n":"kayl22/cve-2025-8110-GOGS-RCE","u":"https://github.com/kayl22/cve-2025-8110-GOGS-RCE","s":4,"c":1775949011000,"d":"GOGS RCE cve-2025-8110 python script that automates the whole attack chain of creating a repository with a symlink file pointing to .git/con"}]},"CVE-2025-37164":{"n":3,"first":1766065312000,"top":[{"n":"g0vguy/CVE-2025-37164-PoC","u":"https://github.com/g0vguy/CVE-2025-37164-PoC","s":6,"c":1766181651000,"d":"PoC for CVE-2025-37164"},{"n":"rxerium/CVE-2025-37164","u":"https://github.com/rxerium/CVE-2025-37164","s":3,"c":1766065312000,"d":"Detection for CVE-2025-37164"},{"n":"LACHHAB-Anas/Exploit_CVE-2025-37164","u":"https://github.com/LACHHAB-Anas/Exploit_CVE-2025-37164","s":1,"c":1767738205000,"d":"Exploit for the CVE-2025-37164"}]},"CVE-2025-14847":{"n":39,"first":1753890720000,"top":[{"n":"cybertechajju/CVE-2025-14847_Expolit","u":"https://github.com/cybertechajju/CVE-2025-14847_Expolit","s":35,"c":1766847710000,"d":"a critical memory disclosure vulnerability in MongoDB's zlib compression handling. This tool allows security researchers to extract sensitiv"},{"n":"Black1hp/mongobleed-scanner","u":"https://github.com/Black1hp/mongobleed-scanner","s":35,"c":1766872623000,"d":"MongoDB CVE-2025-14847 Heap Memory Leak Scanner | OP_COMPRESSED zlib Vulnerability | Bug Bounty & Red Team Tool"},{"n":"ProbiusOfficial/CVE-2025-14847","u":"https://github.com/ProbiusOfficial/CVE-2025-14847","s":26,"c":1766734712000,"d":"poc for CVE-2025-14847"},{"n":"onewinner/CVE-2025-14847","u":"https://github.com/onewinner/CVE-2025-14847","s":15,"c":1766729611000,"d":" MongoDB 内存泄露漏洞 (CVE-2025-14847) 检测工具"},{"n":"Security-Phoenix-demo/mongobleed-exploit-CVE-2025-14847","u":"https://github.com/Security-Phoenix-demo/mongobleed-exploit-CVE-2025-14847","s":13,"c":1766998853000,"d":"Exploit lab, docker and code scanner for mongobleed Vulnerability CVE-2025-14847 plus Phoenix Security Sync tools"}]},"CVE-2025-14733":{"n":1,"first":1766496300000,"top":[{"n":"machevalia/CVE-2025-14733","u":"https://github.com/machevalia/CVE-2025-14733","s":0,"c":1766496300000,"d":""}]},"CVE-2025-40602":{"n":2,"first":1766043176000,"top":[{"n":"rxerium/CVE-2025-40602","u":"https://github.com/rxerium/CVE-2025-40602","s":3,"c":1766043176000,"d":"Detection for CVE-2025-40602"},{"n":"cyberleelawat/CVE-2025-40602","u":"https://github.com/cyberleelawat/CVE-2025-40602","s":1,"c":1766054876000,"d":"CVE-2025-40602 is a local privilege escalation vulnerability in the appliance management console (AMC) of SonicWall Secure Mobile Access (SM"}]},"CVE-2025-20393":{"n":4,"first":1766052171000,"top":[{"n":"cyberleelawat/CVE-2025-20393","u":"https://github.com/cyberleelawat/CVE-2025-20393","s":2,"c":1766052171000,"d":"Cisco is aware of a potential vulnerability.&nbsp; Cisco is currently investigating and&nbsp;will update these details as appropriate&nbsp;a"},{"n":"KingHacker353/CVE-2025-20393","u":"https://github.com/KingHacker353/CVE-2025-20393","s":0,"c":1766059851000,"d":""},{"n":"redpack-kr/Blackash-CVE-2025-20393","u":"https://github.com/redpack-kr/Blackash-CVE-2025-20393","s":0,"c":1766950341000,"d":"CVE-2025-20393"},{"n":"cyberdudebivash/CYBERDUDEBIVASH-Cisco-AsyncOS-CVE-2025-20393-Scanner","u":"https://github.com/cyberdudebivash/CYBERDUDEBIVASH-Cisco-AsyncOS-CVE-2025-20393-Scanner","s":0,"c":1768584890000,"d":"This tool helps identify exposure to CVE-2025-20393 by checking for open TCP/6025 ports, responsive Spam Quarantine interfaces, and known po"}]},"CVE-2025-59718":{"n":2,"first":1765971202000,"top":[{"n":"exfil0/CVE-2025-59718-PoC","u":"https://github.com/exfil0/CVE-2025-59718-PoC","s":6,"c":1765971202000,"d":"Fortinet announced two closely related authentication‑bypass vulnerabilities on 9 December 2025. Both flaws involve improper verification of"},{"n":"moften/CVE-2025-59718-Fortinet-Poc","u":"https://github.com/moften/CVE-2025-59718-Fortinet-Poc","s":3,"c":1766809456000,"d":"PoC para determinar si Fortinet es vulnerable a CVE-2025-59718 / CVE-2025-59719"}]},"CVE-2025-14611":{"n":1,"first":1767007267000,"top":[{"n":"pl4tyz/CVE-2025-14611-CentreStack-and-Triofox-full-Poc-Exploit","u":"https://github.com/pl4tyz/CVE-2025-14611-CentreStack-and-Triofox-full-Poc-Exploit","s":0,"c":1767007267000,"d":"CVE-2025-14611 CentreStack and Triofox full Poc/Exploit"}]},"CVE-2025-43529":{"n":7,"first":1767656621000,"top":[{"n":"0xjohnnydev/WebKit-UAF-ANGLE-OOB-Analysis","u":"https://github.com/0xjohnnydev/WebKit-UAF-ANGLE-OOB-Analysis","s":113,"c":1768278900000,"d":"Analysis of CVE-2025-43529 (WebKit UAF) + CVE-2025-14174 (ANGLE OOB) exploit chain - iOS Safari"},{"n":"GenericCoding/pois0nSword","u":"https://github.com/GenericCoding/pois0nSword","s":108,"c":1781153336000,"d":"A demonstration of read write using cve-2025-43529 and userland PAC bypass on iOS 26.1"},{"n":"jir4vv1t/CVE-2025-43529","u":"https://github.com/jir4vv1t/CVE-2025-43529","s":86,"c":1767656621000,"d":"exploit for cve-2025-43529"},{"n":"bjrjk/CVE-2025-43529","u":"https://github.com/bjrjk/CVE-2025-43529","s":18,"c":1769945770000,"d":"Root Cause Analysis for CVE-2025-43529, a UAF vulnerability due to incorrect DFG StoreBarrierInsertionPhase in JavaScriptCore."},{"n":"SimoesCTT/Convergent-Time-Theory-Enhanced-iOS-Safari-RCE-CVE-2025-43529-","u":"https://github.com/SimoesCTT/Convergent-Time-Theory-Enhanced-iOS-Safari-RCE-CVE-2025-43529-","s":1,"c":1769572201000,"d":"CTT-Enhanced iOS Safari Exploit (based on CVE-2025-43529)"}]},"CVE-2025-14174":{"n":3,"first":1766059103000,"top":[{"n":"Satirush/CVE-2025-14174-Poc","u":"https://github.com/Satirush/CVE-2025-14174-Poc","s":10,"c":1766059103000,"d":"Proof-of-Concept exploit for CVE-2025-14174 (EUVD-2025-203113) - Memory corruption in ANGLE allowing out-of-bounds access and RCE in web bro"},{"n":"typeconfused/CVE-2025-14174-analysis","u":"https://github.com/typeconfused/CVE-2025-14174-analysis","s":3,"c":1767499653000,"d":"Analysis and PoC for CVE-2025-14174 - ANGLE Metal OOB write (iOS Safari, macOS Chrome)"},{"n":"George0Papasotiriou/CVE-2025-14174-Chrome-Zero-Day","u":"https://github.com/George0Papasotiriou/CVE-2025-14174-Chrome-Zero-Day","s":3,"c":1770683210000,"d":""}]},"CVE-2025-58360":{"n":6,"first":1764204457000,"top":[{"n":"quyenheu/CVE-2025-58360","u":"https://github.com/quyenheu/CVE-2025-58360","s":7,"c":1764228045000,"d":"XXE through a specific endpoint /geoserver/wms operation GetMap - Geoserver"},{"n":"quyenheu/Bypass-CVE-2025-58360","u":"https://github.com/quyenheu/Bypass-CVE-2025-58360","s":1,"c":1767152993000,"d":"A new way to exploit CVE-2025-58360 bypass WAF"},{"n":"thomas-osgood/cve-2025-58360","u":"https://github.com/thomas-osgood/cve-2025-58360","s":1,"c":1770004288000,"d":""},{"n":"carlzhang123/Blackash-CVE-2025-58360","u":"https://github.com/carlzhang123/Blackash-CVE-2025-58360","s":0,"c":1764204457000,"d":"CVE-2025-58360"},{"n":"rxerium/CVE-2025-58360","u":"https://github.com/rxerium/CVE-2025-58360","s":0,"c":1765521208000,"d":"Passive detection for CVE-2025-58360"}]},"CVE-2025-6218":{"n":6,"first":1750983063000,"top":[{"n":"skimask1690/CVE-2025-6218-POC","u":"https://github.com/skimask1690/CVE-2025-6218-POC","s":29,"c":1751348097000,"d":"Proof of Concept for CVE-2025-6218, demonstrating the exploitation of a vulnerability in WinRAR versions 7.11 and under, involving improper "},{"n":"absholi7ly/CVE-2025-6218-WinRAR-Directory-Traversal-RCE","u":"https://github.com/absholi7ly/CVE-2025-6218-WinRAR-Directory-Traversal-RCE","s":19,"c":1752111459000,"d":"CVE-2025-6218 is a directory traversal vulnerability in WinRAR that allows an attacker to place files outside the intended extraction direct"},{"n":"speinador/CVE-2025-6218_WinRAR","u":"https://github.com/speinador/CVE-2025-6218_WinRAR","s":16,"c":1750983063000,"d":""},{"n":"ignis-sec/CVE-2025-6218","u":"https://github.com/ignis-sec/CVE-2025-6218","s":12,"c":1751224013000,"d":"A simple proof of concept for WinRAR Path Traversal | RCE | CVE-2025-6218"},{"n":"mulwareX/CVE-2025-6218-POC","u":"https://github.com/mulwareX/CVE-2025-6218-POC","s":10,"c":1751518334000,"d":"RARLAB WinRAR Directory Traversal Remote Code Execution"}]},"CVE-2025-62221":{"n":1,"first":1768762528000,"top":[{"n":"Teodor1231241/DEMO-Proof-of-Concept-Temporal-Memory-Inconsistency-in-cldflt.sys-CVE-2025-62221","u":"https://github.com/Teodor1231241/DEMO-Proof-of-Concept-Temporal-Memory-Inconsistency-in-cldflt.sys-CVE-2025-62221","s":2,"c":1768762528000,"d":""}]},"CVE-2025-55182":{"n":463,"first":1655461150000,"top":[{"n":"assetnote/react2shell-scanner","u":"https://github.com/assetnote/react2shell-scanner","s":2453,"c":1764831304000,"d":"High Fidelity Detection Mechanism for RSC/Next.js RCE (CVE-2025-55182 & CVE-2025-66478)"},{"n":"msanft/CVE-2025-55182","u":"https://github.com/msanft/CVE-2025-55182","s":1431,"c":1764848995000,"d":"Explanation and full RCE PoC for CVE-2025-55182"},{"n":"lachlan2k/React2Shell-CVE-2025-55182-original-poc","u":"https://github.com/lachlan2k/React2Shell-CVE-2025-55182-original-poc","s":1064,"c":1764921607000,"d":"Original Proof-of-Concepts for React2Shell CVE-2025-55182"},{"n":"ejpir/CVE-2025-55182-research","u":"https://github.com/ejpir/CVE-2025-55182-research","s":790,"c":1764796582000,"d":"CVE-2025-55182 POC"},{"n":"mrknow001/RSC_Detector","u":"https://github.com/mrknow001/RSC_Detector","s":587,"c":1764914005000,"d":"Supports RSC fingerprinting and exploitation of the React component vulnerability CVE-2025-55182."}]},"CVE-2021-26828":{"n":3,"first":1617158342000,"top":[{"n":"hev0x/CVE-2021-26828_ScadaBR_RCE","u":"https://github.com/hev0x/CVE-2021-26828_ScadaBR_RCE","s":9,"c":1617158342000,"d":""},{"n":"ridpath/CVE-2021-26828-Ultimate","u":"https://github.com/ridpath/CVE-2021-26828-Ultimate","s":5,"c":1748566771000,"d":"ScadaFlare Authenticated RCE Exploit Framework for ScadaBR (CVE-2021-26828) OpenPLC ScadaBR "},{"n":"h002733/CVE-2021-26828","u":"https://github.com/h002733/CVE-2021-26828","s":0,"c":1791528646000,"d":"Corrected python code for CVE-2021-26828 "}]},"CVE-2025-61757":{"n":2,"first":1763713510000,"top":[{"n":"Jinxia62/Oracle-Identity-Manager-CVE-2025-61757","u":"https://github.com/Jinxia62/Oracle-Identity-Manager-CVE-2025-61757","s":3,"c":1763713510000,"d":"Oracle Identity Manager 远程代码执行漏洞CVE-2025-61757"},{"n":"ngominhquocngu/Blackash-CVE-2025-61757","u":"https://github.com/ngominhquocngu/Blackash-CVE-2025-61757","s":0,"c":1764056961000,"d":"CVE-2025-61757"}]},"CVE-2025-64446":{"n":13,"first":1763143824000,"top":[{"n":"sensepost/CVE-2025-64446","u":"https://github.com/sensepost/CVE-2025-64446","s":34,"c":1763380698000,"d":"A scanner for the FortiNet vulnerability CVE-2025-64446"},{"n":"soltanali0/CVE-2025-64446-Exploit","u":"https://github.com/soltanali0/CVE-2025-64446-Exploit","s":15,"c":1763229668000,"d":""},{"n":"sxyrxyy/CVE-2025-64446-FortiWeb-CGI-Bypass-PoC","u":"https://github.com/sxyrxyy/CVE-2025-64446-FortiWeb-CGI-Bypass-PoC","s":14,"c":1763149787000,"d":""},{"n":"fevar54/CVE-2025-64446-PoC---FortiWeb-Path-Traversal","u":"https://github.com/fevar54/CVE-2025-64446-PoC---FortiWeb-Path-Traversal","s":7,"c":1763143824000,"d":"PoC de CVE-2025-64446: path traversal a RCE en Fortinet FortiWeb. Solo uso educativo."},{"n":"verylazytech/CVE-2025-64446","u":"https://github.com/verylazytech/CVE-2025-64446","s":3,"c":1763404126000,"d":"CVE-2025-64446 - A relative path traversal vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.1, FortiWeb 7.6.0 through 7.6.4, FortiWeb 7."}]},"CVE-2025-62215":{"n":7,"first":1763442814000,"top":[{"n":"abrewer251/CVE-2025-62215_Windows_Kernel_PE","u":"https://github.com/abrewer251/CVE-2025-62215_Windows_Kernel_PE","s":21,"c":1763482364000,"d":"This PoC demonstrates a race condition in the Windows kernel leading to a double-free vulnerability, allowing local privilege escalation to "},{"n":"gowonisgood/CVE-2025-62215-POC","u":"https://github.com/gowonisgood/CVE-2025-62215-POC","s":11,"c":1772447647000,"d":""},{"n":"mrk336/Kernel-Chaos-Weaponizing-CVE-2025-62215-for-SYSTEM-Privilege-Escalation","u":"https://github.com/mrk336/Kernel-Chaos-Weaponizing-CVE-2025-62215-for-SYSTEM-Privilege-Escalation","s":3,"c":1763442814000,"d":"Hands‑on analysis of CVE‑2025‑62215, a Windows Kernel race condition exploited in the wild. Demonstrates privilege escalation to SYSTEM, det"},{"n":"theman001/CVE-2025-62215","u":"https://github.com/theman001/CVE-2025-62215","s":2,"c":1766473555000,"d":"CVE-2025-62215: Windows Kernel Race Condition + Double-Free EoP"},{"n":"nullxall/cve-2025-62215-exploit-poc","u":"https://github.com/nullxall/cve-2025-62215-exploit-poc","s":1,"c":1763507392000,"d":"CVE-2025-62215 is an Elevation of Privilege (EoP) vulnerability in the Windows Kernel, disclosed in November 2025 and confirmed to be active"}]},"CVE-2025-9242":{"n":1,"first":1759323682000,"top":[{"n":"watchtowrlabs/watchTowr-vs-WatchGuard-CVE-2025-9242","u":"https://github.com/watchtowrlabs/watchTowr-vs-WatchGuard-CVE-2025-9242","s":13,"c":1759323682000,"d":""}]},"CVE-2025-21042":{"n":1,"first":1762857730000,"top":[{"n":"patricnilackshan/Samsung-CVE-2025-21042","u":"https://github.com/patricnilackshan/Samsung-CVE-2025-21042","s":0,"c":1762857730000,"d":"CVE-2025-21042"}]},"CVE-2025-48703":{"n":2,"first":1750947576000,"top":[{"n":"Skynoxk/CVE-2025-48703","u":"https://github.com/Skynoxk/CVE-2025-48703","s":3,"c":1750947576000,"d":"Remote Code execution in CentOS web panel "},{"n":"itstarsec/CVE-2025-48703","u":"https://github.com/itstarsec/CVE-2025-48703","s":0,"c":1754015674000,"d":"CVE-2025-48703 là lỗ hổng mức độ nghiêm trọng trong CentOS Web Panel (CWP) cho phép kẻ tấn công không xác thực (unauthenticated) có thể thực"}]},"CVE-2025-11371":{"n":3,"first":1760092017000,"top":[{"n":"rxerium/CVE-2025-11371","u":"https://github.com/rxerium/CVE-2025-11371","s":6,"c":1760092017000,"d":"Detection for CVE-2025-11371"},{"n":"lap1nou/CVE-2025-11371","u":"https://github.com/lap1nou/CVE-2025-11371","s":1,"c":1760205656000,"d":"CVE-2025-11371 PoC, credit goes to Huntress, https://www.huntress.com/blog/gladinet-centrestack-triofox-local-file-inclusion-flaw"},{"n":"NetVanguard-cmd/CVE-2025-11371","u":"https://github.com/NetVanguard-cmd/CVE-2025-11371","s":1,"c":1760537443000,"d":""}]},"CVE-2025-41244":{"n":3,"first":1759232420000,"top":[{"n":"NULL200OK/CVE-2025-41244","u":"https://github.com/NULL200OK/CVE-2025-41244","s":2,"c":1762876420000,"d":"CVE-2025-41244 is a critical local privilege escalation vulnerability in VMware Aria Operations and VMware Tools"},{"n":"rxerium/CVE-2025-41244","u":"https://github.com/rxerium/CVE-2025-41244","s":1,"c":1759232420000,"d":"Detection for CVE-2025-41244"},{"n":"haspiranti/CVE-2025-41244-PoC","u":"https://github.com/haspiranti/CVE-2025-41244-PoC","s":0,"c":1759714521000,"d":"VMware Aria Operations < 4.18.5 & VMware Tools - Local Privilege Escalation"}]},"CVE-2025-24893":{"n":45,"first":1740467511000,"top":[{"n":"gunzf0x/CVE-2025-24893","u":"https://github.com/gunzf0x/CVE-2025-24893","s":23,"c":1754274557000,"d":"PoC for CVE-2025-24893: XWiki' Remote Code Execution exploit for versions prior to 15.10.11, 16.4.1 and 16.5.0RC1."},{"n":"dollarboysushil/CVE-2025-24893-XWiki-Unauthenticated-RCE-Exploit-POC","u":"https://github.com/dollarboysushil/CVE-2025-24893-XWiki-Unauthenticated-RCE-Exploit-POC","s":17,"c":1754326228000,"d":"CVE-2025-24893 is a critical unauthenticated remote code execution vulnerability in XWiki (versions < 15.10.11, 16.4.1, 16.5.0RC1) caused by"},{"n":"b0ySie7e/CVE-2025-24893","u":"https://github.com/b0ySie7e/CVE-2025-24893","s":11,"c":1756938353000,"d":""},{"n":"iSee857/CVE-2025-24893-PoC","u":"https://github.com/iSee857/CVE-2025-24893-PoC","s":10,"c":1740467511000,"d":"XWiki SolrSearchMacros 远程代码执行漏洞PoC（CVE-2025-24893）"},{"n":"Infinit3i/CVE-2025-24893","u":"https://github.com/Infinit3i/CVE-2025-24893","s":6,"c":1754232577000,"d":"PoC exploits CVE-2025-24893 , a remote code execution (RCE) vulnerability in XWiki caused by improper sandboxing in Groovy macros rendered a"}]},"CVE-2025-54236":{"n":7,"first":1757488752000,"top":[{"n":"wubinworks/magento2-session-reaper-patch","u":"https://github.com/wubinworks/magento2-session-reaper-patch","s":4,"c":1760836104000,"d":"Patch for CVE-2025-54236(a.k.a Session Reaper) which allows customer account takeover and RCE under certain conditions. This patch is actual"},{"n":"alexb616/SessionReaper-CVE-2025-54236","u":"https://github.com/alexb616/SessionReaper-CVE-2025-54236","s":1,"c":1773938350000,"d":"PoC Magento Session Reaper - CVE-2025-54236"},{"n":"amalpvatayam67/day01-sessionreaper-lab","u":"https://github.com/amalpvatayam67/day01-sessionreaper-lab","s":0,"c":1757488752000,"d":"This is a tiny lab that simulates the core idea reported for CVE-2025-54236 (“SessionReaper”)"},{"n":"Baba01hacker666/cve-2025-54236","u":"https://github.com/Baba01hacker666/cve-2025-54236","s":0,"c":1767076698000,"d":"cve-2025-54236 poc "},{"n":"Jenderal92/magento-upload-auto-submit-zoneh","u":"https://github.com/Jenderal92/magento-upload-auto-submit-zoneh","s":0,"c":1778643771000,"d":"SessionReaper-CVE-2025-54236"}]},"CVE-2025-59287":{"n":23,"first":1761359407000,"top":[{"n":"jiansiting/CVE-2025-59287","u":"https://github.com/jiansiting/CVE-2025-59287","s":174,"c":1761359407000,"d":"WSUS Unauthenticated RCE"},{"n":"mubix/Find-WSUS","u":"https://github.com/mubix/Find-WSUS","s":46,"c":1761589595000,"d":"Helps defenders find their WSUS configurations in the wake of CVE-2025-59287"},{"n":"Lupovis/Honeypot-for-CVE-2025-59287-WSUS","u":"https://github.com/Lupovis/Honeypot-for-CVE-2025-59287-WSUS","s":26,"c":1761559737000,"d":"Defensive PoC decoy for CVE-2025-59287 (WSUS) - emulates WSUS endpoints, captures request bodies and metadata, saves evidence for forensic a"},{"n":"tecxx/CVE-2025-59287-WSUS","u":"https://github.com/tecxx/CVE-2025-59287-WSUS","s":18,"c":1761573956000,"d":"powershell version of hawktrace POC exploit"},{"n":"garvitv14/CVE-2025-59287","u":"https://github.com/garvitv14/CVE-2025-59287","s":16,"c":1761405501000,"d":"Working exploit (PoC) for CVE-2025-59287 — WSUS vulnerability. Featured on Vulners and DeepWiki."}]},"CVE-2025-33073":{"n":11,"first":1749816914000,"top":[{"n":"mverschu/CVE-2025-33073","u":"https://github.com/mverschu/CVE-2025-33073","s":720,"c":1749816914000,"d":"PoC Exploit for the NTLM reflection SMB flaw."},{"n":"uziii2208/CVE-2025-33073","u":"https://github.com/uziii2208/CVE-2025-33073","s":67,"c":1763119020000,"d":"Universal exploitation tool for CVE-2025-33073 targeting Windows Domain Controllers with DNSAdmins privileges and WinRM enabled."},{"n":"SFRDevelopment/windows-smb-vulnerability-framework-cve-2025-33073","u":"https://github.com/SFRDevelopment/windows-smb-vulnerability-framework-cve-2025-33073","s":6,"c":1760792729000,"d":"Proof-of-Concept"},{"n":"EgCupCake/cupntlm-Automated-Exploit-For-CVE-2025-33073-","u":"https://github.com/EgCupCake/cupntlm-Automated-Exploit-For-CVE-2025-33073-","s":3,"c":1773058383000,"d":"cupntlm"},{"n":"obscura-cert/CVE-2025-33073","u":"https://github.com/obscura-cert/CVE-2025-33073","s":1,"c":1751134648000,"d":""}]},"CVE-2025-61884":{"n":1,"first":1761033715000,"top":[{"n":"JrExploit/Blackash-CVE-2025-61884","u":"https://github.com/JrExploit/Blackash-CVE-2025-61884","s":0,"c":1761033715000,"d":"CVE-2025-61884"}]},"CVE-2025-54253":{"n":3,"first":1754508480000,"top":[{"n":"AdityaBhatt3010/CVE-2025-54253-Inside-the-Adobe-AEM-Forms-Zero-Day","u":"https://github.com/AdityaBhatt3010/CVE-2025-54253-Inside-the-Adobe-AEM-Forms-Zero-Day","s":10,"c":1762248554000,"d":"Breaking down CVE-2025-54253 — an Adobe AEM-Forms exploit path from XXE to full remote code execution and its real-world impact."},{"n":"zoomdbz/AEMPWN","u":"https://github.com/zoomdbz/AEMPWN","s":4,"c":1770754214000,"d":"CVE-2025-54253  |  CVE-2025-54254 | Adobe Experience Manager Forms XXE → RCE Framework"},{"n":"Shivshantp/CVE-2025-54253-Exploit-Demo","u":"https://github.com/Shivshantp/CVE-2025-54253-Exploit-Demo","s":1,"c":1754508480000,"d":"Simulated PoC for CVE-2025-54253: Adobe AEM OGNL Injection Vulnerability"}]},"CVE-2025-47827":{"n":1,"first":1747737731000,"top":[{"n":"Zedeldi/CVE-2025-47827","u":"https://github.com/Zedeldi/CVE-2025-47827","s":4,"c":1747737731000,"d":"PoC and vulnerability report for CVE-2025-47827."}]},"CVE-2025-24990":{"n":2,"first":1760589848000,"top":[{"n":"moiz-2x/CVE-2025-24990_POC","u":"https://github.com/moiz-2x/CVE-2025-24990_POC","s":58,"c":1760589848000,"d":"Proof of Concept CVE-2025-24990 (Agere Systems's driver) "},{"n":"sentinel-aidefense/CVE-2025-24990","u":"https://github.com/sentinel-aidefense/CVE-2025-24990","s":0,"c":1785171618000,"d":"CVE-2025-24990 Research writeup"}]},"CVE-2021-43798":{"n":59,"first":1638821423000,"top":[{"n":"jas502n/Grafana-CVE-2021-43798","u":"https://github.com/jas502n/Grafana-CVE-2021-43798","s":370,"c":1638867736000,"d":"Grafana Unauthorized arbitrary file reading vulnerability"},{"n":"A-D-Team/grafanaExp","u":"https://github.com/A-D-Team/grafanaExp","s":270,"c":1638889894000,"d":"A exploit tool for Grafana Unauthorized arbitrary file reading vulnerability (CVE-2021-43798), it can burst plugins / extract secret_key / d"},{"n":"pedrohavay/exploit-grafana-CVE-2021-43798","u":"https://github.com/pedrohavay/exploit-grafana-CVE-2021-43798","s":46,"c":1639248570000,"d":"This is a proof-of-concept exploit for Grafana's Unauthorized Arbitrary File Read Vulnerability (CVE-2021-43798)."},{"n":"taythebot/CVE-2021-43798","u":"https://github.com/taythebot/CVE-2021-43798","s":43,"c":1638821423000,"d":"CVE-2021-43798 - Grafana 8.x Path Traversal (Pre-Auth)"},{"n":"zer0yu/CVE-2021-43798","u":"https://github.com/zer0yu/CVE-2021-43798","s":27,"c":1638867551000,"d":"Grafana Arbitrary File Reading Vulnerability"}]},"CVE-2021-22555":{"n":13,"first":1626344262000,"top":[{"n":"veritas501/CVE-2021-22555-PipeVersion","u":"https://github.com/veritas501/CVE-2021-22555-PipeVersion","s":40,"c":1649140525000,"d":"CVE-2021-22555 exploit rewritten with pipe primitive"},{"n":"xyjl-ly/CVE-2021-22555-Exploit","u":"https://github.com/xyjl-ly/CVE-2021-22555-Exploit","s":14,"c":1626400441000,"d":"CVE-2021-22555 Exploit"},{"n":"cgwalters/container-cve-2021-22555","u":"https://github.com/cgwalters/container-cve-2021-22555","s":4,"c":1626462777000,"d":""},{"n":"tukru/CVE-2021-22555","u":"https://github.com/tukru/CVE-2021-22555","s":3,"c":1691261778000,"d":"This repo hosts TUKRU's Linux Privilege Escalation exploit (CVE-2021-22555). It demonstrates gaining root privileges via a vulnerability. Te"},{"n":"JoneyJunior/cve-2021-22555","u":"https://github.com/JoneyJunior/cve-2021-22555","s":1,"c":1626344262000,"d":""}]},"CVE-2021-43226":{"n":1,"first":1698648470000,"top":[{"n":"Rosayxy/cve-2021-43226PoC","u":"https://github.com/Rosayxy/cve-2021-43226PoC","s":2,"c":1698648470000,"d":"a Proof of Concept of cve-2021-43226,stack overflow in Windows driver clfs.sys"}]},"CVE-2025-61882":{"n":13,"first":1759689323000,"top":[{"n":"watchtowrlabs/watchTowr-vs-Oracle-E-Business-Suite-CVE-2025-61882","u":"https://github.com/watchtowrlabs/watchTowr-vs-Oracle-E-Business-Suite-CVE-2025-61882","s":55,"c":1759784184000,"d":""},{"n":"rxerium/CVE-2025-61882-CVE-2025-61884","u":"https://github.com/rxerium/CVE-2025-61882-CVE-2025-61884","s":35,"c":1759689323000,"d":"Detection for CVE-2025-61882 & CVE-2025-61884"},{"n":"zerozenxlabs/CVE-2025-61882-Oracle-EBS","u":"https://github.com/zerozenxlabs/CVE-2025-61882-Oracle-EBS","s":19,"c":1760120893000,"d":""},{"n":"AdityaBhatt3010/CVE-2025-61882-Oracle-E-Business-Suite-Pre-Auth-RCE-Exploit","u":"https://github.com/AdityaBhatt3010/CVE-2025-61882-Oracle-E-Business-Suite-Pre-Auth-RCE-Exploit","s":12,"c":1760628820000,"d":"A critical pre-authentication Remote Code Execution (RCE) flaw in Oracle E-Business Suite (versions 12.2.3 - 12.2.14) allows attackers to ga"},{"n":"Sachinart/CVE-2025-61882","u":"https://github.com/Sachinart/CVE-2025-61882","s":11,"c":1759788127000,"d":"Exploit for CVE-2025-61882 (do not use without any written permission). "}]},"CVE-2017-1000353":{"n":2,"first":1555075466000,"top":[{"n":"vulhub/CVE-2017-1000353","u":"https://github.com/vulhub/CVE-2017-1000353","s":57,"c":1555075466000,"d":"jenkins CVE-2017-1000353 POC"},{"n":"r00t4dm/Jenkins-CVE-2017-1000353","u":"https://github.com/r00t4dm/Jenkins-CVE-2017-1000353","s":3,"c":1665567038000,"d":""}]},"CVE-2015-7755":{"n":2,"first":1450470001000,"top":[{"n":"hdm/juniper-cve-2015-7755","u":"https://github.com/hdm/juniper-cve-2015-7755","s":105,"c":1450470001000,"d":"Notes, binaries, and related information from analysis of the CVE-2015-7755 & CVE-2015-7756 issues within Juniper ScreenOS"},{"n":"cinno/CVE-2015-7755-POC","u":"https://github.com/cinno/CVE-2015-7755-POC","s":2,"c":1452379747000,"d":""}]},"CVE-2025-32463":{"n":70,"first":1751369175000,"top":[{"n":"pr0v3rbs/CVE-2025-32463_chwoot","u":"https://github.com/pr0v3rbs/CVE-2025-32463_chwoot","s":529,"c":1751369175000,"d":"Escalation of Privilege to the root through sudo binary with chroot option. CVE-2025-32463"},{"n":"kh4sh3i/CVE-2025-32463","u":"https://github.com/kh4sh3i/CVE-2025-32463","s":476,"c":1751440820000,"d":"Local Privilege Escalation to Root via Sudo chroot in Linux"},{"n":"MohamedKarrab/CVE-2025-32463","u":"https://github.com/MohamedKarrab/CVE-2025-32463","s":50,"c":1752534476000,"d":"Privilege escalation to root using sudo chroot, NO NEED for gcc installed."},{"n":"K1tt3h/CVE-2025-32463-POC","u":"https://github.com/K1tt3h/CVE-2025-32463-POC","s":30,"c":1751377685000,"d":"CVE-2025-32463 Proof of concept"},{"n":"1xPwn/CVE-2025-32463","u":"https://github.com/1xPwn/CVE-2025-32463","s":26,"c":1754683241000,"d":"This CVE addresses a vulnerability in sudo versions 1.9.14 to 1.9.17, enabling unauthorized local privilege escalation to root access."}]},"CVE-2025-10035":{"n":4,"first":1758353713000,"top":[{"n":"rxerium/CVE-2025-10035","u":"https://github.com/rxerium/CVE-2025-10035","s":19,"c":1758353713000,"d":"Detection for CVE-2025-10035"},{"n":"ThemeHackers/CVE-2025-10035","u":"https://github.com/ThemeHackers/CVE-2025-10035","s":1,"c":1758438488000,"d":"A deserialization vulnerability in the License Servlet of Fortra's GoAnywhere MFT allows an actor with a validly forged license response sig"},{"n":"orange0Mint/CVE-2025-10035_GoAnywhere","u":"https://github.com/orange0Mint/CVE-2025-10035_GoAnywhere","s":0,"c":1758963050000,"d":"CVE-2025-10035_GoAnywhere Get RCE"},{"n":"sentinel-aidefense/CVE-2025-10035","u":"https://github.com/sentinel-aidefense/CVE-2025-10035","s":0,"c":1783689417000,"d":"CVE-2025-10035 Research writeup"}]},"CVE-2025-20352":{"n":2,"first":1758828086000,"top":[{"n":"scadastrangelove/CVE-2025-20352","u":"https://github.com/scadastrangelove/CVE-2025-20352","s":7,"c":1758828086000,"d":"CVE-2025-20352 SNMP Exposure Check (onesixtyone + parser)"},{"n":"sentinel-aidefense/CVE-2025-20352","u":"https://github.com/sentinel-aidefense/CVE-2025-20352","s":0,"c":1784630367000,"d":"CVE-2025-20352 Research writeup"}]},"CVE-2021-21311":{"n":3,"first":1644864893000,"top":[{"n":"llhala/CVE-2021-21311","u":"https://github.com/llhala/CVE-2021-21311","s":8,"c":1644864893000,"d":"Adminer is an open-source database management in a single PHP file. In adminer from version 4.0.0 and before 4.7.9 there is a server-side re"},{"n":"omoknooni/CVE-2021-21311","u":"https://github.com/omoknooni/CVE-2021-21311","s":3,"c":1686576772000,"d":""},{"n":"Sudo-WP/sudowp-adminer","u":"https://github.com/Sudo-WP/sudowp-adminer","s":1,"c":1769259436000,"d":"A secure, zero-trust database management tool for WordPress. Fixes critical SSRF vulnerabilities (CVE-2021-21311) by enforcing local connect"}]},"CVE-2025-20362":{"n":1,"first":1778970660000,"top":[{"n":"curtishoughton/CVE-2025-20362-Cisco-Scanner","u":"https://github.com/curtishoughton/CVE-2025-20362-Cisco-Scanner","s":1,"c":1778970660000,"d":"Safe Python scanner for CVE-2025-20362 (Cisco ASA/FTD WebVPN Authentication Bypass)"}]},"CVE-2025-20333":{"n":3,"first":1778969169000,"top":[{"n":"curtishoughton/Cisco-ASA-CVE-2025-20333-Scanner","u":"https://github.com/curtishoughton/Cisco-ASA-CVE-2025-20333-Scanner","s":0,"c":1778969169000,"d":"Safe Python scanner for Cisco CVE-2025-20333 (Cisco ASA/FTD WebVPN Buffer Overflow)"},{"n":"cobbbex/Cisco-ASA-vulnerability-research","u":"https://github.com/cobbbex/Cisco-ASA-vulnerability-research","s":0,"c":1787394201000,"d":"Cisco ASA vulnerability research CVE-2025-20333/CVE-2025-20362"},{"n":"cobbbex/cve-2025-20333","u":"https://github.com/cobbbex/cve-2025-20333","s":0,"c":1788186568000,"d":""}]},"CVE-2025-10585":{"n":1,"first":1758311608000,"top":[{"n":"AdityaBhatt3010/CVE-2025-10585-The-Chrome-V8-Zero-Day","u":"https://github.com/AdityaBhatt3010/CVE-2025-10585-The-Chrome-V8-Zero-Day","s":13,"c":1758311608000,"d":"Google patched CVE-2025-10585, a Chrome V8 zero-day under active exploitation — here’s what it is, why it matters, and how to stay safe."}]},"CVE-2025-38352":{"n":6,"first":1766361558000,"top":[{"n":"farazsth98/chronomaly","u":"https://github.com/farazsth98/chronomaly","s":311,"c":1767459138000,"d":"Android kernel exploit for CVE-2025-38352, previously exploited in-the-wild. Targets vulnerable x86_64 Linux kernels v5.10.x."},{"n":"farazsth98/poc-CVE-2025-38352","u":"https://github.com/farazsth98/poc-CVE-2025-38352","s":118,"c":1766361558000,"d":"This is a proof of concept for CVE-2025-38352, a vulnerability in the Linux kernel's POSIX CPU timers implementation. The September 2025 And"},{"n":"AnalyticETH/chronomaly-webos","u":"https://github.com/AnalyticETH/chronomaly-webos","s":17,"c":1780108630000,"d":"CVE-2025-38352 kernel exploit for LG webOS Smart TVs (ARM64). Achieves persistent root on real consumer hardware with novel exploitation tec"},{"n":"jordelmir/Elysium-Vanguard-Sentinel-Audit","u":"https://github.com/jordelmir/Elysium-Vanguard-Sentinel-Audit","s":2,"c":1771910705000,"d":"The official Sentinel Edition v7.11 - Hypervisor Detection & Kernel Memory Audit Suite for Honor Magic V2. Investigating CVE-2025-38352 and "},{"n":"Crime2/poc-CVE-2025-38352","u":"https://github.com/Crime2/poc-CVE-2025-38352","s":0,"c":1767881659000,"d":""}]},"CVE-2025-48543":{"n":1,"first":1757869728000,"top":[{"n":"gamesarchive/CVE-2025-48543","u":"https://github.com/gamesarchive/CVE-2025-48543","s":55,"c":1757869728000,"d":"PoC exploit for CVE-2025-48543 in C++"}]},"CVE-2025-53690":{"n":3,"first":1757015605000,"top":[{"n":"ErikLearningSec/CVE-2025-53690-POC","u":"https://github.com/ErikLearningSec/CVE-2025-53690-POC","s":8,"c":1762325404000,"d":"CVE-2025-53690 POC"},{"n":"rxerium/CVE-2025-53690","u":"https://github.com/rxerium/CVE-2025-53690","s":5,"c":1757015605000,"d":"Detection for CVE-2025-53690"},{"n":"m0d0ri205/CVE-2025-53690-Analysis","u":"https://github.com/m0d0ri205/CVE-2025-53690-Analysis","s":3,"c":1757215213000,"d":"This is CVE-2025-53690 Analysis Documents."}]},"CVE-2025-55177":{"n":1,"first":1777072259000,"top":[{"n":"danielw98/zero-click-exploit-analysis","u":"https://github.com/danielw98/zero-click-exploit-analysis","s":5,"c":1777072259000,"d":"CVE-2025-55177 + CVE-2025-43300: reverse-engineering the WhatsApp-ImageIO zero-click iOS chain, with interactive labs."}]},"CVE-2025-57819":{"n":26,"first":1756376133000,"top":[{"n":"watchtowrlabs/watchTowr-vs-FreePBX-CVE-2025-57819","u":"https://github.com/watchtowrlabs/watchTowr-vs-FreePBX-CVE-2025-57819","s":30,"c":1757345294000,"d":""},{"n":"0xEhab/FreePBX-CVE-2025-57819-RCE","u":"https://github.com/0xEhab/FreePBX-CVE-2025-57819-RCE","s":18,"c":1780778943000,"d":""},{"n":"MuhammadWaseem29/SQL-Injection-and-RCE_CVE-2025-57819","u":"https://github.com/MuhammadWaseem29/SQL-Injection-and-RCE_CVE-2025-57819","s":8,"c":1757699612000,"d":"FreePBX versions 15, 16, and 17 contain a Remote Code Execution (RCE) vulnerability caused by insufficient sanitization of user-supplied dat"},{"n":"blueisbeautiful/CVE-2025-57819","u":"https://github.com/blueisbeautiful/CVE-2025-57819","s":7,"c":1756744164000,"d":"FreePBX SQL Injection Exploit"},{"n":"b4sh2/CVE-2025-57819-poc","u":"https://github.com/b4sh2/CVE-2025-57819-poc","s":7,"c":1780776814000,"d":"CVE-2025-57819 -> rce "}]},"CVE-2025-7775":{"n":4,"first":1756365762000,"top":[{"n":"swabird/CVE-2025-7775-PoC","u":"https://github.com/swabird/CVE-2025-7775-PoC","s":4,"c":1756365762000,"d":""},{"n":"rxerium/CVE-2025-7775","u":"https://github.com/rxerium/CVE-2025-7775","s":2,"c":1756659929000,"d":"Detection for CVE-2025-7775"},{"n":"mr-r3b00t/CVE-2025-7775","u":"https://github.com/mr-r3b00t/CVE-2025-7775","s":1,"c":1756825500000,"d":"Version detection PowerShell "},{"n":"Aaqilyousuf/CVE-2025-7775-vulnerable-lab","u":"https://github.com/Aaqilyousuf/CVE-2025-7775-vulnerable-lab","s":0,"c":1756540406000,"d":""}]},"CVE-2025-48384":{"n":42,"first":1752011777000,"top":[{"n":"acheong08/CVE-2025-48384","u":"https://github.com/acheong08/CVE-2025-48384","s":52,"c":1752011777000,"d":"Breaking git with a carriage return and cloning RCE"},{"n":"liamg/CVE-2025-48384","u":"https://github.com/liamg/CVE-2025-48384","s":20,"c":1752077899000,"d":"PoC for CVE-2025-48384"},{"n":"vinieger/vinieger-CVE-2025-48384-Dockerfile","u":"https://github.com/vinieger/vinieger-CVE-2025-48384-Dockerfile","s":1,"c":1752232217000,"d":"PoC dockerfile image for CVE-2025-48384"},{"n":"IK-20211125/CVE-2025-48384","u":"https://github.com/IK-20211125/CVE-2025-48384","s":1,"c":1753021110000,"d":"CVE-2025-48384 PoC"},{"n":"beishanxueyuan/CVE-2025-48384-test","u":"https://github.com/beishanxueyuan/CVE-2025-48384-test","s":1,"c":1754283362000,"d":""}]},"CVE-2024-8068":{"n":1,"first":1787113065000,"top":[{"n":"HORKimhab/CVE-2024-8068-CVE-2024-8069","u":"https://github.com/HORKimhab/CVE-2024-8068-CVE-2024-8069","s":0,"c":1787113065000,"d":"CVE-2024-8068, CVE-2024-8069"}]},"CVE-2024-8069":{"n":1,"first":1735377814000,"top":[{"n":"mdiqbalahmad/cve-2024-8069-exp-Citrix-Virtual-Apps-XEN","u":"https://github.com/mdiqbalahmad/cve-2024-8069-exp-Citrix-Virtual-Apps-XEN","s":0,"c":1735377814000,"d":"Citrix Virtual Apps and Desktops (XEN) Unauthenticated RCE"}]},"CVE-2025-43300":{"n":5,"first":1756050521000,"top":[{"n":"hunters-sec/CVE-2025-43300","u":"https://github.com/hunters-sec/CVE-2025-43300","s":119,"c":1756050521000,"d":"This is POC for IOS 0click CVE-2025-43300"},{"n":"PwnToday/CVE-2025-43300","u":"https://github.com/PwnToday/CVE-2025-43300","s":7,"c":1757430070000,"d":"CVE-2025-43300: iOS/macOS DNG Image Processing Memory Corruption"},{"n":"ticofookfook/CVE-2025-43300","u":"https://github.com/ticofookfook/CVE-2025-43300","s":4,"c":1759238770000,"d":""},{"n":"Dark-life944/CVE-2025","u":"https://github.com/Dark-life944/CVE-2025","s":1,"c":1759241276000,"d":"This is POC for IOS 0click CVE-2025-43300"},{"n":"veniversum/cve-2025-43300","u":"https://github.com/veniversum/cve-2025-43300","s":0,"c":1758183554000,"d":""}]},"CVE-2025-8875":{"n":1,"first":1755453405000,"top":[{"n":"rxerium/CVE-2025-8875-CVE-2025-8876","u":"https://github.com/rxerium/CVE-2025-8875-CVE-2025-8876","s":22,"c":1755453405000,"d":"Detection for CVE-2025-8875 & CVE-2025-8876"}]},"CVE-2025-8088":{"n":31,"first":1716718545000,"top":[{"n":"sxyrxyy/CVE-2025-8088-WinRAR-Proof-of-Concept-PoC-Exploit-","u":"https://github.com/sxyrxyy/CVE-2025-8088-WinRAR-Proof-of-Concept-PoC-Exploit-","s":73,"c":1755083146000,"d":"CVE-2025-8088 WinRAR Proof of Concept (PoC-Exploit)"},{"n":"onlytoxi/CVE-2025-8088-Winrar-Tool","u":"https://github.com/onlytoxi/CVE-2025-8088-Winrar-Tool","s":55,"c":1755131784000,"d":"Advanced WinRAR Path Traversal Exploit Tool for CVE-2025-8088"},{"n":"hexsecteam/CVE-2025-8088-Winrar-Tool","u":"https://github.com/hexsecteam/CVE-2025-8088-Winrar-Tool","s":50,"c":1756992787000,"d":"A sophisticated GUI tool for creating malicious RAR archives that exploit the WinRAR path traversal vulnerability (CVE-2025-8088) using ADS "},{"n":"knight0x07/WinRAR-CVE-2025-8088-PoC-RAR","u":"https://github.com/knight0x07/WinRAR-CVE-2025-8088-PoC-RAR","s":44,"c":1755004607000,"d":"WinRAR 0day CVE-2025-8088 PoC RAR Archive"},{"n":"pentestfunctions/CVE-2025-8088-Multi-Document","u":"https://github.com/pentestfunctions/CVE-2025-8088-Multi-Document","s":35,"c":1755324754000,"d":"Exploit systems using older WinRAR without knowing their username (unlike other projects)"}]},"CVE-2020-25078":{"n":3,"first":1617087451000,"top":[{"n":"MzzdToT/CVE-2020-25078","u":"https://github.com/MzzdToT/CVE-2020-25078","s":4,"c":1617087451000,"d":"D-Link DCS系列账号密码信息泄露漏洞，通过脚本获取账号密码，可批量。"},{"n":"flags-alt/abyss-c2","u":"https://github.com/flags-alt/abyss-c2","s":2,"c":1779317641000,"d":" ABYSS C2 — HiSilicon DVR Exploit Framework (CVE-2020-25078). Educational IoT security research platform."},{"n":"chinaYozz/CVE-2020-25078","u":"https://github.com/chinaYozz/CVE-2020-25078","s":0,"c":1634303009000,"d":"CVE-2020-25078账号密码信息泄露批量脚本Batch script of D-Link DCS series camera account password information disclosure"}]},"CVE-2025-20281":{"n":3,"first":1751058447000,"top":[{"n":"abrewer251/CVE-2025-20281-2-Cisco-ISE-RCE","u":"https://github.com/abrewer251/CVE-2025-20281-2-Cisco-ISE-RCE","s":21,"c":1751058447000,"d":"Unauthenticated Python PoC for CVE-2025-20281 RCE against ISE ERS API"},{"n":"grupooruss/CVE-2025-20281-Cisco","u":"https://github.com/grupooruss/CVE-2025-20281-Cisco","s":8,"c":1751508637000,"d":"This script checks for the presence of the **CVE-2025-20281** vulnerability in Cisco Identity Services Engine (ISE) and ISE-PIC, which allow"},{"n":"ill-deed/Cisco-CVE-2025-20281-illdeed","u":"https://github.com/ill-deed/Cisco-CVE-2025-20281-illdeed","s":5,"c":1751641142000,"d":"Unauthenticated Remote Code Execution exploit for CVE-2025-20281 in Cisco ISE ERS API. Execute commands or launch reverse shells as root — n"}]},"CVE-2025-2775":{"n":1,"first":1743160036000,"top":[{"n":"watchtowrlabs/watchTowr-vs-SysAid-PreAuth-RCE-Chain","u":"https://github.com/watchtowrlabs/watchTowr-vs-SysAid-PreAuth-RCE-Chain","s":12,"c":1743160036000,"d":"PoC for SysAid PreAuth RCE Chain (CVE-2025-2775, CVE-2025-2776, CVE-2025-2777, CVE-2025-2778)"}]},"CVE-2025-2776":{"n":1,"first":1756646616000,"top":[{"n":"mrk336/From-EternalBlue-to-CVE-2025-2776-The-Evolution-of-an-SMB-Attack","u":"https://github.com/mrk336/From-EternalBlue-to-CVE-2025-2776-The-Evolution-of-an-SMB-Attack","s":0,"c":1756646616000,"d":"It shook the world in 2017 and has evolved into today’s CVE‑2025‑2776. Microsoft still relies on SMBv1, this article will explain how attack"}]},"CVE-2025-6558":{"n":2,"first":1753181005000,"top":[{"n":"DevBuiHieu/CVE-2025-6558-Proof-Of-Concept","u":"https://github.com/DevBuiHieu/CVE-2025-6558-Proof-Of-Concept","s":7,"c":1753320765000,"d":""},{"n":"gmh5225/CVE-2025-6558-exp","u":"https://github.com/gmh5225/CVE-2025-6558-exp","s":1,"c":1753181005000,"d":""}]},"CVE-2025-54309":{"n":7,"first":1756091233000,"top":[{"n":"watchtowrlabs/watchTowr-vs-CrushFTP-Authentication-Bypass-CVE-2025-54309","u":"https://github.com/watchtowrlabs/watchTowr-vs-CrushFTP-Authentication-Bypass-CVE-2025-54309","s":28,"c":1756091233000,"d":""},{"n":"foregenix/CVE-2025-54309","u":"https://github.com/foregenix/CVE-2025-54309","s":2,"c":1756897505000,"d":"Exploitation scripts for the CrushFTP CVE-2025-54309: vulnerability"},{"n":"whisperer1290/CVE-2025-54309__Enhanced_exploit","u":"https://github.com/whisperer1290/CVE-2025-54309__Enhanced_exploit","s":1,"c":1757195030000,"d":""},{"n":"0xLittleSpidy/CVE-2025-54309","u":"https://github.com/0xLittleSpidy/CVE-2025-54309","s":1,"c":1769515828000,"d":""},{"n":"blueisbeautiful/CVE-2025-54309","u":"https://github.com/blueisbeautiful/CVE-2025-54309","s":0,"c":1756436720000,"d":"CrushFTP AS2 Authentication Bypass"}]},"CVE-2025-49706":{"n":1,"first":1753019728000,"top":[{"n":"AdityaBhatt3010/CVE-2025-49706-SharePoint-Spoofing-Vulnerability-Under-Active-Exploitation","u":"https://github.com/AdityaBhatt3010/CVE-2025-49706-SharePoint-Spoofing-Vulnerability-Under-Active-Exploitation","s":18,"c":1753019728000,"d":"A deep dive into CVE-2025-49706 — the SharePoint spoofing flaw now exploited in the wild for stealthy web shell deployment and privilege esc"}]},"CVE-2025-25257":{"n":12,"first":1752167305000,"top":[{"n":"watchtowrlabs/watchTowr-vs-FortiWeb-CVE-2025-25257","u":"https://github.com/watchtowrlabs/watchTowr-vs-FortiWeb-CVE-2025-25257","s":100,"c":1752167305000,"d":""},{"n":"0xbigshaq/CVE-2025-25257","u":"https://github.com/0xbigshaq/CVE-2025-25257","s":64,"c":1752235742000,"d":"FortiWeb CVE-2025-25257 exploit"},{"n":"TheStingR/CVE-2025-25257","u":"https://github.com/TheStingR/CVE-2025-25257","s":5,"c":1752940550000,"d":"Public PoC for CVE-2025-25257: FortiWeb pre-auth SQLi to RCE"},{"n":"0xgh057r3c0n/CVE-2025-25257","u":"https://github.com/0xgh057r3c0n/CVE-2025-25257","s":2,"c":1752573607000,"d":"PoC for CVE-2025-25257, a critical unauthenticated SQL injection in FortiWeb. Exploits SQLi via the Authorization header to write a webshell"},{"n":"aitorfirm/CVE-2025-25257","u":"https://github.com/aitorfirm/CVE-2025-25257","s":1,"c":1752278753000,"d":"Exploiting the CVE-2025-25257 vulnerability in FortiWeb. This repository demonstrates secure pre-authenticated SQL injection."}]},"CVE-2025-47812":{"n":18,"first":1751371358000,"top":[{"n":"4m3rr0r/CVE-2025-47812-poc","u":"https://github.com/4m3rr0r/CVE-2025-47812-poc","s":54,"c":1751371358000,"d":"Wing FTP Server Remote Code Execution (RCE) Exploit (CVE-2025-47812)"},{"n":"0xcan1337/CVE-2025-47812-poC","u":"https://github.com/0xcan1337/CVE-2025-47812-poC","s":13,"c":1751394004000,"d":"Simple exploit for Wing FTP Server RCE (CVE-2025-47812) to run commands and get a reverse shell. For educational use only."},{"n":"0xgh057r3c0n/CVE-2025-47812","u":"https://github.com/0xgh057r3c0n/CVE-2025-47812","s":3,"c":1751493099000,"d":"Wing FTP Server RCE via Lua Injection"},{"n":"r0otk3r/CVE-2025-47812","u":"https://github.com/r0otk3r/CVE-2025-47812","s":2,"c":1753638460000,"d":""},{"n":"shadowgit30/CVE-2025-47812","u":"https://github.com/shadowgit30/CVE-2025-47812","s":2,"c":1771364810000,"d":"CVE-2025-47812 POC"}]},"CVE-2019-9621":{"n":1,"first":1557157640000,"top":[{"n":"k8gege/ZimbraExploit","u":"https://github.com/k8gege/ZimbraExploit","s":78,"c":1557157640000,"d":"Zimbra邮件系统漏洞 XXE/RCE/SSRF/Upload GetShell Exploit  1. (CVE-2019-9621 Zimbra<8.8.11  XXE GetShell Exploit)"}]},"CVE-2019-5418":{"n":12,"first":1552737498000,"top":[{"n":"mpgn/CVE-2019-5418","u":"https://github.com/mpgn/CVE-2019-5418","s":201,"c":1552737498000,"d":"CVE-2019-5418 - File Content Disclosure on Ruby on Rails"},{"n":"mpgn/Rails-doubletap-RCE","u":"https://github.com/mpgn/Rails-doubletap-RCE","s":132,"c":1553309551000,"d":"RCE on Rails 5.2.2 using a path traversal (CVE-2019-5418) and a deserialization of Ruby objects (CVE-2019-5420)"},{"n":"brompwnie/CVE-2019-5418-Scanner","u":"https://github.com/brompwnie/CVE-2019-5418-Scanner","s":36,"c":1553009881000,"d":"A multi-threaded Golang scanner to identify Ruby endpoints vulnerable to CVE-2019-5418"},{"n":"omarkurt/CVE-2019-5418","u":"https://github.com/omarkurt/CVE-2019-5418","s":5,"c":1552925353000,"d":"File Content Disclosure on Rails Test Case - CVE-2019-5418"},{"n":"random-robbie/CVE-2019-5418","u":"https://github.com/random-robbie/CVE-2019-5418","s":5,"c":1574156406000,"d":""}]},"CVE-2016-10033":{"n":17,"first":1482759543000,"top":[{"n":"opsxcq/exploit-CVE-2016-10033","u":"https://github.com/opsxcq/exploit-CVE-2016-10033","s":408,"c":1482759543000,"d":"PHPMailer < 5.2.18 Remote Code Execution exploit and vulnerable container"},{"n":"GeneralTesler/CVE-2016-10033","u":"https://github.com/GeneralTesler/CVE-2016-10033","s":9,"c":1494386326000,"d":"RCE against WordPress 4.6; Python port of https://exploitbox.io/vuln/WordPress-Exploit-4-6-RCE-CODE-EXEC-CVE-2016-10033.html"},{"n":"Zenexer/safeshell","u":"https://github.com/Zenexer/safeshell","s":8,"c":1483000160000,"d":"Prevent PHP vulnerabilities similar to CVE-2016-10033 and CVE-2016-10045."},{"n":"0x00-0x00/CVE-2016-10033","u":"https://github.com/0x00-0x00/CVE-2016-10033","s":6,"c":1518188031000,"d":"PHPMailer < 5.2.18 Remote Code Execution Exploit "},{"n":"pedro823/cve-2016-10033-45","u":"https://github.com/pedro823/cve-2016-10033-45","s":2,"c":1511119905000,"d":"Exploits CVE-2016-10033 and CVE-2016-10045"}]},"CVE-2025-6554":{"n":9,"first":1751688411000,"top":[{"n":"mistymntncop/CVE-2025-6554","u":"https://github.com/mistymntncop/CVE-2025-6554","s":45,"c":1759629679000,"d":""},{"n":"aklnjakln/CVE-2025-6554","u":"https://github.com/aklnjakln/CVE-2025-6554","s":31,"c":1764054180000,"d":""},{"n":"Muhammednihalmp/Google-chrome-zero-day","u":"https://github.com/Muhammednihalmp/Google-chrome-zero-day","s":12,"c":1762692816000,"d":"CVE-2025-6554"},{"n":"jopraveen/CVE-2025-6554","u":"https://github.com/jopraveen/CVE-2025-6554","s":5,"c":1760426991000,"d":"poc for CVE-2025-6554"},{"n":"gmh5225/CVE-2025-6554-2","u":"https://github.com/gmh5225/CVE-2025-6554-2","s":2,"c":1751688606000,"d":""}]},"CVE-2025-6543":{"n":3,"first":1750950343000,"top":[{"n":"abrewer251/CVE-2025-6543_CitrixNetScaler_PoC","u":"https://github.com/abrewer251/CVE-2025-6543_CitrixNetScaler_PoC","s":6,"c":1751572959000,"d":"Multi-host, multi-port scanner and auditor for CVE-2025-6543-affected NetScaler devices. Supports SNMP and SSH enumeration with optional CSV"},{"n":"grupooruss/Citrix-cve-2025-6543","u":"https://github.com/grupooruss/Citrix-cve-2025-6543","s":5,"c":1750950343000,"d":"Script para determinar si Citrix es vulnerable al CVE-2025-6543 "},{"n":"lex1010/CVE-2025-6543","u":"https://github.com/lex1010/CVE-2025-6543","s":0,"c":1751288875000,"d":"Citrix Bleed 2 PoC"}]},"CVE-2019-6693":{"n":4,"first":1640100480000,"top":[{"n":"saladandonionrings/cve-2019-6693","u":"https://github.com/saladandonionrings/cve-2019-6693","s":30,"c":1702033240000,"d":"An authorized remote user with access or knowledge of the standard encryption key can gain access and decrypt the FortiOS backup files and a"},{"n":"synacktiv/CVE-2020-9289","u":"https://github.com/synacktiv/CVE-2020-9289","s":11,"c":1688114917000,"d":"Decrypt reversible secrets encrypted using the default hardcoded key related to CVE-2020-9289 on FortiAnalyzer/FortiManager (the only differ"},{"n":"gquere/CVE-2019-6693","u":"https://github.com/gquere/CVE-2019-6693","s":8,"c":1640100480000,"d":"Decrypt FortiGate configuration secrets"},{"n":"Real4XoR/CVE-2019-6693","u":"https://github.com/Real4XoR/CVE-2019-6693","s":1,"c":1756178136000,"d":""}]},"CVE-2024-54085":{"n":1,"first":1751236007000,"top":[{"n":"Mr-Zapi/CVE-2024-54085","u":"https://github.com/Mr-Zapi/CVE-2024-54085","s":2,"c":1751236007000,"d":"Just poc for CVE 2024-54085"}]},"CVE-2023-0386":{"n":18,"first":1681980680000,"top":[{"n":"xkaneiki/CVE-2023-0386","u":"https://github.com/xkaneiki/CVE-2023-0386","s":416,"c":1683255733000,"d":"CVE-2023-0386在ubuntu22.04上的提权"},{"n":"chenaotian/CVE-2023-0386","u":"https://github.com/chenaotian/CVE-2023-0386","s":123,"c":1683353243000,"d":"CVE-2023-0386 analysis and Exp"},{"n":"sxlmnwb/CVE-2023-0386","u":"https://github.com/sxlmnwb/CVE-2023-0386","s":56,"c":1684232770000,"d":"Vulnerabilities Exploitation On Ubuntu 22.04"},{"n":"puckiestyle/CVE-2023-0386","u":"https://github.com/puckiestyle/CVE-2023-0386","s":22,"c":1703329315000,"d":""},{"n":"Fanxiaoyao66/CVE-2023-0386","u":"https://github.com/Fanxiaoyao66/CVE-2023-0386","s":21,"c":1687938592000,"d":"非常简单的CVE-2023-0386's exp and analysis.Use c and sh."}]},"CVE-2023-33538":{"n":3,"first":1750621268000,"top":[{"n":"explxx/CVE-2023-33538","u":"https://github.com/explxx/CVE-2023-33538","s":1,"c":1750621268000,"d":"Python Exploit for TP-Link TL-WR940N/TL-WR841N Command Injection Vulnerability"},{"n":"mrowkoob/CVE-2023-33538-msf","u":"https://github.com/mrowkoob/CVE-2023-33538-msf","s":1,"c":1750718876000,"d":"CVE-2023-33538 - TP-Link Command Injection Ruby module for Metasploit Framework "},{"n":"eev4n/tplink-osci","u":"https://github.com/eev4n/tplink-osci","s":0,"c":1776571192000,"d":"rediscovered tplink nday xp (CVE-2023-33538)"}]},"CVE-2025-33053":{"n":5,"first":1749710935000,"top":[{"n":"DevBuiHieu/CVE-2025-33053-Proof-Of-Concept","u":"https://github.com/DevBuiHieu/CVE-2025-33053-Proof-Of-Concept","s":63,"c":1749710935000,"d":"CVE-2025-33053 Proof Of Concept (PoC)"},{"n":"kra1t0/CVE-2025-33053-WebDAV-RCE-PoC-and-C2-Concept","u":"https://github.com/kra1t0/CVE-2025-33053-WebDAV-RCE-PoC-and-C2-Concept","s":3,"c":1750275581000,"d":"Proof-of-Concept for CVE-2025-33053  Exploiting WebDAV with .url file delivery to demonstrate realistic remote code execution. Includes a de"},{"n":"TheTorjanCaptain/CVE-2025-33053-Checker-PoC","u":"https://github.com/TheTorjanCaptain/CVE-2025-33053-Checker-PoC","s":1,"c":1750241325000,"d":"CVE-2025-33053 Checker and PoC"},{"n":"4n4s4zi/CVE-2025-33053_PoC","u":"https://github.com/4n4s4zi/CVE-2025-33053_PoC","s":1,"c":1755913055000,"d":"POC exploit for CVE-2025-33053 (external control of file execution path in URL file)"},{"n":"Cyberw1ng/CVE-2025-33053-POC","u":"https://github.com/Cyberw1ng/CVE-2025-33053-POC","s":0,"c":1766048454000,"d":"POC for CVE-2025-33053 WebDav Exploit, demonstrating how the vulnerability can be triggered in a real environment. This repository focuses o"}]},"CVE-2025-24016":{"n":8,"first":1739428723000,"top":[{"n":"0xjessie21/CVE-2025-24016","u":"https://github.com/0xjessie21/CVE-2025-24016","s":43,"c":1739703672000,"d":"CVE-2025-24016: Wazuh Unsafe Deserialization Remote Code Execution (RCE)"},{"n":"guinea-offensive-security/Wazuh-RCE","u":"https://github.com/guinea-offensive-security/Wazuh-RCE","s":8,"c":1752451014000,"d":"Wazuh 8.4 CVE-2025-24016"},{"n":"MuhammadWaseem29/CVE-2025-24016","u":"https://github.com/MuhammadWaseem29/CVE-2025-24016","s":6,"c":1740094263000,"d":"CVE-2025-24016: RCE in Wazuh server!  Remote Code Execution "},{"n":"huseyinstif/CVE-2025-24016-Nuclei-Template","u":"https://github.com/huseyinstif/CVE-2025-24016-Nuclei-Template","s":4,"c":1739428723000,"d":""},{"n":"cybersecplayground/CVE-2025-24016-Wazuh-Remote-Code-Execution-RCE-PoC","u":"https://github.com/cybersecplayground/CVE-2025-24016-Wazuh-Remote-Code-Execution-RCE-PoC","s":2,"c":1745262781000,"d":"A critical RCE vulnerability has been identified in the Wazuh server due to unsafe deserialization in the wazuh-manager package. This bug af"}]},"CVE-2024-42009":{"n":6,"first":1739314962000,"top":[{"n":"DaniTheHack3r/CVE-2024-42009-PoC","u":"https://github.com/DaniTheHack3r/CVE-2024-42009-PoC","s":8,"c":1748114111000,"d":"CVE-2024-42009 Proof of Concept"},{"n":"0xbassiouny1337/CVE-2024-42009","u":"https://github.com/0xbassiouny1337/CVE-2024-42009","s":4,"c":1739314962000,"d":"This script exploits a stored XSS vulnerability (CVE-2024-42009) in Roundcube Webmail version 1.6.7. It injects a malicious payload into the"},{"n":"Bhanunamikaze/CVE-2024-42009","u":"https://github.com/Bhanunamikaze/CVE-2024-42009","s":1,"c":1739480036000,"d":"This Proof of Concept (PoC) demonstrates an exploit for CVE-2024-42009, leveraging a cross-site scripting (XSS) vulnerability to extract ema"},{"n":"ZaidArif47/CVE-2024-42009","u":"https://github.com/ZaidArif47/CVE-2024-42009","s":1,"c":1776348185000,"d":""},{"n":"Shubhankargupta691/CVE-2024-42009","u":"https://github.com/Shubhankargupta691/CVE-2024-42009","s":0,"c":1757891031000,"d":""}]},"CVE-2025-5419":{"n":4,"first":1749865701000,"top":[{"n":"mistymntncop/CVE-2025-5419","u":"https://github.com/mistymntncop/CVE-2025-5419","s":95,"c":1756108452000,"d":""},{"n":"bjrjk/CVE-2025-5419","u":"https://github.com/bjrjk/CVE-2025-5419","s":30,"c":1769669294000,"d":"An uninitialized read vulnerability by incorrect Turboshaft Store-Store Elimination in V8."},{"n":"itsShotgun/chrome_v8_cve_checker","u":"https://github.com/itsShotgun/chrome_v8_cve_checker","s":2,"c":1749865701000,"d":"Checks if your Chrome version is vulnerable to CVE-2025-5419, from the browser"},{"n":"riemannj/CVE-2025-5419","u":"https://github.com/riemannj/CVE-2025-5419","s":0,"c":1755073216000,"d":"Dissecting CVEin Chrome"}]},"CVE-2025-21479":{"n":15,"first":1750362472000,"top":[{"n":"zhuowei/cheese","u":"https://github.com/zhuowei/cheese","s":277,"c":1750362472000,"d":"CVE-2025-21479 proof-of-concept, I think"},{"n":"sarabpal-dev/cheese-cake","u":"https://github.com/sarabpal-dev/cheese-cake","s":35,"c":1763284086000,"d":"A proof-of-concept for CVE-2025-21479, chained with a Dirty Pagetable technique."},{"n":"ma4the/omae-wa-cheese-da","u":"https://github.com/ma4the/omae-wa-cheese-da","s":18,"c":1781811716000,"d":"CVE-2025-21479 PoC for ZFlip5 with Knox in the way!(˶˃ ᵕ ˂˶) "},{"n":"linux-tools/vivo_iqoo_neo_9_root_research_on_CVE-2025-21479","u":"https://github.com/linux-tools/vivo_iqoo_neo_9_root_research_on_CVE-2025-21479","s":10,"c":1787132386000,"d":""},{"n":"CamsShaft/SELinux-Permissive-Only-CVE-2025-21479","u":"https://github.com/CamsShaft/SELinux-Permissive-Only-CVE-2025-21479","s":9,"c":1785220898000,"d":"This is an SELinux permissive version of the Cheese exploit also known as CVE-2025-21479 which affected the adreno kgsl on many devices incl"}]},"CVE-2024-56145":{"n":3,"first":1734665641000,"top":[{"n":"Chocapikk/CVE-2024-56145","u":"https://github.com/Chocapikk/CVE-2024-56145","s":48,"c":1734665641000,"d":"Unauthenticated RCE on CraftCMS when PHP `register_argc_argv` config setting is enabled"},{"n":"Sachinart/CVE-2024-56145-craftcms-rce","u":"https://github.com/Sachinart/CVE-2024-56145-craftcms-rce","s":4,"c":1734868384000,"d":"CVE-2024-56145 SSTI to RCE - twig templates "},{"n":"hmhlol/craft-cms-RCE-CVE-2024-56145","u":"https://github.com/hmhlol/craft-cms-RCE-CVE-2024-56145","s":0,"c":1743934580000,"d":"A POC lab environment for CVE-2024-56145 CraftCMS RCE."}]},"CVE-2025-4632":{"n":2,"first":1749053694000,"top":[{"n":"digitalsurgn/CVE-2025-4632_POC","u":"https://github.com/digitalsurgn/CVE-2025-4632_POC","s":1,"c":1778097347000,"d":"This repository contains a Python replication script for CVE-2025-4632, an Unauthenticated Remote Code Execution (RCE) vulnerability in Sams"},{"n":"MantisToboggan-git/CVE-2025-4632-POC","u":"https://github.com/MantisToboggan-git/CVE-2025-4632-POC","s":0,"c":1749053694000,"d":""}]},"CVE-2025-4428":{"n":1,"first":1747356128000,"top":[{"n":"xie-22/CVE-2025-4428","u":"https://github.com/xie-22/CVE-2025-4428","s":4,"c":1747356128000,"d":"Ivanti EPMM Pre-Auth RCE Chain"}]},"CVE-2025-4427":{"n":2,"first":1747317579000,"top":[{"n":"watchtowrlabs/watchTowr-vs-Ivanti-EPMM-CVE-2025-4427-CVE-2025-4428","u":"https://github.com/watchtowrlabs/watchTowr-vs-Ivanti-EPMM-CVE-2025-4427-CVE-2025-4428","s":11,"c":1747317579000,"d":""},{"n":"rxerium/CVE-2025-4427-CVE-2025-4428","u":"https://github.com/rxerium/CVE-2025-4427-CVE-2025-4428","s":0,"c":1756666853000,"d":"Detection for CVE-2025-4427 and CVE-2025-4428"}]},"CVE-2025-32756":{"n":5,"first":1747561575000,"top":[{"n":"kn0x0x/CVE-2025-32756-POC","u":"https://github.com/kn0x0x/CVE-2025-32756-POC","s":191,"c":1749132991000,"d":"Proof of Concept for CVE-2025-32756 - A critical stack-based buffer overflow vulnerability affecting multiple Fortinet products."},{"n":"exfil0/CVE-2025-32756-POC","u":"https://github.com/exfil0/CVE-2025-32756-POC","s":4,"c":1747561575000,"d":"Designed for Demonstration of Deep Exploitation."},{"n":"alm6no5/CVE-2025-32756-POC","u":"https://github.com/alm6no5/CVE-2025-32756-POC","s":0,"c":1749469535000,"d":""},{"n":"becrevex/CVE-2025-32756","u":"https://github.com/becrevex/CVE-2025-32756","s":0,"c":1749502369000,"d":"CVE-2025-32756: NSE Scanning for RCE in vulnerable FortiVoice, FortiMail, FortiNDR, FortiRecorder and FortiCamera nodes"},{"n":"shan0ar/cve-2025-32756","u":"https://github.com/shan0ar/cve-2025-32756","s":0,"c":1753272534000,"d":""}]},"CVE-2025-32709":{"n":1,"first":1756946535000,"top":[{"n":"AdnanSiyat/How-to-Patch-CVE-2025-32709","u":"https://github.com/AdnanSiyat/How-to-Patch-CVE-2025-32709","s":0,"c":1756946535000,"d":"Real-world patching workflow for CVE-2025-32709. From hotfix install to SIEM alert validation—this repo documents every step with screenshot"}]},"CVE-2025-30397":{"n":1,"first":1748694036000,"top":[{"n":"mbanyamer/CVE-2025-30397---Windows-Server-2025-JScript-RCE-Use-After-Free-","u":"https://github.com/mbanyamer/CVE-2025-30397---Windows-Server-2025-JScript-RCE-Use-After-Free-","s":66,"c":1748694036000,"d":"Remote Code Execution via Use-After-Free in JScript.dll (CVE-2025-30397)"}]},"CVE-2025-30400":{"n":1,"first":1748014742000,"top":[{"n":"encrypter15/CVE-2025-30400","u":"https://github.com/encrypter15/CVE-2025-30400","s":0,"c":1748014742000,"d":""}]},"CVE-2025-27363":{"n":3,"first":1742772637000,"top":[{"n":"zhuowei/CVE-2025-27363-proof-of-concept","u":"https://github.com/zhuowei/CVE-2025-27363-proof-of-concept","s":40,"c":1742772637000,"d":""},{"n":"tin-z/CVE-2025-27363","u":"https://github.com/tin-z/CVE-2025-27363","s":31,"c":1753263898000,"d":"Integer overflow in FreeType software, which also affects Chrome"},{"n":"ov3rf1ow/CVE-2025-27363","u":"https://github.com/ov3rf1ow/CVE-2025-27363","s":3,"c":1748245587000,"d":""}]},"CVE-2025-3248":{"n":28,"first":1744285557000,"top":[{"n":"ynsmroztas/CVE-2025-3248-Langflow-RCE","u":"https://github.com/ynsmroztas/CVE-2025-3248-Langflow-RCE","s":17,"c":1750151180000,"d":"CVE-2025-3248 Langflow RCE Exploit"},{"n":"xuemian168/CVE-2025-3248","u":"https://github.com/xuemian168/CVE-2025-3248","s":11,"c":1744285557000,"d":"A vulnerability scanner for CVE-2025-3248 in Langflow applications. 用于扫描 Langflow 应用中 CVE-2025-3248 漏洞的工具。"},{"n":"verylazytech/CVE-2025-3248","u":"https://github.com/verylazytech/CVE-2025-3248","s":10,"c":1744812002000,"d":""},{"n":"0-d3y/langflow-rce-exploit","u":"https://github.com/0-d3y/langflow-rce-exploit","s":7,"c":1750641789000,"d":"Remote Code Execution Exploit for Langflow (CVE-2025-3248) - [ By S4Tech ]"},{"n":"PuddinCat/CVE-2025-3248-POC","u":"https://github.com/PuddinCat/CVE-2025-3248-POC","s":3,"c":1744293869000,"d":"POC of CVE-2025-3248, RCE of LangFlow"}]},"CVE-2025-34028":{"n":4,"first":1744877818000,"top":[{"n":"watchtowrlabs/watchTowr-vs-Commvault-PreAuth-RCE-CVE-2025-34028","u":"https://github.com/watchtowrlabs/watchTowr-vs-Commvault-PreAuth-RCE-CVE-2025-34028","s":21,"c":1744877818000,"d":""},{"n":"Mattb709/CVE-2025-34028-PoC-Commvault-RCE","u":"https://github.com/Mattb709/CVE-2025-34028-PoC-Commvault-RCE","s":2,"c":1746549881000,"d":"Proof-of-Concept (PoC) for CVE-2025-34028, a Remote Code Execution vulnerability in Commvault Command Center. This Python script scans singl"},{"n":"becrevex/Commvault-CVE-2025-34028","u":"https://github.com/becrevex/Commvault-CVE-2025-34028","s":1,"c":1746512173000,"d":"Commvault Remote Code Execution (CVE-2025-34028) NSE"},{"n":"tinkerlev/commvault-cve2025-34028-check","u":"https://github.com/tinkerlev/commvault-cve2025-34028-check","s":0,"c":1745512211000,"d":"Commvault CVE-2025-34028 endpoint scanner using Nmap NSE. For ethical testing and configuration validation."}]},"CVE-2024-38475":{"n":6,"first":1723980650000,"top":[{"n":"p0in7s/CVE-2024-38475","u":"https://github.com/p0in7s/CVE-2024-38475","s":16,"c":1723980650000,"d":""},{"n":"soltanali0/CVE-2024-38475","u":"https://github.com/soltanali0/CVE-2024-38475","s":4,"c":1733999012000,"d":"exploit CVE-2024-38475(mod_rewrite weakness with filesystem path matching)"},{"n":"abrewer251/CVE-2024-38475_SonicBoom_Apache_URL_Traversal_PoC","u":"https://github.com/abrewer251/CVE-2024-38475_SonicBoom_Apache_URL_Traversal_PoC","s":0,"c":1746576156000,"d":""},{"n":"syaifulandy/CVE-2024-38475","u":"https://github.com/syaifulandy/CVE-2024-38475","s":0,"c":1746777105000,"d":"CVE-2024-38475 Scanner using FFUF + Seclists"},{"n":"Nyakki-Labs-0x420/Myesve","u":"https://github.com/Nyakki-Labs-0x420/Myesve","s":0,"c":1780251138000,"d":"CVE-2024-38475 exploitation & scanning tool with Mullvad VPN rotation"}]},"CVE-2025-24054":{"n":10,"first":1744975068000,"top":[{"n":"helidem/CVE-2025-24054_CVE-2025-24071-PoC","u":"https://github.com/helidem/CVE-2025-24054_CVE-2025-24071-PoC","s":22,"c":1745327081000,"d":"Proof of Concept for the NTLM Hash Leak via .library-ms CVE-2025-24054 / CVE-2025-24071"},{"n":"basekilll/CVE-2025-24054_PoC","u":"https://github.com/basekilll/CVE-2025-24054_PoC","s":4,"c":1744975068000,"d":"PoC - CVE-2025-24071 / CVE-2025-24054, NTMLv2 hash'leri alınabilen bir vulnerability"},{"n":"Untouchable17/CVE-2025-24054","u":"https://github.com/Untouchable17/CVE-2025-24054","s":2,"c":1763904638000,"d":"Windows File Explorer Zero Click NTLMv2-SSP Hash Disclosure"},{"n":"moften/CVE-2025-24054","u":"https://github.com/moften/CVE-2025-24054","s":1,"c":1747684391000,"d":"Vulnerabilidad NTLM (CVE-2025-24054) explotada para robo de hashes"},{"n":"S4mma3l/CVE-2025-24054","u":"https://github.com/S4mma3l/CVE-2025-24054","s":0,"c":1746136639000,"d":""}]},"CVE-2025-31200":{"n":4,"first":1745213886000,"top":[{"n":"JGoyd/iOS-Attack-Chain-CVE-2025-31200-CVE-2025-31201","u":"https://github.com/JGoyd/iOS-Attack-Chain-CVE-2025-31200-CVE-2025-31201","s":208,"c":1747523036000,"d":"CVE-2025-31200 is a zero-day, zero-click RCE in iOS CoreAudio’s AudioConverterService, triggered by a malicious audio file via iMessage/SMS."},{"n":"zhuowei/apple-positional-audio-codec-invalid-header","u":"https://github.com/zhuowei/apple-positional-audio-codec-invalid-header","s":114,"c":1745213886000,"d":"CVE-2025-31200 - @Noahhw46 figured it out"},{"n":"hunters-sec/CVE-2025-31200","u":"https://github.com/hunters-sec/CVE-2025-31200","s":12,"c":1756389194000,"d":"IOS audio buffer overflow CVE-2025-31200 POC"},{"n":"serundengsapi/CVE-2025-31200-iOS-AudioConverter-RCE","u":"https://github.com/serundengsapi/CVE-2025-31200-iOS-AudioConverter-RCE","s":2,"c":1747883207000,"d":"Public disclosure of CVE-2025-31200 – Zero-click RCE in iOS 18.X via AudioConverterService and malicious audio file."}]},"CVE-2025-30406":{"n":2,"first":1745481322000,"top":[{"n":"mchklt/CVE-2025-30406","u":"https://github.com/mchklt/CVE-2025-30406","s":91,"c":1753989273000,"d":"CVE-2025-30406 ViewState Exploit PoC"},{"n":"W01fh4cker/CVE-2025-30406","u":"https://github.com/W01fh4cker/CVE-2025-30406","s":12,"c":1745481322000,"d":"Exploit for CVE-2025-30406"}]},"CVE-2025-31161":{"n":19,"first":1744126648000,"top":[{"n":"Immersive-Labs-Sec/CVE-2025-31161","u":"https://github.com/Immersive-Labs-Sec/CVE-2025-31161","s":48,"c":1744126648000,"d":"Proof of Concept for CVE-2025-31161 / CVE-2025-2825"},{"n":"0xgh057r3c0n/CVE-2025-31161","u":"https://github.com/0xgh057r3c0n/CVE-2025-31161","s":5,"c":1748034260000,"d":"🛡️ CVE-2025-31161 - CrushFTP User Creation Authentication Bypass Exploit"},{"n":"TX-One/CVE-2025-31161","u":"https://github.com/TX-One/CVE-2025-31161","s":2,"c":1745279827000,"d":"CrushFTP CVE-2025-31161 Exploit Tool 🔓"},{"n":"f4dee-backup/CVE-2025-31161","u":"https://github.com/f4dee-backup/CVE-2025-31161","s":2,"c":1757463635000,"d":"PoC CVE-2025-31161 - Authentication Bypass CrushFTP"},{"n":"SUPRAAA-1337/Nuclei_CVE-2025-31161_CVE-2025-2825","u":"https://github.com/SUPRAAA-1337/Nuclei_CVE-2025-31161_CVE-2025-2825","s":1,"c":1745490326000,"d":"Official Nuclei template for CVE-2025-31161 (formerly CVE-2025-2825)"}]},"CVE-2025-22457":{"n":6,"first":1744104661000,"top":[{"n":"sfewer-r7/CVE-2025-22457","u":"https://github.com/sfewer-r7/CVE-2025-22457","s":73,"c":1744209565000,"d":"PoC for CVE-2025-22457 - A remote unauthenticated stack based buffer overflow affecting Ivanti Connect Secure, Pulse Connect Secure, Ivanti "},{"n":"securekomodo/CVE-2025-22457","u":"https://github.com/securekomodo/CVE-2025-22457","s":18,"c":1744255650000,"d":"CVE-2025-22457: Python Exploit POC Scanner to Detect Ivanti Connect Secure RCE"},{"n":"Vinylrider/ivantiunlocker","u":"https://github.com/Vinylrider/ivantiunlocker","s":2,"c":1744104661000,"d":"Prevent CVE-2025-22457 and other security problems with Juniper/Ivanti Secure Connect SSL VPN"},{"n":"TRone-ux/CVE-2025-22457","u":"https://github.com/TRone-ux/CVE-2025-22457","s":1,"c":1748213573000,"d":"PoC CVE-2025-22457"},{"n":"benmevic/cve-2025-22457","u":"https://github.com/benmevic/cve-2025-22457","s":0,"c":1783638320000,"d":"Altay takımı haftalık sunumu için yaptığım cve-2025-22457 zafiyeti demo uygulaması"}]},"CVE-2025-24813":{"n":59,"first":1741860003000,"top":[{"n":"absholi7ly/POC-CVE-2025-24813","u":"https://github.com/absholi7ly/POC-CVE-2025-24813","s":195,"c":1741937818000,"d":"his repository contains an automated Proof of Concept (PoC) script for exploiting **CVE-2025-24813**, a Remote Code Execution (RCE) vulnerab"},{"n":"iSee857/CVE-2025-24813-PoC","u":"https://github.com/iSee857/CVE-2025-24813-PoC","s":98,"c":1741860003000,"d":"Apache Tomcat 远程代码执行漏洞批量检测脚本(CVE-2025-24813)"},{"n":"drcrypterdotru/Apache-GOExploiter","u":"https://github.com/drcrypterdotru/Apache-GOExploiter","s":20,"c":1756634468000,"d":"Apache (CVE-2025-24813) GOExploiter Checker & Exploiter very Fast "},{"n":"mbanyamer/Apache-Tomcat---Remote-Code-Execution-via-Session-Deserialization-CVE-2025-24813-","u":"https://github.com/mbanyamer/Apache-Tomcat---Remote-Code-Execution-via-Session-Deserialization-CVE-2025-24813-","s":18,"c":1748180058000,"d":"Apache Tomcat - Remote Code Execution via Session Deserialization (CVE-2025-24813)"},{"n":"charis3306/CVE-2025-24813","u":"https://github.com/charis3306/CVE-2025-24813","s":16,"c":1742126399000,"d":"CVE-2025-24813利用工具"}]},"CVE-2025-2783":{"n":5,"first":1743911341000,"top":[{"n":"Alchemist3dot14/CVE-2025-2783","u":"https://github.com/Alchemist3dot14/CVE-2025-2783","s":33,"c":1743911341000,"d":"Simulated PoC for CVE-2025-2783 — a sandbox escape vulnerability in Chrome's Mojo IPC. Includes phishing delivery, memory fuzzing, IPC simul"},{"n":"byteReaper77/CVE-2025-2783","u":"https://github.com/byteReaper77/CVE-2025-2783","s":8,"c":1750030235000,"d":"This project is a research-oriented and educational simulation  designed to demonstrate the concept of a sandbox escape vulnerability  withi"},{"n":"bjrjk/CVE-2025-2783","u":"https://github.com/bjrjk/CVE-2025-2783","s":1,"c":1778230635000,"d":" Full-chain exploit for CVE-2025-2783 (Ipcz Sandbox Escape & RCE)."},{"n":"ElianGonzi00/CVE-2025-2783","u":"https://github.com/ElianGonzi00/CVE-2025-2783","s":1,"c":1781546494000,"d":""},{"n":"razureink/cve-2025-2783-chrome_sandbox_escape_reproduction","u":"https://github.com/razureink/cve-2025-2783-chrome_sandbox_escape_reproduction","s":0,"c":1784778346000,"d":"CVE Reproduction: cve-2025-2783-chrome_sandbox_escape_reproduction"}]},"CVE-2017-12637":{"n":1,"first":1753297780000,"top":[{"n":"abrewer251/CVE-2017-12637_SAP-NetWeaver-URL-Traversal","u":"https://github.com/abrewer251/CVE-2017-12637_SAP-NetWeaver-URL-Traversal","s":0,"c":1753297780000,"d":"Proof-of-concept LFI Scanner: Automated detection of /etc/passwd exposures via directory traversal and regex matching."}]},"CVE-2024-48248":{"n":1,"first":1738039573000,"top":[{"n":"watchtowrlabs/nakivo-arbitrary-file-read-poc-CVE-2024-48248","u":"https://github.com/watchtowrlabs/nakivo-arbitrary-file-read-poc-CVE-2024-48248","s":3,"c":1738039573000,"d":""}]},"CVE-2025-30066":{"n":2,"first":1742308409000,"top":[{"n":"Checkmarx/Checkmarx-CVE-2025-30066-Detection-Tool","u":"https://github.com/Checkmarx/Checkmarx-CVE-2025-30066-Detection-Tool","s":1,"c":1742308409000,"d":""},{"n":"Super-Vulnerable-Org/compromised-action","u":"https://github.com/Super-Vulnerable-Org/compromised-action","s":0,"c":1778797188000,"d":"Test repo: simulates CVE-2025-30066 style compromised GitHub Action (for security research/testing chainradar)"}]},"CVE-2025-24472":{"n":1,"first":1784778340000,"top":[{"n":"razureink/cve-2025-24472-fortinet_authbypass_reproduction","u":"https://github.com/razureink/cve-2025-24472-fortinet_authbypass_reproduction","s":0,"c":1784778340000,"d":"CVE Reproduction: cve-2025-24472-fortinet_authbypass_reproduction"}]},"CVE-2025-24201":{"n":2,"first":1752242460000,"top":[{"n":"The-Maxu/CVE-2025-24201-WebKit-Vulnerability-Detector-PoC-","u":"https://github.com/The-Maxu/CVE-2025-24201-WebKit-Vulnerability-Detector-PoC-","s":6,"c":1752242460000,"d":"CVE-2025-24201 WebKit Vulnerability Detector (PoC)"},{"n":"5ky9uy/glass-cage-i18-2025-24085-and-cve-2025-24201","u":"https://github.com/5ky9uy/glass-cage-i18-2025-24085-and-cve-2025-24201","s":5,"c":1756520498000,"d":"Glass Cage is a zero-click PNG-based RCE chain in iOS 18.2.1, exploiting WebKit (CVE-2025-24201) and Core Media (CVE-2025-24085) to achieve "}]},"CVE-2025-24985":{"n":1,"first":1743607825000,"top":[{"n":"airbus-cert/cve-2025-24985","u":"https://github.com/airbus-cert/cve-2025-24985","s":2,"c":1743607825000,"d":"Detection of malicious VHD files for CVE-2025-24985"}]},"CVE-2025-26633":{"n":2,"first":1744140568000,"top":[{"n":"mbanyamer/MSC-EvilTwin-Local-Privilege-Escalation","u":"https://github.com/mbanyamer/MSC-EvilTwin-Local-Privilege-Escalation","s":4,"c":1763806094000,"d":"CVE-2025-26633 (CVSS 7.8) – Zero-day MMC .msc EvilTwin LPE actively exploited by Water Gamayun APT. PoC creates local admin via malicious MS"},{"n":"sandsoncosta/CVE-2025-26633","u":"https://github.com/sandsoncosta/CVE-2025-26633","s":2,"c":1744140568000,"d":""}]},"CVE-2024-13159":{"n":1,"first":1739909674000,"top":[{"n":"horizon3ai/Ivanti-EPM-Coercion-Vulnerabilities","u":"https://github.com/horizon3ai/Ivanti-EPM-Coercion-Vulnerabilities","s":13,"c":1739909674000,"d":"Proof of concept exploit for Ivanti EPM CVE-2024-13159 and others"}]},"CVE-2024-4885":{"n":1,"first":1720440882000,"top":[{"n":"sinsinology/CVE-2024-4885","u":"https://github.com/sinsinology/CVE-2024-4885","s":17,"c":1720440882000,"d":"Exploit for CVE-2024-4885"}]},"CVE-2018-8639":{"n":2,"first":1551795487000,"top":[{"n":"ze0r/CVE-2018-8639-exp","u":"https://github.com/ze0r/CVE-2018-8639-exp","s":125,"c":1551795487000,"d":""},{"n":"timwhitez/CVE-2018-8639-EXP","u":"https://github.com/timwhitez/CVE-2018-8639-EXP","s":5,"c":1577432347000,"d":"CVE-2018-8639-EXP"}]},"CVE-2017-3066":{"n":2,"first":1520873052000,"top":[{"n":"codewhitesec/ColdFusionPwn","u":"https://github.com/codewhitesec/ColdFusionPwn","s":95,"c":1520873052000,"d":"Exploitation Tool for CVE-2017-3066 targeting Adobe Coldfusion 11/12"},{"n":"cucadili/CVE-2017-3066","u":"https://github.com/cucadili/CVE-2017-3066","s":2,"c":1570619580000,"d":"The study of vulnerability CVE-2017-3066. Java deserialization"}]},"CVE-2025-0108":{"n":7,"first":1739428765000,"top":[{"n":"iSee857/CVE-2025-0108-PoC","u":"https://github.com/iSee857/CVE-2025-0108-PoC","s":32,"c":1739428765000,"d":"Palo Alto Networks PAN-OS 身份验证绕过漏洞批量检测脚本(CVE-2025-0108)"},{"n":"FOLKS-iwd/CVE-2025-0108-PoC","u":"https://github.com/FOLKS-iwd/CVE-2025-0108-PoC","s":8,"c":1739539357000,"d":"PoC exploit for CVE-2025-0108 - PAN-OS Authentication Bypass"},{"n":"fr4nc1stein/CVE-2025-0108-SCAN","u":"https://github.com/fr4nc1stein/CVE-2025-0108-SCAN","s":2,"c":1739912685000,"d":" Detects an authentication bypass vulnerability in Palo Alto PAN-OS (CVE-2025-0108)."},{"n":"becrevex/CVE-2025-0108","u":"https://github.com/becrevex/CVE-2025-0108","s":2,"c":1739984278000,"d":"NSE script that checks for CVE-2025-0108 vulnerability in Palo Alto Networks PAN-OS"},{"n":"sohaibeb/CVE-2025-0108","u":"https://github.com/sohaibeb/CVE-2025-0108","s":1,"c":1739980804000,"d":"PAN-OS CVE POC SCRIPT"}]},"CVE-2024-53704":{"n":3,"first":1737552067000,"top":[{"n":"istagmbh/CVE-2024-53704","u":"https://github.com/istagmbh/CVE-2024-53704","s":2,"c":1739306603000,"d":"demonstriert, wie mittels missbräuchlicher Nutzung eines Swap-Cookies eine VPN-Session übernommen werden kann. Wichtig: Dieses Projekt dient"},{"n":"sfewer-r7/SonicSessionLeak","u":"https://github.com/sfewer-r7/SonicSessionLeak","s":0,"c":1737552067000,"d":"Exploit for CVE-2024-53704 - SonicWall SonicOS SSLVPN authentication bypass"},{"n":"anir0y/sonicwall-audit-toolkit","u":"https://github.com/anir0y/sonicwall-audit-toolkit","s":0,"c":1771867678000,"d":"SonicWall security audit toolkit with vulnerable CTF lab (CVE-2021-20038, CVE-2024-53704)"}]},"CVE-2024-57727":{"n":1,"first":1737128751000,"top":[{"n":"imjdl/CVE-2024-57727","u":"https://github.com/imjdl/CVE-2024-57727","s":15,"c":1737128751000,"d":"CVE-2024-57727"}]},"CVE-2024-40891":{"n":1,"first":1786650466000,"top":[{"n":"Danyw24/zyxel-p870hn-hardware-hacking","u":"https://github.com/Danyw24/zyxel-p870hn-hardware-hacking","s":0,"c":1786650466000,"d":"From a bare PCB to root: hardware-hacking a ZyXEL P-870HN (BCM6368) over UART — CVE-2025-0890 + CVE-2024-40891, on my own hardware."}]},"CVE-2025-0994":{"n":1,"first":1738937588000,"top":[{"n":"rxerium/CVE-2025-0994","u":"https://github.com/rxerium/CVE-2025-0994","s":4,"c":1738937588000,"d":"Cityworks deserialization of untrusted data vulnerability Detection"}]},"CVE-2024-21413":{"n":42,"first":1708027058000,"top":[{"n":"xaitax/CVE-2024-21413-Microsoft-Outlook-Remote-Code-Execution-Vulnerability","u":"https://github.com/xaitax/CVE-2024-21413-Microsoft-Outlook-Remote-Code-Execution-Vulnerability","s":777,"c":1708096679000,"d":"Microsoft-Outlook-Remote-Code-Execution-Vulnerability"},{"n":"CMNatic/CVE-2024-21413","u":"https://github.com/CMNatic/CVE-2024-21413","s":290,"c":1708181572000,"d":"CVE-2024-21413 PoC for THM Lab"},{"n":"duy-31/CVE-2024-21413","u":"https://github.com/duy-31/CVE-2024-21413","s":156,"c":1708027058000,"d":"Microsoft Outlook Information Disclosure Vulnerability (leak password hash) - Expect Script POC"},{"n":"ThemeHackers/CVE-2024-21413","u":"https://github.com/ThemeHackers/CVE-2024-21413","s":25,"c":1725110323000,"d":"CVE-2024-21413 | Microsoft Outlook Remote Code Execution Vulnerability PoC"},{"n":"r00tb1t/CVE-2024-21413-POC","u":"https://github.com/r00tb1t/CVE-2024-21413-POC","s":17,"c":1708117831000,"d":"Microsoft Outlook Information Disclosure Vulnerability (leak password hash) - CVE-2024-21413 POC"}]},"CVE-2025-0411":{"n":6,"first":1737556834000,"top":[{"n":"dhmosfunk/7-Zip-CVE-2025-0411-POC","u":"https://github.com/dhmosfunk/7-Zip-CVE-2025-0411-POC","s":154,"c":1737556834000,"d":"This repository contains POC scenarios as part of CVE-2025-0411 MotW bypass."},{"n":"cesarbtakeda/7-Zip-CVE-2025-0411-POC","u":"https://github.com/cesarbtakeda/7-Zip-CVE-2025-0411-POC","s":2,"c":1740279344000,"d":""},{"n":"iSee857/CVE-2025-0411-PoC","u":"https://github.com/iSee857/CVE-2025-0411-PoC","s":1,"c":1737963129000,"d":"7-Zip Mark-of-the-Web绕过漏洞PoC(CVE-2025-0411)"},{"n":"ishwardeepp/CVE-2025-0411-MoTW-PoC","u":"https://github.com/ishwardeepp/CVE-2025-0411-MoTW-PoC","s":1,"c":1739940479000,"d":""},{"n":"betulssahin/CVE-2025-0411-7-Zip-Mark-of-the-Web-Bypass","u":"https://github.com/betulssahin/CVE-2025-0411-7-Zip-Mark-of-the-Web-Bypass","s":0,"c":1746977911000,"d":"CVE-2025-0411 7-Zip Mark-of-the-Web Bypass"}]},"CVE-2024-53104":{"n":1,"first":1784267951000,"top":[{"n":"runtimeverification/kernel-c-to-rust-spike","u":"https://github.com/runtimeverification/kernel-c-to-rust-spike","s":2,"c":1784267951000,"d":" Hardening kernel C parsers via Rust rewrite + differential fuzzing + formal verification. First target: UVC (CVE-2024-53104)."}]},"CVE-2018-19410":{"n":1,"first":1706167219000,"top":[{"n":"himash/CVE-2018-19410-POC","u":"https://github.com/himash/CVE-2018-19410-POC","s":3,"c":1706167219000,"d":"Proof of concept for the vulnerability CVE-2018-19410"}]},"CVE-2018-9276":{"n":5,"first":1554022267000,"top":[{"n":"wildkindcc/CVE-2018-9276","u":"https://github.com/wildkindcc/CVE-2018-9276","s":36,"c":1554022267000,"d":"CVE-2018-9276 PRTG < 18.2.39 Authenticated Command Injection (Reverse Shell)"},{"n":"andyfeili/CVE-2018-9276","u":"https://github.com/andyfeili/CVE-2018-9276","s":0,"c":1609578522000,"d":""},{"n":"alvinsmith-eroad/CVE-2018-9276","u":"https://github.com/alvinsmith-eroad/CVE-2018-9276","s":0,"c":1627549698000,"d":"CVE-2018-9276 PRTG < 18.2.39 Reverse Shell (Python3 support)"},{"n":"AC8999/PRTG-Network-Monitor-18.2.38---Authenticated-Remote-Code-Execution-CVE-2018-9276","u":"https://github.com/AC8999/PRTG-Network-Monitor-18.2.38---Authenticated-Remote-Code-Execution-CVE-2018-9276","s":0,"c":1775596818000,"d":"Python Exploit for CVE: 2018-9276"},{"n":"BardLaudian/CVE-2018-9276","u":"https://github.com/BardLaudian/CVE-2018-9276","s":0,"c":1781363372000,"d":"CVE-2018-9276 — PRTG Network Monitor < 18.2.39 Authenticated RCE. For educational purposes and authorized penetration testing only."}]},"CVE-2024-29059":{"n":1,"first":1710152079000,"top":[{"n":"codewhitesec/HttpRemotingObjRefLeak","u":"https://github.com/codewhitesec/HttpRemotingObjRefLeak","s":92,"c":1710152079000,"d":"Additional resources for leaking and exploiting ObjRefs via HTTP .NET Remoting (CVE-2024-29059)"}]},"CVE-2024-45195":{"n":1,"first":1753240809000,"top":[{"n":"wyyazjjl/CVE-2024-45195","u":"https://github.com/wyyazjjl/CVE-2024-45195","s":0,"c":1753240809000,"d":""}]},"CVE-2025-24085":{"n":1,"first":1755925686000,"top":[{"n":"JGoyd/Glass-Cage-iOS18-CVE-2025-24085-CVE-2025-24201","u":"https://github.com/JGoyd/Glass-Cage-iOS18-CVE-2025-24085-CVE-2025-24201","s":42,"c":1755925686000,"d":"Glass Cage is a zero-click PNG-based RCE chain in iOS 18.2.1, bypassing LockDown mode protection by exploiting ImageIO (CVE-2025-43300), the"}]},"CVE-2020-11023":{"n":6,"first":1653302959000,"top":[{"n":"Cybernegro/CVE-2020-11023","u":"https://github.com/Cybernegro/CVE-2020-11023","s":4,"c":1704249337000,"d":"CVE-2020-11023  PoC for bug bounty."},{"n":"honeyb33z/cve-2020-11023-scanner","u":"https://github.com/honeyb33z/cve-2020-11023-scanner","s":4,"c":1738238762000,"d":""},{"n":"Snorlyd/https-nj.gov---CVE-2020-11023","u":"https://github.com/Snorlyd/https-nj.gov---CVE-2020-11023","s":1,"c":1653302959000,"d":"Vulnearability Report of the New Jersey official site"},{"n":"GarlicB/jquery35-local-agent","u":"https://github.com/GarlicB/jquery35-local-agent","s":1,"c":1783256215000,"d":"Offline jQuery CVE-2020-11023 remediation kit for legacy Spring/JSP - Node.js built-ins only (no npm, no internet)"},{"n":"andreassundstrom/cve-2020-11023-demonstration","u":"https://github.com/andreassundstrom/cve-2020-11023-demonstration","s":0,"c":1713002273000,"d":"Demonstration of CVE-2020-11023"}]},"CVE-2024-50603":{"n":2,"first":1736337638000,"top":[{"n":"th3gokul/CVE-2024-50603","u":"https://github.com/th3gokul/CVE-2024-50603","s":17,"c":1736680821000,"d":"CVE-2024-50603: Aviatrix Controller Unauthenticated Command Injection"},{"n":"newlinesec/CVE-2024-50603","u":"https://github.com/newlinesec/CVE-2024-50603","s":7,"c":1736337638000,"d":"CVE-2024-50603-nuclei-poc"}]},"CVE-2025-21333":{"n":4,"first":1740659815000,"top":[{"n":"MrAle98/CVE-2025-21333-POC","u":"https://github.com/MrAle98/CVE-2025-21333-POC","s":232,"c":1740659815000,"d":"POC exploit for CVE-2025-21333 heap-based buffer overflow. It leverages WNF state data and I/O ring IOP_MC_BUFFER_ENTRY"},{"n":"nu1lptr0/CVE-2025-21333","u":"https://github.com/nu1lptr0/CVE-2025-21333","s":23,"c":1778013668000,"d":"LPE due to integer truncation in vskrnlintvsp.sys"},{"n":"aleongx/KQL_sentinel_CVE-2025-21333","u":"https://github.com/aleongx/KQL_sentinel_CVE-2025-21333","s":0,"c":1741714327000,"d":"KQL para deteccion de CVE-2025-21333 en Sentinel"},{"n":"uname1able/CVE-2025-21333","u":"https://github.com/uname1able/CVE-2025-21333","s":0,"c":1784174082000,"d":""}]},"CVE-2024-55591":{"n":10,"first":1737012375000,"top":[{"n":"watchtowrlabs/fortios-auth-bypass-poc-CVE-2024-55591","u":"https://github.com/watchtowrlabs/fortios-auth-bypass-poc-CVE-2024-55591","s":76,"c":1737959153000,"d":""},{"n":"watchtowrlabs/fortios-auth-bypass-check-CVE-2024-55591","u":"https://github.com/watchtowrlabs/fortios-auth-bypass-check-CVE-2024-55591","s":65,"c":1737012375000,"d":""},{"n":"sysirq/fortios-auth-bypass-poc-CVE-2024-55591","u":"https://github.com/sysirq/fortios-auth-bypass-poc-CVE-2024-55591","s":27,"c":1737462621000,"d":""},{"n":"exfil0/CVE-2024-55591-POC","u":"https://github.com/exfil0/CVE-2024-55591-POC","s":12,"c":1738162480000,"d":"A comprehensive all-in-one Python-based Proof of Concept script to discover and exploit a critical authentication bypass vulnerability (CVE-"},{"n":"virus-or-not/CVE-2024-55591","u":"https://github.com/virus-or-not/CVE-2024-55591","s":8,"c":1737750596000,"d":"An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] affecting FortiOS and FortiProxy may allow a remote atta"}]},"CVE-2020-2883":{"n":7,"first":1589101483000,"top":[{"n":"Y4er/WebLogic-Shiro-shell","u":"https://github.com/Y4er/WebLogic-Shiro-shell","s":529,"c":1597808046000,"d":"WebLogic利用CVE-2020-2883打Shiro rememberMe反序列化漏洞，一键注册蚁剑filter内存shell"},{"n":"Y4er/CVE-2020-2883","u":"https://github.com/Y4er/CVE-2020-2883","s":176,"c":1589101483000,"d":"Weblogic coherence.jar RCE"},{"n":"MagicZer0/Weblogic_CVE-2020-2883_POC","u":"https://github.com/MagicZer0/Weblogic_CVE-2020-2883_POC","s":15,"c":1589363808000,"d":"Proof of concept for Weblogic CVE-2020-2883"},{"n":"Al1ex/CVE-2020-2883","u":"https://github.com/Al1ex/CVE-2020-2883","s":5,"c":1606399825000,"d":"CVE-2020-2883"},{"n":"FancyDoesSecurity/CVE-2020-2883","u":"https://github.com/FancyDoesSecurity/CVE-2020-2883","s":2,"c":1602717159000,"d":""}]},"CVE-2024-41713":{"n":5,"first":1733379237000,"top":[{"n":"watchtowrlabs/Mitel-MiCollab-Auth-Bypass_CVE-2024-41713","u":"https://github.com/watchtowrlabs/Mitel-MiCollab-Auth-Bypass_CVE-2024-41713","s":20,"c":1733379237000,"d":""},{"n":"zxj-hub/CVE-2024-41713POC","u":"https://github.com/zxj-hub/CVE-2024-41713POC","s":0,"c":1734747986000,"d":"Mitel MiCollab 企业协作平台 任意文件读取漏洞(CVE-2024-41713)由于Mitel MiCollab软件的 NuPoint 统一消息 (NPM) 组件中存在身份验证绕过漏洞，并且输入验证不足，未经身份验证的远程攻击者可利用该漏洞执行路径遍历攻击，成功利用可"},{"n":"Sanandd/cve-2024-CVE-2024-41713","u":"https://github.com/Sanandd/cve-2024-CVE-2024-41713","s":0,"c":1734773712000,"d":"cve-2024-CVE-2024-41713"},{"n":"amanverma-wsu/CVE-2024-41713-Scan","u":"https://github.com/amanverma-wsu/CVE-2024-41713-Scan","s":0,"c":1736563176000,"d":"A Python script to detect CVE-2024-41713, a directory traversal vulnerability in Apache HTTP Server, enabling unauthorized access to restric"},{"n":"gunyakit/CVE-2024-41713-PoC-exploit","u":"https://github.com/gunyakit/CVE-2024-41713-PoC-exploit","s":0,"c":1747555960000,"d":"Mitel MiCollab Authentication Bypass to Arbitrary File Read"}]},"CVE-2026-110958":{"n":1,"first":1792069949000,"top":[{"n":"shlln/CVE-2026-110958","u":"https://github.com/shlln/CVE-2026-110958","s":0,"c":1792069949000,"d":""}]},"CVE-2026-53582":{"n":1,"first":1781609121000,"top":[{"n":"eev4n/CVE-2026-53582","u":"https://github.com/eev4n/CVE-2026-53582","s":0,"c":1781609121000,"d":""}]},"CVE-2026-57155":{"n":1,"first":1784169087000,"top":[{"n":"babyshen/CVE-2026-57155","u":"https://github.com/babyshen/CVE-2026-57155","s":0,"c":1784169087000,"d":"OPNsense Root RCE (CVE-2026-57155)"}]},"CVE-2026-36436":{"n":1,"first":1778903245000,"top":[{"n":"vtrmK/CVE-2026-36436-Public-Reference-Pack","u":"https://github.com/vtrmK/CVE-2026-36436-Public-Reference-Pack","s":0,"c":1778903245000,"d":""}]},"CVE-2026-111283":{"n":1,"first":1792192530000,"top":[{"n":"cybliminal/cve-2026-111283-bmc-helix-network-management-local-administrator-any-password","u":"https://github.com/cybliminal/cve-2026-111283-bmc-helix-network-management-local-administrator-any-password","s":0,"c":1792192530000,"d":"CVE-2026-111283 - BMC Helix Network Management Local Administrator Account Accepts Any Password"}]},"CVE-2026-94134":{"n":1,"first":1792158200000,"top":[{"n":"MosesOX/POC-CVE-2026-94134","u":"https://github.com/MosesOX/POC-CVE-2026-94134","s":0,"c":1792158200000,"d":"Exploitation POC for CVE-2026-94134"}]},"CVE-2026-111389":{"n":1,"first":1792124888000,"top":[{"n":"Syscallh00k/CVE-2026-111389","u":"https://github.com/Syscallh00k/CVE-2026-111389","s":0,"c":1792124888000,"d":"Frappe HRMS missing input validation SQL injection vulnerability "}]},"CVE-2026-104745":{"n":1,"first":1792131765000,"top":[{"n":"rxsklife/CVE-2026-104745","u":"https://github.com/rxsklife/CVE-2026-104745","s":0,"c":1792131765000,"d":"CVE-2026-104745 is a high-severity vulnerability rated 8.1/10 on the CVSS scale. The Customer Email Verification for WooCommerce plugin for "}]},"CVE-2026-111444":{"n":1,"first":1792125200000,"top":[{"n":"Syscallh00k/CVE-2026-111444","u":"https://github.com/Syscallh00k/CVE-2026-111444","s":0,"c":1792125200000,"d":"Wheels SQL injection on MySQL/MariaDB with backslash escaping enabled"}]},"CVE-2026-89079":{"n":1,"first":1792151089000,"top":[{"n":"murrez/CVE-2026-89079","u":"https://github.com/murrez/CVE-2026-89079","s":8,"c":1792151089000,"d":"CVE-2026-89079 — WordPress Theme My Login multisite unauth password overwrite PoC (check, verify, exploit). Not version-only: requires MS + "}]},"CVE-2026-104715":{"n":1,"first":1792101797000,"top":[{"n":"M3aCulpa/CVE-2026-104715","u":"https://github.com/M3aCulpa/CVE-2026-104715","s":0,"c":1792101797000,"d":"CVE-2026-104715: cifs-utils credentials-file option injection (local root)"}]},"CVE-2026-94169":{"n":1,"first":1792262865000,"top":[{"n":"kize7/CVE-2026-94169","u":"https://github.com/kize7/CVE-2026-94169","s":0,"c":1792262865000,"d":"WordPress The Grid plugin <= 2.8.1 - Remote Code Execution (RCE) vulnerability"}]},"CVE-2026-92262":{"n":1,"first":1792351104000,"top":[{"n":"SeanDishman/mariadb-cve-2026-92262","u":"https://github.com/SeanDishman/mariadb-cve-2026-92262","s":0,"c":1792351104000,"d":"PoC for CVE-2026-92262, CVE-2026-85746, CVE-2026-85748 against MariaDB 13.0.1"}]},"CVE-2026-102607":{"n":1,"first":1773209933000,"top":[{"n":"d4kw1n/CVE-2026-102607-ZoneMinder","u":"https://github.com/d4kw1n/CVE-2026-102607-ZoneMinder","s":1,"c":1773209933000,"d":"PoC of CVE-2026-102607 ZoneMinder <= 1.38.1"}]},"CVE-2026-59970":{"n":1,"first":1792190964000,"top":[{"n":"asvorg/CVE-2026-59970-poc","u":"https://github.com/asvorg/CVE-2026-59970-poc","s":0,"c":1792190964000,"d":"PoC for CVE-2026-59970 Blind SSRF in Tandoor Recipes, CWE-918"}]},"CVE-2026-111823":{"n":1,"first":1792230811000,"top":[{"n":"murrez/CVE-2026-111823","u":"https://github.com/murrez/CVE-2026-111823","s":0,"c":1792230811000,"d":"PoC for CVE-2026-111823 — Mage AI OAuth session auth bypass (POST /api/sessions). Check + exploit modes. Authorized testing only."}]},"CVE-2026-104736":{"n":2,"first":1792183030000,"top":[{"n":"BIBILZERODAY/CVE-2026-104736---Proof-of-Concept-PoC-Exploit-Details","u":"https://github.com/BIBILZERODAY/CVE-2026-104736---Proof-of-Concept-PoC-Exploit-Details","s":0,"c":1792183030000,"d":""},{"n":"murrez/CVE-2026-104736","u":"https://github.com/murrez/CVE-2026-104736","s":0,"c":1792357173000,"d":"PoC for CVE-2026-104736 — LearnPress ≤4.4.10 unauthenticated PHP object injection via checkout-email (lp-ajax=checkout). Check + exploit. Au"}]},"CVE-2026-78162":{"n":1,"first":1792141842000,"top":[{"n":"oscerd/CVE-2026-78162","u":"https://github.com/oscerd/CVE-2026-78162","s":0,"c":1792141842000,"d":"Reproducer for CVE-2026-78162 (Apache Camel camel-hazelcast): ReplicatedHazelcastAggregationRepository starts a Hazelcast member with no Jav"}]},"CVE-2026-78164":{"n":1,"first":1792148847000,"top":[{"n":"oscerd/CVE-2026-78164","u":"https://github.com/oscerd/CVE-2026-78164","s":0,"c":1792148847000,"d":"Reproducer for CVE-2026-78164 (Apache Camel HTTP producers): property placeholders resolved on the message-supplied CamelHttpUri/CamelRestHt"}]},"CVE-2026-78165":{"n":1,"first":1792149519000,"top":[{"n":"oscerd/CVE-2026-78165","u":"https://github.com/oscerd/CVE-2026-78165","s":0,"c":1792149519000,"d":"Reproducer for CVE-2026-78165 (Apache Camel camel-spring-redis): default JdkSerializationRedisSerializer deserializes Redis PUBLISH payloads"}]},"CVE-2026-79983":{"n":1,"first":1792150781000,"top":[{"n":"oscerd/CVE-2026-79983","u":"https://github.com/oscerd/CVE-2026-79983","s":1,"c":1792150781000,"d":"Reproducer for CVE-2026-79983 (Apache Camel camel-ftp): the consumer builds the remote path from the server's directory listing without cont"}]},"CVE-2026-79984":{"n":1,"first":1792156122000,"top":[{"n":"oscerd/CVE-2026-79984","u":"https://github.com/oscerd/CVE-2026-79984","s":0,"c":1792156122000,"d":"Reproducer for CVE-2026-79984 (Apache Camel camel-mina-sftp): the consumer builds the remote path from the server's SFTP directory listing w"}]},"CVE-2026-79985":{"n":1,"first":1792156612000,"top":[{"n":"oscerd/CVE-2026-79985","u":"https://github.com/oscerd/CVE-2026-79985","s":0,"c":1792156612000,"d":"Reproducer for CVE-2026-79985 (Apache Camel camel-smb): the SMB consumer builds the remote path from the share listing without containment ("}]},"CVE-2026-79986":{"n":1,"first":1792157165000,"top":[{"n":"oscerd/CVE-2026-79986","u":"https://github.com/oscerd/CVE-2026-79986","s":0,"c":1792157165000,"d":"Reproducer for CVE-2026-79986 (Apache Camel camel-azure-files): the consumer builds the remote path from the share listing without containme"}]},"CVE-2026-80312":{"n":1,"first":1792318254000,"top":[{"n":"oscerd/CVE-2026-80312","u":"https://github.com/oscerd/CVE-2026-80312","s":0,"c":1792318254000,"d":"Reproducer for CVE-2026-80312 (Apache Camel camel-oauth): fail-open authentication guard — the OAuth processors returned control to the rout"}]},"CVE-2026-80343":{"n":1,"first":1792320109000,"top":[{"n":"oscerd/CVE-2026-80343","u":"https://github.com/oscerd/CVE-2026-80343","s":0,"c":1792320109000,"d":"Reproducer for CVE-2026-80343 (Apache Camel camel-netty-http): security constraint case-sensitivity bypass — altering the path case skips th"}]},"CVE-2026-80344":{"n":1,"first":1792394571000,"top":[{"n":"oscerd/CVE-2026-80344","u":"https://github.com/oscerd/CVE-2026-80344","s":0,"c":1792394571000,"d":"Reproducer for CVE-2026-80344 (Apache Camel camel-as2): asynchronous MDN SSRF + credential disclosure — the receiver delivers the MDN to the"}]},"CVE-2026-83531":{"n":1,"first":1792396012000,"top":[{"n":"oscerd/CVE-2026-83531","u":"https://github.com/oscerd/CVE-2026-83531","s":0,"c":1792396012000,"d":"Reproducer for CVE-2026-83531 (Apache Camel camel-dynamic-router): the dynamic-router-control endpoint compiles an attacker-supplied predica"}]}},"fix":{"CVE-2026-106931":{"p":[{"p":"EG Secure Solutions Inc. SiteGuard Server Edition for Apache httpd","f":["Ver8.00 Update 5"],"u":[]},{"p":"EG Secure Solutions Inc. SiteGuard Server Edition for Nginx","f":["Ver8.00 Update 5"],"u":[]},{"p":"EG Secure Solutions Inc. SiteGuard Server Edition for IIS","f":["Ver8.00 Update 5","Ver3.10"],"u":[]},{"p":"EG Secure Solutions Inc. SiteGuard Server Edition for Apache httpd on FreeBSD","f":["Ver7.00 Update 6"],"u":[]}],"a":["https://www.eg-secure.co.jp/siteguard/news/alert-202610-1","https://jvn.jp/en/jp/JVN88474777/"]},"CVE-2017-7170":{"p":[],"a":["https://support.apple.com/HT208221"]},"CVE-2019-8521":{"p":[{"p":"Apple iOS","f":["iOS 12.2"],"u":[]},{"p":"Apple macOS","f":["macOS Mojave 10.14.4"],"u":[]}],"a":["https://support.apple.com/HT209599","https://support.apple.com/HT209600"]},"CVE-2019-8565":{"p":[{"p":"Apple iOS","f":["iOS 12.2"],"u":[]},{"p":"Apple macOS","f":["macOS Mojave 10.14.4"],"u":[]}],"a":["https://support.apple.com/HT209599","https://support.apple.com/HT209600"]},"CVE-2026-0307":{"p":[{"p":"Palo Alto Networks GlobalProtect App","f":["6.3.3-h15","6.0.15"],"u":[]},{"p":"Palo Alto Networks GlobalProtect App","f":["6.3.3-h15","6.2.8-h14","6.0.15"],"u":[]}],"a":["https://security.paloaltonetworks.com/CVE-2026-0307"]},"CVE-2026-88771":{"p":[{"p":"Citrix NetScaler ADC","f":["14.1-73.37","13.1-64.23","14.1-73.37 FIPS","13.1.37.279 FIPS and NDcPP"],"u":[]},{"p":"Citrix NetScaler Gateway","f":["14.1-73.37","13.1-64.23"],"u":[]}],"a":["https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697096"]},"CVE-2026-107406":{"p":[{"p":"NetScaler ADC","f":["14.1-73.46","13.1-64.29","14.1-73.46 FIPS","13.1.37.283 FIPS"],"u":[]},{"p":"NetScaler Gateway","f":["14.1-73.46","13.1-64.29"],"u":[]}],"a":["https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697191"]},"CVE-2026-103849":{"p":[{"p":"Adobe Adobe Commerce","f":[],"u":["2.4.9-2026-sep, 2.4.8-2026-sep, 2.4.7-2026-sep, 2.4.6-2026-sep, 2.4.5-2026-sep, 2.4.4-2026-sep"]},{"p":"Adobe Adobe Commerce B2B","f":[],"u":["1.5.3-2026-sep, 1.5.2-2026-sep, 1.4.2-2026-sep, 1.3.4-2026-sep, 1.3.3-2026-sep"]},{"p":"Adobe Magento Open Source","f":[],"u":["2.4.9-2026-sep, 2.4.8-2026-sep, 2.4.7-2026-sep"]}],"a":["https://www.adobe.com/trust/security/products/commerce/apsb26-153.html"]},"CVE-2026-16756":{"p":[{"p":"AWS aws-smithy-http-server","f":[],"u":["0.66.4"]}],"a":["https://crates.io/crates/aws-smithy-http-server/0.66.5","https://aws.amazon.com/security/security-bulletins/2026-064-aws/","https://github.com/smithy-lang/smithy-rs/security/advisories/GHSA-jvxp-qmx7-gjpx"]},"CVE-2025-4318":{"p":[{"p":"Amazon Amplify Studio","f":["2.20.3"],"u":[]}],"a":["https://aws.amazon.com/security/security-bulletins/AWS-2025-010/","https://github.com/aws-amplify/amplify-codegen-ui/releases/tag/v2.20.3","https://github.com/aws-amplify/amplify-codegen-ui/security/advisories/GHSA-hf3j-86p7-mfw8"]},"CVE-2026-16317":{"p":[{"p":"AWS s2n-tls","f":[],"u":["1.7.5"]}],"a":["https://github.com/aws/s2n-tls/releases/tag/v1.7.6","https://aws.amazon.com/security/security-bulletins/2026-062-aws/","https://github.com/aws/s2n-tls/security/advisories/GHSA-684c-v35q-fvx7"]},"CVE-2026-16318":{"p":[{"p":"Amazon s2n-tls","f":[],"u":["v1.7.5"]}],"a":["https://github.com/aws/s2n-tls/releases/tag/v1.7.6","https://staging.prod.website.marketing.aws.dev/security/security-bulletins/2026-062-aws/","https://github.com/aws/s2n-tls/security/advisories/GHSA-cr7x-863j-xrc7"]},"CVE-2026-18394":{"p":[{"p":"AWS Strands Agents Tools","f":["0.8.2"],"u":[]}],"a":["https://github.com/strands-agents/tools/releases/tag/v0.8.2","https://aws.amazon.com/security/security-bulletins/2026-069-aws/"]},"CVE-2026-102551":{"p":[{"p":"FreeRTOS FreeRTOS-Plus-TCP","f":[],"u":["4.4.1"]}],"a":["https://github.com/FreeRTOS/FreeRTOS-Plus-TCP/releases/tag/V4.4.2","https://aws.amazon.com/security/security-bulletins/2026-139-aws/"]},"CVE-2026-102552":{"p":[{"p":"FreeRTOS FreeRTOS-Plus-TCP","f":[],"u":["4.4.1"]}],"a":["https://github.com/FreeRTOS/FreeRTOS-Plus-TCP/releases/tag/V4.4.2","https://aws.amazon.com/security/security-bulletins/2026-139-aws/"]},"CVE-2026-105008":{"p":[{"p":"Microsoft Windows 10 Version 1607","f":["10.0.14393.9612"],"u":[]},{"p":"Microsoft Windows 10 Version 1809","f":["10.0.17763.9376"],"u":[]},{"p":"Microsoft Windows 10 Version 21H2","f":["10.0.19044.7807"],"u":[]},{"p":"Microsoft Windows 10 Version 22H2","f":["10.0.19044.7807"],"u":[]}],"a":["https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-105008"]},"CVE-2026-96044":{"p":[{"p":"Microsoft Microsoft SharePoint Server Subscription Edition","f":["16.0.20326.20190"],"u":[]}],"a":["https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96044"]},"CVE-2026-108471":{"p":[{"p":"Microsoft Windows 10 Version 1809","f":["10.0.17763.9376"],"u":[]},{"p":"Microsoft Windows Server 2019","f":["10.0.17763.9376"],"u":[]},{"p":"Microsoft Windows Server 2019 (Server Core installation)","f":["10.0.17763.9376"],"u":[]}],"a":["https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-108471"]},"CVE-2026-83518":{"p":[{"p":"Microsoft Windows 11 version 23H2","f":["10.0.22631.7582"],"u":[]},{"p":"Microsoft Windows 11 Version 23H2","f":["10.0.22631.7582"],"u":[]},{"p":"Microsoft Windows 11 Version 24H2","f":["10.0.26100.9445"],"u":[]},{"p":"Microsoft Windows 11 Version 25H2","f":["10.0.26200.9445"],"u":[]}],"a":["https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-83518"]},"CVE-2026-108465":{"p":[{"p":"Microsoft Windows 10 Version 1809","f":["10.0.17763.9376"],"u":[]},{"p":"Microsoft Windows 10 Version 21H2","f":["10.0.19044.7807"],"u":[]},{"p":"Microsoft Windows 10 Version 22H2","f":["10.0.19045.7807"],"u":[]},{"p":"Microsoft Windows 11 version 23H2","f":["10.0.22631.7652"],"u":[]}],"a":["https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-108465"]},"CVE-2026-106287":{"p":[{"p":"Google Chrome","f":["155.0.8059.39"],"u":[]}],"a":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","https://issues.chromium.org/issues/513518289"]},"CVE-2026-106288":{"p":[{"p":"Google Chrome","f":["155.0.8059.39"],"u":[]}],"a":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","https://issues.chromium.org/issues/553274076"]},"CVE-2026-106289":{"p":[{"p":"Google Chrome","f":["155.0.8059.39"],"u":[]}],"a":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","https://issues.chromium.org/issues/517700327"]},"CVE-2026-106291":{"p":[{"p":"Google Chrome","f":["155.0.8059.39"],"u":[]}],"a":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","https://issues.chromium.org/issues/499571442"]},"CVE-2026-106292":{"p":[{"p":"Google Chrome","f":["155.0.8059.39"],"u":[]}],"a":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","https://issues.chromium.org/issues/524587778"]},"CVE-2026-106412":{"p":[{"p":"Google Chrome","f":["155.0.8059.39"],"u":[]}],"a":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","https://issues.chromium.org/issues/520755056"]},"CVE-2026-106293":{"p":[{"p":"Google Chrome","f":["155.0.8059.39"],"u":[]}],"a":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","https://issues.chromium.org/issues/547343108"]},"CVE-2026-106413":{"p":[{"p":"Google Chrome","f":["155.0.8059.39"],"u":[]}],"a":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","https://issues.chromium.org/issues/553336689"]},"CVE-2026-106294":{"p":[{"p":"Google Chrome","f":["155.0.8059.39"],"u":[]}],"a":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","https://issues.chromium.org/issues/556215048"]},"CVE-2026-106415":{"p":[{"p":"Google Chrome","f":["155.0.8059.39"],"u":[]}],"a":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","https://issues.chromium.org/issues/502179715"]},"CVE-2026-106295":{"p":[{"p":"Google Chrome","f":["155.0.8059.39"],"u":[]}],"a":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","https://issues.chromium.org/issues/553138969"]},"CVE-2026-106416":{"p":[{"p":"Google Chrome","f":["155.0.8059.39"],"u":[]}],"a":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","https://issues.chromium.org/issues/514072462"]},"CVE-2026-106297":{"p":[{"p":"Google Chrome","f":["155.0.8059.39"],"u":[]}],"a":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","https://issues.chromium.org/issues/513735469"]},"CVE-2026-106417":{"p":[{"p":"Google Chrome","f":["155.0.8059.39"],"u":[]}],"a":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","https://issues.chromium.org/issues/536471438"]},"CVE-2026-106299":{"p":[{"p":"Google Chrome","f":["155.0.8059.39"],"u":[]}],"a":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","https://issues.chromium.org/issues/519211890"]},"CVE-2026-106418":{"p":[{"p":"Google Chrome","f":["155.0.8059.39"],"u":[]}],"a":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","https://issues.chromium.org/issues/553283471"]},"CVE-2026-106300":{"p":[{"p":"Google Chrome","f":["155.0.8059.39"],"u":[]}],"a":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","https://issues.chromium.org/issues/500106110"]},"CVE-2026-106420":{"p":[{"p":"Google Chrome","f":["155.0.8059.39"],"u":[]}],"a":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","https://issues.chromium.org/issues/477327257"]},"CVE-2026-106301":{"p":[{"p":"Google Chrome","f":["155.0.8059.39"],"u":[]}],"a":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","https://issues.chromium.org/issues/523750306"]},"CVE-2026-106421":{"p":[{"p":"Google Chrome","f":["155.0.8059.39"],"u":[]}],"a":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","https://issues.chromium.org/issues/567873463"]},"CVE-2026-106302":{"p":[{"p":"Google Chrome","f":["155.0.8059.39"],"u":[]}],"a":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","https://issues.chromium.org/issues/514071472"]},"CVE-2026-106422":{"p":[{"p":"Google Chrome","f":["155.0.8059.39"],"u":[]}],"a":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","https://issues.chromium.org/issues/519458746"]},"CVE-2026-106303":{"p":[{"p":"Google Chrome","f":["155.0.8059.39"],"u":[]}],"a":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","https://issues.chromium.org/issues/517475258"]},"CVE-2026-106423":{"p":[{"p":"Google Chrome","f":["155.0.8059.39"],"u":[]}],"a":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","https://issues.chromium.org/issues/566347711"]},"CVE-2026-106304":{"p":[{"p":"Google Chrome","f":["155.0.8059.39"],"u":[]}],"a":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","https://issues.chromium.org/issues/553124799"]},"CVE-2026-106424":{"p":[{"p":"Google Chrome","f":["155.0.8059.39"],"u":[]}],"a":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","https://issues.chromium.org/issues/513365978"]},"CVE-2026-106306":{"p":[{"p":"Google Chrome","f":["155.0.8059.39"],"u":[]}],"a":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","https://issues.chromium.org/issues/513383360"]},"CVE-2026-106425":{"p":[{"p":"Google Chrome","f":["155.0.8059.39"],"u":[]}],"a":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","https://issues.chromium.org/issues/501790682"]},"CVE-2026-106307":{"p":[{"p":"Google Chrome","f":["155.0.8059.39"],"u":[]}],"a":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","https://issues.chromium.org/issues/537832408"]},"CVE-2026-106426":{"p":[{"p":"Google Chrome","f":["155.0.8059.39"],"u":[]}],"a":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","https://issues.chromium.org/issues/547065823"]},"CVE-2026-106308":{"p":[{"p":"Google Chrome","f":["155.0.8059.39"],"u":[]}],"a":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","https://issues.chromium.org/issues/560055258"]},"CVE-2026-106309":{"p":[{"p":"Google Chrome","f":["155.0.8059.39"],"u":[]}],"a":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","https://issues.chromium.org/issues/503708636"]},"CVE-2026-106310":{"p":[{"p":"Google Chrome","f":["155.0.8059.39"],"u":[]}],"a":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","https://issues.chromium.org/issues/556250086"]},"CVE-2026-106311":{"p":[{"p":"Google Chrome","f":["155.0.8059.39"],"u":[]}],"a":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","https://issues.chromium.org/issues/514061289"]},"CVE-2026-106312":{"p":[{"p":"Google Chrome","f":["155.0.8059.39"],"u":[]}],"a":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","https://issues.chromium.org/issues/502111211"]},"CVE-2026-106314":{"p":[{"p":"Google Chrome","f":["155.0.8059.39"],"u":[]}],"a":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","https://issues.chromium.org/issues/501533684"]},"CVE-2026-106315":{"p":[{"p":"Google Chrome","f":["155.0.8059.39"],"u":[]}],"a":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","https://issues.chromium.org/issues/497652727"]},"CVE-2026-106316":{"p":[{"p":"Google Chrome","f":["155.0.8059.39"],"u":[]}],"a":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","https://issues.chromium.org/issues/554556423"]},"CVE-2026-106318":{"p":[{"p":"Google Chrome","f":["155.0.8059.39"],"u":[]}],"a":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","https://issues.chromium.org/issues/566111249"]},"CVE-2026-106321":{"p":[{"p":"Google Chrome","f":["155.0.8059.39"],"u":[]}],"a":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","https://issues.chromium.org/issues/556235808"]},"CVE-2026-106322":{"p":[{"p":"Google Chrome","f":["155.0.8059.39"],"u":[]}],"a":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","https://issues.chromium.org/issues/517213220"]},"CVE-2026-106324":{"p":[{"p":"Google Chrome","f":["155.0.8059.39"],"u":[]}],"a":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","https://issues.chromium.org/issues/501171258"]},"CVE-2026-106325":{"p":[{"p":"Google Chrome","f":["155.0.8059.39"],"u":[]}],"a":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","https://issues.chromium.org/issues/556211265"]},"CVE-2026-106327":{"p":[{"p":"Google Chrome","f":["155.0.8059.39"],"u":[]}],"a":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","https://issues.chromium.org/issues/551529559"]},"CVE-2026-106328":{"p":[{"p":"Google Chrome","f":["155.0.8059.39"],"u":[]}],"a":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","https://issues.chromium.org/issues/518091868"]},"CVE-2026-106329":{"p":[{"p":"Google Chrome","f":["155.0.8059.39"],"u":[]}],"a":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","https://issues.chromium.org/issues/562043997"]},"CVE-2026-110136":{"p":[{"p":"Google Chrome","f":["155.0.8059.79"],"u":[]}],"a":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01668083673.html","https://issues.chromium.org/issues/568719364"]},"CVE-2026-106330":{"p":[{"p":"Google Chrome","f":["155.0.8059.39"],"u":[]}],"a":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html","https://issues.chromium.org/issues/553135213"]},"CVE-2026-15176":{"p":[{"p":"F5 NGINX Plus","f":["37.1.0.1","37.0.5.1"],"u":[]},{"p":"F5 NGINX Open Source","f":["1.31.7","1.30.6"],"u":[]}],"a":["https://my.f5.com/manage/s/article/K000162416"]},"CVE-2026-93479":{"p":[{"p":"F5 NGINX Plus","f":["37.1.0.1","37.0.5.1"],"u":[]},{"p":"F5 NGINX Open Source","f":["1.31.7","1.30.6"],"u":[]}],"a":["https://my.f5.com/manage/s/article/K000162607"]},"CVE-2026-97229":{"p":[{"p":"GitLab GitLab","f":["19.2.8","19.3.5","19.4.2"],"u":[]}],"a":["https://gitlab.com/gitlab-org/gitlab/-/work_items/630686","https://hackerone.com/reports/4055749","https://hackerone.com/reports/4058589"]},"CVE-2025-61624":{"p":[{"p":"Fortinet FortiOS","f":[],"u":["7.6.4","7.4.9","7.2.13"]},{"p":"Fortinet FortiProxy","f":[],"u":["7.6.4","7.4.11","7.2.16"]},{"p":"Fortinet FortiSwitchManager","f":[],"u":["7.2.7","7.0.6"]},{"p":"Fortinet FortiPAM","f":[],"u":["1.6.2","1.5.1","1.4.3"]}],"a":["https://fortiguard.fortinet.com/psirt/FG-IR-26-122"]},"CVE-2026-102764":{"p":[{"p":"BeyondTrust Remote Support","f":[],"u":["26.2.3"]}],"a":["https://www.beyondtrust.com/blog/entry/bt26-05","https://beyondtrustcorp.service-now.com/csm?id=csm_kb_article&sysparm_article=KB0024066"]},"CVE-2026-21589":{"p":[],"a":["https://jira.atlassian.com/browse/BAM-26567","https://jira.atlassian.com/browse/BSERV-20604","https://jira.atlassian.com/browse/CONFSERVER-104488"]},"CVE-2026-88794":{"p":[],"a":["https://cert.pl/en/posts/2026/10/CVE-2026-88794","https://sparxsystems.com/products/ea/"]},"CVE-2026-63273":{"p":[{"p":"The Document Foundation LibreOffice","f":["< 26.2.5"],"u":[]}],"a":["https://www.libreoffice.org/about-us/security/advisories/cve-2026-63273"]},"CVE-2026-63274":{"p":[{"p":"The Document Foundation LibreOffice","f":["< 26.2.5"],"u":[]}],"a":["https://www.libreoffice.org/about-us/security/advisories/cve-2026-63274"]},"CVE-2026-6045":{"p":[{"p":"The Document Foundation LibreOffice","f":["< 25.8.7","< 26.2.3"],"u":[]}],"a":["https://www.libreoffice.org/about-us/security/advisories/cve-2026-6045"]},"CVE-2026-58094":{"p":[{"p":"FreeBSD FreeBSD","f":["p3","p13","p9"],"u":[]}],"a":["https://security.freebsd.org/advisories/FreeBSD-SA-26:63.posixshm.asc"]},"CVE-2026-58093":{"p":[{"p":"FreeBSD FreeBSD","f":["p3","p13","p9"],"u":[]}],"a":["https://security.freebsd.org/advisories/FreeBSD-SA-26:62.tty.asc"]},"CVE-2026-81983":{"p":[{"p":"Adobe Adobe Acrobat","f":[],"u":["26.002.21900"]},{"p":"Adobe Acrobat Reader","f":[],"u":["26.002.21900"]},{"p":"Adobe Acrobat 2024","f":[],"u":["24.001.30383"]}],"a":["https://helpx.adobe.com/security/products/acrobat/apsb26-141.html"]},"CVE-2026-110447":{"p":[{"p":"Collabora Collabora Online - Built-in CODE Server","f":["26.4.303"],"u":[]}],"a":["https://help.nextcloud.com/t/to-collabora-built-in-user-update-asap/250516"]},"CVE-2026-99999":{"p":[{"p":"Linux Linux","f":["a464d950f31c89565cbaae038cc60db04fe01956","0fab003ef4698e0628060a45a48f14b43ba2a40a","94524b7b32691de2e2ce162c04d6cbc9106e5cbf","a65f69e0f38ffbed1b128029e09097436416dc8b","32a8b0adaa18e52aaa0b246b5ffe683075354dbb"],"u":[]}],"a":["https://git.kernel.org/stable/c/a464d950f31c89565cbaae038cc60db04fe01956","https://git.kernel.org/stable/c/0fab003ef4698e0628060a45a48f14b43ba2a40a","https://git.kernel.org/stable/c/94524b7b32691de2e2ce162c04d6cbc9106e5cbf"]},"CVE-2026-76463":{"p":[],"a":["https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-meraki-os-drbEX9GH"]},"CVE-2026-76464":{"p":[],"a":["https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-meraki-os-drbEX9GH"]},"CVE-2026-76467":{"p":[],"a":["https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-meraki-os-drbEX9GH"]},"CVE-2026-76468":{"p":[],"a":["https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-meraki-os-drbEX9GH"]},"CVE-2026-76469":{"p":[],"a":["https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-meraki-os-drbEX9GH"]},"CVE-2026-76470":{"p":[],"a":["https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-meraki-os-drbEX9GH"]},"CVE-2026-76472":{"p":[],"a":["https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-meraki-os-drbEX9GH"]},"CVE-2026-0320":{"p":[{"p":"Palo Alto Networks PAN-OS","f":["12.2.4","12.1.10-h2","12.1.7-h8","12.1.4-h12","11.2.16"],"u":[]},{"p":"Palo Alto Networks Prisma Access","f":["12.1.7-h8"],"u":[]}],"a":["https://security.paloaltonetworks.com/CVE-2026-0320"]},"CVE-2026-0321":{"p":[{"p":"Palo Alto Networks PAN-OS","f":["12.2.4","12.1.10-h2","12.1.7-h8","12.1.4-h12","11.2.16"],"u":[]},{"p":"Palo Alto Networks Prisma Access","f":["12.1.7-h8","11.2.7-h21","10.2.10-h41"],"u":[]}],"a":["https://security.paloaltonetworks.com/CVE-2026-0321"]},"CVE-2026-0317":{"p":[{"p":"Palo Alto Networks PAN-OS","f":["12.2.4","12.1.10-h2","11.2.16","11.1.16-h3"],"u":[]},{"p":"Palo Alto Networks Prisma Access","f":["12.1.7-h8"],"u":[]}],"a":["https://security.paloaltonetworks.com/CVE-2026-0317"]},"CVE-2026-15737":{"p":[],"a":["https://pypi.org/project/bedrock-agentcore/1.5.1/","https://aws.amazon.com/security/security-bulletins/2026-058-aws/","https://github.com/aws/bedrock-agentcore-sdk-python/security/advisories/GHSA-hqf8-7w95-9r33"]},"CVE-2026-15415":{"p":[{"p":"AWS aws-healthomics-mcp-server","f":["0.0.36"],"u":[]}],"a":["https://pypi.org/project/awslabs.aws-healthomics-mcp-server/0.0.36/","https://aws.amazon.com/security/security-bulletins/2026-060-aws/","https://github.com/awslabs/mcp/security/advisories/GHSA-6x7f-488g-75wm"]},"CVE-2026-15746":{"p":[{"p":"Amazon strands-agents-tools","f":["0.7.0"],"u":[]}],"a":["https://pypi.org/project/strands-agents-tools/0.7.0/","https://aws.amazon.com/security/security-bulletins/2026-056-aws/","https://github.com/strands-agents/tools/security/advisories/GHSA-ppcf-fpr3-x46v"]},"CVE-2026-9255":{"p":[{"p":"AWS Kiro CLI","f":["1.28.0"],"u":[]}],"a":["https://kiro.dev/changelog/cli/1-28/","https://aws.amazon.com/security/security-bulletins/2026-035-aws/"]},"CVE-2026-10591":{"p":[{"p":"AWS Kiro IDE","f":["11"],"u":[]}],"a":["https://kiro.dev/changelog/ide/0-11/","https://aws.amazon.com/security/security-bulletins/2026-037-aws/"]},"CVE-2026-8596":{"p":[{"p":"Amazon SageMaker Python SDK AWS","f":[],"u":["2.257.1","3.7.1"]}],"a":["https://github.com/aws/sagemaker-python-sdk/releases/tag/v2.257.2","https://github.com/aws/sagemaker-python-sdk/releases/tag/v3.8.0","https://aws.amazon.com/security/security-bulletins/2026-031-aws/"]},"CVE-2026-8597":{"p":[{"p":"Amazon SageMaker Python SDK AWS","f":[],"u":["2.257.1","3.7.1"]}],"a":["https://github.com/aws/sagemaker-python-sdk/releases/tag/v2.257.2","https://github.com/aws/sagemaker-python-sdk/releases/tag/v3.8.0","https://aws.amazon.com/security/security-bulletins/2026-031-aws/"]},"CVE-2026-8178":{"p":[],"a":["https://github.com/aws/amazon-redshift-jdbc-driver/releases/tag/v2.2.2","https://aws.amazon.com/security/security-bulletins/2026-028-aws/"]},"CVE-2026-31431":{"p":[{"p":"Linux Linux","f":["893d22e0135fa394db81df88697fba6032747667","19d43105a97be0810edbda875f2cd03f30dc130c","961cfa271a918ad4ae452420e7c303149002875b","3115af9644c342b356f3f07a4dd1c8905cd9a6fc","8b88d99341f139e23bdeb1027a2a3ae10d341d82"],"u":[]}],"a":["https://git.kernel.org/stable/c/893d22e0135fa394db81df88697fba6032747667","https://git.kernel.org/stable/c/19d43105a97be0810edbda875f2cd03f30dc130c","https://git.kernel.org/stable/c/961cfa271a918ad4ae452420e7c303149002875b"]},"CVE-2026-107777":{"p":[{"p":"Thermo Fisher Torrent Suite Software","f":[],"u":["5.18"]}],"a":["https://documents.thermofisher.com/TFS-Assets/CORP/Product-Guides/Ion_OneTouch_2_and_Torrent_Suite_Software.pdf","https://www.cisa.gov/news-events/ics-medical-advisories/icsma-26-288-01","https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsma-26-288-01.json"]},"CVE-2026-97851":{"p":[],"a":["https://www.cisa.gov/news-events/ics-medical-advisories/icsma-26-288-02","https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsma-26-288-02.json"]},"CVE-2026-107621":{"p":[],"a":["https://www.cisa.gov/news-events/ics-medical-advisories/icsma-26-288-02","https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsma-26-288-02.json"]},"CVE-2026-105273":{"p":[],"a":["https://www.cisa.gov/news-events/ics-medical-advisories/icsma-26-288-02","https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsma-26-288-02.json"]},"CVE-2026-101021":{"p":[],"a":["https://www.cisa.gov/news-events/ics-medical-advisories/icsma-26-288-02","https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsma-26-288-02.json"]},"CVE-2026-105279":{"p":[],"a":["https://www.cisa.gov/news-events/ics-medical-advisories/icsma-26-288-02","https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsma-26-288-02.json"]},"CVE-2026-105667":{"p":[],"a":["https://www.cisa.gov/news-events/ics-medical-advisories/icsma-26-288-02","https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsma-26-288-02.json"]},"CVE-2026-107617":{"p":[{"p":"Guangzhou Juan IoT Technology Co., Ltd. EseeCloud App","f":[],"u":["4.9.6"]},{"p":"Guangzhou Juan IoT Technology Co., Ltd. EseeCloud Firmware","f":[],"u":["4.9.86.0"]}],"a":["https://eseecloud.app/","https://www.cisa.gov/news-events/ics-advisories/icsa-26-288-02","https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-288-02.json"]},"CVE-2026-97858":{"p":[{"p":"Guangzhou Juan IoT Technology Co., Ltd. EseeCloud App","f":[],"u":["4.9.6"]},{"p":"Guangzhou Juan IoT Technology Co., Ltd. EseeCloud Firmware","f":[],"u":["4.9.86.0"]}],"a":["https://eseecloud.app/","https://www.cisa.gov/news-events/ics-advisories/icsa-26-288-02","https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-288-02.json"]},"CVE-2026-105664":{"p":[{"p":"Guangzhou Juan IoT Technology Co., Ltd. EseeCloud App","f":[],"u":["4.9.6"]},{"p":"Guangzhou Juan IoT Technology Co., Ltd. EseeCloud Firmware","f":[],"u":["4.9.86.0"]}],"a":["https://eseecloud.app/","https://www.cisa.gov/news-events/ics-advisories/icsa-26-288-02","https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-288-02.json"]},"CVE-2026-63252":{"p":[{"p":"Eclipse Foundation Eclipse Milo","f":[],"u":["1.1.4"]}],"a":["https://github.com/eclipse-milo/milo/commit/459715793ec54b0f33367a14f94264500a0d872b","https://gitlab.eclipse.org/security/vulnerability-reports/-/work_items/598","https://gitlab.eclipse.org/security/cve-assignment/-/work_items/179"]},"CVE-2026-63248":{"p":[{"p":"Eclipse Foundation Eclipse Milo","f":[],"u":["1.1.4"]}],"a":["https://github.com/eclipse-milo/milo/commit/a5dae1be0657d2b4fcb66e63f377c1dc36069e2a","https://gitlab.eclipse.org/security/vulnerability-reports/-/work_items/598","https://gitlab.eclipse.org/security/cve-assignment/-/work_items/181"]},"CVE-2026-60007":{"p":[{"p":"Eclipse Foundation Eclipse Milo","f":[],"u":["1.1.4"]}],"a":["https://github.com/eclipse-milo/milo/commit/db59fae993a3a1bc66fffc8a2796d444b40285fb","https://gitlab.eclipse.org/security/vulnerability-reports/-/work_items/598","https://gitlab.eclipse.org/security/cve-assignment/-/work_items/183"]},"CVE-2026-62927":{"p":[{"p":"Eclipse Foundation Eclipse Milo","f":["1.1.5"],"u":[]}],"a":["https://github.com/eclipse-milo/milo/commit/59b50bed094de0d18a130a48f3527254dc76105d","https://gitlab.eclipse.org/security/vulnerability-reports/-/work_items/598","https://gitlab.eclipse.org/security/cve-assignment/-/work_items/178"]},"CVE-2026-58080":{"p":[{"p":"Eclipse Foundation Eclipse Milo","f":["1.1.5"],"u":[]}],"a":["https://github.com/eclipse-milo/milo/commit/d51f03e9a75f313ab41c3d68d809f4b922073f1a","https://gitlab.eclipse.org/security/vulnerability-reports/-/work_items/598","https://gitlab.eclipse.org/security/cve-assignment/-/work_items/180"]},"CVE-2026-61387":{"p":[{"p":"Eclipse Foundation Eclipse Milo","f":["1.1.5"],"u":[]}],"a":["https://github.com/eclipse-milo/milo/commit/587e35669f519b2d7f6d850a5f86ee5a76c3a2c5","https://github.com/eclipse-milo/milo/commit/5f3f6da2a5ea80682e1da7c58f7a1870b09d2b43","https://gitlab.eclipse.org/security/vulnerability-reports/-/work_items/598"]},"CVE-2026-107336":{"p":[{"p":"CISA Malcolm","f":[],"u":["26.07.1"]}],"a":["https://github.com/cisagov/Malcolm/security/advisories/GHSA-7j32-cf27-cp6h","https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-280-01.json"]},"CVE-2026-107361":{"p":[{"p":"CISA Malcolm","f":[],"u":["26.07.1"]}],"a":["https://github.com/cisagov/Malcolm/security/advisories/GHSA-86h3-7rf8-8j34","https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-280-01.json"]},"CVE-2026-107337":{"p":[{"p":"CISA Malcolm","f":[],"u":["26.07.1"]}],"a":["https://github.com/cisagov/Malcolm/security/advisories/GHSA-w8gq-4v5x-xrrm","https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-280-01.json"]},"CVE-2026-107335":{"p":[{"p":"CISA Malcolm","f":[],"u":["26.07.1"]}],"a":["https://github.com/cisagov/Malcolm/security/advisories/GHSA-f2v6-8cj4-mhr6","https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-280-01.json"]},"CVE-2026-107334":{"p":[{"p":"CISA Malcolm","f":[],"u":["26.07.1"]}],"a":["https://github.com/cisagov/Malcolm/security/advisories/GHSA-jr6p-63pg-hr6g","https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-280-01.json"]},"CVE-2026-107333":{"p":[{"p":"CISA Malcolm","f":[],"u":["26.07.1"]}],"a":["https://github.com/cisagov/Malcolm/security/advisories/GHSA-v66f-cwcm-hf73","https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-280-01.json"]},"CVE-2026-107362":{"p":[{"p":"CISA Malcolm","f":[],"u":["26.07.1"]}],"a":["https://github.com/cisagov/Malcolm/security/advisories/GHSA-cvx2-hj33-vc4q","https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-280-01.json"]},"CVE-2026-35029":{"p":[],"a":["https://github.com/BerriAI/litellm/security/advisories/GHSA-53mr-6c8q-9789"]},"CVE-2026-59823":{"p":[],"a":["https://github.com/BerriAI/litellm/security/advisories/GHSA-hx8v-g79f-8w5f","https://github.com/BerriAI/litellm/pull/25827","https://github.com/BerriAI/litellm/commit/47214be317f45a2d2ac08258362e0481411eb427"]},"CVE-2026-0322":{"p":[{"p":"Palo Alto Networks PAN-OS","f":["12.2.4","12.1.10-h2","12.1.4-h12","12.1.7-h8","11.2.16"],"u":[]}],"a":["https://security.paloaltonetworks.com/CVE-2026-0322"]},"CVE-2026-76519":{"p":[],"a":["https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-afw-zqYJkjxp"]},"CVE-2026-105133":{"p":[],"a":["https://www.ahsay.com/en/support/help-centre/release-notes/cbs/v10.3.4"]},"CVE-2026-105134":{"p":[],"a":["https://www.ahsay.com/en/support/help-centre/release-notes/cbs/v10.3.4"]},"CVE-2026-70111":{"p":[{"p":"Microsoft Windows 10 Version 1607","f":["10.0.14393.9612"],"u":[]},{"p":"Microsoft Windows 10 Version 1809","f":["10.0.17763.9376"],"u":[]},{"p":"Microsoft Windows 10 Version 21H2","f":["10.0.19044.7807"],"u":[]},{"p":"Microsoft Windows 10 Version 22H2","f":["10.0.19044.7807"],"u":[]}],"a":["https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70111"]},"CVE-2026-35616":{"p":[{"p":"Fortinet FortiClientEMS","f":[],"u":["7.4.6"]}],"a":["https://fortiguard.fortinet.com/psirt/FG-IR-26-099"]},"CVE-2026-105740":{"p":[],"a":["https://github.com/langflow-ai/langflow/security/advisories/GHSA-7w94-79vh-5mr2","https://github.com/langflow-ai/langflow/security/advisories/GHSA-w794-rj3p-xv45","https://github.com/langflow-ai/langflow/pull/12290"]},"CVE-2026-111105":{"p":[],"a":["https://www.zerodayinitiative.com/advisories/ZDI-26-757/"]},"CVE-2018-10388":{"p":[],"a":["https://sourceforge.net/p/tftp-server/discussion/550564/thread/a586ce62/"]},"CVE-2018-10389":{"p":[],"a":["https://sourceforge.net/p/tftp-server/discussion/550564/thread/a586ce62/"]},"CVE-2026-106170":{"p":[{"p":"Fortinet FortiSandbox","f":[],"u":["5.2.1","5.0.6","4.4.10"]}],"a":["https://fortiguard.fortinet.com/psirt/FG-IR-26-176"]},"CVE-2026-102257":{"p":[],"a":["https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0017"]},"CVE-2026-95636":{"p":[{"p":"Adobe Photoshop","f":[],"u":["27.10"]},{"p":"Adobe Photoshop","f":[],"u":["26.11.7"]}],"a":["https://www.adobe.com/trust/security/products/photoshop/apsb26-158.html"]},"CVE-2026-83661":{"p":[{"p":"Adobe Photoshop","f":[],"u":["27.10"]},{"p":"Adobe Photoshop","f":[],"u":["26.11.7"]}],"a":["https://www.adobe.com/trust/security/products/photoshop/apsb26-158.html"]},"CVE-2026-69982":{"p":[{"p":"Microsoft Windows 10 Version 1607","f":["10.0.14393.9612"],"u":[]},{"p":"Microsoft Windows 10 Version 1809","f":["10.0.17763.9376"],"u":[]},{"p":"Microsoft Windows Server 2012 R2","f":["6.3.9600.23470"],"u":[]},{"p":"Microsoft Windows Server 2012 R2 (Server Core installation)","f":["6.3.9600.23470"],"u":[]}],"a":["https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69982"]},"CVE-2026-96252":{"p":[{"p":"Microsoft Windows 10 Version 1607","f":["10.0.14393.9612"],"u":[]},{"p":"Microsoft Windows 10 Version 1809","f":["10.0.17763.9376"],"u":[]},{"p":"Microsoft Windows Server 2012","f":["6.2.9200.26434"],"u":[]},{"p":"Microsoft Windows Server 2012 (Server Core installation)","f":["6.2.9200.26434"],"u":[]}],"a":["https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96252"]},"CVE-2026-108131":{"p":[{"p":"Microsoft Windows 10 Version 1607","f":["10.0.14393.9612"],"u":[]},{"p":"Microsoft Windows 10 Version 1809","f":["10.0.17763.9376"],"u":[]},{"p":"Microsoft Windows 10 Version 21H2","f":["10.0.19044.7807"],"u":[]},{"p":"Microsoft Windows 10 Version 22H2","f":["10.0.19044.7807"],"u":[]}],"a":["https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-108131"]},"CVE-2024-47575":{"p":[{"p":"Fortinet FortiManager","f":[],"u":["7.4.4","7.2.7","7.0.12"]}],"a":["https://fortiguard.fortinet.com/psirt/FG-IR-24-423"]},"CVE-2026-13762":{"p":[],"a":["https://aws.amazon.com/security/security-bulletins/2026-048-aws/"]},"CVE-2026-13763":{"p":[],"a":["https://docs.aws.amazon.com/elasticloadbalancing/latest/application/edit-target-group-attributes.html#waf-http2-inspection","https://aws.amazon.com/security/security-bulletins/2026-048-aws/"]},"CVE-2026-50195":{"p":[],"a":["https://github.com/containerd/containerd/security/advisories/GHSA-cvxm-645q-p574"]},"CVE-2026-53488":{"p":[],"a":["https://github.com/containerd/containerd/security/advisories/GHSA-xhf5-7wjv-pqxp"]},"CVE-2026-53492":{"p":[],"a":["https://github.com/containerd/containerd/security/advisories/GHSA-33vj-92qq-66hc"]},"CVE-2026-53489":{"p":[],"a":["https://github.com/containerd/containerd/security/advisories/GHSA-rgh6-rfwx-v388"]},"CVE-2026-47262":{"p":[],"a":["https://github.com/containerd/containerd/security/advisories/GHSA-jpcc-p29g-p8mq"]},"CVE-2026-15643":{"p":[{"p":"AWS awslabs.healthlake-mcp-server","f":["0.0.14"],"u":[]}],"a":["https://pypi.org/project/awslabs.healthlake-mcp-server/0.0.14/","https://aws.amazon.com/security/security-bulletins/2026-054-aws/"]},"CVE-2026-12043":{"p":[{"p":"AWS aws-c-http","f":[],"u":["0.10.15"]}],"a":["https://github.com/awslabs/aws-c-http/releases/tag/v0.11.0","https://aws.amazon.com/security/security-bulletins/2026-043-aws/"]},"CVE-2026-14471":{"p":[{"p":"AWS MCP Gateway & Registry","f":[],"u":["1.0.12"]}],"a":["https://github.com/agentic-community/mcp-gateway-registry/releases/tag/v1.0.13","https://aws.amazon.com/security/security-bulletins/2026-052-aws/"]},"CVE-2026-10740":{"p":[{"p":"AWS s2n-quic","f":[],"u":["1.8.1"]}],"a":["https://github.com/aws/s2n-quic/releases/tag/v1.82.0","https://aws.amazon.com/security/security-bulletins/2026-042-aws/"]},"CVE-2026-5747":{"p":[{"p":"AWS Firecracker","f":[],"u":["1.14.3"]}],"a":["https://github.com/firecracker-microvm/firecracker/releases/tag/v1.15.1","https://github.com/firecracker-microvm/firecracker/releases/tag/v1.14.4","https://aws.amazon.com/security/security-bulletins/2026-015-aws/"]},"CVE-2026-6911":{"p":[{"p":"AWS AWS Ops Wheel","f":["163"],"u":[]}],"a":["https://aws.amazon.com/security/security-bulletins/2026-018-aws/","https://github.com/aws/aws-ops-wheel/pull/164"]},"CVE-2026-6912":{"p":[{"p":"AWS AWS Ops Wheel","f":["164"],"u":[]}],"a":["https://github.com/aws/aws-ops-wheel/pull/165","https://aws.amazon.com/security/security-bulletins/2026-018-aws/"]},"CVE-2026-110310":{"p":[{"p":"Amazon Amazon.Extensions.S3.Encryption","f":[],"u":["2.*","3.2.1","4.0.2"]}],"a":["https://www.nuget.org/packages/Amazon.Extensions.S3.Encryption/3.2.2","https://www.nuget.org/packages/Amazon.Extensions.S3.Encryption/4.0.3","https://aws.amazon.com/security/security-bulletins/2026-135-aws/"]},"CVE-2026-13769":{"p":[{"p":"AWS AWS CLI","f":[],"u":["1.44.77","2.34.28"]}],"a":["https://github.com/aws/aws-cli/releases/tag/1.44.78","https://github.com/aws/aws-cli/releases/tag/2.34.29","https://aws.amazon.com/security/security-bulletins/2026-049-aws/"]},"CVE-2026-7461":{"p":[{"p":"AWS Amazon ECS Agent","f":[],"u":["1.102.0"]}],"a":["https://github.com/aws/amazon-ecs-agent/releases/tag/v1.103.0","https://aws.amazon.com/security/security-bulletins/2026-024-aws/"]},"CVE-2026-5190":{"p":[],"a":["https://aws.amazon.com/security/security-bulletins/2026-011-aws/","https://github.com/awslabs/aws-c-event-stream/releases/tag/v0.6.0"]},"CVE-2026-0312":{"p":[{"p":"Palo Alto Networks Checkov by Prisma Cloud","f":["3.3.25"],"u":[]}],"a":["https://security.paloaltonetworks.com/CVE-2026-0312"]},"CVE-2026-0311":{"p":[{"p":"Palo Alto Networks Checkov by Prisma Cloud","f":["3.2.533"],"u":[]}],"a":["https://security.paloaltonetworks.com/CVE-2026-0311"]},"CVE-2026-0313":{"p":[{"p":"Palo Alto Networks Cortex XSOAR OS Query","f":["1.0.17"],"u":[]},{"p":"Palo Alto Networks Cortex XSIAM OS Query","f":["1.0.17"],"u":[]}],"a":["https://security.paloaltonetworks.com/CVE-2026-0313"]},"CVE-2026-0314":{"p":[{"p":"Palo Alto Networks GlobalProtect App","f":["6.3.3-h16","6.2.8-h15","6.0.15"],"u":[]},{"p":"Palo Alto Networks GlobalProtect App","f":["12.2.4"],"u":[]}],"a":["https://security.paloaltonetworks.com/CVE-2026-0314"]},"CVE-2026-0318":{"p":[{"p":"Palo Alto Networks PAN-OS","f":["12.2.4","12.1.10-h2","12.1.4-h12","12.1.7-h8","11.2.16"],"u":[]},{"p":"Palo Alto Networks Prisma Access","f":["12.1.7-h8"],"u":[]}],"a":["https://security.paloaltonetworks.com/CVE-2026-0318"]},"CVE-2026-0315":{"p":[{"p":"Palo Alto Networks GlobalProtect App","f":["6.2.8-h15","6.3.3-h16"],"u":[]},{"p":"Palo Alto Networks GlobalProtect App","f":["12.2.4"],"u":[]}],"a":["https://security.paloaltonetworks.com/CVE-2026-0315"]},"CVE-2026-0316":{"p":[{"p":"Palo Alto Networks PAN-OS","f":["12.2.4","12.1.10-h2","11.2.16","11.1.16-h3"],"u":[]},{"p":"Palo Alto Networks Prisma Access","f":["12.1.7-h8"],"u":[]}],"a":["https://security.paloaltonetworks.com/CVE-2026-0316"]},"CVE-2026-0319":{"p":[{"p":"Palo Alto Networks PAN-OS","f":["12.2.4","12.1.10-h2","12.1.7-h8","12.1.4-h12","11.2.16"],"u":[]},{"p":"Palo Alto Networks Prisma Access","f":["12.1.7-h8","11.2.7-h21","10.2.10-h41"],"u":[]}],"a":["https://security.paloaltonetworks.com/CVE-2026-0319"]},"CVE-2026-93637":{"p":[{"p":"Zimbra Zimbra Collaboration Suite","f":[],"u":["10.1.21"]}],"a":["https://www.rapid7.com/blog/post/ve-breaking-zimbra-identity-boundaries-part-1"]},"CVE-2026-93635":{"p":[{"p":"Zimbra Zimbra Collaboration Suite","f":[],"u":["10.1.21"]}],"a":["https://www.rapid7.com/blog/post/ve-breaking-zimbra-identity-boundaries-part-1"]},"CVE-2026-73571":{"p":[{"p":"Zimbra Collaboration","f":["10.1.17"],"u":[]}],"a":["https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories","https://wiki.zimbra.com/wiki/Security_Center"]},"CVE-2026-10631":{"p":[{"p":"Zimbra Zimbra Collaboration Suite","f":["10.1.20"],"u":[]}],"a":["https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories"]},"CVE-2026-108065":{"p":[{"p":"Channel Software WebAlliance eCommerce","f":[],"u":["1.*"]}],"a":["https://www.rapid7.com/blog/post/ve-unauthenticated-sql-injection-in-channel-software-weballiance-ecommerce/"]},"CVE-2026-85851":{"p":[{"p":"Microsoft Windows 11 version 23H2","f":["10.0.22631.7652"],"u":[]},{"p":"Microsoft Windows 11 Version 23H2","f":["10.0.22631.7652"],"u":[]},{"p":"Microsoft Windows 11 Version 24H2","f":["10.0.26100.9711"],"u":[]},{"p":"Microsoft Windows 11 Version 25H2","f":["10.0.26200.9711"],"u":[]}],"a":["https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-85851"]},"CVE-2026-104935":{"p":[],"a":["https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-CVE-2026-104935"]},"CVE-2026-74580":{"p":[{"p":"Linux Linux","f":["5224bd37e37d36076a550d99b2aebba33939fd95","54617e9119be2eb728ecdd8d977b99c99d4c498a","13fa6f32a56a386a82bd7451644c494beed034af","cf363a7a02ce132ef1f58084fdb13e1a3b7da7e7","6fa3e9b1fe856259555a7e22f3f3082e7827fd9b"],"u":[]}],"a":["https://git.kernel.org/stable/c/5224bd37e37d36076a550d99b2aebba33939fd95","https://git.kernel.org/stable/c/54617e9119be2eb728ecdd8d977b99c99d4c498a","https://git.kernel.org/stable/c/13fa6f32a56a386a82bd7451644c494beed034af"]},"CVE-2026-85920":{"p":[{"p":"Microsoft Windows 10 Version 1607","f":["10.0.14393.9612"],"u":[]},{"p":"Microsoft Windows 10 Version 1809","f":["10.0.17763.9376"],"u":[]},{"p":"Microsoft Windows 10 Version 21H2","f":["10.0.19044.7807"],"u":[]},{"p":"Microsoft Windows 10 Version 22H2","f":["10.0.19044.7807"],"u":[]}],"a":["https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-85920"]},"CVE-2026-88070":{"p":[{"p":"Microsoft Windows 10 Version 1607","f":["10.0.14393.9612"],"u":[]},{"p":"Microsoft Windows 10 Version 1809","f":["10.0.17763.9376"],"u":[]},{"p":"Microsoft Windows 10 Version 21H2","f":["10.0.19044.7807"],"u":[]},{"p":"Microsoft Windows 10 Version 22H2","f":["10.0.19044.7807"],"u":[]}],"a":["https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-88070"]},"CVE-2026-83500":{"p":[{"p":"Microsoft Windows 10 Version 1607","f":["10.0.14393.9612"],"u":[]},{"p":"Microsoft Windows 10 Version 1809","f":["10.0.17763.9376"],"u":[]},{"p":"Microsoft Windows 10 Version 21H2","f":["10.0.19044.7807"],"u":[]},{"p":"Microsoft Windows 10 Version 22H2","f":["10.0.19044.7807"],"u":[]}],"a":["https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-83500"]},"CVE-2026-96951":{"p":[{"p":"Microsoft Outlook.com","f":["20260925.100"],"u":[]},{"p":"Microsoft Windows 10 Version 1607","f":["10.0.14393.9612"],"u":[]},{"p":"Microsoft Windows 10 Version 1809","f":["10.0.17763.9376"],"u":[]},{"p":"Microsoft Windows 10 Version 21H2","f":["10.0.19044.7807"],"u":[]}],"a":["https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96951"]},"CVE-2026-103572":{"p":[{"p":"Microsoft Microsoft Visual Studio 2022 version 17.14","f":["17.14.42"],"u":[]},{"p":"Microsoft Microsoft Visual Studio 2026 version 18.10","f":["18.10.4"],"u":[]}],"a":["https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-103572"]},"CVE-2026-88772":{"p":[{"p":"Citrix NetScaler ADC","f":["14.1-73.37","13.1-64.23","14.1-73.37 FIPS","13.1.37.279 FIPS and NDcPP"],"u":[]},{"p":"Citrix NetScaler Gateway","f":["14.1-73.37","13.1-64.23"],"u":[]}],"a":["https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697096&articleTitle=Citrix_NetScaler_ADC_and_Citrix_NetScaler_Gateway_Security_Bulletin_for_CVE_2026_88771_CVE_2026_88772_CVE_2026_88773_CVE_2026_88774_CVE_2026_88775_CVE_2026_88776_CVE_2026_88777_and_CVE_2026_88778"]},"CVE-2026-105445":{"p":[{"p":"Docker Docker Hub","f":["2026-09-30T19:10:00Z"],"u":[]}],"a":["https://www.docker.com/blog/docker-hub-security-advisory-cve-2026-105445/"]},"CVE-2026-58113":{"p":[{"p":"Siemens Teamcenter V2412","f":["V2412.0013"],"u":[]},{"p":"Siemens Teamcenter V2506","f":["V2506.0010"],"u":[]},{"p":"Siemens Teamcenter V2512","f":["V2512.2607"],"u":[]},{"p":"Siemens Teamcenter V2606","f":["V2606.2607"],"u":[]}],"a":["https://cert-portal.siemens.com/productcert/html/ssa-157465.html"]},"CVE-2026-39919":{"p":[{"p":"Artifex Software Ghostscript","f":["10.08.0"],"u":[]}],"a":["https://github.com/ArtifexSoftware/ghostpdl-downloads/releases/tag/gs10080","https://github.com/ArtifexSoftware/ghostpdl/commit/0a8bf88e39db07b0751a58d6ec1cf992073e4dc1"]},"CVE-2026-107605":{"p":[{"p":"Swann Communications SWIFI-SE2KIC","f":[],"u":["2.0.22"]}],"a":["https://www.cisa.gov/news-events/ics-advisories/icsa-26-286-02"]},"CVE-2026-107606":{"p":[{"p":"Swann Communications SWIFI-SE2KIC","f":[],"u":["2.0.22"]}],"a":["https://www.cisa.gov/news-events/ics-advisories/icsa-26-286-02"]},"CVE-2026-107607":{"p":[{"p":"Swann Communications SWIFI-SE2KIC","f":[],"u":["2.0.22"]}],"a":["https://www.cisa.gov/news-events/ics-advisories/icsa-26-286-02"]},"CVE-2026-92817":{"p":[{"p":"Inductive Automation Ignition","f":[],"u":["8.1.54","8.3.8"]}],"a":["https://security.inductiveautomation.com/?tcuUid=34477620-731d-4b70-b22b-9450f9a659a3","https://www.cisa.gov/news-events/ics-advisories/icsa-26-286-01","https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-286-01.json"]},"CVE-2026-8838":{"p":[{"p":"AWS Amazon Redshift connector for Python","f":[],"u":["2.1.13"]}],"a":["https://github.com/aws/amazon-redshift-python-driver/releases/tag/v2.1.14","https://aws.amazon.com/security/security-bulletins/2026-033-aws/"]},"CVE-2023-6317":{"p":[],"a":["https://lgsecurity.lge.com/bulletins/tv#updateDetails"]},"CVE-2023-6320":{"p":[],"a":["https://lgsecurity.lge.com/bulletins/tv#updateDetails"]},"CVE-2026-85097":{"p":[{"p":"Bricksforge Bricksforge","f":[],"u":["3.1.8.9"]}],"a":["https://www.wordfence.com/threat-intel/vulnerabilities/id/e993c929-f175-43a7-92e6-9d3b089b8dde?source=cve","https://bricksforge.io/version-changelog/"]},"CVE-2026-108096":{"p":[{"p":"AWS aws-amplify/graphql-index-transformer","f":["3.1.2"],"u":[]},{"p":"AWS aws-amplify/graphql-api-construct","f":[],"u":["1.21.4"]},{"p":"AWS aws-amplify/data-construct","f":["1.17.4"],"u":[]}],"a":["https://www.npmjs.com/package/@aws-amplify/graphql-index-transformer/v/3.1.2","https://www.npmjs.com/package/@aws-amplify/graphql-api-construct/v/1.21.4","https://www.npmjs.com/package/@aws-amplify/data-construct/v/1.17.4"]},"CVE-2026-82077":{"p":[{"p":"PaperCut PaperCut NG/MF","f":["25.0.13","26.0.5"],"u":[]}],"a":["https://www.papercut.com/kb/Main/security-bulletin-sep-2026/"]},"CVE-2026-82078":{"p":[{"p":"PaperCut PaperCut MF/NG","f":["24.1.10","25.0.13","26.0.5"],"u":[]}],"a":["https://www.papercut.com/kb/Main/security-bulletin-27-aug-2026-urgent-security-advisory/"]},"CVE-2026-81578":{"p":[{"p":"PaperCut PaperCut MF/NG","f":["24.1.10","25.0.13","26.0.5"],"u":[]}],"a":["https://www.papercut.com/kb/Main/security-bulletin-27-aug-2026-urgent-security-advisory/"]},"CVE-2026-107783":{"p":[{"p":"AWS aws-tools-for-powershell","f":[],"u":["5.0.305"]}],"a":["https://github.com/aws/aws-tools-for-powershell/releases/tag/5.0.306","https://aws.amazon.com/security/security-bulletins/2026-132-aws/"]},"CVE-2015-3306":{"p":[],"a":["http://www.debian.org/security/2015/dsa-3263","http://lists.opensuse.org/opensuse-updates/2015-06/msg00020.html","http://lists.fedoraproject.org/pipermail/package-announce/2015-May/157053.html"]},"CVE-2026-85880":{"p":[{"p":"Microsoft Windows 10 Version 1607","f":["10.0.14393.9512"],"u":[]},{"p":"Microsoft Windows 10 Version 1809","f":["10.0.17763.9245"],"u":[]},{"p":"Microsoft Windows 10 Version 21H2","f":["10.0.19044.7725"],"u":[]},{"p":"Microsoft Windows 10 Version 22H2","f":["10.0.19045.7725"],"u":[]}],"a":["https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-85880"]},"CVE-2026-81963":{"p":[{"p":"Microsoft Windows 11 version 23H2","f":["10.0.22631.7582"],"u":[]},{"p":"Microsoft Windows 11 Version 23H2","f":["10.0.22631.7582"],"u":[]},{"p":"Microsoft Windows 11 Version 24H2","f":["10.0.26100.9445"],"u":[]},{"p":"Microsoft Windows 11 Version 25H2","f":["10.0.26200.9445"],"u":[]}],"a":["https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-81963"]},"CVE-2026-107608":{"p":[{"p":"AWS aws-cdk-lib","f":["2.267.0"],"u":[]}],"a":["https://github.com/aws/aws-cdk/releases/tag/v2.267.0","https://aws.amazon.com/security/security-bulletins/2026-131-aws/"]},"CVE-2026-107322":{"p":[{"p":"aws databases-on-aws","f":["1.7.1"],"u":[]}],"a":["https://github.com/awslabs/agent-plugins/commit/8b13a503746a4ebb0402b936645163224058bde3","https://github.com/awslabs/agent-plugins/pull/232","https://aws.amazon.com/security/security-bulletins/2026-130-aws/"]},"CVE-2026-102489":{"p":[{"p":"Zammad GmbH Zammad","f":["6.5.4"],"u":[]}],"a":["https://csirt.divd.nl/DIVD-2026-00015","https://csirt.divd.nl/CVE-2026-102489"]},"CVE-2026-47483":{"p":[],"a":["https://github.com/NVIDIA/product-security/tree/main/2026/5857"]},"CVE-2026-107332":{"p":[{"p":"aws aws-toolkit-vscode","f":["4.10.0"],"u":[]}],"a":["https://github.com/aws/aws-toolkit-vscode/releases/tag/toolkit/v4.10.0","https://aws.amazon.com/security/security-bulletins/2026-129-aws/"]},"CVE-2026-32645":{"p":[{"p":"Red Lion Controls 700 Series","f":["Firmware Versions 3.11.0","Bootloader Versions 2.0.6.1"],"u":[]}],"a":["https://www.hms-networks.com/","https://www.hms-networks.com/cybersecurity","https://www.cisa.gov/news-events/ics-advisories/icsa-26-281-01"]},"CVE-2026-39460":{"p":[{"p":"Red Lion Controls 700 Series","f":["Firmware Versions 3.11.0","Bootloader Versions 2.0.6.1"],"u":[]}],"a":["https://www.hms-networks.com/","https://www.hms-networks.com/cybersecurity","https://www.cisa.gov/news-events/ics-advisories/icsa-26-281-01"]},"CVE-2026-28745":{"p":[{"p":"Red Lion Controls 700 Series","f":["Firmware Versions 3.11.0","Bootloader Versions 2.0.6.1"],"u":[]}],"a":["https://www.hms-networks.com/","https://www.hms-networks.com/cybersecurity","https://www.cisa.gov/news-events/ics-advisories/icsa-26-281-01"]},"CVE-2026-33367":{"p":[{"p":"Red Lion Controls 700 Series","f":["Firmware Versions 3.11.0","Bootloader Versions 2.0.6.1"],"u":[]}],"a":["https://www.hms-networks.com/","https://www.hms-networks.com/cybersecurity","https://www.cisa.gov/news-events/ics-advisories/icsa-26-281-01"]},"CVE-2026-29797":{"p":[{"p":"Red Lion Controls 700 Series","f":["Firmware Versions 3.11.0","Bootloader Versions 2.0.6.1"],"u":[]}],"a":["https://www.hms-networks.com/","https://www.hms-networks.com/cybersecurity","https://www.cisa.gov/news-events/ics-advisories/icsa-26-281-01"]},"CVE-2026-39453":{"p":[{"p":"Red Lion Controls 700 Series","f":["Firmware Versions 3.11.0","Bootloader Versions 2.0.6.1"],"u":[]}],"a":["https://www.hms-networks.com/","https://www.hms-networks.com/cybersecurity","https://www.cisa.gov/news-events/ics-advisories/icsa-26-281-01"]},"CVE-2026-33272":{"p":[{"p":"Red Lion Controls 700 Series","f":["Firmware Versions 3.11.0","Bootloader Versions 2.0.6.1"],"u":[]}],"a":["https://www.hms-networks.com/","https://www.hms-networks.com/cybersecurity","https://www.cisa.gov/news-events/ics-advisories/icsa-26-281-01"]},"CVE-2026-105269":{"p":[{"p":"Satel Satel Netco Design","f":["v2.1.7"],"u":[]}],"a":["https://www.cisa.gov/news-events/ics-advisories/icsa-26-281-03","https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-281-03.json"]},"CVE-2026-104629":{"p":[{"p":"Grid Protection Alliance openPDC","f":["2.9.477","2.9.482"],"u":[]},{"p":"Grid Protection Alliance openPDC (Docker image)","f":["2.9.477","2.9.482"],"u":[]},{"p":"Grid Protection Alliance openHistorian","f":["2.8.580","2.8.585"],"u":[]}],"a":["https://www.cisa.gov/news-events/ics-advisories/icsa-26-281-02","https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-281-02.json"]},"CVE-2026-100730":{"p":[{"p":"Grid Protection Alliance openPDC","f":["2.9.477","2.9.482"],"u":[]},{"p":"Grid Protection Alliance openPDC (Docker image)","f":["2.9.477","2.9.482"],"u":[]},{"p":"Grid Protection Alliance openHistorian","f":["2.8.580","2.8.585"],"u":[]}],"a":["https://www.cisa.gov/news-events/ics-advisories/icsa-26-281-02","https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-281-02.json"]},"CVE-2026-105281":{"p":[{"p":"Grid Protection Alliance openPDC","f":["2.9.477","2.9.482"],"u":[]},{"p":"Grid Protection Alliance openPDC (Docker image)","f":["2.9.477","2.9.482"],"u":[]},{"p":"Grid Protection Alliance openHistorian","f":["2.8.580","2.8.585"],"u":[]}],"a":["https://www.cisa.gov/news-events/ics-advisories/icsa-26-281-02","https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-281-02.json"]},"CVE-2026-85479":{"p":[{"p":"Grid Protection Alliance openPDC","f":["2.9.477","2.9.482"],"u":[]},{"p":"Grid Protection Alliance openPDC (Docker image)","f":["2.9.477","2.9.482"],"u":[]},{"p":"Grid Protection Alliance openHistorian","f":["2.8.580","2.8.585"],"u":[]}],"a":["https://www.cisa.gov/news-events/ics-advisories/icsa-26-281-02","https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-281-02.json"]},"CVE-2026-101022":{"p":[{"p":"Grid Protection Alliance openPDC","f":["2.9.477","2.9.482"],"u":[]},{"p":"Grid Protection Alliance openPDC (Docker image)","f":["2.9.477","2.9.482"],"u":[]},{"p":"Grid Protection Alliance openHistorian","f":["2.8.580","2.8.585"],"u":[]}],"a":["https://www.cisa.gov/news-events/ics-advisories/icsa-26-281-02","https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-281-02.json"]},"CVE-2026-105278":{"p":[{"p":"Grid Protection Alliance openPDC (Docker image)","f":["2.9.477","2.9.482"],"u":[]}],"a":["https://www.cisa.gov/news-events/ics-advisories/icsa-26-281-02","https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-281-02.json"]},"CVE-2014-6278":{"p":[],"a":["http://marc.info/?l=bugtraq&m=141577137423233&w=2","http://marc.info/?l=bugtraq&m=142721162228379&w=2","http://marc.info/?l=bugtraq&m=142358026505815&w=2"]},"CVE-2015-5477":{"p":[],"a":["http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00050.html","http://rhn.redhat.com/errata/RHSA-2015-1513.html","http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00044.html"]},"CVE-2016-3081":{"p":[],"a":["http://www.securitytracker.com/id/1035665","https://struts.apache.org/docs/s2-032.html","http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20160527-01-struts2-en"]},"CVE-2019-11510":{"p":[],"a":["https://kb.pulsesecure.net/?atype=sa","https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44101/","http://www.securityfocus.com/bid/108073"]},"CVE-2021-22205":{"p":[],"a":["https://hackerone.com/reports/1154542","https://gitlab.com/gitlab-org/gitlab/-/issues/327121","https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22205.json"]},"CVE-2021-3199":{"p":[],"a":["https://github.com/ONLYOFFICE/DocumentServer/blob/903fe5ab7a275bd69c3c3346af2d21cf87ebeabf/CHANGELOG.md#563","https://github.com/nola-milkin/poc_exploits/blob/master/CVE-2021-3199/poc_uploadImageFile.py","https://github.com/moehw/poc_exploits/tree/master/CVE-2021-3199/poc_uploadImageFile.py"]},"CVE-2023-22894":{"p":[],"a":["https://github.com/strapi/strapi/releases","https://www.ghostccamm.com/blog/multi_strapi_vulns/","https://strapi.io/blog/security-disclosure-of-vulnerabilities-cve"]},"CVE-2026-107352":{"p":[],"a":["https://aws.amazon.com/security/security-bulletins/2026-128-aws/"]},"CVE-2026-105811":{"p":[{"p":"aws qnabot-on-aws","f":["7.4.6"],"u":[]}],"a":["https://github.com/aws-solutions-library-samples/qnabot-on-aws/releases/tag/v7.4.6","https://staging.prod.website.marketing.aws.dev/security/security-bulletins/2026-126-aws/"]},"CVE-2026-76455":{"p":[],"a":["https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-nxosw1-cWzSbtR"]},"CVE-2026-76456":{"p":[],"a":["https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-nxosw1-cWzSbtR"]},"CVE-2026-76457":{"p":[],"a":["https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-nxosw1-cWzSbtR"]},"CVE-2026-76459":{"p":[],"a":["https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-nxosw1-cWzSbtR"]},"CVE-2026-76458":{"p":[],"a":["https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-nxosw1-cWzSbtR"]},"CVE-2026-76453":{"p":[],"a":["https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-nxosw1-cWzSbtR"]},"CVE-2026-76465":{"p":[],"a":["https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-moam-rce-uBTzYV7"]},"CVE-2026-76485":{"p":[],"a":["https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ngoam-rce-LWKQ4BU"]},"CVE-2026-76486":{"p":[],"a":["https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ngoam-rce-LWKQ4BU"]},"CVE-2026-76501":{"p":[],"a":["https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ngoam-rce-LWKQ4BU"]},"CVE-2026-76471":{"p":[],"a":["https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-napi-rce-r2shwu2j"]},"CVE-2026-20362":{"p":[],"a":["https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-finesse-ssrf-mmSuyugS"]},"CVE-2026-76480":{"p":[],"a":["https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-ssm-Ph77wdhf"]},"CVE-2026-76482":{"p":[],"a":["https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-ssm-Ph77wdhf"]},"CVE-2026-76483":{"p":[],"a":["https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-ssm-Ph77wdhf"]},"CVE-2026-76484":{"p":[],"a":["https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-ssm-Ph77wdhf"]},"CVE-2026-76498":{"p":[],"a":["https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-apic-UOXWtfh"]},"CVE-2026-76499":{"p":[],"a":["https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-apic-UOXWtfh"]},"CVE-2026-76500":{"p":[],"a":["https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-apic-UOXWtfh"]},"CVE-2026-20328":{"p":[],"a":["https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ssm-access-nttb2dhE"]},"CVE-2026-76437":{"p":[],"a":["https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ssm-access-nttb2dhE"]},"CVE-2026-76452":{"p":[],"a":["https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ssm-access-nttb2dhE"]},"CVE-2026-76454":{"p":[],"a":["https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ssm-access-nttb2dhE"]},"CVE-2026-102255":{"p":[],"a":["https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0017"]},"CVE-2026-42532":{"p":[],"a":["https://talosintelligence.com/vulnerability_reports/TALOS-2026-2415"]},"CVE-2026-41958":{"p":[],"a":["https://talosintelligence.com/vulnerability_reports/TALOS-2026-2414"]},"CVE-2026-105812":{"p":[{"p":"aws bedrock-agentcore-starter-toolkit","f":[],"u":["0.3.13"]}],"a":["https://pypi.org/project/bedrock-agentcore-starter-toolkit/0.3.14/","https://aws.amazon.com/security/security-bulletins/2026-127-aws/"]},"CVE-2026-106032":{"p":[{"p":"aws bedrock-agentcore-starter-toolkit","f":[],"u":["0.3.13"]}],"a":["https://pypi.org/project/bedrock-agentcore-starter-toolkit/0.3.14/","https://staging.prod.website.marketing.aws.dev/security/security-bulletins/2026-127-aws/"]},"CVE-2026-4637":{"p":[{"p":"Paessler GmbH PRTG Network Monitor","f":["26.2.120.1449"],"u":[]}],"a":["https://paessler.freshdesk.com/en/support/solutions/articles/76000088640","https://www.paessler.com/de/download/"]},"CVE-2026-4638":{"p":[{"p":"Paessler GmbH PRTG Network Monitor","f":["26.2.120.1449"],"u":[]}],"a":["https://paessler.freshdesk.com/en/support/solutions/articles/76000088640","https://www.paessler.com/de/download/"]},"CVE-2024-8176":{"p":[{"p":"","f":["2.7.0"],"u":[]}],"a":["https://access.redhat.com/errata/RHSA-2025:13681","https://access.redhat.com/errata/RHSA-2025:22033","https://access.redhat.com/errata/RHSA-2025:22034"]},"CVE-2025-59375":{"p":[{"p":"libexpat project libexpat","f":["2.7.2"],"u":[]}],"a":["https://github.com/libexpat/libexpat/issues/1018","https://github.com/libexpat/libexpat/pull/1034","https://github.com/libexpat/libexpat/blob/676a4c531ec768732fac215da9730b5f50fbd2bf/expat/Changes#L45-L74"]},"CVE-2026-7395":{"p":[{"p":"Hitachi Energy Asset Suite","f":[],"u":["9.9.0"]}],"a":["https://publisher.hitachienergy.com/preview?DocumentID=8DBD000254&LanguageCode=en&DocumentPartId=&Action=Launch"]},"CVE-2026-11796":{"p":[{"p":"Hitachi Energy Asset Suite","f":[],"u":["9.9.0"]}],"a":["https://publisher.hitachienergy.com/preview?DocumentID=8DBD000254&LanguageCode=en&DocumentPartId=&Action=Launch"]},"CVE-2026-27872":{"p":[{"p":"Johnson Controls Easy IO FG","f":["2.0b52"],"u":[]}],"a":["https://www.johnsoncontrols.com/trust-center/cybersecurity/security-advisories"]},"CVE-2026-27873":{"p":[{"p":"Johnson Controls EasyIO FG","f":["2.0b52"],"u":[]}],"a":["https://www.johnsoncontrols.com/trust-center/cybersecurity/security-advisories"]},"CVE-2026-34197":{"p":[{"p":"Apache Software Foundation Apache ActiveMQ Broker","f":["5.19.4","6.2.3"],"u":[]},{"p":"Apache Software Foundation Apache ActiveMQ All","f":["5.19.4","6.2.3"],"u":[]},{"p":"Apache Software Foundation Apache ActiveMQ","f":["5.19.4","6.2.3"],"u":[]}],"a":["https://activemq.apache.org/security-advisories.data/CVE-2026-34197-announcement.txt"]},"CVE-2026-15340":{"p":[],"a":["https://www.cisa.gov/news-events/ics-advisories/icsa-26-279-02","https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-279-02.json"]},"CVE-2026-86360":{"p":[{"p":"Dell System Update","f":["2.3.0.0 or later"],"u":[]}],"a":["https://www.dell.com/support/kbdoc/en-us/000515843/dsa-2026-324-security-update-for-dell-system-update-dsu-vulnerabilities"]},"CVE-2026-61500":{"p":[{"p":"rejetto hfs","f":["3.2.1"],"u":[]}],"a":["https://github.com/rejetto/hfs/releases/tag/v3.2.1"]},"CVE-2026-96940":{"p":[{"p":"Microsoft Microsoft Exchange Server 2016 Cumulative Update 23","f":["15.01.2507.075"],"u":[]},{"p":"Microsoft Microsoft Exchange Server 2019 Cumulative Update 14","f":["15.02.1544.048"],"u":[]},{"p":"Microsoft Microsoft Exchange Server 2019 Cumulative Update 15","f":["15.02.1748.053"],"u":[]},{"p":"Microsoft Microsoft Exchange Server Subscription Edition RTM","f":["15.02.2562.053"],"u":[]}],"a":["https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96940"]},"CVE-2026-88779":{"p":[{"p":"NetScaler ADC","f":["14.1-73.41","13.1-64.28","14.1-73.41 FIPS","13.1-37.282"],"u":[]},{"p":"NetScaler Gateway","f":["14.1-73.41","13.1-64.28"],"u":[]}],"a":["https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697174"]},"CVE-2026-90970":{"p":[{"p":"GitLab GitLab AI Gateway","f":["19.2.4","19.3.2","19.4.1"],"u":[]}],"a":["https://gitlab.com/gitlab-org/gitlab/-/work_items/628842"]},"CVE-2026-104019":{"p":[{"p":"AWS sagemaker-distribution","f":["2.14.12","3.9.12","4.0.11","4.1.11","4.2.8"],"u":[]}],"a":["https://github.com/aws/sagemaker-distribution/releases","https://aws.amazon.com/security/security-bulletins/2026-125-aws/"]},"CVE-2026-103956":{"p":[{"p":"AWS loom","f":["1.6.1"],"u":[]}],"a":["https://github.com/awslabs/loom/releases/tag/v1.6.1","https://aws.amazon.com/security/security-bulletins/2026-124-aws/"]},"CVE-2026-103957":{"p":[{"p":"AWS loom","f":["1.7.0"],"u":[]}],"a":["https://github.com/awslabs/loom/releases/tag/v1.7.0","https://aws.amazon.com/security/security-bulletins/2026-124-aws/"]},"CVE-2026-103958":{"p":[{"p":"AWS loom","f":["1.7.0"],"u":[]}],"a":["https://github.com/awslabs/loom/releases/tag/v1.7.0","https://aws.amazon.com/security/security-bulletins/2026-124-aws/"]},"CVE-2026-20267":{"p":[],"a":["https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-iosxe-V8NMuMZJ"]},"CVE-2026-20268":{"p":[],"a":["https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-iosxe-V8NMuMZJ"]},"CVE-2026-20269":{"p":[],"a":["https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-iosxe-V8NMuMZJ"]},"CVE-2026-20270":{"p":[],"a":["https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-iosxe-V8NMuMZJ"]},"CVE-2026-20271":{"p":[],"a":["https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-iosxe-V8NMuMZJ"]},"CVE-2026-20272":{"p":[],"a":["https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-iosxe-V8NMuMZJ"]},"CVE-2026-20273":{"p":[],"a":["https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-iosxe-V8NMuMZJ"]},"CVE-2026-63688":{"p":[{"p":"Dell Dell Container Storage Modules (CSM)","f":["1.18.0 or later"],"u":[]}],"a":["https://www.dell.com/support/kbdoc/en-us/000515771/dsa-2026-448-security-update-for-dell-container-storage-modules-multiple-vulnerabilities?msockid=3021cac2195069ed3194ddad186a68f9"]},"CVE-2026-103505":{"p":[{"p":"AWS aws-efs-csi-driver","f":[],"u":["3.4.2"]}],"a":["https://github.com/kubernetes-sigs/aws-efs-csi-driver/releases/tag/v3.5.0","https://aws.amazon.com/security/security-bulletins/2026-120-aws/"]},"CVE-2026-102490":{"p":[{"p":"Zammad GmbH Zammad","f":["7.1.0-alpha"],"u":[]}],"a":["https://csirt.divd.nl/DIVD-2026-00015","https://csirt.divd.nl/CVE-2026-102490"]},"CVE-2026-0250":{"p":[{"p":"Palo Alto Networks GlobalProtect App","f":["6.3.3-h9 (6.3.3-999)","6.2.8-h10 (6.2.8-948)"],"u":[]},{"p":"Palo Alto Networks GlobalProtect App","f":["6.1.13"],"u":[]},{"p":"Palo Alto Networks GlobalProtect App","f":["6.3.3-h2 (6.3.3-42)","6.0.11"],"u":[]},{"p":"Palo Alto Networks GlobalProtect App","f":["6.0.13"],"u":[]}],"a":["https://security.paloaltonetworks.com/CVE-2026-0250"]},"CVE-2026-104286":{"p":[{"p":"Fortinet FortiMail","f":[],"u":["7.6.5","7.4.6","7.2.9"]}],"a":["https://fortiguard.fortinet.com/psirt/FG-IR-26-175"]},"CVE-2026-104002":{"p":[{"p":"AWS powertools-lambda-python","f":[],"u":["3.34.0"]}],"a":["https://github.com/aws-powertools/powertools-lambda-python/releases/tag/v3.35.0","https://aws.amazon.com/security/security-bulletins/2026-123-aws/"]},"CVE-2026-104020":{"p":[{"p":"Amazon ion-python","f":["0.15.0"],"u":[]}],"a":["https://github.com/amazon-ion/ion-python/releases/tag/v0.15.0","https://aws.amazon.com/security/security-bulletins/2026-122-aws/"]},"CVE-2026-97662":{"p":[{"p":"AWS security-agent-mcp-server","f":["0.2.0"],"u":[]}],"a":["https://pypi.org/project/awslabs.security-agent-mcp-server/0.2.0/","https://aws.amazon.com/security/security-bulletins/2026-121-aws/"]},"CVE-2026-93616":{"p":[],"a":["https://support.checkpoint.com/results/sk/sk1000171"]},"CVE-2026-73570":{"p":[{"p":"Zimbra Collaboration","f":["10.1.20"],"u":[]}],"a":["https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories","https://wiki.zimbra.com/wiki/Security_Center"]},"CVE-2026-86950":{"p":[{"p":"Apple iOS and iPadOS","f":["26.7.1"],"u":[]},{"p":"Apple macOS","f":["15.8.1","26.7.1"],"u":[]}],"a":["https://support.apple.com/en-us/149226","https://support.apple.com/en-us/149228","https://support.apple.com/en-us/149229"]},"CVE-2026-90443":{"p":[{"p":"CISA Malcolm","f":["v26.06.0"],"u":[]}],"a":["https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2026/icsa-26-254-01.json"]},"CVE-2026-101104":{"p":[],"a":["https://www.meari.com/en/downLoadCenter","https://www.cisa.gov/news-events/ics-advisories/icsa-26-274-06","https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-274-06.json"]},"CVE-2026-96613":{"p":[],"a":["https://www.meari.com/en/downLoadCenter","https://www.cisa.gov/news-events/ics-advisories/icsa-26-274-06","https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-274-06.json"]},"CVE-2026-64893":{"p":[{"p":"Johnson Controls EasyIO NEO","f":["3.3b25"],"u":[]}],"a":["https://www.johnsoncontrols.com/trust-center/cybersecurity/security-advisories"]},"CVE-2026-64892":{"p":[{"p":"Johnson Controls Easy IO Neo","f":["3.3b63"],"u":[]}],"a":["https://www.johnsoncontrols.com/trust-center/cybersecurity/security-advisories"]},"CVE-2026-15952":{"p":[{"p":"ABB Protection and control IED manager (PCM600)","f":[],"u":["2.14"]}],"a":["https://search.abb.com/library/Download.aspx?DocumentID=2NGA003170&LanguageCode=en&DocumentPartId=pdf&Action=Launch"]},"CVE-2026-15953":{"p":[{"p":"ABB Protection and control IED manager (PCM600)","f":[],"u":["2.14"]}],"a":["https://search.abb.com/library/Download.aspx?DocumentID=2NGA003179&LanguageCode=en&DocumentPartId=pdf&Action=Launch"]},"CVE-2026-95102":{"p":[],"a":["https://www.cisa.gov/news-events/ics-advisories/icsa-26-274-02","https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-274-02.json"]},"CVE-2026-97363":{"p":[],"a":["https://www.cisa.gov/news-events/ics-advisories/icsa-26-274-02","https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-274-02.json"]},"CVE-2026-97212":{"p":[],"a":["https://www.cisa.gov/news-events/ics-advisories/icsa-26-274-02","https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-274-02.json"]},"CVE-2026-93474":{"p":[],"a":["https://www.cisa.gov/news-events/ics-advisories/icsa-26-274-02","https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-274-02.json"]},"CVE-2023-46604":{"p":[{"p":"Apache Software Foundation Apache ActiveMQ","f":["5.18.3","5.17.6","5.16.7","5.15.16"],"u":[]},{"p":"Apache Software Foundation Apache ActiveMQ Legacy OpenWire Module","f":["5.18.3","5.17.6","5.16.7","5.15.16"],"u":[]}],"a":["https://activemq.apache.org/security-advisories.data/CVE-2023-46604-announcement.txt"]},"CVE-2026-94591":{"p":[{"p":"Armatura LLC Armatura One","f":["4.7.2"],"u":[]},{"p":"Armatura LLC Armatura One (USA)","f":["4.6.1"],"u":[]}],"a":["https://www.cisa.gov/news-events/ics-advisories/icsa-26-274-01","https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-274-01.json"]},"CVE-2026-94592":{"p":[{"p":"Armatura LLC Armatura One","f":["4.7.2"],"u":[]},{"p":"Armatura LLC Armatura One (USA)","f":["4.6.1"],"u":[]}],"a":["https://www.cisa.gov/news-events/ics-advisories/icsa-26-274-01","https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-274-01.json"]},"CVE-2026-94593":{"p":[{"p":"Armatura LLC Armatura One","f":["4.7.2"],"u":[]},{"p":"Armatura LLC Armatura One (USA)","f":["4.6.1"],"u":[]}],"a":["https://www.cisa.gov/news-events/ics-advisories/icsa-26-274-01","https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-274-01.json"]},"CVE-2026-94594":{"p":[{"p":"Armatura LLC Armatura One","f":["4.7.2"],"u":[]},{"p":"Armatura LLC Armatura One (USA)","f":["4.6.1"],"u":[]}],"a":["https://www.cisa.gov/news-events/ics-advisories/icsa-26-274-01","https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-274-01.json"]},"CVE-2026-76504":{"p":[],"a":["https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-webauth-xr8beuuU"]},"CVE-2026-50375":{"p":[{"p":"Microsoft Windows 10 Version 1809","f":["10.0.17763.9020"],"u":[]},{"p":"Microsoft Windows 10 Version 21H2","f":["10.0.19044.7548"],"u":[]},{"p":"Microsoft Windows 10 Version 22H2","f":["10.0.19045.7548"],"u":[]},{"p":"Microsoft Windows 11 Version 24H2","f":["10.0.26100.8875"],"u":[]}],"a":["https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50375"]},"CVE-2026-65669":{"p":[{"p":"Microsoft SQL Server Management Studio 22","f":["22.8.2"],"u":[]}],"a":["https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-65669"]},"CVE-2026-86131":{"p":[{"p":"WatchGuard Fireware OS","f":["2026.3.2","2026.2.3","12.12.3"],"u":[]},{"p":"WatchGuard Fireware OS","f":["12.5.21"],"u":[]}],"a":["https://psirt.watchguard.com/CVE-2026-86131"]},"CVE-2026-18145":{"p":[{"p":"WatchGuard Fireware OS","f":["2026.3.2","2026.2.3","12.12.3"],"u":[]},{"p":"WatchGuard Fireware OS","f":["12.5.21"],"u":[]}],"a":["https://psirt.watchguard.com/CVE-2026-18145"]},"CVE-2026-13046":{"p":[{"p":"WatchGuard Fireware OS","f":["2026.3.2","2026.2.3","12.12.3"],"u":[]},{"p":"WatchGuard Fireware OS","f":["12.11.10"],"u":[]}],"a":["https://psirt.watchguard.com/CVE-2026-13046"]},"CVE-2026-100308":{"p":[{"p":"AWS gluonts","f":["0.17.0"],"u":[]}],"a":["https://github.com/awslabs/gluonts/releases/tag/v0.17.0","https://aws.amazon.com/security/security-bulletins/2026-119-aws/"]},"CVE-2026-96274":{"p":[{"p":"Baicells Nova 430H eNodeB  (model pBS3101SH)","f":[],"u":["BaiBLQ_3.0.12"]}],"a":["https://www.cisa.gov/news-events/ics-advisories/icsa-26-272-04"]},"CVE-2026-84411":{"p":[{"p":"MikroTik RouterOS","f":["7.24"],"u":[]}],"a":["https://mikrotik.com/download","https://www.cisa.gov/news-events/ics-advisories/icsa-26-272-06","https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-272-06.json"]},"CVE-2026-22755":{"p":[],"a":["http://www.vapidlabs.com/advisory.php?v=220","https://www.akamai.com/blog/security-research/command-injection-vivotek-legacy-firmware-need-to-know"]},"CVE-2026-100291":{"p":[],"a":["https://www.cisa.gov/news-events/ics-advisories/icsa-26-272-05"]},"CVE-2026-100292":{"p":[],"a":["https://www.cisa.gov/news-events/ics-advisories/icsa-26-272-05"]},"CVE-2026-100293":{"p":[],"a":["https://www.cisa.gov/news-events/ics-advisories/icsa-26-272-05"]},"CVE-2026-100294":{"p":[],"a":["https://www.cisa.gov/news-events/ics-advisories/icsa-26-272-05"]},"CVE-2026-100295":{"p":[],"a":["https://www.cisa.gov/news-events/ics-advisories/icsa-26-272-05"]},"CVE-2026-100296":{"p":[],"a":["https://www.cisa.gov/news-events/ics-advisories/icsa-26-272-05"]},"CVE-2026-100297":{"p":[],"a":["https://www.cisa.gov/news-events/ics-advisories/icsa-26-272-05"]},"CVE-2026-100298":{"p":[],"a":["https://www.cisa.gov/news-events/ics-advisories/icsa-26-272-05"]},"CVE-2026-100299":{"p":[],"a":["https://www.cisa.gov/news-events/ics-advisories/icsa-26-272-05"]},"CVE-2026-94204":{"p":[{"p":"Viidure Dashcam Android Application","f":[],"u":["3.3.1.260403"]}],"a":["https://viidure.app/","https://www.cisa.gov/news-events/ics-advisories/icsa-26-272-07","https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-272-07.json"]},"CVE-2026-96587":{"p":[{"p":"Viidure Dashcam Android Application","f":[],"u":["3.3.1.260403"]}],"a":["https://viidure.app/","https://www.cisa.gov/news-events/ics-advisories/icsa-26-272-07","https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-272-07.json"]},"CVE-2026-71379":{"p":[],"a":["https://www.toptech.com/blog/tms7-version-7-8-strengthens-security","https://www.cisa.gov/news-events/ics-advisories/icsa-26-272-02","https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-272-02.json"]},"CVE-2026-70356":{"p":[],"a":["https://www.toptech.com/blog/tms7-version-7-8-strengthens-security","https://www.cisa.gov/news-events/ics-advisories/icsa-26-272-02","https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-272-02.json"]},"CVE-2026-72510":{"p":[],"a":["https://www.toptech.com/blog/tms7-version-7-8-strengthens-security","https://www.cisa.gov/news-events/ics-advisories/icsa-26-272-02","https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-272-02.json"]},"CVE-2026-63713":{"p":[],"a":["https://www.toptech.com/blog/tms7-version-7-8-strengthens-security","https://www.cisa.gov/news-events/ics-advisories/icsa-26-272-02","https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-272-02.json"]},"CVE-2026-68954":{"p":[],"a":["https://www.toptech.com/blog/tms7-version-7-8-strengthens-security","https://www.cisa.gov/news-events/ics-advisories/icsa-26-272-02","https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-272-02.json"]},"CVE-2026-68068":{"p":[],"a":["https://www.toptech.com/blog/tms7-version-7-8-strengthens-security","https://www.cisa.gov/news-events/ics-advisories/icsa-26-272-02","https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-272-02.json"]},"CVE-2026-72507":{"p":[],"a":["https://www.toptech.com/blog/tms7-version-7-8-strengthens-security","https://www.cisa.gov/news-events/ics-advisories/icsa-26-272-02","https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-272-02.json"]},"CVE-2026-71302":{"p":[],"a":["https://www.toptech.com/blog/tms7-version-7-8-strengthens-security","https://www.cisa.gov/news-events/ics-advisories/icsa-26-272-02","https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-272-02.json"]},"CVE-2026-69662":{"p":[],"a":["https://www.toptech.com/blog/tms7-version-7-8-strengthens-security","https://www.cisa.gov/news-events/ics-advisories/icsa-26-272-02","https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-272-02.json"]},"CVE-2026-71189":{"p":[],"a":["https://www.toptech.com/blog/tms7-version-7-8-strengthens-security","https://www.cisa.gov/news-events/ics-advisories/icsa-26-272-02","https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-272-02.json"]},"CVE-2026-84409":{"p":[],"a":["https://ltrxdev.atlassian.net/wiki/spaces/LTRXTS/pages/1889828865/Latest+firmware+for+the+G520+Series+G526+G526RP+G527+G528","https://www.lantronix.com/technical-support/security-updates/vulnerability-disclosure-policy/vulnerability-library/","https://www.cisa.gov/news-events/ics-advisories/icsa-26-272-01"]},"CVE-2026-91191":{"p":[],"a":["https://ltrxdev.atlassian.net/wiki/spaces/LTRXTS/pages/1889828865/Latest+firmware+for+the+G520+Series+G526+G526RP+G527+G528","https://www.lantronix.com/technical-support/security-updates/vulnerability-disclosure-policy/vulnerability-library/","https://www.cisa.gov/news-events/ics-advisories/icsa-26-272-01"]},"CVE-2026-88773":{"p":[{"p":"Citrix NetScaler ADC","f":["14.1-73.37","13.1-64.23","14.1-73.37 FIPS","13.1-37.279 and NDcPP"],"u":[]},{"p":"Citrix NetScaler Gateway","f":["14.1-73.37 FIPS","13.1-64.23"],"u":[]}],"a":["https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697096"]},"CVE-2026-88774":{"p":[{"p":"Citrix NetScaler ADC","f":["14.1-73.37","13.1-64.23","14.1-73.37 FIPS","13.1.37.279 FIPS and NDcPP"],"u":[]},{"p":"Citrix NetScaler Gateway","f":["14.1-73.37","13.1-64.23"],"u":[]}],"a":["https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697096&articleTitle=Citrix_NetScaler_ADC_and_Citrix_NetScaler_Gateway_Security_Bulletin_for_CVE_2026_88771_CVE_2026_88772_CVE_2026_88773_CVE_2026_88774_CVE_2026_88775_CVE_2026_88776_CVE_2026_88777_and_CVE_2026_88778"]},"CVE-2026-88775":{"p":[{"p":"Citrix NetScaler ADC","f":["14.1-73.37","13.1-64.23","14.1-73.37 FIPS","13.1.37.279 FIPS and NDcPP"],"u":[]},{"p":"Citrix NetScaler Gateway","f":["14.1-73.37","13.1-64.23"],"u":[]}],"a":["https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697096&articleTitle=Citrix_NetScaler_ADC_and_Citrix_NetScaler_Gateway_Security_Bulletin_for_CVE_2026_88771_CVE_2026_88772_CVE_2026_88773_CVE_2026_88774_CVE_2026_88775_CVE_2026_88776_CVE_2026_88777_and_CVE_2026_88778"]},"CVE-2026-88776":{"p":[{"p":"Citrix NetScaler ADC","f":["14.1-73.37","13.1-64.23","14.1-73.37 FIPS","13.1.37.279 FIPS and NDcPP"],"u":[]},{"p":"Citrix NetScaler Gateway","f":["14.1-73.37","13.1-64.23"],"u":[]}],"a":["https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697096"]},"CVE-2026-88777":{"p":[{"p":"Citrix NetScaler ADC","f":["14.1-73.37","13.1-64.23","14.1-73.37 FIPS","13.1.37.279 FIPS and NDcPP"],"u":[]},{"p":"Citrix NetScaler Gateway","f":["14.1-73.37","13.1-64.23"],"u":[]}],"a":["https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697096&articleTitle=Citrix_NetScaler_ADC_and_Citrix_NetScaler_Gateway_Security_Bulletin_for_CVE_2026_88771_CVE_2026_88772_CVE_2026_88773_CVE_2026_88774_CVE_2026_88775_CVE_2026_88776_CVE_2026_88777_and_CVE_2026_88778"]},"CVE-2026-88778":{"p":[{"p":"Citrix NetScaler ADC","f":["14.1-73.37","13.1-64.23","14.1-73.37 FIPS","13.1.37.279 FIPS and NDcPP"],"u":[]},{"p":"Citrix NetScaler Gateway","f":["14.1-73.37","13.1-64.23"],"u":[]}],"a":["https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697096"]},"CVE-2026-19490":{"p":[{"p":"NetScaler ADC","f":[],"u":["73.32","63.21"]},{"p":"NetScaler Gateway","f":[],"u":["73.32","63.21"]}],"a":["https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX696939"]},"CVE-2026-13742":{"p":[{"p":"Honeywell Technologies IQ MultiAccess","f":[],"u":["28"]}],"a":["https://www.honeywell.com/us/en/product-security"]},"CVE-2026-35273":{"p":[],"a":["https://www.oracle.com/security-alerts/alert-cve-2026-35273.html"]},"CVE-2026-28326":{"p":[],"a":["https://www.solarwinds.com/trust-center/security-advisories/CVE-2026-28326","https://documentation.solarwinds.com/en/success_center/whd/content/release_notes/arm_2026-2-1_release_notes.htm"]},"CVE-2026-65660":{"p":[{"p":"Microsoft Microsoft SharePoint Enterprise Server 2016","f":["16.0.5565.1001"],"u":[]},{"p":"Microsoft Microsoft SharePoint Server 2019","f":["16.0.10417.20198"],"u":[]},{"p":"Microsoft Microsoft SharePoint Server Subscription Edition","f":["16.0.19725.20522"],"u":[]}],"a":["https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-65660"]},"CVE-2026-67279":{"p":[{"p":"Mikrotik RouterOS","f":["7.24.2","7.23.4","6.49.21"],"u":[]}],"a":["https://mikrotik.com/supportsec/september-2026-vulnerability/","https://forum.mikrotik.com/t/6-49-21-long-term-is-released/272802","https://forum.mikrotik.com/t/7-23-4-long-term-is-released/272801"]},"CVE-2026-87902":{"p":[{"p":"WordPress WordPress","f":["7.1.2"],"u":[]}],"a":["https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-7hp8-65ch-5whp"]},"CVE-2026-96883":{"p":[{"p":"AWS pgcollection","f":[],"u":["2.1.1"]}],"a":["https://github.com/aws/pgcollection/releases/tag/v2.1.2","https://aws.amazon.com/security/security-bulletins/2026-118-aws/"]},"CVE-2026-76439":{"p":[],"a":["https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-multiauth-bypass-sgD2HbL4"]},"CVE-2026-76444":{"p":[],"a":["https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-multiauth-bypass-sgD2HbL4"]},"CVE-2026-76446":{"p":[],"a":["https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-multiauth-bypass-sgD2HbL4"]},"CVE-2026-76447":{"p":[],"a":["https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-multiauth-bypass-sgD2HbL4"]},"CVE-2024-45519":{"p":[],"a":["https://wiki.zimbra.com/wiki/Security_Center","https://wiki.zimbra.com/wiki/Zimbra_Responsible_Disclosure_Policy","https://wiki.zimbra.com/wiki/Zimbra_Releases/10.1.1#Security_Fixes"]},"CVE-2026-5430":{"p":[{"p":"WSO2 WSO2 Universal Gateway","f":["4.5.0.57","4.6.0.21"],"u":[]},{"p":"WSO2 WSO2 Traffic Manager","f":["4.5.0.56","4.6.0.21"],"u":[]},{"p":"WSO2 WSO2 API Control Plane","f":["4.5.0.58","4.6.0.22"],"u":[]},{"p":"WSO2 WSO2 API Manager","f":["4.1.0.257","4.2.0.197","4.3.0.108","4.4.0.72","4.5.0.57"],"u":[]}],"a":["https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5328/"]},"CVE-2026-71362":{"p":[{"p":"Adobe Adobe Commerce","f":[],"u":["2.4.9-2026-jul, 2.4.8-2026-aug, 2.4.7-2026-aug, 2.4.6-2026-aug, 2.4.5-2026-aug, 2.4.4-2026-aug"]},{"p":"Adobe Adobe Commerce B2B","f":[],"u":["1.5.3-2026-jul, 1.5.2-2026-jul, 1.4.2-2026-jul, 1.3.4-2026-jul, 1.3.3-2026-jul"]},{"p":"Adobe Magento Open Source","f":[],"u":["2.4.9-2026-jul, 2.4.8-2026-jul, 2.4.7-2026-jul, 2.4.6-2026-jul"]}],"a":["https://helpx.adobe.com/security/products/magento/apsb26-92.html"]},"CVE-2026-84399":{"p":[],"a":["https://www.cisa.gov/news-events/ics-advisories/icsa-26-267-01","https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-267-01.json"]},"CVE-2026-82566":{"p":[],"a":["https://www.botslab.com/pages/about-botslab","https://www.cisa.gov/news-events/ics-advisories/icsa-26-267-01","https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-267-01.json"]},"CVE-2026-85496":{"p":[],"a":["https://www.botslab.com/pages/about-botslab","https://www.cisa.gov/news-events/ics-advisories/icsa-26-267-01","https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-267-01.json"]},"CVE-2026-77967":{"p":[],"a":["https://www.botslab.com/pages/about-botslab","https://www.cisa.gov/news-events/ics-advisories/icsa-26-267-01","https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-267-01.json"]},"CVE-2026-88761":{"p":[],"a":["https://www.botslab.com/pages/about-botslab","https://www.cisa.gov/news-events/ics-advisories/icsa-26-267-01","https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-267-01.json"]},"CVE-2026-82716":{"p":[],"a":["https://www.botslab.com/pages/about-botslab","https://www.cisa.gov/news-events/ics-advisories/icsa-26-267-01","https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-267-01.json"]},"CVE-2026-84403":{"p":[],"a":["https://www.botslab.com/pages/about-botslab","https://www.cisa.gov/news-events/ics-advisories/icsa-26-267-01","https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-267-01.json"]},"CVE-2026-75558":{"p":[],"a":["https://www.botslab.com/pages/about-botslab","https://www.cisa.gov/news-events/ics-advisories/icsa-26-267-01","https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-267-01.json"]},"CVE-2026-81630":{"p":[],"a":["https://www.botslab.com/pages/about-botslab","https://www.cisa.gov/news-events/ics-advisories/icsa-26-267-01","https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-267-01.json"]},"CVE-2026-87118":{"p":[],"a":["https://www.botslab.com/pages/about-botslab","https://www.cisa.gov/news-events/ics-advisories/icsa-26-267-01","https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-267-01.json"]},"CVE-2026-82708":{"p":[],"a":["https://www.botslab.com/pages/about-botslab","https://www.cisa.gov/news-events/ics-advisories/icsa-26-267-01","https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-267-01.json"]},"CVE-2026-79959":{"p":[],"a":["https://www.botslab.com/pages/about-botslab","https://www.cisa.gov/news-events/ics-advisories/icsa-26-267-01","https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-267-01.json"]},"CVE-2026-82585":{"p":[],"a":["https://www.botslab.com/pages/about-botslab","https://www.cisa.gov/news-events/ics-advisories/icsa-26-267-01","https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-267-01.json"]},"CVE-2026-88956":{"p":[],"a":["https://www.botslab.com/pages/about-botslab","https://www.cisa.gov/news-events/ics-advisories/icsa-26-267-01","https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-267-01.json"]},"CVE-2026-93289":{"p":[{"p":"Eufy Omni C20","f":["1.6.4"],"u":[]},{"p":"Eufy Omni X10 Pro","f":["1.6.4"],"u":[]}],"a":["https://www.cisa.gov/news-events/ics-advisories/icsa-26-267-02"]},"CVE-2026-93290":{"p":[{"p":"Eufy Omni C20","f":["1.6.4"],"u":[]}],"a":["https://www.cisa.gov/news-events/ics-advisories/icsa-26-267-02"]},"CVE-2026-93291":{"p":[{"p":"Eufy Omni C20","f":["1.6.4"],"u":[]}],"a":["https://www.cisa.gov/news-events/ics-advisories/icsa-26-267-02"]},"CVE-2026-13795":{"p":[{"p":"Google Chrome","f":["150.0.7871.47"],"u":[]}],"a":["https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html","https://issues.chromium.org/issues/476591032"]},"CVE-2024-0244":{"p":[],"a":["https://psirt.canon/advisory-information/cp2024-001/","https://canon.jp/support/support-info/240205vulnerability-response","https://www.usa.canon.com/support/canon-product-advisories/Service-Notice-Regarding-Vulnerability-Measure-Against-Buffer-Overflow-for-Laser-Printers-and-Small-Office-Multifunctional-Printers"]},"CVE-2025-39682":{"p":[{"p":"Linux Linux","f":["2902c3ebcca52ca845c03182000e8d71d3a5196f","c09dd3773b5950e9cfb6c9b9a5f6e36d06c62677","3439c15ae91a517cf3c650ea15a8987699416ad9","29c0ce3c8cdb6dc5d61139c937f34cb888a6f42e","62708b9452f8eb77513115b17c4f8d1a22ebf843"],"u":[]}],"a":["https://git.kernel.org/stable/c/2902c3ebcca52ca845c03182000e8d71d3a5196f","https://git.kernel.org/stable/c/c09dd3773b5950e9cfb6c9b9a5f6e36d06c62677","https://git.kernel.org/stable/c/3439c15ae91a517cf3c650ea15a8987699416ad9"]},"CVE-2026-53266":{"p":[{"p":"Linux Linux","f":["bf84ad7c7a9ede46e31afaa41a1ba06a159e8c87","76280b78cc9f23bdc6438e10ad6dff148ef8375b","b7e91939ba9be805a62a257fa4e227dffbb88fa0","afd64b59c3de9bbbdd3759e834fdc55cda716e0b","153ea96c806aea395daba907a4f88480b6ad5093"],"u":[]}],"a":["https://git.kernel.org/stable/c/bf84ad7c7a9ede46e31afaa41a1ba06a159e8c87","https://git.kernel.org/stable/c/76280b78cc9f23bdc6438e10ad6dff148ef8375b","https://git.kernel.org/stable/c/b7e91939ba9be805a62a257fa4e227dffbb88fa0"]},"CVE-2025-39964":{"p":[{"p":"Linux Linux","f":["0f28c4adbc4a97437874c9b669fd7958a8c6d6ce","e4c1ec11132ec466f7362a95f36a506ce4dc08c9","1f323a48e9b5ebfe6dc7d130fdf5c3c0e92a07c8","7c4491b5644e3a3708f3dbd7591be0a570135b84","9aee87da5572b3a14075f501752e209801160d3d"],"u":[]}],"a":["https://git.kernel.org/stable/c/0f28c4adbc4a97437874c9b669fd7958a8c6d6ce","https://git.kernel.org/stable/c/e4c1ec11132ec466f7362a95f36a506ce4dc08c9","https://git.kernel.org/stable/c/1f323a48e9b5ebfe6dc7d130fdf5c3c0e92a07c8"]},"CVE-2026-94127":{"p":[{"p":"F5 BIG-IP","f":["Hotfix-BIGIP-21.1.0.2.0.30.22-ENG","Hotfix-BIGIP-17.5.1.9.0.160.12-ENG","Hotfix-BIGIP-17.1.3.5.0.41.14-ENG"],"u":[]}],"a":["https://my.f5.com/manage/s/article/K000162605"]},"CVE-2026-96417":{"p":[{"p":"Wireshark Foundation Wireshark","f":["4.6.9","4.4.19"],"u":[]}],"a":["https://www.wireshark.org/security/wnpa-sec-2026-104.html","https://gitlab.com/wireshark/wireshark/-/work_items/21574"]},"CVE-2026-91818":{"p":[],"a":["https://www.foxit.com/support/security-bulletins.html"]},"CVE-2026-91817":{"p":[],"a":["https://www.foxit.com/support/security-bulletins.html"]},"CVE-2026-91816":{"p":[],"a":["https://www.foxit.com/support/security-bulletins.html"]},"CVE-2026-91815":{"p":[],"a":["https://www.foxit.com/support/security-bulletins.html"]},"CVE-2026-91813":{"p":[],"a":["https://www.foxit.com/support/security-bulletins.html"]},"CVE-2026-91812":{"p":[],"a":["https://www.foxit.com/support/security-bulletins.html"]},"CVE-2026-91811":{"p":[],"a":["https://www.foxit.com/support/security-bulletins.html"]},"CVE-2026-91810":{"p":[],"a":["https://www.foxit.com/support/security-bulletins.html"]},"CVE-2026-91809":{"p":[],"a":["https://www.foxit.com/support/security-bulletins.html"]},"CVE-2026-91808":{"p":[],"a":["https://www.foxit.com/support/security-bulletins.html"]},"CVE-2026-91807":{"p":[],"a":["https://www.foxit.com/support/security-bulletins.html"]},"CVE-2026-91806":{"p":[],"a":["https://www.foxit.com/support/security-bulletins.html"]},"CVE-2026-91801":{"p":[],"a":["https://www.foxit.com/support/security-bulletins.html"]},"CVE-2026-91797":{"p":[],"a":["https://www.foxit.com/support/security-bulletins.html"]},"CVE-2026-91796":{"p":[],"a":["https://www.foxit.com/support/security-bulletins.html"]},"CVE-2026-91795":{"p":[],"a":["https://www.foxit.com/support/security-bulletins.html"]},"CVE-2026-91794":{"p":[],"a":["https://www.foxit.com/support/security-bulletins.html"]},"CVE-2026-91793":{"p":[],"a":["https://www.foxit.com/support/security-bulletins.html"]},"CVE-2026-57238":{"p":[],"a":["https://www.foxit.com/support/security-bulletins.html"]},"CVE-2026-13128":{"p":[],"a":["https://www.foxit.com/support/security-bulletins.html"]},"CVE-2026-13129":{"p":[],"a":["https://www.foxit.com/support/security-bulletins.html"]},"CVE-2026-91799":{"p":[],"a":["https://www.foxit.com/support/security-bulletins.html"]},"CVE-2026-94450":{"p":[{"p":"AWS s2n-quic","f":[],"u":["1.88.0"]}],"a":["https://github.com/aws/s2n-quic/releases/tag/v1.89.0","https://aws.amazon.com/security/security-bulletins/2026-116-aws/","https://github.com/aws/s2n-quic/security/advisories/GHSA-5rw2-6x5m-v22x"]},"CVE-2026-11400":{"p":[{"p":"AWS AWS Advanced JDBC Wrapper","f":["4.0.1"],"u":[]}],"a":["https://github.com/aws/aws-advanced-jdbc-wrapper/releases/tag/4.0.1","https://aws.amazon.com/security/security-bulletins/2026-039-aws/"]},"CVE-2026-11401":{"p":[{"p":"AWS AWS Advanced Go Wrapper","f":["2026-05-26"],"u":[]}],"a":["https://github.com/aws/aws-advanced-go-wrapper/releases/tag/release-2026-05-26","https://aws.amazon.com/security/security-bulletins/2026-039-aws/"]},"CVE-2026-8686":{"p":[],"a":["https://github.com/FreeRTOS/coreMQTT/releases/tag/v5.0.1","https://aws.amazon.com/security/security-bulletins/2026-032-aws/"]},"CVE-2026-11931":{"p":[{"p":"AWS Kiro IDE","f":["0.11.133"],"u":[]}],"a":["https://kiro.dev/changelog/ide/0-11/#patch-0-11-133","https://aws.amazon.com/security/security-bulletins/2026-045-aws/"]},"CVE-2026-12957":{"p":[{"p":"Amazon Web Services Language Servers for AWS","f":["1.65.0"],"u":[]}],"a":["https://aws.amazon.com/security/security-bulletins/2026-047-aws/"]},"CVE-2026-12958":{"p":[{"p":"Amazon Web Services Language Servers for AWS","f":["1.69.0"],"u":[]}],"a":["https://aws.amazon.com/security/security-bulletins/2026-047-aws/"]},"CVE-2026-14265":{"p":[{"p":"AWS AWS Advanced JDBC Wrapper","f":[],"u":["4.0.0"]}],"a":["https://github.com/aws/aws-advanced-jdbc-wrapper/releases/tag/4.0.1","https://aws.amazon.com/security/security-bulletins/2026-051-aws/"]},"CVE-2026-13760":{"p":[{"p":"AWS AWS CDK","f":["2.260.0"],"u":[]}],"a":["https://github.com/aws/aws-cdk/releases/tag/v2.260.0","https://aws.amazon.com/security/security-bulletins/2026-050-aws/"]},"CVE-2026-14904":{"p":[{"p":"AWS res","f":[],"u":["2026.03"]}],"a":["https://github.com/aws/res/releases/tag/2026.06","https://aws.amazon.com/security/security-bulletins/2026-053-aws/"]},"CVE-2026-15895":{"p":[{"p":"AWS jsii","f":["1.131.0"],"u":[]}],"a":["https://github.com/aws/jsii/releases/tag/v1.131.0","https://aws.amazon.com/security/security-bulletins/2026-057-aws/"]},"CVE-2026-16796":{"p":[{"p":"AWS bedrock-agentcore 1.18.1","f":["1.18.1"],"u":[]}],"a":["https://pypi.org/project/bedrock-agentcore/1.18.1/","https://aws.amazon.com/security/security-bulletins/2026-065-aws/","https://github.com/aws/bedrock-agentcore-sdk-python/security/advisories/GHSA-j6g5-3hh3-pgw8"]},"CVE-2026-12283":{"p":[{"p":"AWS aws-athena-query-federation","f":[],"u":["v2026.19.1"]}],"a":["https://github.com/awslabs/aws-athena-query-federation/releases/tag/v2026.21.1","https://aws.amazon.com/security/security-bulletins/2026-059-aws/","https://github.com/awslabs/aws-athena-query-federation/security/advisories/GHSA-43cr-4635-mfjp"]},"CVE-2026-15957":{"p":[{"p":"AWS aws-sdk-rust","f":["release-2026-06-02"],"u":[]}],"a":["https://github.com/awslabs/aws-sdk-rust/releases/tag/release-2026-06-02","https://aws.amazon.com/security/security-bulletins/2026-061-aws/","https://github.com/smithy-lang/smithy-rs/security/advisories/GHSA-4f2p-7j38-4xrg"]},"CVE-2026-16584":{"p":[{"p":"AWS aws-api-mcp-server","f":["1.3.47"],"u":[]}],"a":["https://pypi.org/project/awslabs.aws-api-mcp-server/1.3.47/","https://aws.amazon.com/security/security-bulletins/2026-063-aws/","https://github.com/awslabs/mcp/security/advisories/GHSA-29w2-fq35-v728"]},"CVE-2026-87121":{"p":[{"p":"lwIP TCP/IP Stack MQTT","f":[],"u":["2.2.1"]}],"a":["https://savannah.nongnu.org/projects/lwip","https://www.cisa.gov/news-events/ics-advisories/icsa-26-265-01","https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-265-01.json"]},"CVE-2026-89207":{"p":[{"p":"Siemens WTV676-HB6035 Web Interface","f":["V3.94"],"u":[]},{"p":"Siemens WTV776-HB6035 Web Interface","f":["V4.17"],"u":[]}],"a":["https://cert-portal.siemens.com/productcert/html/ssa-823812.html"]},"CVE-2026-85102":{"p":[],"a":["https://support.checkpoint.com/results/sk/sk1000117"]},"CVE-2026-93952":{"p":[{"p":"Arista Networks VeloCloud Orchestrator (VCO) On-Prem","f":[],"u":["5.2.3.15","6.1.3.7","6.4.2.7"]}],"a":["https://www.arista.com/en/support/advisories-notices/security-advisory/24765-security-advisory-0183"]},"CVE-2026-67367":{"p":[{"p":"Siemens SIMOVE Fleetmanager V3.1","f":["V3.1.13"],"u":[]},{"p":"Siemens SIMOVE Fleetmanager V3.2","f":["V3.2.4"],"u":[]},{"p":"Siemens SIMOVE Fleetmanager V3.3","f":["V3.3.2"],"u":[]},{"p":"Siemens SIMOVE Fleetmanager V4.0","f":["V4.0.1"],"u":[]}],"a":["https://cert-portal.siemens.com/productcert/html/ssa-517424.html"]},"CVE-2026-34223":{"p":[],"a":["https://cert-portal.siemens.com/productcert/html/ssa-330084.html"]},"CVE-2026-50093":{"p":[{"p":"Siemens Siveillance Control Pro V3.0","f":["V3.0.12.2173"],"u":[]},{"p":"Siemens Siveillance Control Pro V4.0","f":["V4.0.9.2178"],"u":[]},{"p":"Siemens Siveillance Control V3.0","f":["V3.0.22.2177"],"u":[]},{"p":"Siemens Siveillance Control V4.0","f":["V4.0.11.2177"],"u":[]}],"a":["https://cert-portal.siemens.com/productcert/html/ssa-254516.html"]},"CVE-2026-18963":{"p":[],"a":["https://access.redhat.com/errata/RHSA-2026:56519","https://access.redhat.com/errata/RHSA-2026:56520","https://access.redhat.com/errata/RHSA-2026:56523"]},"CVE-2026-91018":{"p":[{"p":"lwIP lwIP API","f":[],"u":["2.2.1"]}],"a":["https://cgit.git.savannah.gnu.org/cgit/lwip.git","https://www.cisa.gov/news-events/ics-advisories/icsa-26-265-02","https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-265-02.json"]},"CVE-2026-88020":{"p":[],"a":["https://www.cisa.gov/news-events/ics-advisories/icsa-26-265-09","https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-265-09.json"]},"CVE-2026-85046":{"p":[{"p":"Google Chrome","f":["152.0.7977.82"],"u":[]}],"a":["https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_01882797386.html","https://issues.chromium.org/issues/542403045"]},"CVE-2026-87491":{"p":[{"p":"Google Chrome","f":["153.0.8010.36"],"u":[]}],"a":["https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_0808145027.html","https://issues.chromium.org/issues/543557673"]},"CVE-2026-7273":{"p":[],"a":["https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-stack-based-buffer-overflow-vulnerability-in-gs1900-series-switches-06-16-2026"]},"CVE-2026-66804":{"p":[{"p":"Microsoft Windows 10 Version 22H2","f":["10.0.19045.7663"],"u":[]},{"p":"Microsoft Windows 11 Version 24H2","f":["10.0.26100.9168"],"u":[]},{"p":"Microsoft Windows 11 Version 25H2","f":["10.0.26200.9168"],"u":[]},{"p":"Microsoft Windows 11 version 26H1","f":["10.0.28000.2704"],"u":[]}],"a":["https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-66804"]},"CVE-2026-50343":{"p":[{"p":"Microsoft Windows 10 Version 1809","f":["10.0.17763.9020"],"u":[]},{"p":"Microsoft Windows 10 Version 21H2","f":["10.0.19044.7548"],"u":[]},{"p":"Microsoft Windows 10 Version 22H2","f":["10.0.19045.7548"],"u":[]},{"p":"Microsoft Windows 11 Version 24H2","f":["10.0.26100.8875"],"u":[]}],"a":["https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50343"]},"CVE-2026-58704":{"p":[],"a":["https://source.android.com/docs/security/bulletin/pixel/2026/2026-09-01"]},"CVE-2026-76460":{"p":[],"a":["https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ISE-ABP-VNSW7Tn5"]},"CVE-2026-87886":{"p":[{"p":"Acronis Acronis Backup plugin for cPanel & WHM","f":["1.9.3.1021"],"u":[]},{"p":"Acronis Acronis Backup extension for Plesk","f":["1.8.11.638"],"u":[]},{"p":"Acronis Acronis Backup plugin for DirectAdmin","f":["1.2.3.238"],"u":[]}],"a":["https://security-advisory.acronis.com/advisories/SEC-10986"]},"CVE-2026-76461":{"p":[],"a":["https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-inj-2bLVGmhX"]},"CVE-2026-84869":{"p":[],"a":["https://www.connectwise.com/company/trust/security-bulletins/2026-09-08-screenconnect-bulletin","https://github.com/ConnectWise-Advisories/Disclosures/tree/main/CVE-2026-84869","https://www.connectwise.com/company/trust/advisories"]},"CVE-2026-42016":{"p":[{"p":"jfrog artifactory","f":["7.133.11"],"u":[]}],"a":["https://docs.jfrog.com/releases/docs/jfrog-security-advisories","https://docs.jfrog.com/releases/docs/artifactory-self-managed-releases"]},"CVE-2026-42018":{"p":[{"p":"jfrog artifactory","f":["7.111.20","7.117.27","7.125.19","7.133.28","7.146.8"],"u":[]}],"a":["https://docs.jfrog.com/releases/docs/jfrog-security-advisories","https://docs.jfrog.com/releases/docs/artifactory-self-managed-releases"]},"CVE-2026-85706":{"p":[{"p":"GitLab GitLab","f":["18.11.12","19.0.9","19.1.8","19.2.6","19.3.2"],"u":[]}],"a":["https://gitlab.com/gitlab-org/gitlab/-/work_items/627748","https://hackerone.com/reports/3909881"]},"CVE-2026-86060":{"p":[{"p":"Mikrotik RouterOS","f":["7.24.2","7.23.4","6.49.21"],"u":[]}],"a":["https://mikrotik.com/supportsec/september-2026-vulnerability/","https://forum.mikrotik.com/t/6-49-21-long-term-is-released/272802","https://forum.mikrotik.com/t/7-23-4-long-term-is-released/272801"]},"CVE-2026-67277":{"p":[{"p":"Mikrotik RouterOS","f":["7.24.2","7.23.4","6.49.21"],"u":[]}],"a":["https://mikrotik.com/supportsec/september-2026-vulnerability/","https://forum.mikrotik.com/t/6-49-21-long-term-is-released/272802","https://forum.mikrotik.com/t/7-23-4-long-term-is-released/272801"]},"CVE-2025-25249":{"p":[{"p":"Fortinet FortiSwitchManager","f":[],"u":["7.2.5"]},{"p":"Fortinet FortiOS","f":[],"u":["7.6.2","7.4.7","7.2.11"]}],"a":["https://fortiguard.fortinet.com/psirt/FG-IR-25-084"]},"CVE-2026-20079":{"p":[],"a":["https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-onprem-fmc-authbypass-5JPp45V2"]},"CVE-2026-75650":{"p":[{"p":"Adobe Adobe Commerce","f":[],"u":["2.4.9-2026-aug, 2.4.8-2026-aug, 2.4.7-2026-aug, 2.4.6-2026-aug, 2.4.5-2026-aug, 2.4.4-2026-aug"]},{"p":"Adobe Adobe Commerce B2B","f":[],"u":["1.5.3-2026-aug, 1.5.2-2026-aug, 1.4.2-2026-aug, 1.3.4-2026-aug, 1.3.3-2026-aug"]},{"p":"Adobe Magento Open Source","f":[],"u":["2.4.9-2026-aug, 2.4.8-2026-aug, 2.4.7-2026-aug, 2.4.6-2026-aug"]}],"a":["https://helpx.adobe.com/security/products/magento/apsb26-146.html"]},"CVE-2026-86218":{"p":[{"p":"N-able N-central","f":["2026.3.1.14"],"u":[]}],"a":["https://me.n-able.com/s/security-advisory/aArVy0000002Ld3KAE/cve202686218-preauthentication-remote-code-execution"]},"CVE-2026-59822":{"p":[],"a":["https://github.com/BerriAI/litellm/security/advisories/GHSA-7488-6r32-c95q","https://github.com/BerriAI/litellm/pull/26463","https://github.com/BerriAI/litellm/commit/73869f0faf7d11ee21adcb5f91b8c33a340b6c2c"]},"CVE-2026-48710":{"p":[],"a":["https://github.com/Kludex/starlette/security/advisories/GHSA-86qp-5c8j-p5mr","https://github.com/Kludex/starlette/commit/764dab0dcfb9033d75442d7a359645c9f94648c6","https://badhost.org"]},"CVE-2026-49869":{"p":[],"a":["https://github.com/kestra-io/kestra/security/advisories/GHSA-5vc5-wxxq-3fjx"]},"CVE-2026-82329":{"p":[{"p":"jfrog artifactory","f":["7.111.21","7.117.28","7.125.20","7.133.29","7.146.38"],"u":[]}],"a":["https://docs.jfrog.com/releases/docs/jfrog-security-advisories","https://docs.jfrog.com/releases/docs/artifactory-self-managed-releases"]},"CVE-2026-9586":{"p":[{"p":"Sangoma Switchvox SMB Edition","f":["8.4.0.2"],"u":[]}],"a":["https://sangomakb.atlassian.net/wiki/spaces/Switchvox/pages/1802371073/Switchvox+-+Release+Notes+Version+8.4.0.2+July+14+2026"]},"CVE-2026-83548":{"p":[],"a":["https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0016"]},"CVE-2026-83549":{"p":[],"a":["https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0016"]},"CVE-2023-49105":{"p":[],"a":["https://owncloud.org/security","https://owncloud.com/security-advisories/webdav-api-authentication-bypass-using-pre-signed-urls/"]},"CVE-2026-53362":{"p":[{"p":"Linux Linux","f":["14200d435af9a9eeb444f529fc2f689a236b7962","65fb14cbebb0cd0eff903a22d33537ddc8b95769","46f201f8b4c39633a1fa3dc12459f506d470993d","6374fb9edf72c67a118a2c214a0dddd04c921e0a","e9eacf19281ea2498b36291b56c9606118c2d74e"],"u":[]}],"a":["https://git.kernel.org/stable/c/14200d435af9a9eeb444f529fc2f689a236b7962","https://git.kernel.org/stable/c/65fb14cbebb0cd0eff903a22d33537ddc8b95769","https://git.kernel.org/stable/c/46f201f8b4c39633a1fa3dc12459f506d470993d"]},"CVE-2026-66384":{"p":[{"p":"jfrog artifactory","f":["7.146.35","7.161.16"],"u":[]}],"a":["https://docs.jfrog.com/releases/docs/jfrog-security-advisories","https://docs.jfrog.com/releases/docs/artifactory-self-managed-releases"]},"CVE-2021-23758":{"p":[{"p":"AjaxPro.2","f":["unspecified"],"u":[]}],"a":["https://snyk.io/vuln/SNYK-DOTNET-AJAXPRO2-1925971","https://github.com/michaelschwarz/Ajax.NET-Professional/commit/b0e63be5f0bb20dfce507cb8a1a9568f6e73de57","http://packetstormsecurity.com/files/175677/AjaxPro-Deserialization-Remote-Code-Execution.html"]},"CVE-2015-3246":{"p":[],"a":["http://lists.fedoraproject.org/pipermail/package-announce/2015-July/162947.html","http://rhn.redhat.com/errata/RHSA-2015-1482.html","http://lists.fedoraproject.org/pipermail/package-announce/2015-August/163044.html"]},"CVE-2015-5287":{"p":[],"a":["http://rhn.redhat.com/errata/RHSA-2015-2505.html"]},"CVE-2022-0995":{"p":[],"a":["https://bugzilla.redhat.com/show_bug.cgi?id=2063786","https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=93ce93587d36493f2f86921fa79921b3cba63fbb","http://packetstormsecurity.com/files/166770/Linux-watch_queue-Filter-Out-Of-Bounds-Write.html"]},"CVE-2026-8452":{"p":[{"p":"NetScaler ADC","f":["72.61","63.18","37.272"],"u":[]},{"p":"NetScaler Gateway","f":["72.61","63.18"],"u":[]}],"a":["https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX696604"]},"CVE-2019-1068":{"p":[],"a":["https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1068"]},"CVE-2026-60004":{"p":[{"p":"Gitea Gitea","f":["1.27.1"],"u":[]}],"a":["https://blog.gitea.com/release-of-1.27.1/","https://github.com/go-gitea/gitea/security/advisories/GHSA-rcr6-4jqh-j84m","https://www.runzero.com/blog/gitea/"]},"CVE-2026-21962":{"p":[],"a":["https://www.oracle.com/security-alerts/cpujan2026.html"]},"CVE-2026-72530":{"p":[{"p":"TrueConf TrueConf Server","f":["5.3","5.3.9","5.4.9","5.5.5"],"u":[]}],"a":["https://ics-cert.kaspersky.com/advisories/2026/08/11/trueconf-server-breakout-from-isolated-environment/"]},"CVE-2026-72529":{"p":[{"p":"TrueConf TrueConf Server","f":["5.3","5.3.9","5.4.9","5.5.5"],"u":[]}],"a":["https://ics-cert.kaspersky.com/advisories/2026/08/11/trueconf-server-missing-authentication-for-critical-function/"]},"CVE-2026-64849":{"p":[],"a":["https://github.com/mlflow/mlflow/security/advisories/GHSA-7gwp-5pfp-969j","https://github.com/mlflow/mlflow/issues/24179","https://github.com/mlflow/mlflow/pull/24258"]},"CVE-2026-33824":{"p":[{"p":"Microsoft Windows 10 Version 1607","f":["10.0.14393.9060"],"u":[]},{"p":"Microsoft Windows 10 Version 1809","f":["10.0.17763.8644"],"u":[]},{"p":"Microsoft Windows 10 Version 21H2","f":["10.0.19044.7184"],"u":[]},{"p":"Microsoft Windows 10 Version 22H2","f":["10.0.19045.7184"],"u":[]}],"a":["https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33824"]},"CVE-2026-59310":{"p":[{"p":"VMware vCenter","f":["9.1.0.0300","9.0.2.0100","8.0 U3k"],"u":[]}],"a":["https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/38017"]},"CVE-2026-55040":{"p":[{"p":"Microsoft Microsoft SharePoint Enterprise Server 2016","f":["16.0.5561.1001"],"u":[]},{"p":"Microsoft Microsoft SharePoint Server 2019","f":["16.0.10417.20175"],"u":[]},{"p":"Microsoft Microsoft SharePoint Server Subscription Edition","f":["16.0.19725.20434"],"u":[]}],"a":["https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55040"]},"CVE-2026-65400":{"p":[{"p":"Apple macOS","f":["14.8.9","15.7.9","26.6.1","26.7","27"],"u":[]}],"a":["https://support.apple.com/en-us/148170","https://support.apple.com/en-us/148171","https://support.apple.com/en-us/148172"]},"CVE-2025-62593":{"p":[],"a":["https://github.com/ray-project/ray/security/advisories/GHSA-q279-jhrf-cc6v","https://github.com/ray-project/ray/commit/70e7c72780bdec075dba6cad1afe0832772bfe09"]},"CVE-2026-20349":{"p":[],"a":["https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-vpn-dos-dzv4mQFF"]},"CVE-2026-68820":{"p":[{"p":"Microsoft Windows 10 Version 1607","f":["10.0.14393.9418"],"u":[]},{"p":"Microsoft Windows 10 Version 1809","f":["10.0.17763.9121"],"u":[]},{"p":"Microsoft Windows 10 Version 21H2","f":["10.0.19044.7663"],"u":[]},{"p":"Microsoft Windows 10 Version 22H2","f":["10.0.19045.7663"],"u":[]}],"a":["https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-68820"]},"CVE-2026-72898":{"p":[{"p":"Metabase Metabase","f":["x.58.24","x.59.21","x.60.17","x.61.11","x.62.9"],"u":[]}],"a":["https://github.com/metabase/metabase/security/advisories/GHSA-vwf4-m7j8-wcjf","https://www.metabase.com/blog/security-update"]},"CVE-2026-8037":{"p":[{"p":"Progress Software LoadMaster","f":["V7.2.63.2","V7.2.54.18"],"u":[]},{"p":"Progress Software ECS Connections Manager","f":["V7.2.63.2"],"u":[]},{"p":"Progress Software Object Scale Connection Manager","f":["V7.2.63.2"],"u":[]},{"p":"Progress Software MOVEit WAF","f":["V7.2.63.2"],"u":[]}],"a":["https://community.progress.com/s/article/LoadMaster-Critical-Security-Bulletin-June-2026-CVE-2026-8037-CVE-2026-33691"]},"CVE-2026-63077":{"p":[{"p":"JetBrains TeamCity","f":["2026.1.3, 2025.11.7"],"u":[]}],"a":["https://www.jetbrains.com/privacy-security/issues-fixed/"]},"CVE-2026-18556":{"p":[{"p":"N-able N-central","f":[],"u":["2026.1"]}],"a":["https://uptime.n-able.com/"]},"CVE-2026-34486":{"p":[],"a":["https://lists.apache.org/thread/9510k5p5zdvt9pkkgtyp85mvwxo2qrly"]},"CVE-2026-9198":{"p":[{"p":"IBM Langflow OSS","f":[],"u":["1.10.0"]}],"a":["https://www.ibm.com/support/pages/node/7278927"]},"CVE-2026-18577":{"p":[{"p":"N-able N-central","f":[],"u":["2026.3"]}],"a":["https://documentation.n-able.com/N-central/Release_Notes/GA/Content/N-central_2026.3_HF1_Release_Notes.htm","https://status.n-able.com/2026/08/02/n-central-2026-3-hotfix-1-mitigation-for-cve-2026-18577/"]},"CVE-2026-20316":{"p":[],"a":["https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fmc-static-cred-BET3Cjh"]},"CVE-2025-68686":{"p":[{"p":"Fortinet FortiOS","f":[],"u":["7.6.1","7.4.6","7.2.13"]}],"a":["https://fortiguard.fortinet.com/psirt/FG-IR-25-934"]},"CVE-2026-16812":{"p":[{"p":"Arista Networks VeloCloud Orchestrator On-Prem","f":["5.2.3.14","6.1.3.4","6.4.2.4","7.0.0.1"],"u":[]}],"a":["https://www.arista.com/en/support/advisories-notices/security-advisory/24364-security-advisory-0144"]},"CVE-2026-16232":{"p":[],"a":["https://support.checkpoint.com/results/sk/sk185169"]},"CVE-2026-50522":{"p":[{"p":"Microsoft Microsoft SharePoint Enterprise Server 2016","f":["16.0.5561.1001"],"u":[]},{"p":"Microsoft Microsoft SharePoint Server 2019","f":["16.0.10417.20175"],"u":[]},{"p":"Microsoft Microsoft SharePoint Server Subscription Edition","f":["16.0.19725.20434"],"u":[]}],"a":["https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50522"]},"CVE-2026-60137":{"p":[{"p":"WordPress WordPress","f":["6.8.6","6.9.5","7.0.2"],"u":[]}],"a":["https://wordpress.org/news/2026/07/wordpress-7-0-2-release/"]},"CVE-2026-63030":{"p":[{"p":"WordPress WordPress","f":["6.9.5","7.0.2"],"u":[]}],"a":["https://wordpress.org/news/2026/07/wordpress-7-0-2-release/"]},"CVE-2026-0770":{"p":[],"a":["https://www.zerodayinitiative.com/advisories/ZDI-26-036/"]},"CVE-2021-27137":{"p":[{"p":"DD-WRT DD-WRT","f":["45724"],"u":[]}],"a":["https://svn.dd-wrt.com/changeset/45724","https://ssd-disclosure.com/ssd-advisory-dd-wrt-upnp-buffer-overflow/","https://securityaffairs.com/193290/uncategorized/iot-botnet-c0xmo-adds-competitor-killing-capability.html"]},"CVE-2026-58644":{"p":[{"p":"Microsoft Microsoft SharePoint Enterprise Server 2016","f":["16.0.5556.1005"],"u":[]},{"p":"Microsoft Microsoft SharePoint Server 2019","f":["16.0.10417.20153"],"u":[]},{"p":"Microsoft Microsoft SharePoint Server Subscription Edition","f":["16.0.19725.20384"],"u":[]}],"a":["https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58644"]},"CVE-2026-25089":{"p":[{"p":"Fortinet FortiSandbox","f":[],"u":["5.0.5","4.4.8","4.2.8"]},{"p":"Fortinet FortiSandbox Cloud","f":[],"u":["5.0.5"]},{"p":"Fortinet FortiSandbox PaaS","f":[],"u":["5.0.5"]}],"a":["https://fortiguard.fortinet.com/psirt/FG-IR-26-141"]},"CVE-2026-39808":{"p":[{"p":"Fortinet FortiSandbox","f":[],"u":["4.4.8"]}],"a":["https://fortiguard.fortinet.com/psirt/FG-IR-26-100"]},"CVE-2026-46817":{"p":[{"p":"Oracle Corporation Oracle Payments","f":[],"u":["12.2.15"]}],"a":["https://www.oracle.com/security-alerts/cspumay2026.html"]},"CVE-2023-4346":{"p":[],"a":["https://www.cisa.gov/news-events/ics-advisories/icsa-23-236-01"]},"CVE-2026-56155":{"p":[{"p":"Microsoft Windows 10 Version 1607","f":["10.0.14393.9339"],"u":[]},{"p":"Microsoft Windows 10 Version 1809","f":["10.0.17763.9020"],"u":[]},{"p":"Microsoft Windows Server 2012","f":["6.2.9200.26226"],"u":[]},{"p":"Microsoft Windows Server 2012 (Server Core installation)","f":["6.2.9200.26226"],"u":[]}],"a":["https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56155"]},"CVE-2026-56164":{"p":[{"p":"Microsoft Microsoft SharePoint Enterprise Server 2016","f":["16.0.5561.1001"],"u":[]},{"p":"Microsoft Microsoft SharePoint Server 2019","f":["16.0.10417.20175"],"u":[]},{"p":"Microsoft Microsoft SharePoint Server Subscription Edition","f":["16.0.19725.20434"],"u":[]}],"a":["https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56164"]},"CVE-2026-15409":{"p":[{"p":"SonicWall SMA1000","f":[],"u":["12.4.3-03434","12.5.0-02800"]}],"a":["https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0008"]},"CVE-2026-15410":{"p":[{"p":"SonicWall SMA1000","f":[],"u":["12.4.3-03434","12.5.0-02800"]}],"a":["https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0008"]},"CVE-2008-4128":{"p":[],"a":["https://www.exploit-db.com/exploits/6476","https://exchange.xforce.ibmcloud.com/vulnerabilities/45226","http://jbrownsec.blogspot.com/2008/09/cisco-0day-released.html"]},"CVE-2026-56291":{"p":[],"a":["https://www.balbooa.com/joomla-forms","https://mysites.guru/blog/balbooa-forms-unauthenticated-file-upload-flaw/"]},"CVE-2026-48939":{"p":[],"a":["https://www.icagenda.com/"]},"CVE-2026-48908":{"p":[],"a":["https://www.joomshaper.com/page-builder"]},"CVE-2026-55255":{"p":[],"a":["https://github.com/langflow-ai/langflow/security/advisories/GHSA-qrpv-q767-xqq2","https://github.com/langflow-ai/langflow/pull/12832","https://github.com/langflow-ai/langflow/commit/2c9f498d664a3c32698b57d7c5e752625291060e"]},"CVE-2026-56290":{"p":[],"a":["https://www.joomlack.fr/"]},"CVE-2026-48282":{"p":[{"p":"Adobe ColdFusion 2025","f":[],"u":["9"]},{"p":"Adobe ColdFusion 2023","f":[],"u":["20"]}],"a":["https://helpx.adobe.com/security/products/coldfusion/apsb26-68.html"]},"CVE-2026-45659":{"p":[{"p":"Microsoft Microsoft SharePoint Enterprise Server 2016","f":["16.0.5552.1002"],"u":[]},{"p":"Microsoft Microsoft SharePoint Server 2019","f":["16.0.10417.20128"],"u":[]},{"p":"Microsoft Microsoft SharePoint Server Subscription Edition","f":["16.0.19725.20280"],"u":[]}],"a":["https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45659"]},"CVE-2026-48558":{"p":[{"p":"SimpleHelp SimpleHelp","f":["5.5.16","6.0 RC2"],"u":[]}],"a":["https://simple-help.com/security/simplehelp-security-update-2026-05","https://simple-help.com/release-news"]},"CVE-2026-12569":{"p":[{"p":"PTC Windchill PDMLink","f":[],"u":["11.0 M030"]},{"p":"PTC FlexPLM","f":[],"u":["11.0 M030"]}],"a":["https://www.ptc.com/en/support/article/CS473270"]},"CVE-2026-20230":{"p":[],"a":["https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cucm-ssrf-cXPnHcW"]},"CVE-2025-67038":{"p":[{"p":"Lantronix EDS5000 series","f":[],"u":["2.1.0.0R3"]},{"p":"Lantronix G520 series","f":["2.6.0.4R6"],"u":[]},{"p":"Lantronix X300 series","f":["2.6.0.4R6"],"u":[]},{"p":"Lantronix E210 series","f":["3.21.0.0R1"],"u":[]}],"a":["https://www.lantronix.com/technical-support/security-updates/vulnerability-disclosure-policy/vulnerability-library/?_gl=16c8bez_upMQ.._gaMzQwNjk5ODI5LjE3ODI5MTM3NTk._ga_M2G6RLT5L3*czE3ODI5MTM3NTgkbzEkZzAkdDE3ODI5MTM3NTgkajYwJGwwJGgw","https://www.cisa.gov/news-events/ics-advisories/icsa-26-069-02","https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-069-02.json"]},"CVE-2026-34910":{"p":[{"p":"Ubiquiti Inc UniFi OS Server","f":["5.0.8"],"u":[]},{"p":"Ubiquiti Inc UDM","f":["5.1.12"],"u":[]},{"p":"Ubiquiti Inc UDM-Pro","f":["5.1.12"],"u":[]},{"p":"Ubiquiti Inc UDM-SE","f":["5.1.12"],"u":[]}],"a":["https://community.ui.com/releases/Security-Advisory-Bulletin-064-064/84811c09-4cf4-42ab-bd61-cc994445963b"]},"CVE-2026-34909":{"p":[{"p":"Ubiquiti Inc UniFi OS Server","f":["5.0.8"],"u":[]},{"p":"Ubiquiti Inc Express","f":["4.0.14"],"u":[]},{"p":"Ubiquiti Inc UDM","f":["5.1.12"],"u":[]},{"p":"Ubiquiti Inc UDM-Pro","f":["5.1.12"],"u":[]}],"a":["https://community.ui.com/releases/Security-Advisory-Bulletin-064-064/84811c09-4cf4-42ab-bd61-cc994445963b"]},"CVE-2026-34908":{"p":[{"p":"Ubiquiti Inc UniFi OS Server","f":["5.0.8"],"u":[]},{"p":"Ubiquiti Inc UDM","f":["5.1.12"],"u":[]},{"p":"Ubiquiti Inc UDM-Pro","f":["5.1.12"],"u":[]},{"p":"Ubiquiti Inc UDM-SE","f":["5.1.12"],"u":[]}],"a":["https://community.ui.com/releases/Security-Advisory-Bulletin-064-064/84811c09-4cf4-42ab-bd61-cc994445963b"]},"CVE-2026-20253":{"p":[{"p":"Splunk Splunk Enterprise","f":["10.2.4","10.0.7"],"u":[]}],"a":["https://advisory.splunk.com/advisories/SVD-2026-0603"]},"CVE-2026-48907":{"p":[],"a":["https://www.joomlacontenteditor.net/"]},"CVE-2026-54420":{"p":[{"p":"LiteSpeed Technologies cPanel Plugin","f":["2.4.8"],"u":[]}],"a":["https://www.litespeedtech.com/products/litespeed-web-server/control-panel-support/cpanel","https://blog.litespeedtech.com/2026/06/01/security-update-for-litespeed-cpanel-plugin-2/"]},"CVE-2026-20262":{"p":[],"a":["https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-arbfw-c2rZvQ"]},"CVE-2026-10520":{"p":[],"a":["https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Sentry-CVE-2026-10520-CVE-2026-10523?language=en_US"]},"CVE-2026-11645":{"p":[{"p":"Google Chrome","f":["149.0.7827.103"],"u":[]}],"a":["https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0153744567.html","https://issues.chromium.org/issues/506689381"]},"CVE-2026-7473":{"p":[{"p":"Arista Networks EOS","f":[],"u":["4.35","4.34","4.33"]}],"a":["https://www.arista.com/en/support/advisories-notices/security-advisory/22872-security-advisory-0137"]},"CVE-2026-20245":{"p":[],"a":["https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-privesc-4uxFrdzx","https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-rpa2-v69WY2SW"]},"CVE-2026-42271":{"p":[],"a":["https://github.com/BerriAI/litellm/security/advisories/GHSA-v4p8-mg3p-g94g","https://github.com/BerriAI/litellm/releases/tag/v1.83.7-stable"]},"CVE-2026-50751":{"p":[],"a":["https://support.checkpoint.com/results/sk/sk185033"]},"CVE-2026-28318":{"p":[],"a":["https://www.solarwinds.com/trust-center/security-advisories/CVE-2026-28318","https://documentation.solarwinds.com/en/success_center/servu/content/release_notes/servu_15-5-4-hotfix-1_release_notes.htm"]},"CVE-2026-45247":{"p":[{"p":"Mirasvit Full Page Cache Warmer for Magento 2","f":["1.11.12"],"u":[]}],"a":["https://mirasvit.com/package/changelog/?package=mirasvit/module-cache-warmer"]},"CVE-2022-0492":{"p":[],"a":["https://www.debian.org/security/2022/dsa-5095","https://www.debian.org/security/2022/dsa-5096"]},"CVE-2025-48595":{"p":[],"a":["https://source.android.com/docs/security/bulletin/2026/2026-06-01"]},"CVE-2024-21182":{"p":[],"a":["https://www.oracle.com/security-alerts/cpujul2024.html"]},"CVE-2026-0257":{"p":[{"p":"Palo Alto Networks PAN-OS","f":["12.1.7, 12.1.4-h6","12.1.7","12.1.4-h6","11.2.12, 11.2.10-h7, 11.2.7-h14, 11.2.4-h17","11.2.12"],"u":[]},{"p":"Palo Alto Networks Prisma Access","f":["10.2.10-h36","11.2.7-h13"],"u":[]}],"a":["https://security.paloaltonetworks.com/CVE-2026-0257"]},"CVE-2026-48027":{"p":[],"a":["https://github.com/nrwl/nx-console/security/advisories/GHSA-c9j4-9m59-847w","https://github.com/nrwl/nx-console/issues/3139","https://nx.dev/blog/nx-console-v18-95-0-postmortem#indicators-of-compromise"]},"CVE-2026-45321":{"p":[],"a":["https://github.com/TanStack/router/security/advisories/GHSA-g7cv-rxg3-hmpx","https://github.com/TanStack/router/issues/7383","https://tanstack.com/blog/npm-supply-chain-compromise-postmortem"]},"CVE-2026-8398":{"p":[{"p":"AVB Disc Soft DAEMON Tools Lite","f":["2.6.0.*"],"u":[]}],"a":["https://blog.daemon-tools.cc/post/security-incident"]},"CVE-2026-48172":{"p":[{"p":"LiteSpeed Technologies cPanel Plugin","f":["2.4.7"],"u":[]},{"p":"LiteSpeed Technologies WHM Plugin","f":["5.3.1.0"],"u":[]}],"a":["https://www.litespeedtech.com/products/litespeed-web-server/control-panel-support/cpanel","https://www.litespeedtech.com/products/litespeed-web-server/control-panel-support/release-log","https://blog.litespeedtech.com/2026/05/21/security-update-for-litespeed-cpanel-plugin/"]},"CVE-2026-9082":{"p":[{"p":"Drupal Drupal core","f":["10.4.10","10.5.10","10.6.9","11.1.10","11.2.12"],"u":[]}],"a":["https://www.drupal.org/sa-core-2026-004"]},"CVE-2025-34291":{"p":[{"p":"Langflow Langflow","f":[],"u":["1.6.9"]}],"a":["https://www.obsidiansecurity.com/blog/cve-2025-34291-critical-account-takeover-and-rce-vulnerability-in-the-langflow-ai-agent-workflow-platform","https://github.com/langflow-ai/langflow","https://www.vulncheck.com/advisories/langflow-cors-misconfiguration-to-token-hijack-and-rce"]},"CVE-2026-34926":{"p":[{"p":"Trend Micro, Inc. TrendAI Apex One","f":["14.0.0.17079"],"u":[]},{"p":"Trend Micro, Inc. TrendAI Apex One as a Service","f":["14.0.20731"],"u":[]}],"a":["https://success.trendmicro.com/en-US/solution/KA-0023430","https://success.trendmicro.com/ja-JP/solution/KA-0022974","https://jvn.jp/en/vu/JVNVU90583059/"]},"CVE-2008-4250":{"p":[],"a":["http://marc.info/?l=bugtraq&m=122703006921213&w=2","http://marc.info/?l=bugtraq&m=122703006921213&w=2","https://docs.microsoft.com/en-us/security-updates/securitybulletins/2008/ms08-067"]},"CVE-2017-0144":{"p":[],"a":["https://www.exploit-db.com/exploits/42031/","https://www.exploit-db.com/exploits/42030/","https://www.exploit-db.com/exploits/41891/"]},"CVE-2019-0708":{"p":[],"a":["https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0708","https://cert-portal.siemens.com/productcert/pdf/ssa-932041.pdf","https://cert-portal.siemens.com/productcert/pdf/ssa-616199.pdf"]},"CVE-2020-1472":{"p":[{"p":"Microsoft Windows Server version 2004","f":["publication"],"u":[]},{"p":"Microsoft Windows Server 2019","f":["publication"],"u":[]},{"p":"Microsoft Windows Server 2019 (Server Core installation)","f":["publication"],"u":[]},{"p":"Microsoft Windows Server, version 1909 (Server Core installation)","f":["publication"],"u":[]}],"a":["https://usn.ubuntu.com/4510-1/","https://usn.ubuntu.com/4510-2/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/H4OTFBL6YDVFH2TBJFJIE4FMHPJEEJK3/"]},"CVE-2021-34527":{"p":[{"p":"Microsoft Windows 10 Version 1507","f":["10.0.10240.18969"],"u":[]},{"p":"Microsoft Windows 10 Version 1607","f":["10.0.14393.4470"],"u":[]},{"p":"Microsoft Windows 10 Version 1809","f":["10.0.17763.2029"],"u":[]},{"p":"Microsoft Windows 10 Version 1809","f":["10.0.17763.2029"],"u":[]}],"a":["https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-34527"]},"CVE-2021-1675":{"p":[{"p":"Microsoft Windows 10 Version 1809","f":["10.0.17763.1999"],"u":[]},{"p":"Microsoft Windows Server 2019","f":["10.0.17763.1999"],"u":[]},{"p":"Microsoft Windows Server 2019 (Server Core installation)","f":["10.0.17763.1999"],"u":[]},{"p":"Microsoft Windows 10 Version 1909","f":["10.0.18363.1621"],"u":[]}],"a":["https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-1675","https://www.kb.cert.org/vuls/id/383432","http://packetstormsecurity.com/files/163349/Microsoft-PrintNightmare-Proof-Of-Concept.html"]},"CVE-2021-36934":{"p":[{"p":"Microsoft Windows 10 Version 1809","f":["10.0.17763.2114"],"u":[]},{"p":"Microsoft Windows 10 Version 1809","f":["10.0.17763.2114"],"u":[]},{"p":"Microsoft Windows 10 Version 1909","f":["10.0.18363.1734"],"u":[]},{"p":"Microsoft Windows 10 Version 2004","f":["10.0.19041.1165"],"u":[]}],"a":["https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-36934"]},"CVE-2021-36942":{"p":[{"p":"Microsoft Windows Server 2008 R2 Service Pack 1","f":["6.1.7601.25685"],"u":[]},{"p":"Microsoft Windows Server 2008 R2 Service Pack 1 (Server Core installation)","f":["6.1.7601.25685"],"u":[]},{"p":"Microsoft Windows Server 2008 Service Pack 2","f":["6.0.6003.21192"],"u":[]},{"p":"Microsoft Windows Server 2008 Service Pack 2 (Server Core installation)","f":["6.0.6003.21192"],"u":[]}],"a":["https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-36942"]},"CVE-2021-42278":{"p":[{"p":"Microsoft Windows Server 2008 R2 Service Pack 1","f":["6.1.7601.25769"],"u":[]},{"p":"Microsoft Windows Server 2008 R2 Service Pack 1 (Server Core installation)","f":["6.1.7601.25769"],"u":[]},{"p":"Microsoft Windows Server 2008 Service Pack 2","f":["6.0.6003.21282"],"u":[]},{"p":"Microsoft Windows Server 2008 Service Pack 2 (Server Core installation)","f":["6.0.6003.21282"],"u":[]}],"a":["https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-42278"]},"CVE-2021-42287":{"p":[{"p":"Microsoft Windows Server 2008 R2 Service Pack 1","f":["6.1.7601.25769"],"u":[]},{"p":"Microsoft Windows Server 2008 R2 Service Pack 1 (Server Core installation)","f":["6.1.7601.25769"],"u":[]},{"p":"Microsoft Windows Server 2008 Service Pack 2","f":["6.0.6003.21282"],"u":[]},{"p":"Microsoft Windows Server 2008 Service Pack 2 (Server Core installation)","f":["6.0.6003.21282"],"u":[]}],"a":["https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-42287"]},"CVE-2022-26923":{"p":[{"p":"Microsoft Windows 10 Version 1809","f":["10.0.17763.4252"],"u":[]},{"p":"Microsoft Windows 10 Version 1809","f":["10.0.17763.4252"],"u":[]},{"p":"Microsoft Windows Server 2019","f":["10.0.17763.4252"],"u":[]},{"p":"Microsoft Windows Server 2019 (Server Core installation)","f":["10.0.17763.4252"],"u":[]}],"a":["https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-26923"]},"CVE-2020-0796":{"p":[],"a":["https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0796","http://packetstormsecurity.com/files/156731/CoronaBlue-SMBGhost-Microsoft-Windows-10-SMB-3.1.1-Proof-Of-Concept.html","http://packetstormsecurity.com/files/156732/Microsoft-Windows-SMB-3.1.1-Remote-Code-Execution.html"]},"CVE-2020-1350":{"p":[],"a":["https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1350","http://packetstormsecurity.com/files/158484/SIGRed-Windows-DNS-Denial-Of-Service.html"]},"CVE-2020-0601":{"p":[],"a":["https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0601","http://packetstormsecurity.com/files/155961/CurveBall-Microsoft-Windows-CryptoAPI-Spoofing-Proof-Of-Concept.html","http://packetstormsecurity.com/files/155960/CurveBall-Microsoft-Windows-CryptoAPI-Spoofing-Proof-Of-Concept.html"]},"CVE-2016-5195":{"p":[],"a":["http://rhn.redhat.com/errata/RHSA-2016-2107.html","https://access.redhat.com/errata/RHSA-2017:0372","http://rhn.redhat.com/errata/RHSA-2016-2118.html"]},"CVE-2022-0847":{"p":[],"a":["https://bugzilla.redhat.com/show_bug.cgi?id=2060795","https://dirtypipe.cm4all.com/","http://packetstormsecurity.com/files/166230/Dirty-Pipe-SUID-Binary-Hijack-Privilege-Escalation.html"]},"CVE-2021-4034":{"p":[],"a":["https://access.redhat.com/security/vulnerabilities/RHSB-2022-001","https://www.qualys.com/2022/01/25/cve-2021-4034/pwnkit.txt","https://bugzilla.redhat.com/show_bug.cgi?id=2025869"]},"CVE-2021-3156":{"p":[],"a":["https://security.gentoo.org/glsa/202101-33","https://www.debian.org/security/2021/dsa-4839","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LHXK6ICO5AYLGFK2TAX5MZKUXTUKWOJY/"]},"CVE-2023-4911":{"p":[{"p":"","f":["2.39"],"u":[]}],"a":["https://access.redhat.com/errata/RHSA-2023:5453","https://access.redhat.com/errata/RHSA-2023:5454","https://access.redhat.com/errata/RHSA-2023:5455"]},"CVE-2024-6387":{"p":[{"p":"","f":[],"u":["9.7p1"]}],"a":["https://access.redhat.com/errata/RHSA-2024:4312","https://access.redhat.com/errata/RHSA-2024:4340","https://access.redhat.com/errata/RHSA-2024:4389"]},"CVE-2024-3094":{"p":[],"a":["https://access.redhat.com/security/cve/CVE-2024-3094","https://bugzilla.redhat.com/show_bug.cgi?id=2272210","https://www.openwall.com/lists/oss-security/2024/03/29/4"]},"CVE-2021-44228":{"p":[{"p":"Apache Software Foundation Apache Log4j2","f":["log4j-core*","2.3.1","2.12.2","2.15.0"],"u":[]}],"a":["https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-log4j-qRuKNEbd","https://www.debian.org/security/2021/dsa-5020","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VU57UJDCFIASIO35GC55JMKSRXJMCDFM/"]},"CVE-2017-5638":{"p":[],"a":["https://nmap.org/nsedoc/scripts/http-vuln-cve2017-5638.html","http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2017-002.txt","https://arstechnica.com/security/2017/03/critical-vulnerability-under-massive-attack-imperils-high-impact-sites/"]},"CVE-2022-22965":{"p":[],"a":["https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-java-spring-rce-Zx9GUc67"]},"CVE-2020-1938":{"p":[],"a":["http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00025.html","https://security.gentoo.org/glsa/202003-43","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2XFLQB3O5QVP4ZBIPVIXBEZV7F2R7ZMS/"]},"CVE-2022-26134":{"p":[{"p":"Atlassian Confluence Data Center","f":["unspecified","7.4.17","7.13.7","7.14.3","7.15.2"],"u":[]},{"p":"Atlassian Confluence Server","f":["unspecified","7.4.17","7.13.7","7.14.3","7.15.2"],"u":[]}],"a":["https://jira.atlassian.com/browse/CONFSERVER-79016","http://packetstormsecurity.com/files/167432/Confluence-OGNL-Injection-Proof-Of-Concept.html","http://packetstormsecurity.com/files/167430/Confluence-OGNL-Injection-Remote-Code-Execution.html"]},"CVE-2023-34362":{"p":[],"a":["https://community.progress.com/s/article/MOVEit-Transfer-Critical-Vulnerability-31May2023","http://packetstormsecurity.com/files/172883/MOVEit-Transfer-SQL-Injection-Remote-Code-Execution.html","http://packetstormsecurity.com/files/173110/MOVEit-SQL-Injection.html"]},"CVE-2021-30116":{"p":[],"a":["https://csirt.divd.nl/2021/07/04/Kaseya-Case-Update-2/","https://helpdesk.kaseya.com/hc/en-gb/articles/4403440684689-Important-Notice-July-2nd-2021","https://csirt.divd.nl/2021/07/07/Kaseya-Limited-Disclosure/"]},"CVE-2024-1709":{"p":[{"p":"ConnectWise ScreenConnect","f":["23.9.8"],"u":["23.9.7"]}],"a":["https://www.connectwise.com/company/trust/security-bulletins/connectwise-screenconnect-23.9.8","https://www.huntress.com/blog/vulnerability-reproduced-immediately-patch-screenconnect-23-9-8","https://www.huntress.com/blog/detection-guidance-for-connectwise-cwe-288-2"]},"CVE-2024-1708":{"p":[{"p":"ConnectWise ScreenConnect","f":["23.9.8"],"u":["23.9.7 "]}],"a":["https://www.connectwise.com/company/trust/security-bulletins/connectwise-screenconnect-23.9.8","https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass"]},"CVE-2024-23897":{"p":[],"a":["https://www.jenkins.io/security/advisory/2024-01-24/#SECURITY-3314"]},"CVE-2021-26855":{"p":[{"p":"Microsoft Microsoft Exchange Server 2013 Cumulative Update 21","f":["15.00.1395.012"],"u":[]},{"p":"Microsoft Microsoft Exchange Server 2013 Cumulative Update 22","f":["15.00.1473.006"],"u":[]},{"p":"Microsoft Microsoft Exchange Server 2013 Cumulative Update 23","f":["15.00.1497.012"],"u":[]},{"p":"Microsoft Microsoft Exchange Server 2016 Cumulative Update 10","f":["15.01.1531.012"],"u":[]}],"a":["https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-26855"]},"CVE-2021-27065":{"p":[{"p":"Microsoft Microsoft Exchange Server 2013 Cumulative Update 21","f":["15.00.1395.012"],"u":[]},{"p":"Microsoft Microsoft Exchange Server 2013 Cumulative Update 22","f":["15.00.1473.006"],"u":[]},{"p":"Microsoft Microsoft Exchange Server 2013 Cumulative Update 23","f":["15.00.1497.012"],"u":[]},{"p":"Microsoft Microsoft Exchange Server 2013 Service Pack 1","f":["15.00.0847.064"],"u":[]}],"a":["https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-27065"]},"CVE-2021-34473":{"p":[{"p":"Microsoft Microsoft Exchange Server 2013 Cumulative Update 23","f":["15.00.1497.015"],"u":[]},{"p":"Microsoft Microsoft Exchange Server 2016 Cumulative Update 19","f":["15.01.2176.012"],"u":[]},{"p":"Microsoft Microsoft Exchange Server 2016 Cumulative Update 20","f":["15.01.2242.008"],"u":[]},{"p":"Microsoft Microsoft Exchange Server 2019 Cumulative Update 8","f":["15.02.0792.013"],"u":[]}],"a":["https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-34473"]},"CVE-2021-34523":{"p":[{"p":"Microsoft Microsoft Exchange Server 2013 Cumulative Update 23","f":["15.00.1497.015"],"u":[]},{"p":"Microsoft Microsoft Exchange Server 2016 Cumulative Update 19","f":["15.01.2176.012"],"u":[]},{"p":"Microsoft Microsoft Exchange Server 2016 Cumulative Update 20","f":["15.01.2242.008"],"u":[]},{"p":"Microsoft Microsoft Exchange Server 2019 Cumulative Update 8","f":["15.02.0792.013"],"u":[]}],"a":["https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-34523"]},"CVE-2021-31207":{"p":[{"p":"Microsoft Microsoft Exchange Server 2013 Cumulative Update 23","f":["15.00.1497.018"],"u":[]},{"p":"Microsoft Microsoft Exchange Server 2019 Cumulative Update 9","f":["15.02.0858.012"],"u":[]},{"p":"Microsoft Microsoft Exchange Server 2016 Cumulative Update 20","f":["15.01.2242.010"],"u":[]},{"p":"Microsoft Microsoft Exchange Server 2016 Cumulative Update 19","f":["15.01.2176.014"],"u":[]}],"a":["https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-31207","https://www.zerodayinitiative.com/advisories/ZDI-21-819/","http://packetstormsecurity.com/files/163895/Microsoft-Exchange-ProxyShell-Remote-Code-Execution.html"]},"CVE-2022-41040":{"p":[{"p":"Microsoft Microsoft Exchange Server 2013 Cumulative Update 23","f":["15.00.1497.044"],"u":[]},{"p":"Microsoft Microsoft Exchange Server 2016 Cumulative Update 22","f":["15.01.2375.037"],"u":[]},{"p":"Microsoft Microsoft Exchange Server 2019 Cumulative Update 11","f":["15.02.0986.036"],"u":[]},{"p":"Microsoft Microsoft Exchange Server 2019 Cumulative Update 12","f":["15.02.1118.020"],"u":[]}],"a":["https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-41040"]},"CVE-2022-41082":{"p":[{"p":"Microsoft Microsoft Exchange Server 2013 Cumulative Update 23","f":["15.00.1497.044"],"u":[]},{"p":"Microsoft Microsoft Exchange Server 2016 Cumulative Update 22","f":["15.01.2375.037"],"u":[]},{"p":"Microsoft Microsoft Exchange Server 2019 Cumulative Update 11","f":["15.02.0986.036"],"u":[]},{"p":"Microsoft Microsoft Exchange Server 2019 Cumulative Update 12","f":["15.02.1118.020"],"u":[]}],"a":["https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-41082"]},"CVE-2023-23397":{"p":[{"p":"Microsoft Microsoft Office LTSC 2021","f":["https://aka.ms/OfficeSecurityReleases"],"u":[]},{"p":"Microsoft Microsoft Outlook 2016","f":["16.0.5387.1000"],"u":[]},{"p":"Microsoft Microsoft 365 Apps for Enterprise","f":["https://aka.ms/OfficeSecurityReleases"],"u":[]},{"p":"Microsoft Microsoft Office 2019","f":["https://aka.ms/OfficeSecurityReleases"],"u":[]}],"a":["https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-23397"]},"CVE-2023-2868":{"p":[{"p":"Barracuda Barracuda Email Security Gateway","f":["9.2.0.006"],"u":[]}],"a":["https://www.barracuda.com/company/legal/esg-vulnerability","https://status.barracuda.com/incidents/34kx82j5n4q9"]},"CVE-2019-19781":{"p":[],"a":["https://support.citrix.com/article/CTX267027","https://www.kb.cert.org/vuls/id/619785","https://twitter.com/bad_packets/status/1215431625766424576"]},"CVE-2023-4966":{"p":[{"p":"Citrix NetScaler ADC","f":["8.50","49.15","92.19","37.164","55.300"],"u":[]},{"p":"Citrix NetScaler Gateway","f":["8.50","49.15","92.19"],"u":[]}],"a":["https://support.citrix.com/article/CTX579459","http://packetstormsecurity.com/files/175323/Citrix-Bleed-Session-Token-Leakage-Proof-Of-Concept.html"]},"CVE-2018-13379":{"p":[],"a":["https://fortiguard.com/advisory/FG-IR-18-384","https://www.fortiguard.com/psirt/FG-IR-20-233"]},"CVE-2022-40684":{"p":[],"a":["https://fortiguard.com/psirt/FG-IR-22-377","http://packetstormsecurity.com/files/169431/Fortinet-FortiOS-FortiProxy-FortiSwitchManager-Authentication-Bypass.html","http://packetstormsecurity.com/files/171515/Fortinet-7.2.1-Authentication-Bypass.html"]},"CVE-2023-46805":{"p":[{"p":"Ivanti ICS","f":[],"u":["9.1R18","22.6R2"]},{"p":"Ivanti IPS","f":[],"u":["9.1R18","22.6R1"]}],"a":["https://forums.ivanti.com/s/article/CVE-2023-46805-Authentication-Bypass-CVE-2024-21887-Command-Injection-for-Ivanti-Connect-Secure-and-Ivanti-Policy-Secure-Gateways?language=en_US","http://packetstormsecurity.com/files/176668/Ivanti-Connect-Secure-Unauthenticated-Remote-Code-Execution.html"]},"CVE-2024-21887":{"p":[{"p":"Ivanti ICS","f":[],"u":["9.1R18","22.6R2"]},{"p":"Ivanti IPS","f":[],"u":["9.1R18","22.6R1"]}],"a":["https://forums.ivanti.com/s/article/CVE-2023-46805-Authentication-Bypass-CVE-2024-21887-Command-Injection-for-Ivanti-Connect-Secure-and-Ivanti-Policy-Secure-Gateways?language=en_US","http://packetstormsecurity.com/files/176668/Ivanti-Connect-Secure-Unauthenticated-Remote-Code-Execution.html"]},"CVE-2024-3400":{"p":[{"p":"Palo Alto Networks PAN-OS","f":["10.2.9-h1","11.0.4-h1","11.1.2-h3"],"u":[]}],"a":["https://security.paloaltonetworks.com/CVE-2024-3400"]},"CVE-2020-5902":{"p":[],"a":["https://support.f5.com/csp/article/K52145254","http://packetstormsecurity.com/files/158333/BIG-IP-TMUI-Remote-Code-Execution.html","http://packetstormsecurity.com/files/158334/BIG-IP-TMUI-Remote-Code-Execution.html"]},"CVE-2022-1388":{"p":[{"p":"F5 BIG-IP","f":["16.1.2.2","15.1.5.1","14.1.4.6","13.1.5"],"u":["12.1.6","11.6.5"]}],"a":["https://support.f5.com/csp/article/K23605346","http://packetstormsecurity.com/files/167007/F5-BIG-IP-Remote-Code-Execution.html","http://packetstormsecurity.com/files/167118/F5-BIG-IP-16.0.x-Remote-Code-Execution.html"]},"CVE-2023-20198":{"p":[],"a":["https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe-webui-privesc-j22SaA4z"]},"CVE-2021-21974":{"p":[],"a":["https://www.vmware.com/security/advisories/VMSA-2021-0002.html","https://www.zerodayinitiative.com/advisories/ZDI-21-250/","http://packetstormsecurity.com/files/162957/VMware-ESXi-OpenSLP-Heap-Overflow.html"]},"CVE-2021-21972":{"p":[],"a":["https://www.vmware.com/security/advisories/VMSA-2021-0002.html","http://packetstormsecurity.com/files/161590/VMware-vCenter-Server-7.0-Arbitrary-File-Upload.html","http://packetstormsecurity.com/files/161695/VMware-vCenter-Server-File-Upload-Remote-Code-Execution.html"]},"CVE-2017-11882":{"p":[],"a":["https://github.com/embedi/CVE-2017-11882","https://github.com/unamer/CVE-2017-11882","http://reversingminds-blog.logdown.com/posts/3907313-fileless-attack-in-word-without-macros-cve-2017-11882"]},"CVE-2022-30190":{"p":[{"p":"Microsoft Windows 10 Version 1809","f":["10.0.17763.3046"],"u":[]},{"p":"Microsoft Windows 10 Version 1809","f":["10.0.17763.3046"],"u":[]},{"p":"Microsoft Windows Server 2019","f":["10.0.17763.3046"],"u":[]},{"p":"Microsoft Windows Server 2019 (Server Core installation)","f":["10.0.17763.3046"],"u":[]}],"a":["https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-30190"]},"CVE-2023-38831":{"p":[],"a":["https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/","https://www.bleepingcomputer.com/news/security/winrar-zero-day-exploited-since-april-to-hack-trading-accounts/","https://news.ycombinator.com/item?id=37236100"]},"CVE-2021-30860":{"p":[{"p":"Apple macOS","f":["11.6"],"u":[]},{"p":"Apple macOS","f":["2021-005"],"u":[]},{"p":"Apple watchOS","f":["7.6"],"u":[]},{"p":"Apple iOS","f":["14.8"],"u":[]}],"a":["https://security.gentoo.org/glsa/202209-21"]},"CVE-2023-4863":{"p":[{"p":"Google Chrome","f":["116.0.5845.187"],"u":[]},{"p":"Google libwebp","f":["1.3.2"],"u":[]}],"a":["https://chromereleases.googleblog.com/2023/09/stable-channel-update-for-desktop_11.html","https://crbug.com/1479274","https://en.bandisoft.com/honeyview/history/"]},"CVE-2023-41064":{"p":[{"p":"Apple macOS","f":["12.6"],"u":[]},{"p":"Apple macOS","f":["11.7"],"u":[]},{"p":"Apple iOS and iPadOS","f":["16.6"],"u":[]},{"p":"Apple iOS and iPadOS","f":["15.7"],"u":[]}],"a":["https://support.apple.com/en-us/HT213914","https://support.apple.com/en-us/HT213915","https://support.apple.com/en-us/HT213905"]},"CVE-2017-5754":{"p":[],"a":["https://usn.ubuntu.com/3523-1/","https://usn.ubuntu.com/usn/usn-3525-1/","https://security.gentoo.org/glsa/201810-06"]},"CVE-2017-5753":{"p":[],"a":["https://www.debian.org/security/2018/dsa-4187","https://usn.ubuntu.com/3542-2/","https://security.gentoo.org/glsa/201810-06"]},"CVE-2017-5715":{"p":[],"a":["https://usn.ubuntu.com/3560-1/","https://www.debian.org/security/2018/dsa-4187","https://usn.ubuntu.com/3542-2/"]},"CVE-2017-13077":{"p":[],"a":["http://www.debian.org/security/2017/dsa-3999","https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20171016-wpa","https://access.redhat.com/errata/RHSA-2017:2911"]},"CVE-2025-53770":{"p":[{"p":"Microsoft Microsoft SharePoint Enterprise Server 2016","f":["16.0.5513.1001"],"u":[]},{"p":"Microsoft Microsoft SharePoint Server 2019","f":["16.0.10417.20037"],"u":[]},{"p":"Microsoft Microsoft SharePoint Server Subscription Edition","f":["16.0.18526.20508"],"u":[]}],"a":["https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-53770"]},"CVE-2025-5777":{"p":[{"p":"NetScaler ADC","f":["43.56","58.32"],"u":[]},{"p":"NetScaler Gateway","f":["43.56","58.32"],"u":[]}],"a":["https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX693420"]},"CVE-2025-31324":{"p":[],"a":["https://me.sap.com/notes/3594142","https://url.sap/sapsecuritypatchday"]},"CVE-2025-1974":{"p":[{"p":"kubernetes ingress-nginx","f":[],"u":["1.11.4"]}],"a":["https://https://github.com/kubernetes/kubernetes/issues/131009"]},"CVE-2025-0282":{"p":[{"p":"Ivanti Connect Secure","f":[],"u":["22.7R2.4"]},{"p":"Ivanti Policy Secure","f":[],"u":["22.7R1.2"]},{"p":"Ivanti Neurons for ZTA gateways","f":[],"u":["22.7R2.3"]}],"a":["https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-Policy-Secure-ZTA-Gateways-CVE-2025-0282-CVE-2025-0283"]},"CVE-2025-29824":{"p":[{"p":"Microsoft Windows 10 Version 1507","f":["10.0.10240.20978"],"u":[]},{"p":"Microsoft Windows 10 Version 1607","f":["10.0.14393.7969"],"u":[]},{"p":"Microsoft Windows 10 Version 1809","f":["10.0.17763.7136"],"u":[]},{"p":"Microsoft Windows 10 Version 21H2","f":["10.0.19044.5737"],"u":[]}],"a":["https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-29824"]},"CVE-2025-32433":{"p":[],"a":["https://github.com/erlang/otp/security/advisories/GHSA-37cp-fgq5-7wc2","https://github.com/erlang/otp/commit/0fcd9c56524b28615e8ece65fc0c3f66ef6e4c12","https://github.com/erlang/otp/commit/6eef04130afc8b0ccb63c9a0d8650209cf54892f"]},"CVE-2009-1537":{"p":[],"a":["https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-028"]},"CVE-2009-3459":{"p":[],"a":["http://secunia.com/advisories/36983","https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6534","http://www.us-cert.gov/cas/techalerts/TA09-286B.html"]},"CVE-2010-0249":{"p":[],"a":["http://support.microsoft.com/kb/979352","https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-002"]},"CVE-2010-0806":{"p":[],"a":["https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-018"]},"CVE-2026-41091":{"p":[{"p":"Microsoft Microsoft Malware Protection Engine","f":["1.1.26040.8"],"u":[]}],"a":["https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-41091"]},"CVE-2026-45498":{"p":[{"p":"Microsoft Microsoft Defender Antimalware Platform","f":["4.18.26040.7"],"u":[]}],"a":["https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45498"]},"CVE-2026-42897":{"p":[{"p":"Microsoft Microsoft Exchange Server 2016 Cumulative Update 23","f":["15.01.2507.069"],"u":[]},{"p":"Microsoft Microsoft Exchange Server 2019 Cumulative Update 14","f":["15.02.1544.041"],"u":[]},{"p":"Microsoft Microsoft Exchange Server 2019 Cumulative Update 15","f":["15.02.1748.046"],"u":[]},{"p":"Microsoft Microsoft Exchange Server Subscription Edition RTM","f":["15.02.2562.043"],"u":[]}],"a":["https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42897"]},"CVE-2026-20182":{"p":[],"a":["https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-rpa2-v69WY2SW","https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-rpa-EHchtZk"]},"CVE-2026-42208":{"p":[],"a":["https://github.com/BerriAI/litellm/security/advisories/GHSA-r75f-5x8p-qvmc","https://github.com/BerriAI/litellm/releases/tag/v1.83.7-stable"]},"CVE-2026-6973":{"p":[],"a":["https://hub.ivanti.com/s/article/May-2026-Security-Advisory-Ivanti-Endpoint-Manager-Mobile-EPMM-Multiple-CVEs"]},"CVE-2026-0300":{"p":[{"p":"Palo Alto Networks PAN-OS","f":["12.1.7","12.1.4-h5","11.2.12","11.2.10-h6","11.2.7-h13"],"u":[]}],"a":["https://security.paloaltonetworks.com/CVE-2026-0300"]},"CVE-2026-41940":{"p":[{"p":"WebPros cPanel","f":["11.86.0.41","11.94.0.28","11.102.0.39","11.110.0.97","11.118.0.63"],"u":[]},{"p":"WebPros WHM","f":["11.86.0.41","11.94.0.28","11.102.0.39","11.110.0.97","11.118.0.63"],"u":[]}],"a":["https://support.cpanel.net/hc/en-us/articles/40073787579671-cPanel-WHM-Security-Update-04-28-2026","https://docs.cpanel.net/release-notes/release-notes","https://docs.wpsquared.com/changelogs/versions/changelog/#13617"]},"CVE-2026-32202":{"p":[{"p":"Microsoft Windows 10 Version 1607","f":["10.0.14393.9339"],"u":[]},{"p":"Microsoft Windows 10 Version 1809","f":["10.0.17763.9020"],"u":[]},{"p":"Microsoft Windows 10 Version 21H2","f":["10.0.19044.7548"],"u":[]},{"p":"Microsoft Windows 10 Version 22H2","f":["10.0.19045.7548"],"u":[]}],"a":["https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32202"]},"CVE-2025-29635":{"p":[],"a":["https://github.com/mono7s/Dir-823x/blob/main/set_prohibiting/set_prohibiting.md"]},"CVE-2024-7399":{"p":[{"p":"Samsung Electronics MagicINFO 9 Server","f":["21.1050"],"u":[]}],"a":["https://security.samsungtv.com/securityUpdates"]},"CVE-2024-57728":{"p":[],"a":["https://www.horizon3.ai/attack-research/disclosures/critical-vulnerabilities-in-simplehelp-remote-support-software/","https://simple-help.com/kb---security-vulnerabilities-01-2025#security-vulnerabilities-in-simplehelp-5-5-7-and-earlier"]},"CVE-2024-57726":{"p":[],"a":["https://www.horizon3.ai/attack-research/disclosures/critical-vulnerabilities-in-simplehelp-remote-support-software/","https://simple-help.com/kb---security-vulnerabilities-01-2025#security-vulnerabilities-in-simplehelp-5-5-7-and-earlier"]},"CVE-2026-39987":{"p":[],"a":["https://github.com/marimo-team/marimo/security/advisories/GHSA-2679-6mx9-h9xc","https://github.com/marimo-team/marimo/pull/9098","https://github.com/marimo-team/marimo/commit/c24d4806398f30be6b12acd6c60d1d7c68cfd12a"]},"CVE-2026-33825":{"p":[{"p":"Microsoft Microsoft Defender Antimalware Platform","f":["4.18.26030.3011"],"u":[]}],"a":["https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33825"]},"CVE-2026-20122":{"p":[],"a":["https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-authbp-qwCX8D4v"]},"CVE-2026-20133":{"p":[],"a":["https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-authbp-qwCX8D4v"]},"CVE-2025-2749":{"p":[{"p":"Kentico Xperience","f":[],"u":["13.0.178"]}],"a":["https://devnet.kentico.com/download/hotfixes"]},"CVE-2023-27351":{"p":[],"a":["https://www.papercut.com/kb/Main/PO-1216-and-PO-1219","https://www.zerodayinitiative.com/advisories/ZDI-23-232/"]},"CVE-2025-48700":{"p":[],"a":["https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories","https://wiki.zimbra.com/wiki/Security_Center","https://wiki.zimbra.com/wiki/Zimbra_Responsible_Disclosure_Policy"]},"CVE-2026-20128":{"p":[],"a":["https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-authbp-qwCX8D4v"]},"CVE-2025-32975":{"p":[],"a":["https://support.quest.com/kb/4379499/quest-response-to-kace-sma-vulnerabilities-cve-2025-32975-cve-2025-32976-cve-2025-32977-cve-2025-32978","https://seclists.org/fulldisclosure/2025/Jun/22","https://seralys.com/research/CVE-2025-32975.txt"]},"CVE-2024-27199":{"p":[{"p":"JetBrains TeamCity","f":["2023.11.4"],"u":[]}],"a":["https://www.jetbrains.com/privacy-security/issues-fixed/","https://www.darkreading.com/cyberattacks-data-breaches/jetbrains-teamcity-mass-exploitation-underway-rogue-accounts-thrive"]},"CVE-2009-0238":{"p":[],"a":["https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-009"]},"CVE-2026-32201":{"p":[{"p":"Microsoft Microsoft SharePoint Enterprise Server 2016","f":["16.0.5548.1003"],"u":[]},{"p":"Microsoft Microsoft SharePoint Server 2019","f":["16.0.10417.20114"],"u":[]},{"p":"Microsoft Microsoft SharePoint Server Subscription Edition","f":["16.0.19725.20210"],"u":[]}],"a":["https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32201"]},"CVE-2012-1854":{"p":[],"a":["https://docs.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-046"]},"CVE-2025-60710":{"p":[{"p":"Microsoft Windows 11 Version 24H2","f":["10.0.26100.7462"],"u":[]},{"p":"Microsoft Windows 11 Version 25H2","f":["10.0.26200.7462"],"u":[]},{"p":"Microsoft Windows Server 2025","f":["10.0.26100.7462"],"u":[]},{"p":"Microsoft Windows Server 2025 (Server Core installation)","f":["10.0.26100.7462"],"u":[]}],"a":["https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-60710"]},"CVE-2023-21529":{"p":[{"p":"Microsoft Microsoft Exchange Server 2013 Cumulative Update 23","f":["15.00.1497.047"],"u":[]},{"p":"Microsoft Microsoft Exchange Server 2016 Cumulative Update 23","f":["15.01.2507.021"],"u":[]},{"p":"Microsoft Microsoft Exchange Server 2019 Cumulative Update 11","f":["15.02.0986.041"],"u":[]},{"p":"Microsoft Microsoft Exchange Server 2019 Cumulative Update 12","f":["15.02.1118.025"],"u":[]}],"a":["https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21529"]},"CVE-2023-36424":{"p":[{"p":"Microsoft Windows 11 version 22H3","f":["10.0.22631.2715"],"u":[]},{"p":"Microsoft Windows Server 2022, 23H2 Edition (Server Core installation)","f":["10.0.25398.531"],"u":[]},{"p":"Microsoft Windows 11 Version 23H2","f":["10.0.22631.2715"],"u":[]},{"p":"Microsoft Windows 10 Version 1809","f":["10.0.17763.5122"],"u":[]}],"a":["https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36424"]},"CVE-2020-9715":{"p":[],"a":["https://www.zerodayinitiative.com/advisories/ZDI-20-991/","https://helpx.adobe.com/security/products/acrobat/apsb20-48.html","https://blog.exodusintel.com/2021/04/20/analysis-of-a-use-after-free-vulnerability-in-adobe-acrobat-reader-dc/"]},"CVE-2026-21643":{"p":[],"a":["https://fortiguard.fortinet.com/psirt/FG-IR-25-1142"]},"CVE-2026-34621":{"p":[{"p":"Adobe Acrobat DC","f":[],"u":["26.001.21367"]},{"p":"Adobe Acrobat Reader DC","f":[],"u":["26.001.21367"]},{"p":"Adobe Acrobat 2024","f":[],"u":["24.001.30356"]}],"a":["https://helpx.adobe.com/security/products/acrobat/apsb26-43.html"]},"CVE-2026-1340":{"p":[],"a":["https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Endpoint-Manager-Mobile-EPMM-CVE-2026-1281-CVE-2026-1340"]},"CVE-2026-3502":{"p":[],"a":["https://trueconf.com/blog/update/trueconf-8-5"]},"CVE-2026-5281":{"p":[{"p":"Google Chrome","f":["146.0.7680.178"],"u":[]}],"a":["https://chromereleases.googleblog.com/2026/03/stable-channel-update-for-desktop_31.html","https://issues.chromium.org/issues/491518608"]},"CVE-2026-3055":{"p":[{"p":"NetScaler ADC","f":["66.59","62.23","37.262"],"u":[]},{"p":"NetScaler Gateway","f":["66.59","62.23"],"u":[]}],"a":["https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX696300"]},"CVE-2025-53521":{"p":[{"p":"F5 BIG-IP","f":["17.5.1.3","17.1.3","16.1.6.1","15.1.10.8"],"u":[]}],"a":["https://my.f5.com/manage/s/article/K000156741"]},"CVE-2026-33634":{"p":[],"a":["https://github.com/aquasecurity/trivy/security/advisories/GHSA-69fq-xp46-6x23","https://github.com/team-telnyx/telnyx-python/security/advisories/GHSA-955r-262c-33jc","https://github.com/BerriAI/litellm/issues/24518"]},"CVE-2026-33017":{"p":[],"a":["https://github.com/langflow-ai/langflow/security/advisories/GHSA-vwmf-pq79-vjvx","https://github.com/langflow-ai/langflow/commit/73b6612e3ef25fdae0a752d75b0fabd47328d4f0"]},"CVE-2025-32432":{"p":[],"a":["https://github.com/craftcms/cms/security/advisories/GHSA-f3gw-9ww9-jmc3","https://github.com/craftcms/cms/commit/e1c85441fa47eeb7c688c2053f25419bc0547b47","https://github.com/craftcms/cms/blob/3.x/CHANGELOG.md#3915---2025-04-10-critical"]},"CVE-2025-54068":{"p":[],"a":["https://github.com/livewire/livewire/security/advisories/GHSA-29cq-5w36-x7w3","https://github.com/livewire/livewire/commit/ef04be759da41b14d2d129e670533180a44987dc","https://github.com/livewire/livewire/releases/tag/v3.6.4"]},"CVE-2025-43510":{"p":[{"p":"Apple iOS and iPadOS","f":["18.7.2","26.1"],"u":[]},{"p":"Apple macOS","f":["14.8.2","15.7.2","26.1"],"u":[]},{"p":"Apple tvOS","f":["26.1"],"u":[]},{"p":"Apple visionOS","f":["26.1"],"u":[]}],"a":["https://support.apple.com/en-us/125632","https://support.apple.com/en-us/125633","https://support.apple.com/en-us/125634"]},"CVE-2025-43520":{"p":[{"p":"Apple iOS and iPadOS","f":["18.7.2","26.1"],"u":[]},{"p":"Apple macOS","f":["14.8.2","15.7.2","26.1"],"u":[]},{"p":"Apple tvOS","f":["26.1"],"u":[]},{"p":"Apple visionOS","f":["26.1"],"u":[]}],"a":["https://support.apple.com/en-us/125632","https://support.apple.com/en-us/125633","https://support.apple.com/en-us/125634"]},"CVE-2025-31277":{"p":[{"p":"Apple Safari","f":["18.6"],"u":[]},{"p":"Apple iOS and iPadOS","f":["18.6"],"u":[]},{"p":"Apple macOS","f":["15.6"],"u":[]},{"p":"Apple tvOS","f":["18.6"],"u":[]}],"a":["https://support.apple.com/en-us/124147","https://support.apple.com/en-us/124149","https://support.apple.com/en-us/124152"]},"CVE-2026-20131":{"p":[],"a":["https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fmc-rce-NKhnULJh"]},"CVE-2025-66376":{"p":[{"p":"Zimbra Collaboration","f":["10.0.18","10.1.13"],"u":[]}],"a":["https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories","https://wiki.zimbra.com/wiki/Security_Center","https://wiki.zimbra.com/wiki/Zimbra_Responsible_Disclosure_Policy"]},"CVE-2026-20963":{"p":[{"p":"Microsoft Microsoft SharePoint Enterprise Server 2016","f":["16.0.5535.1001"],"u":[]},{"p":"Microsoft Microsoft SharePoint Server 2019","f":["16.0.10417.20083"],"u":[]},{"p":"Microsoft Microsoft SharePoint Server Subscription Edition","f":["16.0.19127.20442"],"u":[]}],"a":["https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-20963"]},"CVE-2025-47813":{"p":[{"p":"wftpserver Wing FTP Server","f":["7.4.4"],"u":[]}],"a":["https://www.wftpserver.com","https://www.rcesecurity.com/2025/06/what-the-null-wing-ftp-server-rce-cve-2025-47812/","https://github.com/MrTuxracer/advisories/blob/master/CVEs/CVE-2025-47813.txt"]},"CVE-2026-3910":{"p":[{"p":"Google Chrome","f":["146.0.7680.75"],"u":[]}],"a":["https://chromereleases.googleblog.com/2026/03/stable-channel-update-for-desktop_12.html","https://issues.chromium.org/issues/491410818"]},"CVE-2026-3909":{"p":[{"p":"Google Chrome","f":["146.0.7680.75"],"u":[]}],"a":["https://issues.chromium.org/issues/491421267","https://chromereleases.googleblog.com/2026/03/stable-channel-update-for-desktop_13.html"]},"CVE-2025-68613":{"p":[],"a":["https://github.com/n8n-io/n8n/security/advisories/GHSA-v98v-ff95-f3cp","https://github.com/n8n-io/n8n/commit/08f332015153decdda3c37ad4fcb9f7ba13a7c79","https://github.com/n8n-io/n8n/commit/1c933358acef527ff61466e53268b41a04be1000"]},"CVE-2021-22054":{"p":[],"a":["https://www.vmware.com/security/advisories/VMSA-2021-0029.html"]},"CVE-2025-26399":{"p":[],"a":["https://www.solarwinds.com/trust-center/security-advisories/CVE-2025-26399","https://documentation.solarwinds.com/en/success_center/whd/content/release_notes/whd_12-8-7-hotfix-1_release_notes.htm"]},"CVE-2026-1603":{"p":[],"a":["https://hub.ivanti.com/s/article/Security-Advisory-EPM-February-2026-for-EPM-2024?language=en_US"]},"CVE-2017-7921":{"p":[],"a":["https://ics-cert.us-cert.gov/advisories/ICSA-17-124-01","http://www.securityfocus.com/bid/98313","https://ghostbin.com/paste/q2vq2"]},"CVE-2021-22681":{"p":[],"a":["https://us-cert.cisa.gov/ics/advisories/icsa-21-056-03"]},"CVE-2023-43000":{"p":[{"p":"Apple macOS","f":["13.5"],"u":[]},{"p":"Apple iOS and iPadOS","f":["16.6"],"u":[]},{"p":"Apple Safari","f":["16.6"],"u":[]},{"p":"Apple iOS and iPadOS","f":["15.8.7"],"u":[]}],"a":["https://support.apple.com/en-us/120331","https://support.apple.com/en-us/120338","https://support.apple.com/en-us/120324"]},"CVE-2021-30952":{"p":[{"p":"Apple watchOS","f":["8.3"],"u":[]},{"p":"Apple iOS and iPadOS","f":["15.2"],"u":[]},{"p":"Apple macOS","f":["12.1"],"u":[]},{"p":"Apple macOS","f":["15.2"],"u":[]}],"a":["https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7EQVZ3CEMTINLBZ7PBC7WRXVEVCRHNSM/","https://www.debian.org/security/2022/dsa-5061","https://www.debian.org/security/2022/dsa-5060"]},"CVE-2023-41974":{"p":[{"p":"Apple iOS and iPadOS","f":["17"],"u":[]},{"p":"Apple iOS and iPadOS","f":["15.8.7"],"u":[]}],"a":["https://support.apple.com/en-us/120949","https://support.apple.com/en-us/126632"]},"CVE-2026-22719":{"p":[{"p":"VMware VMware Aria Operations","f":["8.18.6"],"u":[]},{"p":"VMware VMware Cloud Foundation Operations","f":["9.0.2","5.2.3"],"u":[]},{"p":"VMware Telco Cloud Platform","f":["5.2.3"],"u":[]},{"p":"VMware Telco Cloud Infrastructure","f":["5.2.3"],"u":[]}],"a":["https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/36947","https://knowledge.broadcom.com/external/article/430349","https://techdocs.broadcom.com/us/en/vmware-cis/aria/aria-operations/8-18/vmware-aria-operations-8186-release-notes.html"]},"CVE-2026-21385":{"p":[],"a":["https://docs.qualcomm.com/product/publicresources/securitybulletin/march-2026-bulletin.html"]},"CVE-2022-20775":{"p":[],"a":["https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sd-wan-priv-E6e8tEdF"]},"CVE-2026-20127":{"p":[],"a":["https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-rpa-EHchtZk"]},"CVE-2026-25108":{"p":[],"a":["https://www.soliton.co.jp/support/2026/006657.html","https://jvn.jp/en/jp/JVN84622767/"]},"CVE-2025-49113":{"p":[{"p":"Roundcube Webmail","f":["1.5.10","1.6.11"],"u":[]}],"a":["https://roundcube.net/news/2025/06/01/security-updates-1.6.11-and-1.5.10","https://github.com/roundcube/roundcubemail/pull/9865","https://github.com/roundcube/roundcubemail/releases/tag/1.6.11"]},"CVE-2025-68461":{"p":[{"p":"Roundcube Webmail","f":["1.5.12","1.6.12"],"u":[]}],"a":["https://roundcube.net/news/2025/12/13/security-updates-1.6.12-and-1.5.12","https://github.com/roundcube/roundcubemail/commit/bfa032631c36b900e7444dfa278340b33cbf7cdb"]},"CVE-2021-22175":{"p":[],"a":["https://gitlab.com/gitlab-org/gitlab/-/issues/294178","https://hackerone.com/reports/1059596","https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22175.json"]},"CVE-2026-22769":{"p":[{"p":"Dell RecoverPoint for Virtual Machines","f":["6.0.3.1 HF1"],"u":[]},{"p":"Dell RecoverPoint for Virtual Machines","f":["6.0.3.1 HF1"],"u":[]}],"a":["https://www.dell.com/support/kbdoc/en-us/000426773/dsa-2026-079"]},"CVE-2020-7796":{"p":[],"a":["https://wiki.zimbra.com/wiki/Zimbra_Releases/8.8.15/P7"]},"CVE-2024-7694":{"p":[{"p":"TeamT5 ThreatSonar Anti-Ransomware","f":[],"u":["3.4.5"]}],"a":["https://www.twcert.org.tw/tw/cp-132-7998-d76dd-1.html","https://www.twcert.org.tw/en/cp-139-8000-e5a5c-2.html"]},"CVE-2008-0015":{"p":[],"a":["https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-032","https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-037"]},"CVE-2026-2441":{"p":[{"p":"Google Chrome","f":["145.0.7632.75"],"u":[]}],"a":["https://chromereleases.googleblog.com/2026/02/stable-channel-update-for-desktop_13.html","https://issues.chromium.org/issues/483569511"]},"CVE-2026-1731":{"p":[{"p":"BeyondTrust Remote Support(RS) & Privileged Remote Access(PRA)","f":[],"u":["RS 25.3.1","PRA 24.3.4"]}],"a":["https://beyondtrustcorp.service-now.com/csm?id=csm_kb_article&sysparm_article=KB0023293","https://www.beyondtrust.com/trust-center/security-advisories/bt26-02"]},"CVE-2026-20700":{"p":[{"p":"Apple iOS and iPadOS","f":["26.3"],"u":[]},{"p":"Apple macOS","f":["26.3"],"u":[]},{"p":"Apple tvOS","f":["26.3"],"u":[]},{"p":"Apple visionOS","f":["26.3"],"u":[]}],"a":["https://support.apple.com/en-us/126346","https://support.apple.com/en-us/126348","https://support.apple.com/en-us/126351"]},"CVE-2024-43468":{"p":[{"p":"Microsoft Microsoft Configuration Manager","f":["5.00.9106"],"u":[]}],"a":["https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-43468"]},"CVE-2025-15556":{"p":[{"p":"notepad-plus-plus notepad-plus-plus","f":["8.8.9"],"u":[]}],"a":["https://community.notepad-plus-plus.org/topic/27298/notepad-v8-8-9-vulnerability-fix","https://notepad-plus-plus.org/news/hijacked-incident-info-update/","https://github.com/notepad-plus-plus/notepad-plus-plus/commit/bcf2aa68ef414338d717e20e059459570ed6c5ab"]},"CVE-2025-40536":{"p":[],"a":["https://www.solarwinds.com/trust-center/security-advisories/CVE-2025-40536","https://documentation.solarwinds.com/en/success_center/whd/content/release_notes/whd_2026-1_release_notes.htm"]},"CVE-2026-21513":{"p":[{"p":"Microsoft Windows 10 Version 1607","f":["10.0.14393.8868"],"u":[]},{"p":"Microsoft Windows 10 Version 1809","f":["10.0.17763.8389"],"u":[]},{"p":"Microsoft Windows 10 Version 21H2","f":["10.0.19044.6937"],"u":[]},{"p":"Microsoft Windows 10 Version 22H2","f":["10.0.19045.6937"],"u":[]}],"a":["https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21513"]},"CVE-2026-21525":{"p":[{"p":"Microsoft Windows 10 Version 1607","f":["10.0.14393.8868"],"u":[]},{"p":"Microsoft Windows 10 Version 1809","f":["10.0.17763.8389"],"u":[]},{"p":"Microsoft Windows 10 Version 21H2","f":["10.0.19044.6937"],"u":[]},{"p":"Microsoft Windows 10 Version 22H2","f":["10.0.19045.6937"],"u":[]}],"a":["https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21525"]},"CVE-2026-21510":{"p":[{"p":"Microsoft Windows 10 Version 1607","f":["10.0.14393.8868"],"u":[]},{"p":"Microsoft Windows 10 Version 1809","f":["10.0.17763.8389"],"u":[]},{"p":"Microsoft Windows 10 Version 21H2","f":["10.0.19044.6937"],"u":[]},{"p":"Microsoft Windows 10 Version 22H2","f":["10.0.19045.6937"],"u":[]}],"a":["https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21510"]},"CVE-2026-21533":{"p":[{"p":"Microsoft Windows 10 Version 1607","f":["10.0.14393.8868"],"u":[]},{"p":"Microsoft Windows 10 Version 1809","f":["10.0.17763.8389"],"u":[]},{"p":"Microsoft Windows 10 Version 21H2","f":["10.0.19044.6937"],"u":[]},{"p":"Microsoft Windows 10 Version 22H2","f":["10.0.19045.6937"],"u":[]}],"a":["https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21533"]},"CVE-2026-21519":{"p":[{"p":"Microsoft Windows 10 Version 1607","f":["10.0.14393.8868"],"u":[]},{"p":"Microsoft Windows 10 Version 1809","f":["10.0.17763.8389"],"u":[]},{"p":"Microsoft Windows 10 Version 21H2","f":["10.0.19044.6937"],"u":[]},{"p":"Microsoft Windows 10 Version 22H2","f":["10.0.19045.6937"],"u":[]}],"a":["https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21519"]},"CVE-2026-21514":{"p":[{"p":"Microsoft Microsoft 365 Apps for Enterprise","f":["https://aka.ms/OfficeSecurityReleases"],"u":[]},{"p":"Microsoft Microsoft Office LTSC 2021","f":["https://aka.ms/OfficeSecurityReleases"],"u":[]},{"p":"Microsoft Microsoft Office LTSC 2024","f":["https://aka.ms/OfficeSecurityReleases"],"u":[]},{"p":"Microsoft Microsoft Office LTSC for Mac 2021","f":["16.106.26020821"],"u":[]}],"a":["https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21514"]},"CVE-2025-11953":{"p":[{"p":"","f":["20.0.0"],"u":[]}],"a":["https://github.com/react-native-community/cli/commit/15089907d1f1301b22c72d7f68846a2ef20df547"]},"CVE-2026-24423":{"p":[{"p":"SmarterTools SmarterMail","f":["100.0.9511"],"u":[]}],"a":["https://www.smartertools.com/smartermail/release-notes/current"]},"CVE-2021-39935":{"p":[],"a":["https://gitlab.com/gitlab-org/gitlab/-/issues/346187","https://hackerone.com/reports/1236965","https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-39935.json"]},"CVE-2025-64328":{"p":[],"a":["https://github.com/FreePBX/security-reporting/security/advisories/GHSA-vm9p-46mv-5xvw","https://github.com/FreePBX/filestore/blob/f0e3983059271efd80b483ec823310ef19a59013/drivers/SSH/testconnection.php#L2","https://www.freepbx.org/watch-what-we-do-with-security-fixes-%f0%9f%91%80"]},"CVE-2019-19006":{"p":[],"a":["https://www.freepbx.org/category/blog/","https://wiki.freepbx.org/display/FOP/2019-11-20+Remote+Admin+Authentication+Bypass","https://community.freepbx.org/t/freepbx-security-vulnerability-sec-2019-001/62772"]},"CVE-2025-40551":{"p":[],"a":["https://www.solarwinds.com/trust-center/security-advisories/CVE-2025-40551","https://documentation.solarwinds.com/en/success_center/whd/content/release_notes/whd_2026-1_release_notes.htm"]},"CVE-2026-1281":{"p":[],"a":["https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Endpoint-Manager-Mobile-EPMM-CVE-2026-1281-CVE-2026-1340"]},"CVE-2026-24858":{"p":[{"p":"Fortinet FortiWeb","f":[],"u":["8.0.3","7.6.6","7.4.11"]},{"p":"Fortinet FortiNAC-F","f":[],"u":["7.6.5"]},{"p":"Fortinet FortiOS","f":[],"u":["7.6.5","7.4.10","7.2.12"]},{"p":"Fortinet FortiAnalyzer","f":[],"u":["7.6.5","7.4.9","7.2.11"]}],"a":["https://fortiguard.fortinet.com/psirt/FG-IR-26-060"]},"CVE-2018-14634":{"p":[],"a":["https://access.redhat.com/errata/RHSA-2018:3540","https://access.redhat.com/errata/RHSA-2018:2925","https://access.redhat.com/errata/RHSA-2018:3591"]},"CVE-2025-52691":{"p":[],"a":["https://www.csa.gov.sg/alerts-and-advisories/alerts/al-2025-124/"]},"CVE-2026-23760":{"p":[{"p":"SmarterTools SmarterMail","f":["100.0.9511"],"u":[]}],"a":["https://www.smartertools.com/smartermail/release-notes/current"]},"CVE-2026-24061":{"p":[{"p":"GNU Inetutils","f":[],"u":["2.7"]}],"a":["https://www.openwall.com/lists/oss-security/2026/01/20/2","https://www.openwall.com/lists/oss-security/2026/01/20/8","https://www.gnu.org/software/inetutils/"]},"CVE-2026-21509":{"p":[{"p":"Microsoft Microsoft 365 Apps for Enterprise","f":["https://aka.ms/OfficeSecurityReleases"],"u":[]},{"p":"Microsoft Microsoft Office 2016","f":["16.0.5539.1001"],"u":[]},{"p":"Microsoft Microsoft Office 2019","f":["16.0.10417.20095"],"u":[]},{"p":"Microsoft Microsoft Office LTSC 2021","f":["https://aka.ms/OfficeSecurityReleases"],"u":[]}],"a":["https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21509"]},"CVE-2024-37079":{"p":[{"p":"VMware vCenter Server","f":["8.0 U2d","8.0 U1e","7.0 U3r"],"u":[]}],"a":["https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/24453"]},"CVE-2025-68645":{"p":[],"a":["https://wiki.zimbra.com/wiki/Security_Center","https://wiki.zimbra.com/wiki/Zimbra_Responsible_Disclosure_Policy"]},"CVE-2025-34026":{"p":[{"p":"Versa Concerto","f":[],"u":["12.2.0"]}],"a":["https://projectdiscovery.io/blog/versa-concerto-authentication-bypass-rce"]},"CVE-2025-31125":{"p":[],"a":["https://github.com/vitejs/vite/security/advisories/GHSA-4r4m-qw57-chr8","https://github.com/vitejs/vite/commit/59673137c45ac2bcfad1170d954347c1a17ab949"]},"CVE-2025-54313":{"p":[],"a":["https://socket.dev/blog/npm-phishing-campaign-leads-to-prettier-tooling-packages-compromise","https://www.bleepingcomputer.com/news/security/popular-npm-linter-packages-hijacked-via-phishing-to-drop-malware/","https://github.com/prettier/eslint-config-prettier/issues/339"]},"CVE-2026-20045":{"p":[],"a":["https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-voice-rce-mORhqY4b"]},"CVE-2026-20805":{"p":[{"p":"Microsoft Windows 10 Version 1607","f":["10.0.14393.8783"],"u":[]},{"p":"Microsoft Windows 10 Version 1809","f":["10.0.17763.8276"],"u":[]},{"p":"Microsoft Windows 10 Version 21H2","f":["10.0.19044.6809"],"u":[]},{"p":"Microsoft Windows 10 Version 22H2","f":["10.0.19045.6809"],"u":[]}],"a":["https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-20805"]},"CVE-2025-8110":{"p":[{"p":"Gogs Gogs","f":[],"u":["0.13.3"]}],"a":["http://wiz.io/blog/wiz-research-gogs-cve-2025-8110-rce-exploit"]},"CVE-2009-0556":{"p":[],"a":["https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-017"]},"CVE-2025-37164":{"p":[{"p":"Hewlett Packard Enterprise (HPE) HPE OneView","f":["11.00"],"u":[]}],"a":["https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbgn04985en_us&docLocale=en_US"]},"CVE-2025-14847":{"p":[{"p":"MongoDB Inc. MongoDB Server","f":["8.2.3","8.0.17","7.0.28","6.0.27","5.0.32"],"u":[]}],"a":["https://jira.mongodb.org/browse/SERVER-115508"]},"CVE-2023-52163":{"p":[],"a":["https://www.txone.com/blog/digiever-fixes-sorely-needed/","https://www.akamai.com/blog/security-research/digiever-fix-that-iot-thing"]},"CVE-2025-14733":{"p":[{"p":"WatchGuard Fireware OS","f":["2025.1.4","12.11.6"],"u":["11.12.4+541730"]},{"p":"WatchGuard Fireware OS","f":["12.3.1+728352"],"u":[]},{"p":"WatchGuard Fireware OS","f":["12.5.15"],"u":[]}],"a":["https://psirt.watchguard.com/CVE-2025-14733","https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2025-00027"]},"CVE-2025-59374":{"p":[],"a":["https://www.asus.com/news/hqfgvuyz6uyayje1/"]},"CVE-2025-40602":{"p":[],"a":["https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2025-0019"]},"CVE-2025-20393":{"p":[],"a":["https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sma-attack-N9bf4"]},"CVE-2025-59718":{"p":[{"p":"Fortinet FortiSwitchManager","f":[],"u":["7.2.6","7.0.5"]},{"p":"Fortinet FortiOS","f":[],"u":["7.6.3","7.4.8","7.2.11"]},{"p":"Fortinet FortiProxy","f":[],"u":["7.6.3","7.4.10","7.2.14"]}],"a":["https://fortiguard.fortinet.com/psirt/FG-IR-25-647"]},"CVE-2025-14611":{"p":[{"p":"Gladinet CentreStack and TrioFox","f":["16.12.10420.56791"],"u":[]}],"a":["https://www.huntress.com/blog/active-exploitation-gladinet-centrestack-triofox-insecure-cryptography-vulnerability"]},"CVE-2025-43529":{"p":[{"p":"Apple Safari","f":["26.2"],"u":[]},{"p":"Apple iOS and iPadOS","f":["18.7.3","26.2"],"u":[]},{"p":"Apple macOS","f":["26.2"],"u":[]},{"p":"Apple tvOS","f":["26.2"],"u":[]}],"a":["https://support.apple.com/en-us/125884","https://support.apple.com/en-us/125885","https://support.apple.com/en-us/125886"]},"CVE-2018-4063":{"p":[],"a":["http://packetstormsecurity.com/files/152648/Sierra-Wireless-AirLink-ES450-ACEManager-upload.cgi-Remote-Code-Execution.html","https://ics-cert.us-cert.gov/advisories/ICSA-19-122-03","http://www.securityfocus.com/bid/108147"]},"CVE-2025-14174":{"p":[{"p":"Google Chrome","f":["143.0.7499.110"],"u":[]}],"a":["https://chromereleases.googleblog.com/2025/12/stable-channel-update-for-desktop_10.html","https://issues.chromium.org/issues/466192044"]},"CVE-2025-58360":{"p":[],"a":["https://github.com/geoserver/geoserver/security/advisories/GHSA-fjf5-xgmq-5525","https://osgeo-org.atlassian.net/browse/GEOS-11682"]},"CVE-2025-6218":{"p":[],"a":["https://www.win-rar.com/singlenewsview.html?&tx_ttnews%5Btt_news%5D=276&cHash=388885bd3908a40726f535c026f94eb6"]},"CVE-2025-62221":{"p":[{"p":"Microsoft Windows 10 Version 1809","f":["10.0.17763.8146"],"u":[]},{"p":"Microsoft Windows 10 Version 21H2","f":["10.0.19044.6691"],"u":[]},{"p":"Microsoft Windows 10 Version 22H2","f":["10.0.19045.6691"],"u":[]},{"p":"Microsoft Windows 11 version 22H3","f":["10.0.22631.6345"],"u":[]}],"a":["https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-62221"]},"CVE-2022-37055":{"p":[],"a":["https://www.dlink.com/en/security-bulletin/","https://drive.google.com/file/d/1hmIk0jQoex4QDyjIUg_6yxi-J6ROCh8S/view?usp=sharing","https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10308"]},"CVE-2025-66644":{"p":[{"p":"Array Networks ArrayOS AG","f":["9.4.5.9"],"u":[]}],"a":["https://www.jpcert.or.jp/at/2025/at250024.html","https://x.com/ArraySupport/status/1921373397533032590","https://www.bleepingcomputer.com/news/security/hackers-are-exploiting-arrayos-ag-vpn-flaw-to-plant-webshells/"]},"CVE-2025-55182":{"p":[{"p":"Meta react-server-dom-webpack","f":[],"u":["19.0.0","19.1.1","19.2.0"]},{"p":"Meta react-server-dom-turbopack","f":[],"u":["19.0.0","19.1.1","19.2.0"]},{"p":"Meta react-server-dom-parcel","f":[],"u":["19.0.0","19.1.1","19.2.0"]}],"a":["https://www.facebook.com/security/advisories/cve-2025-55182","https://react.dev/blog/2025/12/03/critical-security-vulnerability-in-react-server-components"]},"CVE-2021-26828":{"p":[],"a":["https://youtu.be/k1teIStQr1A","http://packetstormsecurity.com/files/162564/ScadaBR-1.0-1.1CE-Linux-Shell-Upload.html","http://forum.scadabr.com.br/t/report-falhas-de-seguranca-em-versoes-do-scadabr/3615/4"]},"CVE-2025-48633":{"p":[],"a":["https://android.googlesource.com/platform/frameworks/base/+/d00bcda9f42dcf272d329e9bf9298f32af732f93","https://source.android.com/security/bulletin/2025-12-01"]},"CVE-2025-48572":{"p":[],"a":["https://android.googlesource.com/platform/frameworks/base/+/e707f6600330691f9c67dc023c09f4cd2fc59192","https://source.android.com/security/bulletin/2025-12-01"]},"CVE-2021-26829":{"p":[],"a":["https://youtu.be/Xh6LPCiLMa8","http://forum.scadabr.com.br/t/report-falhas-de-seguranca-em-versoes-do-scadabr/3615/4"]},"CVE-2025-61757":{"p":[],"a":["https://www.oracle.com/security-alerts/cpuoct2025.html"]},"CVE-2025-13223":{"p":[{"p":"Google Chrome","f":["142.0.7444.175"],"u":[]}],"a":["https://chromereleases.googleblog.com/2025/11/stable-channel-update-for-desktop_17.html","https://issues.chromium.org/issues/460017370"]},"CVE-2025-58034":{"p":[{"p":"Fortinet FortiWeb","f":[],"u":["7.6.4","7.4.8","7.2.11"]}],"a":["https://fortiguard.fortinet.com/psirt/FG-IR-25-513"]},"CVE-2025-64446":{"p":[{"p":"Fortinet FortiWeb","f":[],"u":["8.0.1","7.6.4","7.4.9"]}],"a":["https://fortiguard.fortinet.com/psirt/FG-IR-25-910"]},"CVE-2025-12480":{"p":[{"p":"TrioFox TrioFox","f":["16.7.10368.56560"],"u":[]}],"a":["https://access.triofox.com/releases_history/"]},"CVE-2025-62215":{"p":[{"p":"Microsoft Windows 10 Version 1809","f":["10.0.17763.8027"],"u":[]},{"p":"Microsoft Windows 10 Version 21H2","f":["10.0.19044.6575"],"u":[]},{"p":"Microsoft Windows 10 Version 22H2","f":["10.0.19045.6575"],"u":[]},{"p":"Microsoft Windows 11 version 22H3","f":["10.0.22631.6199"],"u":[]}],"a":["https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-62215"]},"CVE-2025-9242":{"p":[{"p":"WatchGuard Fireware OS","f":["12.11.4","2025.1.1"],"u":["11.12.4+541730"]},{"p":"WatchGuard Fireware OS","f":["12.3.1+722811"],"u":[]},{"p":"WatchGuard Fireware OS","f":["12.5.13"],"u":[]}],"a":["https://psirt.watchguard.com/CVE-2025-9242","https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2025-00015"]},"CVE-2025-21042":{"p":[],"a":["https://security.samsungmobile.com/securityUpdate.smsb?year=2025&month=04"]},"CVE-2025-48703":{"p":[{"p":"centos-webpanel CentOS Web Panel","f":["0.9.8.1205"],"u":[]}],"a":["https://fenrisk.com/rce-centos-webpanel"]},"CVE-2025-11371":{"p":[{"p":"Gladinet CentreStack and TrioFox","f":[],"u":["16.7.10368.56560"]}],"a":["https://www.huntress.com/blog/gladinet-centrestack-triofox-local-file-inclusion-flaw"]},"CVE-2025-41244":{"p":[{"p":"VMware VCF operations","f":["9.0.1.0"],"u":[]},{"p":"VMware VMware tools","f":["13.0.5.0","12.5.4"],"u":[]},{"p":"VMware VMware Aria Operations","f":["8.18.5"],"u":[]},{"p":"VMware VMware Cloud Foundation","f":["8.18.5"],"u":[]}],"a":["http://support.broadcom.com/group/ecx/support-content-view/-/support-content/Security%20Advisories/VMSA-2025-0015--VMware-Aria-Operations-and-VMware-Tools-updates-address-multiple-vulnerabilities--CVE-2025-41244-CVE-2025-41245--CVE-2025-41246-/36149"]},"CVE-2025-24893":{"p":[],"a":["https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-rr6p-3pfg-562j","https://github.com/xwiki/xwiki-platform/commit/67021db9b8ed26c2236a653269302a86bf01ef40","https://github.com/xwiki/xwiki-platform/blob/568447cad5172d97d6bbcfda9f6183689c2cf086/xwiki-platform-core/xwiki-platform-search/xwiki-platform-search-solr/xwiki-platform-search-solr-ui/src/main/resources/Main/SolrSearchMacros.xml#L955"]},"CVE-2025-6204":{"p":[{"p":"Dassault Systèmes DELMIA Apriso","f":[],"u":["Release 2020 SP4","Release 2021 SP3","Release 2022 SP3"]}],"a":["https://www.3ds.com/trust-center/security/security-advisories/cve-2025-6204"]},"CVE-2025-6205":{"p":[{"p":"Dassault Systèmes DELMIA Apriso","f":[],"u":["Release 2020 SP4","Release 2021 SP3","Release 2022 SP3"]}],"a":["https://www.3ds.com/trust-center/security/security-advisories/cve-2025-6205"]},"CVE-2025-54236":{"p":[{"p":"Adobe Adobe Commerce","f":[],"u":["2.4.4-p15"]}],"a":["https://helpx.adobe.com/security/products/magento/apsb25-88.html"]},"CVE-2025-59287":{"p":[{"p":"Microsoft Windows Server 2012","f":["6.2.9200.25728"],"u":[]},{"p":"Microsoft Windows Server 2012 (Server Core installation)","f":["6.2.9200.25728"],"u":[]},{"p":"Microsoft Windows Server 2012 R2","f":["6.3.9600.22826"],"u":[]},{"p":"Microsoft Windows Server 2012 R2 (Server Core installation)","f":["6.3.9600.22826"],"u":[]}],"a":["https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-59287"]},"CVE-2025-61932":{"p":[],"a":["https://www.motex.co.jp/news/notice/2025/release251020/","https://jvn.jp/en/jp/JVN86318557/"]},"CVE-2022-48503":{"p":[{"p":"Apple macOS","f":["12.5"],"u":[]},{"p":"Apple tvOS","f":["15.6"],"u":[]},{"p":"Apple Safari","f":["15.6"],"u":[]},{"p":"Apple watchOS","f":["8.7"],"u":[]}],"a":["https://support.apple.com/en-us/HT213345","https://support.apple.com/en-us/HT213342","https://support.apple.com/en-us/HT213341"]},"CVE-2025-2746":{"p":[{"p":"Kentico Xperience","f":[],"u":["13.0.172"]}],"a":["https://devnet.kentico.com/download/hotfixes"]},"CVE-2025-2747":{"p":[{"p":"Kentico Xperience","f":[],"u":["13.0.178"]}],"a":["https://devnet.kentico.com/download/hotfixes"]},"CVE-2025-33073":{"p":[{"p":"Microsoft Windows 10 Version 1507","f":["10.0.10240.21034"],"u":[]},{"p":"Microsoft Windows 10 Version 1607","f":["10.0.14393.8148"],"u":[]},{"p":"Microsoft Windows 10 Version 1809","f":["10.0.17763.7434"],"u":[]},{"p":"Microsoft Windows 10 Version 21H2","f":["10.0.19044.5965"],"u":[]}],"a":["https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-33073"]},"CVE-2025-61884":{"p":[{"p":"Oracle Corporation Oracle Configurator","f":[],"u":["12.2.14"]}],"a":["https://www.oracle.com/security-alerts/alert-cve-2025-61884.html"]},"CVE-2025-54253":{"p":[{"p":"Adobe Adobe Experience Manager","f":[],"u":["6.5.23"]}],"a":["https://helpx.adobe.com/security/products/aem-forms/apsb25-82.html"]},"CVE-2025-47827":{"p":[],"a":["https://github.com/Zedeldi/igelfs","https://github.com/Zedeldi/CVE-2025-47827"]},"CVE-2025-24990":{"p":[{"p":"Microsoft Windows 10 Version 1507","f":["10.0.10240.21161"],"u":[]},{"p":"Microsoft Windows 10 Version 1607","f":["10.0.14393.8519"],"u":[]},{"p":"Microsoft Windows 10 Version 1809","f":["10.0.17763.7919"],"u":[]},{"p":"Microsoft Windows 10 Version 21H2","f":["10.0.19044.6456"],"u":[]}],"a":["https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-24990"]},"CVE-2025-59230":{"p":[{"p":"Microsoft Windows 10 Version 1507","f":["10.0.10240.21161"],"u":[]},{"p":"Microsoft Windows 10 Version 1607","f":["10.0.14393.8519"],"u":[]},{"p":"Microsoft Windows 10 Version 1809","f":["10.0.17763.7919"],"u":[]},{"p":"Microsoft Windows 10 Version 21H2","f":["10.0.19044.6456"],"u":[]}],"a":["https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-59230"]},"CVE-2016-7836":{"p":[],"a":["http://www.skyseaclientview.net/news/161221/","https://www.skygroup.jp/security-info/170308.html","https://jvn.jp/en/jp/JVN84995847/index.html"]},"CVE-2021-43798":{"p":[],"a":["https://github.com/grafana/grafana/security/advisories/GHSA-8pjx-jj86-j47p","https://github.com/grafana/grafana/commit/c798c0e958d15d9cc7f27c72113d572fa58545ce","http://packetstormsecurity.com/files/165198/Grafana-Arbitrary-File-Reading.html"]},"CVE-2025-27915":{"p":[],"a":["https://wiki.zimbra.com/wiki/Security_Center","https://wiki.zimbra.com/wiki/Zimbra_Releases/10.1.5#Security_Fixes","https://wiki.zimbra.com/wiki/Zimbra_Releases/10.0.13#Security_Fixes"]},"CVE-2021-22555":{"p":[{"p":"Linux Kernel","f":["unspecified"],"u":[]}],"a":["https://github.com/google/security-research/security/advisories/GHSA-xxx5-8mvq-3528","https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/net/netfilter/x_tables.c?id=9fa492cdc160cd27ce1046cb36f47d3b2b1efa21","https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/net/netfilter/x_tables.c?id=b29c457a6511435960115c0f548c4360d5f4801d"]},"CVE-2010-3962":{"p":[],"a":["https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-090"]},"CVE-2021-43226":{"p":[{"p":"Microsoft Windows 10 Version 1809","f":["10.0.17763.2366"],"u":[]},{"p":"Microsoft Windows Server 2019","f":["10.0.17763.2366"],"u":[]},{"p":"Microsoft Windows Server 2019 (Server Core installation)","f":["10.0.17763.2366"],"u":[]},{"p":"Microsoft Windows 10 Version 1909","f":["10.0.18363.1977"],"u":[]}],"a":["https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-43226"]},"CVE-2013-3918":{"p":[],"a":["https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-090"]},"CVE-2011-3402":{"p":[],"a":["https://docs.microsoft.com/en-us/security-updates/securitybulletins/2011/ms11-087","https://docs.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-034","https://docs.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-039"]},"CVE-2010-3765":{"p":[],"a":["https://rhn.redhat.com/errata/RHSA-2010-0812.html","http://www.redhat.com/support/errata/RHSA-2010-0896.html","http://www.redhat.com/support/errata/RHSA-2010-0808.html"]},"CVE-2025-61882":{"p":[{"p":"Oracle Corporation Oracle Concurrent Processing","f":[],"u":["12.2.14"]}],"a":["https://www.oracle.com/security-alerts/alert-cve-2025-61882.html"]},"CVE-2017-1000353":{"p":[],"a":["https://www.exploit-db.com/exploits/41965/","http://www.securityfocus.com/bid/98056","https://www.oracle.com/security-alerts/cpuapr2022.html"]},"CVE-2015-7755":{"p":[],"a":["http://arstechnica.com/security/2015/12/unauthorized-code-in-juniper-firewalls-decrypts-encrypted-vpn-traffic/","http://www.wired.com/2015/12/juniper-networks-hidden-backdoors-show-the-risk-of-government-backdoors/","http://www.securitytracker.com/id/1034489"]},"CVE-2025-21043":{"p":[],"a":["https://security.samsungmobile.com/securityUpdate.smsb?year=2025&month=09"]},"CVE-2025-4008":{"p":[{"p":"Smartbedded MeteoBridge","f":[],"u":["6.1"]}],"a":["https://forum.meteohub.de/viewtopic.php?t=18687"]},"CVE-2025-32463":{"p":[{"p":"Sudo project Sudo","f":["1.9.17p1"],"u":[]}],"a":["https://www.sudo.ws/security/advisories/","https://www.sudo.ws/releases/changelog/","https://www.stratascale.com/vulnerability-alert-CVE-2025-32463-sudo-chroot"]},"CVE-2025-59689":{"p":[{"p":"Libraesva Email Security Gateway","f":["5.0.31","5.1.20","5.2.31","5.4.8","5.5.7"],"u":[]}],"a":["https://www.libraesva.com/security-blog/","https://docs.libraesva.com/knowledgebase/security-advisory-command-injection-vulnerability-cve-2025-59689/"]},"CVE-2025-10035":{"p":[{"p":"Fortra GoAnywhere MFT","f":[],"u":["7.8.3"]}],"a":["https://www.fortra.com/security/advisories/product-security/fi-2025-012"]},"CVE-2025-20352":{"p":[],"a":["https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-snmp-x4LPhte"]},"CVE-2021-21311":{"p":[],"a":["https://github.com/vrana/adminer/security/advisories/GHSA-x5r2-hj5c-8jx6","https://github.com/vrana/adminer/files/5957311/Adminer.SSRF.pdf","https://packagist.org/packages/vrana/adminer"]},"CVE-2025-20362":{"p":[],"a":["https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-webvpn-YROOTUW"]},"CVE-2025-20333":{"p":[],"a":["https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-webvpn-z5xP8EUB"]},"CVE-2025-10585":{"p":[{"p":"Google Chrome","f":["140.0.7339.185"],"u":[]}],"a":["https://chromereleases.googleblog.com/2025/09/stable-channel-update-for-desktop_17.html","https://issues.chromium.org/issues/445380761"]},"CVE-2025-5086":{"p":[{"p":"Dassault Systèmes DELMIA Apriso","f":[],"u":["Release 2020 SP4","Release 2021 SP3","Release 2022 SP3"]}],"a":["https://www.3ds.com/vulnerability/advisories"]},"CVE-2025-38352":{"p":[{"p":"Linux Linux","f":["78a4b8e3795b31dae58762bc091bb0f4f74a2200","c076635b3a42771ace7d276de8dc3bc76ee2ba1b","2f3daa04a9328220de46f0d5c919a6c0073a9f0b","764a7a5dfda23f69919441f2eac2a83e7db6e5bb","2c72fe18cc5f9f1750f5bc148cf1c94c29e106ff"],"u":[]}],"a":["https://git.kernel.org/stable/c/78a4b8e3795b31dae58762bc091bb0f4f74a2200","https://git.kernel.org/stable/c/c076635b3a42771ace7d276de8dc3bc76ee2ba1b","https://git.kernel.org/stable/c/2f3daa04a9328220de46f0d5c919a6c0073a9f0b"]},"CVE-2025-48543":{"p":[],"a":["https://android.googlesource.com/platform/art/+/444fc40dfb04d2ec5f74c443ed3a4dd45d3131f2","https://source.android.com/security/bulletin/2025-09-01"]},"CVE-2025-53690":{"p":[{"p":"Sitecore Experience Manager (XM)","f":[],"u":["9.0"]},{"p":"Sitecore Experience Platform (XP)","f":[],"u":["9.0"]}],"a":["https://cloud.google.com/blog/topics/threat-intelligence/viewstate-deserialization-zero-day-vulnerability","https://support.sitecore.com/kb?id=kb_article_view&sysparm_article=KB1003865"]},"CVE-2023-50224":{"p":[],"a":["https://www.tp-link.com/en/support/download/tl-wr841n/v12/#Firmware","https://www.tp-link.com/us/support/faq/5058/"]},"CVE-2025-9377":{"p":[{"p":"TP-Link Systems Inc. Archer C7(EU) V2","f":["241108"],"u":[]},{"p":"TP-Link Systems Inc. TL-WR841N/ND(MS) V9","f":["241108"],"u":[]}],"a":["https://www.tp-link.com/us/support/faq/4365/","https://www.tp-link.com/us/support/faq/4308/"]},"CVE-2020-24363":{"p":[],"a":["https://www.tp-link.com/us/support/download/tl-wa855re/#Firmware","http://malwrforensics.com/en/2020/08/31/cve-2020-24363-tl-wa855re-v5-advisory/","https://pastebin.com/VjHM4UiA"]},"CVE-2025-55177":{"p":[{"p":"Facebook WhatsApp Desktop for Mac","f":["2.25.21.78"],"u":[]},{"p":"Facebook WhatsApp Business for iOS","f":["2.25.21.78"],"u":[]},{"p":"Facebook WhatsApp for iOS","f":["2.25.21.73"],"u":[]}],"a":["https://www.facebook.com/security/advisories/cve-2025-55177","https://www.whatsapp.com/security/advisories/2025/"]},"CVE-2025-57819":{"p":[],"a":["https://github.com/FreePBX/security-reporting/security/advisories/GHSA-m42g-xg4c-5f3h","https://community.freepbx.org/t/security-advisory-please-lock-down-your-administrator-access/107203"]},"CVE-2025-7775":{"p":[{"p":"NetScaler ADC","f":["47.48","59.22","37.241","55.330"],"u":[]},{"p":"NetScaler Gateway","f":["47.48","59.22","37.241","55.330"],"u":[]}],"a":["https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX694938"]},"CVE-2025-48384":{"p":[],"a":["https://github.com/git/git/security/advisories/GHSA-vwqx-4fm8-6qc9"]},"CVE-2024-8068":{"p":[{"p":"Citrix Citrix Session Recording","f":["24.5.200.8","CU9 hotfix 19.12.9100.6","CU5 hotfix 22.03.5100.11","CU1 hotfix 24.02.1200.16"],"u":[]}],"a":["https://support.citrix.com/s/article/CTX691941-citrix-session-recording-security-bulletin-for-cve20248068-and-cve20248069?language=en_US"]},"CVE-2024-8069":{"p":[{"p":"Citrix Session Recording Citrix Session Recording","f":["24.5.200.8","CU9 hotfix 19.12.9100.6","CU5 hotfix 22.03.5100.11","CU1 hotfix 24.02.1200.16"],"u":[]}],"a":["https://support.citrix.com/s/article/CTX691941-citrix-session-recording-security-bulletin-for-cve20248068-and-cve20248069?language=en_US"]},"CVE-2025-43300":{"p":[{"p":"Apple iOS and iPadOS","f":["15.8.5","16.7.12","18.6.2"],"u":[]},{"p":"Apple iPadOS","f":["17.7.10"],"u":[]},{"p":"Apple macOS","f":["13.7.8","14.7.8","15.6.1"],"u":[]}],"a":["https://support.apple.com/en-us/124925","https://support.apple.com/en-us/124926","https://support.apple.com/en-us/124927"]},"CVE-2025-54948":{"p":[{"p":"Trend Micro, Inc. Trend Micro Apex One","f":["14.0.0.14039"],"u":[]}],"a":["https://success.trendmicro.com/en-US/solution/KA-0020652"]},"CVE-2025-8876":{"p":[{"p":"N-able N-central","f":["2025.3.1"],"u":[]}],"a":["https://status.n-able.com/2025/08/13/announcing-the-ga-of-n-central-2025-3-1/"]},"CVE-2025-8875":{"p":[{"p":"N-able N-central","f":["2025.3.1"],"u":[]}],"a":["https://status.n-able.com/2025/08/13/announcing-the-ga-of-n-central-2025-3-1/"]},"CVE-2025-8088":{"p":[{"p":"win.rar GmbH WinRAR","f":[],"u":["7.12"]}],"a":["https://www.win-rar.com/singlenewsview.html?&L=0&tx_ttnews%5Btt_news%5D=283&cHash=a64b4a8f662d3639dec8d65f47bc93c5"]},"CVE-2007-0671":{"p":[],"a":["https://docs.microsoft.com/en-us/security-updates/securitybulletins/2007/ms07-015"]},"CVE-2013-3893":{"p":[],"a":["https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-080"]},"CVE-2020-25078":{"p":[],"a":["https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10180","https://twitter.com/Dogonsecurity/status/1273251236167516161"]},"CVE-2020-25079":{"p":[],"a":["https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10180","https://twitter.com/Dogonsecurity/status/1271265152118259712"]},"CVE-2022-40799":{"p":[],"a":["https://gitlab.com/lu-ka/cve-2022-40799"]},"CVE-2023-2533":{"p":[{"p":"PaperCut PaperCut NG/MF","f":["2.1.1"],"u":[]}],"a":["https://fluidattacks.com/advisories/arcangel/","https://www.papercut.com/kb/Main/SecurityBulletinJune2023"]},"CVE-2025-20337":{"p":[],"a":["https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-unauth-rce-ZAd2GnJ6"]},"CVE-2025-20281":{"p":[],"a":["https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-unauth-rce-ZAd2GnJ6"]},"CVE-2025-2775":{"p":[{"p":"SysAid SysAid On-Prem","f":[],"u":["23.3.40"]}],"a":["https://documentation.sysaid.com/docs/24-40-60"]},"CVE-2025-2776":{"p":[{"p":"SysAid SysAid On-Prem","f":[],"u":["23.3.40"]}],"a":["https://documentation.sysaid.com/docs/24-40-60"]},"CVE-2025-6558":{"p":[{"p":"Google Chrome","f":["138.0.7204.157"],"u":[]}],"a":["https://chromereleases.googleblog.com/2025/07/stable-channel-update-for-desktop_15.html","https://issues.chromium.org/issues/427162086"]},"CVE-2025-54309":{"p":[{"p":"CrushFTP CrushFTP","f":["10.8.5","11.3.4_23"],"u":[]}],"a":["https://www.crushftp.com/crush11wiki/Wiki.jsp?page=CompromiseJuly2025","https://www.rapid7.com/blog/post/crushftp-zero-day-exploited-in-the-wild/","https://www.bleepingcomputer.com/news/security/crushftp-zero-day-exploited-in-attacks-to-gain-admin-access-on-servers/"]},"CVE-2025-49704":{"p":[{"p":"Microsoft Microsoft SharePoint Enterprise Server 2016","f":["16.0.5508.1000"],"u":[]},{"p":"Microsoft Microsoft SharePoint Server 2019","f":["16.0.10417.20027"],"u":[]}],"a":["https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-49704"]},"CVE-2025-49706":{"p":[{"p":"Microsoft Microsoft SharePoint Enterprise Server 2016","f":["16.0.5508.1000"],"u":[]},{"p":"Microsoft Microsoft SharePoint Server 2019","f":["16.0.10417.20027"],"u":[]},{"p":"Microsoft Microsoft SharePoint Server Subscription Edition","f":["16.0.18526.20424"],"u":[]}],"a":["https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-49706"]},"CVE-2025-25257":{"p":[{"p":"Fortinet FortiWeb","f":[],"u":["7.6.3","7.4.7","7.2.10"]}],"a":["https://fortiguard.fortinet.com/psirt/FG-IR-25-151"]},"CVE-2025-47812":{"p":[{"p":"wftpserver Wing FTP Server","f":["7.4.4"],"u":[]}],"a":["https://www.wftpserver.com","https://www.rcesecurity.com/2025/06/what-the-null-wing-ftp-server-rce-cve-2025-47812/","https://www.vicarius.io/vsociety/posts/cve-2025-47812-mitigation-script-remote-code-execution-vulnerability-in-wing-ftp-server"]},"CVE-2019-9621":{"p":[],"a":["https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories","https://wiki.zimbra.com/wiki/Security_Center","https://bugzilla.zimbra.com/show_bug.cgi?id=109127"]},"CVE-2019-5418":{"p":[],"a":["https://access.redhat.com/errata/RHSA-2019:0796","http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00011.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Y43636TH4D6T46IC6N2RQVJTRFJAAYGA/"]},"CVE-2016-10033":{"p":[],"a":["http://packetstormsecurity.com/files/140350/PHPMailer-Sendmail-Argument-Injection.html","https://www.drupal.org/psa-2016-004","https://www.exploit-db.com/exploits/42221/"]},"CVE-2014-3931":{"p":[],"a":["http://mrlg.op-sec.us/","http://www.s3.eurecom.fr/cve/CVE-2014-3931.txt","https://hackerone.com/reports/16330"]},"CVE-2025-6554":{"p":[{"p":"Google Chrome","f":["138.0.7204.96"],"u":[]}],"a":["https://chromereleases.googleblog.com/2025/06/stable-channel-update-for-desktop_30.html","https://issues.chromium.org/issues/427663123"]},"CVE-2025-48928":{"p":[{"p":"TeleMessage service","f":[],"u":["2025-05-05"]}],"a":["https://www.wired.com/story/how-the-signal-knock-off-app-telemessage-got-hacked-in-20-minutes/"]},"CVE-2025-48927":{"p":[{"p":"TeleMessage service","f":[],"u":["2025-05-05"]}],"a":["https://www.wired.com/story/how-the-signal-knock-off-app-telemessage-got-hacked-in-20-minutes/"]},"CVE-2025-6543":{"p":[{"p":"NetScaler ADC","f":["47.46","59.19","37.236"],"u":[]},{"p":"NetScaler Gateway","f":["47.46","59.19","37.236"],"u":[]}],"a":["https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX694788"]},"CVE-2019-6693":{"p":[],"a":["https://fortiguard.com/advisory/FG-IR-19-007"]},"CVE-2024-0769":{"p":[],"a":["https://vuldb.com/?id.251666","https://vuldb.com/?ctiid.251666","https://github.com/c2dc/cve-reported/blob/main/CVE-2024-0769/CVE-2024-0769.md"]},"CVE-2024-54085":{"p":[{"p":"AMI MegaRAC-SPx","f":["12.7","13.5"],"u":[]}],"a":["https://go.ami.com/hubfs/Security%20Advisories/2025/AMI-SA-2025003.pdf"]},"CVE-2023-0386":{"p":[],"a":["https://www.debian.org/security/2023/dsa-5402"]},"CVE-2023-33538":{"p":[],"a":["https://github.com/a101e-IoTvul/iotvul/blob/main/tp-link/3/TL-WR940N_TL-WR841N_userRpm_WlanNetworkRpm_Command_Injection.md","https://web.archive.org/web/20230609111043/https://github.com/a101e-IoTvul/iotvul/blob/main/tp-link/3/TL-WR940N_TL-WR841N_userRpm_WlanNetworkRpm_Command_Injection.md","https://www.secpod.com/blog/cisa-issues-warning-on-active-exploitation-of-tp-link-vulnerability-cve-2023-33538/"]},"CVE-2025-43200":{"p":[{"p":"Apple iOS and iPadOS","f":["15.8.4","16.7.11","18.3.1"],"u":[]},{"p":"Apple iPadOS","f":["17.7.5"],"u":[]},{"p":"Apple macOS","f":["13.7.4","14.7.4","15.3.1"],"u":[]},{"p":"Apple visionOS","f":["2.3.1"],"u":[]}],"a":["https://support.apple.com/en-us/122173","https://support.apple.com/en-us/122174","https://support.apple.com/en-us/122345"]},"CVE-2025-33053":{"p":[{"p":"Microsoft Windows 10 Version 1507","f":["10.0.10240.21034"],"u":[]},{"p":"Microsoft Windows 10 Version 1607","f":["10.0.14393.8148"],"u":[]},{"p":"Microsoft Windows 10 Version 1809","f":["10.0.17763.7434"],"u":[]},{"p":"Microsoft Windows 10 Version 21H2","f":["10.0.19044.5965"],"u":[]}],"a":["https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-33053"]},"CVE-2025-24016":{"p":[],"a":["https://github.com/wazuh/wazuh/security/advisories/GHSA-hcrc-79hj-m3qh"]},"CVE-2024-42009":{"p":[],"a":["https://github.com/roundcube/roundcubemail/releases","https://sonarsource.com/blog/government-emails-at-risk-critical-cross-site-scripting-vulnerability-in-roundcube-webmail/","https://github.com/roundcube/roundcubemail/releases/tag/1.5.8"]},"CVE-2025-5419":{"p":[{"p":"Google Chrome","f":["137.0.7151.68"],"u":[]}],"a":["https://chromereleases.googleblog.com/2025/06/stable-channel-update-for-desktop.html","https://issues.chromium.org/issues/420636529"]},"CVE-2025-21479":{"p":[],"a":["https://docs.qualcomm.com/product/publicresources/securitybulletin/june-2025-bulletin.html"]},"CVE-2025-21480":{"p":[],"a":["https://docs.qualcomm.com/product/publicresources/securitybulletin/june-2025-bulletin.html"]},"CVE-2025-27038":{"p":[],"a":["https://docs.qualcomm.com/product/publicresources/securitybulletin/june-2025-bulletin.html"]},"CVE-2021-32030":{"p":[],"a":["https://www.asus.com/Networking-IoT-Servers/WiFi-Routers/ASUS-Gaming-Routers/RT-AC2900/HelpDesk_BIOS/","https://github.com/atredispartners/advisories/blob/master/ATREDIS-2020-0010.md","https://www.atredis.com/blog/2021/4/30/asus-authentication-bypass"]},"CVE-2025-3935":{"p":[],"a":["https://www.connectwise.com/company/trust/security-bulletins/screenconnect-security-patch-2025.4","https://www.connectwise.com/company/trust/advisories"]},"CVE-2025-35939":{"p":[{"p":"Craft CMS","f":["5.7.5","4.15.3"],"u":[]}],"a":["https://github.com/craftcms/cms/pull/17220","https://github.com/craftcms/cms/releases/tag/4.15.3","https://github.com/craftcms/cms/releases/tag/5.7.5"]},"CVE-2024-56145":{"p":[],"a":["https://github.com/craftcms/cms/security/advisories/GHSA-2p6p-9rc9-62j9","https://github.com/craftcms/cms/commit/82e893fb794d30563da296bca31379c0df0079b3"]},"CVE-2023-39780":{"p":[],"a":["https://github.com/D2y6p/CVE/blob/main/asus/CVE-2023-39780/1/EN.md","https://github.com/D2y6p/CVE/blob/main/asus/CVE-2023-39780/2/EN.md","https://github.com/D2y6p/CVE/blob/main/asus/CVE-2023-39780/3/EN.md"]},"CVE-2025-4632":{"p":[{"p":"Samsung Electronics MagicINFO 9 Server","f":["21.1052"],"u":[]}],"a":["https://security.samsungtv.com/securityUpdates#SVP-MAY-2025"]},"CVE-2023-38950":{"p":[],"a":["https://claroty.com/team82/disclosure-dashboard/cve-2023-38950"]},"CVE-2024-27443":{"p":[],"a":["https://wiki.zimbra.com/wiki/Zimbra_Releases/10.0.7#Security_Fixes","https://wiki.zimbra.com/wiki/Zimbra_Releases/9.0.0/P39#Security_Fixes"]},"CVE-2025-27920":{"p":[{"p":"Srimax Output Messenger","f":["2.0.63"],"u":[]}],"a":["https://www.srimax.com/products-2/output-messenger/","https://www.outputmessenger.com/cve-2025-27920/"]},"CVE-2024-11182":{"p":[{"p":"MDaemon Email Server","f":[],"u":["24.5.0"]}],"a":["https://files.mdaemon.com/mdaemon/beta/RelNotes_en.html"]},"CVE-2025-4428":{"p":[],"a":["https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Endpoint-Manager-Mobile-EPMM"]},"CVE-2025-4427":{"p":[],"a":["https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Endpoint-Manager-Mobile-EPMM"]},"CVE-2025-42999":{"p":[],"a":["https://me.sap.com/notes/3604119","https://url.sap/sapsecuritypatchday"]},"CVE-2024-12987":{"p":[],"a":["https://vuldb.com/?id.289380","https://vuldb.com/?ctiid.289380","https://vuldb.com/?submit.468795"]},"CVE-2025-32756":{"p":[{"p":"Fortinet FortiNDR","f":[],"u":["7.4.7","7.2.4","7.1.1"]},{"p":"Fortinet FortiCamera","f":[],"u":["2.1.3","1.1.5"]},{"p":"Fortinet FortiRecorder","f":[],"u":["7.2.3","7.0.5","6.4.5"]},{"p":"Fortinet FortiVoice","f":[],"u":["7.0.6","6.4.10"]}],"a":["https://fortiguard.fortinet.com/psirt/FG-IR-25-254"]},"CVE-2025-32709":{"p":[{"p":"Microsoft Windows 10 Version 1507","f":["10.0.10240.21014"],"u":[]},{"p":"Microsoft Windows 10 Version 1607","f":["10.0.14393.8066"],"u":[]},{"p":"Microsoft Windows 10 Version 1809","f":["10.0.17763.7314"],"u":[]},{"p":"Microsoft Windows 10 Version 21H2","f":["10.0.19044.5854"],"u":[]}],"a":["https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-32709"]},"CVE-2025-30397":{"p":[{"p":"Microsoft Windows 10 Version 1507","f":["10.0.10240.21014"],"u":[]},{"p":"Microsoft Windows 10 Version 1607","f":["10.0.14393.8066"],"u":[]},{"p":"Microsoft Windows 10 Version 1809","f":["10.0.17763.7314"],"u":[]},{"p":"Microsoft Windows 10 Version 21H2","f":["10.0.19044.5854"],"u":[]}],"a":["https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-30397"]},"CVE-2025-32706":{"p":[{"p":"Microsoft Windows 10 Version 1507","f":["10.0.10240.21014"],"u":[]},{"p":"Microsoft Windows 10 Version 1607","f":["10.0.14393.8066"],"u":[]},{"p":"Microsoft Windows 10 Version 1809","f":["10.0.17763.7314"],"u":[]},{"p":"Microsoft Windows 10 Version 21H2","f":["10.0.19044.5854"],"u":[]}],"a":["https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-32706"]},"CVE-2025-32701":{"p":[{"p":"Microsoft Windows 10 Version 1507","f":["10.0.10240.21014"],"u":[]},{"p":"Microsoft Windows 10 Version 1607","f":["10.0.14393.8066"],"u":[]},{"p":"Microsoft Windows 10 Version 1809","f":["10.0.17763.7314"],"u":[]},{"p":"Microsoft Windows 10 Version 21H2","f":["10.0.19044.5854"],"u":[]}],"a":["https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-32701"]},"CVE-2025-30400":{"p":[{"p":"Microsoft Windows 10 Version 1809","f":["10.0.17763.7314"],"u":[]},{"p":"Microsoft Windows 10 Version 21H2","f":["10.0.19044.5854"],"u":[]},{"p":"Microsoft Windows 10 Version 22H2","f":["10.0.19045.5854"],"u":[]},{"p":"Microsoft Windows 11 version 22H2","f":["10.0.22621.5335"],"u":[]}],"a":["https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-30400"]},"CVE-2025-47729":{"p":[{"p":"TeleMessage archiving backend","f":[],"u":["2025-05-05"]}],"a":["https://news.ycombinator.com/item?id=43909220","https://arstechnica.com/security/2025/05/signal-clone-used-by-trump-official-stops-operations-after-report-it-was-hacked/","https://www.theregister.com/2025/05/05/telemessage_investigating/"]},"CVE-2024-11120":{"p":[],"a":["https://www.twcert.org.tw/tw/cp-132-8236-d4836-1.html","https://www.twcert.org.tw/en/cp-139-8237-26d7a-2.html"]},"CVE-2024-6047":{"p":[],"a":["https://www.twcert.org.tw/tw/cp-132-7883-f5635-1.html","https://www.twcert.org.tw/en/cp-139-7884-c5a8b-2.html"]},"CVE-2025-27363":{"p":[{"p":"FreeType FreeType","f":[],"u":["2.13.0"]}],"a":["https://www.facebook.com/security/advisories/cve-2025-27363"]},"CVE-2025-3248":{"p":[{"p":"langflow-ai langflow","f":["1.3.0"],"u":[]}],"a":["https://github.com/langflow-ai/langflow/releases/tag/1.3.0"]},"CVE-2025-34028":{"p":[{"p":"Commvault Command Center Innovation Release","f":[],"u":["11.38.25"]}],"a":["https://documentation.commvault.com/securityadvisories/CV_2025_04_1.html"]},"CVE-2024-58136":{"p":[{"p":"yiiframework Yii","f":["2.0.52"],"u":[]}],"a":["https://github.com/yiisoft/yii2/pull/20232","https://github.com/yiisoft/yii2/pull/20232#issuecomment-2252459709","https://github.com/yiisoft/yii2/commit/40fe496eda529fd1d933b56a1022ec32d3cd0b12"]},"CVE-2024-38475":{"p":[{"p":"Apache Software Foundation Apache HTTP Server","f":[],"u":["2.4.59"]}],"a":["https://httpd.apache.org/security/vulnerabilities_24.html"]},"CVE-2023-44221":{"p":[],"a":["https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2023-0018"]},"CVE-2025-1976":{"p":[],"a":["https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/25602"]},"CVE-2025-42599":{"p":[],"a":["https://www.qualitia.com/jp/news/2025/04/18_1030.html","https://jvn.jp/en/jp/JVN22348866/"]},"CVE-2025-3928":{"p":[{"p":"Commvault Web Server","f":["11.36.46","11.32.89","11.28.141","11.20.217"],"u":[]}],"a":["https://documentation.commvault.com/securityadvisories/CV_2025_03_1.html","https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-3928","https://www.commvault.com/blogs/security-advisory-march-7-2025"]},"CVE-2025-24054":{"p":[{"p":"Microsoft Windows 10 Version 1507","f":["10.0.10240.20947"],"u":[]},{"p":"Microsoft Windows 10 Version 1607","f":["10.0.14393.7876"],"u":[]},{"p":"Microsoft Windows 10 Version 1809","f":["10.0.17763.7009"],"u":[]},{"p":"Microsoft Windows 10 Version 21H2","f":["10.0.19044.5608"],"u":[]}],"a":["https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-24054"]},"CVE-2025-31201":{"p":[{"p":"Apple iOS and iPadOS","f":["18.4.1"],"u":[]},{"p":"Apple macOS","f":["15.4.1"],"u":[]},{"p":"Apple tvOS","f":["18.4.1"],"u":[]},{"p":"Apple visionOS","f":["2.4.1"],"u":[]}],"a":["https://support.apple.com/en-us/122282","https://support.apple.com/en-us/122400","https://support.apple.com/en-us/122401"]},"CVE-2025-31200":{"p":[{"p":"Apple iOS and iPadOS","f":["18.4.1"],"u":[]},{"p":"Apple macOS","f":["15.4.1"],"u":[]},{"p":"Apple tvOS","f":["18.4.1"],"u":[]},{"p":"Apple visionOS","f":["2.4.1"],"u":[]}],"a":["https://support.apple.com/en-us/122282","https://support.apple.com/en-us/122400","https://support.apple.com/en-us/122401"]},"CVE-2021-20035":{"p":[],"a":["https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0022"]},"CVE-2024-53150":{"p":[{"p":"Linux Linux","f":["a632bdcb359fd8145e86486ff8612da98e239acd","45a92cbc88e4013bfed7fd2ccab3ade45f8e896b","ab011f7439d9bbfd34fd3b9cef4b2d6d952c9bb9","da13ade87a12dd58829278bc816a61bea06a56a9","74cb86e1006c5437b1d90084d22018da30fddc77"],"u":[]}],"a":["https://git.kernel.org/stable/c/a632bdcb359fd8145e86486ff8612da98e239acd","https://git.kernel.org/stable/c/45a92cbc88e4013bfed7fd2ccab3ade45f8e896b","https://git.kernel.org/stable/c/ab011f7439d9bbfd34fd3b9cef4b2d6d952c9bb9"]},"CVE-2024-53197":{"p":[{"p":"Linux Linux","f":["0b4ea4bfe16566b84645ded1403756a2dc4e0f19","9b8460a2a7ce478e0b625af7c56d444dc24190f7","62dc01c83fa71e10446ee4c31e0e3d5d1291e865","9887d859cd60727432a01564e8f91302d361b72b","920a369a9f014f10ec282fd298d0666129379f1b"],"u":[]}],"a":["https://git.kernel.org/stable/c/0b4ea4bfe16566b84645ded1403756a2dc4e0f19","https://git.kernel.org/stable/c/9b8460a2a7ce478e0b625af7c56d444dc24190f7","https://git.kernel.org/stable/c/62dc01c83fa71e10446ee4c31e0e3d5d1291e865"]},"CVE-2025-30406":{"p":[{"p":"Gladinet CentreStack","f":["16.4.10315.56368"],"u":[]}],"a":["https://www.centrestack.com/p/gce_latest_release.html","https://gladinetsupport.s3.us-east-1.amazonaws.com/gladinet/securityadvisory-cve-2005.pdf"]},"CVE-2025-31161":{"p":[{"p":"CrushFTP CrushFTP","f":["10.8.4","11.3.1"],"u":[]}],"a":["https://outpost24.com/blog/crushftp-auth-bypass-vulnerability/","https://crushftp.com/crush11wiki/Wiki.jsp?page=Update#section-Update-VulnerabilityInfo"]},"CVE-2025-22457":{"p":[],"a":["https://forums.ivanti.com/s/article/April-Security-Advisory-Ivanti-Connect-Secure-Policy-Secure-ZTA-Gateways-CVE-2025-22457"]},"CVE-2025-24813":{"p":[{"p":"Apache Software Foundation Apache Tomcat","f":[],"u":["11.0.2","10.1.34","9.0.98"]}],"a":["https://lists.apache.org/thread/j5fkjv2k477os90nczf2v9l61fb0kkgq"]},"CVE-2024-20439":{"p":[],"a":["https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cslu-7gHMzWmw"]},"CVE-2025-2783":{"p":[{"p":"Google Chrome","f":["134.0.6998.177"],"u":[]}],"a":["https://chromereleases.googleblog.com/2025/03/stable-channel-update-for-desktop_25.html","https://issues.chromium.org/issues/405143032"]},"CVE-2019-9875":{"p":[],"a":["https://dev.sitecore.net/Downloads.aspx","https://www.synacktiv.com/blog.html","https://www.synacktiv.com/ressources/advisories/Sitecore_CSRF_deserialize_RCE.pdf"]},"CVE-2019-9874":{"p":[],"a":["https://dev.sitecore.net/Downloads.aspx","https://www.synacktiv.com/blog.html","https://www.synacktiv.com/ressources/advisories/Sitecore_CSRF_deserialize_RCE.pdf"]},"CVE-2025-30154":{"p":[],"a":["https://github.com/reviewdog/reviewdog/security/advisories/GHSA-qmg3-hpqr-gqvc","https://github.com/reviewdog/reviewdog/issues/2079","https://github.com/reviewdog/action-setup/commit/3f401fe1d58fe77e10d665ab713057375e39b887"]},"CVE-2017-12637":{"p":[],"a":["https://web.archive.org/web/20170807202056/http://www.sh0w.top/index.php/archives/7/"]},"CVE-2024-48248":{"p":[{"p":"NAKIVO Backup & Replication Director","f":["11.0.0.88174"],"u":[]}],"a":["https://labs.watchtowr.com/the-best-security-is-when-we-all-agree-to-keep-everything-secret-except-the-secrets-nakivo-backup-replication-cve-2024-48248/","https://helpcenter.nakivo.com/Release-Notes/Content/Release-Notes.htm"]},"CVE-2025-1316":{"p":[],"a":["https://www.cisa.gov/news-events/ics-advisories/icsa-25-063-08"]},"CVE-2025-30066":{"p":[{"p":"tj-actions changed-files","f":["46"],"u":[]}],"a":["https://github.com/github/docs/blob/962a1c8dccb8c0f66548b324e5b921b5e4fbc3d6/content/actions/security-for-github-actions/security-guides/security-hardening-for-github-actions.md?plain=1#L191-L193","https://github.com/tj-actions/changed-files/issues/2463","https://www.stepsecurity.io/blog/harden-runner-detection-tj-actions-changed-files-action-is-compromised"]},"CVE-2025-24472":{"p":[{"p":"Fortinet FortiOS","f":[],"u":["7.0.16"]},{"p":"Fortinet FortiProxy","f":[],"u":["7.2.12","7.0.19"]}],"a":["https://fortiguard.fortinet.com/psirt/FG-IR-24-535"]},"CVE-2025-21590":{"p":[{"p":"Juniper Networks Junos OS","f":["21.2R3-S9","21.4R3-S10","22.2R3-S6","22.4R3-S6","23.2R2-S3"],"u":[]}],"a":["https://supportportal.juniper.net/JSA93446"]},"CVE-2025-24201":{"p":[{"p":"Apple Safari","f":["18.3.1"],"u":[]},{"p":"Apple iOS and iPadOS","f":["15.8.4","16.7.11","18.3.2"],"u":[]},{"p":"Apple iPadOS","f":["17.7.6"],"u":[]},{"p":"Apple macOS","f":["15.3.2"],"u":[]}],"a":["https://support.apple.com/en-us/122281","https://support.apple.com/en-us/122283","https://support.apple.com/en-us/122284"]},"CVE-2025-24993":{"p":[{"p":"Microsoft Windows 10 Version 1507","f":["10.0.10240.20947"],"u":[]},{"p":"Microsoft Windows 10 Version 1607","f":["10.0.14393.7876"],"u":[]},{"p":"Microsoft Windows 10 Version 1809","f":["10.0.17763.7009"],"u":[]},{"p":"Microsoft Windows 10 Version 21H2","f":["10.0.19044.5608"],"u":[]}],"a":["https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-24993"]},"CVE-2025-24991":{"p":[{"p":"Microsoft Windows 10 Version 1507","f":["10.0.10240.20947"],"u":[]},{"p":"Microsoft Windows 10 Version 1607","f":["10.0.14393.7876"],"u":[]},{"p":"Microsoft Windows 10 Version 1809","f":["10.0.17763.7009"],"u":[]},{"p":"Microsoft Windows 10 Version 21H2","f":["10.0.19044.5608"],"u":[]}],"a":["https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-24991"]},"CVE-2025-24985":{"p":[{"p":"Microsoft Windows 10 Version 1507","f":["10.0.10240.20947"],"u":[]},{"p":"Microsoft Windows 10 Version 1607","f":["10.0.14393.7876"],"u":[]},{"p":"Microsoft Windows 10 Version 1809","f":["10.0.17763.7009"],"u":[]},{"p":"Microsoft Windows 10 Version 21H2","f":["10.0.19044.5608"],"u":[]}],"a":["https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-24985"]},"CVE-2025-24984":{"p":[{"p":"Microsoft Windows 10 Version 1507","f":["10.0.10240.20947"],"u":[]},{"p":"Microsoft Windows 10 Version 1607","f":["10.0.14393.7876"],"u":[]},{"p":"Microsoft Windows 10 Version 1809","f":["10.0.17763.7009"],"u":[]},{"p":"Microsoft Windows 10 Version 21H2","f":["10.0.19044.5608"],"u":[]}],"a":["https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-24984"]},"CVE-2025-24983":{"p":[{"p":"Microsoft Windows 10 Version 1507","f":["10.0.10240.20947"],"u":[]},{"p":"Microsoft Windows 10 Version 1607","f":["10.0.14393.7876"],"u":[]},{"p":"Microsoft Windows Server 2008 R2 Service Pack 1","f":["6.1.7601.27618"],"u":[]},{"p":"Microsoft Windows Server 2008 R2 Service Pack 1 (Server Core installation)","f":["6.1.7601.27618"],"u":[]}],"a":["https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-24983"]},"CVE-2025-26633":{"p":[{"p":"Microsoft Windows 10 Version 1507","f":["10.0.10240.20947"],"u":[]},{"p":"Microsoft Windows 10 Version 1607","f":["10.0.14393.7876"],"u":[]},{"p":"Microsoft Windows 10 Version 1809","f":["10.0.17763.7009"],"u":[]},{"p":"Microsoft Windows 10 Version 21H2","f":["10.0.19044.5608"],"u":[]}],"a":["https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-26633"]},"CVE-2024-13161":{"p":[],"a":["https://forums.ivanti.com/s/article/Security-Advisory-EPM-January-2025-for-EPM-2024-and-EPM-2022-SU6"]},"CVE-2024-13160":{"p":[],"a":["https://forums.ivanti.com/s/article/Security-Advisory-EPM-January-2025-for-EPM-2024-and-EPM-2022-SU6"]},"CVE-2024-13159":{"p":[],"a":["https://forums.ivanti.com/s/article/Security-Advisory-EPM-January-2025-for-EPM-2024-and-EPM-2022-SU6"]},"CVE-2024-57968":{"p":[{"p":"Advantive VeraCore","f":["2024.4.2.1"],"u":[]}],"a":["https://advantive.my.site.com/support/s/article/VeraCore-Release-Notes-2024-4-2-1","https://intezer.com/blog/research/xe-group-exploiting-zero-days/","https://www.solissecurity.com/en-us/insights/xe-group-from-credit-card-skimming-to-exploiting-zero-days/"]},"CVE-2025-25181":{"p":[{"p":"Advantive VeraCore","f":[],"u":["2025.1.0"]}],"a":["https://advantive.my.site.com/support/s/knowledge","https://intezer.com/blog/research/xe-group-exploiting-zero-days/","https://www.solissecurity.com/en-us/insights/xe-group-from-credit-card-skimming-to-exploiting-zero-days/"]},"CVE-2025-22226":{"p":[{"p":"ESXi","f":["ESXi80U3d-24585383","ESXi80U2d-24585300","ESXi70U3s-24585291"],"u":[]},{"p":"VMware Workstation","f":["17.6.3"],"u":[]},{"p":"VMware Fusion","f":["13.6.3"],"u":[]}],"a":["https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/25390"]},"CVE-2025-22225":{"p":[{"p":"VMware ESXi","f":["ESXi80U3d-24585383","ESXi80U2d-24585300","ESXi70U3s-24585291"],"u":[]}],"a":["https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/25390"]},"CVE-2025-22224":{"p":[{"p":"VMware ESXi","f":["ESXi80U3d-24585383","ESXi80U2d-24585300","ESXi70U3s-24585291"],"u":[]},{"p":"VMware Workstation","f":["17.6.3"],"u":[]}],"a":["https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/25390"]},"CVE-2024-50302":{"p":[{"p":"Linux Linux","f":["e7ea60184e1e88a3c9e437b3265cbb6439aa7e26","3f9e88f2672c4635960570ee9741778d4135ecf5","d7dc68d82ab3fcfc3f65322465da3d7031d4ab46","05ade5d4337867929e7ef664e7ac8e0c734f1aaf","1884ab3d22536a5c14b17c78c2ce76d1734e8b0b"],"u":[]}],"a":["https://git.kernel.org/stable/c/e7ea60184e1e88a3c9e437b3265cbb6439aa7e26","https://git.kernel.org/stable/c/3f9e88f2672c4635960570ee9741778d4135ecf5","https://git.kernel.org/stable/c/d7dc68d82ab3fcfc3f65322465da3d7031d4ab46"]},"CVE-2024-4885":{"p":[{"p":"Progress Software Corporation WhatsUp Gold","f":["2023.1.3"],"u":[]}],"a":["https://community.progress.com/s/article/WhatsUp-Gold-Security-Bulletin-June-2024"]},"CVE-2018-8639":{"p":[],"a":["http://www.securityfocus.com/bid/106093","https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8639"]},"CVE-2022-43769":{"p":[{"p":"Hitachi Vantara Pentaho Business Analytics Server","f":["9.3.0.2","9.4.0.1"],"u":[]}],"a":["https://support.pentaho.com/hc/en-us/articles/14455561548301--Resolved-Pentaho-BA-Server-Failure-to-Sanitize-Special-Elements-into-a-Different-Plane-Special-Element-Injection-Versions-before-9-4-0-1-and-9-3-0-2-including-8-3-x-Impacted-CVE-2022-43769-","http://packetstormsecurity.com/files/172296/Pentaho-Business-Server-Authentication-Bypass-SSTI-Code-Execution.html"]},"CVE-2022-43939":{"p":[{"p":"Hitachi Vantara Pentaho Business Analytics Server","f":["9.3.0.2","9.4.0.1"],"u":[]}],"a":["https://support.pentaho.com/hc/en-us/articles/14455394120333--Resolved-Pentaho-BA-Server-Use-of-Non-Canonical-URL-Paths-for-Authorization-Decisions-Versions-before-9-4-0-1-and-9-3-0-2-including-8-3-x-Impacted-CVE-2022-43939-","http://packetstormsecurity.com/files/172296/Pentaho-Business-Server-Authentication-Bypass-SSTI-Code-Execution.html"]},"CVE-2023-20118":{"p":[],"a":["https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sbr042-multi-vuln-ej76Pke5"]},"CVE-2023-34192":{"p":[],"a":["https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories","https://wiki.zimbra.com/wiki/Security_Center","https://wiki.zimbra.com/wiki/Zimbra_Responsible_Disclosure_Policy"]},"CVE-2024-49035":{"p":[],"a":["https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-49035"]},"CVE-2024-20953":{"p":[],"a":["https://www.oracle.com/security-alerts/cpujan2024.html"]},"CVE-2017-3066":{"p":[],"a":["https://www.exploit-db.com/exploits/43993/","https://helpx.adobe.com/security/products/coldfusion/apsb17-14.html","http://www.securityfocus.com/bid/98003"]},"CVE-2025-24989":{"p":[],"a":["https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-24989"]},"CVE-2025-0111":{"p":[{"p":"Palo Alto Networks PAN-OS","f":["10.1.14-h9","10.2.7-h24","10.2.8-h21","10.2.9-h21","10.2.12-h6"],"u":[]}],"a":["https://security.paloaltonetworks.com/CVE-2025-0111"]},"CVE-2025-23209":{"p":[],"a":["https://github.com/craftcms/cms/security/advisories/GHSA-x684-96hh-833x","https://github.com/craftcms/cms/commit/e59e22b30c9dd39e5e2c7fe02c147bcbd004e603","https://craftcms.com/knowledge-base/securing-craft#keep-your-secrets-secret"]},"CVE-2025-0108":{"p":[{"p":"Palo Alto Networks PAN-OS","f":["10.1.14-h9","10.2.7-h24","10.2.8-h21","10.2.9-h21","10.2.12-h6"],"u":[]}],"a":["https://security.paloaltonetworks.com/CVE-2025-0108"]},"CVE-2024-53704":{"p":[],"a":["https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2025-0003"]},"CVE-2024-57727":{"p":[],"a":["https://www.horizon3.ai/attack-research/disclosures/critical-vulnerabilities-in-simplehelp-remote-support-software/","https://simple-help.com/kb---security-vulnerabilities-01-2025#security-vulnerabilities-in-simplehelp-5-5-7-and-earlier"]},"CVE-2025-24200":{"p":[{"p":"Apple iOS and iPadOS","f":["15.8.4","16.7.11","18.3.1"],"u":[]},{"p":"Apple iPadOS","f":["17.7.5"],"u":[]}],"a":["https://support.apple.com/en-us/122173","https://support.apple.com/en-us/122174","https://support.apple.com/en-us/122345"]},"CVE-2024-41710":{"p":[],"a":["https://www.mitel.com/support/security-advisories","https://github.com/kwburns/CVE/blob/main/Mitel/6.3.0.1020/README.md","https://www.mitel.com/support/security-advisories/mitel-product-security-advisory-24-0019"]},"CVE-2024-40891":{"p":[],"a":["https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-command-injection-and-insecure-default-credentials-vulnerabilities-in-certain-legacy-dsl-cpe-02-04-2025"]},"CVE-2024-40890":{"p":[],"a":["https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-command-injection-and-insecure-default-credentials-vulnerabilities-in-certain-legacy-dsl-cpe-02-04-2025"]},"CVE-2025-21418":{"p":[{"p":"Microsoft Windows 10 Version 1507","f":["10.0.10240.20915"],"u":[]},{"p":"Microsoft Windows 10 Version 1607","f":["10.0.14393.7785"],"u":[]},{"p":"Microsoft Windows 10 Version 1809","f":["10.0.17763.6893"],"u":[]},{"p":"Microsoft Windows 10 Version 21H2","f":["10.0.19044.5487"],"u":[]}],"a":["https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21418"]},"CVE-2025-21391":{"p":[{"p":"Microsoft Windows 10 Version 1507","f":["10.0.10240.20915"],"u":[]},{"p":"Microsoft Windows 10 Version 1607","f":["10.0.14393.7785"],"u":[]},{"p":"Microsoft Windows 10 Version 1809","f":["10.0.17763.6893"],"u":[]},{"p":"Microsoft Windows 10 Version 21H2","f":["10.0.19044.5487"],"u":[]}],"a":["https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21391"]},"CVE-2025-0994":{"p":[{"p":"Trimble Cityworks","f":["15.8.9"],"u":[]},{"p":"Trimble Cityworks (with office companion)","f":["23.10"],"u":[]}],"a":["https://learn.assetlifecycle.trimble.com/i/1532182-cityworks-customer-communication-2025-02-05-docx/0?"]},"CVE-2020-15069":{"p":[],"a":["https://community.sophos.com/b/security-blog/posts/advisory-buffer-overflow-vulnerability-in-user-portal"]},"CVE-2020-29574":{"p":[],"a":["https://www.cyberoam.com/ngfw.html","https://www.bleepingcomputer.com/news/security/sophos-fixes-sql-injection-vulnerability-in-their-cyberoam-os/"]},"CVE-2024-21413":{"p":[{"p":"Microsoft Microsoft 365 Apps for Enterprise","f":["https://aka.ms/OfficeSecurityReleases"],"u":[]},{"p":"Microsoft Microsoft Office 2016","f":["16.0.5435.1001"],"u":[]},{"p":"Microsoft Microsoft Office 2019","f":["https://aka.ms/OfficeSecurityReleases"],"u":[]},{"p":"Microsoft Microsoft Office LTSC 2021","f":["https://aka.ms/OfficeSecurityReleases"],"u":[]}],"a":["https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-21413"]},"CVE-2022-23748":{"p":[],"a":["https://cpr-zero.checkpoint.com/vulns/cprid-2193/%2C","https://www.audinate.com/learning/faqs/audinate-response-to-dante-discovery-mdnsresponder-exe-security-issue-cve-2022-23748"]},"CVE-2025-0411":{"p":[],"a":["https://www.zerodayinitiative.com/advisories/ZDI-25-045/"]},"CVE-2024-53104":{"p":[{"p":"Linux Linux","f":["95edf13a48e75dc2cc5b0bc57bf90d6948a22fe8","684022f81f128338fe3587ec967459669a1204ae","faff5bbb2762c44ec7426037b3000e77a11d6773","467d84dc78c9abf6b217ada22b3fdba336262e29","beced2cb09b58c1243733f374c560a55382003d6"],"u":[]}],"a":["https://git.kernel.org/stable/c/95edf13a48e75dc2cc5b0bc57bf90d6948a22fe8","https://git.kernel.org/stable/c/684022f81f128338fe3587ec967459669a1204ae","https://git.kernel.org/stable/c/faff5bbb2762c44ec7426037b3000e77a11d6773"]},"CVE-2018-19410":{"p":[],"a":["https://www.ptsecurity.com/ww-en/analytics/threatscape/pt-2018-24/"]},"CVE-2018-9276":{"p":[],"a":["http://packetstormsecurity.com/files/148334/PRTG-Command-Injection.html","https://www.exploit-db.com/exploits/46527/","http://www.securityfocus.com/archive/1/542103/100/0/threaded"]},"CVE-2024-29059":{"p":[{"p":"Microsoft Microsoft .NET Framework 4.8","f":["4.8.04690.02"],"u":[]},{"p":"Microsoft Microsoft .NET Framework 3.5 AND 4.8","f":["4.8.04690.02"],"u":[]},{"p":"Microsoft Microsoft .NET Framework 3.5 AND 4.7.2","f":["4.7.04081.03"],"u":[]},{"p":"Microsoft Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2","f":["4.7.04081.03"],"u":[]}],"a":["https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-29059"]},"CVE-2024-45195":{"p":[{"p":"Apache Software Foundation Apache OFBiz","f":["18.12.16"],"u":[]}],"a":["https://ofbiz.apache.org/download.html","https://ofbiz.apache.org/security.html","https://lists.apache.org/thread/o90dd9lbk1hh3t2557t2y2qvrh92p7wy"]},"CVE-2025-24085":{"p":[{"p":"Apple iOS and iPadOS","f":["18.3"],"u":[]},{"p":"Apple iPadOS","f":["17.7.6"],"u":[]},{"p":"Apple macOS","f":["13.7.5","14.7.5","15.3"],"u":[]},{"p":"Apple tvOS","f":["18.3"],"u":[]}],"a":["https://support.apple.com/en-us/122066","https://support.apple.com/en-us/122068","https://support.apple.com/en-us/122071"]},"CVE-2025-23006":{"p":[],"a":["https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2025-0002"]},"CVE-2020-11023":{"p":[],"a":["https://www.debian.org/security/2020/dsa-4693","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QPN2L2XVQGUA2V5HNQJWHK3APSK3VN7K/","http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00067.html"]},"CVE-2024-50603":{"p":[{"p":"Aviatrix Controller","f":["7.1.4191","7.2.4996"],"u":[]}],"a":["https://docs.aviatrix.com/documentation/latest/network-security/index.html","https://docs.aviatrix.com/documentation/latest/release-notices/psirt-advisories/psirt-advisories.html?expand=true#remote-code-execution-vulnerability-in-aviatrix-controllers","https://www.securing.pl/en/cve-2024-50603-aviatrix-network-controller-command-injection-vulnerability/"]},"CVE-2025-21335":{"p":[{"p":"Microsoft Windows 10 Version 21H2","f":["10.0.19044.5371"],"u":[]},{"p":"Microsoft Windows 10 Version 22H2","f":["10.0.19045.5371"],"u":[]},{"p":"Microsoft Windows 11 version 22H2","f":["10.0.22621.4751"],"u":[]},{"p":"Microsoft Windows 11 version 22H3","f":["10.0.22631.4751"],"u":[]}],"a":["https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21335"]},"CVE-2025-21334":{"p":[{"p":"Microsoft Windows 10 Version 21H2","f":["10.0.19044.5371"],"u":[]},{"p":"Microsoft Windows 10 Version 22H2","f":["10.0.19045.5371"],"u":[]},{"p":"Microsoft Windows 11 version 22H2","f":["10.0.22621.4751"],"u":[]},{"p":"Microsoft Windows 11 version 22H3","f":["10.0.22631.4751"],"u":[]}],"a":["https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21334"]},"CVE-2025-21333":{"p":[{"p":"Microsoft Windows 10 Version 21H2","f":["10.0.19044.5371"],"u":[]},{"p":"Microsoft Windows 10 Version 22H2","f":["10.0.19045.5371"],"u":[]},{"p":"Microsoft Windows 11 version 22H2","f":["10.0.22621.4751"],"u":[]},{"p":"Microsoft Windows 11 version 22H3","f":["10.0.22631.4751"],"u":[]}],"a":["https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21333"]},"CVE-2024-55591":{"p":[{"p":"Fortinet FortiOS","f":[],"u":["7.0.16"]},{"p":"Fortinet FortiProxy","f":[],"u":["7.2.12","7.0.19"]}],"a":["https://fortiguard.fortinet.com/psirt/FG-IR-24-535"]},"CVE-2023-48365":{"p":[],"a":["https://community.qlik.com/t5/Official-Support-Articles/Critical-Security-fixes-for-Qlik-Sense-Enterprise-for-Windows/tac-p/2120510"]},"CVE-2024-12686":{"p":[{"p":"BeyondTrust Remote Support(RS) & Privileged Remote Access(PRA)","f":[],"u":["24.3.1"]}],"a":["https://www.beyondtrust.com/trust-center/security-advisories/bt24-11"]},"CVE-2020-2883":{"p":[],"a":["https://www.oracle.com/security-alerts/cpuapr2020.html","https://www.zerodayinitiative.com/advisories/ZDI-20-504/","https://www.zerodayinitiative.com/advisories/ZDI-20-570/"]},"CVE-2024-55550":{"p":[],"a":["https://www.mitel.com/support/security-advisories","https://www.mitel.com/support/security-advisories/mitel-product-security-advisory-misa-2024-0029"]},"CVE-2024-41713":{"p":[],"a":["https://www.mitel.com/support/security-advisories/mitel-product-security-advisory-misa-2024-0029"]},"CVE-2026-109686":{"p":[{"p":"Link Whisper INC Link Whisper Free","f":["0.9.8"],"u":["0.9.7"]}],"a":["https://patchstack.com/database/wordpress/plugin/link-whisper/vulnerability/wordpress-link-whisper-free-plugin-0-9-7-php-object-injection-vulnerability?_s_id=cve"]},"CVE-2026-109688":{"p":[{"p":"Link Whisper INC Link Whisper Free","f":["0.9.8"],"u":["0.9.7"]}],"a":["https://patchstack.com/database/wordpress/plugin/link-whisper/vulnerability/wordpress-link-whisper-free-plugin-0-9-7-sql-injection-vulnerability-2?_s_id=cve"]},"CVE-2026-109698":{"p":[{"p":"Kitae Park Mang Board WP","f":["2.4.5"],"u":["2.4.4"]}],"a":["https://patchstack.com/database/wordpress/plugin/mangboard/vulnerability/wordpress-mang-board-wp-plugin-2-4-4-sql-injection-vulnerability?_s_id=cve"]},"CVE-2026-109892":{"p":[{"p":"Shabti Kaplan Frontend Admin by DynamiApps","f":[],"u":["3.29.13"]}],"a":["https://patchstack.com/database/wordpress/plugin/acf-frontend-form-element/vulnerability/wordpress-frontend-admin-by-dynamiapps-plugin-3-29-13-privilege-escalation-vulnerability?_s_id=cve"]},"CVE-2026-110957":{"p":[],"a":["https://dl.wavlink.com/firmware/RD/WN530BE2_WAVLINK-WO-2026-09-24-841a51c6d5_tclinux.bin"]},"CVE-2026-47168":{"p":[],"a":["https://github.com/espocrm/espocrm/security/advisories/GHSA-7q78-jjr9-mqcg","https://github.com/espocrm/espocrm/commit/f48d1d26ffa05eac07ef72bb7f00f67a851184e1","https://github.com/espocrm/espocrm/releases/tag/9.3.7"]},"CVE-2026-105474":{"p":[{"p":"WebPros SolusVM 2","f":[],"u":["2.0.0-44576"]}],"a":["https://support.solusvm.com/hc/en-us/articles/44057968061591-CVE-2026-105474-Server-Side-Template-Injection-in-SolusVM-2"]},"CVE-2026-110958":{"p":[],"a":["https://dl.wavlink.com/firmware/RD/WN530BE2_WAVLINK-WO-2026-09-24-841a51c6d5_tclinux.bin"]},"CVE-2026-111094":{"p":[{"p":"JetBrains TeamCity","f":["2026.2, \n2026.1.4, \n2025.11.8"],"u":[]}],"a":["https://www.jetbrains.com/privacy-security/issues-fixed/"]},"CVE-2026-57155":{"p":[],"a":["https://github.com/opnsense/core/security/advisories/GHSA-wjqq-rfmm-v5h3","https://github.com/opnsense/core/commit/c46aced9c47d956167e294911113bc334fea5f48","https://github.com/opnsense/core/commit/e7fbfaa7f5e070da667e3f243da11fd3d4b731fa"]},"CVE-2026-110812":{"p":[{"p":"AWS Amazon Neptune Engine","f":["1.5.0.0"],"u":[]}],"a":["https://docs.aws.amazon.com/neptune/latest/userguide/engine-releases-1.5.0.0.html","https://docs.aws.amazon.com/neptune/latest/userguide/engine-releases-1.4.7.1.html","https://docs.aws.amazon.com/neptune/latest/userguide/engine-releases-1.4.8.1.html"]},"CVE-2026-84731":{"p":[{"p":"Nutanix Acropolis Operating System (AOS)","f":["7.3.1.18","7.5.2","7.6.0.8"],"u":[]}],"a":["https://download.nutanix.com/alerts/Security_Advisory_0058.pdf","https://portal.nutanix.com/page/documents/list?type=software&filterKey=software&filterVal=AOS"]},"CVE-2026-102946":{"p":[],"a":["https://github.com/authlib/joserfc/security/advisories/GHSA-4pp3-559j-c5c2","https://github.com/authlib/joserfc/commit/f409f8f058225d7686acab6546c94593e4c1bfbe","https://github.com/authlib/joserfc/releases/tag/1.7.4"]},"CVE-2026-111235":{"p":[{"p":"The OpenNMS Group Meridian","f":["2024.3.14","2025.0.11","2026.0.1"],"u":[]},{"p":"The OpenNMS Group Horizon","f":["36.0.5"],"u":[]}],"a":["https://github.com/OpenNMS/opennms/pull/8934"]},"CVE-2026-47218":{"p":[],"a":["https://github.com/containerd/runwasi/security/advisories/GHSA-cc25-vq59-rcjx","https://github.com/containerd/runwasi/commit/d28ab73c2c8a6c50d1927078821bd418b9e51638","https://github.com/containerd/runwasi/releases/tag/containerd-shim-wasmtime/v0.6.1"]},"CVE-2026-55240":{"p":[],"a":["https://github.com/msgbyte/tianji/security/advisories/GHSA-5grg-j3cr-3hpm","https://github.com/msgbyte/tianji/commit/132ff67907df897d222829ea8ad1a018ff74df48","https://github.com/msgbyte/tianji/releases/tag/v1.31.29"]},"CVE-2026-57496":{"p":[],"a":["https://github.com/Labs64/NetLicensing-MCP/security/advisories/GHSA-hxpf-9xvq-wph8","https://github.com/Labs64/NetLicensing-MCP/pull/6","https://github.com/Labs64/NetLicensing-MCP/commit/b8fd0ea76d533202573eb24add9fb2fbd9331496"]},"CVE-2026-105032":{"p":[],"a":["https://github.com/xn0tsa/your-secrets-are-safe-with-me","https://takeonme.org/gcves/GCVE-1337-2026-00000000000000000000000000000000000000000000000001011111111110011111111110000000000000000000000000000000000000000000000000000001100/","https://www.theverge.com/tech/1010727/eiliko-robot-hack-energize-lab"]},"CVE-2026-105037":{"p":[{"p":"EnergizeLab station-middleware","f":[],"u":["1.8.2"]}],"a":["https://github.com/xn0tsa/your-secrets-are-safe-with-me","https://takeonme.org/gcves/GCVE-1337-2026-00000000000000110111111111111111110000000000000000000011111100011111111110000000000000000000011111111111111000000000000000000010001/","https://www.theverge.com/tech/1010727/eiliko-robot-hack-energize-lab"]},"CVE-2026-105038":{"p":[],"a":["https://github.com/xn0tsa/your-secrets-are-safe-with-me","https://takeonme.org/gcves/GCVE-1337-2026-00000000000000111001111111111111111000000000000000000011111100100111111110000000000000000000011111111111111100000000000000000010010/","https://www.theverge.com/tech/1010727/eiliko-robot-hack-energize-lab"]},"CVE-2026-105039":{"p":[{"p":"EnergizeLab station-middleware","f":[],"u":["1.8.2"]}],"a":["https://github.com/xn0tsa/your-secrets-are-safe-with-me","https://takeonme.org/gcves/GCVE-1337-2026-00000000000000111111111111111111111000000000000000000011111100111111111111000000000000000000011111111111111101010000000000000010011/","https://www.theverge.com/tech/1010727/eiliko-robot-hack-energize-lab"]},"CVE-2026-110916":{"p":[{"p":"Google Chrome","f":["155.0.8059.84"],"u":[]}],"a":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01886704284.html","https://issues.chromium.org/issues/501886301"]},"CVE-2026-111281":{"p":[],"a":["https://rahulr.in/reversing-a-cheap-ip-camera-to-root/","https://www.vulncheck.com/advisories/jooan-ja-a12-unauthenticated-root-rce-via-setdiagmode-hard-coded-credentials"]},"CVE-2026-111283":{"p":[{"p":"BMC Helix BMC Helix Network Management","f":["26.3.01"],"u":[]}],"a":["https://docs.helixops.ai/bin/IT-Operations-Management/Operations-Management/BMC-Helix-Network-Management/NetworkManagement/Release-Notes/On-prem-Release-Notes/BMC-Helix-Network-Management-26-3-01-On-prem-Release-Notes/"]},"CVE-2026-111322":{"p":[{"p":"coleam00 Archon","f":[],"u":["0.11.1"]}],"a":["https://hackmd.io/@hieuPenguinnn/archon-os-api-missing-authentication-default","https://github.com/coleam00/Archon/blob/v0.11.1/packages/server/src/routes/api.ts#L1749-L1756","https://github.com/coleam00/Archon/blob/v0.11.1/packages/server/src/auth/config.ts#L25-L27"]},"CVE-2026-111329":{"p":[{"p":"juggleim JuggleIM","f":[],"u":["1.8.16"]}],"a":["https://hackmd.io/@hieuPenguinnn/juggleim-im-server-default-admin-credential","https://github.com/juggleim/im-server/blob/v1.8.16/sql/imserver.sql#L988","https://github.com/juggleim/imserver-console/blob/v1.0.10/services/accountservice.go#L77-L96"]},"CVE-2026-94134":{"p":[{"p":"Apache Software Foundation Apache Airflow SSH provider","f":["7.0.0"],"u":[]},{"p":"Apache Software Foundation Apache Airflow SFTP provider","f":["7.0.0"],"u":[]}],"a":["https://github.com/apache/airflow/pull/73419","https://lists.apache.org/thread/ksr1lztvd3zr74f8xd1hzch1ssl0l3lj"]},"CVE-2026-111444":{"p":[{"p":"Wheels Wheels","f":["4.2.0"],"u":[]}],"a":["https://github.com/wheels-dev/wheels/security/advisories/GHSA-mvr9-2h5x-w6cq"]},"CVE-2026-104798":{"p":[{"p":"joedolson My Calendar – Accessible Event Manager","f":[],"u":["3.4.24","3.5.21","3.6.17"]}],"a":["https://www.wordfence.com/threat-intel/vulnerabilities/id/e8aa6ee7-525e-4458-9f5b-1e729afe448c?source=cve","https://plugins.trac.wordpress.org/browser/my-calendar/tags/3.8.6/my-calendar-navigation.php#L248","https://plugins.trac.wordpress.org/browser/my-calendar/tags/3.8.6/my-calendar-navigation.php#L260"]},"CVE-2026-109219":{"p":[{"p":"kitae-park Mang Board","f":[],"u":["2.4.4"]}],"a":["https://www.wordfence.com/threat-intel/vulnerabilities/id/1e4f4860-b4c9-4f41-b1d0-0b2da8c88b99?source=cve","https://plugins.trac.wordpress.org/browser/mangboard/tags/2.4.4/includes/functions/func.api.php#L972","https://plugins.trac.wordpress.org/browser/mangboard/tags/2.4.4/includes/functions/func.api.php#L902"]},"CVE-2026-109515":{"p":[{"p":"properfraction MailOptin – Popup, Optin Forms & Email Newsletters for Mailchimp, HubSpot, AWeber Etc.","f":[],"u":["1.2.78.6"]}],"a":["https://www.wordfence.com/threat-intel/vulnerabilities/id/96111116-6b6f-42fc-98d8-6f5c27dc3c1c?source=cve","https://plugins.trac.wordpress.org/browser/mailoptin/tags/1.2.78.5/src/connections/WordPressUserRegistrationConnect/Subscription.php#L68","https://plugins.trac.wordpress.org/browser/mailoptin/tags/1.2.78.5/src/core/src/Connections/AbstractConnect.php#L84"]},"CVE-2026-103768":{"p":[{"p":"elextensions ELEX WordPress HelpDesk & Customer Ticketing System","f":[],"u":["3.3.7"]}],"a":["https://www.wordfence.com/threat-intel/vulnerabilities/id/8e8129b6-cc1d-4fdc-81a7-b0c8c3d1c308?source=cve","https://plugins.trac.wordpress.org/changeset?reponame=&new=3733037%40elex-helpdesk-customer-support-ticket-system%2Ftags%2F3.3.8&old=3538729%40elex-helpdesk-customer-support-ticket-system%2Ftags%2F3.3.7","https://plugins.trac.wordpress.org/changeset/3733037/elex-helpdesk-customer-support-ticket-system/trunk/includes/Mailbox.php"]},"CVE-2026-89079":{"p":[{"p":"jfarthing84 Theme My Login","f":[],"u":["7.2.1"]}],"a":["https://www.wordfence.com/threat-intel/vulnerabilities/id/53c548be-b8aa-4949-93f8-7b4d73688540?source=cve","https://plugins.trac.wordpress.org/changeset/3696081/theme-my-login"]},"CVE-2026-104730":{"p":[{"p":"sunshinephotocart Sunshine Photo Cart – Client Photo Gallery & Photo Proofing for Photographers","f":[],"u":["3.7.4"]}],"a":["https://www.wordfence.com/threat-intel/vulnerabilities/id/b6f6b29e-1678-486c-a955-23d9247af0b5?source=cve","https://plugins.trac.wordpress.org/browser/sunshine-photo-cart/tags/3.7.3/includes/class-session.php#L164","https://plugins.trac.wordpress.org/browser/sunshine-photo-cart/tags/3.7.3/includes/class-frontend.php#L195"]},"CVE-2026-94169":{"p":[{"p":"Theme-one The Grid","f":["2.8.2"],"u":["2.8.1"]}],"a":["https://patchstack.com/database/wordpress/plugin/the-grid/vulnerability/wordpress-the-grid-plugin-2-8-1-remote-code-execution-rce-vulnerability?_s_id=cve"]},"CVE-2026-94388":{"p":[{"p":"halfdata Green Popups","f":["7.6.3"],"u":[]}],"a":["https://patchstack.com/database/wordpress/plugin/halfdata-green-popups/vulnerability/wordpress-green-popups-plugin-7-6-3-sql-injection-vulnerability?_s_id=cve"]},"CVE-2026-111472":{"p":[{"p":"TSG Profleet","f":["16/10/2026"],"u":[]}],"a":["https://www.incibe.es/en/incibe-cert/notices/aviso/sql-injection-tsg-profleet"]},"CVE-2026-18516":{"p":[{"p":"Arcadia Technology, LLC Crafty Controller","f":[],"u":["4.10.8"]}],"a":["https://gitlab.com/crafty-controller/crafty-4/-/work_items/743"]},"CVE-2026-95182":{"p":[],"a":["http://deepseek.com","https://gist.github.com/lkloliver/46a88c7d619e487327a1122c20ff8e32"]},"CVE-2026-44977":{"p":[],"a":["https://github.com/Countly/countly-server/security/advisories/GHSA-jqp4-p86c-phxc","https://github.com/Countly/countly-server/commit/ae899f37bc6d70c1b44859756ce80a204ae72631","https://github.com/Countly/countly-server/commit/fcb16c808c0fdb6dc99fe9c66de7fc560b3a9c41"]},"CVE-2026-102692":{"p":[],"a":["https://github.com/RIOT-OS/RIOT/security/advisories/GHSA-8365-gj33-rgpf","https://github.com/RIOT-OS/RIOT/commit/6b283ace3565d931b3edff7e115d4f79339253b8","https://github.com/RIOT-OS/RIOT/commit/ee1fa0ef91874494823d476392572aeefdbc6b74"]},"CVE-2026-102693":{"p":[],"a":["https://github.com/RIOT-OS/RIOT/security/advisories/GHSA-gwgv-6976-hxrg","https://github.com/RIOT-OS/RIOT/commit/5209c1b84f9771342f079b7d5d94d8207fdd5f0a","https://github.com/RIOT-OS/RIOT/releases/tag/2026.04"]},"CVE-2026-49868":{"p":[],"a":["https://github.com/RIOT-OS/RIOT/security/advisories/GHSA-p3fx-9qcg-jmcf","https://github.com/RIOT-OS/RIOT/pull/22322","https://github.com/RIOT-OS/RIOT/commit/c9830dc5f2a9bf97418de4fc7d7167d00a45df17"]},"CVE-2026-57169":{"p":[],"a":["https://github.com/Finsys/dockhand/security/advisories/GHSA-f6q3-chhc-4hxm","https://github.com/Finsys/dockhand/commit/efb634701c55f80a8c752df8ae08d88f2c16cce9","https://github.com/Finsys/dockhand/releases/tag/v1.0.34"]},"CVE-2026-85746":{"p":[],"a":["https://github.com/MariaDB/server/security/advisories/GHSA-8fvj-c57c-pggx","https://github.com/MariaDB/server/commit/5c04ca5524385356ff7cf84974a7d491974c1f85","https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19"]},"CVE-2026-85748":{"p":[],"a":["https://github.com/MariaDB/server/security/advisories/GHSA-mv8g-9f7q-hprm","https://github.com/MariaDB/server/commit/91156c3de58762196605150ab3f756fe952592d1","https://github.com/MariaDB/server/commit/9b075b2cb53338f67e7230cc585e02d2d34514ed"]},"CVE-2026-92262":{"p":[],"a":["https://github.com/MariaDB/server/security/advisories/GHSA-65jj-h265-3m7h","https://github.com/MariaDB/server/commit/574ba66b2d6c5d71db83d416677876e9b592858e","https://github.com/MariaDB/server/commit/f277eefa424850a8cba5c2371406047f6395e8bb"]},"CVE-2026-111626":{"p":[{"p":"Webreaper Damselfly","f":[],"u":["4.5.3"]}],"a":["https://hackmd.io/@hieuPenguinnn/damselfly-api-missing-authorization","https://github.com/Webreaper/Damselfly/blob/4.5.3/Damselfly.Web.Server/Controllers/UserManagementController.cs#L8-L53","https://github.com/Webreaper/Damselfly/blob/4.5.3/Damselfly.Web.Server/Program.cs#L238-L242"]},"CVE-2026-111641":{"p":[{"p":"fastapiadmin FastapiAdmin","f":[],"u":["3.0"]}],"a":["https://hackmd.io/@hieuPenguinnn/fastapiadmin-unauthenticated-autologin-and-hardcoded-jwt-secret","https://github.com/fastapiadmin/FastapiAdmin/blob/v3.0/backend/app/api/v1/module_system/auth/controller.py#L173-L251","https://www.vulncheck.com/advisories/fastapiadmin-through-3.0-authentication-bypass-via-auto-login-endpoints"]},"CVE-2026-111643":{"p":[{"p":"l429609201 misaka_danmu_server","f":[],"u":["2.8.9"]}],"a":["https://hackmd.io/@hieuPenguinnn/misaka-danmu-server-ui-api-missing-authentication","https://github.com/l429609201/misaka_danmu_server/blob/v2.8.9/src/api/ui/config_history.py#L51-L66","https://github.com/l429609201/misaka_danmu_server/blob/v2.8.9/src/security.py#L136-L182"]},"CVE-2026-111673":{"p":[{"p":"Thecosy IceCMS","f":[],"u":["4.1.5"]}],"a":["https://hackmd.io/@hieuPenguinnn/icecms-backend-user-admin-unauth-account-takeover","https://github.com/Thecosy/IceCMS/blob/afd7a9f0d04a714e7c7e735e566c27f54b5d5201/IceCMS-ment/src/main/java/com/ttice/icewkment/controller/backend/UserController.java#L743-L818","https://github.com/Thecosy/IceCMS/blob/afd7a9f0d04a714e7c7e735e566c27f54b5d5201/IceCMS-ment/src/main/java/com/ttice/icewkment/configuration/ShiroConfig.java#L64-L88"]},"CVE-2026-111687":{"p":[{"p":"rachelos we-mp-rss","f":[],"u":["1.5.3"]}],"a":["https://hackmd.io/@hieuPenguinnn/werss-rss-template-unauth-ssti-rce","https://github.com/rachelos/we-mp-rss/blob/v1.5.3/core/lax/template_parser.py#L1150-L1166","https://github.com/rachelos/we-mp-rss/blob/v1.5.3/apis/rss.py#L185-L198"]},"CVE-2026-111690":{"p":[{"p":"suyuan32 simple-admin-core","f":[],"u":["1.8.7"]}],"a":["https://github.com/suyuan32/simple-admin-core/pull/382"]},"CVE-2026-111692":{"p":[{"p":"databufflabs databuff","f":[],"u":["0.1.10"]}],"a":["https://hackmd.io/@hieuPenguinnn/databuff-default-jwt-secret-auth-bypass","https://github.com/databufflabs/databuff/blob/v0.1.10/ai-apm-web/src/main/resources/application.yml#L54-L59","https://github.com/databufflabs/databuff/blob/v0.1.10/ai-apm-web/src/main/java/com/databuff/apm/web/config/JwtProperties.java#L8-L15"]},"CVE-2026-111693":{"p":[{"p":"databufflabs databuff","f":[],"u":["0.1.10"]}],"a":["https://hackmd.io/@hieuPenguinnn/databuff-default-jwt-secret-auth-bypass","https://github.com/databufflabs/databuff/blob/v0.1.10/ai-apm-web/src/main/java/com/databuff/apm/web/admin/account/PortalUserManagementService.java#L14-L31","https://github.com/databufflabs/databuff"]},"CVE-2026-111704":{"p":[{"p":"LangChat langchat","f":[],"u":["2a6285a6b8c51d51cdc599771bb667a30bc03f5c"]}],"a":["https://hackmd.io/@hieuPenguinnn/langchat-missing-global-auth-credential-exposure","https://github.com/LangChat/langchat/blob/2a6285a6b8c51d51cdc599771bb667a30bc03f5c/langchat-server/src/main/java/cn/langchat/server/config/WebAsyncConfig.java#L17-L33","https://github.com/LangChat/langchat/blob/2a6285a6b8c51d51cdc599771bb667a30bc03f5c/langchat-auth/src/main/java/cn/langchat/auth/controller/AigcUserController.java#L25-L60"]},"CVE-2026-111708":{"p":[{"p":"canove whaticket-community","f":[],"u":["cf047955a6f0d07002ed89c67d765c28d06f8d52"]}],"a":["https://hackmd.io/@hieuPenguinnn/whaticket-community-signup-eop-ticket-idor","https://github.com/canove/whaticket-community/blob/cf047955a6f0d07002ed89c67d765c28d06f8d52/backend/src/services/UserServices/CreateUserService.ts#L23-L65","https://github.com/canove/whaticket-community/blob/cf047955a6f0d07002ed89c67d765c28d06f8d52/backend/src/controllers/UserController.ts#L29-L48"]},"CVE-2026-111711":{"p":[{"p":"Netcore NR256CN","f":[],"u":["1.5.140116"]}],"a":["https://github.com/lukadqq/netcore-router-public-refs/blob/a44d562736b41c944223297e9144d2ad7fa2aff1/2026.10.15-netcore-nr256cn-basic-auth-stack-overflow.md","https://www.vulncheck.com/advisories/netcore-nr256cn-through-1.5.140116-pre-auth-stack-overflow-via-boa-user-ok"]},"CVE-2026-102608":{"p":[],"a":["https://github.com/ZoneMinder/zoneminder/security/advisories/GHSA-88m4-hrgp-m9v3","https://github.com/ZoneMinder/zoneminder/commit/2de2ae44a1d751bad4b020c5573b2d58c59c1525","https://github.com/ZoneMinder/zoneminder/commit/b3a7c05f079c87badf4b0ce052da0acfd4047a4b"]},"CVE-2026-96620":{"p":[],"a":["https://github.com/anthropics/claude-agent-sdk-python/security/advisories/GHSA-h4mw-j7qp-8mwm","https://github.com/anthropics/claude-agent-sdk-python/pull/1123","https://github.com/anthropics/claude-agent-sdk-python/commit/347a1cb88d7652199399db1b7f914e0a459a6662"]},"CVE-2026-111823":{"p":[{"p":"Mage mage-ai","f":[],"u":["0.9.80"]}],"a":["https://github.com/mage-ai/mage-ai/pull/6204","https://github.com/mage-ai/mage-ai/pull/6205","https://github.com/mage-ai/mage-ai/pull/6204/changes/76c4f467f3654041d8899b1c4447a985710d26c0"]},"CVE-2026-110653":{"p":[{"p":"latepoint Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress","f":[],"u":["5.7.4"]}],"a":["https://www.wordfence.com/threat-intel/vulnerabilities/id/61fbc1dd-06c9-409b-8cad-3f350b38dfc3?source=cve","https://plugins.trac.wordpress.org/browser/latepoint/tags/5.7.4/lib/helpers/otp_helper.php#L228","https://plugins.trac.wordpress.org/browser/latepoint/tags/5.7.4/lib/helpers/otp_helper.php#L185"]},"CVE-2026-104736":{"p":[{"p":"thimpress LearnPress – WordPress LMS Plugin for Create and Sell Online Courses","f":[],"u":["4.4.10"]}],"a":["https://www.wordfence.com/threat-intel/vulnerabilities/id/3e28e008-0ec1-4262-9ac0-6170cf8b8bdf?source=cve","https://plugins.trac.wordpress.org/browser/learnpress/tags/4.4.9.1/inc/class-lp-session-handler.php#L373","https://plugins.trac.wordpress.org/browser/learnpress/tags/4.4.9.1/inc/class-lp-checkout.php#L377"]},"CVE-2026-111911":{"p":[{"p":"thorsten phpMyFAQ","f":["4.1.9"],"u":[]}],"a":["https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-g6cq-6rqg-6c9p","https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-rg9h-f29v-xhxr"]},"CVE-2026-109894":{"p":[{"p":"Arraytics Booktics","f":["1.0.30"],"u":["1.0.29"]}],"a":["https://patchstack.com/database/wordpress/plugin/booktics/vulnerability/wordpress-booktics-plugin-1-0-29-sql-injection-vulnerability?_s_id=cve"]},"CVE-2026-110372":{"p":[{"p":"Brainstorm Force OttoKit","f":["1.1.41"],"u":["1.1.40"]}],"a":["https://patchstack.com/database/wordpress/plugin/suretriggers/vulnerability/wordpress-ottokit-plugin-1-1-40-privilege-escalation-vulnerability?_s_id=cve"]},"CVE-2026-110886":{"p":[{"p":"QuantumCloud Conversational Forms for ChatBot","f":["1.5.2"],"u":["1.5.1"]}],"a":["https://patchstack.com/database/wordpress/plugin/conversational-forms/vulnerability/wordpress-conversational-forms-for-chatbot-plugin-1-5-1-php-object-injection-vulnerability?_s_id=cve"]},"CVE-2026-111998":{"p":[{"p":"vanus-labs vanus","f":[],"u":["0.9.0"]}],"a":["https://github.com/vanus-labs/vanus/issues/647","https://github.com/vanus-labs/vanus/blob/v0.9.0/internal/controller/tenant/controller.go#L449-L500","https://github.com/vanus-labs/vanus/blob/v0.9.0/internal/primitive/constants.go#L37"]},"CVE-2026-108983":{"p":[],"a":["https://www.geovision.com.tw/cyber_security.php"]},"CVE-2026-102503":{"p":[{"p":"Google SAM","f":["0.1.0-alpha.3"],"u":[]}],"a":["https://github.com/google/sam/security/advisories/GHSA-r6hp-67wp-c7jx","https://github.com/google/sam/commit/433bc99d2a2c10071167bf22acc2c930a12e64e1","https://github.com/google/sam/releases/tag/v0.1.0-alpha.3"]},"CVE-2026-103091":{"p":[{"p":"Google SAM","f":["0.1.0-alpha.9"],"u":[]}],"a":["https://github.com/google/sam/security/advisories/GHSA-cgmg-9xf6-rrgw","https://github.com/google/sam/releases/tag/v0.1.0-alpha.9"]},"CVE-2026-110887":{"p":[{"p":"HivePress HivePress","f":["1.8.0"],"u":["1.7.32"]}],"a":["https://patchstack.com/database/wordpress/plugin/hivepress/vulnerability/wordpress-hivepress-plugin-1-7-32-remote-code-execution-rce-vulnerability?_s_id=cve"]},"CVE-2026-111406":{"p":[{"p":"PT Norther Lights Production MapSVG","f":["8.16.2"],"u":["8.16.1"]}],"a":["https://patchstack.com/database/wordpress/plugin/mapsvg-lite-interactive-vector-maps/vulnerability/wordpress-mapsvg-plugin-8-16-1-arbitrary-file-upload-vulnerability?_s_id=cve"]},"CVE-2026-78162":{"p":[{"p":"Apache Software Foundation Apache Camel","f":["4.18.5","4.22.1"],"u":[]}],"a":["https://camel.apache.org/security/CVE-2026-78162.html","https://github.com/apache/camel/pull/25566","https://github.com/apache/camel/pull/25595"]}},"ai":{},"recent":[{"id":"CVE-2026-88900","p":1792412231980,"x":"Deserialization of Untrusted Data vulnerability in Apache Camel Camel-Jgroups component.\n\n\n\nThis issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1.\n\n\n\nJGroupsEndpoint.createExchange(Message), which CamelJGroupsReceiver calls for every message the jgroups consumer receives before the…","s":8.8,"v":"HIGH","cwe":"CWE-502"},{"id":"CVE-2026-112210","p":1792412221910,"x":"A flaw was found in the rhc-canonical-facts.service systemd unit shipped with rhc. The service runs as root and operates on a file inside a directory owned by an unprivileged system user without verifying that the file is not a symbolic link. A local attacker who has already compromised the privileged yggdrasil system…","s":6,"v":"MEDIUM","cwe":"CWE-59"},{"id":"CVE-2026-112140","p":1792412221740,"x":"A vulnerability was found in llSourcell Doctor-Dignity up to 3f2ffb6c892f13b50a708d05900d3227acb40ded. This impacts the function _get_lib_module of the file python/mlc_chat/chat_module.py. The manipulation of the argument model_lib results in code injection. The attack may be launched remotely. The exploit has been…","s":6.3,"v":"MEDIUM","cwe":"CWE-74"},{"id":"CVE-2026-112139","p":1792412221563,"x":"A vulnerability has been found in subhajitkhan online-clinic-management-system up to e9ee77a8827a1446220fa07ee693dc4d9a29a578. This affects an unknown function of the file admindocview.php of the component Administrative Mutation Handler. The manipulation of the argument docid leads to sql injection. The attack may be…","s":7.3,"v":"HIGH","cwe":"CWE-74"},{"id":"CVE-2026-112138","p":1792412221383,"x":"A flaw has been found in diem-project diem up to 5.1.3. The impacted element is the function dmOs::join of the file dmFrontPlugin/modules/dmCodeEditor/actions/actions.class.php of the component dmCodeEditor. Executing a manipulation can lead to path traversal. The attack can be launched remotely. The exploit has been…","s":4.7,"v":"MEDIUM","cwe":"CWE-22"},{"id":"CVE-2026-112108","p":1792412221197,"x":"A vulnerability was determined in ztxz16 fastllm up to 0.1.8.2. This impacts the function GGUFBuffer::ReadString of the file third_party/gguf/gguf.cpp of the component String Parsing. This manipulation of the argument len causes buffer overflow. The attack can be initiated remotely. The exploit has been publicly…","s":6.3,"v":"MEDIUM","cwe":"CWE-119"},{"id":"CVE-2026-112107","p":1792412220937,"x":"A flaw has been found in ztxz16 fastllm up to 1.8.2. Affected by this issue is the function SafeTensorItem::CreateBuffer of the file src/model.cpp of the component Safetensors Weight Loading. This manipulation of the argument data_offsets causes buffer overflow. The attack can be initiated remotely. The exploit has…","s":6.3,"v":"MEDIUM","cwe":"CWE-119"},{"id":"CVE-2026-91858","p":1792408645683,"x":"FopProducer transforms the incoming XSL-FO message body by creating a javax.xml.transform.TransformerFactory through TransformerFactory.newInstance() and enabling only FEATURE_SECURE_PROCESSING before running an identity transform over the body. On the JDK's built-in transformer, that feature alone already empties the…","s":6.5,"v":"MEDIUM","cwe":"CWE-611"},{"id":"CVE-2026-88901","p":1792408645340,"x":"Improper Restriction of XML External Entity Reference vulnerability in Apache Camel.\n\n\n\nThis issue affects Apache Camel: from 4.7.0 before 4.18.5, from 4.19.0 before 4.22.1.\n\n\n\nImproper Restriction of XML External Entity Reference in the Smooks component (camel-smooks) in Apache Camel allows an attacker who supplies…","s":8.2,"v":"HIGH","cwe":"CWE-611"},{"id":"CVE-2026-85317","p":1792408645103,"x":"Use of Cache Containing Sensitive Information vulnerability in Apache Camel HTTP component.\n\nThis issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1.\n\nThe OAuth2 client token cache is global to the JVM, and its key omitted several of the fields that determine what a token actually…","s":4.8,"v":"MEDIUM","cwe":"CWE-524"},{"id":"CVE-2026-85316","p":1792408644973,"x":"Insufficient Granularity of Access Control vulnerability in Apache Camel Platform HTTP component.\n\nThis issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1.\n\nThe component decided whether an endpoint ran in proxy mode by testing whether its configured path started with the string proxy,…","s":4.8,"v":"MEDIUM","cwe":"CWE-1220"},{"id":"CVE-2026-85315","p":1792408644837,"x":"Generation of Error Message Containing Sensitive Information vulnerability in Apache Camel gRPC component.\n\nThis issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1.\n\nWhen a route behind a gRPC consumer failed, the exception's message was placed into the gRPC status description. Unlike the…","s":5.3,"v":"MEDIUM","cwe":"CWE-209"},{"id":"CVE-2026-85314","p":1792408644700,"x":"Improper Input Validation vulnerability in Apache Camel Mail component.\n\nThis issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1.\n\nCVE-2026-46584 addressed mail headers reaching the Exchange without passing through a header filter, but the MimeMultipart data format retained an unfiltered…","s":6.5,"v":"MEDIUM","cwe":"CWE-20"},{"id":"CVE-2026-85313","p":1792408644560,"x":"Permissive Cross-domain Policy with Untrusted Domains vulnerability in Apache Camel Jetty component.\n\nThis issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1.\n\nSetting enableCORS on a Jetty endpoint installed Jetty's CrossOriginFilter with its stock defaults, which accept every origin and…","s":4.3,"v":"MEDIUM","cwe":"CWE-942"},{"id":"CVE-2026-85312","p":1792408644427,"x":"Improper Input Validation vulnerability in Apache Camel Core component.\n\nThis issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1.\n\nThe saga processor consulted a header named Long-Running-Action to decide which saga an exchange belonged to. The name carries no Camel prefix, so it sits…","s":4.8,"v":"MEDIUM","cwe":"CWE-20"},{"id":"CVE-2026-85301","p":1792408644290,"x":"Improper Authentication vulnerability in Apache Camel Keycloak component.\n\nThis issue affects Apache Camel: from 4.15.0 before 4.18.5, from 4.19.0 before 4.22.1.\n\n\n\n\nThe security processor validated the issuer of an introspected token only when the introspection response actually carried an iss claim. When the claim…","s":4.8,"v":"MEDIUM","cwe":"CWE-287"},{"id":"CVE-2026-85300","p":1792408644147,"x":"Incorrect Default Permissions vulnerability in Apache Camel PQC component.\n\nThis issue affects Apache Camel: from 4.12.0 before 4.18.5, from 4.19.0 before 4.22.1.\n\nWhen the component wrote generated key material to disk it did so with the permissions the process default umask produced, rather than restricting the file…","s":5.5,"v":"MEDIUM","cwe":"CWE-276"},{"id":"CVE-2026-85296","p":1792408644000,"x":"Exposure of Data Element to Wrong Session vulnerability in Apache Camel AS2 component.\n\nThis issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1.\n\nSigning material belonging to an individual request was stored in state that is shared across requests rather than confined to the request being…","s":6.5,"v":"MEDIUM","cwe":"CWE-488"},{"id":"CVE-2026-85260","p":1792408643840,"x":"Insertion of Sensitive Information into Log File vulnerability in Apache Camel MLLP component.\n\nThis issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1.\n\nThe camel-mllp component carries a logPhi option that governs whether HL7 payload content may be written to the log. It defaulted to…","s":5.5,"v":"MEDIUM","cwe":"CWE-532"},{"id":"CVE-2026-85257","p":1792408643690,"x":"Generation of Error Message Containing Sensitive Information vulnerability in Apache Camel CXF component.\n\nThis issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1.\n\nWhen a route behind a CXF SOAP consumer failed with an exception the service contract does not declare, the exception was…","s":5.3,"v":"MEDIUM","cwe":"CWE-209"},{"id":"CVE-2026-85254","p":1792408643553,"x":"Improper Handling of Case Sensitivity vulnerability in Apache Camel Platform HTTP component.\n\nThis issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1.\n\nThe guard that prevents a request header being reflected into the response compared header names case sensitively, while HTTP header names…","s":6.5,"v":"MEDIUM","cwe":"CWE-178"},{"id":"CVE-2026-85251","p":1792408643417,"x":"Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Camel HTTP component.\n\nThis issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1.\n\nTwo paths handed credentials to a redirect target, which is a host chosen by the remote server rather than by the route, once…","s":7.5,"v":"HIGH","cwe":"CWE-200"},{"id":"CVE-2026-85250","p":1792408643257,"x":"Improper Restriction of XML External Entity Reference vulnerability in Apache Camel XPath component.\n\nThis issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1.\n\nWith documentType set to InputSource, XPathBuilder handed the payload straight to javax.xml.xpath, which builds a DocumentBuilder…","s":7.5,"v":"HIGH","cwe":"CWE-611"},{"id":"CVE-2026-85249","p":1792408643117,"x":"Improper Input Validation vulnerability in Apache Camel Tika component.\n\nThis issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1.\n\nThe Tika producer mapped every metadata key parsed out of the submitted document onto the Exchange as a header, with no filter applied. Document metadata is…","s":6.5,"v":"MEDIUM","cwe":"CWE-20"},{"id":"CVE-2026-85248","p":1792408642970,"x":"Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in Apache Camel PQC component.\n\nThis issue affects Apache Camel: from 4.12.0 before 4.18.5, from 4.19.0 before 4.22.1.\n\n\n\n\nThe producer held a single java.security.Signature instance and used it for every exchange…","s":5.9,"v":"MEDIUM","cwe":"CWE-362"},{"id":"CVE-2026-85247","p":1792408642820,"x":"Improper Certificate Validation vulnerability in Apache Camel Knative component.\n\nThis issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1.\n\nWhen SSL was enabled on the Knative HTTP client but no truststore was configured, the client options fell back to trusting every presented certificate…","s":5.9,"v":"MEDIUM","cwe":"CWE-295"},{"id":"CVE-2026-85246","p":1792408642673,"x":"Generation of Error Message Containing Sensitive Information vulnerability in Apache Camel Mina component.\n\nThis issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1.\n\nWhen processing of an exchange failed, the Mina consumer wrote exchange.getException() straight back over the socket to the…","s":5.3,"v":"MEDIUM","cwe":"CWE-209"},{"id":"CVE-2026-85245","p":1792408642527,"x":"Exposure of Data Element to Wrong Session vulnerability in Apache Camel Thrift component.\n\n\n\nThis issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1.\n\nThe Thrift data format unmarshalled incoming data into the shared defaultInstance of the target type rather than into a fresh copy, and…","s":5.9,"v":"MEDIUM","cwe":"CWE-488"},{"id":"CVE-2026-85243","p":1792408642367,"x":"Improper Validation of Integrity Check Value vulnerability in Apache Camel Crypto PGP component.\n\nThis issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1.\n\nunmarshal() verified the modification detection code only when the message was an OpenPGP symmetrically encrypted integrity protected…","s":5.9,"v":"MEDIUM","cwe":"CWE-354"},{"id":"CVE-2026-84181","p":1792408642250,"x":"Improper Authentication vulnerability in Apache Camel Shiro component.\n\n\n\nThis issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1.\n\nThe Shiro security processor skipped credential verification when the subject already bound to the current thread carried the same principal as the incoming…","s":5.9,"v":"MEDIUM","cwe":"CWE-287"},{"id":"CVE-2026-84180","p":1792408642100,"x":"Generation of Error Message Containing Sensitive Information vulnerability in Apache Camel Knative component.\n\nThis issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1.\n\nWhen processing of an exchange failed on the consumer side, the Knative HTTP consumer wrote the resulting exception back…","s":5.3,"v":"MEDIUM","cwe":"CWE-209"},{"id":"CVE-2026-84178","p":1792408641917,"x":"Cross-Site Request Forgery (CSRF) vulnerability in Apache Camel OAuth component.\n\n\n\nThis issue affects Apache Camel: from 4.11.0 before 4.18.5, from 4.19.0 before 4.22.1.\n\nThe authorization code callback did not carry a state parameter binding it to the authorization request that started the flow, and the callback did…","s":6.1,"v":"MEDIUM","cwe":"CWE-352"},{"id":"CVE-2026-84176","p":1792408641750,"x":"Permissive Cross-domain Policy with Untrusted Domains vulnerability in Apache Camel Platform HTTP Vertx component.\n\nThis issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1.\n\n\n\n\ncreateCorsHandler() set Access-Control-Allow-Credentials: true outside the origin check, so the header went out…","s":6.5,"v":"MEDIUM","cwe":"CWE-942"},{"id":"CVE-2026-83531","p":1792408641507,"x":"Improper Control of Generation of Code ('Code Injection'), Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection') vulnerability in Apache Camel.\n\n\n\nThis issue affects Apache Camel: from 4.4.0 before 4.18.5, from 4.19.0 before 4.22.1.\n\n\n\nThe…","s":8.8,"v":"HIGH","cwe":"CWE-94"},{"id":"CVE-2026-80344","p":1792408641363,"x":"Server-Side Request Forgery (SSRF) vulnerability in Apache Camel AS2 component.\n\nThis issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1.\n\nIn the AS2 protocol the sender of a message may request that the Message Disposition Notification be returned asynchronously to an address the sender…","s":8.2,"v":"HIGH","cwe":"CWE-918"},{"id":"CVE-2026-80343","p":1792408641223,"x":"Improper Handling of Case Sensitivity vulnerability in Apache Camel Netty HTTP component.\n\n\n\nThis issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1.\n\n\n\nThe camel-netty-http security constraint compared the request path against the configured context path using a case-sensitive match,…","s":8.2,"v":"HIGH","cwe":"CWE-178"},{"id":"CVE-2026-80312","p":1792408641073,"x":"Improper Authentication vulnerability in Apache Camel OAuth component.\n\n\n\nThis issue affects Apache Camel: from 4.11.0 before 4.18.5, from 4.19.0 before 4.22.1.\n\n\n\nThe camel-oauth processors that guard a route did not stop the exchange when authentication could not be completed. Where a failure to establish an…","s":8.2,"v":"HIGH","cwe":"CWE-287"},{"id":"CVE-2026-79986","p":1792408640860,"x":"Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache Camel Azure Files component.\n\n\n\nThis issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1.\n\n\n\nThe Camel remote-file consumers poll a directory on a remote server and build the absolute…","s":7.4,"v":"HIGH","cwe":"CWE-22"},{"id":"CVE-2026-79985","p":1792408640647,"x":"Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache Camel SMB component.\n\n\n\nThis issue affects Apache Camel: from 4.2.0 before 4.18.5, from 4.19.0 before 4.22.1.\n\n\n\nThe Camel remote-file consumers poll a directory on a remote server and build the absolute remote path…","s":7.4,"v":"HIGH","cwe":"CWE-22"},{"id":"CVE-2026-79984","p":1792408640437,"x":"Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache Camel Mina SFTP component.\n\n\n\nThis issue affects Apache Camel: from 4.18.0 before 4.18.5, from 4.19.0 before 4.22.1.\n\n\n\nThe Camel remote-file consumers poll a directory on a remote server and build the absolute…","s":7.4,"v":"HIGH","cwe":"CWE-22"},{"id":"CVE-2026-79983","p":1792408640207,"x":"Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache Camel FTP component.\n\n\n\nThis issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1.\n\n\n\nThe Camel remote-file consumers poll a directory on a remote server and build the absolute remote path…","s":7.4,"v":"HIGH","cwe":"CWE-22"},{"id":"CVE-2026-78165","p":1792408639643,"x":"Deserialization of Untrusted Data vulnerability in Apache Camel Spring Redis component.\n\n\n\nThis issue affects Apache Camel: from 2.11.0 before 4.18.5, from 4.19.0 before 4.22.1.\n\n\n\nRedisConfiguration.getSerializer lazily built a bare JdkSerializationRedisSerializer whenever no serializer option was configured, and…","s":8.8,"v":"HIGH","cwe":"CWE-502"},{"id":"CVE-2026-78164","p":1792408639403,"x":"Improper Neutralization of Special Elements Used in a Template Engine and Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Camel HTTP, Netty HTTP, Undertow and Vert.x HTTP components.\n\n\n\nThis issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1.\n\n\n\nThe Camel…","s":8.2,"v":"HIGH","cwe":"CWE-200"},{"id":"CVE-2026-78163","p":1792408639233,"x":"Server-Side Request Forgery (SSRF), Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') and Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Camel Docling component.\n\n\n\nThis issue affects Apache Camel: from 4.15.0 before 4.18.5, from 4.19.0 before 4.22.1.…","s":5.9,"v":"MEDIUM","cwe":"CWE-22"},{"id":"CVE-2026-78162","p":1792408639037,"x":"Deserialization of Untrusted Data vulnerability in Apache Camel.\n\n\n\nThis issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1.\n\n\n\nThe camel-hazelcast component applies a default Hazelcast JavaSerializationFilterConfig to the instances it creates from its own configuration, a protection…","s":10,"v":"CRITICAL","cwe":"CWE-502"},{"id":"CVE-2026-71253","p":1792408638540,"x":"Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Apache Johnzon.\n\n\n\nClassConverter loads & static-initializes an attacker-named class from untrusted JSON.\n\n\n\n\nThis issue affects Apache Johnzon: from 1.0.0 before 2.2.0.\n\n\n\nUsers are recommended to upgrade to version…","cwe":"CWE-470"},{"id":"CVE-2026-112106","p":1792408637310,"x":"A security vulnerability has been detected in TufayelLUS TikTok-Video-Downloader-PHP up to c4230497bb23dd9c1f81456fe8a982d951feac0d. Affected by this issue is some unknown functionality of the file index.php of the component TLS Handler. Such manipulation leads to improper certificate validation. It is possible to…","s":3.7,"v":"LOW","cwe":"CWE-287"},{"id":"CVE-2026-112105","p":1792408637143,"x":"A vulnerability has been found in GlitterWare Passy up to 1.10.1. The affected element is the function MyHttpOverrides in the library lib/main.dart of the component TLS Handler. Such manipulation leads to improper certificate validation. The attack may be launched remotely. This attack is characterized by high…","s":3.7,"v":"LOW","cwe":"CWE-287"},{"id":"CVE-2026-112104","p":1792408636967,"x":"A flaw has been found in eremef bandcamp-player up to 1.8.33-beta. The impacted element is an unknown function of the file database.ts of the component Remote Control Server. Executing a manipulation of the argument remoteEnabled can lead to missing authentication. The attack may be launched remotely. Upgrading to…","s":7.3,"v":"HIGH","cwe":"CWE-287"},{"id":"CVE-2026-112103","p":1792408636773,"x":"A vulnerability has been found in f3-factory fatfree-core up to 3.9.2. This vulnerability affects the function _curl of the file web.php of the component HTTP Client. Such manipulation leads to improper certificate validation. The attack may be performed from remote. Attacks of this nature are highly complex. It is…","s":3.7,"v":"LOW","cwe":"CWE-287"},{"id":"CVE-2026-90910","p":1792405009897,"x":"Missing authentication for critical function vulnerability in Apache Answer.\n\n\n\nThis issue affects Apache Answer: through 2.0.2.\n\n\n\nThe reaction API did not enforce content visibility controls, allowing unauthorized users to read reaction metadata from restricted content or add and remove their own reactions.\n\n\n\nUsers…","cwe":"CWE-306"},{"id":"CVE-2026-86589","p":1792405009540,"x":"Incorrect implementation of authentication algorithm vulnerability in Apache Answer.\n\n\n\nThis issue affects Apache Answer: through 2.0.2.\n\n\n\nA flaw in the User Center login integration can cause a newly created external user session to omit its external identity, allowing subsequent requests to bypass central account…","cwe":"CWE-303"},{"id":"CVE-2026-79633","p":1792405009430,"x":"vulnerability in Apache Answer.\n\n\n\nThis issue affects Apache Answer: through 2.0.2.\n\n\n\nMissing authorization checks allowed authenticated users to perform actions on non-public content they were not permitted to access.\n\n\n\nUsers are recommended to upgrade to version 2.0.3, which fixes the issue.","cwe":"CWE-202"},{"id":"CVE-2026-79624","p":1792405009327,"x":"Insufficient session expiration vulnerability in Apache Answer.\n\n\n\nThis issue affects Apache Answer: through 2.0.2.\n\n\n\nInsufficient session invalidation allowed revoked users to continue accessing known private uploaded files with a stale visit token.\n\n\n\nUsers are recommended to upgrade to version 2.0.3, which fixes…","cwe":"CWE-613"},{"id":"CVE-2026-79620","p":1792405009213,"x":"Exposure of sensitive information through data queries vulnerability in Apache Answer.\n\n\n\nThis issue affects Apache Answer: through 2.0.2.\n\n\n\nAn improper authorization check in the similar-question search allowed authenticated users to view metadata of non-public questions.\n\n\n\nUsers are recommended to upgrade to…","cwe":"CWE-202"},{"id":"CVE-2026-79613","p":1792405009093,"x":"vulnerability in Apache Answer.\n\n\n\nThis issue affects Apache Answer: through 2.0.2.\n\n\n\nUnauthenticated attackers could access comments associated with non-public content through public user profiles.\n\n\n\nUsers are recommended to upgrade to version 2.0.3, which fixes the issue.","cwe":"CWE-202"},{"id":"CVE-2026-76994","p":1792405008983,"x":"Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Answer.\n\n\n\nThis issue affects Apache Answer: through 2.0.2.\n\nUnauthenticated attackers could obtain metadata associated with hidden questions through public answer profiles.\n\n\nUsers are recommended to upgrade to version 2.0.3, which…","cwe":"CWE-200"},{"id":"CVE-2026-71563","p":1792405008637,"x":"Missing Authorization vulnerability in Apache Answer.\n\n\n\nThis issue affects Apache Answer: through 2.0.2.\n\nAn authorization flaw in the MCP answer retrieval tool allows holders of a global API key to access answer content associated with hidden, deleted, or pending-review questions.\n\n\nUsers are recommended to upgrade…","cwe":"CWE-862"},{"id":"CVE-2026-68482","p":1792405008510,"x":"Missing Authorization vulnerability in Apache Answer.\n\n\n\nThis issue affects Apache Answer: through 2.0.2.\n\nAn unauthenticated or unauthorized user can retrieve the invited-user list associated with a non-public question due to missing visibility authorization checks.\n\n\nUsers are recommended to upgrade to version…","cwe":"CWE-862"},{"id":"CVE-2026-67249","p":1792405008397,"x":"A vulnerability in Apache Answer.\n\n\n\nThis issue affects Apache Answer: through 2.0.2.\n\nA verification code issued for one email-based workflow could be accepted by another sensitive workflow because the code purpose was not properly enforced.\n\n\nUsers are recommended to upgrade to version 2.0.3, which fixes the issue.","cwe":"CWE-863"},{"id":"CVE-2026-64945","p":1792405008280,"x":"A vulnerability in Apache Answer.\n\n\n\nThis issue affects Apache Answer: through 2.0.2.\n\nThe question operation controller gates hide/show operations on the wrong permission check result (the unpin permission instead of the hide permission), so in custom role configurations that separate these permissions, a user…","cwe":"CWE-863"},{"id":"CVE-2026-64944","p":1792405008170,"x":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache Answer.\n\n\n\nThis issue affects Apache Answer: through 2.0.2.\n\nThe importer stores imported question bodies as raw HTML without passing them through the normal Markdown-to-HTML sanitization path, so…","cwe":"CWE-79"},{"id":"CVE-2026-64943","p":1792405008047,"x":"Insertion of Sensitive Information into Log File vulnerability in Apache Answer.\n\n\n\nThis issue affects Apache Answer: through 2.0.2.\n\nFull API keys are written to application logs on every authenticated request, allowing anyone with log-read access to recover and replay active bearer credentials.\n\n\nUsers are…","cwe":"CWE-532"},{"id":"CVE-2026-112192","p":1792405007563,"x":"MISP contains a vulnerability in the handling of module plugin settings. When the server rebuilds module-supplied settings for API consumption, it drops the redacted and cli_only flags that a module declares in its own configuration metadata.\n\nAs a result:\n\n- A module that marks a setting (such as an API key) as…","s":5.3,"v":"MEDIUM","cwe":"CWE-200"},{"id":"CVE-2026-112188","p":1792405007413,"x":"MISP contains a vulnerability in its server settings lookup mechanism that allows an authenticated user to retrieve sensitive configuration data that should have been redacted.\n\nThe settings lookup function resolves a dotted setting name to a node in the configuration tree. When a branch name (such as Security, MISP,…","s":7.1,"v":"HIGH","cwe":"CWE-200"},{"id":"CVE-2026-112184","p":1792405007210,"x":"MISP contains a reflected cross-site scripting (XSS) vulnerability in the workflow module interface. Parameter names returned by the misp-modules service are rendered as raw HTML form labels on the workflow module page without output encoding. An attacker who can influence the parameter names reported by the…","s":4.8,"v":"MEDIUM","cwe":"CWE-79"},{"id":"CVE-2026-112183","p":1792405006970,"x":"MISP contains a CSS injection vulnerability in the remote event preview feature. When a user previews an event from a linked MISP server, the colour value associated with each remote tag is written directly into an inline CSS style attribute without sufficient validation. Although HTML entity encoding is applied, the…","s":4.8,"v":"MEDIUM","cwe":"CWE-74"},{"id":"CVE-2026-112102","p":1792405006780,"x":"A vulnerability was detected in AXA Group NLP.js 4.27.0. This impacts the function Evaluator.walkFunction of the file packages/evaluator/src/evaluator.js of the component Condition Expression Pipeline. The manipulation of the argument condition results in code injection. It is possible to launch the attack remotely.…","s":6.3,"v":"MEDIUM","cwe":"CWE-74"},{"id":"CVE-2026-112101","p":1792405006610,"x":"A vulnerability was determined in BlackBeltTechnology pi-agent-dashboard up to 0.8.0. The affected element is an unknown function of the file /BlackBeltTechnology/pi-agent-dashboard of the component WebSocket Gateway. Executing a manipulation of the argument cwd can lead to origin validation error. The attack can be…","s":4.3,"v":"MEDIUM","cwe":"CWE-345"},{"id":"CVE-2026-112100","p":1792405006393,"x":"A vulnerability was determined in DeepPavlov up to 1.7.0. This affects the function MultiTaskPipelinePreprocessor.__init__ of the file deeppavlov/models/preprocessors/multitask_preprocessor.py. This manipulation of the argument preprocessor causes code injection. The attack is possible to be carried out remotely. The…","s":5.5,"v":"MEDIUM","cwe":"CWE-74"},{"id":"CVE-2026-111408","p":1792405006257,"x":"Deserialization of Untrusted Data vulnerability in ExpressTech Quiz And Survey Master quiz-master-next allows Object Injection.This issue affects Quiz And Survey Master: from n/a through 11.2.7.","s":8.8,"v":"HIGH","cwe":"CWE-502"},{"id":"CVE-2026-111407","p":1792405006133,"x":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themeum Tutor LMS tutor allows Stored XSS.This issue affects Tutor LMS: from n/a through 4.1.2.","s":6.5,"v":"MEDIUM","cwe":"CWE-79"},{"id":"CVE-2026-111406","p":1792405006007,"x":"Unrestricted Upload of File with Dangerous Type vulnerability in PT Norther Lights Production MapSVG mapsvg-lite-interactive-vector-maps allows Upload a Web Shell to a Web Server.This issue affects MapSVG: from n/a through 8.16.1.","s":9.9,"v":"CRITICAL","cwe":"CWE-434"},{"id":"CVE-2026-111398","p":1792405005880,"x":"Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in PT Norther Lights Production MapSVG mapsvg-lite-interactive-vector-maps allows Path Traversal.This issue affects MapSVG: from n/a through 8.16.1.","s":7.7,"v":"HIGH","cwe":"CWE-22"},{"id":"CVE-2026-110898","p":1792405005753,"x":"Incorrect Privilege Assignment vulnerability in WPDeveloper Essential Addons for Elementor essential-addons-for-elementor-lite allows Privilege Escalation.This issue affects Essential Addons for Elementor: from n/a through 6.8.5.","s":6.4,"v":"MEDIUM","cwe":"CWE-266"},{"id":"CVE-2026-110887","p":1792405005627,"x":"Improper Control of Generation of Code ('Code Injection') vulnerability in HivePress HivePress hivepress allows Remote Code Inclusion.This issue affects HivePress: from n/a through 1.7.32.","s":9.9,"v":"CRITICAL","cwe":"CWE-94"},{"id":"CVE-2026-110379","p":1792405005490,"x":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ays Pro Quiz Maker quiz-maker allows Reflected XSS.This issue affects Quiz Maker: from n/a through 6.7.1.91.","s":7.1,"v":"HIGH","cwe":"CWE-79"},{"id":"CVE-2026-108837","p":1792405005220,"x":"Allocation of resources without limits or throttling vulnerability in Apache Kylin. Given an attacker has got project admin permission, an cache API maybe used to cause computed-column resource exhaustion.\n\n\n\nThis issue affects Apache Kylin: from 4.0.0 through 5.0.4.\n\n\n\nUsers are recommended to upgrade to version…","cwe":"CWE-770"},{"id":"CVE-2026-108833","p":1792405005123,"x":"Default startup profile miss security settings in Apache Kylin. Any deployment has security setting profile turned on does not impact.\n\n\n\nThis issue affects Apache Kylin: from 4.0.0 through 5.0.4.\n\n\n\nUsers are recommended to upgrade to version 5.0.5, which fixes the issue."},{"id":"CVE-2026-108823","p":1792405005013,"x":"Exposure of Sensitive Information to an Unauthorized Actor during job manipulation in Apache Kylin. The impact is minor unless job services are exposed to public network, which is uncommon.\n\n\n\nThis issue affects Apache Kylin: from 4.0.0 through 5.0.4.\n\n\n\nUsers are recommended to upgrade to version 5.0.5, which fixes…","cwe":"CWE-200"},{"id":"CVE-2026-108780","p":1792405004913,"x":"Potential JDBC source configuration validation vulnerability in Apache Kylin. The impact is minor, unless the kylin backend services are open to public network.\n\n\n\nThis issue affects Apache Kylin: from 4.0.0 through 5.0.4.\n\n\n\nUsers are recommended to upgrade to version 5.0.5, which fixes the issue."},{"id":"CVE-2026-108776","p":1792405004800,"x":"Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Kylin. The impact is moderate if kylin service is in query only mode, which is the default and most common mode.\n\n\n\nThis issue affects Apache Kylin: from 4.0.0 through 5.0.4.\n\n\n\nUsers are recommended to upgrade…","cwe":"CWE-89"},{"id":"CVE-2026-108771","p":1792405004690,"x":"Missing authentication for in-house broadcast and polymorphic deserialization vulnerability in Apache Kylin. Impact most to the kylin services that are directly exposed to public network, which is not common. In-house kylin deployments are mostly not impacted.\n\n\n\nThis issue affects Apache Kylin: from 4.0.0 through…","cwe":"CWE-306"},{"id":"CVE-2026-108766","p":1792405004587,"x":"Missing authorization on jdbc source config update in Apache Kylin. Impact most to the kylin services that are directly exposed to public network, which is not common. In-house kylin deployments are mostly not impacted.\n\n\n\nThis issue affects Apache Kylin: from 4.0.0 through 5.0.4.\n\n\n\nUsers are recommended to upgrade…"},{"id":"CVE-2026-108764","p":1792405004460,"x":"Server-Side request forgery (SSRF) vulnerability in Apache Kylin. Impact most to the kylin job service that are directly exposed to public network, which is not common. In-house kylin deployments are mostly not impacted.\n\n\n\nThis issue affects Apache Kylin: from 4.0.0 through 5.0.4.\n\n\n\nUsers are recommended to upgrade…","cwe":"CWE-918"},{"id":"CVE-2026-108762","p":1792405004313,"x":"Path-confinement bypass during metadata backup deletion in Apache Kylin. Impact most to the kylin services that are directly exposed to public network, which is not common. In-house kylin deployments are mostly not impacted.\n\n\n\nThis issue affects Apache Kylin: from 4.0.0 through 5.0.4.\n\n\n\nUsers are recommended to…"},{"id":"CVE-2026-13695","p":1792401428880,"x":"SQL injection (SQLi) vulnerability—specifically a UNION-based vulnerability—in the Integratec application that affects the sInfo parameter sent via POST to the endpoint /login/ap_Login.aspx/start. Successful exploitation of this vulnerability could allow an attacker to steal data from the database, such as credentials…","s":8.8,"v":"HIGH","cwe":"CWE-89"},{"id":"CVE-2026-112180","p":1792401428660,"x":"MISP contains a data integrity flaw in its event deletion logic. When a user deletes an event, several associated records are not removed from the database, leaving them as orphaned entries. The affected record types include event report tags, event graph entries, proposal (shadow attribute) correlations, fuzzy ssdeep…","s":5.1,"v":"MEDIUM","cwe":"CWE-459"},{"id":"CVE-2026-112179","p":1792401428457,"x":"In MISP, the event synchronization process contained a logic error in the preparation of event reports for remote push. The filtering of non-exportable tags was applied only once after the iteration over all reports, rather than to each individual report.\n\nAs a result:\n\n- All reports except the last one in the set…","s":5.3,"v":"MEDIUM","cwe":"CWE-200"},{"id":"CVE-2026-112178","p":1792401428240,"x":"MISP contains an access control flaw in the proposal (shadow attribute) visibility logic. The authorization check accepted any attribute or object carrying one of the user's sharing groups without verifying the distribution level, and denied the owning organisation access to proposals on its own organisation-only…","s":7.1,"v":"HIGH","cwe":"CWE-862"},{"id":"CVE-2026-112161","p":1792401428097,"x":"MobaXterm Personal Edition (Portable) 26.4 GA extracts the CygUtils64.plugin file without first verifying its integrity. A local attacker with write permissions on this file can replace the ‘bin/cygwin1.dll’ library contained within it with a malicious library. When the victim opens a Local Shell session or uses a…","s":8.5,"v":"HIGH","cwe":"CWE-345"},{"id":"CVE-2026-112098","p":1792401427917,"x":"A security flaw has been discovered in DeepPavlov up to 1.7.0. Impacted is the function resolve of the file deeppavlov/core/common/params.py of the component Config Reference Resolver. The manipulation results in code injection. The attack can be launched remotely. The exploit has been released to the public and may…","s":6.3,"v":"MEDIUM","cwe":"CWE-74"},{"id":"CVE-2026-112097","p":1792401427740,"x":"A vulnerability was found in SourceCodester Inventory System 1.0. This issue affects some unknown processing of the file /api/transactions_handler.php?action=save_sale of the component Sales Management Handler. The manipulation of the argument Hsn_Code results in cross site scripting. It is possible to launch the…","s":3.5,"v":"LOW","cwe":"CWE-79"},{"id":"CVE-2026-112096","p":1792401427570,"x":"A vulnerability has been found in SourceCodester Inventory System 1.0. This vulnerability affects unknown code of the file /api/transactions_handler.php?action=save_purchase of the component Purchase Records Handler. The manipulation of the argument Product_Name/Product_Code/Vendor_Name leads to cross site scripting.…","s":3.5,"v":"LOW","cwe":"CWE-79"},{"id":"CVE-2026-112095","p":1792401427400,"x":"A flaw has been found in SourceCodester Inventory System 1.0. This affects an unknown part of the file /api/products_handler.php?action=save of the component Product Management. Executing a manipulation of the argument Product_Id/Product_Name can lead to cross site scripting. The attack may be performed from remote.…","s":3.5,"v":"LOW","cwe":"CWE-79"},{"id":"CVE-2026-111438","p":1792401427173,"x":"在 openGauss-server 的 src/common/backend/libpq/hba.cpp 中，复制连接认证存在访问控制绕过。hba_getauthmethod() 在处理 HADR/SW 复制发送方时，不要求 is_node_internal_connection()，直接调用 check_hba_replication()。check_hba_replication() 仅按 replication 标记做弱匹配，缺少普通 check_hba() 中的远程 trust 禁止等完整校验。因此，非内部网络的 HADR/SW 复制连接可绕过内部连接限制和完整 pg_hba…","s":6.5,"v":"MEDIUM","cwe":"CWE-288"},{"id":"CVE-2026-104679","p":1792401426890,"x":"VOCALOID6 Editor provided by Yamaha Corporation improperly restricts XML external entity references. Loading a specially crafted project file may the product to initiate unintended communication, potentially leading to the leak of sensitive information from the device where the product is installed or resulting in a…","s":7.1,"v":"HIGH","cwe":"CWE-611"},{"id":"CVE-2026-112094","p":1792397823623,"x":"A security vulnerability has been detected in michaelrsweet mxml 4.0.5/4.0.6. This affects the function mxml_load_data of the file mxml-file.c. The manipulation leads to use after free. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used. The project was informed…","s":5.5,"v":"MEDIUM","cwe":"CWE-119"},{"id":"CVE-2026-112093","p":1792397823440,"x":"A vulnerability has been found in subhajitkhan online-clinic-management-system up to e9ee77a8827a1446220fa07ee693dc4d9a29a578. The impacted element is an unknown function of the file feedback.php. The manipulation of the argument msg leads to cross site scripting. The attack can be initiated remotely. The exploit has…","s":4.3,"v":"MEDIUM","cwe":"CWE-79"},{"id":"CVE-2026-112092","p":1792397823240,"x":"A flaw has been found in subhajitkhan online-clinic-management-system up to e9ee77a8827a1446220fa07ee693dc4d9a29a578. The affected element is the function echo of the file doctorregistration.php of the component Doctor Registration. Executing a manipulation of the argument doc_name can lead to cross site scripting. It…","s":4.3,"v":"MEDIUM","cwe":"CWE-79"},{"id":"CVE-2026-112091","p":1792397823040,"x":"A flaw has been found in Dav-ee dairy-management-system 31ace9692d1e1e6d64339a42c463b361319c615c/f31a584c3330c013b61f8b0306d9e0849c6d693d. Impacted is an unknown function of the file delivery/checkfarmer.json.php of the component AJAX Endpoint. This manipulation of the argument fname causes information disclosure.…","s":5.3,"v":"MEDIUM","cwe":"CWE-200"},{"id":"CVE-2026-112090","p":1792397822813,"x":"A vulnerability was detected in Dav-ee dairy-management-system 31ace9692d1e1e6d64339a42c463b361319c615c/f31a584c3330c013b61f8b0306d9e0849c6d693d. This issue affects the function mysqli_real_escape_string of the file payment/pay.php. The manipulation of the argument f_no/farmer results in sql injection. The attack may…","s":6.3,"v":"MEDIUM","cwe":"CWE-74"},{"id":"CVE-2026-111439","p":1792397822130,"x":"在 openGauss-server的 src/common/backend/utils/adt/genfile.cpp 模块中，内置函数 pg_read_binary_file_blocks() 存在权限校验逻辑缺陷。该函数在入口处仅校验了起始块号（startBlockNum）和块数量（blockCount）的范围，随后直接调用底层文件读取例程 ReadBinaryFileBlocksFirstCall()。该底层例程仅执行了路径规范化检查以及针对 .. 路径遍历和数据目录边界的基本检查，缺失了对调用者数据库权限（如 SELECT 权限）的校验。此外，辅助函数 is_row_data_file()…","s":4.3,"v":"MEDIUM","cwe":"CWE-862"},{"id":"CVE-2026-94294","p":1792394192950,"x":"The App Builder WordPress plugin before 5.7.1 does not require authentication or authorisation before writing attacker-supplied data to one of its options and, on a separate unauthenticated request, redirecting the visitor's browser to a URI built from that stored data.","s":5.3,"v":"MEDIUM","cwe":"CWE-862"},{"id":"CVE-2026-94272","p":1792394192830,"x":"The Snap Finance WordPress plugin before 3.12.0 does not verify that a request to change a WooCommerce order's status comes from an authorised source, allowing unauthenticated attackers to move any order into a paid state or force it to fail.","s":5.3,"v":"MEDIUM","cwe":"CWE-862"},{"id":"CVE-2026-94231","p":1792394192710,"x":"The TrueBooker WordPress plugin before 1.3.0 does not have authorisation checks in place in some of its functionality, allowing unauthenticated users to create and modify booking services and categories, including their prices.","s":5.3,"v":"MEDIUM","cwe":"CWE-862"},{"id":"CVE-2026-94230","p":1792394192580,"x":"The TrueBooker WordPress plugin before 1.3.0 does not have authorisation checks in some of its AJAX actions, and does not validate the submitted service price server-side, allowing unauthenticated users to create bookings at a price of their choosing and to attach them to arbitrary customer accounts.","s":5.3,"v":"MEDIUM","cwe":"CWE-862"},{"id":"CVE-2026-94229","p":1792394192450,"x":"The TrueBooker WordPress plugin before 1.3.0 does not verify that the requester owns a booking before rendering its confirmation summary, allowing unauthenticated attackers to enumerate booking identifiers and retrieve the personal information of customers who booked an appointment, as well as invalidate the…","s":5.3,"v":"MEDIUM","cwe":"CWE-639"},{"id":"CVE-2026-94228","p":1792394192320,"x":"The TrueBooker WordPress plugin before 1.3.0 does not perform any capability check on one of its setup handlers, and the token it does check is issued to unauthenticated visitors, allowing anyone to overwrite the plugin's entire configuration and to discard any setting they do not supply.","s":5.3,"v":"MEDIUM","cwe":"CWE-862"},{"id":"CVE-2026-91831","p":1792394192187,"x":"The Subscribe to Comments WordPress plugin before 2.3.3 does not sanitise newline characters from a notification sender-name setting before using it in e-mail headers, allowing users with Author-level access and above to inject arbitrary e-mail headers, such as a hidden Bcc, and to spoof the sender.","s":3.8,"v":"LOW","cwe":"CWE-93"},{"id":"CVE-2026-86791","p":1792394192043,"x":"The iPOSpays Payment Gateway for WooCommerce WordPress plugin before 1.4.7 does not verify that a payment was actually completed before recording an order as paid, allowing unauthenticated users to mark any unpaid order as paid and to rewrite its total.","s":5.3,"v":"MEDIUM","cwe":"CWE-345"},{"id":"CVE-2026-76740","p":1792394191900,"x":"A security vulnerability in HPE Compute Scale-up Server 3200 and 3250 platforms, Superdome Flex and Superdome Flex 280 servers could be exploited remotely to execute arbitrary commands on the RMC.","s":7.2,"v":"HIGH","cwe":"CWE-78"},{"id":"CVE-2026-74922","p":1792394191760,"x":"The Document Gallery WordPress plugin through 5.1.1 does not verify the signature on one of its unauthenticated webhook endpoints when no shared secret has been configured, which is the default state, allowing unauthenticated users to replace the thumbnail image the site publishes for any document.","s":5.3,"v":"MEDIUM","cwe":"CWE-345"},{"id":"CVE-2026-74921","p":1792394191613,"x":"The Document Gallery WordPress plugin through 5.1.1 does not sanitise or escape several gallery shortcode attributes before embedding them in a single-quoted HTML attribute in the rendered gallery markup, allowing users with the Contributor role and above to inject arbitrary event handlers that execute when a higher…","s":6.8,"v":"MEDIUM","cwe":"CWE-79"},{"id":"CVE-2026-16460","p":1792394191253,"x":"A flaw was found in bootc and ostree. Already-staged deployments are finalized without revalidating the deployment's container image against the current containers signature policy. Unsigned OS content staged under a prior permissive policy can remain bootable after policy is hardened to reject unsigned images,…","s":7.4,"v":"HIGH","cwe":"CWE-345"},{"id":"CVE-2026-112089","p":1792394191050,"x":"A security vulnerability has been detected in Dav-ee dairy-management-system 31ace9692d1e1e6d64339a42c463b361319c615c/f31a584c3330c013b61f8b0306d9e0849c6d693d. This vulnerability affects the function mysqli_query of the file employees/delete.php. The manipulation of the argument e_payroll_no leads to sql injection.…","s":4.7,"v":"MEDIUM","cwe":"CWE-74"},{"id":"CVE-2026-112088","p":1792394190873,"x":"A weakness has been identified in Dav-ee dairy-management-system 31ace9692d1e1e6d64339a42c463b361319c615c/f31a584c3330c013b61f8b0306d9e0849c6d693d. This affects the function mysqli_query of the file farmers/add.php. Executing a manipulation of the argument f_no/f_id/f_name/f_locallity/f_ac/f_phone can lead to sql…","s":6.3,"v":"MEDIUM","cwe":"CWE-74"},{"id":"CVE-2026-112087","p":1792394190690,"x":"A weakness has been identified in itsourcecode Online Cake Ordering System 1.0. This issue affects some unknown processing of the file confirm.php. This manipulation of the argument cancel causes sql injection. The attack may be initiated remotely. The exploit has been made available to the public and could be used…","s":6.3,"v":"MEDIUM","cwe":"CWE-74"},{"id":"CVE-2026-110034","p":1792394190513,"x":"The Salon Booking System WordPress plugin before 10.31.11 does not enforce a minimum of zero when subtracting a fixed-amount discount from a booking's total, allowing an unauthenticated visitor who knows a valid discount code to create a confirmed booking stored with a negative total.","s":3.7,"v":"LOW","cwe":"CWE-20"},{"id":"CVE-2026-106010","p":1792394190397,"x":"The BDM Digital Payment Gateway WordPress plugin through 1.3.12 does not verify the credentials on its public payment-status update route and treats unset credentials as valid, allowing unauthenticated attackers to mark arbitrary WooCommerce orders as paid without payment in the default configuration.","s":5.3,"v":"MEDIUM","cwe":"CWE-862"},{"id":"CVE-2026-103311","p":1792394190260,"x":"The Coinbase Commerce Payment Gateway for WooCommerce WordPress plugin through 1.4.1 does not verify the authenticity of incoming payment webhook notifications, because the shared secret used to validate the request signature is empty by default and nothing rejects an unconfigured secret, allowing unauthenticated…","s":5.3,"v":"MEDIUM","cwe":"CWE-345"},{"id":"CVE-2026-94273","p":1792390645523,"x":"The Snap Finance WordPress plugin through 3.11.0 does not verify that the payment provider's response actually confirms a completed, approved transaction before marking a WooCommerce order as paid, allowing unauthenticated attackers to mark arbitrary orders as paid without completing payment.","s":5.3,"v":"MEDIUM","cwe":"CWE-862"},{"id":"CVE-2026-91047","p":1792390645390,"x":"The ElementsReady Addons for Elementor WordPress plugin through 6.7.2 does not properly restrict access to protected WooCommerce product downloads, allowing unauthenticated users to bypass the payment requirement and retrieve any product's paid downloadable file.","s":5.3,"v":"MEDIUM","cwe":"CWE-862"},{"id":"CVE-2026-91046","p":1792390645223,"x":"The ElementsReady Addons for Elementor WordPress plugin through 6.7.2 does not perform authorization checks that halt execution in several of its settings-save handlers, allowing users with subscriber-level access and above to overwrite the ElementsReady Addons for Elementor WordPress plugin through 6.7.2's stored…","s":4.3,"v":"MEDIUM","cwe":"CWE-284"},{"id":"CVE-2026-89286","p":1792390645050,"x":"The FormFlow for GoHighLevel (GHL)  WordPress plugin through 1.0.0 does not restrict access to a log file it writes inside the publicly accessible uploads directory, allowing unauthenticated attackers to read its contents, which include connected-CRM identifiers and, on sites that have linked the integration, a…","s":5.3,"v":"MEDIUM","cwe":"CWE-200"},{"id":"CVE-2026-76739","p":1792390644730,"x":"A potential security vulnerability in HPE Compute Scale-up Server 3200 and 3250 platforms and Superdome Flex server could be remotely exploited to list and modify RMC filesystem.","s":4.3,"v":"MEDIUM","cwe":"CWE-20"},{"id":"CVE-2026-16487","p":1792390644203,"x":"A flaw was found in bootc when operating with the default containers signature policy. Automatic or manual upgrades of a mutable image tag may apply unsigned content for registries that fall through to insecureAcceptAnything, allowing an attacker who can update that tag to execute arbitrary OS content as the host root…","s":8.1,"v":"HIGH","cwe":"CWE-345"},{"id":"CVE-2026-112086","p":1792390643667,"x":"A vulnerability was found in ESPnet up to 202610.post2. This affects the function build_model of the file espnet3/publication/inference_model.py of the component Inference Model Handler. The manipulation of the argument _target_ results in deserialization. It is possible to launch the attack remotely. The exploit has…","s":6.3,"v":"MEDIUM","cwe":"CWE-20"},{"id":"CVE-2026-112083","p":1792390643377,"x":"A security flaw has been discovered in sgl-project SGLang up to 0.5.19. Affected is the function WeightExporter.send_weights_to_remote_instance of the file python/sglang/srt/model_executor/model_runner_components/weight_exporter.py of the component Weight Exporter. Performing a manipulation of the argument group_name…","s":5.3,"v":"MEDIUM","cwe":"CWE-404"},{"id":"CVE-2026-112082","p":1792390643013,"x":"A vulnerability was identified in sgl-project SGLang up to 0.5.19. This impacts the function Scheduler.expert_distribution_handle of the file python/sglang/srt/eplb/expert_distribution.py of the component Expert-Distribution Recording Endpoint. Such manipulation leads to denial of service. It is possible to launch the…","s":7.5,"v":"HIGH","cwe":"CWE-404"},{"id":"CVE-2026-112081","p":1792390642430,"x":"A vulnerability was determined in hankcs HanLP up to 2.1.0-beta.64. This affects the function hanlp.load of the file plugins/hanlp_common/hanlp_common/reflection.py of the component Model Config Loading. This manipulation of the argument classpath causes deserialization. It is possible to initiate the attack remotely.…","s":6.3,"v":"MEDIUM","cwe":"CWE-20"},{"id":"CVE-2026-108121","p":1792390642163,"x":"Brian Mariani from DigitalCanion SA has discovered a  vulnerability in the domain creation functionality of koozali's \nSME Server version 11.0rc1-215, allowing an attacker with high privileges \nto inject reserved Apache configuration directives, corrupting \nhttpd.conf and preventing Apache from starting after a server…","s":6.9,"v":"MEDIUM","cwe":"CWE-20"},{"id":"CVE-2026-108120","p":1792390641097,"x":"Brian Mariani from DigitalCanion SA has discovered a path traversal vulnerability in the View Logs functionality of \nkoozali's SME Server version 11.0rc1-215 allowing an unauthenticated \nattacker to access files outside of the intended directory, leading to \nexfiltration of files located outside the intended system…","s":7.7,"v":"HIGH","cwe":"CWE-31"},{"id":"CVE-2026-106933","p":1792390640817,"x":"The Blaze Demo Importer WordPress plugin before 1.0.17 does not sanitize uploaded SVG files and registers the SVG MIME type for the WordPress media library unconditionally, allowing authenticated users with the Author role or higher to upload a crafted SVG that executes arbitrary JavaScript in the browser of any user…","s":6.8,"v":"MEDIUM","cwe":"CWE-79"},{"id":"CVE-2026-106028","p":1792390640510,"x":"The ActiveTrail for WooCommerce WordPress plugin through 1.2.6 does not perform any authorization check before creating WooCommerce coupons, allowing unauthenticated attackers to create arbitrary coupons, including 100%-off and free-shipping coupons.","s":5.3,"v":"MEDIUM","cwe":"CWE-862"},{"id":"CVE-2026-106014","p":1792390637607,"x":"The Gateway for Vantiv on WC WordPress plugin through 1.0.1 does not verify the authenticity of the payment notification received on its hosted-payment return handler, allowing unauthenticated attackers to mark orders as paid without actually paying.","s":5.3,"v":"MEDIUM","cwe":"CWE-284"},{"id":"CVE-2026-112080","p":1792387024993,"x":"A vulnerability was found in LlamaChinese Llama-Chinese up to 6fa0fffb0dd82fe3cfaa1449ee54a5806d26ae9b. The impacted element is the function get_class_from_dynamic_module of the file examples/chat_gradio_no_merge.py of the component Adapter Config. The manipulation of the argument base_model_name_or_path results in…","s":6.3,"v":"MEDIUM","cwe":"CWE-74"},{"id":"CVE-2026-112079","p":1792387024773,"x":"A vulnerability has been found in hankcs HanLP up to 2.1.0-beta.64. The affected element is the function load_word2vec_as_vocab_tensor of the file hanlp/utils/torch_util.py. The manipulation of the argument vectors.vocab leads to deserialization. The attack is possible to be carried out remotely. The exploit has been…","s":6.3,"v":"MEDIUM","cwe":"CWE-20"},{"id":"CVE-2026-112078","p":1792387024570,"x":"A flaw has been found in RVC-Project Retrieval-based-Voice-Conversion-WebUI up to 2.3.260718. Impacted is the function change_info_ of the file webui.py. Executing a manipulation of the argument ckpt_path can lead to code injection. The attack can be executed remotely. The exploit has been published and may be used.…","s":6.3,"v":"MEDIUM","cwe":"CWE-74"},{"id":"CVE-2026-112077","p":1792387024347,"x":"A vulnerability was detected in radareorg radare2 6.2.0/6.2.2. This issue affects the function r_core_cmd_str_pipe in the library libr/core/rtr_http.inc.c of the component HTTP Sandbox Policy Handler. Performing a manipulation results in protection mechanism failure. Remote exploitation of the attack is possible. The…","s":5.6,"v":"MEDIUM","cwe":"CWE-693"},{"id":"CVE-2026-112076","p":1792383429543,"x":"A security vulnerability has been detected in alexta69 MeTube up to 2026.09.28. This vulnerability affects the function DownloadQueue.__write_feed_metadata_sync of the file app/ytdl.py of the component Feed-metadata Thumbnail Fetch Handler. Such manipulation leads to server-side request forgery. The attack may be…","s":5.6,"v":"MEDIUM","cwe":"CWE-918"},{"id":"CVE-2026-112075","p":1792383429287,"x":"A weakness has been identified in unslothai unsloth up to 0.1.501-beta. This affects the function FastSentenceTransformer._is_transformer_module_ref of the file unsloth/models/sentence_transformer.py. This manipulation of the argument Type causes use of externally-controlled input to select classes or code. The attack…","s":6.3,"v":"MEDIUM","cwe":"CWE-470"},{"id":"CVE-2026-112074","p":1792383428910,"x":"A security flaw has been discovered in Tencent ncnn up to 44b02dabdcf97499281a4692ebd65bad73dcf8b6. Affected by this issue is the function ncnn::yuv420sp2rgb of the file src/mat_pixel.cpp of the component Conversion API. The manipulation results in integer overflow. The attack can be launched remotely. The exploit has…","s":6.3,"v":"MEDIUM","cwe":"CWE-189"},{"id":"CVE-2026-112073","p":1792383428707,"x":"A vulnerability was identified in Tencent ncnn up to 44b02dabdcf97499281a4692ebd65bad73dcf8b6. Affected by this vulnerability is the function matmul_transb of the file src/layer/matmul.cpp of the component MatMul. The manipulation leads to out-of-bounds read. The attack can be initiated remotely. The exploit is…","s":6.3,"v":"MEDIUM","cwe":"CWE-119"},{"id":"CVE-2026-112045","p":1792383428373,"x":"A vulnerability was detected in donetick up to 0.1.82. The impacted element is the function CanDeleteHistory of the file internal/chore/model/model.go of the component History Deletion Handler. The manipulation of the argument AssignedTo results in improper authorization. The attack can be launched remotely. The…","s":5.4,"v":"MEDIUM","cwe":"CWE-266"},{"id":"CVE-2026-111440","p":1792383423657,"x":"在 openGauss-connector-jdbc 的 pgjdbc/src/main/java/org/postgresql/log/LogFactory.java 中，LogFactory 根据 JDBC 连接参数中的 logger 类名调用 Class.forName 加载类后，直接反射调用以 String 为参数的构造函数，再转换为 Log。缺少 asSubclass(Log.class) 校验，非 Log 实现类也会在类型检查前被实例化。因此，当攻击者可控制 JDBC URL 或连接属性中的 logger 类名，且客户端 classpath 中存在可被加载的类时，可能在客户端触发非预期的类加载与构造副作用。\n\n此漏洞自…","s":7,"v":"HIGH","cwe":"CWE-470"},{"id":"CVE-2026-112044","p":1792379819153,"x":"A security vulnerability has been detected in dotnet eShop up to 913acea66708a59595351174cee9b29f37179d29. The affected element is the function AddApplicationServices of the file src/Catalog.API/Extensions/Extensions.cs of the component Catalog API. The manipulation leads to improper authentication. The attack can be…","s":7.3,"v":"HIGH","cwe":"CWE-287"},{"id":"CVE-2026-112043","p":1792379818920,"x":"A weakness has been identified in calcom cal.com and cal.diy up to 6.2.0. Impacted is the function createWebhookProcedure of the file packages/trpc/server/routers/viewer/webhook/util.ts of the component Webhook Handler. Executing a manipulation of the argument ID can lead to authorization bypass. It is possible to…","s":6.3,"v":"MEDIUM","cwe":"CWE-285"},{"id":"CVE-2026-112042","p":1792379818720,"x":"A security flaw has been discovered in diem-project diem up to 116974edfb9a5b8bd69cb13586dc62bcdbb485ad. This issue affects the function dmBaseLinkTag::text of the file dmCorePlugin/lib/view/html/link/dmBaseLinkTag.php of the component dmWidget. Performing a manipulation of the argument text results in cross site…","s":3.5,"v":"LOW","cwe":"CWE-79"},{"id":"CVE-2026-111441","p":1792379818543,"x":"在 openGauss-server 的 src/gausskernel/cbb/utils/hll/hll.cpp 中，内置函数 HllObjectUnpack() 存在长度校验缺陷。该函数从用户提供的 packed HLL 解析 lenUsed 与 lenTotal 后，仅检查输入长度足以覆盖 HLL_HEAD_SIZE + lenUsed，随后按 lenTotal 分配缓冲区、按 lenUsed 调用 memcpy_s() 拷贝输入，既未校验 lenTotal >= lenUsed，也将 memcpy_s() 目标大小写成 lenUsed 而非实际分配的…","s":8.1,"v":"HIGH","cwe":"CWE-122"},{"id":"CVE-2026-103091","p":1792379818377,"x":"Missing Authorization (CWE-862) and Initialization of a Resource with an Insecure Default (CWE-1188) in the MCP proxy (HandleStreamPassThrough in mcp_service.go) and OIDC registration flow (GET /info and POST /register in internal/controlplane/server.go) in Google OSS Agent Mesh (SAM) versions 0.1.0-alpha.1 through…","s":9.3,"v":"CRITICAL","cwe":"CWE-200"},{"id":"CVE-2026-102503","p":1792379818193,"x":"Missing Authentication for Critical Function (CWE-306) and Missing Authorization (CWE-862) in the /libp2p-http ingress server (StartIngressServer in cmd/sam-node/node.go) in Google OSS Agent Mesh (SAM) versions 0.1.0-alpha.1 through 0.1.0-alpha.2 allow an unauthenticated remote libp2p peer to bypass Biscuit capability…","s":9.3,"v":"CRITICAL","cwe":"CWE-306"},{"id":"CVE-2026-112041","p":1792376226840,"x":"A vulnerability was identified in diem-project diem up to 116974edfb9a5b8bd69cb13586dc62bcdbb485ad. This vulnerability affects the function dmString::random of the file dmCorePlugin/lib/basic/dmString.php. Such manipulation leads to cryptographically weak prng. The attack may be performed from remote. A high…","s":3.7,"v":"LOW","cwe":"CWE-331"},{"id":"CVE-2026-112040","p":1792376226667,"x":"A vulnerability was determined in diem-project diem up to 116974edfb9a5b8bd69cb13586dc62bcdbb485ad. This affects an unknown part of the file dmCorePlugin/plugins/dmUserPlugin/modules/dmUser/lib/BasedmUserActions.class.php of the component Sign-In. This manipulation of the argument Referer causes open redirect. The…","s":4.3,"v":"MEDIUM","cwe":"CWE-601"},{"id":"CVE-2026-112039","p":1792376226503,"x":"A vulnerability was found in diem-project diem up to 116974edfb9a5b8bd69cb13586dc62bcdbb485ad. Affected by this issue is the function append of the file dmAdminPlugin/modules/dmConsole/actions/actions.class.php of the component Administrative Console. The manipulation of the argument dm_command results in cross site…","s":2.4,"v":"LOW","cwe":"CWE-79"},{"id":"CVE-2026-112038","p":1792376226313,"x":"A vulnerability has been found in diem-project diem up to 116974edfb9a5b8bd69cb13586dc62bcdbb485ad. Affected by this vulnerability is the function html of the file dmAdminPlugin/web/js/dmAdminCtrl.js of the component Version Check Service. The manipulation leads to cross site scripting. Remote exploitation of the…","s":2.4,"v":"LOW","cwe":"CWE-79"},{"id":"CVE-2026-112037","p":1792376226133,"x":"A flaw has been found in diem-project diem up to 116974edfb9a5b8bd69cb13586dc62bcdbb485ad. Affected is an unknown function of the file dmCorePlugin/lib/vendor/gapi/gapi.class.php of the component Google Analytics Client. Executing a manipulation can lead to improper certificate validation. The attack may be launched…","s":3.7,"v":"LOW","cwe":"CWE-287"},{"id":"CVE-2026-108984","p":1792376225997,"x":"A vulnerability is in Web Server default connection ports under the process name GeoWebServer.exe .","s":7.5,"v":"HIGH","cwe":"CWE-121"},{"id":"CVE-2026-108983","p":1792376225853,"x":"A vulnerability is in Web Server default connection ports under the process name GeoWebServer.exe .","s":9.8,"v":"CRITICAL","cwe":"CWE-78"},{"id":"CVE-2026-112036","p":1792372597677,"x":"A vulnerability was detected in Artifex MuPDF up to 1.28.5. This impacts the function free_char_list of the file source/pdf/pdf-xref.c of the component Signature Locking. Performing a manipulation results in double free. The attack may be initiated remotely. The exploit is now public and may be used. The patch is…","s":4.3,"v":"MEDIUM","cwe":"CWE-119"},{"id":"CVE-2026-112035","p":1792372597510,"x":"A security vulnerability has been detected in aircheng-org iWebShop-5 up to 5.16. This affects the function send_message_mobile of the file controllers/simple.php. Such manipulation of the argument user_id leads to weak password recovery. The attack can be launched remotely. The exploit has been disclosed publicly and…","s":6.3,"v":"MEDIUM","cwe":"CWE-640"},{"id":"CVE-2026-112034","p":1792372597340,"x":"A weakness has been identified in aircheng-org iWebShop-5 up to 5.16. The impacted element is the function IController::redirect of the file plugins/_userInfo/_userInfo.php of the component Login Redirect. This manipulation of the argument callback causes open redirect. The attack can be initiated remotely. The…","s":4.3,"v":"MEDIUM","cwe":"CWE-601"},{"id":"CVE-2026-112033","p":1792372596473,"x":"A security flaw has been discovered in aircheng-org iWebShop-5 up to 5.16. The affected element is the function admin_repwd/admin_repwd_act of the file controllers/system.php of the component Password Change. The manipulation of the argument password/repassword results in cross-site request forgery. It is possible to…","s":4.3,"v":"MEDIUM","cwe":"CWE-352"},{"id":"CVE-2026-112032","p":1792368991790,"x":"A vulnerability was identified in aircheng-org iWebShop-5 up to 5.16. Impacted is the function Util::search of the file classes/util.php. The manipulation leads to sql injection. It is possible to initiate the attack remotely. The exploit is publicly available and might be used. The project was informed of the problem…","s":4.7,"v":"MEDIUM","cwe":"CWE-74"},{"id":"CVE-2026-112031","p":1792368991587,"x":"A vulnerability was determined in Chamilo LMS up to 1.11.40/2.0.3/3.0.1. This issue affects the function TicketManager::addProject of the file main/inc/lib/TicketManager.php of the component Ticket Module. Executing a manipulation of the argument Name can lead to cross site scripting. The attack may be performed from…","s":3.5,"v":"LOW","cwe":"CWE-79"},{"id":"CVE-2026-112030","p":1792368990640,"x":"A vulnerability was found in diem-project diem up to 5.1.3. This vulnerability affects unknown code of the file dmCorePlugin/lib/data/dmDataLoad.php. Performing a manipulation results in use of default password. The attack is possible to be carried out remotely. The exploit has been made public and could be used. It…","s":6.3,"v":"MEDIUM","cwe":"CWE-1393"},{"id":"CVE-2026-112112","p":1792365416767,"x":"An IPv6 FlowSpec validation bypass in the CZ.NIC BIRD Internet Routing Daemon allows an established BGP peer to inject FlowSpec rules matching destinations outside the address space authorized by the unicast-route validation procedure. With validation enabled on the receiving flow6 channel, BIRD fails to reject a…","s":2.3,"v":"LOW","cwe":"CWE-1284"},{"id":"CVE-2026-112111","p":1792365416583,"x":"The Bootstrap Shortcodes plugin for WordPress before 3.4.6 is vulnerable to stored XSS via the id attribute of the [bs_tcontent] shortcode. The bs_tcontent() shortcode handler in inc/bs_tabs.php emits the id attribute value into an unquoted HTML attribute. esc_attr() is applied, but it does not encode space…","s":5.1,"v":"MEDIUM","cwe":"CWE-79"},{"id":"CVE-2026-112029","p":1792365416417,"x":"A vulnerability has been found in diem-project diem up to 5.1.3. This affects an unknown part of the file lib/model/doctrine/PluginDmUser.class.php of the component SHA1 Handler. Such manipulation of the argument salt/password leads to password hash with insufficient computational effort. The attack needs to be…","s":2.5,"v":"LOW","cwe":"CWE-326"},{"id":"CVE-2026-112028","p":1792365416247,"x":"A flaw has been found in light0011 cms c774dce31c6df0055568a8d5c53d964d99be199d/f72cf46f601efb2a0618c3814cc2f61380b38930. Affected by this issue is some unknown functionality of the file App/Home/Controller/VoteController.class.php of the component Vote Handler. This manipulation of the argument X-Requested-With…","s":6.5,"v":"MEDIUM","cwe":"CWE-840"},{"id":"CVE-2026-112027","p":1792365416073,"x":"A vulnerability was detected in light0011 cms c774dce31c6df0055568a8d5c53d964d99be199d/f72cf46f601efb2a0618c3814cc2f61380b38930. Affected by this vulnerability is the function file_exists of the file Public/Home/js/uploadify/check-exists.php of the component Uploadify. The manipulation of the argument filename results…","s":5.3,"v":"MEDIUM","cwe":"CWE-200"},{"id":"CVE-2026-112026","p":1792365415750,"x":"A security vulnerability has been detected in light0011 cms c774dce31c6df0055568a8d5c53d964d99be199d/f72cf46f601efb2a0618c3814cc2f61380b38930. Affected is the function sha1 of the file App/Home/Model/UserModel.class.php. The manipulation of the argument Password leads to password hash with insufficient computational…","s":3.7,"v":"LOW","cwe":"CWE-326"},{"id":"CVE-2026-112025","p":1792361790410,"x":"A weakness has been identified in light0011 cms c774dce31c6df0055568a8d5c53d964d99be199d/f72cf46f601efb2a0618c3814cc2f61380b38930. This impacts an unknown function of the file App/Home/Controller/UserController.class.php of the component Captcha Validation. Executing a manipulation can lead to improper access…","s":7.3,"v":"HIGH","cwe":"CWE-266"},{"id":"CVE-2026-97859","p":1792350993637,"x":"Seven Gitea API routes under `/api/v1/users/{username}` (followers, following, following/{target}, starred, subscriptions, keys and gpg_keys) were registered without the `individualPermsChecker` middleware that enforces the visibility of the target user. An authenticated user could therefore read the followers,…","cwe":"CWE-862"},{"id":"CVE-2026-97204","p":1792350993530,"x":"Deleting a label compared the ID of the repository in the request against the organization ID of organization labels, and the two ID sequences overlap. A user with write access to the issues of a repository could therefore delete the labels of an organization that has the same numeric ID as that repository. Labels are…","cwe":"CWE-863"},{"id":"CVE-2026-110494","p":1792350993403,"x":"Adding attachments to a release checked the repository and release of an attachment but not whether it was already linked to an issue or comment. A user with write access to the releases of a repository, who knew the UUID of an attachment in that repository, could link it to a release. This exposed the file name, size…","cwe":"CWE-639"},{"id":"CVE-2026-110324","p":1792350993297,"x":"The visibility check of Gitea user profiles was applied to GET requests only, while `POST /{username}` (follow and unfollow) required only a signed-in user. Any authenticated user could therefore obtain the full name, location, website and description of a user with a private profile from the response. The issue was…","cwe":"CWE-200"},{"id":"CVE-2026-110311","p":1792350993197,"x":"Creating a draft release through the API returned an `assets` list that was built from a release without an ID, which matched every attachment that was not linked to a release. A user who could create a draft release in a repository therefore received the metadata (file name, UUID, upload time, size and download…","cwe":"CWE-200"},{"id":"CVE-2026-109844","p":1792350993090,"x":"`GET /api/v1/user/subscriptions` returned the metadata of every repository a user was watching without checking that the user still had access to it. A user who watched a private repository while having access, and later lost it, for example through a team permission downgrade, could still read its name, description,…","cwe":"CWE-862"},{"id":"CVE-2026-109553","p":1792350992997,"x":"Gitea resolved the principals of an SSH certificate by searching the content of all stored public keys instead of only principal keys. When Gitea trusts a user certificate authority (`SSH_TRUSTED_USER_CA_KEYS`) and accepts arbitrary principals (`SSH_AUTHORIZED_PRINCIPALS_ALLOW=anything`), a user could register another…"},{"id":"CVE-2026-107686","p":1792350992903,"x":"The Gitea web handlers for adding and removing reactions on issues and comments did not refuse locked issues for users without write access, although the API did. A signed-in user who could read an issue could therefore add or remove reactions on a locked issue and its comments, bypassing the interaction restriction…"},{"id":"CVE-2026-107618","p":1792350992807,"x":"`POST /{owner}/{repo}/topics` was registered without the sign-in middleware that provides the cross-origin protection, so a request issued by a third-party site was not rejected. A repository administrator who visited a malicious page could have the topics of their repository changed. No other repository settings were…"},{"id":"CVE-2026-105964","p":1792350992700,"x":"The Gitea Actions artifact v4 (Twirp) handlers read the whole request body into memory without a size limit. A user who can run a workflow and obtains the runner token of that run could send an oversized request to the artifact service and exhaust the memory of the server, which terminates the Gitea process. The…","cwe":"CWE-770"},{"id":"CVE-2026-105661","p":1792350992590,"x":"Requesting `/{username}/-/repositories` for an individual user instead of an organization made the organization home handler dereference a nil organization and panic. The request needs no authentication and no special configuration. The server answered with an HTTP 500 error and logged a panic for each request; the…","cwe":"CWE-248"},{"id":"CVE-2026-104627","p":1792350992463,"x":"The Gitea OpenID association callback in the security settings accepted a positive OpenID 2.0 assertion without checking that the signed-in user had started the linking. Because OpenID 2.0 allows unsolicited assertions, an attacker-controlled OpenID provider could attach the attacker's identity to the account of a…","cwe":"CWE-287"},{"id":"CVE-2024-4457","p":1792347388467,"x":"The Management Console fails to properly validate input related to the configuration of JDBC user stores. This weakness allows an attacker to supply specially crafted input that can lead to the execution of arbitrary code on the affected server.\n\nSuccessful exploitation of this vulnerability enables an attacker to…","cwe":"CWE-78"},{"id":"CVE-2026-111993","p":1792343803020,"x":"A flaw has been found in Soarkey StudentManagement up to e08f7f1d5015af407aa4cca0ada3dea189b4937e. Impacted is the function UserDao.login of the file code/src/service/AdminDao.java. This manipulation of the argument Password causes cleartext storage of sensitive information. The attack is restricted to local…","s":3.3,"v":"LOW","cwe":"CWE-310"},{"id":"CVE-2026-111992","p":1792343801987,"x":"A vulnerability was detected in itsmeravitejak Online-Examination-System up to e6208e630b14657999bbfe4c9912302d2a1e2449. This issue affects the function Exam::startExam of the file exam.php of the component Exam Module. The manipulation of the argument topicid results in sql injection. The attack can be executed…","s":6.3,"v":"MEDIUM","cwe":"CWE-74"},{"id":"CVE-2026-98868","p":1792340261320,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\ndm-pcache: reject a kset that overruns its segment\n\ncache_replay(), the writeback worker and the GC worker read a kset of\nget_kset_onmedia_size() bytes and advance the position by it. A forged\nkey_num makes that size exceed the segment's remaining…"},{"id":"CVE-2026-98867","p":1792340261220,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\ndm-pcache: bound the logical key offset from persistent memory\n\ncache_key_decode() takes a key's logical off from the cache device and\nlater indexes req_key_tree->subtrees[] by it in get_subtree(). An off\npast the device forms a subtree pointer…"},{"id":"CVE-2026-98866","p":1792340261117,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nsched/cache: Introduce task_struct->sched_cache_grp to fix UAF\n\nAdd a sched_cache_grp pointer to task_struct so that scheduler code\ncan access the cache group directly via the task, without going\nthrough mm->sched_cache_grp.  This decouples the…"},{"id":"CVE-2026-98865","p":1792340260973,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nsched_ext: Don't run ops.dequeue() with a DSQ lock held\n\nops.dequeue() is invoked with the source user DSQ's lock still held on\nthe consume and move paths (scx_consume_dispatch_q(),\nmove_task_between_dsqs()). A BPF scheduler which locks the source…"},{"id":"CVE-2026-98864","p":1792340260877,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nsched_ext: Wait for SCX_OPSS_DISPATCHING before reenqueueing a task\n\nebf1ccff79c4 (\"sched_ext: Fix ops.dequeue() semantics\") moved the final\nops_state store in scx_dispatch_enqueue() after the DSQ unlock so that the\ncustody update and ops.dequeue()…"},{"id":"CVE-2026-98863","p":1792340260780,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: x86: Re-pend GET_NESTED_STATE_PAGES if getting said pages fails\n\nRe-pend GET_NESTED_STATE_PAGES before exiting to userspace if getting the\nnested pages fails in the KVM_RUN path.  If userspace re-runs the vCPU, and\nvmcs02 holds valid PFNs from…"},{"id":"CVE-2026-98862","p":1792340260677,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\naudit: fix exe mark UAF in kill_rules()\n\nkill_rules() removes mixed AUDIT_DIR and AUDIT_EXE rules when an audit\ntree is pruned. It drops entry->rule.exe before removing the rule from\nthe RCU-visible filter lists.\n\nAfter a rule has been installed with…"},{"id":"CVE-2026-98861","p":1792340260573,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nfprobe: Use guard(rcu_sched_notrace) and check rcu_is_watching()\n\nunregister_fprobe() and unregister_fprobe_async() (used by BPF\nkprobe-multi) rely on standard RCU grace periods (synchronize_rcu()\nand call_rcu()) to wait until in-flight fprobe…"},{"id":"CVE-2026-98860","p":1792340260470,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nHID: bpf: cast size to ssize_t when checking hid_bpf_hw_request\n\nAs reported by Sashiko:\nIf a transport driver encounters a hardware error and returns a negative\nerror code such as -EPIPE, ret is implicitly promoted to size_t when\ncompared against…"},{"id":"CVE-2026-98859","p":1792340260363,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nHID: multitouch: stop the release timer from being rearmed on remove\n\nmt_remove() quiesces the sticky-finger timer before stopping the\nhardware:\n\n    timer_delete_sync(&td->release_timer);\n\n    sysfs_remove_group(&hdev->dev.kobj,…"},{"id":"CVE-2026-98858","p":1792340260257,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nio_uring: fix task_work add use-after-free with SQPOLL\n\nFor SQPOLL, the sqpoll thread runs task_work off its own list and\ndoesn't need to be told about it, so it can pop and complete a request\nas soon as mpscq_push() has published it. If that was the…"},{"id":"CVE-2026-98857","p":1792340260150,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nipvs: bound LBLCR and LBLC cache growth\n\nip_vs_lblcr_new() and ip_vs_lblc_new() create cache entries for\nevery previously unseen destination address. The table max_size only\ntells the periodic collector to reclaim entries after the cache has\nalready…"},{"id":"CVE-2026-98856","p":1792340260050,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nkprobes: Skip disarmed probes when checking optkprobe overlap\n\nOn x86, an optkprobe at A replaces five bytes with a jump. If a disabled\nprobe B is at A+2, get_optimized_kprobe() stops at B when arming a new\nprobe C at A+4. It leaves A optimized:…"},{"id":"CVE-2026-98855","p":1792340259937,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nof/overlay: put property on deadprops only after changeset add succeeds\n\nadd_changeset_property() links a new property of a not-yet-live\ntarget node into the node's deadprops list before handing it to\nof_changeset_add_property(). If that fails, the…"},{"id":"CVE-2026-98854","p":1792340259833,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nof/overlay: only treat a positive changeset id as registered\n\nof_overlay_fdt_apply() stores the idr_alloc() return value in\novcs->id before checking it. On failure the stored id is negative,\nfree_overlay_changeset()'s \"if (ovcs->id)\" check passes,…"},{"id":"CVE-2026-98853","p":1792340259733,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: gso: limit recursive IP-in-IP segmentation\n\nIP-in-IP GSO can re-enter inet_gso_segment() or ipv6_gso_segment()\nfor each nested IP header. encap_level tracks header bytes, not callback\ndepth, so a deep chain can exhaust the kernel stack. Making…"},{"id":"CVE-2026-98852","p":1792340259593,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: extend IPv6 exthdr detection of tunneled packets\n\nCommit c4336a07eb6b (\"net: correctly handle tunneled traffic on IPV6_CSUM\nGSO fallback\") split skb_gso_has_extension_hdr() into mutually exclusive\nbranches on skb->encapsulation. This did not yet…"},{"id":"CVE-2026-98851","p":1792340259490,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nft_flow_offload: drop flowtable reference on init error path\n\nnft_flow_offload_init() bumps the flowtable use count with\nnft_use_inc() before calling nf_ct_netns_get().  When the latter\nfails, the error is returned as-is and the reference…"},{"id":"CVE-2026-98850","p":1792340259390,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet/packet: prevent TX_RING byte count overflow\n\ntpacket_snd() drains every SEND_REQUEST frame in a TX ring and adds\neach valid packet length to the signed int len_sum. Userspace can\nrecycle completed frames concurrently, so a single blocking send…"},{"id":"CVE-2026-98849","p":1792340259283,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\npfcp: fix socket lifetime on netdevice registration failure\n\npfcp_newlink() creates the UDP socket before register_netdevice().\nIf registration fails after pfcp_dev_init() succeeds, the core calls\npfcp_dev_uninit(), which releases the socket and…"},{"id":"CVE-2026-98848","p":1792340259163,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nrtc: ac100: Assign .num before accessing .hws\n\nCommit f316cdff8d67 (\"clk: Annotate struct clk_hw_onecell_data with\n__counted_by\") annotated the hws member of 'struct clk_hw_onecell_data'\nwith __counted_by, which informs the bounds sanitizer…"},{"id":"CVE-2026-98847","p":1792340259047,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nrtc: spear: initialize IRQ state before requesting alarm IRQ\n\ndevm_request_irq() enables the interrupt before it returns, so the handler\nmay run while probe is still initializing the device. Initialize the MMIO\naddress and spinlock before requesting…"},{"id":"CVE-2026-98846","p":1792340258947,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nsctp: check RCV_SHUTDOWN after the sendmsg connect wait\n\nsctp_wait_for_connect() drops the socket lock while it sleeps. An\nout-of-the-blue ABORT can then be processed from the socket backlog and\nunlink the association. If a concurrent shutdown(fd,…"},{"id":"CVE-2026-98845","p":1792340258833,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\ntpm: Disable TPM on null key name mismatch\n\nThe null key name check exists to protect against TPM reset attacks, so\na mismatch should stop the device from serving further requests.\nCurrently it does not disable the chip when it finds a mismatch.\n\nThe…"},{"id":"CVE-2026-98844","p":1792340258720,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nnetfs: clear post-EOF pagecache when extending a file via write\n\nFix netfs to erase the contents of a hole created after the EOF by an\nordinary write if dirty data has been previously left there by writes\nthrough an mmapped region.  Neither the…"},{"id":"CVE-2026-98843","p":1792340258623,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nnetfs: zero gaps in read-gaps folio to avoid writing back stale data\n\nnetfs_read_gaps() leaves gaps around a streaming write's dirty region\nunread on the server side, so a short/EOF response there left stale\nfolio content that later got written back.…"},{"id":"CVE-2026-98842","p":1792340258527,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nmodule: fix lost error code from codetag_load_module()\n\nIf codetag_load_module() fails, err is not set to reflect the failure\nand load_module() returns 0 after the module has been torn down.\n\nAlso, if the module is a livepatch, mod->klp_info…"},{"id":"CVE-2026-98841","p":1792340258417,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nvirt: vmgenid: set driver_data before registering notification handlers\n\nBoth probe paths register their notification handler before assigning\ndriver_data, which the handler dereferences.\n\nIn the devicetree path, the notification IRQ can fire as soon…"},{"id":"CVE-2026-98840","p":1792340258293,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nvc_screen: reload vc pointer before if (ret) in vcs_write() to avoid UAF\n\nThe reload of 'vc' added by commit 8fb9ea65c9d1 (\"vc_screen: reload load\nof struct vc_data pointer in vcs_write() to avoid UAF\") sits after the\n'if (ret)' block, so the…"},{"id":"CVE-2026-98839","p":1792340258170,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nvt: selection: Fix unsigned underflow and slab-out-of-bounds read in paste_selection()\n\nIn paste_selection(), the loop copies min_t(unsigned int,\nvc_sel.buf_len - pasted,tty->receive_room) bytes per iteration into\ntty_ldisc_receive_buf() and…"},{"id":"CVE-2026-98838","p":1792340258060,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nvt: skip screen update for DEC alignment test on backgroup consoles\n\n[BUG]\nRecently, we encountered a KASAN warning as follows:\n\nBUG: KASAN: slab-out-of-bounds in fb_pad_aligned_buffer+0x11f/0x140\nRead of size 1 at addr ff1100015fd9f6a4 by task…"},{"id":"CVE-2026-98837","p":1792340257943,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: caiaq: unregister the input device when probe fails\n\nsetup_card() registers the input device, whose name and phys point into\nstruct snd_usb_caiaqdev, and then goes on to snd_card_register() and\nsnd_usb_caiaq_control_init(). If either fails,…"},{"id":"CVE-2026-98836","p":1792340257830,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: line6: reject oversized playback packets\n\nEach playback URB is handed a slice of out.buffer that is exactly\nLINE6_ISO_PACKETS * max_packet_size_out bytes, sized from the OUT\nendpoint, but the number of bytes written into that slice is never…"},{"id":"CVE-2026-98835","p":1792340257730,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\niio: accel: kionix-kx022a: Fix array boundary check\n\nThe driver performs a sanity check for an array size, when converting a\nregister value to an array index. The check incorrectly accepts the\nsizeof(array) as a last index, when last valid index…"},{"id":"CVE-2026-98834","p":1792340257633,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nmtd: core: avoid double-free of OTP NVMEM device\n\nIf factory OTP setup fails after the user OTP NVMEM device has been\nregistered, mtd_otp_nvmem_add() unregisters the user device but leaves\nmtd->otp_user_nvmem set. On an error, the caller unregisters…"},{"id":"CVE-2026-98833","p":1792340257537,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nmtd: core: call _get_device() with the master MTD\n\n__get_mtd_device() calls the master's _get_device() callback with mtd,\nwhich may be a partition. __put_mtd_device() passes the master.\n\nThis breaks gluebi partitions because gluebi_get_device() uses…"},{"id":"CVE-2026-98832","p":1792340257443,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nblk-cgroup: save IRQ state in blkg_tryget_closest()\n\nbio_set_dev() associates the bio with a blkg through bio_associate_blkg().\nIf the blkg lookup misses, blkg_tryget_closest() takes q->queue_lock with\nspin_lock_irq() and releases it with…"},{"id":"CVE-2026-98831","p":1792340257347,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nof/overlay: don't leak fragment references when changeset init fails\n\ninit_overlay_changeset() stores the number of initialized fragments\nin ovcs->count only on full success. When find_target() or the\n__symbols__ lookup fails partway through, the…"},{"id":"CVE-2026-98830","p":1792340257250,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: wfx: validate MIB read length before copying to caller\n\nwfx_hif_read_mib() copies reply->length bytes from the firmware\nresponse into the caller-provided buffer without checking that\nreply->length does not exceed val_len. A firmware response…"},{"id":"CVE-2026-98829","p":1792340257140,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mac80211: drop oversized fragments to avoid extra_len overflow\n\nIn ieee80211_rx_h_defragment(), fragment payloads are accumulated into\nentry->extra_len as subsequent fragments arrive:\n\n        entry->extra_len += rx->skb->len;\n\nWhen the final…"},{"id":"CVE-2026-98828","p":1792340257043,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: ath9k: reject short WMI command responses\n\nath9k_wmi_rsp_callback() removes the validated WMI header and copies\nthe number of bytes expected by the waiting command into its response\nbuffer. A device response shorter than that expectation can…"},{"id":"CVE-2026-98827","p":1792340256937,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: ath9k_htc: bound TX aggregation to MAX_TX_BUF_SIZE\n\n__hif_usb_tx() dequeues up to MAX_TX_AGGR_NUM (20) frames into a\nsingle tx_buf of MAX_TX_BUF_SIZE (32768) bytes, limiting the batch\nby record count but never by cumulative byte length.\n\nWith…"},{"id":"CVE-2026-98826","p":1792340256823,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nrtc: ac100: Fix clock provider use-after-free on probe failure\n\nac100_rtc_register_clks() registers the RTC-32k clock with\nclk_hw_register_fixed_rate() and the clock provider with\nof_clk_add_hw_provider(). Neither is device managed, and both are…"},{"id":"CVE-2026-98825","p":1792340256720,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nrtc: mpfs: fix unchecked devm_clk_get() error pointer in probe()\n\ndevm_clk_get(&pdev->dev, \"rtcref\")'s return value was passed straight\ninto clk_get_rate() without checking it for an error first, unlike the\n\"rtc\" clock a few lines above which is…"},{"id":"CVE-2026-98824","p":1792340256630,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mac80211: validate TX status rate metadata\n\nminstrel_ht_tx_status() converts the HT/VHT rate reported in a TX status\ninto a group and rate index and uses those to index the minstrel_ht rate\ntables.  The existing validation only checked that an…"},{"id":"CVE-2026-98823","p":1792340256533,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: cfg80211: preserve hidden-group beacon IE ownership\n\nA hidden-group probe-response entry borrows its beacon IEs from the\ngroup's beacon entry. cfg80211_update_assoc_bss_entry() can pass such\nan entry to cfg80211_update_known_bss() when merging…"},{"id":"CVE-2026-98822","p":1792340256437,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mac80211: prevent AP VLAN tx from other interfaces\n\nSince the station lookup was factored out of ieee80211_build_hdr(),\nieee80211_lookup_ra_sta() uses sta_info_get_bss() for all AP and AP VLAN\nframes, not only for control port frames. A unicast…"},{"id":"CVE-2026-98821","p":1792340256337,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nblock: reject polled dio with user integrity metadata\n\nIOCB_HAS_METADATA leaves iocb->private as a uio_meta, while\niocb_bio_iopoll() expects a bio. Since 2729a60bbfb9, metadata I/O\nalways uses __blkdev_direct_IO(), which never publishes the bio for…"},{"id":"CVE-2026-98820","p":1792340256240,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nblk-mq: set RQF_USE_SCHED when the operation is known\n\nThe cached requests are allocated for one operation but can be handed\nout for another. A passthrough command has RQF_USE_SCHED cleared, so\nusing those flags for a subsequent read/write bio will…"},{"id":"CVE-2026-98819","p":1792340256143,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: btintel: validate DDC record lengths\n\nParse DDC record lengths in unsigned storage so 0xFF does not wrap.\nReject records smaller than the mandatory three-byte header, records\nexceeding U8_MAX, and records exceeding remaining firmware bytes…"},{"id":"CVE-2026-98818","p":1792340256017,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nmm/slab: do not wake up kswapd in __kfree_rcu_sheaf()\n\nSince kfree_rcu() can be called under pi_lock (a raw spinlock in the\nscheduler), kfree_rcu() itself should never allocate memory with\n__GFP_KSWAPD_RECLAIM as waking up kswapd ends up acquiring…"},{"id":"CVE-2026-98817","p":1792340255890,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nASoC: SDCA: Add better pm_runtime error handling in func probe\n\nAdd a common error path in probe that balances the runtime PM reference."},{"id":"CVE-2026-98816","p":1792340255770,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Fix overflow of jump offset in constant blinding\n\nbpf_jit_blind_insn() rewrites 'if rX op imm goto off' into:\n\n  AX = imm ^ rnd\n  AX ^= rnd\n  if rX op AX goto off\n\nand subtracts 2 from off when the jump is backward. off is s16, so\n-32767 and…"},{"id":"CVE-2026-98815","p":1792340255640,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nnvme: fix cdev lifetime\n\nSashiko bot reported a potential problem for the cdev lifetime in [0]\n- the code there is heavily based on the NVMe code.\n\nCurrently the NS head .open and .release file_operations methods take and\nput a reference to the…"},{"id":"CVE-2026-98814","p":1792340255540,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nnvme: fix command effects log lifetime for multipath heads\n\nKASAN reported a use-after-free when an I/O passthrough command was sent\nthrough a multipath namespace head after the controller path that first\ncreated the head had been removed:\n\n  BUG:…"},{"id":"CVE-2026-98813","p":1792340255427,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Hold map BTF for the memory allocator destructor record\n\nbpf_ma_set_dtor() duplicates map->record so that the bpf_mem_alloc\ndestructor can release the special fields of hash and rhash map elements\nonce the allocator frees them for good.…"},{"id":"CVE-2026-98812","p":1792340255313,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet/mctp: publish the mctp_dev only after it is initialised\n\nmctp_add_dev() links the new mctp_dev into dev->mctp_ptr before mdev->dev\nis assigned, so a reader that picks the device up in that window\ndereferences a net_device pointer that is still…"},{"id":"CVE-2026-98811","p":1792340255200,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: cls_api: reclaim an empty proto on the error path\n\nTwo racing tc filter add requests on the same chain/prio of an\nunlocked classifier both run change() on the shared proto and both\ncan fail: the winner's tcf_chain_tp_delete_empty() attempt…"},{"id":"CVE-2026-98810","p":1792340255103,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mac80211: fix slab-out-of-bounds read in ieee80211_monitor_select_queue()\n\nieee80211_monitor_select_queue() validates the skb length using skb->len\nbefore dereferencing pointers into skb->data to access the 802.11 header.\nHowever, skb->len…"},{"id":"CVE-2026-98809","p":1792340254997,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: hci_sync: don't drain cmd_sync backlog on unregister\n\nhci_unregister_dev() disables cmd_work and cmd_timer, then calls\nhci_cmd_sync_clear(), whose cancel_work_sync() waits for\nhci_cmd_sync_work() to return. That worker dequeues and runs…"},{"id":"CVE-2026-98808","p":1792340254893,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: systemport: Fix buffer overflow in bcm_sysport_get_stats()\n\nWhen running on SYSTEMPORT Lite, certain statistics are unsupported and\nskipped during bcm_sysport_get_stats(). The variable 'j' tracks the\ncompacted index into the destination data…"},{"id":"CVE-2026-98807","p":1792340254787,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5: Fix slab-out-of-bounds when handling team device events\n\nThe mlx5_handle_changeupper_event() and mlx5_handle_changeinfodata_event()\nfunctions check for LAG masters (which includes both bonding and team\ndevices) but only call…"},{"id":"CVE-2026-98806","p":1792340254683,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nocteontx2-pf: Fix aura BPID assignment when CONFIG_DCB is enabled\n\nPreviously, BPID assignment under CONFIG_DCB assumed\n`queue_to_pfc_map` was always initialized. For SDP VFs this leads to\ninvalid memory access as it was not initialized.\n\nThis patch…"},{"id":"CVE-2026-98805","p":1792340254567,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\ntipc: prevent GCM nonce reuse on peer key changes\n\nTIPC can encrypt traffic between nodes using a different transmit key\nfor each node. In this mode, the AES-GCM nonce for a packet sent to a\nknown peer consists of a 32-bit prefix (a per-key salt XOR…"},{"id":"CVE-2026-98804","p":1792340254470,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: page_pool: fix use-after-free in page_pool_recycle_ring_bulk()\n\nWith CONFIG_PAGE_POOL_STATS=y, page_pool_recycle_ring_bulk() updates\nthe recycle stats after dropping the producer lock. If it just recycled\nthe last inflight netmems of a pool…"},{"id":"CVE-2026-98803","p":1792340254350,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: stmmac: fix rx Scatter-Gather support\n\nWhen a received frame is larger than dma_buf_sz, the DMA scatters it\nacross multiple RX descriptors (rx Scatter-Gather). The secondary RX\nbuffer (sec_page) was only allocated and programmed when…"},{"id":"CVE-2026-98802","p":1792340254250,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nseg6: ensure packet data is writable before modifying SRH and IPv6 DA\n\nadvance_nextseg() modifies the SRH Segments Left field and the IPv6\ndestination address without ensuring the packet data is writable.\nseg6_next_csid_advance_arg() has the same…"},{"id":"CVE-2026-98801","p":1792340254137,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: restrict SO_RESERVE_MEM to TCP sockets and cap max value\n\nCommit 2bb2f5fb21b0 (\"net: add new socket option SO_RESERVE_MEM\") and\ncommit d00c8ee31729 (\"net: fix possible NULL deref in sock_reserve_memory\")\nonly checked sk_has_account(sk), which is…"},{"id":"CVE-2026-98800","p":1792340254030,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Wait for an RCU tasks grace period before freeing trampoline progs\n\nWhen a prog is detached from a trampoline, it is freed after an RCU\ngrace period, or an RCU tasks trace one if it is sleepable. This covers\nthe tasks that are running the prog,…"},{"id":"CVE-2026-98799","p":1792340253910,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Skip detached progs in trampoline images that are still in use\n\nbpf_tramp_image_put() makes sure a trampoline image is not freed while\na task may still be running in it, but nothing similar is done for the\nprogs called by that image. Detach…"},{"id":"CVE-2026-98798","p":1792340253807,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: bcmgenet: fix NULL dereference in set_coalesce before first open\n\nThe Rx ring priv and index are only set in bcmgenet_init_rx_ring(),\nwhich runs at open. Setting the Rx coalescing parameters on an interface\nthat was never opened, e.g. \"ethtool…"},{"id":"CVE-2026-98797","p":1792340253673,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: cap skb->queue_mapping when the tx queue is picked\n\nskbedit can set skb->queue_mapping and raise the per-CPU skip_txqueue\nflag so __dev_queue_xmit() honours the mapping. __dev_queue_xmit()\ncleared the flag before sch_handle_egress() and only…"},{"id":"CVE-2026-98796","p":1792340253583,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: ethernet: mtk_eth_soc: allocate dummy netdev sooner\n\nThe RX rings and the shared NAPI are carried by an internal \"dummy\" netdev\n(eth->dummy_dev). mtk_probe() creates that dummy device, and adds the\nshared tx/rx NAPI to it, only after the MAC…"},{"id":"CVE-2026-98795","p":1792340253490,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: sparx5: skip ptp deinit if init was skipped\n\nsparx5_ptp_init() returns early on the base lan969x variants\nbecause they do not have the SPX5_FEATURE_PTP flag. It also returns early\nwhen no \"ptp\" interrupt is described. Unbinding the driver then…"},{"id":"CVE-2026-98794","p":1792340253390,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nipvs: filter some flags received in the backup server\n\nWhile the IPVS SYNC protocol is not secure by design\nwe can still protect the backup server from messages that\ncan wreak havoc.\n\nThis commit addresses problems from received connection flags\nor…"},{"id":"CVE-2026-98793","p":1792340253287,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: bpf: reject invalid NAT manipulation types\n\nAs bpf_ct_set_nat_info() is not validating the NAT manipulation type a\nwrong value can be passed directly to nf_nat_setup_info(). This triggers\nthe WARN_ON() at nf_nat_setup_info() and if…"},{"id":"CVE-2026-98792","p":1792340253183,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: flowtable: generalize pending status bit\n\nRename NF_FLOW_HW_PENDING to NF_FLOW_PENDING and use it to inhibit the\nflowtable GC worker until pending hw offload work has been completed.\n\nApparently, nf_flow_offload_stats() can schedule work…"},{"id":"CVE-2026-98791","p":1792340253087,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5e: Fix AF_XDP TX timestamp teardown NULL dereference\n\nDuring XSK TX queue teardown, outstanding descriptors are completed\nwithout a CQE. If one requested a TX timestamp, the completion path\npasses that NULL CQE to mlx5e_xsk_fill_timestamp(),…"},{"id":"CVE-2026-98790","p":1792340252987,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nperf: Fix race between perf_event_exit_task() and perf_pending_task()\n\nA race condition exists between perf_event_exit_task() and\nperf_pending_task() during begin_new_exec().\n\nDuring begin_new_exec(), perf_event_exit_task() may be called, and the…"},{"id":"CVE-2026-98789","p":1792340252887,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Fix objects stuck in free_by_rcu_ttrace\n\ndo_call_rcu_ttrace() returns early when call_rcu_ttrace_in_progress is set\nand leaves the objects in free_by_rcu_ttrace. __free_rcu() frees\nwaiting_for_gp_ttrace only and clears the flag. Hence the…"},{"id":"CVE-2026-98788","p":1792340252787,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nfutex: Fix private hash use-after-free on resize\n\npoll_state_synchronize_rcu(mm->futex.phash.batches) is used by\nfutex_ref_drop() to check that a grace period has passed since the\ncurrent hash was published. This relies on batches referencing a grace…"},{"id":"CVE-2026-98787","p":1792340252690,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Fix missing migration protection in __rhtab_map_lookup_and_delete_batch()\n\nbpf_mem_cache_free_rcu() uses this_cpu_ptr() which requires migration\nto be disabled. All callers of rhtab_delete_elem() disable migration\nexcept…"},{"id":"CVE-2026-98786","p":1792340252580,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: guard dc_sink dereferences in MST mode validation\n\ndm_dp_mst_is_port_support_mode() reads\naconnector->dc_sink->dsc_caps... for the DSC branch-throughput check,\nand get_conv_frl_bw()'s HDMI-PCON FRL-bandwidth path reads…"},{"id":"CVE-2026-98785","p":1792340252467,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: check dc_state_create_copy() for NULL in dm_suspend\n\ndc_state_create_copy() can return NULL on allocation failure.\ndm_suspend() only conditionally skips dm_gpureset_toggle_interrupts()\nand continues execution, returning success.…"},{"id":"CVE-2026-98784","p":1792340252367,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu/gfx6: fix firmware leak on teardown\n\nThe firmware requested in gfx_v6_0_init_microcode() is not released\nwhen the GFX block is torn down, leaking the firmware resources.\n\nAdd gfx_v6_0_free_microcode() and call it from gfx_v6_0_sw_fini()\nto…"},{"id":"CVE-2026-98783","p":1792340252267,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/mediatek: Add missing IS_ERR check for ovl_adaptor platform device\n\nplatform_device_register_data() can fail and return an ERR_PTR, but the\nreturn value is used without checking, leading to an invalid pointer\nbeing stored in ddp_comp[].dev and…"},{"id":"CVE-2026-98782","p":1792340252163,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/mediatek: Fix ovl adaptor platform device leak\n\nmtk_drm_probe() creates an OVL adaptor platform device with\nplatform_device_register_data() when the display pipeline requires the\nOVL adaptor.\n\nIf a later initialization step fails, the probe error…"},{"id":"CVE-2026-98781","p":1792340252060,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/mediatek: Fix pdev reference leak in mtk_drm_bind()\n\nWhen the device is not the mmsys master, mtk_drm_bind() returns early\nafter taking a reference on the disp-mutex device via\nof_find_device_by_node(), without ever dropping it: mtk_drm_unbind()…"},{"id":"CVE-2026-98780","p":1792340251960,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: fix IP instance memory leak on kobject add failure\n\namdgpu_discovery_sysfs_ips() allocates ip_hw_instance with\nkzalloc_flex() and initializes its embedded kobject before calling\nkobject_add().\n\nIf kobject_add() fails, the return value is…"},{"id":"CVE-2026-98779","p":1792340251853,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: fix ACP MFD device leak on init failure\n\nacp_hw_init() registers ACP child devices with mfd_add_devices() before\nattaching them to the ACP power domain and initializing the hardware.\n\nIf attaching a child to the power domain fails, or if…"},{"id":"CVE-2026-98778","p":1792340251757,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nbinder: fix is_failure flag for superseded transaction cleanup\n\nWhen a TF_UPDATE_TXN transaction supersedes a pending async transaction,\nbinder_release_entire_buffer() is called with is_failure=false. Since the\nsuperseded transaction was never…"},{"id":"CVE-2026-98777","p":1792340251657,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nbinder: fix leaked fd fixups on TF_UPDATE_TXN supersede\n\nWhen a TF_UPDATE_TXN transaction supersedes a pending async transaction\nin a frozen process, the outdated transaction is freed with kfree()\ndirectly. This skips binder_free_txn_fixups(),…"},{"id":"CVE-2026-98776","p":1792340251540,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nbinderfs: fix UAF write in binder_add_device\n\nbinderfs_binder_device_create() publishes the new dentry with\nd_make_persistent() and then calls simple_done_creating(), which drops\nthe parent directory lock and the creator's dentry reference. It then…"},{"id":"CVE-2026-98775","p":1792340251437,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nnitro_enclaves: fix use-after-free on SLOT_ALLOC failure\n\nWhen ne_create_vm_ioctl() fails the SLOT_ALLOC request after\nanon_inode_getfile() has succeeded, the error path calls\nfput(enclave_file) and then frees ne_enclave.\n\nIn normal userspace…"},{"id":"CVE-2026-98774","p":1792340251340,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nrust_binder: cancel deferred work items in thread exit\n\nIf there are deferred work items on the thread todo list, then they are\nnot cleaned up in the Thread::release() method. Thus, update the code to\nclean up the work items even if they are…"},{"id":"CVE-2026-98773","p":1792340251223,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nUSB: cdc-acm: skip URB restart in port_shutdown if disconnected\n\nacm_port_shutdown() is called from the tty-port machinery whenever the\nlast user closes the port.  acm_disconnect() sets acm->disconnected and\ncalls tty_port_tty_vhangup(), which…"},{"id":"CVE-2026-98772","p":1792340251127,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nUSB: serial: fix port tear down use-after-free\n\nSome drivers for multiport devices access port driver data from\ncompletion handlers of shared URBs submitted at attach() or first open()\nand stopped at disconnect() or last close(), respectively.\n\nA…"},{"id":"CVE-2026-98771","p":1792340251020,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nusb: storage: sierra_ms: reject short SWoC info transfers\n\nsierra_get_swoc_info() requests sizeof(struct swoc_info) (60) bytes\nfrom the device via usb_control_msg(), but its callers only treat a\nnegative return value as failure. A device that answers…"},{"id":"CVE-2026-98770","p":1792340250920,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nusb: gadget: midi2: Fix the jack descriptor array sizes\n\nThe jack in/out descriptor arrays in struct f_midi2_usb_config have\nthe size of MAX_CABLES, which look reasonable -- but it turned out to\nbe incorrect.  Namely, the entries for those arrays are…"},{"id":"CVE-2026-98769","p":1792340250813,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nusb: gadget: f_uac1_legacy: validate bRequest index in generic_{set,get}_cmd\n\ngeneric_set_cmd() and generic_get_cmd() use the low nibble of\nctrl->bRequest as an index into con->data[]:\n\n    u8 cmd = (ctrl->bRequest & 0x0F);  /* 0 .. 15 */\n    ...…"},{"id":"CVE-2026-98768","p":1792340250683,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nusb: typec: anx7411 - stop the IRQ before destroying the workqueue\n\nThe IRQ is devm-managed, so it can still queue plat->work while\nremove() is tearing the queue down. Disable it first."},{"id":"CVE-2026-98767","p":1792340250550,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nusb: dwc3: gadget: fix IRQ storm on invalid event buffer count\n\nWhen dwc3_check_event_buf() reads a GEVNTCOUNT value exceeding the\nevent buffer length, commit 63ccd26cd1f6 (\"usb: dwc3: gadget: check\nthat event count does not exceed event buffer…"},{"id":"CVE-2026-98766","p":1792340250440,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nusb: gadget: aspeed-vhub: cancel wake work on device removal\n\nwake_work is armed from the gadget .wakeup callback to resume suspended\ndownstream ports, and it is never cancelled in ast_vhub_remove(), so a\nwork item queued before or during removal can…"},{"id":"CVE-2026-98765","p":1792340250323,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nUSB: gadget: dummy-hcd: Fix wait for outstanding request completions\n\nThe dummy-hcd driver emulates synchronize_irq() by waiting until its\nprivate callback_usage counter drops to 0 (with the private lock not\nheld).  This counter is incremented…"},{"id":"CVE-2026-98764","p":1792340250217,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nusb: gadget: f_fs: Fix NULL pointer dereference in FUNCTIONFS_ENDPOINT_DESC\n\nWhen user space sets up FunctionFS with only full-speed descriptors\n(e.g., flags = FUNCTIONFS_HAS_FS_DESC) and the gadget operates at a\nhigher speed (such as USB_SPEED_HIGH…"},{"id":"CVE-2026-98763","p":1792340250113,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nusb: core: clear both ep_in and ep_out for non-ep0 control endpoints\n\nIn usb_enable_endpoint(), non-zero control endpoints (where\nusb_endpoint_xfer_control(&ep->desc) is true) populate both\ndev->ep_in[epnum] and dev->ep_out[epnum] with the same…"},{"id":"CVE-2026-98762","p":1792340250013,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nUSB: dwc2: shut down wakeup timer before freeing HCD state\n\ndwc2_wakeup_detected() accesses the DWC2 host state and can rearm the\nwakeup timer.  dwc2_hcd_free() currently deletes the timer only after\nfreeing host-owned state, and timer_delete() does…"},{"id":"CVE-2026-98761","p":1792340249900,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nusb: typec: tcpm: recover after failure to start the frs ams\n\nReset the port if the tcpm fails to start the FAST_ROLE_SWAP AMS by\ninitiating error recovery on it.\n\nThis helps in cases where some cables (incorrectly) signal an FRS to\nan FRS capable…"},{"id":"CVE-2026-98760","p":1792340249800,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nusb: typec: tipd: fix uninitialized typec_partner_desc in tps6598x_connect()\n\ntps6598x_connect() passes a stack-allocated typec_partner_desc to\ntypec_register_partner() after initializing only usb_pd, accessory and\nidentity.\n\ntypec_register_partner()…"},{"id":"CVE-2026-98759","p":1792340249700,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nusb: typec: tipd: fix uninitialized typec_partner_desc in cd321x_update_work()\n\ncd321x_update_work() passes a stack-allocated typec_partner_desc to\ntypec_register_partner() after initializing only usb_pd, accessory and\nidentity.…"},{"id":"CVE-2026-98758","p":1792340249607,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nusb: typec: ucsi: glink: fix use-after-free of ucsi on remove\n\nThe pmic_glink client is released by the devres cleanup, which runs\nafter pmic_glink_ucsi_remove() has returned, so its notification\ncallbacks can queue work until then. Work that runs…"},{"id":"CVE-2026-98757","p":1792340249500,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nusb: cdns3: fix use-after-free in cdns3_gadget_exit()\n\ncdns3_gadget_start() arms two works on system_freezable_wq:\npending_status_wq for the deferred ep0 status stage and aligned_buf_wq\nfor realigned request buffers. Both handlers use the…"},{"id":"CVE-2026-98756","p":1792340249397,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nusb: cdns3: Fix NULL pointer dereference in cdns3_pci_probe\n\nThe Cadence USBSS controller is a two-function PCI device. The first\nprobed function allocates the driver data and stores it with\npci_set_drvdata(), while the second function reuses it via…"},{"id":"CVE-2026-98755","p":1792340249300,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\ntty: vcc: zero-initialize control packet in vcc_send_ctl()\n\nThe stack-allocated struct vio_vcc pkt was partially initialized,\nleaving the tag.stype_env field uninitialized before being sent via\nldc_write(), potentially leaking kernel stack data to…"},{"id":"CVE-2026-98754","p":1792340249203,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\ntty: vcc: hold port lock when clearing tty pointer in vcc_cleanup\n\nvcc_cleanup() sets port->tty to NULL without holding port->lock, racing\nwith vcc_event() LDC callbacks that read port->tty under port->lock and\nthen use tty->port. This can cause a…"},{"id":"CVE-2026-98753","p":1792340249103,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\ntty: tty_port: restore TTY_IO_ERROR on activation failure\n\nMake sure to restore the TTY_IO_ERROR flag if activation fails to\nprevent I/O attempts on a port that is gone or powered down.\n\nThis specifically avoids issues like kernel panic due to…"},{"id":"CVE-2026-98752","p":1792340248993,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\ntty: port: fix tty_port_tty_vhangup() race\n\nDrivers rely on tty_port_tty_vhangup() to synchronously hang up their\nports before tearing down resources as part of deregistration (e.g. on\nphysical disconnect).\n\nIf tty_port_tty_vhangup() races with…"},{"id":"CVE-2026-98751","p":1792340248880,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\ntty: abort break signalling on hangup\n\nThe break ioctls can race with hangup and end up calling into a tty\ndriver for a device that is already gone or powered down.\n\nDrivers must handle this race, but TCSBRK and TCSBRKP should still be\naborted to…"},{"id":"CVE-2026-98750","p":1792340248767,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\ntty: fix saved termios reset race\n\nResetting saved termios state on device registration is needed where a\nminor number can be reused for an entirely different device and where\nthe old settings may prevent the port from even being opened (e.g. when…"},{"id":"CVE-2026-98749","p":1792340248660,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\ntty: serial: max3100: shut down timer before freeing port\n\nmax3100_shutdown() stops the polling timer but returns early during\nsystem suspend. If the SPI device is unbound before resume, the serial\ncore does not call max3100_shutdown() again, so…"},{"id":"CVE-2026-98748","p":1792340248557,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nserial: 8250_bcm7271: fix use-after-free in brcmuart_remove()\n\nbrcmuart_handle_irq() starts priv->hrt to work around a receive-timeout\nquirk of the 8250 core when hardware flow control is enabled; the timer\ncallback brcmuart_hrtimer_func()…"},{"id":"CVE-2026-98747","p":1792340248460,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nserial: core: fix NULL pointer dereference in serial_core_unregister_port()\n\nport->port_dev is NULL when no port device is installed: it is cleared\non teardown, and never set if registration failed before\nserial_core_port_device_add().…"},{"id":"CVE-2026-98746","p":1792340248363,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nserial: ma35d1: Fix clock reference leak in ma35d1serial_probe()\n\nof_clk_get() returns a clock with a reference that has to be released\nwith clk_put(). ma35d1serial_probe() never does that, so the reference\nis leaked on the probe error paths and also…"},{"id":"CVE-2026-98745","p":1792340248237,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\narm64/fpsimd: signal: Forbid non-streaming SVE payload on SME-only systems\n\nWhen system_supports_sme() is true but system_supports_sve() is false,\nrestoring a specifically crafted SVE signal context can result in the\ntask erroneously having…"},{"id":"CVE-2026-98744","p":1792340248140,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nASoC: codecs: max98363: fix uninitialized stream_config->type\n\nstream_config is not initialized before being passed to\nsdw_stream_add_slave().  The type field may contain garbage and is\nlater copied to stream->type by sdw_config_stream().…"},{"id":"CVE-2026-98743","p":1792340248037,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nASoC: codecs: rt1017-sdca-sdw: fix uninitialized stream_config->type\n\nstream_config is not initialized before being passed to\nsdw_stream_add_slave().  The type field may contain garbage and is\nlater copied to stream->type by sdw_config_stream().…"},{"id":"CVE-2026-98742","p":1792340247920,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: seq: Serialize compat port-info ioctls\n\nThe native sequencer ioctl path serializes handler calls with\nclient->ioctl_mutex, but the translated port-info compat path invokes the\nsame handlers through snd_seq_kernel_client_ctl() without taking…"},{"id":"CVE-2026-98741","p":1792340247807,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: ua101: reject mismatched capture/playback packet sizes\n\ndetect_usb_format() cross-checks bSubframeSize, bBitResolution and\ntSamFreq between the capture and playback interfaces, but never relates\nthe two endpoints' wMaxPacketSize and…"},{"id":"CVE-2026-98740","p":1792340247707,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nEDAC/altera: Drop __init from ECC setup paths for re-probe safety\n\nSashiko reports:\n\n\"Does suppressing sysfs unbinding fully prevent the execution of freed __init\nmemory? If altr_sysmgr_regmap_lookup_by_phandle() returns -EPROBE_DEFER, the\nprobe is…"},{"id":"CVE-2026-98739","p":1792340247590,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: RFCOMM: Fix initial port reference race\n\nFor RFCOMM_RELEASE_ONHUP devices, rfcomm_tty_install() and\n__rfcomm_release_dev() both use RFCOMM_TTY_OWNED to decide who drops the\ninitial tty_port reference. The release path tests the bit…"},{"id":"CVE-2026-98738","p":1792340247477,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: Serialize SMP remote OOB data access\n\nbuild_pairing_cmd() looks up remote OOB data and copies its contents\nwithout holding hdev->lock, which serializes the list's writers. After\nSMP finds an entry, a concurrent management Remove Remote OOB…"},{"id":"CVE-2026-98737","p":1792340247370,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: hci_sync: Fix inquiry cache use-after-free\n\nThe sync command worker holds hdev->req_lock, but inquiry-cache updates\nand flushes use hdev->lock. Both hci_acl_create_conn_sync() and\nhci_stop_discovery_sync() look up entries and read their…"},{"id":"CVE-2026-98736","p":1792340247237,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: hci_conn: Lock parent access during enhanced SCO setup\n\nBluetooth: hci_conn: Lock parent access during enhanced SCO setup\n\nhci_enhanced_setup_sync() runs on the request workqueue without the\nhci_dev_lock held by its caller when setup was…"},{"id":"CVE-2026-98735","p":1792340247127,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: hci_core: Serialize ACL scheduling with channel deletion\n\nhci_chan_sent() selects a channel under RCU but drops the read lock before\naccessing chan->conn and returning the channel. The ACL and LE schedulers\nthen use its packet queue and…"},{"id":"CVE-2026-98734","p":1792340247010,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: hci_core: Serialize SCO and ISO scheduling with teardown\n\nhci_low_sent() selects a connection under RCU but drops the read lock\nbefore calculating its quota and returning it to the scheduler. The\nconnection is then used without lifetime…"},{"id":"CVE-2026-98733","p":1792340246900,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: hci_core: Serialize fragmented ISO packet queueing\n\nThe fragmented path in hci_queue_iso() calls __skb_queue_tail() without\nholding conn->data_q.lock. The socket lock serializes senders, but the\ntransmit worker can concurrently remove…"},{"id":"CVE-2026-98732","p":1792340246807,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: btintel: fix buffer over-read in btintel_hw_error()\n\nThe \"Exception info %s\" print uses skb->data + 1, but the 12-byte\npayload is not guaranteed to be NUL-terminated and can be read past\nits end.\n\nBound the print with \"%.*s\" and skb->len -…"},{"id":"CVE-2026-98731","p":1792340246710,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: btintel_pcie: fix plen overflow in btintel_pcie_recv_frame()\n\nplen is u16 and computed as HDR_SIZE + dlen. For ACL/ISO frames dlen\nis a 16-bit field, so a value >= 0xFFFC wraps the sum, bypassing the\n\"skb->len < plen\" check and letting…"},{"id":"CVE-2026-98730","p":1792340246623,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: btintel_pcie: reject oversized TX packets in send_frame()\n\nbtintel_pcie_send_frame() eventually copies skb->data into a fixed\nBTINTEL_PCIE_BUFFER_SIZE (4096) DMA buffer via memcpy() in\nbtintel_pcie_prepare_tx(), with a 4-byte PCIe type…"},{"id":"CVE-2026-98729","p":1792340246530,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nx86/mm: Don't apply va_align to hugetlb mappings on AMD F15h\n\nget_align_mask() returns huge_page_mask_align() for hugetlbfs, but get_align_bits()\nadds va_align.bits regardless, so vm_unmapped_area() returns an address off the huge\npage boundary and…"},{"id":"CVE-2026-98728","p":1792340246430,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\ntpm: fix off-by-four bounds check in tpm2_get_random()\n\nWhen the response carries the TPM2_ST_SESSIONS tag, tpm2_get_random()\nskips the 4-byte parameter size field before locating the random data,\nbut the bounds check still validates the response…"},{"id":"CVE-2026-98727","p":1792340246333,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nnvme-multipath: set BLK_FEAT_ZONED only after the zone info is known\n\nThe namespace head is marked zoned at allocation time based only on the\ncommand set identifier.  If the zone info query reports a zero zone size,\nthe path namespace is registered…"},{"id":"CVE-2026-98726","p":1792340246237,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nnvme-multipath: fix underflow in ANA log bounds checks\n\nThe number of ANA groups advertised through Identify Controller sizes the\nANA log buffer. The ANA log header and group descriptors independently\nsupply the number of groups and namespace IDs to…"},{"id":"CVE-2026-98725","p":1792340246120,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nnvmet-auth: fix out-of-bounds write in nvmet_auth_challenge()\n\nnvmet_auth_challenge() receives its output buffer as a void pointer.\nsizeof(*d) therefore evaluates to one with GCC and undercounts the fixed\nchallenge header by 15 bytes.  A short…"},{"id":"CVE-2026-98724","p":1792340246020,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nnvmet: pci-epf: reject too-short SGL segments\n\nThe host controls an SGL segment's length. A nonzero length smaller than\none SGL descriptor makes nr_descs zero, so\nnvmet_pci_epf_get_sgl_segment() reads the type byte of sgls[-1] outside\nthe allocated…"},{"id":"CVE-2026-98723","p":1792340245917,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nnvmet: copy the hostid into the ctrl before creating PR pc_refs\n\nCommit 6202783184bf (\"nvmet: Improve nvmet_alloc_ctrl() interface and\nimplementation\") added a second uuid_copy() of args->hostid near the end\nof nvmet_alloc_ctrl(), and commit…"},{"id":"CVE-2026-98722","p":1792340245813,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nmtd: block2mtd: Fix divide error when erase_size is zero\n\nThe erase size is parsed from the \"block2mtd\" module parameter and can\nbe set to zero. add_device() then evaluates\n\n        if (size % erase_size)\n\nwith a zero divisor, which triggers a divide…"},{"id":"CVE-2026-98721","p":1792340245713,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nmtd: rawnand: cadence: Initialize IRQ state before requesting IRQ\n\nThe Cadence NAND interrupt handler uses both the IRQ lock and completion\nobject. Registering the IRQ before initializing them leaves a window in\nwhich a pending interrupt can access…"},{"id":"CVE-2026-98720","p":1792340245583,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: nVMX: Force MSR bitmap refresh if runtime eVMCS controls are modified\n\nForce a refresh of the vmcs02 MSR bitmap during nested VM-Enter if the\nruntime eVMCS controls (pin, primary, secondary, etc.) are being updated.\nIf L1 isn't intercepting TPR…"},{"id":"CVE-2026-98719","p":1792340245463,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: SEV: Nullify \"have run CPUs\" mask pointer when freeing it\n\nNullify have_run_cpus when freeing the mask, particularly in the error path\nof __sev_guest_init(), so that KVM doesn't have to subtly use sev->active\nto track whether or not the mask has…"},{"id":"CVE-2026-98718","p":1792340245363,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: SEV: Do cache maintenance on the source VM *before* clearing SEV state\n\nExplicitly flush caches after intra-host migration before clearing \"SEV\nactive\" on the source VM, as doing cache maintenance afterwards creates a\ntiny window where memory…"},{"id":"CVE-2026-98717","p":1792340245250,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: x86/mmu: Bail from shadow walks if the root is invalid or a dummy\n\nWhen walking shadow page tables, immediately terminate the walk if the root\nis a \"dummy\" root, i.e. a root whose top-level page table is backed by the\nzero page, but otherwise…"},{"id":"CVE-2026-98716","p":1792340245150,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: SVM: Use the active VMCB's MSR bitmap when checking if MSR is intercepted\n\nUse the MSR permission bitmap of the active VMCB instead of assuming that\nKVM is always using vmcb02's bitmap when L2 is active, as KVM uses msrpm02\nif and only if L1…"},{"id":"CVE-2026-98715","p":1792340245050,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: SVM: Preserve TLB control (i.e. pending TLB flush) on failed VMRUN\n\nDon't reset the VMCB's TLB control back to \"do nothing\" on a failed VMRUN,\nas empirical testing shows that the CPU performs the requested TLB flush if\nand only if VMRUN is…"},{"id":"CVE-2026-98714","p":1792340244953,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: SVM: Update control fields on #VMEXIT if and only if VMRUN succeeded\n\nLeave control.erap_ctl and control.clean as-is in the VMCS if VMRUN fails,\nbecause as per AMD:\n\n  there's no explicit architectural guarantee about the behavior in the…"},{"id":"CVE-2026-98713","p":1792340244857,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: arm64: Apply the fine-grained UNDEFs without FEAT_FGT\n\nFGUs don't actually require hardware support, so don't gate fgt trap\nconfig insertion on FGT. This is the only action required to allow FGUs\nalways, as kvm_calculate_traps() already computes…"},{"id":"CVE-2026-98712","p":1792340244760,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: arm64: vgic: Take a refcount on IRQs referenced by last_lr_irq\n\nReferencing the last interrupt inserted in an LR is rather fragile, as\nthis interrupt can vanish if a concurrently unmapped LPI.\n\nSolve this by bumping up the refcount on the…"},{"id":"CVE-2026-98711","p":1792340244653,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: cw1200: fix TX padding OOB read leaking heap data to device\n\nThe TX path rounds the transfer size up to the bus alignment\n(align_size(), up to 511 bytes for SDIO, 1 byte for SPI) but sends\nthe padded length straight from the frame buffer, which…"},{"id":"CVE-2026-98710","p":1792340244540,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: iwlegacy: 3945: free EEPROM data on remove\n\nil3945_pci_probe() calls il_eeprom_init(), which allocates memory for\nthe EEPROM data. The probe failure paths release this allocation with\nil_eeprom_free(), but the remove path does not free it after…"},{"id":"CVE-2026-98709","p":1792340244437,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mac80211: count only matching reservations in reserved switch\n\nieee80211_vif_use_reserved_switch() validates a replacement by counting\nassigned links on ctx->replace_ctx and treating reservations too\nbroadly. A link can still be assigned to the…"},{"id":"CVE-2026-98708","p":1792340244337,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mac80211: keep paired old chanctx alive\n\nAn in-place replacement keeps reciprocal replace_ctx pointers between\nthe old WILL_BE_REPLACED chanctx and the new REPLACES_OTHER chanctx.\nHowever, the early free paths only consider assigned and…"},{"id":"CVE-2026-98707","p":1792340244230,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mac80211: shut down RX BA session timer on teardown\n\nTearing down an RX BA session can leave the session timer queued on a\nfreed tid_rx. Later timer-wheel processing and the timer callback itself\nthen run against freed memory.\n\nAn RX BAR…"},{"id":"CVE-2026-98706","p":1792340244117,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mac80211: drain PS delivery work during station teardown\n\nRemoving an AP or mesh station can notify the driver and wake TXQs after\nthe station has already been removed from the driver, and can update\nnum_sta_ps and the power-save queues after…"},{"id":"CVE-2026-98705","p":1792340244017,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mac80211: account proxy paths against the mesh path limit\n\nProxy-path churn can drive the interface path counter negative and let\nlater mesh path additions exceed MESH_MAX_MPATHS.\n\nmesh_path_free_rcu() decrements the interface mpaths counter…"},{"id":"CVE-2026-98704","p":1792340243913,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mac80211: keep fallback association elements alive\n\nAssociating to a non-transmitted MBSSID profile reads freed memory while\ndetermining the operating channel and applying HT capabilities.\n\nWhen an association response omits WMM, HT, or VHT…"},{"id":"CVE-2026-98703","p":1792340243810,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mac80211: minstrel_ht: validate fixed rate index\n\nThe fixed_rate_idx debugfs file is a plain u32 attribute, so any value\ncan be written to it.  minstrel_ht_update_stats() then copies the value\ninto mi->max_tp_rate[] and mi->max_prob_rate, and…"},{"id":"CVE-2026-98702","p":1792340243700,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mac80211: reject invalid 320 MHz CSA bandwidth\n\nThe HT/VHT channel definition validator can receive a 320 MHz\nbandwidth indication from a received CSA frame on a non-6 GHz link.\nIt warns for this unsupported width but continues with an…"},{"id":"CVE-2026-98701","p":1792340243597,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mac80211: release mesh path quota on failed additions\n\nRepeated failed or duplicate mesh path additions can exhaust\nMESH_MAX_MPATHS while the path table holds fewer paths, which stops new\npaths to reachable destinations from being created.…"},{"id":"CVE-2026-98700","p":1792340243497,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mac80211: set info->band for 802.3 encap offload frames\n\nUnlike the 802.11 TX paths, ieee80211_8023_xmit() does not set\ninfo->band from the channel context on non-MLD interfaces. It stays at\n0, so ieee80211_get_tx_rates() uses the wrong band…"},{"id":"CVE-2026-98699","p":1792340243390,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mac80211: fix mesh fast xmit path deletion UAF\n\nmesh_fast_tx_cache() stores raw mesh_path pointers. Path deletion\nflushes the cache and then frees the path with kfree_rcu(), but a\nlookup that already holds the path can insert a new cache entry…"},{"id":"CVE-2026-98698","p":1792340243280,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mac80211: handle empty FILS association request payload\n\nfils_encrypt_assoc_req() accepts a (Re)Association Request frame whose\nlast element is the FILS Session element.  crypt_len is then zero and\naes_siv_encrypt() is called with an empty…"},{"id":"CVE-2026-98697","p":1792340243177,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nUSB: serial: fix dynamic id driver deregistration race\n\nOnly free the dynamic ids after having deregistered the driver and\nremoved the \"new_id\" attribute to avoid leaking any id added by a racing\nwrite to the attribute."},{"id":"CVE-2026-98696","p":1792340243070,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nUSB: serial: fix driver deregistration order\n\nUSB serial driver modules register one driver for the USB bus and one or\nmore drivers for the ports on the USB serial bus.\n\nWhen unloading a driver module, the USB driver must be deregistered\nbefore the…"},{"id":"CVE-2026-98695","p":1792340242960,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nUSB: serial: fix ioctl hangup race\n\nThe tty ioctls can race with hangup and end up calling into a tty driver\nfor a device that is already gone or powered down.\n\nSerialise the callbacks using the tty port mutex and add the missing\nchecks to make sure…"},{"id":"CVE-2026-98694","p":1792340242830,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nthunderbolt: Fix KASAN reported use-after-free when request is canceled\n\nAlan reported that when doing stress testing sometimes KASAN notices\nuse-after-free during control channel operation (stripped down keeping\nthe relevant parts):\n\n BUG: KASAN:…"},{"id":"CVE-2026-98693","p":1792340242727,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nthunderbolt: Hold a router reference for each allocated HopID\n\ntb_stop() drops the reference to all DP tunnels but does not deactivate\nthem, thus nothing cancels a dprx_work still in flight (which holds its\nown tunnel reference) and the tunnel can…"},{"id":"CVE-2026-98692","p":1792340242623,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nthunderbolt: Make the DP tunnel activation callback mandatory\n\ntb_tunnel_alloc_dp() takes an optional callback which is run from\ndprx_work once the DPRX capabilities read has completed. Without that\ncallback tb_dp_dprx_start() reads the capabilities…"},{"id":"CVE-2026-98691","p":1792340242523,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nthunderbolt: Tear down inactive DP tunnels when the domain is stopped\n\ntb_stop() only tears down DMA tunnels so a DP tunnel that is still\nwaiting for dprx_work to complete keeps that work queued while the\nrouters are removed and the control channel…"},{"id":"CVE-2026-98690","p":1792340242423,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nthunderbolt: Fix domain reference leak when DPRX read is canceled\n\ntb_tunnel_one_dp() takes a domain reference which is only dropped once\ntb_dp_tunnel_active() has run on the work queue. If that work is\ncancelled that reference is leaked. Since…"},{"id":"CVE-2026-98689","p":1792340242317,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nthunderbolt: Don't access a DP tunnel after its DPRX read was canceled\n\ntb_dp_dprx_work() checks ->dprx_canceled before it takes tb->lock so it\nmisses a tb_dp_dprx_stop() that could not cancel the already running\nwork. It then polls the DPRX…"},{"id":"CVE-2026-98688","p":1792340242207,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nthunderbolt: Fix NULL dereference in tb_remove_work()\n\nThere is a slight race between tb_remove_work() and tb_domain_remove()\nwhich leads to dereferencing a NULL tb->root_switch pointer inside\ntb_free_unplugged_xdomains():\n\n        Thread A…"},{"id":"CVE-2026-98687","p":1792340242097,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nthunderbolt: Reject oversized XDomain properties responses\n\ntb_xdp_properties_request() allocates room for 45 data dwords in its\n252-byte response buffer.  The XDomain length field is six bits wide,\nhowever, and a malicious peer can set it to 63.…"},{"id":"CVE-2026-98686","p":1792340241993,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: discard post-EOF pagecache when extending a file via zero range\n\nsmb3_zero_range() removed the pagecache only for the range being zeroed,\nso when it extends the file the folio straddling the old EOF - which may\nhold data dirtied past EOF…"},{"id":"CVE-2026-98685","p":1792340241890,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: discard post-EOF pagecache when extending a file via clone range\n\ncifs_remap_file_range() discarded the pagecache only for the folios\noverlapping the destination region, so when a clone extends the file the\nfolio straddling the old EOF -…"},{"id":"CVE-2026-98684","p":1792340241770,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: flush and commit data before querying allocated ranges\n\nThe mode 0 / FALLOC_FL_KEEP_SIZE fallocate emulation for small interior\nranges in smb3_simple_fallocate_range() issues\nFSCTL_QUERY_ALLOCATED_RANGES and zero-fills any sub-range the…"},{"id":"CVE-2026-98683","p":1792340241660,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: flush dirty data before zeroing a range\n\nsmb3_zero_range() emulates FALLOC_FL_ZERO_RANGE by invalidating the\npage cache over the target range with truncate_pagecache_range() and\nthen issuing FSCTL_SET_ZERO_DATA to the server.\n\nDirty data…"},{"id":"CVE-2026-98682","p":1792340241557,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: drain and invalidate before server-side copy/clone\n\ncifs_file_copychunk_range() and the clone (FICLONE) path of\ncifs_remap_file_range() do not serialise the destination page cache\nagainst the server-side copy the way the other…"},{"id":"CVE-2026-98681","p":1792340241457,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: split cifsFileInfo bitfields to avoid shared-byte RMW races\n\nThe invalidHandle, swapfile, oplock_break_cancelled, offload,\nand status_file_deleted fields are stored in the same bitfield byte\nin struct cifsFileInfo, but are updated in…"},{"id":"CVE-2026-98680","p":1792340241357,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\niio: accel: kionix-kx022a: Prevent memory leak and fix state\n\nThe driver allocates memory for samples at buffer enable path. If regmap\noperation fails in the kx022a_fifo_enable() at the buffer enable path, the\nallocated memory is never freed.…"},{"id":"CVE-2026-98679","p":1792340241253,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\niio: accel: kxcjk-1013: reject duplicate event disable\n\nThe IIO core does not filter duplicate writes to the event enable\nattribute. kxcjk1013_write_event_config() already ignores repeated\nenable requests, but a repeated disable request still calls…"},{"id":"CVE-2026-98678","p":1792340241160,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\niio: adc: ad4030: fix invalid oversampling_ratio validation\n\nIn ad4030_set_avg_frame_len(), the logarithm is calculated before input\nvalidation. Passing zero or negative values leads to an undefined result\nfrom ilog2().\n\nValidate that the input is…"},{"id":"CVE-2026-98677","p":1792340241057,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\niio: adc: ad_sigma_delta: fix use-after-free on unbind\n\nad_sd_buffer_postenable() allocates sigma_delta->samples_buf with\ndevm_krealloc() at runtime, so its devres entry sits after all\nprobe-time entries of the driver. devm resources are released in…"},{"id":"CVE-2026-98676","p":1792340240950,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\niio: adc: ade9000: fix NULL pointer dereference in clkout registration\n\nade9000_setup_clkout() passes NULL as the register address when\nregistering a divider clock. During clock registration, the common\nclock framework calls…"},{"id":"CVE-2026-98675","p":1792340240853,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\niio: adc: ade9000: handle Phase C dip events in IRQ1 handler\n\nADE9000_ST1_CROSSING_DEPTH is the exclusive upper bound for scanning the\nSTATUS1 event bits, so a value of 25 left out the highest event bit,\nADE9000_ST1_DIPC_BIT (bit 25). Phase C dip…"},{"id":"CVE-2026-98674","p":1792340240750,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\niio: adc: adi-axi-adc: Initialize state mutex\n\nThe AXI ADC register access paths serialize transactions with st->lock,\nbut probe does not initialize it. Initialize the mutex before registering\nthe backend."},{"id":"CVE-2026-98673","p":1792340240650,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\niio: adc: pac1934: check ACPI label duplication\n\nA label duplication failure currently reaches the terminating-byte\nwrite. Release the ACPI result and abort before accessing the missing\nlabel; earlier labels are managed by devres.\n\nDetected by static…"},{"id":"CVE-2026-98672","p":1792340240543,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\niio: adc: stm32-adc: fix possible division by zero in processed channel\n\nIn case the conversion has failed or returned zero, processing *val\ncan lead to a division by zero. Need to check for errors, or converted\nvalue is zero, before processing the…"},{"id":"CVE-2026-98671","p":1792340240407,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\niio: adc: sun4i-gpadc-iio: clean up on thermal zone registration failure\n\nIf devm_thermal_of_zone_register() fails, probe returns without\nunregistering the IIO map array or disabling runtime PM.\n\nJump to err_map to release them."},{"id":"CVE-2026-98670","p":1792340240300,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\niio: adc: xilinx-xadc: free IRQ before cancelling the unmask worker on unbind\n\nThe ZYNQ XADC alarm IRQ handler queues zynq_unmask_work via\nschedule_delayed_work(); that work is cleared by a devm callback.\nRegister the devm callback before…"},{"id":"CVE-2026-98669","p":1792340240190,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\niio: buffer: serialize buffer teardown with mode claims\n\nBuffer-mode claims hold mlock to guarantee that the device remains in\nbuffer mode until the claim is released. Normal buffer updates take\ninfo_exist_lock followed by mlock in…"},{"id":"CVE-2026-98668","p":1792340240097,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\niio: buffer: Ensure bounce buffer used for unaligned case is zeroed.\n\niio_push_to_buffers_with_ts_unaligned() leaks uninitialized heap memory\nto userspace if the data passed in is not a multiple of 8 bytes and the\ntimestamp is enabled. Specify…"},{"id":"CVE-2026-98667","p":1792340239997,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\niio: frequency: adf4377: Fully initialize clk_init_data and clk_parent_data\n\nThe clk_init_data structure contains several mutually-exclusive members\nfor different methods to specify the possible parents of a clock,\nprompting drivers to initialize…"},{"id":"CVE-2026-98666","p":1792340239900,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\niio: gyro: adis16136: fix unprotected debugfs reads\n\nThe serial_number file operations are open coded and never call\ndebugfs_file_get(), which debugfs_create_file_unsafe() requires.\ndebugfs_remove_recursive() therefore does not wait for a read in…"},{"id":"CVE-2026-98665","p":1792340239797,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\niio: health: max30102: fix NULL dereference in interrupt handler\n\nThe interrupt is requested in max30102_probe() and stays enabled\nfor the lifetime of the device, but indio_dev->active_scan_mask is only\nvalid while a buffer is enabled. When an…"},{"id":"CVE-2026-98664","p":1792340239697,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\niio: imu: adis16400: fix unprotected debugfs reads\n\nadis16400_serial_number_fops is open coded and never calls\ndebugfs_file_get(), so debugfs_remove_recursive() does not wait for a\nread in progress and unbind frees the iio_dev underneath it.\n\nCommit…"},{"id":"CVE-2026-98663","p":1792340239603,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\niio: imu: adis16480: fix unprotected debugfs reads\n\nThe firmware_revision and firmware_date file operations are open coded\nand never call debugfs_file_get(), which debugfs_create_file_unsafe()\nrequires. debugfs_remove_recursive() therefore does not…"},{"id":"CVE-2026-98662","p":1792340239507,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\niio: light: gp2ap020a00f: drain irq_work after free_irq\n\nThe threaded IRQ handler queues data->work through irq_work_queue() so\nthe trigger is polled from a per-CPU context.  free_irq() does not flush\nan irq_work the handler already queued, so after…"},{"id":"CVE-2026-98661","p":1792340239410,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\niio: light: rohm-bu27034: Fix infinite delay on error\n\nWhen reading an integration-time fails, the code will use error code to\ncompute the sleep time.\n\nFix this by using the smallest integration time as a default if\nreading fails."},{"id":"CVE-2026-98660","p":1792340239313,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\niio: pressure: bmp280: fix out-of-bounds access in sampling frequency lookup\n\nThe sampling frequency tables store each frequency as an integer part and\na fractional part in micro units. num_sampling_freq_avail is initialized\nto the number of…"},{"id":"CVE-2026-98659","p":1792340239213,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\niio: pressure: rohm-bm1390: Return error when read fails\n\nThe data reading function ignores the cached error value, and\nunconditionally returns 0. Return cached 'ret' -value after stopping\nthe measurement so user knows if read failed and data is…"},{"id":"CVE-2026-98658","p":1792340239110,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\niio: proximity: aw96103: validate firmware data length\n\nThe firmware parser reads a length from the binary header and then uses\nit to walk six-byte register/value entries. A truncated firmware image\ncan make the parser read beyond the copied firmware…"},{"id":"CVE-2026-98657","p":1792340239013,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\niio: proximity: pulsedlight: fix iio_device left registered on PM setup failure\n\npm_runtime_set_active() failing in probe() jumps to error_unreg_buffer,\nwhich only calls iio_triggered_buffer_cleanup() -- it does not undo the\niio_device_register()…"},{"id":"CVE-2026-98656","p":1792340238907,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\niio: trigger: cancel reenable_work before freeing trigger\n\niio_trigger_notify_done_atomic() defers ->reenable() into\ntrig->reenable_work on the system workqueue, and the worker dereferences\nthe owning trigger through container_of().  Nothing cancels…"},{"id":"CVE-2026-98655","p":1792340238797,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nperf: Require kernel access for text poke events\n\nPerf events with exclude_kernel=1 can be opened without kernel perf\naccess. However, exclude_kernel does not suppress text-poke sideband\nrecords. Every PERF_RECORD_TEXT_POKE is marked…"},{"id":"CVE-2026-98654","p":1792340238690,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Atomize IRQ register read/modify/write ops\n\n[Why]\n\nThe OTG_GLOBAL_SYNC_STATUS register controls various HW IRQ sources for\nthe output timing generator (OTG). VUPDATE_NO_LOCK is one of them.\n\nTo enable the IRQ, driver sets the…"},{"id":"CVE-2026-98653","p":1792340238580,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: s390: Fix _gaccess_shadow_fault()\n\nIn some circumstances, it is possible that the page of nested guest\nmemory that is being shadowed is not present at all in the parent guest\ngmap. dat_entry_walk() will not find any leaf entry and return with…"},{"id":"CVE-2026-98652","p":1792340238483,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: s390: Add missing srcu in kvm_s390_set_irq_state()\n\nLike kvm_s390_inject_vcpu(), kvm_s390_set_irq_state() also needs the\nkvm->srcu or the slots lock when performing the Store status operation.\n\nFix by taking kvm->srcu in kvm_s390_set_irq_state()."},{"id":"CVE-2026-98651","p":1792340238387,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: s390: Properly handle NULL pointer in dat_cond_set_storage_key()\n\nSome callers pass NULL as oldkey. Calling page_cond_set_storage_key()\nwill cause that NULL pointer to get dereferenced.\n\nFix by checking for NULL and assigning the pointer to a…"},{"id":"CVE-2026-98650","p":1792340238290,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: s390: Fix potential races in dat skey functions\n\nWhen dat_cond_set_storage_key() finds a large page, it will\nconditionally set the storage key in absolute memory using\nlarge_crste_to_phys() to get the absolute address.\n\nThere is a race window…"},{"id":"CVE-2026-98649","p":1792340238193,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: s390: Fix race in _destroy_pages_crste()\n\nUse READ_ONCE() in _destroy_pages_crste() to read the crste, avoid\ndereferencing the pointer multiple times."},{"id":"CVE-2026-98648","p":1792340238097,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\ns390/uv: Prevent potential out-of-bounds read\n\nWhen the system has more than 85 secrets, the uv_secret_list struct\narray only holds up to 85 items per page, resulting in an out of bounds\nread in find_secret_in_page if the targeted secret is in the…"},{"id":"CVE-2026-98647","p":1792340237980,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Fix divide-by-zero in btf_struct_walk()\n\nWhen an access goes past the struct and the last member is a flexible\narray, btf_struct_walk() folds the offset back into a single element with\n(off - moff) % t->size, but never checks that the element…"},{"id":"CVE-2026-98646","p":1792340237853,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\ntcp: Skip cond_resched() in inet_csk_listen_stop() under BPF context\n\nbpf_sock_destroy() runs from the tcp iterator, under rcu_read_lock(). If\nthe sock is a listener that still has children in its accept queue,\ntcp_abort() ends up in…"},{"id":"CVE-2026-98645","p":1792340237757,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nHID: winwing: fix use-after-free in force feedback teardown\n\nwinwing_init_ff() passes the driver's private data, allocated with\ndevm_kzalloc() in winwing_probe(), as the effect context to\ninput_ff_create_memless(). The memoryless force-feedback core…"},{"id":"CVE-2026-98644","p":1792340237623,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Avoid soft lockup in __htab_map_lookup_and_delete_batch()\n\n__htab_map_lookup_and_delete_batch() has no rescheduling point. The\nbatch count bounds how many entries are copied out, not how many\nbuckets are visited, so one BPF_MAP_LOOKUP_BATCH call…"},{"id":"CVE-2026-98643","p":1792340237490,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Fix out-of-bounds read of rtt_min in sock_ops\n\nA sockops prog reading skops->rtt_min never checks the sk type: on the\ntcp_conn_request() path sock_ops->sk is a request_sock (non-full), and the\nctx rewrite casts it to a tcp_sock (full) and reads…"},{"id":"CVE-2026-98642","p":1792340237367,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Fix UAF due to concurrent consumption of ttrace lists in alloc_bulk\n\nSyzkaller repeatedly triggered UAF splats related to nodes in\nwaiting_for_gp_ttrace within the bpf memalloc:\n\nBUG: KASAN: slab-use-after-free in llist_del_first+0x85/0x110…"},{"id":"CVE-2026-98641","p":1792340237247,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nbpf, arm64: set up the frame pointer for the exception callback\n\nA program acting as exception boundary saves all callee-saved registers,\nso build_prologue() takes the exception_cb path and never calls\npush_callee_regs(). That is the only place…"},{"id":"CVE-2026-98640","p":1792340237123,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nHID: amd_sfh: Validate PCI BAR size before mapping\n\nThe amd_sfh driver maps PCI BAR 2 using pcim_iomap_regions() and\nsubsequently accesses MMIO registers at offsets up to 0x10958 (e.g.,\nAMD_P2C_MSG3 at 0x1068C). However, the driver never validates…"},{"id":"CVE-2026-98639","p":1792340237020,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: riscv: Fix NACL hfence entry update order\n\nThe SBI v3.0 specification (section 15.1.2) requires a nested HFENCE\nentry to be populated as follows:\n1) find an unused entry with Config.Pending == 0\n2) update the Page_Number and Page_Count words\n3)…"},{"id":"CVE-2026-98638","p":1792340236920,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: arm64: Validate the SVE vector length in pkvm_vcpu_init_sve()\n\npkvm_vcpu_init_sve() clamps only the upper bound of the host-provided\nsve_max_vl, so an invalid vector length reaches sve_state_size_from_vl()\nand the WARN_ON() there, which is fatal…"},{"id":"CVE-2026-98637","p":1792340236820,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: arm64: Do not clear VM-wide SVE feature on vCPU init failure\n\npkvm_vcpu_init_sve() clears KVM_ARM_VCPU_SVE in kvm->arch.vcpu_features\nwhen it fails, but vcpu_has_sve() tests KVM_ARCH_FLAG_GUEST_HAS_SVE,\nwhich is left set. Later vCPUs on that VM…"},{"id":"CVE-2026-98636","p":1792340236700,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nsquashfs: Add dictionary size range check to prevent shift-out-of-bounds\n\nWhen an abnormal SquashFS image (COMP_OPTS flag is 1 but dictionary size\nis 0) is mounted, and performs shift operations using dictionarysize, the\nshift exponent is -1, causing…"},{"id":"CVE-2026-98635","p":1792340236607,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: block: Fix zones_cond out-of-bounds write on zone report\n\nblk_revalidate_disk_zones() sizes the zones_cond array from the disk\ncapacity and zone size, but the index used by blk_revalidate_zone_cond()\ncomes from the device-driven report_zones()…"},{"id":"CVE-2026-98634","p":1792340236507,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: sd_zbc: Reject disks with too many zones\n\nsd_zbc_read_zones() computes the number of zones with 64-bit arithmetic and\nstores the result in the unsigned int nr_zones field of struct\nzoned_disk_info, silently truncating counts that exceed 32…"},{"id":"CVE-2026-98633","p":1792340236410,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: btnxpuart: Fix skb leak in nxp_process_fw_dump()\n\nWhen CONFIG_DEV_COREDUMP=n, hci_devcd_append() returns -EOPNOTSUPP\nwithout freeing its skb argument. This leaks the cloned skb and also\nprevents nxp_set_ind_reset() from being called to…"},{"id":"CVE-2026-98632","p":1792340236297,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: mgmt: Dequeue pending mesh_send_sync entries on cancel\n\nIn send_cancel(), pending mesh_tx objects are removed from the\nhdev->mesh_pending list and freed via mesh_send_complete().  However, if\na mesh transmission was already queued onto…"},{"id":"CVE-2026-98631","p":1792340236180,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nxsk: Use a 32-bit compare in xsk_map_gen_lookup\n\nxsk_map_gen_lookup() loads a u32 key and compares it with max_entries\nusing BPF_JMP_IMM. BPF immediates are sign-extended to 64 bits, so a\nmax_entries value of 0x80000000 or higher becomes a threshold…"},{"id":"CVE-2026-98630","p":1792340236080,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\neth: fbnic: Fix payload page pool error cleanup\n\nThe payload page pool pointer contains an error pointer when its\nallocation fails. The cleanup path passes that error pointer to\npage_pool_destroy() instead of destroying the header page pool. This\ncan…"},{"id":"CVE-2026-98629","p":1792340235960,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: cls_u32: fix manual hash table handle IDR aliasing\n\nA u32 hash table created with an explicit handle ('tc filter add ...\nhandle 801: u32 divisor N') keys its IDR entry on the raw handle, while\nthe destroy paths free it under…"},{"id":"CVE-2026-98628","p":1792340235860,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Make post-verification instruction rewrites killable\n\nAfter do_check() returns, the verifier runs several instruction rewrite\npasses. Some of them patch or remove one instruction at a time. Each\noperation moves the remaining instruction and…"},{"id":"CVE-2026-98627","p":1792340235760,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Preserve packet pointer class displacement in regsafe()\n\nregsafe() maps packet pointer IDs between states and checks that each\ncurrent register range is a subset of the corresponding explored\nregister range. It does not, however, preserve the…"},{"id":"CVE-2026-98626","p":1792340235640,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Restrict CO-RE poisoning to relocatable instructions\n\nCO-RE relocation records can name any instruction offset. When a\nrelocation cannot be resolved, bpf_core_patch_insn() currently poisons its\ntarget before checking whether that instruction is…"},{"id":"CVE-2026-98625","p":1792340235513,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: flowtable: publish HW_DEAD after worker is done\n\nflow_offload_work_del() sets NF_FLOW_HW_DEAD before the work handler\nclears NF_FLOW_HW_PENDING. Once a flow is both HW_DYING and HW_DEAD, a\nconcurrent garbage collection pass can remove it…"},{"id":"CVE-2026-98624","p":1792340235393,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nfnetlink_queue: hold nfnl mutex in event notifier\n\nWe must serialize the release notifier and the config netlink function.\nA concurrent thread can issue close() which can call the release function\nwhile unrelated socket processes UNBIND…"},{"id":"CVE-2026-98623","p":1792340235237,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/nouveau/clk: fix list cursor use after loop in nvkm_clk_ustate_update\n\nIf list_for_each_entry() exits without hitting a break then \"pstate\" is\nnot a valid pstate pointer.  Introduce a \"found\" variable instead.\n\nThe check is reachable from…"},{"id":"CVE-2026-98622","p":1792340235117,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: act_ct: don't WARN on benign flow_offload_alloc() failure\n\nflow_offload_alloc() returns NULL when the conntrack entry is dying\n(e.g. raced with a conntrack flush) or when the GFP_ATOMIC allocation\nfails; both are expected under load and…"},{"id":"CVE-2026-98621","p":1792340234997,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: gue: reject invalid REMCSUM offsets\n\nThe REMCSUM option carries an absolute checksum start and checksum field\noffset. gue_remcsum() passes them to skb_remcsum_process(), whose\npartial path stores offset - start in the u16 skb->csum_offset…"},{"id":"CVE-2026-98620","p":1792340234890,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: ethernet: mtk_eth_soc: unregister net_devices in case of probe failure\n\nIf register_netdev() fails for one of the MTK_MAX_DEVS devices in\nmtk_probe(), the error path jumps to err_deinit_ppe, skipping\nmtk_unreg_dev(). The previously registered…"},{"id":"CVE-2026-98619","p":1792340234787,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: ethtool: keep rtnl_lock for the ioctl self test\n\nAn offline self test that brings the interface down and back up with\nnetif_close() / netif_open() requires rtnl_lock for both. Since the\nethtool IOCTL path became rtnl-optional for ops-locked…"},{"id":"CVE-2026-98618","p":1792340234690,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\neth: fbnic: Handle maximum standalone channels\n\nStandalone channels use one NAPI vector for each Tx and Rx queue.\nfbnic's allocation path excludes FBNIC_MAX_TXQS from that layout. A\n64-Tx/64-Rx configuration therefore records 128 vectors but…"},{"id":"CVE-2026-98617","p":1792340234600,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\neth: fbnic: use the Rx queue napi pointer to find the napi vector\n\nThe queue management ndos pick the napi vector for an Rx queue with:\n\tnv = fbn->napi[idx % fbn->num_napi];\n\nThe issue is this is only correct in the cases where there are no…"},{"id":"CVE-2026-98616","p":1792340234497,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\neth: fbnic: reset num_napi when the napi vectors are freed\n\nfbn->num_napi is the count of live napi vectors, each of which owns an\nIRQ.  The PM path had freed them without clearing the count.\nfbnic_pm_suspend() tears the datapath down via ndo_stop()…"},{"id":"CVE-2026-98615","p":1792340234387,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\neth: fbnic: Set AW_FLUSH_MODE alongside AW_FLUSH when flushing the mailbox\n\nWhen tearing down the FW mailbox Rx ring, fbnic_mbx_reset_desc_ring()\nwrites AW_CFG with FLUSH set and everything else, BME included, cleared.\nClearing BME halts the device's…"},{"id":"CVE-2026-98614","p":1792340234267,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nsctp: avoid livelock while updating retransmit path\n\nsctp_assoc_update_retran_path() can loop forever when every remaining\ntransport, including retran_path, is SCTP_UNCONFIRMED: the state check\nruns before the wraparound test, so the loop cannot…"},{"id":"CVE-2026-98613","p":1792340234150,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Bound ownership depth through local kptrs and graph roots\n\nProgram-allocated objects can own other local objects through referenced\nkptrs. bpf_obj_free_fields() follows those pointers through\n__bpf_obj_drop_impl() synchronously, before the…"},{"id":"CVE-2026-98612","p":1792340234030,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: usb: catc: bound the RX packet length in catc_rx_done()\n\ncatc_rx_done() walks a multi-packet URB, reading a two-byte length from\neach packet header. Its bound, pkt_len > urb->actual_length, ignores the\nheader offset and compares against the…"},{"id":"CVE-2026-98611","p":1792340233927,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Check params size before reading reserved fields\n\nbpf_crypto_ctx_create() is a kfunc whose second argument is declared\nwith the __sz annotation, so the verifier only guarantees that\nparams__sz bytes of params are valid.  The function…"},{"id":"CVE-2026-98610","p":1792340233793,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: sch_hfsc: bound the classify inner-filter walk with a drift budget\n\nhfsc_classify() applies the \"filter may only point downwards\" level check\nonly when the filter result carries no bound class. A filter created with\na flowid gets res.class…"},{"id":"CVE-2026-98609","p":1792340233677,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/virtio: fix object leak when drm_gem_handle_create() fails\n\nvirtio_gpu_gem_create() owns the reference taken by\nvirtio_gpu_object_create(). On the drm_gem_handle_create() error path it\ncalls drm_gem_object_release() instead of dropping that…"},{"id":"CVE-2026-98608","p":1792340233560,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/virtio: fix object leak in virtio_gpu_resource_create_ioctl()\n\nvirtio_gpu_resource_create_ioctl() calls drm_gem_object_release() on the\ndrm_gem_handle_create() error path instead of dropping the reference it\nowns, so obj->funcs->free() never runs…"},{"id":"CVE-2026-98607","p":1792340233450,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/virtio: fix object leaks in virtio_gpu_resource_create_blob_ioctl()\n\nvirtio_gpu_resource_create_blob_ioctl() calls drm_gem_object_release() on\nboth the virtio_gpu_resource_assign_uuid() and drm_gem_handle_create()\nerror paths instead of dropping…"},{"id":"CVE-2026-98606","p":1792340233340,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/virtio: release the GEM object on virtio_gpu_vram_create() errors\n\nvirtio_gpu_vram_create() frees the object with a bare kfree(vram) on\nboth error paths after drm_gem_private_object_init() has run, and on the\nsecond one after…"},{"id":"CVE-2026-98605","p":1792340233237,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/bridge: samsung-dsim: fix TE GPIO lifetime for host attach\n\nWhen the Exynos DSI driver was generalized into samsung-dsim, the TE\nGPIO acquisition was switched from gpiod_get_optional() to\ndevm_gpiod_get_optional() while keeping the matching…"},{"id":"CVE-2026-98604","p":1792340233140,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\novpn: replace bind when learning local endpoint\n\nstruct ovpn_bind is published through peer->bind with RCU, but local\nendpoint learning updates bind->local in place under peer->lock. UDP TX\nreads the field without that lock. In particular, a…"},{"id":"CVE-2026-98603","p":1792340233040,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\novpn: replace bind when clearing stale local source\n\nThe UDP output fallback clears bind->local in place when the remembered\nsource address is no longer usable. The bind is RCU-published and read\nlocklessly by concurrent TX, so an IPv6 reader can…"},{"id":"CVE-2026-98602","p":1792340232920,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: bnep: fix out-of-bounds reads on short RX/TX frames and control fallthrough\n\nFix multiple out-of-bounds reads in Bluetooth BNEP frame processing:\n\n1. In bnep_rx_frame() and bnep_ctrl_frame() (net/bluetooth/bnep/core.c),\n   use…"},{"id":"CVE-2026-98601","p":1792340232817,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: btintel_pcie: validate device-supplied DMA indices\n\nIn btintel_pcie_msix_rx_handle(), the driver processes RX completion\ndescriptors (urbd1) written by the PCIe device into DMA-coherent memory.\nurbd1->frbd_tag (a 16-bit field fully…"},{"id":"CVE-2026-98600","p":1792340232707,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: RFCOMM: Reject short EA=0 frames in rfcomm_recv_frame()\n\nWhile rfcomm_recv_frame() verifies that skb->len is at least\nsizeof(*hdr) + 1 (4 bytes: 3-byte header + 1-byte FCS), an RFCOMM frame\nwith an extended 2-byte length field…"},{"id":"CVE-2026-98599","p":1792340232603,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Reject non-negative offsets in stack_slot_obj_get_spi()\n\nbpf_get_spi() computes (-off - 1) / BPF_REG_SIZE using C division,\nwhich truncates toward zero. For off == 0, this produces spi 0, the\nsame index used by the valid stack slot at fp-8.…"},{"id":"CVE-2026-98598","p":1792340232500,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nipv6: Prevent rt6_insert_exception() for dying fib6_info.\n\nBefore the cited commit, fib6_nh_flush_exceptions() always set\nfrom->exception_bucket_flushed = 1 under rt6_exception_lock to\nprevent rt6_insert_exception() from inserting a new exception\nfor…"},{"id":"CVE-2026-98597","p":1792340232387,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: usb: sr9700: include receive overhead in the length check\n\nThe receive fixup subtracts the Ethernet CRC from the reported packet\nlength, but compares that payload length against the whole remaining\nreceive buffer. The following copy starts after…"},{"id":"CVE-2026-98596","p":1792340232283,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nipv6: Fix dst leak for uncached routes.\n\nip6_route_output_flags(), ip6_rt_put_flags(), and ip6_dst_check()\ndetect an uncached route by list_empty(&rt->dst.rt_uncached),\nwhich replaced the static DST_NOCACHE flag check in commit\na4c2fd7f7891 (\"net:…"},{"id":"CVE-2026-98595","p":1792340232163,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nudp: remove a disconnected socket from the 4-tuple hash table\n\nA UDP socket bound to a specific address and port keeps its entry in the\n4-tuple hash table after it is disconnected:\n\n    sk binds to 127.0.0.1:21001\n    sk connects to 127.0.0.2:20001…"},{"id":"CVE-2026-98594","p":1792340232043,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\ntg3: clean up PHYLIB resources on probe failure\n\ntg3_get_invariants() can register an MDIO bus and connect a PHY for\nUSE_PHYLIB devices. If tg3_init_one() later fails, its common error path\nreleases the mappings and netdev without undoing those…"},{"id":"CVE-2026-98593","p":1792340231933,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\ns390/debug: Fix NULL pointer dereference in debug_info_copy()\n\nWhen debug_register_static() fails, it clears areas, active_pages and\nactive_entries but leaves the area bounds unchanged. Copying such an\narea, either by opening its view file or via…"},{"id":"CVE-2026-98592","p":1792340231830,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: spacemit: clear TX descriptor on fragment mapping failure\n\nemac_tx_mem_map() writes TX_DESC_0_OWN into the ring descriptor for\nevery slot beyond old_head as soon as that slot's memset()'d local\ncopy is committed with \"*tx_desc_addr = tx_desc\",…"},{"id":"CVE-2026-98591","p":1792340231727,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Fix bounds check for skb-backed dynptrs\n\nThe skb_pointer_if_linear() function checks whether a\nmemory region of length len starting at offset off into\nthe skb is in the linear area, and returns a pointer to\nthe region if so. The check currently…"},{"id":"CVE-2026-98590","p":1792340231610,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Fix bpf_sock context code generation\n\nCurrently, the ctx access code reads the rx_queue_mapping\nfield with either a 4-byte or 2-byte load. The rest of the bits\nin the register are marked known zero by the verifier. However,\nthe emitted ctx…"},{"id":"CVE-2026-98589","p":1792340231513,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Reject pkt arguments in mutating subprogs\n\nThe verifier tracks changes in how PTR_TO_PACKET registers'\nbounds are modified across subprog boundaries. PTR_TO_PACKET\nregisters are actually passed as PTR_TO_MEM, which is assumed\nvalid for the…"},{"id":"CVE-2026-98588","p":1792340231393,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nbpf, sockmap: Reject max_entries > INT_MAX in sock_map_alloc\n\nsock_map_alloc() only rejects max_entries == 0 and otherwise allows any\nu32 value.  sock_map_free() then walks the sks[] array with a signed int\niterator:\n\n\tint i;\n\tfor (i = 0; i <…"},{"id":"CVE-2026-98587","p":1792340231297,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nfirewire: cdev: fix back-transition for iso_resource_auto client resource\n\nThe todo member of iso_resource_auto structure represents the state of the\nclient resource and normally transitions in the following order:\n\n    ISO_RES_AUTO_ALLOC ->…"},{"id":"CVE-2026-98586","p":1792340231180,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nsctp: hold asoc or transport before mod_timer() in timer handlers\n\nTake the association or transport reference before rearming a timer in the\ntimer handlers.\n\nThe existing code calls mod_timer() before taking the reference needed by\nthe rearmed timer…"},{"id":"CVE-2026-98585","p":1792340231083,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\neth: fbnic: Avoid rounding zero ring sizes\n\nroundup_pow_of_two() is undefined for zero. ethtool permits a zero ring\nsize to reach the driver, where the minimum-size check should reject it.\n\nLeave zero unchanged while rounding nonzero ring sizes. The…"},{"id":"CVE-2026-98584","p":1792340230983,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: fix potential stack infoleak in em_text_dump()\n\nem_text_dump() allocates struct tcf_em_text on the stack without zeroing\nit.  strscpy() writes the algorithm name and a NUL terminator into\nconf.algo[], leaving the remaining bytes…"},{"id":"CVE-2026-98583","p":1792340230867,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nnfc: nfcmrvl: validate helper command length before pull\n\nThe firmware download receive path removes the NCI data header and\nreads the helper command before validating the remaining packet length.\nA short frame can therefore reach the data access…"},{"id":"CVE-2026-98582","p":1792340230743,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nnfc: st21nfca: validate received frame size\n\nst21nfca_hci_i2c_repack() trims a received frame at its EOF marker\nbefore removing byte stuffing.  It then assumes the truncated frame\ncontains the LLC header and two CRC bytes, and it unconditionally…"},{"id":"CVE-2026-98581","p":1792340230610,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nnfc: llcp: Fix list corruption / refcount desync in nfc_llcp_recv_dm()\n\nnfc_llcp_recv_dm() handles DM(NOBOUND)/DM(REJ) for a socket that is still\nlinked on local->connecting_sockets: it looks the socket up with\nnfc_llcp_connecting_sock_get(), sets…"},{"id":"CVE-2026-98580","p":1792340230483,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nnfc: llcp: Fix race condition in accept_queue lifecycle\n\nIn nfc_llcp_socket_release(), sockets and listener accept queues are\nwalked under the local sockets rwlock and bh_lock_sock().  However,\nbh_lock_sock() does not synchronise against…"},{"id":"CVE-2026-98579","p":1792340230363,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nnfc: llcp: fix sdreq TLV list leak on parse/alloc/send failure\n\nnfc_genl_llc_sdreq() builds a list of TLV nodes while walking nested\nnetlink attrs, but 3 error paths (nested-attr parse failure, TLV alloc\nENOMEM, nfc_llcp_send_snl_sdreq() failure) all…"},{"id":"CVE-2026-98578","p":1792340230223,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nnfc: st21nfca: validate ISO15693 inventory length\n\nThe ISO15693 inventory helper removes a two-byte prefix without checking\nthat it exists, then accepts a one-byte remainder before reading data[1] as\nthe DSFID.\n\nRequire the prefix and at least two…"},{"id":"CVE-2026-98577","p":1792340230053,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nnfc: llcp: fix WKS SAP hijacking via prefix match in nfc_llcp_wks_sap()\n\nnfc_llcp_wks_sap() compares only service_name_len bytes, so a short\nservice_name like \"u\" matches longer WKS strings like \"urn:nfc:sn:snep\".\nFix by requiring exact length match…"},{"id":"CVE-2026-98576","p":1792340229930,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nnfc: llcp: fix slab-out-of-bounds reads when logging service names\n\nnfc_llcp_wks_sap() and nfc_llcp_build_sdreq_tlv() pass non-null-\nterminated strings to pr_debug() using the %s format specifier.\nThe buffers are allocated via kmemdup() or come from…"},{"id":"CVE-2026-98575","p":1792340229810,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nnfc: pn533: fix OOB read in pn533_acr122_is_rx_frame_valid()\n\nframe->ccid.datalen is read directly from the USB response frame\nand used, unchecked, as an index into frame->data[]. A malicious or\nmalfunctioning device can set this field to an…"},{"id":"CVE-2026-98574","p":1792340229703,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: bcmgenet: stop Tx NAPI before disabling the queues\n\nbcmgenet_netif_stop() and the Wake-on-LAN branch of bcmgenet_suspend()\nboth disable the Tx queues first and stop Tx NAPI several steps later. A\ncompletion in flight calls netif_tx_wake_queue()…"},{"id":"CVE-2026-98573","p":1792340229587,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: skbuff: fix pull-bound underflow in skb_checksum_setup_ipv6()\n\nskb_maybe_pull_tail() subtracts skb_headlen(skb) from the unsigned max\nargument and passes the result to __pskb_pull_tail() as a signed int.  The\nfunction does not ensure that max is…"},{"id":"CVE-2026-98572","p":1792340229477,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Fix immediate JMP JEQ/JNE on MIPS32\n\nAn addu instruction was emitted instead of addiu, causing the immediate\nvalue 1 to be interpreted as register $at. This made the comparison\nresult invalid when the immediate operand was negative. Note that…"},{"id":"CVE-2026-98571","p":1792340229363,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: stmmac: clear stale buf->page after recycling on skb build failure\n\nIn stmmac_rx(), when napi_build_skb() fails the descriptor page is\nrecycled back to the page pool with page_pool_recycle_direct(), but\nbuf->page is left pointing at the recycled…"},{"id":"CVE-2026-98570","p":1792340229233,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: ipv6: keep room for the mac header in dst_dev_overhead()\n\nThe seg6, ioam6 and rpl lwtunnels size their skb_cow_head() request as\nthe length they are about to push plus dst_dev_overhead(), then push the\nnew headers and rebuild the mac header…"},{"id":"CVE-2026-98569","p":1792340229113,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nip_gre: Reject enabling collect metadata through changelink\n\nipgre_netlink_parms() can enable collect_md on an existing GRE, GRETAP\nor ERSPAN device. Unlike newlink, changelink does not enforce metadata\ntunnel uniqueness. Converting a non-metadata…"},{"id":"CVE-2026-98568","p":1792340229000,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nvxlan: use one headroom snapshot for neighbour replies\n\nvxlan_na_create() samples LL_RESERVED_SPACE() to size the reply skb and then\nsamples it again to reserve headroom. A concurrent vxlan_changelink() can\nupdate needed_headroom between the two…"},{"id":"CVE-2026-98567","p":1792340228870,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: xps: reject an out of range traffic class\n\nOnly the entries below dev->num_tc are valid in dev->tc_to_txq[], and\ndev->prio_tc_map[] may only name classes below it. netdev_set_num_tc()\nlowers dev->num_tc without touching either array.…"},{"id":"CVE-2026-98566","p":1792340228767,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/imagination: clamp freelist reconstruction requests\n\nThe firmware reconstruction count controls accesses to the request's\nfixed freelist ID array and the copy into the fixed response array.\nNeither access currently bounds the count to those…"},{"id":"CVE-2026-98565","p":1792340228667,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: dsa: mt7530: fix NULL dereference on unbind of MT7531 and MT7621\n\nThe core and io supplies are only requested for ID_MT7530: both the\ndevm_regulator_get() in probe and the regulator_enable() in\nmt7530_setup() are guarded by the switch id, but…"},{"id":"CVE-2026-98564","p":1792340228553,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: dsa: mt7530: leave the MDIO IRQ mappings to regmap-irq\n\nmt7530_remove_common() disposes the per-PHY interrupt mappings from\n.remove, but the regmap-irq chip that owns the domain is devm-registered,\nso its parent interrupt is only freed once…"},{"id":"CVE-2026-98563","p":1792340228443,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: phylink: record the PHY only once bringup cannot fail\n\nphylink_bringup_phy() stores the PHY in pl->phydev before its last\nfallible step: on a MAC whose phylink ops implement LPI,\nphy_eee_rx_clock_stop() can fail with a real MDIO error. The…"},{"id":"CVE-2026-98562","p":1792340228347,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: libwx: fix races in Tx timestamp handling\n\nwx->ptp_tx_skb is shared between the Tx path, the PTP auxiliary\nworker and the timestamp cleanup paths. The\nWX_STATE_PTP_TX_IN_PROGRESS bit prevents multiple Tx paths from\nsubmitting timestamp requests,…"},{"id":"CVE-2026-98561","p":1792340228243,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nnfp: hold IPsec RX state under the XArray lock\n\nnfp_net_ipsec_rx() drops the XArray lock before taking a reference to the\nxfrm_state it found. The delete path can erase the entry and drop the last\nstate reference in that interval. RX can then try to…"},{"id":"CVE-2026-98560","p":1792340228143,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet/rds: size a connection's path set by the transport it ends up with\n\n__rds_conn_create() computes npaths from the caller's transport before\nit decides whether a connection to one of the host's own addresses is\nto be handled by the loopback…"},{"id":"CVE-2026-98559","p":1792340228033,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet/smc: fix UAF on lgr list traversal in smcr_port_err()\n\nsmcr_port_err() traverses smc_lgr_list.list without holding\nsmc_lgr_list.lock, allowing a concurrent smc_lgr_terminate_sched()\nto free an lgr while it is still being dereferenced.\n\nHold…"},{"id":"CVE-2026-98558","p":1792340227933,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: flush skb_defer_nodes in dev_cpu_dead()\n\nWhen a CPU goes offline, dev_cpu_dead() drains its softnet queues\n(completion_queue, output_queue, poll_list, process_queue, and\ninput_pkt_queue), but leaves net_hotdata.skb_defer_nodes untouched.\n\nIf…"},{"id":"CVE-2026-98557","p":1792340227830,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\ngve: DQO: fix header length used by gve_can_send_tso() for UDP GSO\n\ngve_can_send_tso() computes how many buffers each segment of a GSO\npacket would span, and for this it needs the length of the headers\nthat the device replicates in front of every…"},{"id":"CVE-2026-98556","p":1792340227730,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\ngve: DQO: reject TSO packets with an out of range MSS\n\ngve_prep_tso() notes that the device requires the MSS to be <= 9728,\nbut does not enforce it, assuming the 9K MTU enforced by the hypervisor\nand the 64KB limit on TSO sizes are enough.\n\nThis does…"},{"id":"CVE-2026-98555","p":1792340227610,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nllc: fix skb UAF and leaks on llc_mac_hdr_init() failure\n\nIn llc_conn_ac_resend_i_xxx_x_set_0_or_send_rr(), if llc_mac_hdr_init()\nfails, kfree_skb(skb) is called instead of kfree_skb(nskb). This leaks\nthe newly allocated nskb, reads from the freed…"},{"id":"CVE-2026-98554","p":1792340227490,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nvlan: ensure sufficient headroom in vlan_dev_hard_header()\n\nCallers that only reserve ETH_HLEN or less (such as llc_alloc_frame()),\nor skbs allocated before dynamic device/headroom changes (e.g. toggling\nVLAN_FLAG_REORDER_HDR or bonding/team…"},{"id":"CVE-2026-98553","p":1792340227370,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nautofs: fix sbi->pipe file reference leak in autofs_kill_sb()\n\nWhen autofs_fill_super() fails before clearing AUTOFS_SBI_CATATONIC (for\nexample, when find_get_pid() fails on an invalid pgrp mount option, or\nwhen an fs_context is closed before…"},{"id":"CVE-2026-98552","p":1792340227267,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nperf/core: Fix a refcount leak in attach_perf_ctx_data()\n\nThe attach_perf_ctx_data() can race on global and !global cases.  The\nglobal case is protected by global_ctx_data_rwsem and shares a single\nreference count using perf_ctx_data.global field.…"},{"id":"CVE-2026-98551","p":1792340227167,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nperf/core: Fill branch entries with a single assignment\n\nperf_clear_branch_entry_bitfields() clears the bitfields of struct\nperf_branch_entry one by one and leaves from/to alone, since callers\noverwrite those straight away. The list has to be kept in…"},{"id":"CVE-2026-98550","p":1792340227030,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\ntipc: reject invalid and unexpected GRP_ACK_MSG to prevent bc_ackers underflow\n\nCommit 48a5fe38772b (\"tipc: fix bc_ackers underflow on duplicate\nGRP_ACK_MSG\") rejected duplicate/stale ACKs in tipc_group_proto_rcv()\nby returning early when…"},{"id":"CVE-2026-98549","p":1792340226913,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\ntcp: prevent collapsing skbs across boundary in rtx queue\n\ntcp_write_collapse_fence() sets TCP_SKB_CB(skb)->eor = 1 on\ntcp_write_queue_tail(sk) to prevent skbs queued after a switch to\ndevice encryption from being collapsed into earlier skbs.\n\nThe…"},{"id":"CVE-2026-98548","p":1792340226767,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nsctp: discard the rest of the packet on a stale-cookie error\n\nWhen an association is in COOKIE-ECHOED state and the peer sends a\nbundled [ERROR(Stale Cookie)][DATA] packet from one of its non-primary\naddresses, processing the ERROR chunk takes the…"},{"id":"CVE-2026-98547","p":1792340226630,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\naf_packet: fix integer overflow in prb_calc_retire_blk_tmo()\n\nprb_calc_retire_blk_tmo() computes in 32-bit int arithmetic:\n\n        mbits = (blk_size_in_bytes * 8) / (1024 * 1024);\n\nIf I'm reading the validation right, tp_block_size is user…"},{"id":"CVE-2026-98546","p":1792340226517,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\narm64/boot: Disable trapping of PMZR_EL0 writes to EL2\n\n__init_el2_fgt2() writes one mask to both HDFGRTR2_EL2 and HDFGWTR2_EL2.\nPMZR_EL0 is write-only, so its trap bit, nPMZR_EL0, exists only in\nHDFGWTR2_EL2 and is therefore never set: a PMZR_EL0…"},{"id":"CVE-2026-98545","p":1792340226403,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nata: libata-scsi: bound the ATA passthru sense descriptor writes\n\nWhen an ATA PASS-THROUGH command to an ATAPI device fails, the sense\nbuffer holds the device's REQUEST SENSE reply, and\nata_scsi_set_passthru_sense_fields() trusts its additional…"},{"id":"CVE-2026-98544","p":1792340226300,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nbna: prevent IOC timer rearm during teardown\n\nbna: prevent IOC timer rearm during teardown\n\nbnad_pci_remove() and the probe disable_ioceth path call\ntimer_delete_sync() for ioc_timer, sem_timer and hb_timer, but not for\niocpf_timer.…"},{"id":"CVE-2026-98543","p":1792340226200,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: fs/xattr: don't assume the inode is locked in path_unlink/path_rmdir\n\nbpf_lsm_has_d_inode_locked() makes the verifier rewrite\nbpf_[set|remove]_dentry_xattr() to the _locked variants, which assume\nthat the caller already holds the inode's…"},{"id":"CVE-2026-98542","p":1792340226090,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\ncgroup/cpuset: Return PERR_NOCPUS in remote_partition_enable() on subpartitions_cpus conflict\n\nWhen a remote partition is created underneath an existing local partition\nvia a non-partition (PRS_MEMBER) intermediate cgroup, update_prstate() sees…"},{"id":"CVE-2026-98541","p":1792340225967,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nfou: reject omitted FOU_ATTR_IPPROTO on FOU_ENCAP_DIRECT\n\nCommit 7a9bc9e3f423 (\"fou: Don't allow 0 for FOU_ATTR_IPPROTO.\") added\nNLA_POLICY_MIN(NLA_U8, 1) to fou_nl_policy[FOU_ATTR_IPPROTO], which\nrejects an explicitly supplied FOU_ATTR_IPPROTO == 0…"},{"id":"CVE-2026-98540","p":1792340225863,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nfprobe: Terminate the fgraph_data list when the reservation is not filled\n\nfprobe_fgraph_entry() reserves shadow stack space for every fprobe with\nan exit handler, but only fills it for those whose entry handler returns\n0. fgraph_reserve_data() does…"},{"id":"CVE-2026-98539","p":1792340225733,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nfs/ntfs3: use d_instantiate_new() in ntfs_create_inode() and murder syzbot's \"WARNING in do_new_mount\" saga\n\nntfs_create_inode() creates a new inode via ntfs_new_inode(). It hashes\nit with insert_inode_locked() and so it's marked as I_NEW until…"},{"id":"CVE-2026-98538","p":1792340225613,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nwriteback: bound cleanup_offline_cgwb() rescans by rotating scanned inodes\n\ncleanup_offline_cgwb() prepares at most WB_MAX_INODES_PER_ISW inodes\nper call and is called again until the dying wb is drained, but every\ncall walks wb->b_attached and then…"},{"id":"CVE-2026-98537","p":1792340225480,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nworkqueue: Fix NULL current_pwq deref in flush dependency check\n\ncheck_flush_dependency() uses current_wq_worker() to determine whether\nthe caller is a workqueue worker and then dereferences worker->current_pwq\nto test whether the current workqueue…"},{"id":"CVE-2026-98536","p":1792340225357,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nwriteback: report a Tasks-RCU quiescent state per cgwb drain pass\n\ncleanup_offline_cgwbs_workfn() drains a dying cgwb by calling\ncleanup_offline_cgwb() until it returns false, with a cond_resched()\nbetween passes.  On a CONFIG_PREEMPTION kernel that…"},{"id":"CVE-2026-98535","p":1792340225223,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nfsl/fman: Fix clk reference leak in read_dts_node()\n\nof_clk_get() returns a clock with its reference count incremented, but\nread_dts_node() only uses it to read the rate and never calls clk_put().\nThe clock is not stored anywhere, so the reference…"},{"id":"CVE-2026-98534","p":1792340225107,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nipe: fix use-after-free when auditing a newly loaded policy\n\nnew_policy() audits the policy after ipe_new_policyfs_node() publishes it\nand drops the new directory's inode lock. A concurrent delete can free\nthe policy while ipe_audit_policy_load() is…"},{"id":"CVE-2026-98533","p":1792340224933,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nipe: protect the dm-verity root hash with RCU\n\nipe_bdev_setintegrity() frees the old root hash when dm-verity publishes\na new one on ->preresume, while policy evaluation can still be\ndereferencing it.\n\nProtect the root hash with RCU. The evaluation…"},{"id":"CVE-2026-98532","p":1792340224790,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nipv6: do not let ipv6_find_hdr() return an offset past the packet end\n\nipv6_find_hdr() walks the extension header chain, skipping each header by\nthe length that header itself declares.  ipv6_optlen() returns up to 2048,\nand the skip is never checked…"},{"id":"CVE-2026-98531","p":1792340224653,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nipv6: sr: enforce exact attribute length for SEG6_ATTR_DST\n\nIn seg6_genl_policy, SEG6_ATTR_DST is defined with .type = NLA_BINARY and\n.len = sizeof(struct in6_addr). For NLA_BINARY, .len only enforces the\nmaximum payload length and permits shorter…"},{"id":"CVE-2026-98530","p":1792340224530,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nkprobes: Fix permanent hang when flushing the kprobe optimizer\n\nWriting 0 to /proc/sys/debug/kprobes-optimization while a kprobe is\njump-optimized never returns. The writer sleeps in D state forever with\nkprobe_sysctl_mutex held, so any later read or…"},{"id":"CVE-2026-98529","p":1792340224410,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\ngpio: arizona: Fix runtime PM leak in arizona_gpio_direction_out()\n\nSwitching a persistent GPIO line from input to output acquires a\nruntime PM reference on the parent device, but if the subsequent\nregmap_update_bits() fails the reference is never…"},{"id":"CVE-2026-98528","p":1792340224303,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\ngpio: cdev: fix kernel stack leak to user-space in error path\n\nIf we fail to acquire the GPIO chip guard in gpio_desc_to_lineinfo(), we\nreturn immediately before zeroing the info struct we'll end up passing\nto the user-space later in…"},{"id":"CVE-2026-98527","p":1792340224183,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\ngpio: zynq: fix runtime PM leak on request error path\n\npm_runtime_get_sync() leaves the usage counter incremented even when it\nfails, and zynq_gpio_request() returns the error without dropping it.\n\ngpiolib does not call ->free() when ->request()…"},{"id":"CVE-2026-98526","p":1792340224063,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nllc: reserve device headroom for allocated frames\n\nllc_alloc_frame() reserves link-layer headroom using the device type.\nThis is insufficient for stacked Ethernet devices such as VLAN devices,\nwhere vlan_dev_hard_header() pushes a VLAN header before…"},{"id":"CVE-2026-98525","p":1792340223953,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nmctp: route: iterate socket tag list in mctp_lookup_prealloc_tag()\n\nWhen a socket transmits a packet with MCTP_TAG_PREALLOC set,\nmctp_lookup_prealloc_tag() iterates over the per-netns &mns->keys list\nand matches netid, req_tag, peer_addr, and…"},{"id":"CVE-2026-98524","p":1792340223827,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nrds: ib: Clear the sg list when mapping an MR fails\n\nrds_ib_map_frmr() stores the caller's scatterlist in the MR before DMA\nmapping and registration can fail. On failure, __rds_rdma_map() unpins\nthe pages and frees the scatterlist, but…"},{"id":"CVE-2026-98523","p":1792340223700,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/client: fix restore of partially initialized client\n\nI got a null-ptr-deref report when closing a DRM file descriptor:\n\nWARNING: drivers/gpu/drm/drm_atomic.c:2031 at\n__drm_atomic_helper_set_config+0x18e/0x1b0 [drm]\n\nCall Trace:…"},{"id":"CVE-2026-98522","p":1792340223583,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/imagination: Propagate map failures correctly from pvr_mmu_map_sgl()\n\nMap failure from pvr_mmu_map_sgl() interface was not returned correctly\nto pvr_mmu_map() interface. This resulted in pvr_mmu_map() interface to\ncontinue instead of returning an…"},{"id":"CVE-2026-98521","p":1792340223473,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/i915: fix incorrect RCU teardown order\n\ni915_gem_busy_ioctl uses dma_resv_for_each_fence_unlocked() to iterate\nover the fences in an GEM object without holding a reference but only\nthe RCU read side lock.\n\nWhat can happen here is that the GEM…"},{"id":"CVE-2026-98520","p":1792340223370,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdkfd: fix use-after-free and multi-container gap in kfd_dev_mapping\n\nkfd_dev_mapping caches the address_space of the first /dev/kfd opener\nso that the GPU reset path can call unmap_mapping_range() to zap all\nuserspace mappings of doorbell and…"},{"id":"CVE-2026-98519","p":1792340223260,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: Fix runtime PM leak in amdgpu_debugfs_test_ib_show()\n\namdgpu_debugfs_test_ib_show() resumes the device with\npm_runtime_get_sync() before taking the reset domain semaphore with\ndown_write_killable().  If the write lock acquisition is…"},{"id":"CVE-2026-98518","p":1792340223163,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/nouveau/dmem: pin VRAM for the whole registered range\n\nCommit c32287471077 (\"gpu/drm/nouveau: enable THP support for GPU memory\nmigration\") grew the device-private region that\nnouveau_dmem_chunk_alloc() registers from DMEM_CHUNK_SIZE to…"},{"id":"CVE-2026-98517","p":1792340223033,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/nouveau/uvmm: fix UAF in nouveau_uvmm_sm when BO is in TTM_PL_SYSTEM\n\nnouveau_uvmm_sm() calls op_map(), which passes bo->resource through\nnouveau_mem() to nouveau_uvma_map(). nouveau_uvmm_vmm_map() then reads\nmem->mem.type.\n\nBut this is only…"},{"id":"CVE-2026-98516","p":1792340222920,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/nouveau: Fix bridge reference leak in nv1a_ram_new()\n\npci_get_domain_bus_and_slot() takes a reference to the PCI device,\nwhich is never released once the memory size has been read from its\nconfig space.  Drop the reference before returning."},{"id":"CVE-2026-98515","p":1792340222773,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/nouveau: fix double-free in nvif_vmm_dtor\n\nOn failure, nouveau_cli_init() calls nouveau_cli_fini() to tear\nthe client down. Then, nouveau_drm_open() also enters into its\ncleanup path and calls nouveau_cli_fini() AGAIN. nouveau_cli_fini()\ncalls…"},{"id":"CVE-2026-98514","p":1792340222657,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/nouveau: Fix gem reference leak in validate_init()\n\nOn the ttm_bo_reserve() failure and \"vma not found\" error paths, the\nloop breaks without adding the looked-up object to any validate list,\nso the reference taken by drm_gem_object_lookup() is…"},{"id":"CVE-2026-98513","p":1792340222557,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/nouveau: Fix runtime PM leak in nouveau_connector_detect()\n\nIf nvif_outp_edid_get() fails, nouveau_connector_detect() returns\nearly without dropping the runtime PM reference taken at the start\nof the function, keeping the device powered on until…"},{"id":"CVE-2026-98512","p":1792340222457,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/nouveau: RCU-free the scheduler-containing nouveau_sched\n\nstruct nouveau_sched embeds a struct drm_gpu_scheduler (base).\nnouveau_sched_destroy() calls nouveau_sched_fini() (which does\ndrm_sched_fini(&sched->base)) and then frees the object with…"},{"id":"CVE-2026-98511","p":1792340222310,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/nouveau: don't bump pin count on failed re-pin in nouveau_bo_pin_locked()\n\nnouveau_bo_pin_locked() checks whether an already pinned BO is in a\nmemory domain compatible with a new pin request. When the domains are\nincompatible, it sets -EBUSY but…"},{"id":"CVE-2026-98510","p":1792340222203,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/xe/vm: nuke PTs only after unlinking contested VMAs\n\nIn xe_vm_close_and_put(), external-BO VMAs are queued on the contested\nlist for deferred destruction via xe_vma_destroy_unlocked(). However,\nxe_vm_pt_destroy() was previously invoked before…"},{"id":"CVE-2026-98509","p":1792340222083,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/virtio: fix memory leak of fence event on execbuffer failure\n\nvirtio_gpu_execbuffer_ioctl() reserves a DRM event with\ndrm_event_reserve_init() when VIRTGPU_EXECBUF_RING_IDX selects a ring that\nuserspace has enabled polling for.…"},{"id":"CVE-2026-98508","p":1792340221947,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/virtio: fix NULL pointer dereference on fence allocation failure\n\nvirtio_gpu_fence_alloc() can fail due to memory pressure and return NULL,\nbut its caller like virtio_gpu_init_submit() never checks it. Later,\nvirtio_gpu_init_submit() passes the…"},{"id":"CVE-2026-98507","p":1792340221817,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nmm/rmap: fix missing barrier between anon_vma init and vma->anon_vma publish\n\nOn arm64 server, we find that a task trying to grab the anon_vma lock\ntriggers hungtask.\n\nINFO: task main:2354726 blocked for more than 120 seconds.\n      Tainted: G…"},{"id":"CVE-2026-98506","p":1792340221717,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nmm/hugetlb: do not dissolve gigantic pages without runtime support\n\ndissolve_free_hugetlb_folio() doesn't check\nhstate_is_gigantic_no_runtime(h) though remove_hugetlb_folio()/\nupdate_and_free_hugetlb_folio() silently bail for such folios, so it frees…"},{"id":"CVE-2026-98505","p":1792340221610,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nmm/damon/vaddr: avoid hw-driven pte updates during damon_hugetlb_mkold()\n\ndamon_hugetlb_mkold() reads the page table entry into a local variable,\nunsets the accessed bit in the variable, and updates the page table entry\nwith the updated variable…"},{"id":"CVE-2026-98504","p":1792340221493,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nPCI: of_property: Omit bus properties without a subordinate bus\n\nA bridge (a device with a Type 1 header) may not have a secondary bus\nallocated (pdev->subordinate), e.g., if there are no available bus numbers\nor the bridge secondary/subordinate bus…"},{"id":"CVE-2026-98503","p":1792340221370,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\npacket: use ubuf_info completion for TX_RING packets\n\ntpacket_snd sends skbs with frags pointing into its ring slots. Slots\nare released when skb->destructor is called.\n\nA call to skb_orphan calls skb->destructor before the skb is freed.\nThis can…"},{"id":"CVE-2026-98502","p":1792340221260,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nHID: alps: unregister DualPoint Stick input device on remove\n\nalps_input_configured() allocates a second input device (\"DualPoint\nStick\") with input_allocate_device() and registers it, but the\nalps_driver struct has no .remove handler and input2 is…"},{"id":"CVE-2026-98501","p":1792340221143,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nHID: alps: fix use-after-free on input2 registration failure\n\nalps_input_configured() stores data->input2 before calling\ninput_register_device().  If registration fails, input_free_device()\nfrees the input device but data->input2 still points to the…"},{"id":"CVE-2026-98500","p":1792340221040,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nHID: hid-oxp: use cancel_delayed_work_sync() in remove\n\noxp_hid_remove() uses cancel_delayed_work() for all three delayed work\nitems.  cancel_delayed_work() only dequeues a pending work item without\nwaiting for a currently executing callback to…"},{"id":"CVE-2026-98499","p":1792340220913,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nHID: wacom: fix OOB read in wacom_wac_pen_serial_enforce()\n\nThe 'wacom_wac_pen_serial_enforce()' function may calculate and pass an\ninvalid offset to hid_field_extract(), resulting in memory reads at\nincorrect addresses -- possibly beyond the end of…"},{"id":"CVE-2026-98498","p":1792340220797,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5: Fix rev_entry reference leak in mlx5_tc_ct_shared_counter_get()\n\nWhen the reverse entry is found but its counter is already being\nreleased, refcount_inc_not_zero() fails and the reference taken by\nmlx5_tc_ct_entry_get() is never dropped…"},{"id":"CVE-2026-98497","p":1792340220697,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5e: fix swapped IPv6 IPsec policy masks\n\nIPv6 XFRM policies may use different source and destination prefix\nlengths. mlx5e_ipsec_policy_mask() builds the corresponding masks\nindependently, but setup_fte_addr6() installs each mask in the…"},{"id":"CVE-2026-98496","p":1792340220590,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: airoha: npu: cancel wdt_work after releasing the WDT IRQ\n\nairoha_npu_remove() calls cancel_work_sync() on each core's wdt_work,\nbut the watchdog IRQ that queues it is requested with devm_request_irq()\nand is freed only after .remove() returns.…"},{"id":"CVE-2026-98495","p":1792340220483,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: arp: terminate device name before lookup\n\nThe ARP ioctl copies a user-provided struct arpreq into a stack object. Its\narp_dev field may contain IFNAMSIZ bytes without a NUL terminator.\n\nSuch input is passed to dev_get_by_name_rcu() or…"},{"id":"CVE-2026-98494","p":1792340220370,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: atl1: fix soft lockup on out-of-range cmb_tpd_next_to_clean read\n\nSame issue as atl1c (see the first commit in this series, \"net:\natl1c: fix soft lockup on out-of-range tpd_cons read\"): the hardware\ncan report an out-of-range…"},{"id":"CVE-2026-98493","p":1792340220257,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: ipconfig: bound DHCP option construction\n\nic_dhcp_init_options() appends the hostname (option 12), vendor-class\n(option 60) and client-ID (option 61) options into the fixed 312-byte\nbootp_pkt.exten[] buffer.  Only the client-ID branch checked…"},{"id":"CVE-2026-98492","p":1792340220150,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: macb: fix dma_alloc_coherent() leak on macb_alloc() error paths\n\nFix 3 leaks in macb_alloc() error paths:\n- Tx buffer allocated but crossing a 4G boundary: Tx leaked.\n- Rx buffer allocation fails: Tx leaked.\n- Rx buffer allocated but crossing a…"},{"id":"CVE-2026-98491","p":1792340220020,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: openvswitch: conntrack: avoid modifying shared unconfirmed ct entry\n\nIn a case where skb with an unconfirmed ct entry gets cloned, we may\nend up committing both but with different sets of extensions.\n\nThe series of events:\n\n 1. The first clone…"},{"id":"CVE-2026-98490","p":1792340219903,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: openvswitch: conntrack: fix helper UAF due to extensions realloc\n\nWhile calling the helpers, a raw pointer to the extensions area is\nwired into expectations list:\n\n  -> nf_ct_helper()\n   -> helper->help()\n    -> nf_ct_expect_related_report()…"},{"id":"CVE-2026-98489","p":1792340219733,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: atl1c: fix soft lockup on out-of-range tpd_cons read\n\nThe hardware can report an out-of-range tpd_cons (seen as 0xffff)\nwhile the PCIe link/MAC is resetting. An out-of-range value can\nnever be reached and the loop below would spin forever. To…"},{"id":"CVE-2026-98488","p":1792340219613,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: atl1e: fix soft lockup on out-of-range hw_next_to_clean read\n\nSame issue as atl1c (see the first commit in this series, \"net:\natl1c: fix soft lockup on out-of-range tpd_cons read\"): the hardware\ncan report an out-of-range hw_next_to_clean (seen…"},{"id":"CVE-2026-98487","p":1792340219423,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: bridge: mdb: restart port group walk after deletion\n\nbr_mdb_flush_pgs() keeps a pointer-to-pointer cursor while walking\nmp->ports. br_multicast_del_pg() can re-enter the same MDB entry through\nbr_multicast_sg_del_exclude_ports() and unlink other…"},{"id":"CVE-2026-98486","p":1792340219313,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: ena: fix MMIO read buffer leak on probe failure\n\nena_device_init() initializes the MMIO read mechanism with\nena_com_mmio_reg_read_request_init(), which allocates a coherent DMA\nbuffer for MMIO read responses.\n\nThe normal removal path releases…"},{"id":"CVE-2026-98485","p":1792340219187,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: ip6t_rt: fix zero-address non-strict match out-of-bounds read\n\nrt_mt6_check() permits rules to be configured with rtinfo->addrnr == 0\neven when address matching (IP6T_RT_FST_MASK) is requested.\n\nIn the IP6T_RT_FST_NSTRICT path, rt_mt6()…"},{"id":"CVE-2026-98484","p":1792340219077,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nf_tables: skip expired catchall elements on insert and delete\n\nnft_setelem_catchall_insert() looks up duplicates with\nnft_set_elem_active() only, while nft_set_catchall_lookup() and the\ndump path additionally skip expired elements.\n\nOnce…"},{"id":"CVE-2026-98483","p":1792340218940,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nnfc: fix use-after-free in nfc_get_local_general_bytes\n\nCommit 6709d4b7bc2e (\"net: nfc: Fix use-after-free caused by\nnfc_llcp_find_local\") attempted to fix a use-after-free (UAF) issue by\ninvoking nfc_llcp_local_put(local) after accessing local->gb.…"},{"id":"CVE-2026-98482","p":1792340218817,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nnfc: llcp: drop truncated I/RR/RNR PDUs in nfc_llcp_recv_hdlc()\n\nnfc_llcp_recv_hdlc() reads the sequence byte skb->data[2], via\nnfc_llcp_ns()/nfc_llcp_nr(), before any length check. The receive path\nonly guarantees the two-byte LLCP header --…"},{"id":"CVE-2026-98481","p":1792340218697,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nnfc: port100: reject frames whose declared length exceeds the received data\n\nport100_recv_response() passes the URB transfer buffer to\nport100_rx_frame_is_valid(), which checksums le16_to_cpu(frame->datalen)\nbytes of frame->data. datalen is a 16-bit…"},{"id":"CVE-2026-98480","p":1792340218593,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nnfc: trf7970a: power down on startup RX gain failure\n\ntrf7970a_startup() powers up the device before applying the optional RX\ngain reduction. If the register read or write fails, it returns without\nundoing that power-up. Probe's unwind only drops the…"},{"id":"CVE-2026-98479","p":1792340218467,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: libiscsi_tcp: Check the data direction of a Data-In PDU\n\nThe Data-In branch of iscsi_tcp_hdr_dissect() resolves the ITT to a task\nand copies the PDU's data segment into that command's scatterlist without\nasking whether the command was reading.…"},{"id":"CVE-2026-98478","p":1792340218353,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: ufs: core: Keep internal commands dispatchable during error handling\n\nCommit 08b12cda6c44 (\"scsi: ufs: core: Switch to scsi_get_internal_cmd()\")\nswitched UFS internal commands to allocate requests on\nhba->host->pseudo_sdev->request_queue, which…"},{"id":"CVE-2026-98477","p":1792340218243,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nperf/core: Fix NULL pmu_ctx passed to pmu->sched_task()\n\nperf_pmu_sched_task() returns early when cpuctx->task_ctx is set, and\ncpc->task_epc is only non-NULL while a task context is scheduled in on\nthis CPU. __perf_pmu_sched_task() therefore always…"},{"id":"CVE-2026-98476","p":1792340218130,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\ns390/cio: Fix NULL pointer dereference in ccw_device_get_util_str()\n\nThe channel path registry entry associated with a CHPID may be removed\nwhile the subchannel's PMCW still references that CHPID. In this case,\nchpid_to_chp() can return NULL, leading…"},{"id":"CVE-2026-98475","p":1792340218027,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\ns390/cmf: Fix virtual vs physical address confusion\n\nThe measurement block address is an absolute address. Define the\nassociated schib_config and schib fields as dma64_t to enable automatic\ndetection of incorrect assignments. Also add the missing…"},{"id":"CVE-2026-98474","p":1792340217927,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\ns390/pci: Fix missing device lock in zpci_report_status()\n\nWhen pdev is non-NULL, zpci_report_status() accesses the device's driver.\nTo get a consistent state matching the recovery, the device lock needs to\nbe held. Do so by expanding the existing…"},{"id":"CVE-2026-98473","p":1792340217793,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\ns390/vfio-ap: fix KVM GISC and page leak when queue removed from host config\n\nThree related problems exist in the handling of KVM interrupt and page\nresources when a queue is removed from the host's AP configuration\nwhile assigned to a mediated…"},{"id":"CVE-2026-98472","p":1792340217697,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: SEV: Free have_run_cpus during VM destruction even if VM is no longer SEV\n\nUnconditionally free SEV's \"have run CPUs\" cpumask in the VM destroy path,\ni.e. even for what appear to be non-SEV VMs, as an SEV VM becomes a non-SEV\nVM if its state is…"},{"id":"CVE-2026-98471","p":1792340217600,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: SEV: Do cache maintenance on the source VM during intra-host migration\n\nManually perform cache maintenance on the source VM during intra-host\nmigration to ensure no stale data is left in CPU caches after the VM is\ndestroyed.  Because the source…"},{"id":"CVE-2026-98470","p":1792340217507,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: arm64: Don't WARN on an unknown VM ioctl in protected mode\n\nkvm_pkvm_ioctl_allowed() WARNs when kvm_get_cap_for_kvm_ioctl() doesn't\nfind the ioctl number in vm_ioctl_caps[], and kvm_arch_vm_ioctl() calls\nit for every number the generic code…"},{"id":"CVE-2026-98469","p":1792340217413,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: arm64: Fix AArch32 DBGBXVR<n> handling\n\nThe consolidation of the breakpoint and watchpoint register accessors\nswitched DBGBXVR<n> from trap_bvr() to trap_dbg_wb_reg(). The latter\nselects backing storage with demux_wb_reg(), which only handles…"},{"id":"CVE-2026-98468","p":1792340217293,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: arm64: Fix spurious warning for benign stage 2 teardown race\n\nkvmtool was used to establish an L1 guest with 8 CPUs and 8 GiB of RAM, an\nL2 guest with 4 CPUs and 4 GiB of RAM and an L3 guest with 2 CPUs and 2 GiB\nof RAM, all of which was then…"},{"id":"CVE-2026-98467","p":1792340217190,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: arm64: nv: Fix null ptr deref on nested wp/unmap, teardown race\n\nCommit 7270cc9157f4 (\"KVM: arm64: nv: Handle VNCR_EL2 invalidation from MMU\nnotifiers\") introduced VNCR_EL2 invalidation in both kvm_nested_s2_unmap()\nand kvm_nested_s2_wp().…"},{"id":"CVE-2026-98466","p":1792340217090,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: arm64: Transfer the hyp stack pages out of the host stage-2\n\nfix_host_ownership() walks only the linear-map alias of each memblock\nregion, and the per-CPU hyp stack, mapped in the private VA range for\nits guard page, has none.\n\nWalk each stack's…"},{"id":"CVE-2026-98465","p":1792340216993,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nRISC-V: KVM: Serialize IMSIC attributes with vCPU migration\n\nKVM device ioctls are not serialized against KVM_RUN. As a result,\nkvm_riscv_aia_imsic_rw_attr() can snapshot the physical CPU and HGEI of\nan IMSIC VS-file before a concurrent vCPU…"},{"id":"CVE-2026-98464","p":1792340216873,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nRISC-V: KVM: Synchronize hrtimer callback during teardown\n\nThe non-Sstc hrtimer callback clears next_set before its final uses of\nthe enclosing vCPU.  If teardown observes next_set as false while the\ncallback is still running,…"},{"id":"CVE-2026-98463","p":1792340216770,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nsched_ext: Derive SCX_RQ_IN_WAKEUP from the core enqueue flags\n\nschedule_deferred_locked() skips scheduling a deferred action while\nSCX_RQ_IN_WAKEUP is set and relies on the task_woken_scx() call that follows\na wakeup enqueue to run it.…"},{"id":"CVE-2026-98462","p":1792340216660,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: hci_conn: fix CIS hold ownership on reuse\n\nCommit 69997d50ec57 (\"Bluetooth: ISO: handle bound CIS cleanup via\nhci_conn\") made hci_bind_cis() and hci_connect_cis() return a\nconnection with one hold for the ISO layer.  hci_bind_cis()…"},{"id":"CVE-2026-98461","p":1792340216543,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: hci_sock: validate event length before filtering\n\nis_filtered_packet() reads the event code from skb->data[0] without first\nchecking that the skb is nonempty. When an opcode filter is configured,\nit also reads the command opcode at offsets…"},{"id":"CVE-2026-98460","p":1792340216430,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: hci_sock: reject out-of-range OCF values\n\nThe raw HCI socket security filter has 128 OCF bits per supported OGF,\nbut masks the 10-bit OCF with 127 before looking up the command. An\nunprivileged socket can therefore submit a reserved OCF…"},{"id":"CVE-2026-98459","p":1792340216327,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: ISO: balance the parent hold in hci_bind_bis()\n\nhci_conn_link() takes a lifetime reference to its parent with\nhci_conn_get(), but only takes an operational hold on the child.\nhci_conn_unlink() later balances both a hold and a reference on…"},{"id":"CVE-2026-98458","p":1792340216230,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: ISO: release unused CIS holds after channel attach\n\nhci_bind_cis() and hci_connect_cis() return one hci_conn hold for the\nISO layer.  A new channel association consumes that hold, which is\neventually released by iso_conn_free().\n\nThere are…"},{"id":"CVE-2026-98457","p":1792340216110,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: L2CAP: validate frame length before control and FCS access\n\nl2cap_data_rcv() unpacks either a two-byte or four-byte control field\nwithout first ensuring that it is present. A short ERTM or streaming-mode\nframe can therefore cause an…"},{"id":"CVE-2026-98456","p":1792340216003,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: mgmt: fix race in read_unconf_index_list()\n\nread_unconf_index_list() counts unconfigured controllers before allocating\nits response, then checks the device flags again while filling it.\n\nhci_dev_list_lock stabilizes list membership, but it…"},{"id":"CVE-2026-98455","p":1792340215863,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: RFCOMM: fix NULL dereference of dlc->session in RFCOMM_CONNINFO\n\nThe RFCOMM_CONNINFO getsockopt handler accepts a socket that is not\nconnected as long as deferred setup is enabled:\n\n\tif (sk->sk_state != BT_CONNECTED &&…"},{"id":"CVE-2026-98454","p":1792340215757,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: fix create context out-of-bounds reads\n\nsmb2_parse_contexts() validates the complete create-context area but\ndoes not limit each record to its Next field before dispatching it.  A\nmalformed chain can therefore expose bytes beyond the…"},{"id":"CVE-2026-98453","p":1792340215647,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: close handle after create-context parsing failure\n\nSMB2_open() accounts a successful CREATE response as a remote open before\nparsing its create contexts.  If smb2_parse_contexts() rejects malformed\ncontext data, SMB2_open() returns…"},{"id":"CVE-2026-98452","p":1792340215537,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: clean up failed cached directory opens\n\nopen_cached_dir() sends CREATE and QUERY_INFO as a compound request. If\nthe CREATE succeeds but a later command returns an error, the function\nmust retain the CREATE FID so common cleanup can issue…"},{"id":"CVE-2026-98451","p":1792340215437,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: use finish_no_open() for non-regular inodes\n\nAn O_CREAT open can find an existing symlink or another non-regular\ninode. cifs_atomic_open() calls finish_open() on it and attaches a\ncifsFileInfo. Symlink inodes have no CIFS release…"},{"id":"CVE-2026-98450","p":1792340215333,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: close completed creates on compound wait errors\n\ncompound_send_recv() waits for responses in order. If a later wait is\ninterrupted, or if a later MID fails during response synchronization, an\nearlier CREATE may already have opened a…"},{"id":"CVE-2026-98449","p":1792340215237,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: delete compound mids on send failure before unlock\n\nWhen sending a compound request fails, smb_send_rqst() kicks off a\nreconnect. compound_send_recv() still has those mids on pending_mid_q,\nbut it unlocks the server without removing them…"},{"id":"CVE-2026-98448","p":1792340215140,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nxfs: release orphanage dir inode if chown fails\n\nLOLLM points out that we leak the igrab'd reference to the orphanage\ndirectory inode if chowning it fails.  Fix that."},{"id":"CVE-2026-98447","p":1792340215037,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nxfs: fix wild memcpy access when formatting ondisk rtrefcount btree roots\n\nLOLLM noticed that the inode btree root formatting methods copy too many\nbytes -- there's only one set of keys in node blocks, not two.  This\ncauses memory corruption of…"},{"id":"CVE-2026-98446","p":1792340214937,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nxfs: don't let hidden_space go negative in xfs_metafile_resv_init\n\nLOLLM points out that if the amount of fdblocks that we can reserve for\na metadata btree file goes below the space already used by that file,\nthen the hidden_space subtraction can…"},{"id":"CVE-2026-98445","p":1792340214837,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nxfs: don't let memory failures leak blocks and kill repairs\n\nLOLLM complains that a memory allocation failure in\nxrep_newbt_add_blocks results in online repair leaking blocks that were\npreviously allocated to write a new btree, but the problem is…"},{"id":"CVE-2026-98444","p":1792340214737,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nxfs: drop dquot flush lock when we can't find a buffer to flush\n\nLOLLM noticed that xfs_qm_flush_one fails to drop the dquot flush lock\nif it can't grab the buffer associated with the dquot.  Since there's no\nbuffer, nobody else is going to drop the…"},{"id":"CVE-2026-98443","p":1792340214620,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nxfs: fix cursor and pointer handling when recovering iunlink buckets\n\nLOLLM pointed out a bug in xlog_recover_iunlink_bucket:\n\n1. We don't null out prev_ip after releasing it, which can lead to UAF\n   problems if the inodegc flush call in the loop…"},{"id":"CVE-2026-98442","p":1792340214503,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: act_ct: fix helper UAF due to extensions realloc\n\nWhile calling the helpers, a raw pointer to the extensions area is\nwired into expectations list:\n\n  -> nf_ct_helper()\n   -> helper->help()\n    -> nf_ct_expect_related_report()\n     ->…"},{"id":"CVE-2026-98441","p":1792340214393,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: act_ct: avoid modifying shared unconfirmed ct entry\n\nIn a case where skb with an unconfirmed ct entry gets cloned, we may\nend up processing both again but with different sets of extensions.\n\nThe series of events:\n\n 1. The first clone wants…"},{"id":"CVE-2026-98440","p":1792340214287,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: arm64: nv: Delay freeing of shadow S2 structures until VM destruction\n\nWe free the shadow S2 structures from kvm_arch_flush_shadow_all(), which\nis a Bad Idea(tm). Freeing the page tables is fair game (this is what\nthis callback is for), but…"},{"id":"CVE-2026-98439","p":1792336613687,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nsmb/server: cancel async requests when closing connection\n\nAn async request may still be waiting when a connection is closed.\nThis can stop the connection from closing.\n\nCancel active async requests before waiting for them to finish."},{"id":"CVE-2026-98438","p":1792336613590,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nmptcp: options: fix uninit-value in mptcp_write_data_fin\n\nWhen sending a DATA_FIN without data, and because the DATA_FIN occupies\n1 octet of the connection-level sequence space [1], it is then required\nto add a DSS mapping with specific values.\n\nIf…"},{"id":"CVE-2026-98437","p":1792336613490,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: qcom: iris: fix runtime PM reference leaks\n\nUse pm_runtime_resume_and_get() in iris_enable_power_domains()\nto avoid leaking a runtime PM usage count on failure.\n\nAlso ensure pm_runtime_put_sync() is always called in…"},{"id":"CVE-2026-98436","p":1792336613397,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\naccel/amdxdna: Disable device buffer exporting\n\nDevice buffers are never intended to be exported. Disable exporting\nsupport explicitly."},{"id":"CVE-2026-98435","p":1792336613300,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nEDAC/altera: Use parent device for devres in altr_portb_setup()\n\nAnchor the devres group and the devm-managed IRQ requests in altr_portb_setup()\nto the actual parent device (device->edac->dev) instead of the embedded struct\ndevice inside the copied…"},{"id":"CVE-2026-98434","p":1792336613200,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nsysctl: Check range in  proc_dointvec_ms_jiffies_minmax\n\nAdd the range check to do_proc_int_conv_ms_jiffies_minmax that commit\nd174174c6776 (\"sysctl: replace SYSCTL_INT_CONV_CUSTOM macro with\nfunctions\") incorrectly removed."},{"id":"CVE-2026-98433","p":1792336613047,"x":"In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: PPC: Book3S HV: fix secure device page leak on uv_page_in() failure\n\nIn kvmppc_svm_page_in(), if uv_page_in() fails after\nkvmppc_uvmem_get_page() has succeeded, the secure device page is never\nreleased.  kvmppc_uvmem_get_page() sets a bit in…"},{"id":"CVE-2026-111991","p":1792336612853,"x":"A security vulnerability has been detected in WongKinYiu yolov9 0.1. This vulnerability affects the function DetectMultiBackend.__init__ of the file models/common.py of the component ONNX Metadata Handler. The manipulation of the argument names/stride leads to code injection. Remote exploitation of the attack is…","s":6.3,"v":"MEDIUM","cwe":"CWE-74"},{"id":"CVE-2026-111990","p":1792336612693,"x":"A weakness has been identified in kishan0725 Hospital Management System up to 777fda46b77a820977a5ba616283dbfbc40bf7e1. This affects the function mysqli_query of the file admin-panel.php of the component Appointment Cancellation Handler. Executing a manipulation of the argument ID can lead to sql injection. The attack…","s":7.3,"v":"HIGH","cwe":"CWE-74"},{"id":"CVE-2026-111988","p":1792336612483,"x":"A security flaw has been discovered in dyad-sh dyad up to 1.16.0. Affected by this issue is some unknown functionality of the component OAuth Callback Handler. Performing a manipulation results in cross-site request forgery. The attack may be initiated remotely. Upgrading to version 1.17.0-beta.1 can resolve this…","s":4.3,"v":"MEDIUM","cwe":"CWE-352"},{"id":"CVE-2026-110024","p":1792336611417,"x":"@fastify/jwt is a JWT utility plugin for Fastify. In versions prior to 10.2.5, the top-level sign and verify methods replace the globally configured defaults with the per-call options instead of merging them, so passing any per-call option silently drops every global default that the call does not restate, including…","s":6.8,"v":"MEDIUM","cwe":"CWE-613"},{"id":"CVE-2026-111987","p":1792333014630,"x":"A vulnerability was identified in AUTOMATIC1111 stable-diffusion-webui up to 1.10.1. Affected by this vulnerability is the function read_metadata_from_safetensors of the file modules/sd_models.py of the component Extra-Networks Card Builder. Such manipulation of the argument __metadata__.sshs_model_hash leads to cross…","s":4.3,"v":"MEDIUM","cwe":"CWE-79"},{"id":"CVE-2026-112063","p":1792329398893,"x":"libstrophe through 0.14.0 contains a stack-based buffer overflow vulnerability in SCRAM_Hi that allows malicious XMPP servers to overflow a 128-byte stack buffer by sending an oversized SCRAM salt. Attackers can send a server-first-message whose s= attribute decodes to more than 124 bytes, aborting the client or…","s":5.9,"v":"MEDIUM","cwe":"CWE-121"},{"id":"CVE-2026-112062","p":1792329398750,"x":"lwIP through 2.2.1 contains a stack out-of-bounds write vulnerability in mdns_handle_response that allows adjacent attackers to corrupt stack memory by sending mDNS responses with invalid domain names. Attackers on the local link can send multicast PTR answers with oversized RDLENGTH or SRV answers with RDLENGTH below…","s":5.9,"v":"MEDIUM","cwe":"CWE-121"},{"id":"CVE-2026-112061","p":1792329398600,"x":"librtmp (RTMPDump) through 2.6 contains a heap out-of-bounds read vulnerability in AMFProp_Decode that reads an AMF0 strict-array element count before checking that four bytes remain. A malicious RTMP server or man in the middle can send an AMF0 body ending with a strict-array type byte and fewer than four trailing…","s":4.3,"v":"MEDIUM","cwe":"CWE-125"},{"id":"CVE-2026-112060","p":1792329398437,"x":"librtmp in RTMPDump through 2.6 contains an out-of-bounds read and heap out-of-bounds write vulnerability because AMF3_Decode ignores AMF3 property decode failures. Malicious RTMP servers or man-in-the-middle attackers can send oversized AMF3 string lengths, and with the token option DecodeTEA corrupts heap memory and…","s":6.4,"v":"MEDIUM","cwe":"CWE-787"},{"id":"CVE-2026-112059","p":1792329398300,"x":"libLAS through 1.8.1 contains a heap out-of-bounds write vulnerability in the point record reader caused by truncating the schema byte size to 16 bits when sizing the point buffer. Attackers can craft a .las file with a LASSchema variable length record whose schema exceeds 65535 bytes, so tools like lasinfo, las2las,…","s":6.1,"v":"MEDIUM","cwe":"CWE-787"},{"id":"CVE-2026-112058","p":1792329398167,"x":"VideoLAN libdvdnav through 7.0.0 contains an out-of-bounds read vulnerability in set_PTT that allows attackers to crash applications by supplying an invalid JumpTT title number checked only by an assert. Attackers can craft a DVD or disc image whose First Play program chain issues JumpTT with title 0 or an oversized…","s":5.5,"v":"MEDIUM","cwe":"CWE-125"},{"id":"CVE-2026-112057","p":1792329398037,"x":"libdvdnav before 7.0.0 contains a heap out-of-bounds read vulnerability in dvdnav_describe_title_chapters that allows attackers to read beyond the part-of-title array by supplying an oversized vts_ttn value. Attackers can provide a crafted DVD or disc image declaring a larger VMGI title vts_ttn than the title set's…","s":5.5,"v":"MEDIUM","cwe":"CWE-125"},{"id":"CVE-2026-112056","p":1792329397890,"x":"wvWare wv through 1.2.9 contains a heap-based out-of-bounds read vulnerability in wvGetSTSH in stylesheet.c that allows attackers to crash applications by supplying crafted Word stylesheets. Attackers can provide a .doc file with ten or fewer styles or out-of-range style base indexes to read past heap arrays, crashing…","s":5.5,"v":"MEDIUM","cwe":"CWE-125"},{"id":"CVE-2026-112055","p":1792329397757,"x":"wvWare wv through 1.2.9 contains a stack-based out-of-bounds read vulnerability in wvGetPAPX_FKP and wvGetCHPX_FKP caused by an unvalidated FKP run count. Attackers can supply a crafted .doc file with a large crun value to read kilobytes past the 512-byte stack buffer, crashing applications like AbiWord.","s":5.5,"v":"MEDIUM","cwe":"CWE-125"},{"id":"CVE-2026-112054","p":1792329397620,"x":"Schroedinger libschroedinger through 1.0.11 contains a divide by zero vulnerability that allows attackers to crash applications by supplying a zero slice_bytes_denom or slice count in a Dirac stream. Attackers can provide a crafted low-delay picture parsed by schro_decoder_parse_transform_parameters and…","s":5.5,"v":"MEDIUM","cwe":"CWE-369"},{"id":"CVE-2026-112053","p":1792329397470,"x":"Schroedinger libschroedinger through 1.0.11 contains an out-of-bounds read vulnerability that allows attackers to read past a static quantiser table by supplying unvalidated wavelet filter index or transform depth values. Attackers can deliver a crafted low-delay Dirac stream with a wavelet filter index of 7 or more…","s":5.5,"v":"MEDIUM","cwe":"CWE-125"},{"id":"CVE-2026-112052","p":1792329397337,"x":"libspatialite through 5.1.0 contains an integer overflow vulnerability in the WKB point and vertex count size guard of ParseWkbLine and related parsers in gg_wkb.c, allowing out-of-bounds reads. Attackers can supply a crafted geometry BLOB with a large point count, for example in a SpatiaLite database file, to crash…","s":6.1,"v":"MEDIUM","cwe":"CWE-190"},{"id":"CVE-2026-112051","p":1792329397190,"x":"Xinference through 4.0.1 contains a path traversal vulnerability on Windows that allows unauthenticated attackers to write and delete arbitrary .json files via backslash sequences in model_name. Attackers can register a persisted custom model through POST /v1/model_registrations/{model_type} with names like ..\\..\\evil…","s":6.5,"v":"MEDIUM","cwe":"CWE-22"},{"id":"CVE-2026-112050","p":1792329397050,"x":"Gitify before 7.10.0 contains a login cross-site request forgery vulnerability that allows remote attackers to bind a victim's client to their account because performGitHubWebOAuth() omits OAuth state validation. Attackers can get a gitify://oauth?code= link with their own authorization code opened during a victim's…","s":3.1,"v":"LOW","cwe":"CWE-352"},{"id":"CVE-2026-112049","p":1792329396913,"x":"Vita3K before build 4187 contains a path traversal (zip slip) vulnerability in install_archive_content() that allows attackers to write files outside the install directory via crafted .vpk archives. Attackers can embed '..' segments or absolute paths in zip entry names to write attacker-controlled files anywhere…","s":5.5,"v":"MEDIUM","cwe":"CWE-22"},{"id":"CVE-2026-112048","p":1792329396770,"x":"libspatialite through 5.1.0 fails to validate the polygon ring count in ParseWkbPolygon, allowing attackers to trigger uncontrolled interior-ring allocation via crafted geometry BLOBs. Attackers can supply a crafted polygon in a SpatiaLite database or ST_GeomFromWKB input to crash the process or corrupt heap memory on…","s":6.1,"v":"MEDIUM","cwe":"CWE-789"},{"id":"CVE-2026-112047","p":1792329396607,"x":"OneUptime 14.0.2 before 14.0.69 contains an incorrect authorization vulnerability that allows authenticated project members to act on clusters outside their scope by exploiting project-wide permission checks. Attackers can call the AI access test, agent reset, kubectl plan approval and incident AI conversation…","s":5.4,"v":"MEDIUM","cwe":"CWE-863"},{"id":"CVE-2026-112046","p":1792329396463,"x":"OW2 ASM 9.11 before 9.11.1 contains an infinite loop vulnerability in Label.resolve() caused by 16-bit forward-reference offsets truncating when rewritten methods exceed 64 KB. Attackers can supply crafted class files whose transformed code grows past 65535 bytes, hanging ClassReader.accept() and denying service to…","s":5.5,"v":"MEDIUM","cwe":"CWE-835"},{"id":"CVE-2026-111986","p":1792329395920,"x":"A vulnerability was determined in AUTOMATIC1111 stable-diffusion-webui up to 1.10.1. Affected is the function get_obj_from_str of the file modules/sd_models.py of the component Model Instantiation. This manipulation of the argument Target causes code injection. The attack can be initiated remotely. The exploit has…","s":6.3,"v":"MEDIUM","cwe":"CWE-74"},{"id":"CVE-2026-78497","p":1792325835350,"x":"JQ::Lite versions before 2.51 for Perl execute Perl code embedded in a query's regular expression by compiling it with string eval.\n\nThe pattern given to test(), match(), or the match and =~ conditions of select() is placed in a `qr'...'` literal and compiled as source text, so a `(?{ ... })` code block in it runs…","cwe":"CWE-95"},{"id":"CVE-2026-112021","p":1792325835200,"x":"snac2 before 2.93 contains a heap-based buffer overflow vulnerability in _xs_json_load_lexer() that allows unauthenticated remote attackers to corrupt heap memory by sending JSON strings containing a \\u0000 escape. Attackers can send a single crafted application/activity+json POST to activitypub_post_handler(), which…","s":7.5,"v":"HIGH","cwe":"CWE-122"},{"id":"CVE-2026-112020","p":1792325835067,"x":"LodePNG through 20261006 contains a heap out-of-bounds read vulnerability in lodepng::getFilterTypesInterlaced() in lodepng_util.cpp that lacks bounds checks on decompressed IDAT data. Attackers can supply a crafted interlaced PNG declaring a raster larger than its IDAT stream to disclose adjacent heap memory or crash…","s":6.1,"v":"MEDIUM","cwe":"CWE-125"},{"id":"CVE-2026-112019","p":1792325834910,"x":"cgltf through 1.15 contains a heap out-of-bounds read vulnerability in cgltf_accessor_unpack_floats() that advances the sparse values cursor by the base bufferView byteStride. Attackers can supply a crafted glTF or GLB file that passes cgltf_validate() to read adjacent heap memory into vertex data or crash…","s":6.1,"v":"MEDIUM","cwe":"CWE-125"},{"id":"CVE-2026-112018","p":1792325834747,"x":"cgltf through 1.15 contains a heap out-of-bounds write vulnerability in cgltf_accessor_unpack_floats() that allows attackers to write outside the output buffer via unchecked sparse accessor indices. Attackers can supply a crafted glTF or GLB file with large sparse indices to corrupt heap memory, crash applications,…","s":7,"v":"HIGH","cwe":"CWE-787"},{"id":"CVE-2026-112017","p":1792325834600,"x":"JeecgBoot before 3.9.5 contains an sql injection vulnerability that allows authenticated attackers to bypass the SqlInjectionUtil keyword blocklist by inserting newline characters into dictionary and online report SQL fragments. Attackers can send newline-separated payloads to endpoints like /sys/dict/getDictItems for…","s":6.5,"v":"MEDIUM","cwe":"CWE-89"},{"id":"CVE-2026-112016","p":1792325834450,"x":"Netcore NR256CN through 1.5.140116 contains an unauthenticated file write vulnerability in the Boa-derived /bin/boa web server that allows remote attackers to overwrite update and restore staging files. Attackers can POST to a non-existent .cgi pathname to write attacker-controlled content into /tmp/boa_temp.update or…","s":6.5,"v":"MEDIUM","cwe":"CWE-306"},{"id":"CVE-2026-112015","p":1792325834303,"x":"Omnigent 0.3.0 before 0.14.0 contains a path traversal vulnerability that allows authenticated users to escape the workspace by setting os_env.cwd on nested sub-agents. Attackers can upload a bundle whose sub-agent uses an absolute or parent-traversing working directory, bypassing root-only validation in bundles.py,…","s":7.5,"v":"HIGH","cwe":"CWE-22"},{"id":"CVE-2026-112014","p":1792325834167,"x":"LobsterAI before 2026.10.16 contains a hardcoded password vulnerability that allows attackers to decrypt exported provider API keys encrypted with the constant 'lobsterai-APP'. Attackers who obtain a providers export file can derive the AES-GCM key via PBKDF2 using the embedded salt and recover every third-party AI…","s":5.5,"v":"MEDIUM","cwe":"CWE-321"},{"id":"CVE-2026-112013","p":1792325834030,"x":"libtta through 2.3 contains a divide-by-zero vulnerability in tta_decoder_init_get_info() that allows attackers to crash applications by supplying an unvalidated zero sample rate. Attackers can craft a .tta file with a recomputed header CRC32 that triggers SIGFPE, crashing applications including the bundled tta…","s":5.5,"v":"MEDIUM","cwe":"CWE-369"},{"id":"CVE-2026-112012","p":1792325833873,"x":"libtta through 2.3 contains a stack out-of-bounds read and write vulnerability in tta_decoder_process_stream() and tta_decoder_process_frame() because header checks never reject a zero channel count. Attackers can supply a crafted .tta file declaring zero channels so decorrelation accesses cache[-1] with…","s":5.3,"v":"MEDIUM","cwe":"CWE-787"},{"id":"CVE-2026-112011","p":1792325833653,"x":"libtta through 2.3 contains an integer overflow vulnerability in tta_decoder_init_get_info() that allows attackers to cause a heap buffer overflow on 32-bit builds via unvalidated header fields. Attackers can supply a crafted .tta file with a sample rate of 1 and large samples value, wrapping the seek table allocation…","s":5.3,"v":"MEDIUM","cwe":"CWE-190"},{"id":"CVE-2026-112010","p":1792325833520,"x":"smpeg through 2.0.0 contains an integer underflow vulnerability in stream_header() in MPEGsystem.cpp that allows attackers to wrap packet_size by declaring an undersized packet length. Attackers can supply a crafted MPEG file opened via SMPEG_new, SMPEG_new_rwops or SMPEG_new_data to trigger a reachable assertion or…","s":5.5,"v":"MEDIUM","cwe":"CWE-191"},{"id":"CVE-2026-112009","p":1792325833383,"x":"smpeg through 2.0.0 contains a heap out-of-bounds read vulnerability in MPEGsystem::FillBuffer() that allows attackers to read past the 16384-byte buffer by supplying a crafted system header stream table. Attackers can provide an MPEG file whose stream table bytes all set the high bit, which crashes applications…","s":5.5,"v":"MEDIUM","cwe":"CWE-125"},{"id":"CVE-2026-112008","p":1792325833247,"x":"libmng through 2.0.3 contains a heap-based buffer overflow vulnerability in mng_read_ordr() that allows attackers to corrupt heap memory because ORDR entry buffers are sized by 5-byte on-wire records instead of 8-byte in-memory entries. Attackers can supply a crafted MNG file with MHDR, DHDR and a multi-record ORDR…","s":6.1,"v":"MEDIUM","cwe":"CWE-131"},{"id":"CVE-2026-112007","p":1792325833097,"x":"Schism Tracker through 20260524 contains a heap out-of-bounds write vulnerability in fmt_ult_load_song() in fmt/ult.c that fails to clamp the one-byte sample count to MAX_SAMPLES. Attackers can supply a crafted .ult module that overwrites the instruments pointer array, causing csf_destroy() to free attacker-chosen…","s":6.1,"v":"MEDIUM","cwe":"CWE-787"},{"id":"CVE-2026-112006","p":1792325832927,"x":"OpenTelemetry opentelemetry-exporter-otlp-proto-http 1.5.0 before 1.45.0 contains an improper certificate validation vulnerability that disables TLS verification when OTEL_EXPORTER_OTLP_CERTIFICATE variables are empty strings. Man-in-the-middle attackers can impersonate the collector to read or alter exported traces,…","s":6.5,"v":"MEDIUM","cwe":"CWE-295"},{"id":"CVE-2026-112005","p":1792325832790,"x":"WhoDB 0.104.0 before 0.135.0 contains a path traversal vulnerability that allows remote attackers to read and write arbitrary host files by running DuckDB filesystem functions through the query editor. Attackers can log in to a DuckDB file without credentials and use read_text, read_blob, COPY ... TO or ATTACH to…","s":7.7,"v":"HIGH","cwe":"CWE-22"},{"id":"CVE-2026-112004","p":1792325832647,"x":"Teable before 2026-10-12T12-45-53Z.3331 contains an authorization bypass vulnerability that allows authenticated users to rename folders in other bases by supplying a foreign folderId. The PATCH /api/base/:baseId/node/folder/:folderId endpoint checks base|update only against the URL baseId, so attackers can rename…","s":3.1,"v":"LOW","cwe":"CWE-639"},{"id":"CVE-2026-112003","p":1792325832490,"x":"ProjectSend 2.0.0 before 2.7.0 contains a path validation flaw in OrphanFileScanner::isOrphan() that allows staff with import_orphans permission to treat tracked files as orphans. Attackers can submit ./ path aliases to the orphans import or delete endpoints, deleting or adopting other owners' files while bypassing…","s":5.9,"v":"MEDIUM","cwe":"CWE-180"},{"id":"CVE-2026-112002","p":1792325832323,"x":"ProjectSend 2.5.0 before 2.7.0 contains an unverified password change vulnerability in PasswordController::update() that lets sessions of Social-provisioned accounts set local passwords without the current password. Attackers holding a stolen session cookie can send PUT /settings/password to create a durable local…","s":6.8,"v":"MEDIUM","cwe":"CWE-620"},{"id":"CVE-2026-112001","p":1792325832140,"x":"ProjectSend 2.0.0 before 2.7.0 contains an incorrect authorization vulnerability that allows restricted API token holders to change the token owner's credentials via PATCH /api/v1/users/{user}. Attackers with a token limited to manage_users and edit_users can set a new owner password, clear two-factor authentication,…","s":7.2,"v":"HIGH","cwe":"CWE-863"},{"id":"CVE-2026-112000","p":1792325832007,"x":"Vanus 0.8.0 through 0.9.0 contains a missing authorization vulnerability in the gateway that allows any authenticated user to call Subscribe, Ack, and unregistered methods without permission checks. Attackers can supply another tenant's subscription ID to Subscribe to hijack it, read and acknowledge its events, starve…","s":7.6,"v":"HIGH","cwe":"CWE-862"},{"id":"CVE-2026-111999","p":1792325831870,"x":"Vanus 0.8.0 through 0.9.0 contains a missing authentication vulnerability that allows unauthenticated remote attackers to publish events to any eventbus through the gateway CloudEvents HTTP receiver. Attackers can send forged CloudEvents to the /namespaces/{ns}/eventbus/{name}/events or legacy /gateway/{name} paths,…","s":7.5,"v":"HIGH","cwe":"CWE-306"},{"id":"CVE-2026-111998","p":1792325831730,"x":"Vanus 0.8.0 through 0.9.0 contains a default credentials vulnerability that allows unauthenticated remote attackers to gain cluster-admin access by using the hardcoded admin token. Attackers can send the fixed Bearer token to the gateway gRPC proxy port to manage namespaces, eventbuses, users, tokens, and role…","s":9.8,"v":"CRITICAL","cwe":"CWE-1392"},{"id":"CVE-2026-111985","p":1792325831440,"x":"A vulnerability was found in AUTOMATIC1111 stable-diffusion-webui up to 1.10.1. This impacts the function read_metadata_from_safetensors of the file modules/sd_models.py of the component Metadata Extraction. The manipulation of the argument header length field results in allocation of resources. It is possible to…","s":4.3,"v":"MEDIUM","cwe":"CWE-400"},{"id":"CVE-2026-111984","p":1792325831210,"x":"A vulnerability has been found in AUTOMATIC1111 stable-diffusion-webui up to 1.10.1. This affects the function create_item_html of the file modules/ui_extra_networks.py of the component Card Builder. The manipulation of the argument filename leads to cross site scripting. It is possible to initiate the attack…","s":4.3,"v":"MEDIUM","cwe":"CWE-79"},{"id":"CVE-2026-110897","p":1792322197697,"x":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in IdeaBox Creations PowerPack Lite for Beaver Builder powerpack-addon-for-beaver-builder allows Stored XSS.This issue affects PowerPack Lite for Beaver Builder: from n/a through 1.3.1.","s":7.1,"v":"HIGH","cwe":"CWE-79"},{"id":"CVE-2026-110895","p":1792322197577,"x":"Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in DevItems Support Genix support-genix-lite allows SQL Injection.This issue affects Support Genix: from n/a through 1.4.54.","s":8.5,"v":"HIGH","cwe":"CWE-89"},{"id":"CVE-2026-110886","p":1792322197450,"x":"Deserialization of Untrusted Data vulnerability in QuantumCloud Conversational Forms for ChatBot conversational-forms allows Object Injection.This issue affects Conversational Forms for ChatBot: from n/a through 1.5.1.","s":9.8,"v":"CRITICAL","cwe":"CWE-502"},{"id":"CVE-2026-110885","p":1792322197330,"x":"Improper Control of Generation of Code ('Code Injection') vulnerability in HivePress HivePress hivepress allows Code Injection.This issue affects HivePress: from n/a through 1.7.32.","s":6.5,"v":"MEDIUM","cwe":"CWE-94"},{"id":"CVE-2026-110883","p":1792322197200,"x":"Authentication Bypass by Primary Weakness vulnerability in VideoWhisper.com 2Way VideoCalls and Random Chat webcam-2way-videochat allows Authentication Abuse.This issue affects 2Way VideoCalls and Random Chat: from n/a through 6.1.5.","s":6.5,"v":"MEDIUM","cwe":"CWE-305"},{"id":"CVE-2026-110880","p":1792322197070,"x":"Missing Authorization vulnerability in Kit Kit (formerly ConvertKit) convertkit allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Kit (formerly ConvertKit): from n/a through 3.4.6.","s":6.5,"v":"MEDIUM","cwe":"CWE-862"},{"id":"CVE-2026-110383","p":1792322196943,"x":"Authorization Bypass Through User-Controlled Key vulnerability in WP E-Signature Electronic Signature Add-on for Fluent Forms signature-fluent-contract-forms-add-on allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Electronic Signature Add-on for Fluent Forms: from n/a through…","s":7.5,"v":"HIGH","cwe":"CWE-639"},{"id":"CVE-2026-110382","p":1792322196827,"x":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NSquared Simply Schedule Appointments simply-schedule-appointments allows Stored XSS.This issue affects Simply Schedule Appointments: from n/a through 1.6.12.35.","s":7.1,"v":"HIGH","cwe":"CWE-79"},{"id":"CVE-2026-110373","p":1792322196703,"x":"Incorrect Privilege Assignment vulnerability in Hamid Alinia Login with phone number login-with-phone-number allows Privilege Escalation.This issue affects Login with phone number: from n/a through 1.8.77.","s":8.1,"v":"HIGH","cwe":"CWE-266"},{"id":"CVE-2026-110372","p":1792322196580,"x":"Incorrect Privilege Assignment vulnerability in Brainstorm Force OttoKit suretriggers allows Privilege Escalation.This issue affects OttoKit: from n/a through 1.1.40.","s":9.8,"v":"CRITICAL","cwe":"CWE-266"},{"id":"CVE-2026-110365","p":1792322196443,"x":"Missing Authorization vulnerability in WPExperts Advanced File Manager file-manager-advanced allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Advanced File Manager: from n/a through 5.4.14.","s":6.5,"v":"MEDIUM","cwe":"CWE-862"},{"id":"CVE-2026-109895","p":1792322196320,"x":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Arraytics Booktics booktics allows DOM-Based XSS.This issue affects Booktics: from n/a through 1.0.29.","s":7.1,"v":"HIGH","cwe":"CWE-79"},{"id":"CVE-2026-109894","p":1792322196190,"x":"Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Arraytics Booktics booktics allows SQL Injection.This issue affects Booktics: from n/a through 1.0.29.","s":9.3,"v":"CRITICAL","cwe":"CWE-89"},{"id":"CVE-2026-108485","p":1792322196047,"x":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeGrill eStore estore allows Reflected XSS.This issue affects eStore: from n/a through 1.6.13.","s":7.1,"v":"HIGH","cwe":"CWE-79"},{"id":"CVE-2026-107436","p":1792322194720,"x":"Deserialization of Untrusted Data vulnerability in WP Chill Strong Testimonials strong-testimonials allows Object Injection.This issue affects Strong Testimonials: from n/a through 3.3.12.","s":8.8,"v":"HIGH","cwe":"CWE-502"},{"id":"CVE-2026-96534","p":1792307813680,"x":"The Modern Events Calendar Lite WordPress plugin before 7.37.0, Modern Event Calendar Pro WordPress plugin before 7.37.0 does not sanitise and escape a parameter before using it in a SQL statement, allowing authenticated users with minimal privileges (Subscriber and above) to perform SQL injection attacks.","s":7.7,"v":"HIGH","cwe":"CWE-89"},{"id":"CVE-2026-87844","p":1792307813560,"x":"The PickPlugins Product Designer for WooCommerce WordPress plugin through 1.0.40 does not perform any capability check and its nonce verification is inverted, accepting requests with an invalid or absent nonce while rejecting valid ones, and it does not validate the post the data is written to, allowing…","s":5.3,"v":"MEDIUM","cwe":"CWE-862"},{"id":"CVE-2026-111942","p":1792307813343,"x":"A weakness has been identified in hrisikeshpal Blood_Bank_Management_System 1.0.0. Impacted is an unknown function of the file /abs.php. This manipulation of the argument Search causes cross site scripting. The attack can be initiated remotely. The exploit has been made available to the public and could be used for…","s":4.3,"v":"MEDIUM","cwe":"CWE-79"},{"id":"CVE-2026-111877","p":1792307813033,"x":"A vulnerability was determined in dext34-morgan Books4Cash up to a8d3e357db75c07ac5ffbadcbaee2aeb4db3e571. This affects an unknown part of the file search.php. Executing a manipulation of the argument Search can lead to cross site scripting. The attack may be performed from remote. The exploit has been publicly…","s":4.3,"v":"MEDIUM","cwe":"CWE-79"},{"id":"CVE-2026-111041","p":1792307812920,"x":"The AI Engine  WordPress plugin before 3.7.9 does not verify that the user performing certain AI media management actions owns or is otherwise allowed to edit the targeted object, allowing users with the Editor role or above to modify, or change the type of, arbitrary posts on the site, including content they are not…","s":4.9,"v":"MEDIUM","cwe":"CWE-862"},{"id":"CVE-2026-110981","p":1792307812817,"x":"The WP Photo Album Plus WordPress plugin before 9.2.11.002 does not properly escape a category navigation value before reflecting it into a JavaScript event handler on its gallery breadcrumb links, allowing unauthenticated attackers to inject arbitrary script that executes in the browser of anyone who follows a…","s":7.1,"v":"HIGH","cwe":"CWE-79"},{"id":"CVE-2026-110976","p":1792307812713,"x":"The AI Engine  WordPress plugin before 3.7.9 does not check that the item passed to one of its media actions belongs to the requesting user before converting it to an attachment and permanently deleting it, allowing users with the Editor role and above to delete arbitrary posts of any type, including content they…","s":4.9,"v":"MEDIUM","cwe":"CWE-862"},{"id":"CVE-2026-110070","p":1792307812610,"x":"The Modern Events Calendar Lite WordPress plugin before 7.36.4 does not verify that a user is authorized to edit the target post before updating it, allowing authenticated users with the Subscriber role to modify the title, content, and excerpt of arbitrary posts, pages, and custom post types created by other users.","s":6.5,"v":"MEDIUM","cwe":"CWE-639"},{"id":"CVE-2026-110069","p":1792307812500,"x":"The Modern Events Calendar Lite WordPress plugin before 7.37.0 does not perform capability, nonce, or ownership checks before returning event booking and attendee data, allowing any authenticated user, including Subscribers, to disclose the names, email addresses, transaction IDs and payment amounts of every booking…","s":4.3,"v":"MEDIUM","cwe":"CWE-200"},{"id":"CVE-2026-110035","p":1792307812397,"x":"The Salon Booking System  WordPress plugin before 10.31.11 does not restrict one of its REST API endpoints to salon staff, allowing any authenticated user, such as a subscriber, to retrieve every discount coupon configured on the site, including coupons the administrator has chosen to hide from customers, together…","s":4.3,"v":"MEDIUM","cwe":"CWE-284"},{"id":"CVE-2026-110033","p":1792307812287,"x":"The Salon Booking System  WordPress plugin before 10.31.11 does not validate a user-supplied image URL before fetching it server-side and writing the response to a publicly accessible location under an attacker-chosen filename, allowing users with the Salon Staff role or higher to force the server to read…","s":6.8,"v":"MEDIUM","cwe":"CWE-79"},{"id":"CVE-2026-110032","p":1792307812183,"x":"The Salon Booking System  WordPress plugin before 10.31.11 does not restrict which user account its salon staff roles may edit through the customers management screen, allowing users with the Salon Staff or Salon Worker role to reset any other user's role, including administrators, to a customer and to overwrite…","s":5.5,"v":"MEDIUM","cwe":"CWE-863"},{"id":"CVE-2026-110031","p":1792307812077,"x":"The Salon Booking System  WordPress plugin before 10.31.11 does not prevent users holding its custom salon staff role from assigning arbitrary capabilities to other accounts when editing a customer, allowing them to escalate any account to administrator and take over the site.","s":7.2,"v":"HIGH","cwe":"CWE-269"},{"id":"CVE-2026-110026","p":1792307811967,"x":"The Tasty Recipes Lite  WordPress plugin before 1.2.11 does not correctly check user capabilities when creating, renaming and deleting taxonomy terms, allowing users with a role as low as Contributor to add, rename and permanently delete terms in any taxonomy on the site, including categories, tags and navigation…","s":4.9,"v":"MEDIUM","cwe":"CWE-862"},{"id":"CVE-2026-109937","p":1792307810927,"x":"The Otter Blocks  WordPress plugin before 3.2.3 does not validate that a user-supplied return URL belongs to the site before using it to build the return destination of a Stripe Checkout session, allowing unauthenticated attackers to redirect victims who complete or cancel checkout to an arbitrary external URL.","s":5.4,"v":"MEDIUM","cwe":"CWE-601"},{"id":"CVE-2026-111876","p":1792304217047,"x":"A vulnerability was found in alexpasmantier television up to 0.15.9. Affected by this issue is the function Entry::output of the file television/channels/entry.rs. Performing a manipulation of the argument raw results in command injection. The attack requires a local approach. The reported GitHub issue was closed with…","s":5.3,"v":"MEDIUM","cwe":"CWE-74"},{"id":"CVE-2026-111875","p":1792304216840,"x":"A vulnerability has been found in David-Crty Databasement up to 1.8.1. Affected by this vulnerability is an unknown functionality of the file app/Http/Requests/Api/V1/SaveScheduledRestoreRequest.php of the component Scheduled Restore. Such manipulation of the argument schema_name leads to missing authorization. The…","s":4.7,"v":"MEDIUM","cwe":"CWE-862"},{"id":"CVE-2026-111874","p":1792304216380,"x":"A flaw has been found in OpenCATS 0.10.0. Affected is the function processLogin of the file modules/careers/CareersUI.php of the component Career Portal. This manipulation of the argument applyToJobSubAction causes improper restriction of excessive authentication attempts. Remote exploitation of the attack is…","s":3.7,"v":"LOW","cwe":"CWE-307"},{"id":"CVE-2026-111873","p":1792300587920,"x":"A vulnerability was detected in itsmeravitejak Online-Examination-System up to e6208e630b14657999bbfe4c9912302d2a1e2449. This impacts the function MySQLDB::topicslist of the file exammanger.php of the component AJAX Endpoint. The manipulation of the argument subject results in sql injection. The attack may be launched…","s":7.3,"v":"HIGH","cwe":"CWE-74"},{"id":"CVE-2026-111872","p":1792296995433,"x":"A security vulnerability has been detected in itsmeravitejak Online-Examination-System up to e6208e630b14657999bbfe4c9912302d2a1e2449. This affects the function MySQLDB::valid/MySQLDB::getresults/MySQLDB::noresults/MySQLDB::getExams/MySQLDB::latestExamID/MySQLDB::getreport of the file results.php/include/database.php.…","s":7.3,"v":"HIGH","cwe":"CWE-74"},{"id":"CVE-2026-111871","p":1792296995227,"x":"A weakness has been identified in itsmeravitejak Online-Examination-System up to e6208e630b14657999bbfe4c9912302d2a1e2449. The impacted element is an unknown function of the file qsdb/usersdb/brandb/topicsdb/subjectsdb.php. Executing a manipulation of the argument query/qtype/sortname/sortorder can lead to sql…","s":7.3,"v":"HIGH","cwe":"CWE-74"},{"id":"CVE-2026-111870","p":1792296991750,"x":"A security flaw has been discovered in itsmeravitejak Online-Examination-System up to e6208e630b14657999bbfe4c9912302d2a1e2449. The affected element is the function isAdmin of the file admin/admin.php. Performing a manipulation results in missing authentication. The attack can be initiated remotely. The exploit has…","s":5.3,"v":"MEDIUM","cwe":"CWE-287"},{"id":"CVE-2026-111869","p":1792293388970,"x":"A vulnerability was identified in makeplane plane up to 1.4.2. Impacted is an unknown function of the component API Endpoint. Such manipulation of the argument X-Forwarded-For leads to reliance on untrusted inputs in a security decision. It is possible to launch the attack remotely. The exploit is publicly available…","s":5.3,"v":"MEDIUM","cwe":"CWE-20"},{"id":"CVE-2026-111997","p":1792286195463,"x":"ip-address before 10.7.4 allows a denial of service (CPU consumption from quadratic complexity, and application stall) via many % characters in input reaching a function call that uses the Address6 constructor.","s":6.3,"v":"MEDIUM","cwe":"CWE-1333"},{"id":"CVE-2026-111868","p":1792286194483,"x":"A vulnerability was determined in datastax pulsar-jms up to 9.0.3. This issue affects the function decode of the file pulsar-jms/src/main/java/com/datastax/oss/pulsar/jms/messages/PulsarObjectMessage.java. This manipulation causes deserialization. It is possible to initiate the attack remotely. The exploit has been…","s":6.3,"v":"MEDIUM","cwe":"CWE-20"},{"id":"CVE-2026-111866","p":1792282597960,"x":"A weakness has been identified in nemoTyrant manong up to 7c9e5228e133b9267ad3a415833bc9bb53193bb4. This impacts the function cache/del_cache/arr2sql of the file func.php. This manipulation causes sql injection. The attack may be initiated remotely. This product uses a rolling release model to deliver continuous…","s":7.3,"v":"HIGH","cwe":"CWE-74"},{"id":"CVE-2026-111865","p":1792271785793,"x":"A security flaw has been discovered in THU-MIG yoloe up to 40cd606cabdbe2b566d6f14a6b162c89206e9a1b. This affects the function eval of the file ultralytics/nn/autobackend.py of the component AutoBackend Model Loading. The manipulation of the argument imgsz/names/kpt_shape results in improper neutralization of…","s":5.3,"v":"MEDIUM","cwe":"CWE-94"},{"id":"CVE-2026-111934","p":1792264596497,"x":"Coder before 2.34.7 contains an IP spoofing vulnerability in the ExtractRealIPAddress middleware that trusts the leftmost, client-supplied X-Forwarded-For value instead of the client IP appended by a reverse proxy. Attackers can send forged X-Forwarded-For values through appending proxies to bypass per-IP rate limits…","s":3.7,"v":"LOW","cwe":"CWE-348"},{"id":"CVE-2026-111933","p":1792264596360,"x":"Coder before 2.29.17, 2.30.0 before 2.32.7, 2.33.0 before 2.33.8, and 2.34.0 before 2.34.2 contains a user enumeration vulnerability because userpassword.Compare() substitutes a placeholder hash derived from the string \"hunter2\" when a stored password hash is empty. Unauthenticated attackers can submit logins with the…","s":3.7,"v":"LOW","cwe":"CWE-203"},{"id":"CVE-2026-111932","p":1792264596217,"x":"Coder before 2.29.17, 2.30.0 before 2.32.7, 2.33.0 before 2.33.8, and 2.34.0 before 2.34.2 contains a stored HTML injection vulnerability because the ApplicationName and LogoURL appearance settings are rendered into HTML output without sufficient escaping. Attackers with the Owner role can store HTML markup in these…","s":3.4,"v":"LOW","cwe":"CWE-79"},{"id":"CVE-2026-111931","p":1792264596080,"x":"Coder from 2.0.0 before 2.34.8 contains an open redirect vulnerability in handleAPIKeySmuggling that allows attackers to redirect users externally via unsanitized r.URL.Path values. Attackers can craft links on trusted workspace app subdomains with paths beginning with double slashes, which become scheme-relative…","s":4.3,"v":"MEDIUM","cwe":"CWE-601"},{"id":"CVE-2026-111930","p":1792264595940,"x":"Coder from 2.26.0 before 2.34.8 contains an incorrect authorization flaw in the GET /api/v2/workspaces/{id}/acl endpoint, which checks only workspace read access and then fetches group members using an elevated system context. Authenticated users granted workspace use access can query the endpoint to harvest group…","s":4.3,"v":"MEDIUM","cwe":"CWE-200"},{"id":"CVE-2026-111929","p":1792264595807,"x":"Coder from 2.30.0 before 2.34.8 contains an authorization bypass vulnerability in the provisioner daemon DownloadFile gRPC handler that allows authenticated provisioner daemons to download other organizations' cached Terraform module archives. Attackers with an org-scoped provisioner key and a known file UUID can…","s":5.3,"v":"MEDIUM","cwe":"CWE-863"},{"id":"CVE-2026-111928","p":1792264595673,"x":"Coder from 2.0.0 before 2.34.8 contains an incorrect authorization vulnerability in the acl_allow rule of coderd/rbac/policy.rego, which does not verify organization membership for per-user ACL entries, and organization member removal does not scrub those entries. Authenticated users removed from an organization can…","s":5.4,"v":"MEDIUM","cwe":"CWE-863"},{"id":"CVE-2026-111927","p":1792264595527,"x":"Coder before 2.29.20, 2.33.0 before 2.33.12, 2.34.0 before 2.34.8, and 2.35.0 before 2.35.4 contains an improper hostname validation flaw in GetWorkspaceProxyByHostname whose SIMILAR TO pattern performs a prefix match, so any domain that is a string prefix of a workspace-proxy access URL is trusted as a proxy.…","s":7.7,"v":"HIGH","cwe":"CWE-522"},{"id":"CVE-2026-111926","p":1792264595390,"x":"Coder from 2.10.0 before 2.34.8 has an unauthenticated agent debug HTTP server on 127.0.0.1:2113 whose /debug/manifest handler returns the full agent manifest, including template-provided environment variable values. A lower-privileged Unix user or process in the same workspace can query this endpoint to read…","s":3.3,"v":"LOW","cwe":"CWE-200"},{"id":"CVE-2026-111924","p":1792264595257,"x":"Fleet before 4.83.0 contains a denial of service vulnerability that allows unauthenticated attackers to exhaust server memory by sending gzip-compressed request bodies. Attackers can send small, highly compressed requests with Content-Encoding: gzip to unauthenticated endpoints that expand during decoding, crashing…","s":7.5,"v":"HIGH","cwe":"CWE-409"},{"id":"CVE-2026-111923","p":1792264595117,"x":"Fleet before 4.89.0 contains an unbounded recursion vulnerability in Apple MDM enrollment property list parsing that allows unauthenticated attackers to crash the server. Attackers can send a crafted binary plist payload of about 150 bytes to the enrollment endpoints, triggering exponential allocation or infinite…","s":7.5,"v":"HIGH","cwe":"CWE-674"},{"id":"CVE-2026-111922","p":1792264594957,"x":"Vikunja from 2.2.0 before 2.7.0 contains a permissive CORS configuration that trusts every localhost and 127.0.0.1 port with credentials, even when service.publicurl is set. Attackers controlling a page on any localhost port can send a credentialed request to the token refresh endpoint and read the returned bearer JWT…","s":6.3,"v":"MEDIUM","cwe":"CWE-942"},{"id":"CVE-2026-111921","p":1792264594820,"x":"Vikunja 0.13.0 before 2.7.0 contains an incorrect authorization vulnerability that allows project members with Write permission to delete admin-tier link shares because the delete permission check reads an unloaded share object. Attackers can send DELETE requests to the v1 or v2 projects shares endpoints with…","s":5.4,"v":"MEDIUM","cwe":"CWE-863"},{"id":"CVE-2026-111920","p":1792264594680,"x":"Vikunja 2.6.0 contains a broken access control flaw in getProjectAccessForUser (pkg/models/project_access.go), which resolves a user's effective project permission as the maximum over the project tree, silently overriding explicit lower-permission shares on sub-projects. A collaborator with write access on a parent…","s":4.3,"v":"MEDIUM","cwe":"CWE-269"},{"id":"CVE-2026-111919","p":1792264594543,"x":"Vikunja 0.22.0 before 2.7.0 contains an improper access revocation vulnerability that allows removed collaborators to keep receiving project data through webhooks they created. Former collaborators keep receiving task titles and descriptions through their webhook, including content created after their access was…","s":6.5,"v":"MEDIUM","cwe":"CWE-613"},{"id":"CVE-2026-111918","p":1792264594403,"x":"Vikunja from 1.0.0-rc0 before 2.7.0 contains an improper authorization vulnerability in RecalculateTaskPositions that allows authenticated users with zero accessible projects to write task_positions rows for all tasks instance-wide. Attackers can delete their Inbox after repointing default_project_id, then create…","s":5.4,"v":"MEDIUM","cwe":"CWE-863"},{"id":"CVE-2026-111917","p":1792264594263,"x":"Vikunja 2.3.0 before 2.7.0 contains an improper session validation vulnerability that allows attackers to keep WebSocket access after revocation because handleAuth never checks the JWT sid claim against the sessions table. Attackers holding a stolen access token can open or maintain connections to /api/v2/ws after…","s":6.5,"v":"MEDIUM","cwe":"CWE-613"},{"id":"CVE-2026-111916","p":1792264594127,"x":"Admidio before 5.0.16 contains an information disclosure vulnerability that allows unauthenticated attackers to view role-restricted weblinks because rss/links.php omits the category_view role-visibility filter. Attackers can request the weblinks RSS feed for an organization to retrieve link names, URLs, descriptions,…","s":5.3,"v":"MEDIUM","cwe":"CWE-862"},{"id":"CVE-2026-111914","p":1792264593963,"x":"Admidio from 5.0.11 before 5.0.16 contains a broken access control vulnerability in modules/inventory/inventory_data.php that allows authenticated users to bypass the inventory_module_enabled restriction. Attackers with any valid login can request the DataTables JSON feed to read every inventory item and keeper names,…","s":6.5,"v":"MEDIUM","cwe":"CWE-862"},{"id":"CVE-2026-111913","p":1792264593823,"x":"Admidio from 5.0.0 before 5.0.16 contains an authorization bypass vulnerability that allows authenticated users to export lists despite export restrictions by requesting mode=pdfl. The groups_roles_export check in modules/groups-roles/lists_show.php omits pdfl, which later runs the pdf export, letting users with list…","s":4.3,"v":"MEDIUM","cwe":"CWE-285"},{"id":"CVE-2026-111912","p":1792264593687,"x":"Admidio from 5.0.0 before 5.0.16 contains an insecure direct object reference vulnerability in ForumService::saveTopic() that allows authenticated members to modify other users' forum topics. Attackers can replace the topic_uuid parameter in their own topic_save request, reusing their CSRF token, to overwrite the…","s":6.5,"v":"MEDIUM","cwe":"CWE-639"},{"id":"CVE-2026-111911","p":1792264593500,"x":"phpMyFAQ 4.0.0 before 4.1.9 contains an authentication bypass vulnerability where WebAuthn registration endpoints attach credentials to any account without authentication or challenge validation. Attackers can stage a victim username, submit a forged fmt=none attestation to register a passkey, then log in bypassing…","s":9.8,"v":"CRITICAL","cwe":"CWE-287"},{"id":"CVE-2026-111910","p":1792264593343,"x":"phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains an authorization bypass vulnerability in attachment.php that allows attackers to download attachments of restricted FAQs by bypassing per-record permission checks. Low-privileged users with the dlattachment right, or anonymous users when…","s":6.5,"v":"MEDIUM","cwe":"CWE-862"},{"id":"CVE-2026-111909","p":1792264593190,"x":"phpMyFAQ before 4.1.9 contains a missing authorization vulnerability in the deleteUser() API that allows authenticated non-superadmin users with delete_user permission to delete superadmin accounts. Attackers can send a DELETE request to /admin/api/user/delete with a superadmin's userId other than 1, removing…","s":8.1,"v":"HIGH","cwe":"CWE-269"},{"id":"CVE-2026-111908","p":1792264593043,"x":"phpMyFAQ 4.0.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains a broken object-level authorization vulnerability in the PUT /api/v3.1/faq/update endpoint, which checks only the global edit_faq permission and does not verify access to the target FAQ. Authenticated users with edit_faq permission can supply the…","s":8.3,"v":"HIGH","cwe":"CWE-639"},{"id":"CVE-2026-111907","p":1792264592883,"x":"phpMyFAQ 4.0.0 before 4.1.9 contains a cross-site request forgery vulnerability in the POST /admin/api/update-database endpoint, which executes database migrations without validating a CSRF token. Attackers can lure a logged-in user with the CONFIGURATION_EDIT permission into submitting a crafted cross-site request,…","s":7.1,"v":"HIGH","cwe":"CWE-352"},{"id":"CVE-2026-111906","p":1792264592723,"x":"phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains a cross-site request forgery vulnerability in the Elasticsearch and OpenSearch administration API endpoints, which do not validate a CSRF token for the create, drop, and import actions. Attackers can lure a user with CONFIGURATION_EDIT permission to a…","s":6.5,"v":"MEDIUM","cwe":"CWE-352"},{"id":"CVE-2026-111905","p":1792264592563,"x":"phpMyFAQ 3.2.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains an insecure direct object reference vulnerability in GET /admin/api/user/data/{userId}, which returns any user's full faquserdata row, including the live TOTP secret, without a SuperAdmin or protected-target check. Delegated administrators with…","s":6,"v":"MEDIUM","cwe":"CWE-639"},{"id":"CVE-2026-111904","p":1792264592407,"x":"phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains an information disclosure vulnerability that allows unauthenticated attackers to read hidden open questions due to an inverted api.onlyPublicQuestions check in OpenQuestionController. Attackers can send GET requests to the /api/v4.0/open-questions endpoint to retrieve…","s":5.3,"v":"MEDIUM","cwe":"CWE-200"},{"id":"CVE-2026-111903","p":1792264592253,"x":"phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains a stored cross-site scripting vulnerability in SvgSanitizer that allows users with FAQ_EDIT permission to bypass sanitization using XML DTD custom entities. Attackers can upload an SVG defining an entity that expands to javascript in an anchor href, executing script when…","s":5.4,"v":"MEDIUM","cwe":"CWE-79"},{"id":"CVE-2026-111902","p":1792264592103,"x":"phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains an authorization bypass vulnerability in isFaqAccessibleForUser() that treats a missing FAQ translation as visible to unauthenticated users. Attackers can send a mismatched Accept-Language header to the comments and attachments API endpoints to read comments and…","s":5.3,"v":"MEDIUM","cwe":"CWE-639"},{"id":"CVE-2026-111901","p":1792264591953,"x":"phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains an uncontrolled resource consumption vulnerability in the unauthenticated faqs and search API endpoints. Attackers can send concurrent GET requests that load and process all database records into PHP memory, exhausting CPU and memory to crash the server.","s":7.5,"v":"HIGH","cwe":"CWE-400"},{"id":"CVE-2026-111900","p":1792264591800,"x":"phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains an improper authorization vulnerability in attachment.php that fails to verify whether an attachment's parent FAQ is published or visible to the requester. Authenticated users with the dlattachment permission can request…","s":4.3,"v":"MEDIUM","cwe":"CWE-863"},{"id":"CVE-2026-111898","p":1792264591647,"x":"phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains an authentication bypass vulnerability that allows Keycloak users to take over local accounts by matching preferred_username or email. Attackers controlling a Keycloak identity with a colliding username or unverified email can log in through /auth/keycloak/authorize to…","s":7.5,"v":"HIGH","cwe":"CWE-287"},{"id":"CVE-2026-111897","p":1792264591487,"x":"phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains an authorization bypass vulnerability that allows category-restricted editors to manage attachments of FAQs outside their categories by supplying arbitrary record IDs. Attackers in medium permission mode can send upload or delete requests with a target record_id or…","s":7.1,"v":"HIGH","cwe":"CWE-862"},{"id":"CVE-2026-111896","p":1792264591337,"x":"phpMyFAQ from 4.2.0-alpha before 4.2.0-beta contains a stored cross-site scripting vulnerability in SvgSanitizer that allows FAQ editors to store executable SVG files. Attackers can split script tags around removed tokens like processing instructions so single-pass removal reassembles them, executing script in the…","s":5.4,"v":"MEDIUM","cwe":"CWE-182"},{"id":"CVE-2026-111895","p":1792264591177,"x":"phpMyFAQ 3.2.0 before 4.0.0 and 4.0.2 before 4.2.0-beta contains an authentication bypass in its Microsoft Entra ID login flow, which links users by the mutable preferred_username claim and whose AuthEntraId::create() ignores the duplicate-login exception while continuing with the existing local account. Attackers…","s":6.8,"v":"MEDIUM","cwe":"CWE-287"},{"id":"CVE-2026-111894","p":1792264591017,"x":"phpMyFAQ 3.2.1 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains a stored cross-site scripting vulnerability that allows authenticated content authors to inject JavaScript by embedding iframes with data:text/html sources in FAQ or News content. Attackers can bypass the hostless media-host allowlist in…","s":5.4,"v":"MEDIUM","cwe":"CWE-79"},{"id":"CVE-2026-111893","p":1792264590860,"x":"phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains a privilege escalation vulnerability in GroupController::saveCategoryRestrictions() that lets delegated administrators assign categories outside their own scope. Category-restricted administrators can POST to /admin/api/group/category-restrictions with out-of-scope or…","s":6.5,"v":"MEDIUM","cwe":"CWE-269"},{"id":"CVE-2026-111892","p":1792264590703,"x":"phpMyFAQ 4.2.0-alpha before 4.2.0-beta lacks effective rate limiting on the unauthenticated user/password/update and user/password/reset endpoints. Unauthenticated attackers can send unlimited reset requests to flood a registered user's inbox with reset emails, exhausting mailer and server resources.","s":6.5,"v":"MEDIUM","cwe":"CWE-307"},{"id":"CVE-2026-111891","p":1792264590550,"x":"phpMyFAQ from 4.2.0-alpha.2 before 4.2.0-beta contains a privilege escalation vulnerability in the group permission API, whose updatePermissions and updateMembers endpoints check held rights without regard to language or category scope and write unrestricted group grants. Non-superadmin administrators holding…","s":5.5,"v":"MEDIUM","cwe":"CWE-269"},{"id":"CVE-2026-111890","p":1792264590393,"x":"phpMyFAQ from 4.2.0-alpha.2 before 4.2.0-beta contains a privilege escalation vulnerability in UserController::updateUserRights that drops per-right language restrictions when rights are re-granted. Administrators holding USER_EDIT can submit language-scoped rights to the update-rights API, including for themselves,…","s":5.5,"v":"MEDIUM","cwe":"CWE-269"},{"id":"CVE-2026-111889","p":1792264590237,"x":"phpMyFAQ from 4.1.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains a missing authorization vulnerability in the admin dashboard that allows authenticated users without admin rights to view restricted data. Attackers with any activated account can request /admin/index.php/ to read unpublished FAQ questions,…","s":4.3,"v":"MEDIUM","cwe":"CWE-862"},{"id":"CVE-2026-111888","p":1792264590080,"x":"phpMyFAQ from 4.0.0 before 4.1.9 contains an incorrect authorization vulnerability that allows delegated admins lacking the editnews right to modify news by calling PUT /admin/api/news/update, which checks NEWS_DELETE instead of NEWS_EDIT. Attackers holding addnews and delnews can read the update-news CSRF token from…","s":2.7,"v":"LOW","cwe":"CWE-863"},{"id":"CVE-2026-111887","p":1792264589930,"x":"phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains an account enumeration vulnerability that allows unauthenticated attackers to confirm registered display names and emails via a distinct HTTP 409 response. Attackers can submit guest comments to the comment create endpoint with candidate user and mail…","s":5.3,"v":"MEDIUM","cwe":"CWE-204"},{"id":"CVE-2026-111886","p":1792264589770,"x":"phpMyFAQ from 4.2.0-alpha.2 before 4.2.0-beta lacks brute-force lockout in the removeTwofactorConfig() 2FA removal endpoint, allowing authenticated attackers to guess TOTP codes without limit. Attackers holding a hijacked session and CSRF token can repeatedly POST guesses to /api/user/remove-twofactor to permanently…","s":6.5,"v":"MEDIUM","cwe":"CWE-307"},{"id":"CVE-2026-111885","p":1792264589610,"x":"phpMyFAQ from 4.2.0-alpha before 4.2.0-beta contains a missing authorization vulnerability in GroupController::deleteGroup() that omits privilege-level checks on target groups. Authenticated non-SuperAdmin administrators holding GROUP_DELETE can send a crafted groupId to /admin/api/group/delete to permanently destroy…","s":5.5,"v":"MEDIUM","cwe":"CWE-1220"},{"id":"CVE-2026-111884","p":1792264589450,"x":"phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta does not require the current password when changing an account e-mail in the user control panel (UserController::updateData, api/user/data/update), checking only the session and CSRF token. An attacker with a hijacked session can set the e-mail to their own…","s":8.3,"v":"HIGH","cwe":"CWE-308"},{"id":"CVE-2026-111882","p":1792264589240,"x":"phpMyFAQ 3.2.0-alpha before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains an authentication bypass vulnerability that allows IdP-authenticated users to skip TOTP two-factor authentication through the Keycloak and Entra ID SSO callbacks. Attackers holding a valid or phished IdP identity linked to a 2FA-enabled…","s":8.1,"v":"HIGH","cwe":"CWE-287"},{"id":"CVE-2026-111881","p":1792264589103,"x":"FreeRDP from 3.14.1 before 3.32.0 contains an integer underflow in the WinPR BMP writer, where a mismatched stride calculation passes SIZE_MAX - 3 to Stream_Zero for sub-byte images. A malicious RDP clipboard peer can return a crafted 1-bpp BMP processed by clipboard_synthesize_image_format_to_bmp for CF_DIB/CF_DIBV5,…","s":7.6,"v":"HIGH","cwe":"CWE-191"},{"id":"CVE-2026-111880","p":1792264588960,"x":"FreeRDP versions from 2.0.0 before 3.32.0 contain a heap out-of-bounds write in the server hash-callback NTLM path that fails to validate the MIC offset. Unauthenticated attackers can send a crafted AUTHENTICATE_MESSAGE with a backward session-key offset and MIC offset to write 16 zero bytes beyond the allocation.","s":7.4,"v":"HIGH","cwe":"CWE-787"},{"id":"CVE-2026-110882","p":1792264588830,"x":"Missing Authorization vulnerability in Cozy Vision Technologies Pvt. Ltd. SMS Alert Order Notifications sms-alert allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SMS Alert Order Notifications: from n/a through 4.0.1.","s":4.3,"v":"MEDIUM","cwe":"CWE-862"},{"id":"CVE-2025-71435","p":1792264588683,"x":"Coder before 2.23.0 contains a session expiration bypass vulnerability that allows authenticated users to retain access after OIDC token expiry when no refresh token is issued. Users can keep their APIKey cookie active through regular use, extending it every 24 hours to access Coder indefinitely after losing OIDC…","s":4.2,"v":"MEDIUM","cwe":"CWE-613"},{"id":"CVE-2024-58398","p":1792264587860,"x":"Coder 2.3.1 before 2.14.4, 2.15.x before 2.15.3, and 2.16.0 before 2.16.1 contains an open redirect vulnerability in the login page because the redirect query parameter is improperly sanitized. Attackers can craft a Coder login URL that, when clicked by a logged-in user, redirects the victim to an attacker-controlled…","s":4.3,"v":"MEDIUM","cwe":"CWE-601"},{"id":"CVE-2026-109701","p":1792257388973,"x":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PAYCOMET PAYCOMET for WooCommerce paytpv-for-woocommerce allows Reflected XSS.This issue affects PAYCOMET for WooCommerce: from n/a through 5.45.","s":7.1,"v":"HIGH","cwe":"CWE-79"},{"id":"CVE-2026-110889","p":1792235792017,"x":"Generation of Error Message Containing Sensitive Information vulnerability in Gantry Gantry 5 Framework gantry5 allows Retrieve Embedded Sensitive Data.This issue affects Gantry 5 Framework: from n/a through 5.6.4.","s":7.5,"v":"HIGH","cwe":"CWE-209"},{"id":"CVE-2026-111110","p":1792224988310,"x":"The Payment forms, Buy now buttons, and Invoicing System | GetPaid plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'mmdwqzpoxadd' parameter in all versions up to, and including, 2.8.61 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated…","s":7.2,"v":"HIGH","cwe":"CWE-79"},{"id":"CVE-2026-110253","p":1792224988167,"x":"The weForms – Easy Drag & Drop Contact Form Builder For WordPress plugin for WordPress is vulnerable to limited media file deletion due to insufficient file path validation in the weforms_delete_entry_attachments function in all versions up to, and including, 1.6.28 This makes it possible for unauthenticated attackers…","s":5.4,"v":"MEDIUM","cwe":"CWE-22"},{"id":"CVE-2026-109983","p":1792224988020,"x":"The YMC Filter plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'post_title' parameter in all versions up to, and including, 3.12.19 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level access and above, to…","s":6.4,"v":"MEDIUM","cwe":"CWE-79"},{"id":"CVE-2026-100316","p":1792224986950,"x":"The European VAT Compliance Assistant for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via CF-IPCountry Header in all versions up to, and including, 1.36.10 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject…","s":7.2,"v":"HIGH","cwe":"CWE-79"},{"id":"CVE-2026-110384","p":1792221410350,"x":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Heateor Support Fancy Comments WordPress fancy-facebook-comments allows Reflected XSS.This issue affects Fancy Comments WordPress: from n/a through 1.2.21.","s":7.1,"v":"HIGH","cwe":"CWE-79"},{"id":"CVE-2026-97314","p":1792217794553,"x":"The ThirstyAffiliates  WordPress plugin before 3.12.1 does not check the status or type of the object requested by its link redirect tracking handler, allowing unauthenticated attackers to disclose the destination URLs of unpublished affiliate links and to record fabricated click statistics.","s":6.5,"v":"MEDIUM","cwe":"CWE-200"},{"id":"CVE-2026-92433","p":1792217794457,"x":"The Patreon WordPress plugin before 1.10.0 does not verify a nonce when connecting the site to a Patreon account, allowing attackers to make a logged-in administrator re-link the integration to an attacker-controlled account via a crafted request (CSRF), taking over the site's Patreon integration.","s":6.5,"v":"MEDIUM","cwe":"CWE-352"},{"id":"CVE-2026-92432","p":1792217794357,"x":"The Patreon WordPress plugin before 1.10.0 does not validate a user-supplied redirect destination before redirecting, allowing unauthenticated attackers to redirect visitors to an arbitrary external URL through a crafted link, which is useful for phishing.","s":4.3,"v":"MEDIUM","cwe":"CWE-601"},{"id":"CVE-2026-92431","p":1792217794257,"x":"The Patreon WordPress plugin before 1.10.0 does not perform an authorization check on some of its functionality, allowing unauthenticated users to enumerate the names of terms in any taxonomy, including non-public taxonomies that WordPress does not expose on the front end.","s":3.7,"v":"LOW","cwe":"CWE-862"},{"id":"CVE-2026-91074","p":1792217793933,"x":"The BSK PDF Manager WordPress plugin through 3.8.1 does not properly sanitise and escape a parameter before using it in a SQL statement, which could allow authenticated users with contributor-level access and above to perform SQL injection attacks and read sensitive data such as administrator password hashes from the…","s":6.8,"v":"MEDIUM","cwe":"CWE-89"},{"id":"CVE-2026-81344","p":1792217793830,"x":"The ACF Frontend Admin by DynamiApps WordPress plugin through 3.29.13 does not restrict which PHP classes may be instantiated when it deserialises stored post content that is rendered on public-facing pages, allowing high-privilege users such as administrators to inject a PHP object which, given a suitable POP chain…","s":6.6,"v":"MEDIUM","cwe":"CWE-502"},{"id":"CVE-2026-81343","p":1792217793710,"x":"The ACF Frontend Admin by DynamiApps WordPress plugin through 3.29.13 does not perform a capability check on one of its form-submission actions before writing submitted values into the site's global ACF options store, allowing unauthenticated visitors to overwrite site-wide option values via a public form.","s":5.3,"v":"MEDIUM","cwe":"CWE-862"},{"id":"CVE-2026-110527","p":1792217793580,"x":"The WP User Manager  WordPress plugin before 2.9.20 does not roll back the WordPress account it creates during payment-gated registration when the subsequent payment step fails, allowing unauthenticated users to create functional accounts without completing payment.","s":5.3,"v":"MEDIUM","cwe":"CWE-284"},{"id":"CVE-2026-106470","p":1792217793450,"x":"The WP Data Access  WordPress plugin before 5.5.88 does not have authorisation and CSRF checks in one of its actions, allowing any authenticated user, such as a subscriber, to make the server open connections to arbitrary hosts and ports, including internal ones, and read back the outcome.","s":5,"v":"MEDIUM","cwe":"CWE-918"},{"id":"CVE-2026-104246","p":1792217793347,"x":"The Contact Form 7 Signature Addon WordPress plugin through 4.2.2 does not sanitize a signature field value before building an email attachment path from it, allowing unauthenticated users to attach arbitrary files (bounded to wp-content on current Contact Form 7) to a form's outgoing email via path traversal; when a…","s":5.9,"v":"MEDIUM","cwe":"CWE-22"},{"id":"CVE-2026-104122","p":1792217793237,"x":"The Ukr-To-Lat WordPress plugin through 1.3.5 does not sanitize and escape a term name before using it in a SQL query, allowing users with Contributor-level access and above to perform SQL injection attacks.","s":6.8,"v":"MEDIUM","cwe":"CWE-89"},{"id":"CVE-2026-103376","p":1792217790930,"x":"The PeachPay — Payments & Express Checkout for WooCommerce (supports Stripe, PayPal, Square, Authorize.net, NMI) WordPress plugin before 1.120.70 does not perform any capability or ownership check before returning an order's secret key in response to an unauthenticated request, allowing anyone to retrieve the key for…","s":5.3,"v":"MEDIUM","cwe":"CWE-200"},{"id":"CVE-2026-96660","p":1792210630537,"x":"The User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Checkbox Field Value in all versions up to, and including, 5.2.8 due to insufficient input…","s":7.2,"v":"HIGH","cwe":"CWE-79"},{"id":"CVE-2026-92978","p":1792210630410,"x":"The User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 5.2.8 This is due to missing or incorrect nonce validation on…","s":4.3,"v":"MEDIUM","cwe":"CWE-352"},{"id":"CVE-2026-92798","p":1792210630257,"x":"The User Registration & Membership plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in versions up to, and including, 5.2.8 This is due to insufficient input sanitization in the 'referrer_url' branch of UR_Smart_Tags::process(), where the attacker-controlled HTTP_REFERER header is only passed…","s":8.1,"v":"HIGH","cwe":"CWE-94"},{"id":"CVE-2026-92715","p":1792210630073,"x":"The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.1.0 via the 'ID' parameter due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with author-level access…","s":4.3,"v":"MEDIUM","cwe":"CWE-639"},{"id":"CVE-2026-111726","p":1792210612233,"x":"The Themify Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'visible' Shortcode Attribute in all versions up to, and including, 7.8.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to…","s":6.4,"v":"MEDIUM","cwe":"CWE-79"},{"id":"CVE-2026-110268","p":1792210612057,"x":"The Post Export Import with Media plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.17.2 via the 'theme_slug' parameter. This makes it possible for authenticated attackers, with administrator-level access and above, to perform actions on files outside of the originally…","s":4.9,"v":"MEDIUM","cwe":"CWE-22"},{"id":"CVE-2026-109989","p":1792210611907,"x":"The Themify Popup plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'popup_width_unit' parameter in all versions up to, and including, 1.4.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level access and above, to…","s":6.4,"v":"MEDIUM","cwe":"CWE-79"},{"id":"CVE-2026-109985","p":1792210611760,"x":"The xSpeed Cache: AI-Powered Performance Hub with MCP, Caching & CDN plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'content' parameter in all versions up to, and including, 1.4.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers,…","s":6.4,"v":"MEDIUM","cwe":"CWE-79"},{"id":"CVE-2026-109369","p":1792210611620,"x":"The WP Booking System – Booking Calendar plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.1.0.3 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level…","s":6.8,"v":"MEDIUM","cwe":"CWE-862"},{"id":"CVE-2026-109368","p":1792210611480,"x":"The WP Booking System – Booking Calendar plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.1.0.3 via the 'id' parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to extract private per-event booking…","s":6.5,"v":"MEDIUM","cwe":"CWE-862"},{"id":"CVE-2026-108123","p":1792210608427,"x":"The WP Booking System – Booking Calendar plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.1.0.3 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to read the stored…","s":7.5,"v":"HIGH","cwe":"CWE-862"},{"id":"CVE-2026-107752","p":1792210608260,"x":"The Welcart e-Commerce plugin for WordPress is vulnerable to generic SQL Injection via the 'wp_usces_order_old (JSON fields searchSql / searchSkuSql)' parameter in all versions up to, and including, 2.12.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing…","s":4.9,"v":"MEDIUM","cwe":"CWE-89"},{"id":"CVE-2026-107744","p":1792210608113,"x":"The LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.4.10 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated…","s":6.5,"v":"MEDIUM","cwe":"CWE-862"},{"id":"CVE-2026-104736","p":1792210607780,"x":"The LearnPress plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 4.4.10 via deserialization of untrusted input from the 'checkout-email' request parameter during the checkout AJAX action. The value is passed through sanitize_text_field(), which does not strip serialized…","s":9.8,"v":"CRITICAL","cwe":"CWE-502"},{"id":"CVE-2026-103899","p":1792210607413,"x":"The EU VAT Assistant for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'vat_number' parameter in all versions up to, and including, 2.1.30.260413 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary…","s":7.2,"v":"HIGH","cwe":"CWE-79"},{"id":"CVE-2026-111602","p":1792206988740,"x":"The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.7.4 via the 'params (customer[uuid])' parameter. This makes it possible for unauthenticated attackers to extract the first name,…","s":3.7,"v":"LOW","cwe":"CWE-200"},{"id":"CVE-2026-111601","p":1792206988613,"x":"The Hippoo Mobile App for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'token_id' parameter in all versions up to, and including, 1.12.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web…","s":6.1,"v":"MEDIUM","cwe":"CWE-79"},{"id":"CVE-2026-110653","p":1792206988480,"x":"The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Authentication Bypass via Race Condition in all versions up to, and including, 5.7.4. This is due to a non-atomic read-modify-write on the OTP verification attempts counter in the `verifyOTP`…","s":9.1,"v":"CRITICAL","cwe":"CWE-287"},{"id":"CVE-2026-109208","p":1792206988340,"x":"The LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'quantity (REST) / order_comments (checkout)' parameter in all versions up to, and including, 4.4.10 due to insufficient input sanitization and output escaping. This makes…","s":7.2,"v":"HIGH","cwe":"CWE-79"},{"id":"CVE-2026-107763","p":1792206988213,"x":"The Fastcache by Host.it plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.7.5. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above,…","s":4.3,"v":"MEDIUM","cwe":"CWE-862"},{"id":"CVE-2026-107762","p":1792206988083,"x":"The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 6.3.2 via the 'context' parameter due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to…","s":7.5,"v":"HIGH","cwe":"CWE-639"},{"id":"CVE-2026-104734","p":1792206987927,"x":"The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 6.3.2 via deserialization of untrusted input . This makes it possible for authenticated attackers, with administrator-level access and above, to inject a PHP…","s":7.2,"v":"HIGH","cwe":"CWE-502"},{"id":"CVE-2026-111855","p":1792203438877,"x":"An issue was discovered on Tektronix 3 Series MDO devices before 1.21.1. A path traversal vulnerability exists in the web management interface of the device. Insufficient validation of user-supplied file paths allows remote attackers to read arbitrary files accessible to the application. Depending on configuration,…","s":7.5,"v":"HIGH","cwe":"CWE-22"},{"id":"CVE-2026-111854","p":1792203438750,"x":"An issue was discovered on Tektronix 3 Series MDO devices before 1.21.1. A path traversal vulnerability in the SCPI FILESystem command interface allows remote attackers to read or modify arbitrary files on the device through insufficient validation of file paths supplied to filesystem access commands.","s":8.1,"v":"HIGH","cwe":"CWE-22"},{"id":"CVE-2026-111853","p":1792203438610,"x":"An issue was discovered on Tektronix 3 Series MDO devices before 1.21.1. An OS command injection vulnerability exists in the FILESystem:MOUNT:DRIve SCPI command handler. Insufficient neutralization of user-supplied input allows remote attackers to execute arbitrary operating system commands with elevated privileges.","s":8.8,"v":"HIGH","cwe":"CWE-78"},{"id":"CVE-2026-111823","p":1792203438470,"x":"Mage OSS through 0.9.80 before 76c4f46 can proceed with session creation upon encountering an unknown OAuth provider.","s":9.8,"v":"CRITICAL","cwe":"CWE-390"},{"id":"CVE-2026-89096","p":1792192622810,"x":"A flaw was found in nfs-utils. An unauthenticated remote attacker can trigger a Denial of Service (DoS) by sending repeated state notification requests to an exposed rpc.statd service. The service fails to properly release memory allocated during callback processing, leading to continuous memory growth. Sustained…","s":5.9,"v":"MEDIUM","cwe":"CWE-772"},{"id":"CVE-2026-89088","p":1792192622680,"x":"A flaw was found in parted. A heap-based buffer overflow exists in libparted's file system resizing logic when handling FAT16 volumes. By convincing a user or administrator to resize a specially crafted FAT16 file system image with malformed directory metadata, an attacker can trigger an oversized read into a…","s":5.5,"v":"MEDIUM","cwe":"CWE-787"},{"id":"CVE-2026-89085","p":1792192622553,"x":"A flaw was found in parted. A heap-based buffer overflow can occur when processing a specially crafted FAT32 filesystem due to an integer calculation error during buffer allocation. A local attacker could exploit this by enticing a user or automated service to open a malicious filesystem image, resulting in an…","s":6.6,"v":"MEDIUM","cwe":"CWE-787"},{"id":"CVE-2026-17591","p":1792192621420,"x":"A flaw was found in libarchive. An attacker can cause a Denial of Service (DoS) or potential information disclosure due to a use-after-free vulnerability, which occurs when a program reads memory that has already been released. This issue arises when the archive_entry_copy_mac_metadata() function deallocates an…","s":3.6,"v":"LOW","cwe":"CWE-416"},{"id":"CVE-2026-111802","p":1792192621277,"x":"A flaw was found in Nautilus. When a removable drive or disk image is unmounted or ejected, Nautilus prompts the user to empty the trash without verifying whether the trash directory paths are symbolic links. An attacker can exploit this flaw by tricking a user into mounting a crafted storage volume and confirming the…","s":6.6,"v":"MEDIUM","cwe":"CWE-59"},{"id":"CVE-2026-110759","p":1792192621170,"x":"Text::CSV_XS versions before 1.65 for Perl return a 0xFF byte that is not in the input for an empty last field followed by a lone CR in parse.\n\nWhen the input to parse ends in a separator and a lone CR, the parser treats the end of the input as the next character and stores the end-of-file marker in the field as the…","cwe":"CWE-1286"},{"id":"CVE-2026-110758","p":1792192621057,"x":"Text::CSV_XS versions before 1.65 for Perl read before the start of an all-blank field under allow_whitespace in strip_trail_whitespace.\n\nUnder allow_whitespace, strip_trail_whitespace removes trailing spaces and tabs from each unquoted field without stopping at the start of the field. For a field of only blanks it…","cwe":"CWE-127"},{"id":"CVE-2026-110757","p":1792192620953,"x":"Text::CSV_XS versions before 1.65 for Perl allow record splitting by writing strings used as numbers without quotes in combine.\n\ncombine and print do not check whether a field needs quotes when its value has Perl's integer or numeric flag set. Perl sets these flags on a string used in a numeric operation when it…","cwe":"CWE-116"},{"id":"CVE-2026-110756","p":1792192620847,"x":"Text::CSV_XS versions before 1.65 for Perl drop the end of a record and its line ending when a UTF-8 flagged field precedes invalid UTF-8 bytes in print.\n\nWhen a record contains a UTF-8 flagged field, print holds back trailing bytes that are not valid UTF-8 at each buffer flush, so that a character split across two…","cwe":"CWE-116"},{"id":"CVE-2026-110755","p":1792192620740,"x":"Text::CSV_XS versions before 1.65 for Perl allow quadratic CPU use by copying the unparsed remainder per record of CR-only input in getline.\n\nWith eol unset, the default, getline reads with Perl's default line separator, so input with CR-only line endings arrives as one chunk. After each record the parser copies the…","cwe":"CWE-407"},{"id":"CVE-2026-110754","p":1792192620637,"x":"Text::CSV_XS versions before 1.65 for Perl leak the parsed fields of a record that fails to parse in getline.\n\ngetline collects the fields of a record into a new array and returns a reference to it only when the parse succeeds. When the record has a syntax error, getline returns undef and never frees the array or the…","cwe":"CWE-401"},{"id":"CVE-2026-110753","p":1792192620530,"x":"Text::CSV_XS versions from 1.46 before 1.65 for Perl have a use-after-free of bind_columns variables when skip_empty_rows skips an empty line in getline.\n\nWith bind_columns, the parser writes each field into the caller's own scalar without taking a reference to it. When skip_empty_rows skips an empty last line, the…","cwe":"CWE-416"},{"id":"CVE-2026-110752","p":1792192620410,"x":"Text::CSV_XS versions before 1.65 for Perl allow memory exhaustion by allocating one entry per index of an RFC 7111 selector in fragment.\n\nfragment expands a row= or col= selector into an array with one element per selected index before it reads any data, and it does not clamp an explicit end column in a cell=…","cwe":"CWE-770"},{"id":"CVE-2026-96628","p":1792189138367,"x":"Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to 2.11.0, AuthMiddleware.managerAuth accepts X-Arcane-Agent-Token credentials and the environment-token branch calls next before the AdminRequired option is evaluated. An attacker with a valid X-Arcane-Agent-Token can request…","s":4.3,"v":"MEDIUM","cwe":"CWE-863"},{"id":"CVE-2026-96627","p":1792189138227,"x":"Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to 2.6.0, UpdateUser in backend/api/handlers/users.go sets PasswordHash for any target without comparing caller and target privilege. A holder of delegated users:update permission can submit a password change for the global…","s":8.8,"v":"HIGH","cwe":"CWE-266"},{"id":"CVE-2026-96626","p":1792189138070,"x":"Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to 2.5.0, UpdateRegistry and TestRegistry in backend/api/services/container_registry_service.go allow the registry URL to change while preserving the stored encrypted token. When a holder of registries:update and…","s":8.5,"v":"HIGH","cwe":"CWE-200"},{"id":"CVE-2026-68498","p":1792189045183,"x":"StreamReadConstraints.maxNameLength (default 50,000 characters) is intended to bound how much memory a single JSON Object property name can consume while being parsed, independently of the much larger maxStringLength (default 100,000,000 characters) that bounds ordinary string values. For parsers built over character…","s":7.5,"v":"HIGH","cwe":"CWE-400"},{"id":"CVE-2026-62439","p":1792189044440,"x":"A flaw was found in GIMP. An integer overflow occurs in the file-pvr plug-in when calculating memory buffer sizes for image dimensions. By tricking a user into opening or previewing a specially crafted PowerVR (.pvr) file, an attacker can trigger a heap-based buffer overflow, potentially leading to arbitrary code…","s":7,"v":"HIGH","cwe":"CWE-190"},{"id":"CVE-2026-62438","p":1792189044307,"x":"A flaw was found in GIMP. An attacker can cause a Denial of Service (DoS) or potentially disclose sensitive memory contents by convincing a user to open or preview a specially crafted Bohemia Interactive (PAA) texture file. Due to an integer overflow when calculating image dimensions during file decompression, the…","s":6.1,"v":"MEDIUM","cwe":"CWE-190"},{"id":"CVE-2026-49410","p":1792189043490,"x":"OpenHuman is an open-source agent harness available as a desktop application and Rust library. Versions before 0.56.0 allow cross-site request forgery against the unauthenticated GET /auth/telegram loopback callback because telegram_auth_handler consumes an attacker-supplied one-time Telegram login token and passes…","s":8.1,"v":"HIGH","cwe":"CWE-352"},{"id":"CVE-2026-111044","p":1792189040610,"x":"Sunshine is a self-hosted game stream host for Moonlight. From 2026.329.165800 until 2026.906.222525, Sunshine accepted any client certificate that chained to a stored paired-client certificate, but it did not require the presented certificate to be the exact enabled paired identity. Certificate text was also compared…","s":7.6,"v":"HIGH","cwe":"CWE-863"},{"id":"CVE-2026-108372","p":1792189034457,"x":"Open and provider-neutral, LoopX is a lightweight state kernel and local-first control plane for loop engineering. From version 0.0.1 until 0.4.5, `loopx serve-status` in `loopx/status_server.py` uses `StatusRequestHandler._send_json()` and `do_OPTIONS()` to send `Access-Control-Allow-Origin: *` for unauthenticated…","s":7.1,"v":"HIGH","cwe":"CWE-346"},{"id":"CVE-2026-96542","p":1792185662040,"x":"Incorrect permission assignment (CWE-732) in the standalone installer for EA Javelin Anticheat (versions 1.0.14329371, 1.0.14547437, 1.0.14789537, and 1.0.14940698) on Windows allows a local non-administrative user to elevate privileges to NT AUTHORITY\\SYSTEM by modifying the EAAntiCheatService service configuration…","s":5,"v":"MEDIUM","cwe":"CWE-732"},{"id":"CVE-2026-64862","p":1792185559597,"x":"Frappe HR is an open-source human resources management solution (HRMS). Prior to 15.58.3 and 16.4.3, HRMS PWA API endpoints for employee data do not consistently authorize employee-specific PWA API requests. An authenticated user requests records associated with another employee. The user can request records…","s":6.5,"v":"MEDIUM","cwe":"CWE-862"},{"id":"CVE-2026-55796","p":1792185558963,"x":"Frappe HR is an open-source human resources management solution (HRMS). Prior to 15.60.3 and 16.7.1, the Salary Payments via ECS report constructs report conditions with unsafe SQL string interpolation. An authenticated HR user supplies crafted Salary Payments via ECS report filter values. The affected Salary Payments…","s":6.5,"v":"MEDIUM","cwe":"CWE-89"},{"id":"CVE-2026-108374","p":1792185439600,"x":"ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.121.0 and 16.34.0, certain endpoints for status modification fail to enforce proper authorization checks. A low-privileged authenticated user can invoke state-changing whitelisted methods without required write, submit, cancel, document,…","s":7.7,"v":"HIGH","cwe":"CWE-862"},{"id":"CVE-2026-108373","p":1792185439437,"x":"ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.118.0 and 16.27.0, certain endpoints in the Sales Person-wise Transaction Summary report fail to enforce proper authorization checks. When a role-limited authenticated user requests the affected financial report, the query can query…","s":6.5,"v":"MEDIUM","cwe":"CWE-862"},{"id":"CVE-2026-96620","p":1792181908293,"x":"Claude Agent SDK is a Python SDK for Claude Code. Prior to 0.2.121, the resume option is passed to the Claude CLI as a separate token without validation, so a dash-leading value is parsed as an independent CLI flag. An attacker can inject the --mcp-config flag to define a stdio MCP server, causing arbitrary command…","s":9.2,"v":"CRITICAL","cwe":"CWE-20"},{"id":"CVE-2026-69080","p":1792181844560,"x":"Exposure of SQL Black List to an Unauthorized Actor vulnerability in Apache Kylin.\n\n\n\nThis issue affects Apache Kylin: from 4 through 5.0.4.\n\n\n\nUsers are recommended to upgrade to version 5.0.5, which fixes the issue.","cwe":"CWE-200"},{"id":"CVE-2026-69077","p":1792181844450,"x":"Exposure of unauthorized cross-project job manipulation vulnerability in Apache Kylin. Impact most to the kylin services that are directly exposed to public network, which is not common. In-house kylin deployments are mostly not impacted.\n\n\n\nThis issue affects Apache Kylin: from 4 through 5.0.4.\n\n\n\nUsers are…","cwe":"CWE-200"},{"id":"CVE-2026-69076","p":1792181844343,"x":"Exposure of Job Discard to an Unauthorized Actor vulnerability in Apache Kylin. Impact most to the kylin services that are directly exposed to public network, which is not common. In-house kylin deployments are mostly not impacted.\n\n\n\nThis issue affects Apache Kylin: from 4 through 5.0.4.\n\n\n\nUsers are recommended to…","cwe":"CWE-200"},{"id":"CVE-2026-68573","p":1792181844233,"x":"Improper Authentication vulnerability in Apache Kylin. Unauthenticated user may access to system cleanup actions. Impact most to the kylin services that are directly exposed to public network, which is not common. In-house kylin deployments are mostly not impacted. \n\n\n\nThis issue affects Apache Kylin: from 4 through…","cwe":"CWE-287"},{"id":"CVE-2026-68572","p":1792181844120,"x":"Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Kylin.\n\n\n\nThis issue affects Apache Kylin: from 4 through 5.0.4.\n\n\n\nUsers are recommended to upgrade to version 5.0.5, which fixes the issue.","cwe":"CWE-200"},{"id":"CVE-2026-61726","p":1792181843980,"x":"Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.12, StepViewSet and IngredientViewSet filter only by active Space and use role-level CustomIsUser checks instead of the private-recipe owner or sharing predicate when an authenticated user with read and…","s":8.1,"v":"HIGH","cwe":"CWE-284"},{"id":"CVE-2026-59970","p":1792181843843,"x":"Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.10, passes an administrator-controlled AI provider URL directly to LiteLLM without applying the server's outbound-request SSRF checks when an authenticated user creates a Space, configures an AI provider…","s":7.7,"v":"HIGH","cwe":"CWE-918"},{"id":"CVE-2026-59966","p":1792181843700,"x":"Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.10, executes user-controlled Automation regular-expression patterns with Python re.sub() without complexity validation or an execution timeout when an authenticated user stores a catastrophic-backtracking…","s":5.7,"v":"MEDIUM","cwe":"CWE-1333"},{"id":"CVE-2026-59963","p":1792181843567,"x":"Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.10, recipe utility endpoints retrieve same-Space Recipe objects without invoking the private-recipe owner or sharing permission when an authenticated member of a shared Space supplies another member's…","s":7.1,"v":"HIGH","cwe":"CWE-639"},{"id":"CVE-2026-30971","p":1792181843190,"x":"ZoneMinder is a free, open source closed-circuit television software application. Prior to 1.39.2, 1.38.2, and 1.36.40, ZoneMinder interpolates an unvalidated monitor Device field into shell commands in PHP and Perl control paths when an authenticated user with monitor-create or monitor-edit permission saves a Local…","s":8.8,"v":"HIGH","cwe":"CWE-78"},{"id":"CVE-2026-108743","p":1792181839050,"x":"Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Apache Kylin. Impact most to the kylin services that are directly exposed to public network, which is not common. In-house kylin deployments are mostly not impacted.\n\n\n\nThis issue affects Apache Kylin: from…","cwe":"CWE-78"},{"id":"CVE-2026-108709","p":1792181838943,"x":"Authentication bypass within in-house network in Apache Kylin. Impact most to the kylin services that are directly exposed to public network, which is not common. In-house kylin deployments are mostly not impacted.\n\n\n\nThis issue affects Apache Kylin: from 4.0.4 through 5.0.4.\n\n\n\nUsers are recommended to upgrade to…"},{"id":"CVE-2026-102834","p":1792181837563,"x":"JavaCV provides Java interfaces to OpenCV, FFmpeg, and other multimedia libraries. Prior to 1.5.14, IPCameraFrameGrabber doubles a 32-bit buffer capacity without checking for overflow or bounding the parsed Content-Length. An application consumes an MJPEG response from a malicious camera endpoint or a tampered…","s":7.5,"v":"HIGH","cwe":"CWE-190"},{"id":"CVE-2026-102608","p":1792181837253,"x":"ZoneMinder is a free, open source closed-circuit television software application. Prior to 1.38.3, downloadEvents() manually wraps a monitor Name value in single quotes instead of using escapeshellarg() before placing it in shell commands when a user with monitor-create or monitor-edit permission stores a monitor Name…","s":9,"v":"CRITICAL","cwe":"CWE-78"},{"id":"CVE-2026-102607","p":1792181837097,"x":"ZoneMinder is a free, open source closed-circuit television software application. Prior to 1.38.3, the exportEvents() function concatenates the attacker-controlled exportFile request parameter into a shell command without neutralizing shell metacharacters when an authenticated user with View Events or View Snapshots…","s":8.8,"v":"HIGH","cwe":"CWE-78"},{"id":"CVE-2026-85977","p":1792178264430,"x":"A flaw was found in libtirpc. A remote attacker can exploit this vulnerability by sending specially crafted PMAPPROC_DUMP replies to a client application that uses the pmap_getmaps() function against an attacker-controlled host. This unbounded decoding can lead to excessive memory and CPU allocation, causing the…","s":5.3,"v":"MEDIUM","cwe":"CWE-1050"},{"id":"CVE-2026-85231","p":1792178264180,"x":"A flaw was found in libtirpc. An authenticated remote attacker could exploit this vulnerability by sending oversized wrapped data requests to an RPC (Remote Procedure Call) service configured with RPCSEC_GSS (Remote Procedure Call Security-Generic Security Service) integrity or privacy. This can lead to unbounded…","s":6.5,"v":"MEDIUM","cwe":"CWE-770"},{"id":"CVE-2026-17491","p":1792178226557,"x":"IBM i 7.3, 7.4, 7.5, and 7.6 is could allow a remote authenticated attacker to bypass security restrictions due to improper enforcement of the ChrootDirectory configuration directive.","s":5.4,"v":"MEDIUM","cwe":"CWE-269"},{"id":"CVE-2026-17488","p":1792178226443,"x":"IBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to bypass security restrictions due to improper authentication.","s":4.3,"v":"MEDIUM","cwe":"CWE-287"},{"id":"CVE-2026-17275","p":1792178226313,"x":"IBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote attacker to perform unauthorized manipulation of distributed transactions due to improper validation of attacker-supplied transaction identifiers.","s":3.7,"v":"LOW","cwe":"CWE-285"},{"id":"CVE-2026-17073","p":1792178226190,"x":"IBM i 7.3, 7.4, 7.5, and 7.6 could allow a local attacker to obtain sensitive information due to missing subtree checks during file handle resolution.","s":5.4,"v":"MEDIUM","cwe":"CWE-284"},{"id":"CVE-2026-17068","p":1792178226063,"x":"IBM i 7.3, 7.4, 7.5, and 7.6 could allow a local attacker to bypass NFS version restrictions due to improper enforcement of the export version flag.","s":5.4,"v":"MEDIUM","cwe":"CWE-285"},{"id":"CVE-2026-111793","p":1792178225680,"x":"Openwave Webtop Media Transcoder does not enforce administrator-defined file type restrictions to restrict the file-types to be converted. This may allow an authenticated user to process and convert unintended document types if bypassing the Webmail experience.","s":4.3,"v":"MEDIUM","cwe":"CWE-669"},{"id":"CVE-2026-107674","p":1792178222473,"x":"IBM i 7.3, 7.4, 7.5, and 7.6 is vulnerable to a denial of service to Digital Certificate Manager (DCM) for System TLS using applications attempting to create secure network connections. A bad actor could use this to prevent a service from starting or cause it to fallback to non-secure connections.","s":5.1,"v":"MEDIUM","cwe":"CWE-667"},{"id":"CVE-2026-102917","p":1792178221273,"x":"IBM i 7.3, 7.4, 7.5, and 7.6 is vulnerable to an authenticated attacker elevating their privilege. A bad actor could exploit this vulnerability to perform operations with QSECOFR/Root authority on the system.","s":7.8,"v":"HIGH","cwe":"CWE-269"},{"id":"CVE-2025-66969","p":1792178217160,"x":"Integer overflow in OpenModSim (<=1.11.0), leading to denial of service"},{"id":"CVE-2025-55653","p":1792178217013,"x":"GPAC MP4Box v2.4 was discovered to contain a floating point exception in the gf_parse_lfrac function (utils/error.c). Processing a crafted MP4 file containing a zero-denominator fraction string causes gf_parse_lfrac() to divide by zero, terminating the process with SIGFPE."},{"id":"CVE-2025-55640","p":1792178216243,"x":"A heap buffer overflow in the stbl_AddSize function (isomedia/stbl_write.c) of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file."},{"id":"CVE-2026-89098","p":1792174782320,"x":"A flaw was found in nfs-utils. The fsidd daemon improperly handles input received over its local domain socket by relying on program assertions to verify command arguments. A local user can exploit this vulnerability by sending a malformed request lacking the required arguments to trigger an assertion failure. This…","s":5.5,"v":"MEDIUM","cwe":"CWE-617"},{"id":"CVE-2026-81452","p":1792174717770,"x":"Dell Alienware Command Center (AWCC), versions prior to 6.14.54.0, contain a Least Privilege Violation vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of Privilege and Denial of Service.","s":7,"v":"HIGH","cwe":"CWE-272"},{"id":"CVE-2026-80092","p":1792174717640,"x":"Authentication bypass by assumed-immutable data in Microsoft Identity Web allows an authorized attacker to elevate privileges over a network.","s":5.3,"v":"MEDIUM","cwe":"CWE-302"},{"id":"CVE-2026-111723","p":1792174676980,"x":"LingGuo-Drama through commit 8a6924a contains a missing authorization vulnerability that allows any registered user to manage all accounts through the /admin/v1/admins API protected only by AuthAdminJWT. Attackers can self-register, read every account's bcrypt hash, reset the bootstrap administrator's password via…","s":8.8,"v":"HIGH","cwe":"CWE-862"},{"id":"CVE-2026-111722","p":1792174676823,"x":"LingGuo-Drama through commit 8a6924a contains an insecure direct object reference vulnerability that allows registered users to access other users' projects because projects.Get lacks an owner check. Self-registered attackers can iterate numeric IDs via GET, PUT and DELETE /admin/v1/projects/:id to read, overwrite,…","s":8.1,"v":"HIGH","cwe":"CWE-639"},{"id":"CVE-2026-111721","p":1792174676683,"x":"Open WES through 1.0.0 contains an authorization bypass vulnerability that allows authenticated users to modify other warehouses' stock records because GlobalGatewayFilter never enforces auth_warehouse scoping. Attackers holding the menu permission can enumerate sequential IDs on freezeContainerStock and…","s":5.4,"v":"MEDIUM","cwe":"CWE-639"},{"id":"CVE-2026-111720","p":1792174676533,"x":"fish-island-backend through commit 7c61b78 contains an unauthenticated server-side request forgery vulnerability that allows remote attackers to make the server fetch attacker-supplied URLs via the url parameter of GET /api/web/parse. Attackers can target internal hosts, loopback services or cloud metadata endpoints…","s":5.3,"v":"MEDIUM","cwe":"CWE-918"},{"id":"CVE-2026-111719","p":1792174676397,"x":"Roncoo-pay through commit 9428382 contains a missing authorization vulnerability in F2FPayController.orderQuery that allows unauthenticated attackers to retrieve payment records by supplying a trxNo parameter. Attackers can guess transaction numbers, a '7' prefix plus a snowflake ID, to obtain the full serialized…","s":5.9,"v":"MEDIUM","cwe":"CWE-306"},{"id":"CVE-2026-111718","p":1792174676257,"x":"AipexBase through commit 690adb9 contains a sql injection vulnerability that allows attackers to inject SQL through the order_by and group_by fields of the /api/data/invoke endpoint. Attackers can supply subqueries or EXTRACTVALUE and UPDATEXML functions that bypass the SqlGuard denylist and row-level security,…","s":6.5,"v":"MEDIUM","cwe":"CWE-89"},{"id":"CVE-2026-111717","p":1792174676130,"x":"Arkon through 0.9.2 contains a missing authorization vulnerability in list_skill_versions that allows authenticated employees to read other departments' skill version metadata by bypassing the can_access_skill check. Attackers holding the default skill:read permission can request GET /api/skills/{slug}/versions for…","s":4.3,"v":"MEDIUM","cwe":"CWE-639"},{"id":"CVE-2026-111716","p":1792174675997,"x":"Arkon through 0.9.2 contains a broken access control vulnerability that allows authenticated employees to read and modify other departments' sources because by-id routes in app/routers/sources.py skip can_access_document. Attackers can call the plan, progress, PATCH, retry and approve-extraction routes with foreign…","s":5.4,"v":"MEDIUM","cwe":"CWE-639"},{"id":"CVE-2026-111715","p":1792174675857,"x":"Arkon through 0.9.2 contains a missing authorization vulnerability in GET /api/wiki/graph that lets authenticated employees read other departments' wiki metadata by supplying a foreign slug. Attackers with only wiki:read:own_dept permission can query get_neighborhood() without scope checks to obtain page slugs,…","s":4.3,"v":"MEDIUM","cwe":"CWE-639"},{"id":"CVE-2026-111714","p":1792174675723,"x":"tarteaucitron.js before 1.37.0 contains a regular expression denial of service vulnerability that allows attackers to block visitor pages by supplying unescaped cookie names to cookie.purge. Attackers can plant a cookie from a sibling subdomain or inject a purgeBtn element with a catastrophic-backtracking data-cookie…","s":3.1,"v":"LOW","cwe":"CWE-1333"},{"id":"CVE-2026-111713","p":1792174675580,"x":"tarteaucitron.js before 1.37.0 contains a cross-site scripting vulnerability because getElemAttr resolves 'data-' prefixed attributes while the https-only guard validates the unprefixed attribute. Attackers who can place markup, such as CMS authors, can add data-url with a javascript: URL beside a benign url to…","s":5.4,"v":"MEDIUM","cwe":"CWE-79"},{"id":"CVE-2026-111712","p":1792174675453,"x":"Netcore NR256CN through 1.5.140116 contains an authentication bypass vulnerability that allows unauthenticated attackers to reach protected management CGI handlers by prefixing the URI with a public route. Attackers can request paths prefixed with l7_web_auth.cgi or an .ico route to invoke protected management…","s":6.5,"v":"MEDIUM","cwe":"CWE-288"},{"id":"CVE-2026-111711","p":1792174675337,"x":"Netcore NR256CN through 1.5.140116 contains a pre-authentication stack overflow vulnerability in the Boa web server's user_ok() function, which copies Basic-auth usernames with unbounded strcpy() calls into 64-byte stack buffers. Unauthenticated attackers can send a username longer than 63 bytes to any protected…","s":9.8,"v":"CRITICAL","cwe":"CWE-121"},{"id":"CVE-2026-111710","p":1792174675207,"x":"Netcore NR256CN through 1.5.140116 contains a NULL pointer dereference vulnerability in the Boa web server's user_auth() function that allows unauthenticated attackers to crash the server via a malformed Authorization header. Attackers can send a Basic Authorization value lacking a colon, such as one decoding to a…","s":7.5,"v":"HIGH","cwe":"CWE-476"},{"id":"CVE-2026-111709","p":1792174675070,"x":"WhaTicket Community through commit cf04795 contains an insecure direct object reference vulnerability that allows authenticated agents to access other agents' tickets because ShowTicketService performs no ownership or queue checks. Attackers can supply another agent's ticket id to GET /tickets/:ticketId and…","s":5.4,"v":"MEDIUM","cwe":"CWE-639"},{"id":"CVE-2026-111708","p":1792174674933,"x":"WhaTicket Community through commit cf04795 contains an authentication bypass vulnerability that allows unauthenticated attackers to self-register as administrators via POST /auth/signup. Attackers can omit the profile field or set it to admin, gaining user management, settings, and access to all tickets, contacts,…","s":9.8,"v":"CRITICAL","cwe":"CWE-269"},{"id":"CVE-2026-111707","p":1792174674803,"x":"99AI through 4.3.0 contains an insecure direct object reference vulnerability that allows unauthenticated attackers to read other users' chat messages because querySingleChat lacks an owner check. Attackers can send a fingerprint header to obtain a visitor JWT and iterate sequential chatId values to retrieve other…","s":5.3,"v":"MEDIUM","cwe":"CWE-639"},{"id":"CVE-2026-111706","p":1792174674663,"x":"99AI through 4.3.0 contains a missing authentication vulnerability in the POST /api/chatLog/exportExcel route that allows unauthenticated attackers to export all users' chat logs. Attackers can send requests with controlled page, size, and optional email fields to download xlsx files containing usernames, emails,…","s":7.5,"v":"HIGH","cwe":"CWE-306"},{"id":"CVE-2026-111705","p":1792174674527,"x":"Fuint through commit 57ec018 contains an insecure direct object reference vulnerability that allows authenticated members to read other members' booking records by supplying arbitrary bookId values to /clientApi/book/myBookDetail. Attackers can iterate the auto-increment bookId to retrieve contact names, mobile…","s":4.3,"v":"MEDIUM","cwe":"CWE-639"},{"id":"CVE-2026-111704","p":1792174674370,"x":"LangChat through commit 2a6285a contains a missing authentication vulnerability that allows unauthenticated remote attackers to access REST controllers because no Sa-Token interceptor is registered. Attackers can query /api/v1/auth/users to read plaintext passwords, retrieve LLM provider API keys, create super-admin…","s":9.8,"v":"CRITICAL","cwe":"CWE-306"},{"id":"CVE-2026-111703","p":1792174674213,"x":"yshop-crm through 2.1.3 contains an insecure direct object reference vulnerability that allows authenticated sales users to access other users' customer records by supplying arbitrary ids. Attackers can enumerate ids against the get, update, delete and do-open endpoints to read contact details, overwrite or delete…","s":6.3,"v":"MEDIUM","cwe":"CWE-639"},{"id":"CVE-2026-111702","p":1792174674080,"x":"ChatOllama through commit 96c3ce5 contains an insecure direct object reference vulnerability that allows remote attackers to access other users' private knowledge bases by supplying sequential ids. Attackers can enumerate ids via GET /api/knowledgebases/{id} or the knowledgebaseId parameter of POST /api/models/chat to…","s":7.5,"v":"HIGH","cwe":"CWE-639"},{"id":"CVE-2026-111701","p":1792174673930,"x":"OtterMind Nubase through 0.1.4 contains a missing authentication vulnerability that allows unauthenticated attackers to access private bucket objects because /storage/v1/object/{bucketId}/{path} is treated as public for every HTTP method. Attackers knowing a tenant subdomain, bucket id and object path can download…","s":7,"v":"HIGH","cwe":"CWE-306"},{"id":"CVE-2026-111700","p":1792174673780,"x":"WebVella ERP through 1.8.8 contains an sql injection vulnerability that allows any authenticated user to inject SQL through WHERE-clause text literals in the EQL query API. Attackers can send crafted single-quoted literals to POST /api/v3/en_US/eql, escaping the unsanitized EqlBuilder SQL interpolation to read…","s":7.1,"v":"HIGH","cwe":"CWE-89"},{"id":"CVE-2026-111699","p":1792174673633,"x":"Niefy wx-api through 0.8.2 contains an authentication bypass vulnerability that allows unauthenticated attackers to impersonate WeChat fans by supplying a raw openid cookie to fan-facing controllers. Attackers knowing a victim's openid can call /wxUser/getUserInfo and /wxUserTags endpoints to read nickname, phone,…","s":4.8,"v":"MEDIUM","cwe":"CWE-306"},{"id":"CVE-2026-111698","p":1792174673490,"x":"HUIZHI ChargeOS cloud through 3.0.9 contains a missing authorization vulnerability in the hcp-mp PayController.xcxRecharge endpoint that allows attackers to modify any member's wallet balance without payment. Attackers can send requests with arbitrary amount and userId parameters to credit or reduce balances and…","s":6.5,"v":"MEDIUM","cwe":"CWE-639"},{"id":"CVE-2026-111697","p":1792174673350,"x":"HUIZHI ChargeOS cloud through 3.0.9 contains an insecure direct object reference vulnerability in the hcp-mp MeController and OrderController that trusts client-supplied userId, openId and orderNumber parameters. Attackers can enumerate sequential member ids against endpoints like /me/getMemberBalanceByUserId and…","s":6.5,"v":"MEDIUM","cwe":"CWE-639"},{"id":"CVE-2026-111696","p":1792174673220,"x":"data-platform-open through commit efeacd3 uses a hardcoded, publicly known default AES key in AesPasswordEncAndDecServiceImpl, allowing authenticated attackers to decrypt stored datasource passwords. Attackers can obtain ciphertext passwords from the datasource detail API, for example via cross-workspace IDOR, and…","s":6.5,"v":"MEDIUM","cwe":"CWE-321"},{"id":"CVE-2026-111695","p":1792174673080,"x":"Shaiwz data-platform-open through commit efeacd3 contains an insecure direct object reference vulnerability that allows authenticated workspace members to access other workspaces' datasources by numeric id. Attackers can send foreign sequential ids to /datasource/detail, /listSchemaTable, /tableDetail, /update or…","s":7.1,"v":"HIGH","cwe":"CWE-639"},{"id":"CVE-2026-111694","p":1792174672907,"x":"qKnow through 2.4.3 contains a missing authentication vulnerability that allows unauthenticated remote attackers to access /flyflow workflow integration endpoints permitted in SecurityConfig. Attackers can POST sequential userId values to /flyflow/userById or call roleAll and deptListByParentDeptId to enumerate user…","s":5.3,"v":"MEDIUM","cwe":"CWE-306"},{"id":"CVE-2026-111693","p":1792174672773,"x":"DataBuff ai-apm-web through 0.1.10 contains a hard-coded default credentials vulnerability that allows unauthenticated attackers to gain administrator access using the built-in admin/Databuff@123 account. Attackers can POST these credentials to /webapi/api/v1/auth/login to obtain an administrator token and access all…","s":9.8,"v":"CRITICAL","cwe":"CWE-1392"},{"id":"CVE-2026-111692","p":1792174672633,"x":"DataBuff ai-apm-web through 0.1.10 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge admin session tokens by using the hardcoded HMAC secret in JwtTokenService. Attackers can sign a payload of admin and a future expiry with the default dev-secret to gain full administrative…","s":9.8,"v":"CRITICAL","cwe":"CWE-321"},{"id":"CVE-2026-111691","p":1792174672493,"x":"WIMOOR through commit ec86736 contains an authentication bypass vulnerability that allows attackers to impersonate any tenant and privilege level by sending an unsigned X-USERINFO header. Attackers reaching backend service ports directly, bypassing the gateway, can forge companyid and manager or admin usertype values…","s":7.4,"v":"HIGH","cwe":"CWE-290"},{"id":"CVE-2026-111690","p":1792174672350,"x":"Simple Admin Core through 1.8.7 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge super administrator tokens by using the hard-coded Auth.AccessSecret in api/etc/core.yaml. Attackers can sign a JWT with the public secret and roleId claim 001 to gain full administrative…","s":9.8,"v":"CRITICAL","cwe":"CWE-321"},{"id":"CVE-2026-111689","p":1792174672207,"x":"Exrick XBoot through 3.3.4 contains an authorization bypass vulnerability that allows authenticated users to read user records of any department by ignoring role data scope. Attackers can request GET /xboot/user/getByDepartmentId/{departmentId} with arbitrary department ids to retrieve usernames, real names, mobile…","s":4.3,"v":"MEDIUM","cwe":"CWE-639"},{"id":"CVE-2026-111688","p":1792174672063,"x":"Exrick XBoot through 3.3.4 contains an authorization bypass vulnerability that allows authenticated users to evade role data-scope restrictions by sending openDataFilter=false. Attackers can append this parameter to the department getByParentId or search endpoints to retrieve the entire organization's department tree…","s":4.3,"v":"MEDIUM","cwe":"CWE-863"},{"id":"CVE-2026-111687","p":1792174671920,"x":"WeRSS (we-mp-rss) through 1.5.3 contains a remote code execution vulnerability that allows unauthenticated attackers to run code via the template parameter of the public GET /rss/{feed_id} endpoint. Attackers can supply a non-built-in ext value and a {{=expression}} template whose object-subclass traversal bypasses…","s":9.8,"v":"CRITICAL","cwe":"CWE-95"},{"id":"CVE-2026-111686","p":1792174671787,"x":"IceCMS through 4.1.5 contains an unauthenticated sql injection vulnerability that allows remote attackers to inject SQL through the num path parameter of /WebArticle/findarticlesbynum. Attackers can append crafted SQL after the LIMIT clause concatenated into a MyBatis-Plus QueryWrapper to extract database contents via…","s":7.5,"v":"HIGH","cwe":"CWE-89"},{"id":"CVE-2026-111685","p":1792174671643,"x":"IceCMS through 4.1.5 contains an unauthenticated sql injection vulnerability that allows remote attackers to inject SQL by supplying a crafted num path parameter to /WebResource/findresourcebynum. Attackers can append SQL after the LIMIT clause concatenated via QueryWrapper.last() to extract database contents using…","s":7.5,"v":"HIGH","cwe":"CWE-89"},{"id":"CVE-2026-111684","p":1792174671477,"x":"Magistrala through 1.0.0 contains an authorization bypass vulnerability that allows authenticated workspace members to view, issue, and revoke other tenants' device certificates by supplying foreign serials or entity ids. Attackers can call RevokeBySerial, RevokeAll, ViewCert, ListCerts, or IssueCert under their own…","s":8.3,"v":"HIGH","cwe":"CWE-639"},{"id":"CVE-2026-111683","p":1792174671350,"x":"Allegro Ralph through 20260902.1 contains a missing authorization vulnerability that allows authenticated staff users to bypass rack model permissions because RalphPermission skips checks for views without a queryset. Attackers can call DCAssetsView and SRRacksAPIView at /api/rack/<id> and /api/server_room/<id> to…","s":5.4,"v":"MEDIUM","cwe":"CWE-862"},{"id":"CVE-2026-111682","p":1792174671213,"x":"EFAK 5.0.0 through 5.1.0 contains a missing authorization vulnerability that allows authenticated low-privilege users to read LLM provider API keys through the /api/model-config REST API. Attackers with any ROLE_USER account can query /api/model-config/page or /api/model-config/{id} to retrieve unmasked keys, enabling…","s":6.5,"v":"MEDIUM","cwe":"CWE-862"},{"id":"CVE-2026-111681","p":1792174671063,"x":"EFAK through 5.1.0 contains a missing authorization vulnerability that allows authenticated low-privilege users to manage accounts because the /api/users endpoints lack administrator role checks. Attackers can send POST, PUT, or DELETE requests to UserController to grant themselves ROLE_ADMIN, create administrators,…","s":8.8,"v":"HIGH","cwe":"CWE-862"},{"id":"CVE-2026-111680","p":1792174670923,"x":"APIPark through 1.9.7-beta contains an authorization bypass vulnerability that allows authenticated team managers to access other teams' services and applications by supplying their own team id in the team query parameter. Attackers can target service or app ids exposed by /api/v1/simple/services and…","s":8.3,"v":"HIGH","cwe":"CWE-639"},{"id":"CVE-2026-111679","p":1792174670770,"x":"Ekko Studio through 0.7.36 contains a missing authorization vulnerability that allows any authenticated non-super_admin user to list and clear server-wide login lockouts via /api/auth/locked-ips. Attackers can send DELETE requests without an ip parameter to invoke unlockAll(), disabling the login rate limiter during…","s":5.4,"v":"MEDIUM","cwe":"CWE-862"},{"id":"CVE-2026-111678","p":1792174670627,"x":"Antiword through 0.37 contains a stack out-of-bounds read vulnerability in vGet8PapInfo and vGet8ChrInfo in prop8.c because FKP run counts and grpprl offsets are not bounded. Attackers can supply a crafted .doc file with malicious FKP pages to read past the 512-byte stack buffer, crashing antiword or corrupting style…","s":3.3,"v":"LOW","cwe":"CWE-125"},{"id":"CVE-2026-111677","p":1792174670477,"x":"Antiword through 0.37 contains a heap out-of-bounds read vulnerability in vGet8LstInfo in prop8.c caused by an inverted bounds check on the PlcfLst record count. Attackers can supply a crafted Word 8 .doc file claiming up to 0xffff LSTF records in a tiny buffer, causing reads past the heap allocation that crash the…","s":5.5,"v":"MEDIUM","cwe":"CWE-125"},{"id":"CVE-2026-111676","p":1792174670337,"x":"Faveo Helpdesk through 2.0.3 contains a broken access control vulnerability that allows authenticated agents to read tickets in other departments via the getTooltip handler. Attackers can enumerate sequential ticketid values on GET /ticket/tooltip to read ticket conversations, including customer personal data and…","s":4.3,"v":"MEDIUM","cwe":"CWE-639"},{"id":"CVE-2026-111675","p":1792174670197,"x":"Course-tencent-cloud through 2.0.1 contains an improper restriction of authentication attempts vulnerability that allows unauthenticated attackers to brute force 6-digit SMS/email verification codes, which are never invalidated or attempt-limited. Attackers who know a victim's phone or email can trigger a code and…","s":7.4,"v":"HIGH","cwe":"CWE-307"},{"id":"CVE-2026-111674","p":1792174670063,"x":"Tbed through 20240319 contains a missing authorization vulnerability that allows any authenticated user to rename other users' images through the /admin/setImgFileName endpoint. Attackers can supply a victim's imgname, exposed in public image URLs and album listings, to overwrite display names with attacker-chosen…","s":4.3,"v":"MEDIUM","cwe":"CWE-639"},{"id":"CVE-2026-111673","p":1792174669920,"x":"IceCMS through 4.1.5 contains a missing authentication vulnerability that allows unauthenticated attackers to modify, delete, or disable any account because /User/** is excluded from the Shiro jwt filter. Attackers can send PUT requests to /User/updateUser to set a new password and role on any userId, including…","s":9.8,"v":"CRITICAL","cwe":"CWE-306"},{"id":"CVE-2026-111672","p":1792174669790,"x":"Cube-studio through 2026.09.01 contains a missing authorization vulnerability in myapp/views/view_pipeline.py that allows authenticated users to view or copy other project groups' pipelines by id. Attackers can enumerate sequential pipeline ids via the web, log, monitoring, pod, and copy_pipeline endpoints to expose…","s":4.3,"v":"MEDIUM","cwe":"CWE-639"},{"id":"CVE-2026-111671","p":1792174669647,"x":"Cube-studio through 2026.09.01 contains an insecure direct object reference vulnerability that allows authenticated users to stop, reset, clear or redeploy other users' notebooks and services by id. Attackers can pass sequential ids to lifecycle endpoints in view_notebook.py, view_inferenceserving.py and…","s":7.1,"v":"HIGH","cwe":"CWE-639"},{"id":"CVE-2026-111670","p":1792174669470,"x":"ClickVisual through 1.1.2 contains a missing authorization vulnerability in the /api/v2/reports handlers that allows authenticated low-privileged users to access ClickHouse instances they were not granted. Attackers can iterate the instance-id parameter in ReportSourceDatabases, ReportSourceTables, ReportTableColumns…","s":4.3,"v":"MEDIUM","cwe":"CWE-862"},{"id":"CVE-2026-111669","p":1792174669080,"x":"ZR.Admin.NET through 3.8.2 contains an sql injection vulnerability that allows authenticated attackers to manipulate the ORDER BY clause by supplying a crafted PagerInfo.Sort query parameter to the shared ToPage paging helper. Attackers holding the system:user:list permission can inject subquery or CASE expressions…","s":6.5,"v":"MEDIUM","cwe":"CWE-89"},{"id":"CVE-2026-111668","p":1792174668790,"x":"AIHelms through 0.1.25 contains a missing authorization vulnerability in apps/api/v1/efficiency.py that allows authenticated low-privileged users to bypass efficiency:read and efficiency:write permission checks. Attackers can query routes like /cost/detail, /top-users and /budget to read organization-wide AI spend,…","s":5.4,"v":"MEDIUM","cwe":"CWE-862"},{"id":"CVE-2026-111667","p":1792174668660,"x":"REBUILD through 4.5.0 contains a missing authorization vulnerability in TaskCommentController.commentList that allows authenticated low-privileged users to read task comments without project membership checks. Attackers can supply the id of a task in a private project to the /project/comments/list endpoint to retrieve…","s":4.3,"v":"MEDIUM","cwe":"CWE-639"},{"id":"CVE-2026-111666","p":1792174668507,"x":"Steedos Platform through 3.0.15-beta.51 contains an authorization bypass vulnerability that allows authenticated users to read other tenants' report definitions by querying the reports object. Because objectql's callAdapter skips space filtering for enable_space_global objects on find/findOne, attackers can call GET…","s":4.3,"v":"MEDIUM","cwe":"CWE-863"},{"id":"CVE-2026-111665","p":1792174668363,"x":"Piranha CMS through 12.2 contains a missing authorization vulnerability in the Piranha.Manager LanguageApiController that allows any authenticated manager user to list, create, edit and delete site languages without the granular Language, LanguageAdd, LanguageEdit or LanguageDelete permissions. Attackers can call the…","s":5.4,"v":"MEDIUM","cwe":"CWE-862"},{"id":"CVE-2026-111664","p":1792174668210,"x":"Safing Portmaster before 2.2.5 contains a missing authorization vulnerability that allows unprivileged local processes to force updates by calling the POST /api/v1/updates/from-url endpoint registered with api.PermitAnyone. Attackers can supply an attacker-controlled index URL that bypasses version checks and…","s":4.4,"v":"MEDIUM","cwe":"CWE-306"},{"id":"CVE-2026-111663","p":1792174668077,"x":"Chaskiq through 2.0.3 contains a server-side request forgery vulnerability that allows unauthenticated attackers to fetch arbitrary URLs via the createUrlUpload GraphQL mutation. Attackers can submit internal URLs, including cloud instance metadata endpoints, through POST /graphql and retrieve the full response via…","s":8.6,"v":"HIGH","cwe":"CWE-918"},{"id":"CVE-2026-111662","p":1792174667900,"x":"Chaskiq through 2.0.3 contains a server-side request forgery vulnerability that allows unauthenticated attackers to make the server fetch arbitrary URLs via the url parameter of the /oembed endpoint. Attackers can target loopback, private, or cloud-metadata addresses through FetchLinkCardService, which follows…","s":5.8,"v":"MEDIUM","cwe":"CWE-918"},{"id":"CVE-2026-111661","p":1792174667733,"x":"waynboot-mall through 2.0.0 contains a missing authentication vulnerability that allows unauthenticated attackers to send arbitrary email by calling the anonymously mapped /callback/email endpoint. Attackers can POST caller-supplied subject, content, and recipient to EmailController.sendEmail, sending messages from…","s":5.3,"v":"MEDIUM","cwe":"CWE-306"},{"id":"CVE-2026-111660","p":1792174667570,"x":"waynboot-mall through 2.0.0 contains a missing authentication vulnerability that allows unauthenticated attackers to cancel any member's pending order via the /callback/order/unpaid endpoint. Attackers can submit predictable orderSn values, built from epoch seconds and a sequential counter, to auto-cancel unpaid…","s":6.5,"v":"MEDIUM","cwe":"CWE-306"},{"id":"CVE-2026-111659","p":1792174667367,"x":"Waynboot-mall through 2.0.0 contains a missing authentication vulnerability that allows unauthenticated attackers to forge orders by calling the internal /callback/order/submit message-queue callback. Attackers can supply arbitrary userId, addressId and cart ids in the order JSON to create orders for any member,…","s":6.5,"v":"MEDIUM","cwe":"CWE-306"},{"id":"CVE-2026-111658","p":1792174667227,"x":"SiteServer SSCMS through 7.4.0 contains an authorization bypass vulnerability in ChannelsController that allows site-scoped administrators to access other sites' channels by supplying foreign channel IDs. Attackers with Channels permission on one site can read and overwrite another site's channel names, file paths,…","s":3.8,"v":"LOW","cwe":"CWE-639"},{"id":"CVE-2026-111657","p":1792174667083,"x":"BeikeShop through 2.0.0.31 contains an insecure direct object reference vulnerability in the markAsShipped handler of RmaController that allows authenticated customers to modify other customers' returns. Attackers can submit sequential RMA ids to the account/rmas/{id}/mark_as_shipped endpoint to overwrite courier…","s":4.3,"v":"MEDIUM","cwe":"CWE-639"},{"id":"CVE-2026-111656","p":1792174666940,"x":"ChatWiki through 2.9.6 contains an insecure direct object reference vulnerability that allows authenticated users to access another tenant's form filters by supplying arbitrary form_id values. Attackers can send sequential form_id values to getFormFilterList, getFormFilterInfo and updateFormFilterSort to read filter…","s":5.4,"v":"MEDIUM","cwe":"CWE-639"},{"id":"CVE-2026-111655","p":1792174666803,"x":"ThinkAdmin think-plugs-admin through 1.0.81 contains an insecure direct object reference vulnerability that allows non-super administrators to read and overwrite other administrators' file records via admin/file.edit. Attackers holding the admin/file.edit node can request or POST a target id with columns like xurl,…","s":3.8,"v":"LOW","cwe":"CWE-639"},{"id":"CVE-2026-111654","p":1792174666660,"x":"FastBee through 2.1.0 contains an insecure direct object reference vulnerability that allows authenticated low-privilege users to access other users' device groups because GroupController queries lack owner checks. Attackers, including self-registered users, can supply sequential group IDs to read, overwrite,…","s":6.3,"v":"MEDIUM","cwe":"CWE-639"},{"id":"CVE-2026-111653","p":1792174666513,"x":"53AIHub through 0.5.3 contains a missing authentication vulnerability that allows unauthenticated attackers to overwrite any enterprise's profile by sending PUT requests to /api/enterprises/:id. Because UpdateEnterprise only enforces checks when IS_SAAS is true, attackers can enumerate sequential enterprise IDs and…","s":5.3,"v":"MEDIUM","cwe":"CWE-306"},{"id":"CVE-2026-111652","p":1792174666360,"x":"Engineercms through 2.0.5 contains a missing authorization vulnerability in AttachController.Attachment that allows unauthenticated attackers to download project image and video attachments. Attackers can request known or derived /attachment/* paths for .jpg, .png, .bmp, or .mp4 files, which are served before casbin,…","s":5.3,"v":"MEDIUM","cwe":"CWE-862"},{"id":"CVE-2026-111651","p":1792174666217,"x":"Risesoft Digital-Infrastructure through 9.6.11 contains a missing authorization vulnerability in the log module DownloadController that allows authenticated users to export any tenant's personnel directory. Attackers can supply another tenant's tenantId to exportLoginXLS or exportNotLoginXLS to obtain XLSX files with…","s":6.5,"v":"MEDIUM","cwe":"CWE-639"},{"id":"CVE-2026-111650","p":1792174666047,"x":"ChronoFrame through 1.0.0 contains a missing authentication vulnerability in the server/api/wizard/ handlers that allows unauthenticated attackers to reconfigure already configured instances. Attackers can POST to /api/wizard/storage to activate an attacker-controlled S3 or OpenList provider, redirecting uploads and…","s":8.6,"v":"HIGH","cwe":"CWE-306"},{"id":"CVE-2026-111649","p":1792174665897,"x":"Rocboss paopao-ce through 0.6.0-alpha.3 contains an insecure direct object reference vulnerability in DownloadAttachment that allows authenticated users to access private media by supplying arbitrary content IDs. Attackers can enumerate sequential post_content ids via the /v1/attachment endpoint to obtain signed…","s":6.5,"v":"MEDIUM","cwe":"CWE-639"},{"id":"CVE-2026-111648","p":1792174665753,"x":"BuildAdmin through 2.3.9 contains an insecure direct object reference vulnerability that allows authenticated backend administrators to modify other administrators' profiles via the id parameter. Attackers holding the routine/adminInfo/edit permission can overwrite avatar, nickname, email, mobile and motto fields,…","s":2.7,"v":"LOW","cwe":"CWE-639"},{"id":"CVE-2026-111647","p":1792174665597,"x":"PickMall lilishop through 5.0.0 contains an insecure direct object reference vulnerability that allows authenticated buyers to read other buyers' invoice records because ReceiptServiceImpl.getDetail performs no ownership check. Attackers can supply another buyer's receipt id to GET /buyer/trade/receipt/{id} to obtain…","s":4.3,"v":"MEDIUM","cwe":"CWE-639"},{"id":"CVE-2026-111646","p":1792174665440,"x":"SurveyKing before 1.13.0 contains a missing authorization vulnerability that allows unauthenticated attackers to download any stored file by id through GET /api/public/preview/{attachmentId}. Attackers who know or derive time-ordered snowflake file ids can bypass shared, owner, and project checks in…","s":5.9,"v":"MEDIUM","cwe":"CWE-862"},{"id":"CVE-2026-111645","p":1792174665303,"x":"MrDoc through 1.1.1 contains a missing object-level authorization vulnerability in the ImportLocalDoc API that allows authenticated users to modify other users' documents and projects. Attackers can send PUT requests with arbitrary sort_data document ids to publish private drafts and reparent documents, or POST with…","s":5.4,"v":"MEDIUM","cwe":"CWE-639"},{"id":"CVE-2026-111644","p":1792174665160,"x":"Misaka Danmu Server through 2.8.9 contains a missing authentication vulnerability that allows unauthenticated attackers to access audit, diagnostics, data-check, scan-index and health routes under /api/ui lacking the get_current_user dependency. Attackers can read audit logs with login IPs, server logs and environment…","s":7.3,"v":"HIGH","cwe":"CWE-306"},{"id":"CVE-2026-111643","p":1792174665013,"x":"Misaka Danmu Server through 2.8.9 contains an authentication bypass vulnerability that allows unauthenticated attackers to write arbitrary configuration keys via the unprotected POST /api/ui/config-history/rollback endpoint. Attackers can set the ipWhitelist key to their own /32 address, or alter trustedProxies and…","s":9.8,"v":"CRITICAL","cwe":"CWE-306"},{"id":"CVE-2026-111642","p":1792174664877,"x":"FastapiAdmin through 3.0 contains a hard-coded JWT signing secret in backend/app/config/setting.py that allows low-privileged users to forge tokens impersonating the superuser. Attackers can register via the unauthenticated /api/v1/system/user/register endpoint, log in, and forge an HS256 token keeping their…","s":8.8,"v":"HIGH","cwe":"CWE-321"},{"id":"CVE-2026-111641","p":1792174664730,"x":"FastapiAdmin through 3.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to obtain sessions for any user by abusing unprotected auto-login endpoints. Attackers can list users via /api/v1/auth/auto-login/users, mint a superuser auto-login token, and exchange it for a JWT session to…","s":9.8,"v":"CRITICAL","cwe":"CWE-306"},{"id":"CVE-2026-111640","p":1792174664587,"x":"DooTask through 1.9.66 contains a missing authorization vulnerability in WebSocketDialog::checkDialog() that skips the membership check for dialogs with group_type 'okr'. Authenticated users can supply the dialog_id of OKR comment dialogs to msg__list, msg__one, or msg__send* endpoints to read and inject messages.","s":5.4,"v":"MEDIUM","cwe":"CWE-639"},{"id":"CVE-2026-111639","p":1792174664447,"x":"bbs-go through 4.4.6 contains an authentication bypass vulnerability in the /api/login/google_one_tap endpoint that allows remote attackers to log in as other users by submitting Google ID tokens issued to any OAuth client. Attackers operating their own Google OAuth client can capture a victim's Google-signed ID token…","s":8.1,"v":"HIGH","cwe":"CWE-287"},{"id":"CVE-2026-111638","p":1792174664297,"x":"sshportal through 1.19.5 contains a missing authorization vulnerability in the management shell 'key show' command that allows authenticated non-admin users to obtain decrypted backend private SSH keys. Attackers can request predictable key names like 'default' or 'host' to retrieve private keys and connect directly…","s":7.7,"v":"HIGH","cwe":"CWE-862"},{"id":"CVE-2026-111637","p":1792174664157,"x":"NexoPOS through 6.2.4 contains a missing authentication vulnerability that allows unauthenticated attackers to read accounting transaction records via GET /api/fields/{resource}/{identifier}. Attackers can request transaction field classes like ns.entity-transaction with sequential ids to retrieve names, values,…","s":5.3,"v":"MEDIUM","cwe":"CWE-306"},{"id":"CVE-2026-111636","p":1792174664010,"x":"OpenBMB StaffDeck through 0.5.6 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge administrator session tokens using the hard-coded default app_secret. Attackers can sign an HMAC-SHA256 token for the seeded 'admin' user in 'tenant_demo' to gain full tenant administration,…","s":8.1,"v":"HIGH","cwe":"CWE-321"},{"id":"CVE-2026-111635","p":1792174663883,"x":"Helical Insight through 7.0.0 contains a path traversal vulnerability that allows authenticated viewers to read files outside the solution directory via the path parameter of /getExternalResource. Attackers can supply parent-directory segments to read any readable file with an allowed extension such as js, json, or…","s":4.3,"v":"MEDIUM","cwe":"CWE-22"},{"id":"CVE-2026-111634","p":1792174663750,"x":"Helical Insight through 7.0.0 contains an sql injection vulnerability that allows authenticated viewers to inject SQL through unescaped report parameter values sent to /executeDatasource. Attackers can supply crafted Numeric or String placeholder values that bypass the broken SqlDetect guard to read unexposed tables…","s":8.1,"v":"HIGH","cwe":"CWE-89"},{"id":"CVE-2026-111633","p":1792174663607,"x":"ZKEACMS through 4.4 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge REST API JWT bearer tokens using a hard-coded HMAC-SHA256 signing key in JwtBearerDefaults.cs. Attackers can sign a token with the Name claim set to 'admin' to call ApiAuthorize endpoints, modifying…","s":8.6,"v":"HIGH","cwe":"CWE-321"},{"id":"CVE-2026-111632","p":1792174663470,"x":"Aureus ERP through 1.6.0 contains an authorization bypass vulnerability that allows authenticated API users to create or move records into disallowed companies by supplying a foreign company_id. Attackers can submit create or update requests to plugin REST API endpoints such as partners, sales, or inventories to break…","s":5.4,"v":"MEDIUM","cwe":"CWE-639"},{"id":"CVE-2026-111631","p":1792174663330,"x":"Distributor before 2.3.2 contains a missing authorization vulnerability that allows Contributor-level users to invoke external connection AJAX actions intended for manage_options users. Attackers can call dt_verify_external_connection with a chosen endpointId and url to send stored connection credentials to…","s":5.4,"v":"MEDIUM","cwe":"CWE-862"},{"id":"CVE-2026-111630","p":1792174663190,"x":"abp-next-admin 10.2.0 through 10.6.0 contains an insecure direct object reference vulnerability in the LINGYUN.Abp.AIManagement module that allows authenticated users to access other users' AI chat conversations by supplying their ConversationId. Attackers holding the Chat permission can call…","s":5.4,"v":"MEDIUM","cwe":"CWE-639"},{"id":"CVE-2026-111629","p":1792174663043,"x":"IoTSharp through 3.6.1 contains an insecure direct object reference vulnerability that allows any authenticated user to read other tenants' data because Customers and Devices API handlers do not scope queries to the caller's tenant. Attackers can self-register through the anonymous AccountController.Create endpoint…","s":4.3,"v":"MEDIUM","cwe":"CWE-639"},{"id":"CVE-2026-111628","p":1792174662907,"x":"10up Distributor before 2.3.2 contains a PHP object injection vulnerability that allows Contributor-level users to instantiate PHP objects by double unserializing distributed post meta. Attackers can store a serialized PHP string as meta, which set_meta() in includes/utils.php unserializes on the destination site,…","s":5,"v":"MEDIUM","cwe":"CWE-502"},{"id":"CVE-2026-111627","p":1792174662760,"x":"HestiaCP before 1.10.5 contains an authorization bypass vulnerability that allows non-ROOT_USER administrators to perform write actions while impersonating the protected ROOT_USER account. Attackers can log in via the loginas parameter and POST to /add/cron/, because the read-only flag is never checked, causing crond…","s":7.2,"v":"HIGH","cwe":"CWE-863"},{"id":"CVE-2026-111626","p":1792174662583,"x":"Webreaper Damselfly through 4.5.3 contains an authentication bypass vulnerability that allows unauthenticated attackers to access all /api/* routes because controller authorization attributes are commented out. Attackers can send PUT /api/users with Admin roles to create administrator accounts, or POST /api/users to…","s":9.8,"v":"CRITICAL","cwe":"CWE-306"},{"id":"CVE-2026-111625","p":1792174662437,"x":"10up Distributor before 2.3.2 contains a missing authorization vulnerability in ajax_push() that allows Contributor-level multisite users to publish posts on other network sites. Attackers can use the dt-push nonce with a chosen connection id and postStatus to create draft or published posts on sites they cannot…","s":5,"v":"MEDIUM","cwe":"CWE-862"},{"id":"CVE-2026-111624","p":1792174662280,"x":"Umbraco CMS before 17.7.1 and 18.2.1 contains a missing authorization vulnerability that allows unauthenticated clients to connect to the backoffice PreviewHub and BackofficeHub SignalR hubs. Attackers can complete the SignalR negotiate step and receive refreshed notifications that disclose content keys, including…","s":3.7,"v":"LOW","cwe":"CWE-306"},{"id":"CVE-2026-111623","p":1792174662133,"x":"Xiaozhi-esp32-server-java through 6.1.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to obtain valid device WebSocket tokens by requesting /api/device/ota with any MAC address. Attackers can open a victim device's WebSocket channel to read private role system prompts, write…","s":5.6,"v":"MEDIUM","cwe":"CWE-290"},{"id":"CVE-2026-111622","p":1792174661980,"x":"smart-sso through 2.1.1 contains an open redirect vulnerability in the /login handler that allows unauthenticated attackers to steal OAuth2 authorization codes by supplying an unvalidated redirectUri parameter. Attackers can send crafted /login links to users with active SSO sessions, then redeem stolen codes at…","s":6.8,"v":"MEDIUM","cwe":"CWE-601"},{"id":"CVE-2026-111621","p":1792174661837,"x":"TDuck Survey Form through 5.3 contains a missing authorization vulnerability that allows any authenticated user to read other owners' raw form settings via GET /user/form/setting/{key}. Attackers can supply the 8-character form key from a public fill link to obtain the form write password, owner notification e-mail,…","s":4.3,"v":"MEDIUM","cwe":"CWE-639"},{"id":"CVE-2026-111620","p":1792174661690,"x":"O2OA through 10.0.2-ce contains an authorization bypass vulnerability in x_processplatform_assemble_surface that allows authenticated users to download attachments from other works. ActionDownloadWithWork and ActionDownloadWithWorkStream never verify that the requested attachment id belongs to the referenced work or…","s":5.3,"v":"MEDIUM","cwe":"CWE-639"},{"id":"CVE-2026-111619","p":1792174661540,"x":"FilePress through 3.0.1 contains an sql injection vulnerability that allows authenticated low-privilege users to inject SQL into ORDER BY clauses via the unvalidated asc parameter. Attackers can use blind boolean or time-based subqueries in dzz/pichome/library/filelist.php and dzz/collection/filelist.php to extract…","s":6.5,"v":"MEDIUM","cwe":"CWE-89"},{"id":"CVE-2026-111618","p":1792174661393,"x":"CoAI (Chat Nio) through 4.0.0 contains an unauthenticated path traversal vulnerability in the generation and article archive download endpoints via the hash query parameter. Attackers can supply ../ sequences in hash to download any readable .tar.gz or .zip file, including other users' generated archives.","s":5.3,"v":"MEDIUM","cwe":"CWE-22"},{"id":"CVE-2026-111617","p":1792174661250,"x":"WHartTest through 2.8.1 contains a missing authentication vulnerability that allows unauthenticated attackers to connect to the /ws/ui/web/ and /ws/ui/actuator/ WebSocket endpoints because UiAutomationConsumer accepts every connection. Attackers can register an actuator with a client-supplied id to intercept other…","s":6.5,"v":"MEDIUM","cwe":"CWE-306"},{"id":"CVE-2026-111616","p":1792174661113,"x":"Oqtane Framework through 10.2.6 contains an authorization bypass vulnerability in SettingController that allows a site administrator to read another co-tenant site's private settings. Attackers with the Administrators role on one site can request another site's entityId through their own alias to retrieve stored…","s":4.9,"v":"MEDIUM","cwe":"CWE-639"},{"id":"CVE-2026-111615","p":1792174660977,"x":"Mall4cloud through 4.0 contains an insecure direct object reference vulnerability that allows authenticated merchants to read other shops' buyer shipping addresses via the multishop OrderController getOrderAddr handler. Attackers can enumerate auto-increment orderAddrId values in GET /m/order/order_addr/{orderAddrId}…","s":6.5,"v":"MEDIUM","cwe":"CWE-639"},{"id":"CVE-2026-111614","p":1792174660833,"x":"DataCap through 2025.1.1 contains an insecure direct object reference vulnerability in BaseController.getInfoForPath that allows authenticated users to read other users' datasources, snippets and dashboards by numeric id. Low-privileged attackers can enumerate auto-increment ids on the source, snippet and dashboard…","s":6.5,"v":"MEDIUM","cwe":"CWE-639"},{"id":"CVE-2026-111613","p":1792174660680,"x":"AllData through 0.7.1 contains an unauthenticated JDBC injection vulnerability that allows remote attackers to open arbitrary database connections by supplying jdbcUrl and jdbcDriverClass values to the data-dts /jobJdbcDatasource/test endpoint. Attackers can supply a MySQL JDBC URL with allowLoadLocalInfile=true…","s":7.5,"v":"HIGH","cwe":"CWE-306"},{"id":"CVE-2026-111612","p":1792174660533,"x":"netdisk-fast-download through 0.4.8 contains an information disclosure vulnerability that allows unauthenticated attackers to retrieve donated netdisk credentials via the /v2/randomAuth endpoint in ParserApi. Attackers can repeatedly call the endpoint and decrypt the encryptedAuth blob using the hard-coded AES key…","s":7.5,"v":"HIGH","cwe":"CWE-321"},{"id":"CVE-2026-111611","p":1792174660383,"x":"roncoo-education through 25.0.0-RELEASE contains an insecure direct object reference vulnerability that allows authenticated users to cancel or continue payment on other users' orders. Attackers can supply another user's order number to the pay cancel or continue endpoints to close pending orders or read course ids…","s":5.4,"v":"MEDIUM","cwe":"CWE-639"},{"id":"CVE-2026-111610","p":1792174660240,"x":"B3log Solo through 4.4.0 contains a missing authorization vulnerability in ArticleConsole that allows authenticated authors to access other authors' articles by omitting per-author ownership checks. Attackers can query the console articles status endpoint to list other authors' drafts, probe draft content via the k…","s":5.4,"v":"MEDIUM","cwe":"CWE-639"},{"id":"CVE-2026-111609","p":1792174660103,"x":"PKP Open Journal Systems through 3.5.0-5 contains an insecure direct object reference vulnerability that allows journal or subscription managers to access other journals' subscriptions by supplying arbitrary subscription ids. Attackers can enumerate sequential ids through editSubscription to view subscriber details…","s":3.8,"v":"LOW","cwe":"CWE-639"},{"id":"CVE-2026-111608","p":1792174659957,"x":"Jeepay through 3.2.9 contains an insecure direct object reference vulnerability that allows authenticated merchant users to delete other merchants' division receivers by exploiting an ownership check on the wrong column. Attackers holding ENT_DIVISION_RECEIVER_DELETE who own a receiver group whose id matches a…","s":4.2,"v":"MEDIUM","cwe":"CWE-639"},{"id":"CVE-2026-111607","p":1792174659813,"x":"Jeepay through 3.2.9 contains an insecure direct object reference vulnerability that allows authenticated merchant users to overwrite another merchant application's payment channel configuration by supplying a victim infoId to MchPayInterfaceConfigController.saveOrUpdate. Attackers holding the default…","s":7.1,"v":"HIGH","cwe":"CWE-639"},{"id":"CVE-2026-111606","p":1792174659647,"x":"Huly Platform through 0.7.432 contains a missing authorization vulnerability that allows any authenticated user to merge arbitrary persons by calling the mergeSpecifiedPersons account RPC. Attackers knowing two person UUIDs can graft attacker-controlled unverified social ids onto a victim person, then use login or…","s":8.1,"v":"HIGH","cwe":"CWE-862"},{"id":"CVE-2026-111605","p":1792174659490,"x":"Jpom through 2.11.12 contains an authorization bypass vulnerability in SshFileController that allows authenticated workspace users to access SSH hosts belonging to other workspaces by supplying foreign SSH asset ids. Attackers with SSH file permissions in any workspace can call download, upload, read_file_data.json,…","s":8.1,"v":"HIGH","cwe":"CWE-639"},{"id":"CVE-2026-111604","p":1792174659367,"x":"eladmin through 2.7 contains an authorization bypass vulnerability that allows department-scoped user managers to modify or delete accounts outside their data scope because write handlers skip department checks. Attackers with user:edit or user:del permissions can send PUT or DELETE requests to /api/users with target…","s":3.8,"v":"LOW","cwe":"CWE-639"},{"id":"CVE-2026-111603","p":1792174659220,"x":"PlayEdu through 2.3 contains a missing authorization vulnerability in the CourseController that allows authenticated students to access department-restricted courses by omitting the department visibility check. Attackers can enumerate sequential course and attachment IDs via the course details and attachment download…","s":4.3,"v":"MEDIUM","cwe":"CWE-639"},{"id":"CVE-2026-111392","p":1792174658950,"x":"SGLang through 0.5.21 trusts caller-supplied mm_hashes values as the multimodal prefix-cache key, allowing remote attackers to poison cached KV entries across requests. Attackers can send a different image under a known or predicted hash via /generate to disclose another request's image content or corrupt victims'…","s":4.8,"v":"MEDIUM","cwe":"CWE-345"},{"id":"CVE-2026-109839","p":1792174651713,"x":"IBM Db2 Genius Hub 1.0 could allow a remote authenticated attacker to bypass security restrictions due to a missing initialization vector in the cryptographic algorithm.","s":3.1,"v":"LOW","cwe":"CWE-325"},{"id":"CVE-2026-109838","p":1792174651587,"x":"IBM Db2 Genius Hub 1.0 could allow a local attacker to obtain sensitive information due to improper verification of cryptographic signature.","s":5.1,"v":"MEDIUM","cwe":"CWE-347"},{"id":"CVE-2026-109588","p":1792174651457,"x":"Numeric truncation of the buffer length in the MPU buffer authorization check in FreeRTOS-Kernel V11.3.0 and V11.3.1 on the Arm Cortex-R82 (Armv8-R AArch64) MPU port might allow, under certain conditions, an unprivileged task on MPU-enabled builds to read or write privileged kernel memory beyond the validated buffer…","s":8.8,"v":"HIGH","cwe":"CWE-125"},{"id":"CVE-2026-109587","p":1792174651330,"x":"Incorrect authorization in the Arm Cortex-R82 (Armv8-R AArch64) MPU port in FreeRTOS-Kernel V11.3.0 and V11.3.1 might allow an unprivileged task on MPU-enabled builds to read and write privileged kernel memory outside the regions assigned to it, via a buffer argument passed to an MPU system call.\n\n\n\nTo remediate this…","s":8.8,"v":"HIGH","cwe":"CWE-863"},{"id":"CVE-2026-109461","p":1792174651150,"x":"Origin validation error in Microsoft Authentication Library (MSAL) for Node.js allows an unauthorized attacker to disclose information over a network.","s":5.9,"v":"MEDIUM","cwe":"CWE-346"},{"id":"CVE-2026-102552","p":1792174634893,"x":"Improper verification of the source of a communication channel in the DNS resolver in Amazon FreeRTOS-Plus-TCP before V4.4.2 might allow remote third-party to insert a chosen address into the device's DNS cache via a forged DNS reply.\n\n\n\nTo remediate this issue, users should upgrade to version V4.4.2 and enable…","s":5.9,"v":"MEDIUM","cwe":"CWE-940"},{"id":"CVE-2026-102551","p":1792174634750,"x":"Improper verification of the source of a communication channel in the IPv6 Router Advertisement handler in Amazon FreeRTOS-Plus-TCP before V4.4.2 might allow a remote third-party to influence an endpoint's IPv6 default gateway, on-link prefix, and address configuration via a crafted Router Advertisement.\n\n\n\nTo…","s":7.7,"v":"HIGH","cwe":"CWE-940"},{"id":"CVE-2026-97380","p":1792171082013,"x":"MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the GRANT PROXY statement treats an IDENTIFIED clause with an empty password as though authentication were not specified, causing it to check the wrong grantor privileges. A…","s":8.8,"v":"HIGH","cwe":"CWE-620"},{"id":"CVE-2026-92262","p":1792171072710,"x":"MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the #mysql50# bypass prefix is affected because it allows the #mysql50# prefix to bypass normal table-name filesystem encoding. An attacker can trigger the issue with a table name…","s":9.9,"v":"CRITICAL","cwe":"CWE-706"},{"id":"CVE-2026-86047","p":1792171072063,"x":"MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, SHOW CREATE SERVER, SHOW CREATE USER, and mariadb-dump are affected because each does not consistently quote identifiers and values when serializing SQL. A low-privileged attacker can…","s":7.7,"v":"HIGH","cwe":"CWE-89"},{"id":"CVE-2026-86009","p":1792171071920,"x":"Mailu is a mail server distributed as a set of Docker images. Prior to f05aeb8322e2f61096af6b089d61ba6f40587d96, domain managers can enable spoofing for hosted domains they do not control. A potentially malicious domain administrator enables spoofing for another hosted domain and can send emails that are authenticated…","s":8.2,"v":"HIGH","cwe":"CWE-285"},{"id":"CVE-2026-86008","p":1792171071753,"x":"Mailu is a mail server distributed as a set of Docker images. Prior to 8577c929b4ade04d3cd4210cf036601abd793556, a domain manager targeting an administrative account or another domain manager with greater privileges can reset passwords or obtain tokens for that account. This authorization failure allows a domain…","s":7.2,"v":"HIGH","cwe":"CWE-269"},{"id":"CVE-2026-85985","p":1792171071620,"x":"MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the CONNECT engine plugin file-access UDFs json_file(), bson_file(), jfile_make(), bfile_make(), and jbin_file() are affected because each does not enforce FILE privilege or the…","s":5.4,"v":"MEDIUM","cwe":"CWE-862"},{"id":"CVE-2026-85748","p":1792171071303,"x":"MariaDB server is a community developed fork of MySQL server. From 12.3.1 until 12.3.3 and 13.0.2, SYS_REFCURSOR handling is affected because cursor-array reallocation can leave stale references in routine contexts. A low-privileged attacker can open a large number of SYS_REFCURSORs and then fetch one to trigger a…","s":9.9,"v":"CRITICAL","cwe":"CWE-416"},{"id":"CVE-2026-85746","p":1792171071167,"x":"MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, ST_AsText can write beyond an allocated output buffer when converting deeply nested GeometryCollections because recursive WKT serialization does not account for bytes consumed or…","s":9.9,"v":"CRITICAL","cwe":"CWE-787"},{"id":"CVE-2026-85745","p":1792171071020,"x":"MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, ST_Area reads beyond the allocated buffer when processing invalid WKB for a MultiPolygon because the multi-polygon parser advances past a nested geometry header without first…","s":4.3,"v":"MEDIUM","cwe":"CWE-126"},{"id":"CVE-2026-77474","p":1792171070390,"x":"destructive_command_guard (dcg) is a command-line safety tool that blocks destructive shell commands before AI coding agents run them. Prior to 0.6.6, nested or unclosed substitutions are recursively rescanned after an inner scan returns unterminated, producing exponential-time work. The affected scanners are reached…","s":7.1,"v":"HIGH","cwe":"CWE-400"},{"id":"CVE-2026-62362","p":1792171055720,"x":"PeerBanHelper automatically blocks unwanted, leeching, and abnormal BitTorrent peers using customizable and cloud rules. From 5.0.0 until 9.3.15, the /api/statistic/analysis/field endpoint accepts a crafted field query parameter from an authenticated user and passes it to countField or sumField. The mapField() method…","s":4.9,"v":"MEDIUM","cwe":"CWE-89"},{"id":"CVE-2026-59967","p":1792171055507,"x":"Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.10, looks up BookmarkletImport by sequential primary key within the active Space without restricting created_by to the requesting user when an authenticated member of a shared Space submits another…","s":5.4,"v":"MEDIUM","cwe":"CWE-639"},{"id":"CVE-2026-59962","p":1792171055343,"x":"Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.10, passes unvalidated sort_order and order_field strings into Django ORM order_by() calls when an authenticated user supplies foreign-key traversal paths in recipe search, RecipeBook, or stored…","s":6.5,"v":"MEDIUM","cwe":"CWE-943"},{"id":"CVE-2026-57169","p":1792171055113,"x":"Dockhand is a Docker management application. Prior to 1.0.34, the in-browser container terminal endpoint /api/containers/<id>/exec does not enforce authentication on the WebSocket upgrade request. When an unauthenticated attacker has network reach to Dockhand, knows a target container ID, and targets a container with…","s":9.6,"v":"CRITICAL","cwe":"CWE-306"},{"id":"CVE-2026-49868","p":1792171054963,"x":"RIOT is an open-source microcontroller operating system designed for Internet of Things devices and other embedded systems. Prior to 2026.07, _parse_reply() in sys/net/application_layer/dhcpv6/client.c omits minimum-length validation before passing IA_PD and IA_NA option bodies to sub-option parsers. A malicious or…","s":9.8,"v":"CRITICAL","cwe":"CWE-125"},{"id":"CVE-2026-102693","p":1792171037173,"x":"RIOT is an open-source microcontroller operating system designed for Internet of Things devices and other embedded systems. Prior to 2026.04, the ATWINC15x0 driver's _atwinc15x0_sta_set_current_ssid function uses strcpy to copy an SSID without checking the destination size. When MODULE_ATWINC15X0_DYNAMIC_CONNECT is…","s":9.6,"v":"CRITICAL","cwe":"CWE-120"},{"id":"CVE-2026-102692","p":1792171036980,"x":"RIOT is an open-source microcontroller operating system designed for Internet of Things devices and other embedded systems. Prior to 2026.07, nanocoap accepts oversized CoAP Block2 option values without enforcing the 20-bit maximum block number, allowing block offset multiplication to overflow on 32-bit targets. The…","s":9.1,"v":"CRITICAL","cwe":"CWE-190"},{"id":"CVE-2026-96425","p":1792167772693,"x":"Incorrect DBus policy for lomiri-download-manager allows arbitrary user to run arbitrary command as root over DBus","s":5.5,"v":"MEDIUM","cwe":"CWE-732"},{"id":"CVE-2026-96424","p":1792167772560,"x":"Incorrect DBus policy for lomiri-upload-manager (part of lomiri-download-manager) allows arbitrary user to read arbitrary file as root over DBus","s":7.8,"v":"HIGH","cwe":"CWE-732"},{"id":"CVE-2026-95859","p":1792167764400,"x":"libp2p-rust is the official Rust language implementation of the libp2p networking stack. Prior to 0.49.5, Gossipsub GRAFT control-message handling unconditionally adds attacker-supplied topic hashes to connected_peer.topics without confirming that the peer previously subscribed to those topics. A remote…","s":8.7,"v":"HIGH","cwe":"CWE-770"},{"id":"CVE-2026-92263","p":1792167763027,"x":"SparkyFitness is a self-hosted, AI-powered health and fitness tracker for families. Prior to 1.6.0, the api/admin/backup/restore endpoint interpolates an uploaded filename into a shell command. An authenticated global administrator uploads a restore archive with a crafted filename. The administrator can supply a…","s":7.2,"v":"HIGH","cwe":"CWE-78"},{"id":"CVE-2026-77630","p":1792167663187,"x":"pupnp is an SDK for development of UPnP device and control point applications. Prior to 22.0.4, parse_hostport in upnp/src/genlib/net/uri/uri.c synchronously calls getaddrinfo while parse_uri is processing attacker-supplied hostnames from inbound HTTP request targets in upnp/src/genlib/net/http/httpparser.c and GENA…","s":7.5,"v":"HIGH","cwe":"CWE-400"},{"id":"CVE-2026-68908","p":1792167601140,"x":"libIEC61850 is an open-source implementation of IEC 61850 client and server protocols including MMS, GOOSE, Sampled Values, and R-Session. Prior to 1.6.2, Reporting_RCBWriteAccessHandler accepts an RptID longer than 129 bytes in the report-control-block write path. When GI later causes sendNextReportEntrySegment to…","s":5.3,"v":"MEDIUM","cwe":"CWE-590"},{"id":"CVE-2026-68907","p":1792167600960,"x":"libIEC61850 is an open-source implementation of IEC 61850 client and server protocols including MMS, GOOSE, Sampled Values, and R-Session. Prior to 1.6.2, checkDataSetAccess reverses the source and destination arguments to StringUtils_copyStringToBuffer while constructing an MMS_ASSOCIATION_SPECIFIC dataset reference.…","s":8.2,"v":"HIGH","cwe":"CWE-125"},{"id":"CVE-2026-68906","p":1792167600793,"x":"libIEC61850 is an open-source implementation of IEC 61850 client and server protocols including MMS, GOOSE, Sampled Values, and R-Session. Prior to 1.6.2, parseUserInformation in src/mms/iso_acse/acse.c checks len for zero before validating the negative bufPos returned by BerDecoder_decodeLength for a truncated…","s":8.7,"v":"HIGH","cwe":"CWE-125"},{"id":"CVE-2026-57488","p":1792167524823,"x":"pupnp is an SDK for development of UPnP device and control point applications. Prior to 2.0.2, raw_to_int in upnp/src/genlib/net/http/httpparser.c parses Content-Length with strtol and casts the resulting long to a 32-bit int before the caller stores it as unsigned int. On LP64 systems, values greater than INT_MAX can…","s":7.1,"v":"HIGH","cwe":"CWE-190"},{"id":"CVE-2026-57487","p":1792167524663,"x":"pupnp is an SDK for development of UPnP device and control point applications. Prior to 2.0.2, Transfer-Encoding: chunked causes the HTTP parser in upnp/src/genlib/net/http/httpparser.c to leave parser->content_length at zero while parser_parse_chunky_entity and parser_parse_chunky_body accumulate decoded bytes in…","s":7.5,"v":"HIGH","cwe":"CWE-770"},{"id":"CVE-2026-57486","p":1792167524510,"x":"pupnp is an SDK for development of UPnP device and control point applications. Prior to 2.0.2, ixmlNode_compare in ixml/src/node.c passes the nullable nodeValue, namespaceURI, prefix, and localName fields directly to strcmp. Non-namespaced attributes created by ixmlDocument_createAttribute legitimately leave those…","s":7.5,"v":"HIGH","cwe":"CWE-476"},{"id":"CVE-2026-57447","p":1792167524357,"x":"Discourse Doc Categories is a plugin for organizing Discourse topics as documentation. Prior to the verified source fix, the doc category index refresh resolves linked titles for private messages or restricted category topics without enforcing the viewer's authorization. A user who can edit the index topic can use…","s":4.3,"v":"MEDIUM","cwe":"CWE-200"},{"id":"CVE-2026-57446","p":1792167524207,"x":"libIEC61850 is an open-source implementation of IEC 61850 client and server protocols including MMS, GOOSE, Sampled Values, and R-Session. From 1.6.1 until 1.6.2, a successful MMS ObtainFile operation closes MmsObtainFileTask::fileHandle but leaves the stale non-NULL value in a task marked…","s":5.3,"v":"MEDIUM","cwe":"CWE-415"},{"id":"CVE-2026-55862","p":1792167524060,"x":"pupnp is an SDK for development of UPnP device and control point applications. Prior to 2.0.0, multiple ixml DOM traversal functions process deeply nested XML with unbounded recursion. The iterative XML parser accepts the document, but ixmlPrintDomTreeRecursive in ixml/src/ixml.c and…","s":6.5,"v":"MEDIUM","cwe":"CWE-674"},{"id":"CVE-2026-55836","p":1792167523897,"x":"Open Zaak is an open-source data and services layer for Dutch case-oriented working. From 1.13.0 until 1.27.2, 1.28.2, and 1.29.0, _import_document_row in src/openzaak/components/documenten/tasks.py uses the attacker-controlled bestandspad CSV field without ensuring that the resolved path remains under…","s":6.8,"v":"MEDIUM","cwe":"CWE-200"},{"id":"CVE-2026-55543","p":1792167523750,"x":"TuxGuitar is an open-source guitar tablature editor. Prior to 2.1.0, an untrusted .tg file can set gervil.soundbank.path to reference an on-disk archive, including the .tg file itself, whose META-INF/services/javax.sound.midi.Soundbank entry names an attacker-supplied class stored in that archive. When a user opens…","s":8.5,"v":"HIGH","cwe":"CWE-94"},{"id":"CVE-2026-54657","p":1792167523590,"x":"Open Zaak is an open-source data and services layer for Dutch case-oriented working. From 1.0.0 until 1.27.2, 1.28.2, and 1.29.0, the POST search endpoints /zaken/api/v1/zaken/_zoek and /documenten/api/v1/enkelvoudiginformatieobjecten/_zoek do not filter result querysets according to the authorizations associated with…","s":6.5,"v":"MEDIUM","cwe":"CWE-285"},{"id":"CVE-2026-48741","p":1792167491943,"x":"libIEC61850 is an open-source implementation of IEC 61850 client and server protocols including MMS, GOOSE, Sampled Values, and R-Session. Prior to 1.6.2, alternateArrayAccess in src/mms/iso_mms/server/mms_read_service.c does not validate an alternate-access sub-array range when numberOfElements is greater than zero.…","s":7.5,"v":"HIGH","cwe":"CWE-129"},{"id":"CVE-2026-48503","p":1792167491793,"x":"libIEC61850 is an open-source implementation of IEC 61850 client and server protocols including MMS, GOOSE, Sampled Values, and R-Session. Prior to 1.6.2, the MMS file service in src/mms/iso_mms/server/mms_file_service.c accepts an out-of-range initialPosition in fileOpen and stores it in the file-read state. The…","s":7.5,"v":"HIGH","cwe":"CWE-191"},{"id":"CVE-2026-46472","p":1792167491647,"x":"An issue was discovered in GStreamer gst-plugins-good before 1.28.2. While parsing an MP4 file, the isomp4 plugin's qtdemux_parse_chnl function may read past the end of a global array, potentially leading to information disclosure.","s":7.5,"v":"HIGH","cwe":"CWE-125"},{"id":"CVE-2026-46471","p":1792167491513,"x":"An issue was discovered in GStreamer gst-plugins-good before 1.28.2. While parsing an MP4 file, the isomp4 plugin's qtdemux_parse_uuid function may read past the end of a heap-allocated buffer, allowing an attacker to disclose heap memory contents."},{"id":"CVE-2026-44977","p":1792167464483,"x":"countly-server is the server-side part of Countly, a product analytics solution. Prior to 24.05.50 and 25.03.44, plugins/star-rating/api/api.js allows a non-global application administrator to use uploadFeedbackFile to store attacker-controlled active content while trusting the supplied MIME type.…","s":9,"v":"CRITICAL","cwe":"CWE-79"},{"id":"CVE-2026-42270","p":1792167443940,"x":"countly-server is the server-side part of Countly, a product analytics solution. Prior to 24.05.50 and 25.03.44, star-rating/images/ and dashboards/images/screenshots/ are among public image and screenshot routes using the local fs storage backend that call getStream and pipe filesystem streams to HTTP responses…","s":7.5,"v":"HIGH","cwe":"CWE-248"},{"id":"CVE-2026-42269","p":1792167443783,"x":"countly-server is the server-side part of Countly, a product analytics solution. Prior to 24.05.50 and 25.03.44, the authenticated data-migration deletion route in plugins/data_migration/api/api.js passes the user-controlled exportid to clean_up_data without path validation.…","s":8.1,"v":"HIGH","cwe":"CWE-22"},{"id":"CVE-2026-41582","p":1792167443623,"x":"countly-server is the server-side part of Countly, a product analytics solution. Prior to 24.05.50 and 25.03.44, public image and screenshot routes implemented in frontend/express/app.js, plugins/star-rating/frontend/app.js, and plugins/dashboards/frontend/app.js concatenate attacker-controlled wildcard paths without…","s":7.5,"v":"HIGH","cwe":"CWE-22"},{"id":"CVE-2026-26846","p":1792167426357,"x":"Buffer Overflow vulnerability in WEINVEIW CO.,LTD EBPro v.6.10.01.510_20251022 allows a remote attacker to execute arbitrary code via the UtilityManagerEx.exe component"},{"id":"CVE-2026-111581","p":1792167424680,"x":"A flaw was found in libblockdev. The bd_fs_ntfs_set_label() and bd_fs_vfat_set_label() functions pass caller-supplied label values as bare positional arguments to the ntfslabel and fatlabel utilities without end-of-options separators or input validation for values beginning with a dash. This allows a label starting…","s":3.3,"v":"LOW","cwe":"CWE-88"},{"id":"CVE-2026-102941","p":1792167412937,"x":"The package github.com/gomarkdown/markdown is a Go library for parsing Markdown text and rendering as HTML. Prior to 0.0.0-20260724235538-61af6e1e6971, parser.IsSafeURL in parser/parser.go slices url[:nPath] before the len(url) >= nPath guard. A short destination causes a slice-bounds panic when the loop reaches a…","s":7.5,"v":"HIGH","cwe":"CWE-125"},{"id":"CVE-2026-102923","p":1792167412707,"x":"SparkyFitness is a self-hosted, AI-powered health and fitness tracker for families. Prior to 1.6.0, SparkyFitnessServer/services/chatService.ts and SparkyFitnessServer/services/labelScanService.ts do not validate destinations supplied in custom AI service settings. An authenticated user saves a custom AI service URL…","s":5.4,"v":"MEDIUM","cwe":"CWE-918"},{"id":"CVE-2026-97851","p":1792163858490,"x":"The storage status-change REST service allows location records still associated with DICOM instances to be changed to deletion-related states. Changing a location to TO_DELETE causes PurgeStorageScheduler to delete the referenced object from storage even though the corresponding instance record remains in the database.","s":9.1,"v":"CRITICAL","cwe":"CWE-862"},{"id":"CVE-2026-95183","p":1792163857050,"x":"An issue in the context-compaction feature of DeepSeek Harness (dsh) commit c291e796 allows attackers to execute a prompt injection attack via crafted external content."},{"id":"CVE-2026-95182","p":1792163856940,"x":"An untrusted search path in DeepSeek Harness (dsh) commit c291e796 allows attackers to execute arbitrary code via supplying and opening crafted executable files in place of legitimate content.","s":10,"v":"CRITICAL","cwe":"CWE-426"},{"id":"CVE-2026-88755","p":1792163853537,"x":"Z.ai ZCode v3.11.2.6792 was discovered to automatically establish connections with MCP servers declared inside a repository's workspace configuration, possibly allowing attackers to execute arbitrary code via opening a crafted repository.","s":7.8,"v":"HIGH","cwe":"CWE-78"},{"id":"CVE-2026-111728","p":1792163835190,"x":"Seanime v3.7.0 to v3.10.3 contains an argument injection vulnerability reachable through improper authorization, allowing unauthenticated LAN or Tailnet clients to bypass the privileged mediastream settings guard by setting transcodeHwAccel to custom and supplying attacker-controlled decodeFlags and encodeFlags via…","s":5.4,"v":"MEDIUM","cwe":"CWE-88"},{"id":"CVE-2026-107777","p":1792163825977,"x":"Thermo Fisher Torrent Suite Software is vulnerable to a path traversal, which could allow an authenticated attacker to read arbitrary files on the Torrent Server that are accessible to the web service account.","s":6.5,"v":"MEDIUM","cwe":"CWE-22"},{"id":"CVE-2026-107621","p":1792163825003,"x":"JPEGParser can enter an infinite loop while parsing a specially crafted or truncated stream.","s":7.5,"v":"HIGH","cwe":"CWE-835"},{"id":"CVE-2026-106705","p":1792163824767,"x":"ELADMIN (eladmin-mp) up to 2.7 contains an improper access control vulnerability in the role management module. The endpoint PUT /api/roles/menu (RoleController.updateRoleMenu) authorizes the request only by comparing the target role's level with the caller's minimum level. The application neither validates the…","s":8.8,"v":"HIGH","cwe":"CWE-284"},{"id":"CVE-2026-105667","p":1792163824260,"x":"In the default configuration, the HL7 listener accepts ADT^A40 patient-merge messages without authenticating the sending application. A remote sender can reassign studies and related workflow records from one patient identity to another. The archive's unmerge does not reverse this.","s":7.5,"v":"HIGH","cwe":"CWE-306"},{"id":"CVE-2026-105279","p":1792163824130,"x":"In the default configuration, the archive accepts DICOM associations from an unregistered calling AE. A remote peer can use C-FIND and C-GET to enumerate and retrieve patient information and medical images. It can also use C-STORE to file fabricated study content under an existing patient identity.","s":9.1,"v":"CRITICAL","cwe":"CWE-306"},{"id":"CVE-2026-105273","p":1792163823993,"x":"MP4Parser does not adequately validate MP4 box sizes. A malformed box can cause parsing to make no forward progress and repeatedly process the same input.","s":7.5,"v":"HIGH","cwe":"CWE-835"},{"id":"CVE-2026-101021","p":1792163818837,"x":"MultipartInputStream performs inefficient boundary matching and unnecessary buffer copying. Crafted multipart input can force excessive boundary comparisons and repeated copying.","s":7.5,"v":"HIGH","cwe":"CWE-407"},{"id":"CVE-2025-52097","p":1792163810360,"x":"Cross Site Scripting vulnerability in InstantASP ltd, InstantForum.NET v.4.1.4 allows an attacker to execute arbitrary code via reflecting un-sanitized input from query string parameters directly into the HTML response without proper output encoding"},{"id":"CVE-2026-97858","p":1792160376597,"x":"An attacker can cause the server to unbind the target device from its current owner and rebind it to the requesting account, regardless of whether the device is currently bound to a different account, allowing an attacker to obtain the device's full serial ID.","s":5.3,"v":"MEDIUM","cwe":"CWE-915"},{"id":"CVE-2026-97470","p":1792160367763,"x":"The Tourfic – AI Powered Travel Booking, Hotel Booking & Car Rental plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via unfiltered_html Grant to Customer Role in all versions up to, and including, 3.0.1 due to insufficient input sanitization and output escaping. This makes it…","s":6.4,"v":"MEDIUM","cwe":"CWE-79"},{"id":"CVE-2026-90821","p":1792160350960,"x":"An input neutralization vulnerability in the Webhook URL form field component of Crafty Controller allows a remote, authenticated attacker to perform stored XSS via malicious form input","s":5.4,"v":"MEDIUM","cwe":"CWE-79"},{"id":"CVE-2026-18516","p":1792160244710,"x":"An output escaping vulnerability in the Audit Logs component of Crafty Controller allows a remote, unauthenticated attacker to perform stored cross-site scripting via HTTP header injection","s":9.6,"v":"CRITICAL","cwe":"CWE-116"},{"id":"CVE-2026-111413","p":1792160243710,"x":"Cross-Site Request Forgery (CSRF) vulnerability in aThemeArt aThemeArt Theme Helper athemeart-theme-helper allows Cross Site Request Forgery.This issue affects aThemeArt Theme Helper: from n/a through 1.0.8.","s":8.8,"v":"HIGH","cwe":"CWE-352"},{"id":"CVE-2026-110806","p":1792160242443,"x":"Incorrect authorization in add-on properties in Devolutions Server 2026.3.8.0 and earlier allows an authenticated user with only View permission to obtain add-on passwords via the unredacted add-on properties returned in connection data.","s":6.5,"v":"MEDIUM","cwe":"CWE-863"},{"id":"CVE-2026-110805","p":1792160242343,"x":"Server-side request forgery in PingOne groups endpoint in Devolutions Server 2026.3.8.0 and earlier allows an authenticated low-privileged user to exfiltrate the stored PingOne application secret via an attacker-controlled PingOne configuration in the request parameter.","s":2.6,"v":"LOW","cwe":"CWE-918"},{"id":"CVE-2026-110804","p":1792160242247,"x":"Improperly controlled modification of JIT elevation settings in PAM checkout in Devolutions Server 2026.3.8.0 and earlier allows an authenticated user with PAM checkout access to delete arbitrary Active Directory groups or retain elevated privileges via client-supplied JIT elevation settings in a checkout update…","s":4.3,"v":"MEDIUM","cwe":"CWE-915"},{"id":"CVE-2026-110287","p":1792160242020,"x":"Improper access control in asset contact password in Devolutions Server 2026.3.8.0 and earlier allows an authenticated user with general Edit but without Edit asset permission to modify the asset contact password via a crafted direct request to the partial-save endpoint.","s":4.3,"v":"MEDIUM","cwe":"CWE-863"},{"id":"CVE-2026-107617","p":1792160236510,"x":"An attacker can use a hard-coded credential to log in to EseeCloud devices.","s":9.8,"v":"CRITICAL","cwe":"CWE-798"},{"id":"CVE-2026-105664","p":1792160234903,"x":"The endpoint exposes an observable response discrepancy when processing ID values. A request submitted with a nonexistent ID returns a distinct error response code from one submitted with a valid, registered ID, allowing an attacker holding a valid access token - but without further authentication or authorization -…","s":5.3,"v":"MEDIUM","cwe":"CWE-204"},{"id":"CVE-2026-68571","p":1792156617587,"x":"Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Kylin. Special parameter in JDBC URL can lead to code injection. \nImpact most to the kylin services that are directly exposed to public network, which is not common. In-house kylin deployments are mostly not impacted.\n\n\n\n\n\nThis issue…","s":8.8,"v":"HIGH","cwe":"CWE-94"},{"id":"CVE-2026-64959","p":1792156617480,"x":"Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'), Missing Authentication for Critical Function vulnerability in Apache Kylin. Impact most to the kylin services that are directly exposed to public network, which is not common. In-house kylin deployments are mostly not impacted.…","cwe":"CWE-89"},{"id":"CVE-2026-64610","p":1792156617367,"x":"Deserialization of Untrusted Data vulnerability in Apache Kylin. Unsafe Java deserialization could happen from a broken external cache service.\n\n\n\nThis issue affects Apache Kylin: from 4 through 5.0.4.\n\n\n\nUsers are recommended to upgrade to version 5.0.5, which fixes the issue.","cwe":"CWE-502"},{"id":"CVE-2026-63619","p":1792156617250,"x":"Missing Authorization vulnerability in Apache Kylin. A backend metadata dump API misses the enough authorization and the path-confinement. Impact most to the kylin services that are directly exposed to public network, which is not common. In-house kylin deployments are mostly not impacted.\n\n\n\nThis issue affects Apache…","cwe":"CWE-862"},{"id":"CVE-2026-63618","p":1792156617127,"x":"Exposure of Sensitive Information (system level configuration info) to an Unauthorized Actor vulnerability in Apache Kylin.\n\n\n\nThis issue affects Apache Kylin: from 4 through 5.0.4.\n\n\n\nUsers are recommended to upgrade to version 5.0.5, which fixes the issue.","s":7.5,"v":"HIGH","cwe":"CWE-200"},{"id":"CVE-2026-111555","p":1792156616620,"x":"A flaw was found in luksmeta. Improper boundary validation of metadata slots allows an attacker capable of supplying or modifying a disk header to redirect wipe or load operations outside the intended metadata area. An attacker could exploit this vulnerability by providing a crafted header with valid checksums to…","s":6,"v":"MEDIUM","cwe":"CWE-1285"},{"id":"CVE-2026-111409","p":1792156616077,"x":"Missing Authorization vulnerability in YITH YITH PayPal Express Checkout for WooCommerce yith-paypal-express-checkout-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects YITH PayPal Express Checkout for WooCommerce: from n/a through 1.61.0.","s":5.3,"v":"MEDIUM","cwe":"CWE-862"},{"id":"CVE-2026-111405","p":1792156615967,"x":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PT Norther Lights Production MapSVG mapsvg-lite-interactive-vector-maps allows Stored XSS.This issue affects MapSVG: from n/a through 8.16.1.","s":6.5,"v":"MEDIUM","cwe":"CWE-79"},{"id":"CVE-2026-111400","p":1792156615850,"x":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in IdeaBox Creations PowerPack Addons for Elementor powerpack-lite-for-elementor allows Stored XSS.This issue affects PowerPack Addons for Elementor: from n/a through 3.1.0.","s":6.5,"v":"MEDIUM","cwe":"CWE-79"},{"id":"CVE-2026-111399","p":1792156615733,"x":"Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in PT Norther Lights Production MapSVG mapsvg-lite-interactive-vector-maps allows SQL Injection.This issue affects MapSVG: from n/a through 8.16.1.","s":8.5,"v":"HIGH","cwe":"CWE-89"},{"id":"CVE-2026-111397","p":1792156615617,"x":"Missing Authorization vulnerability in PT Norther Lights Production MapSVG mapsvg-lite-interactive-vector-maps allows Retrieve Embedded Sensitive Data.This issue affects MapSVG: from n/a through 8.16.1.","s":5.3,"v":"MEDIUM","cwe":"CWE-862"},{"id":"CVE-2026-111396","p":1792156615497,"x":"Missing Authorization vulnerability in Liquid Web / StellarWP Advanced Post Manager advanced-post-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Advanced Post Manager: from n/a through 4.5.6.","s":7.1,"v":"HIGH","cwe":"CWE-862"},{"id":"CVE-2026-110903","p":1792156615370,"x":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Liquid Web / StellarWP The Events Calendar the-events-calendar allows Stored XSS.This issue affects The Events Calendar: from n/a through 6.18.1.","s":6.5,"v":"MEDIUM","cwe":"CWE-79"},{"id":"CVE-2026-110901","p":1792156615250,"x":"Authorization Bypass Through User-Controlled Key vulnerability in WPMU DEV SmartCrawl smartcrawl-seo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SmartCrawl: from n/a through 3.16.4.","s":5.4,"v":"MEDIUM","cwe":"CWE-639"},{"id":"CVE-2026-110900","p":1792156615130,"x":"Missing Authorization vulnerability in Liquid Web / StellarWP BookIt bookit allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects BookIt: from n/a through 2.6.0.5.","s":5.3,"v":"MEDIUM","cwe":"CWE-862"},{"id":"CVE-2026-110896","p":1792156615010,"x":"Missing Authorization vulnerability in WP Chill Passster content-protector allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Passster: from n/a through 4.3.18.","s":5.3,"v":"MEDIUM","cwe":"CWE-862"},{"id":"CVE-2026-110380","p":1792156614893,"x":"Missing Authorization vulnerability in Arraytics WP Event Solution wp-event-solution allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Event Solution: from n/a through 4.1.26.","s":5.3,"v":"MEDIUM","cwe":"CWE-862"},{"id":"CVE-2026-107564","p":1792156614013,"x":"An unauthenticated remote attacker may use an allocation of resources without limits or throttling weakness in the affected product to cause high CPU load leading to a denial of service.","s":7.5,"v":"HIGH","cwe":"CWE-770"},{"id":"CVE-2026-105958","p":1792156613480,"x":"A flaw was found in spice-server. Multiple migration data handlers use client-supplied offsets from SPICE_MSGC_MIGRATE_DATA messages without bounds validation, allowing a malicious authenticated SPICE client during VM live migration to read arbitrary heap memory or trigger heap corruption via out-of-bounds read and…","s":7.5,"v":"HIGH","cwe":"CWE-787"},{"id":"CVE-2026-111391","p":1792152993197,"x":"SGLang 0.5.10 through 0.5.22 contains a code injection vulnerability in _evaluate_filter() that allows remote attackers to execute Python code by escaping the eval() sandbox through re.search __globals__. Attackers can send a crafted filter expression to the unauthenticated /dumper/configure endpoint when…","s":8.1,"v":"HIGH","cwe":"CWE-95"},{"id":"CVE-2026-111390","p":1792152993050,"x":"Erupt through 2.3.0 contains an HQL injection vulnerability that allows authenticated users to bypass tree-scoped data filters by injecting unescaped quotes into the linkTreeVal parameter of POST /erupt-api/data/table/{erupt}. Attackers holding query permission on entities with String-keyed linkTree targets can append…","s":5.3,"v":"MEDIUM","cwe":"CWE-564"},{"id":"CVE-2026-110029","p":1792152992387,"x":"The Squeeze WordPress plugin before 1.8.1 does not perform a capability check on one of its AJAX actions, allowing authenticated users with a role as low as Subscriber to revert any attachment to its backup copy and to permanently delete that backup and the plugin's generated WebP derivatives, regardless of ownership.","s":5.4,"v":"MEDIUM","cwe":"CWE-862"},{"id":"CVE-2026-109930","p":1792152992273,"x":"The MAIO WordPress plugin before 7.3.22 does not properly restrict access to its analytics data, treating a credential value shipped verbatim in its own public source as a valid API key, which allows unauthenticated attackers to retrieve the stored crawl-analytics log, including each recorded visitor's IP address,…","s":5.3,"v":"MEDIUM","cwe":"CWE-200"},{"id":"CVE-2026-107648","p":1792152992053,"x":"The WP Sessions Time Monitoring Full Automatic plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'action (also function, plugin, post_type, post_status, ids, loggedout, and POST post_title)' parameter in all versions up to, and including, 1.1.5 due to insufficient input sanitization and output…","s":7.2,"v":"HIGH","cwe":"CWE-79"},{"id":"CVE-2026-105959","p":1792152991733,"x":"A flaw was found in spice-server. The GLZ encoder dictionary restore path truncates a size_t allocation size to int when calling the malloc callback, allowing a malicious authenticated SPICE client during VM live migration to trigger a massive heap buffer overflow by sending a crafted max_encoders value in migration…","s":7.5,"v":"HIGH","cwe":"CWE-190"},{"id":"CVE-2026-109119","p":1792149420927,"x":"Improper Privilege Management in the user management API endpoint (/api/users/{username_or_id}) in Rdiffweb allows authenticated users to elevate their privileges to administrator by modifying the role parameter in a POST request.","s":8.8,"v":"HIGH","cwe":"CWE-862"},{"id":"CVE-2026-109118","p":1792149420793,"x":"Improper path containment check in ikus060 rdiffweb 7.1.1 allows an authenticated user to cause the browse, restore, history and delete operations to resolve to a path outside the repository being operated on, via a percent-encoded traversal sequence (%2e%2e) in the request path, because the containment check uses a…","s":4.6,"v":"MEDIUM","cwe":"CWE-22"},{"id":"CVE-2026-96768","p":1792145885863,"x":"The GoSMTP Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via Email Log Body in all versions up to, and including, 1.2.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages…","s":7.2,"v":"HIGH","cwe":"CWE-79"},{"id":"CVE-2026-14452","p":1792145885653,"x":"Improper validation of the reset_url parameter of the Setup in-page search in Checkmk <2.5.0p15, <2.4.0p38, <2.3.0p51 and 2.2.0 (EOL) allows an attacker to execute arbitrary script in the session of an authenticated user with Setup access, or to redirect that user to an arbitrary external site, by tricking the user…","s":8.6,"v":"HIGH","cwe":"CWE-601"},{"id":"CVE-2026-110703","p":1792145885447,"x":"The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'post_content' parameter in all versions up to, and including, 2.8.191 due to insufficient input sanitization and output escaping. This makes it possible for…","s":6.4,"v":"MEDIUM","cwe":"CWE-79"},{"id":"CVE-2026-107649","p":1792145884307,"x":"The Events Made Easy plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'event[location_name]' parameter in all versions up to, and including, 3.2.22 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts…","s":5.4,"v":"MEDIUM","cwe":"CWE-79"},{"id":"CVE-2026-106030","p":1792145883327,"x":"NordVPN for Windows allows local attackers to stop unprotected Windows system services and change their startup type to Manual via named pipes. The NordVPN user-mode application allows a low-privileged attacker to act as a trusted process and connect to the named pipe \"\\\\.\\pipe\\nord-security\\v1\\NordVpnService\\Server\".…","s":6.8,"v":"MEDIUM","cwe":"CWE-863"},{"id":"CVE-2026-93681","p":1792142225107,"x":"The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Stored Cross-Site Scripting via display_name Parameter in all versions up to, and including, 4.1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with…","s":6.4,"v":"MEDIUM","cwe":"CWE-79"},{"id":"CVE-2026-92766","p":1792142224963,"x":"The Vitepos – Point of Sale (POS) for WooCommerce plugin for WordPress is vulnerable to generic SQL Injection via the 'src_by' parameter in all versions up to, and including, 3.5.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it…","s":7.5,"v":"HIGH","cwe":"CWE-89"},{"id":"CVE-2026-15575","p":1792142224790,"x":"Active debug code vulnerability in SFM Software Technologies Inc. Costifier allows Exploit Non-Production Interfaces.\n\nThis issue affects Costifier: through 2026-10-16. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.","s":5.3,"v":"MEDIUM","cwe":"CWE-489"},{"id":"CVE-2026-15219","p":1792142224663,"x":"Authorization bypass through User-Controlled key vulnerability in SFM Software Technologies Inc. Costifier allows Exploitation of Trusted Identifiers.\n\nThis issue affects Costifier: through 2026-10-16.  NOTE: The vendor was contacted early about this disclosure but did not respond in any way.","s":6.5,"v":"MEDIUM","cwe":"CWE-639"},{"id":"CVE-2026-14177","p":1792142224533,"x":"Observable response discrepancy vulnerability in IKAS Technology Inc. Ikas E-Commerce Infrastructure allows Account Footprinting.\n\nThis issue affects ikas E-Commerce Infrastructure: through 2026-07-13.","s":7.5,"v":"HIGH","cwe":"CWE-204"},{"id":"CVE-2026-111472","p":1792142224410,"x":"An SQL injection vulnerability has been discovered in TSG Profleet. The vulnerability could allow an attacker to retrieve, create, update and delete data from the database by sending a GET request using the ‘Identificación’ parameter of the ‘/cgi-bin/index.php’ endpoint.","s":9.3,"v":"CRITICAL","cwe":"CWE-89"},{"id":"CVE-2026-111311","p":1792142224250,"x":"The DoubleScale | All-in-One CRM – Sales, Multi-Channel Marketing, Newsletter, Booking, Helpdesk, Automation, MCP & More plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.5.1 via the store_upload function. This is due to a fail-open extension allow-list in…","s":8.8,"v":"HIGH","cwe":"CWE-434"},{"id":"CVE-2026-109224","p":1792142224113,"x":"The SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 4.9.4 due to insufficient input sanitization and output escaping.…","s":7.2,"v":"HIGH","cwe":"CWE-79"},{"id":"CVE-2026-104726","p":1792142223980,"x":"The Name Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'dir' Shortcode Attribute in all versions up to, and including, 1.34.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to…","s":6.4,"v":"MEDIUM","cwe":"CWE-79"},{"id":"CVE-2026-104003","p":1792142223843,"x":"The WP User Avatar / ProfilePress plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in versions up to, and including, 4.17.5. This is due to the get_user_profile_structure() function assembling the front-end profile buffer — which includes raw comment excerpts inlined by author_comment_query() — and…","s":5.4,"v":"MEDIUM","cwe":"CWE-94"},{"id":"CVE-2026-101300","p":1792142223703,"x":"Server-Side Request Forgery (SSRF) reported in the ticket sales chart PDF export functionality of Wegow. According to the report, an authenticated user with a promoter account can manipulate the <svg> parameter of the POST request generated by selecting Download PDF. The content is processed by the…","s":7.1,"v":"HIGH","cwe":"CWE-918"},{"id":"CVE-2026-96870","p":1792138633783,"x":"The SureDash – Community, Courses & Member Dashboard plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'display_name' parameter in all versions up to, and including, 1.12.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with…","s":6.4,"v":"MEDIUM","cwe":"CWE-79"},{"id":"CVE-2026-87111","p":1792138633650,"x":"The User Registration PRO – Custom Registration Form, Login Form, and User Profile WordPress Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via HTTP Referer Header in all versions up to, and including, 6.2.9 due to insufficient input sanitization and output escaping. This makes it possible…","s":7.2,"v":"HIGH","cwe":"CWE-79"},{"id":"CVE-2026-75903","p":1792138633513,"x":"The Vulnity Security plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 1.4.3 This is due to insufficient protection of the delegated-login pairing credential file on Nginx-based installations, where the plugin's generated server configuration snippet guards the wrong…","s":8.1,"v":"HIGH","cwe":"CWE-287"},{"id":"CVE-2026-19621","p":1792138633390,"x":"Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to strip action integration secrets from post payloads before broadcasting post-deletion web socket events and returning thread API responses, which allows an authenticated channel member to obtain server-side webhook…","s":6.5,"v":"MEDIUM","cwe":"CWE-200"},{"id":"CVE-2026-19600","p":1792138633283,"x":"Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 fail to sanitize authentication tokens before writing them to server log entries, which allows an attacker with access to server logs to obtain valid session tokens or OAuth access tokens and impersonate authenticated users…","s":4.5,"v":"MEDIUM","cwe":"CWE-532"},{"id":"CVE-2026-19076","p":1792138633177,"x":"Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to reject OAuth application sessions in the account type switch endpoint, which allows an attacker with a valid OAuth bearer token for a target user to permanently take over that user's SSO-backed account by setting an…","s":4.4,"v":"MEDIUM","cwe":"CWE-863"},{"id":"CVE-2026-18799","p":1792138633073,"x":"Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to restrict Slack import account binding to system administrator-initiated imports which allows an authenticated attacker with team admin privileges to force-add existing Mattermost users to their team and forge posts…","s":4.3,"v":"MEDIUM","cwe":"CWE-862"},{"id":"CVE-2026-18560","p":1792138632967,"x":"Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to validate user’s permissions before other validations which allows non-content reviewers to infer a post’s flagged status via direct API call.. Mattermost Advisory ID: MMSA-2026-00754","s":4.3,"v":"MEDIUM","cwe":"CWE-203"},{"id":"CVE-2026-18256","p":1792138632863,"x":"Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to properly restrict private teams from public team search results, which allows an authenticated user without permission to list private teams to disclose the ID, name, and display name of private teams via a modified…","s":4.3,"v":"MEDIUM","cwe":"CWE-863"},{"id":"CVE-2026-18223","p":1792138632753,"x":"Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to validate the invited recipient's email address when redeeming team and guest invitation tokens, which allows an authenticated attacker to join a team or gain unauthorized access to private channels via a forwarded or…","s":5,"v":"MEDIUM","cwe":"CWE-863"},{"id":"CVE-2026-16453","p":1792138632640,"x":"Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to verify the integrity of the SAML RelayState POST parameter which allows an authenticated SAML user to join any team, including invite-only teams, via forging the team_id or invite_id fields in the RelayState..…","s":7.1,"v":"HIGH","cwe":"CWE-472"},{"id":"CVE-2026-16251","p":1792138632527,"x":"Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to limit the size of remote image responses buffered in memory during local image proxy direct fetches, which allows a remote attacker to cause memory exhaustion on the server via a crafted oversized image response..…","s":6.5,"v":"MEDIUM","cwe":"CWE-770"},{"id":"CVE-2026-100108","p":1792138632320,"x":"The Social Share Buttons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'form (containing share_url)' parameter in all versions up to, and including, 1.30 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level…","s":6.4,"v":"MEDIUM","cwe":"CWE-79"},{"id":"CVE-2026-100106","p":1792138631207,"x":"The FiboSearch – Ajax Search for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'purchased_plan' parameter in all versions up to, and including, 1.34.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with…","s":6.4,"v":"MEDIUM","cwe":"CWE-79"},{"id":"CVE-2026-97640","p":1792135034823,"x":"The WPConsent – Cookie Banner & Cookie Consent for Privacy Compliance (GDPR / CCPA / EU Compliance Cookie Notice) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via Simple HTML DOM Parser Noise-Key Restoration (mXSS) in all versions up to, and including, 1.1.9 due to insufficient…","s":7.2,"v":"HIGH","cwe":"CWE-79"},{"id":"CVE-2026-97296","p":1792135034693,"x":"Deserialization of Untrusted Data vulnerability in Rocketgenius, Inc Gravity Forms gravityforms allows Object Injection.This issue affects Gravity Forms: from n/a before 3.1.1.","s":8.1,"v":"HIGH","cwe":"CWE-502"},{"id":"CVE-2026-96339","p":1792135034560,"x":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Houzez.co Houzez houzez allows Reflected XSS.This issue affects Houzez: from n/a through 4.4.0.","s":7.1,"v":"HIGH","cwe":"CWE-79"},{"id":"CVE-2026-94388","p":1792135034430,"x":"Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in halfdata Green Popups halfdata-green-popups allows Blind SQL Injection.This issue affects Green Popups: from n/a before 7.6.3.","s":9.3,"v":"CRITICAL","cwe":"CWE-89"},{"id":"CVE-2026-94169","p":1792135034297,"x":"Improper Control of Generation of Code ('Code Injection') vulnerability in Theme-one The Grid the-grid allows Command Injection.This issue affects The Grid: from n/a through 2.8.1.","s":10,"v":"CRITICAL","cwe":"CWE-94"},{"id":"CVE-2026-92553","p":1792135034150,"x":"The YaySMTP – WP Mail SMTP with Email Logs, Tracking & Reports plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.7.7 via the putFile function. This is due to insufficient file type validation in the putFile function, as sanitize_file_name() does not strip executable…","s":8.8,"v":"HIGH","cwe":"CWE-434"},{"id":"CVE-2026-92427","p":1792135034047,"x":"The Coinsnap Bitcoin Crowdfunding WordPress plugin through 1.2.0 does not restrict access to the secret used to authenticate its payment gateway webhook, disclosing it to unauthenticated users and rendering the webhook's signature check ineffective. This allows unauthenticated attackers to forge payment-confirmation…","s":5.3,"v":"MEDIUM","cwe":"CWE-200"},{"id":"CVE-2026-92115","p":1792135033907,"x":"The WP Photo Album Plus plugin for WordPress is vulnerable to authenticated Command Injection in all versions up to, and including, 9.3.02.002 via the `value` parameter of the `update-photo` AJAX action. This is due to insufficient shell escaping within the `wppa_image_magick_a()` function, where the…","s":8.8,"v":"HIGH","cwe":"CWE-77"},{"id":"CVE-2026-91833","p":1792135033803,"x":"The WX Subscribe  微信支付付费订阅 WordPress plugin through 1.2.1 does not sanitise and escape a parameter before using it in a SQL statement, allowing unauthenticated attackers to perform SQL injection attacks on installs where the payment key has not been configured.","s":6.8,"v":"MEDIUM","cwe":"CWE-89"},{"id":"CVE-2026-91830","p":1792135033700,"x":"The Subscribe to Comments WordPress plugin before 2.3.3 does not sign or validate a cookie it trusts to identify a commenter, allowing unauthenticated attackers to disclose a subscriber's management key and silently alter that subscriber's subscriptions.","s":6.5,"v":"MEDIUM","cwe":"CWE-200"},{"id":"CVE-2026-74923","p":1792135033487,"x":"The Document Gallery WordPress plugin through 5.1.1 does not perform any capability or ownership check when generating a gallery on demand, allowing unauthenticated users to enumerate and disclose the titles, descriptions and direct file URLs of media attached to unpublished, private or trashed content.","s":5.3,"v":"MEDIUM","cwe":"CWE-200"},{"id":"CVE-2026-19867","p":1792135033353,"x":"Mattermost versions 11.10.x <= 11.10.0, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10 fail to cap the number and size of mention keys stored in a user's notification properties, and to bound the quadratic multibyte-keyword matching performed for each post, which allows an authenticated user to degrade…","s":4.3,"v":"MEDIUM","cwe":"CWE-770"},{"id":"CVE-2026-19798","p":1792135033217,"x":"The Wp Map Block plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the set_status() and bulk() functions in the Maps_Controller REST controller in versions up to, and including, 3.0.0. The plugin's permission_callback (can_edit()) only verifies…","s":4.3,"v":"MEDIUM","cwe":"CWE-862"},{"id":"CVE-2026-19603","p":1792135032750,"x":"Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 fail to sanitize the active channel field returned by the user status API endpoints, which allows an authenticated user to learn the channel ID of a private channel another user is actively viewing via the status endpoints,…","s":4.3,"v":"MEDIUM","cwe":"CWE-201"},{"id":"CVE-2026-19601","p":1792135032640,"x":"Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 fail to invalidate the stored AD/LDAP bind password when other connection settings (such as the server address) are changed, which allows a System Console administrator to disclose the plaintext bind password to an…","s":4.9,"v":"MEDIUM","cwe":"CWE-201"},{"id":"CVE-2026-19541","p":1792135032520,"x":"Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 fail to require re-entry of the stored client secret when validating an outgoing OAuth connection, which allows an authenticated user with permission to manage outgoing OAuth connections to obtain the secret via pointing the…","s":6.5,"v":"MEDIUM","cwe":"CWE-201"},{"id":"CVE-2026-18795","p":1792135032407,"x":"Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to enforce DM/GM check on server side which allows an authenticated user to quarantine a post belonging to DM or GM via direct API call.. Mattermost Advisory ID: MMSA-2026-00756","s":6.4,"v":"MEDIUM","cwe":"CWE-862"},{"id":"CVE-2026-18551","p":1792135032260,"x":"Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to validate the combination of guest and admin scheme roles which allows an authenticated attacker to escalate a guest account to team or channel admin via a crafted PUT request to the member roles API endpoint..…","s":6.5,"v":"MEDIUM","cwe":"CWE-863"},{"id":"CVE-2026-15222","p":1792135032120,"x":"The The User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 5.2.8. This is due to the software allowing users to…","s":5.4,"v":"MEDIUM","cwe":"CWE-94"},{"id":"CVE-2026-111178","p":1792135031960,"x":"The WP Booking System – Booking Calendar plugin for WordPress is vulnerable to generic SQL Injection via the 'data[orderby]' parameter in all versions up to, and including, 2.1.0.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it…","s":4.9,"v":"MEDIUM","cwe":"CWE-89"},{"id":"CVE-2026-111069","p":1792135031790,"x":"The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'twitterusername' parameter in all versions up to, and including, 2.8.192 due to insufficient input sanitization and output escaping. This makes it possible for…","s":6.4,"v":"MEDIUM","cwe":"CWE-79"},{"id":"CVE-2026-110701","p":1792135031643,"x":"The CP Multi View Events Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'CalendarTitle' parameter in all versions up to, and including, 1.4.42 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web…","s":7.2,"v":"HIGH","cwe":"CWE-79"},{"id":"CVE-2026-110664","p":1792135031490,"x":"The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'note' parameter in all versions up to, and including, 7.2.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with…","s":6.4,"v":"MEDIUM","cwe":"CWE-79"},{"id":"CVE-2026-110366","p":1792135031337,"x":"Missing Authorization vulnerability in Gemini Labs Site Reviews site-reviews allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Site Reviews: from n/a through 8.3.4.","s":5.3,"v":"MEDIUM","cwe":"CWE-862"},{"id":"CVE-2026-110290","p":1792135031183,"x":"The WebberZone Top 10 — Popular Posts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'other_attributes (parsed to inject instance_id) + undeclared is_widget' parameter in all versions up to, and including, 4.5.2 due to insufficient input sanitization and output escaping. This makes it…","s":6.4,"v":"MEDIUM","cwe":"CWE-79"},{"id":"CVE-2026-110252","p":1792135031030,"x":"The WPeMatico RSS Feed Fetcher plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.9 This is due to the plugin removing WordPress's wp_filter_post_kses filter from content_save_pre immediately before calling wp_insert_post() with RSS feed content, whenever the…","s":5.4,"v":"MEDIUM","cwe":"CWE-79"},{"id":"CVE-2026-110191","p":1792135030920,"x":"The Product Delivery Date for WooCommerce  WordPress plugin before 3.3.2 does not perform a capability check before disclosing order details through its calendar view AJAX actions, allowing users with a role as low as Contributor to view other customers' order information.","s":2.7,"v":"LOW","cwe":"CWE-200"},{"id":"CVE-2026-110179","p":1792135030807,"x":"The affiliate-toolkit  WordPress plugin before 3.8.9 does not validate a user-supplied sort value against an allowlist before using it in a database query, and the affected administrative list screen requires only a lower-privilege capability rather than an administrator one, so users with editor-level access and…","s":6.8,"v":"MEDIUM","cwe":"CWE-89"},{"id":"CVE-2026-110135","p":1792135030683,"x":"The OTP Login & Register Woocommerce WordPress plugin before 2.7.3 does not adequately limit one-time-password verification attempts, because the attempt limit is tracked against a value the client itself supplies and can change freely, allowing an unauthenticated attacker to bypass the limit and brute-force the short…","s":7.4,"v":"HIGH","cwe":"CWE-287"},{"id":"CVE-2026-110039","p":1792135030573,"x":"The Smush  WordPress plugin before 4.3.4 does not restrict changes to a network-wide access setting to network administrators, allowing an administrator of a single site on a multisite network to change it for the entire network.","s":2.7,"v":"LOW","cwe":"CWE-863"},{"id":"CVE-2026-110015","p":1792135030470,"x":"The Salon Booking System  WordPress plugin before 10.31.9 does not correctly verify the authenticity of REST API requests and discards WordPress core's nonce check for cookie-authenticated sessions across the whole REST API, allowing unauthenticated attackers who trick a logged-in administrator into clicking a crafted…","s":8.8,"v":"HIGH","cwe":"CWE-352"},{"id":"CVE-2026-110014","p":1792135030363,"x":"The Salon Booking System  WordPress plugin before 10.31.9 does not properly check authorization before creating a booking and trusts a caller-supplied user identifier and booking status, allowing unauthenticated attackers to create bookings attributed to arbitrary users, overwrite those users' stored contact details,…","s":5.3,"v":"MEDIUM","cwe":"CWE-862"},{"id":"CVE-2026-110013","p":1792135030253,"x":"The Salon Booking System  WordPress plugin before 10.31.9 does not generate its booking-API access tokens from a secure random source, instead deriving them from a value hardcoded in the Salon Booking System  WordPress plugin before 10.31.9 and the second at which a token was issued. An attacker able to constrain when…","s":4.8,"v":"MEDIUM","cwe":"CWE-287"},{"id":"CVE-2026-110012","p":1792135030140,"x":"The Salon Booking System  WordPress plugin before 10.31.3 does not restrict several of its booking REST API routes to users with the appropriate capability, allowing any authenticated user such as a subscriber to read every customer's booking records, including their personal data.","s":4.3,"v":"MEDIUM","cwe":"CWE-200"},{"id":"CVE-2026-109982","p":1792135030030,"x":"The MB Custom Post Types & Custom Taxonomies WordPress plugin before 2.12.2 does not perform a capability check or validate a nonce on its migration actions, allowing any authenticated user, such as a subscriber, to trigger a one-way migration that creates published records and permanently deletes a companion MB…","s":4.2,"v":"MEDIUM","cwe":"CWE-862"},{"id":"CVE-2026-109401","p":1792135029887,"x":"The WP Mail Logging plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.17.0 via the 'email_address' parameter. This makes it possible for authenticated attackers, with administrator-level access and above, to extract complete logged mail rows belonging to other…","s":2.7,"v":"LOW","cwe":"CWE-200"},{"id":"CVE-2026-109388","p":1792135029730,"x":"The HivePress – Business Directory, Listings & Classified Ads Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'message' parameter in all versions up to, and including, 1.7.32 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers,…","s":6.4,"v":"MEDIUM","cwe":"CWE-79"},{"id":"CVE-2026-109382","p":1792135029573,"x":"The WSP MCP AI Agents Connector plugin for WordPress is vulnerable to Sensitive Information Disclosure in versions up to, and including, 2.9.5. This is due to the wsp_get_posts MCP tool being registered with an empty capability requirement while the MCP endpoint's authenticate() method accepts any logged-in user, and…","s":6.5,"v":"MEDIUM","cwe":"CWE-863"},{"id":"CVE-2026-109193","p":1792135029417,"x":"The HivePress – Business Directory, Listings & Classified Ads Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the '<custom user attribute slug> (e.g. hp_custom_link)' parameter in all versions up to, and including, 1.7.32 due to insufficient input sanitization and output escaping. This…","s":7.2,"v":"HIGH","cwe":"CWE-79"},{"id":"CVE-2026-107770","p":1792135029253,"x":"The Photo Engine (Media Organizer & Lightroom) plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 6.5.6 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to permanently…","s":6.8,"v":"MEDIUM","cwe":"CWE-862"},{"id":"CVE-2026-107768","p":1792135029103,"x":"The TranslatePress – Translate Multilingual sites with AI Translation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 3.3.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated…","s":7.2,"v":"HIGH","cwe":"CWE-79"},{"id":"CVE-2026-107646","p":1792135028940,"x":"The HUSKY – Products Filter for WooCommerce Professional plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.4.5 via the 'woof_settings[woof_stat][server_options]' parameter. This makes it possible for unauthenticated attackers to extract the external MySQL…","s":5.3,"v":"MEDIUM","cwe":"CWE-200"},{"id":"CVE-2026-105974","p":1792135028837,"x":"The Visual Form Builder WordPress plugin through 3.1 does not perform an authorization check before displaying recent form submission data in a dashboard widget, allowing any authenticated user (Subscriber and above) to read other users' submitted contact information, including names, email addresses, form titles and…","s":4.3,"v":"MEDIUM","cwe":"CWE-200"},{"id":"CVE-2026-105973","p":1792135028730,"x":"The Visual Form Builder WordPress plugin through 3.1 does not perform authorization or nonce checks when reordering form fields, allowing any authenticated user (Subscriber and above) to alter the field structure of any form on the site, persistently breaking its public rendering.","s":4.3,"v":"MEDIUM","cwe":"CWE-862"},{"id":"CVE-2026-104755","p":1792135028413,"x":"The WP Compress – Instant Performance & Speed Optimization plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 7.25.00 The vulnerability exists because the `start_comms` dispatcher (`wps_ic_comms::start_comms`), hooked on every front-end request, gates access only by…","s":4.8,"v":"MEDIUM","cwe":"CWE-269"},{"id":"CVE-2026-104730","p":1792135028267,"x":"The Sunshine Photo Cart – Client Photo Gallery & Photo Proofing for Photographers plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.7.4 via deserialization of untrusted input . This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP…","s":9.8,"v":"CRITICAL","cwe":"CWE-502"},{"id":"CVE-2026-104715","p":1792135028090,"x":"A flaw was found in cifs-utils. This flaw allows an unprivileged local user to achieve privilege escalation. When a privileged service mounts a Common Internet File System (CIFS) share using a user-controlled credentials file, input values are not properly sanitized before being assembled into mount options. A local…","s":7.8,"v":"HIGH","cwe":"CWE-88"},{"id":"CVE-2026-103696","p":1792135027973,"x":"The Mobile builder WordPress plugin through 1.4.2 does not sanitise and escape a parameter before using it in a SQL statement, allowing unauthenticated users to perform SQL injection attacks on sites that also run the WCFM Delivery add-on.","s":6.8,"v":"MEDIUM","cwe":"CWE-89"},{"id":"CVE-2026-96570","p":1792131433630,"x":"The Schema & Structured Data for WP & AMP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'saswp_review_text' parameter in all versions up to, and including, 1.67 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject…","s":7.2,"v":"HIGH","cwe":"CWE-79"},{"id":"CVE-2026-95809","p":1792131433300,"x":"The Opti-Behavior – Self-Hosted Heatmaps, Session Recordings, Funnels, A/B Testing & Smart Insights plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via 'country_name' Location Parameter in all versions up to, and including, 1.9.2.1 due to insufficient input sanitization and output escaping.…","s":7.2,"v":"HIGH","cwe":"CWE-79"},{"id":"CVE-2026-95686","p":1792131432963,"x":"The Opti-Behavior – Self-Hosted Heatmaps, Session Recordings, Funnels, A/B Testing & Smart Insights plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'targetUrl' parameter in all versions up to, and including, 1.9.2.1 due to insufficient input sanitization and output escaping. This…","s":7.2,"v":"HIGH","cwe":"CWE-79"},{"id":"CVE-2026-93767","p":1792131432620,"x":"The Tainacan plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.3.0 via the 'guid' parameter parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to read the contents of arbitrary files on the server, which can contain…","s":6.5,"v":"MEDIUM","cwe":"CWE-22"},{"id":"CVE-2026-89079","p":1792131432410,"x":"The Theme My Login plugin for WordPress is vulnerable to privilege escalation via account takeover in versions up to, and including, 7.2.1. This is due to the plugin not properly validating a user's identity prior to updating their password. This makes it possible for unauthenticated attackers to change arbitrary…","s":9.8,"v":"CRITICAL","cwe":"CWE-269"},{"id":"CVE-2026-89051","p":1792131432167,"x":"The WP Ghost (Hide My WP Ghost) – Security & Firewall plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'replaceHeadersAndTags' function in versions up to, and including, 7.0.12 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to…","s":7.2,"v":"HIGH","cwe":"CWE-79"},{"id":"CVE-2026-88963","p":1792131431930,"x":"The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to DOM-Based Cross-Site Scripting via the 'redirect_url' parameter in versions up to, and including, 4.0.8 This is due to insufficient input validation in the Topbar component's back button handler. This makes it possible for…","s":6.1,"v":"MEDIUM","cwe":"CWE-79"},{"id":"CVE-2026-85659","p":1792131431493,"x":"The PilotPress plugin for WordPress is vulnerable to Privilege Escalation via Account Takeover in all versions up to, and including, 2.0.43. The vulnerability exists because the `update_cc_details()` AJAX handler forwards an attacker-supplied `username` parameter to ONTRAPORT via `api_call('update_cc_details', ...)`…","s":8.8,"v":"HIGH","cwe":"CWE-269"},{"id":"CVE-2026-12272","p":1792131429910,"x":"The Lightweight Cookie Notice – Cookie Banner for Cookie Consent plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.19 This is due to the W3TC_DYNAMIC_SECURITY constant being hardcoded to a publicly known value. This makes it possible for unauthenticated…","s":5.3,"v":"MEDIUM","cwe":"CWE-330"},{"id":"CVE-2026-111458","p":1792131429510,"x":"The fanx_fingerprint function in ssl/sslxprint.c of ssldump allocates a heap buffer for formatting FAN/1 X.509 certificate fingerprints. The allocation size is computed as strlen(b64) + strlen(hex) + 31, but the format string \"fan1:x509:server:passive:%s:sha256:%s\" contains 33 fixed characters in addition to the two…","s":6.8,"v":"MEDIUM","cwe":"CWE-122"},{"id":"CVE-2026-111122","p":1792131429250,"x":"The SiteOrigin CSS plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'href' parameter in all versions up to, and including, 1.6.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages…","s":7.2,"v":"HIGH","cwe":"CWE-79"},{"id":"CVE-2026-110017","p":1792131428810,"x":"The Quick PayPal Payments: Payment Button & Form plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'form' parameter in all versions up to, and including, 6.0.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level…","s":6.4,"v":"MEDIUM","cwe":"CWE-79"},{"id":"CVE-2026-109513","p":1792131428407,"x":"The NotificationX – FOMO, Live Sales Notification, WooCommerce Sales Popup, GDPR, Social Proof, Announcement Banner & Floating Notification Bar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'name' parameter in all versions up to, and including, 3.3.3 due to insufficient input sanitization…","s":7.2,"v":"HIGH","cwe":"CWE-79"},{"id":"CVE-2026-109447","p":1792131428020,"x":"The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.0.3 via the `role` parameter handled by the `wppb_add_meta_to_user_on_activation()` function. The vulnerability exists…","s":8.1,"v":"HIGH","cwe":"CWE-269"},{"id":"CVE-2026-109414","p":1792131427450,"x":"The Vitepos – Point of Sale (POS) for WooCommerce plugin for WordPress is vulnerable to blind SQL Injection via the 'src_by[].val.start / src_by[].val.end (operator 'bt')' parameter in all versions up to, and including, 3.6.1 due to insufficient escaping on the user supplied parameter and lack of sufficient…","s":6.5,"v":"MEDIUM","cwe":"CWE-89"},{"id":"CVE-2026-109232","p":1792131426790,"x":"The Salon Booking System – Appointment Booking for Salons, Barbershops & Spas plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'sln[<checkout-field-key>]' parameter in all versions up to, and including, 10.31.9 due to insufficient input sanitization and output escaping. This makes it possible…","s":7.2,"v":"HIGH","cwe":"CWE-79"},{"id":"CVE-2026-107764","p":1792131426380,"x":"The SiteOrigin CSS plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'url (comment_author_url)' parameter in all versions up to, and including, 1.6.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary…","s":7.2,"v":"HIGH","cwe":"CWE-79"},{"id":"CVE-2026-107748","p":1792131425990,"x":"The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'display_name' parameter in all versions up to, and including, 4.0.3 due to insufficient input sanitization and output escaping. This makes it…","s":6.4,"v":"MEDIUM","cwe":"CWE-79"},{"id":"CVE-2026-104932","p":1792131425590,"x":"The Search Regex plugin for WordPress is vulnerable to PHP Object Injection in version 3.5 via deserialization of untrusted input in the replace_all function. This allows authenticated attackers, with subscriber-level access and above, to inject a PHP Object. The additional presence of a POP chain allows attackers to…","s":8,"v":"HIGH","cwe":"CWE-502"},{"id":"CVE-2026-104001","p":1792131425180,"x":"The The Slim SEO – AI SEO Plugin, Lightweight, Fast & Automated plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 4.11.1 This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This…","s":5.4,"v":"MEDIUM","cwe":"CWE-94"},{"id":"CVE-2026-104000","p":1792131424667,"x":"The Simply Schedule Appointments plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'status' parameter in all versions up to, and including, 1.6.12.35 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts…","s":7.2,"v":"HIGH","cwe":"CWE-79"},{"id":"CVE-2026-103999","p":1792131423927,"x":"The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via File Upload in all versions up to, and including, 3.5.54 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages…","s":7.2,"v":"HIGH","cwe":"CWE-79"},{"id":"CVE-2026-103896","p":1792131423417,"x":"The 10Web Booster – Website speed optimization, Cache & Page Speed optimizer plugin for WordPress is vulnerable to a limited file write via path traversal in versions up to, and including, 2.34.5 This is due to the OptimizerWebPageCache::get_cache_file_dir() function concatenating raw, unsanitized $_GET parameter…","s":7.5,"v":"HIGH","cwe":"CWE-22"},{"id":"CVE-2026-103768","p":1792131423060,"x":"The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.3.7 via the initMailPart function. This is due to insufficient file type validation when saving IMAP email attachments. This makes it possible for unauthenticated…","s":9.8,"v":"CRITICAL","cwe":"CWE-434"},{"id":"CVE-2026-103480","p":1792131422673,"x":"The Tourfic – AI Powered Travel Booking, Hotel Booking & Car Rental plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'type' parameter in all versions up to, and including, 3.0.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with…","s":6.4,"v":"MEDIUM","cwe":"CWE-79"},{"id":"CVE-2026-100186","p":1792131422317,"x":"The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via First Name Field in all versions up to, and including, 4.0.3 due to insufficient input sanitization and output escaping. This makes it possible for…","s":7.2,"v":"HIGH","cwe":"CWE-79"},{"id":"CVE-2026-100158","p":1792131421323,"x":"The SQL Chart Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'X-axis column value ($value->$xarg_s from $wpdb->get_results())' parameter in all versions up to, and including, 3.0.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated…","s":6.4,"v":"MEDIUM","cwe":"CWE-79"},{"id":"CVE-2026-96562","p":1792127850687,"x":"The The Broken Link Checker plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.4.14.1. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated…","s":6.5,"v":"MEDIUM","cwe":"CWE-94"},{"id":"CVE-2026-111114","p":1792127850350,"x":"The Nexter Extension – Security, Performance, Code Snippets & Site Toolkit plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.7.11 The vulnerability exists because the `/?reset-view` handler in `role_switcher_to_view_admin_as()` performs no nonce or capability check when…","s":7.5,"v":"HIGH","cwe":"CWE-269"},{"id":"CVE-2026-111106","p":1792127850223,"x":"The Mail Mint plugin for WordPress is vulnerable to SQL Injection via the 'filters' parameter of the /wp-json/mrm/v1/segments/contacts REST endpoint in versions up to, and including, 1.31.4 This is due to insufficient escaping on the user supplied filter 'value' before it is appended to a SQL query in…","s":6.5,"v":"MEDIUM","cwe":"CWE-89"},{"id":"CVE-2026-110721","p":1792127850097,"x":"The NotificationX plugin for WordPress is vulnerable to Missing Authorization leading to arbitrary content injection in versions up to, and including, 3.3.3 The /notificationx/v1/popup-submit REST route is registered with permission_callback => '__return_true', and the handler at…","s":5.3,"v":"MEDIUM","cwe":"CWE-862"},{"id":"CVE-2026-110590","p":1792127849973,"x":"The Klarna for WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.13.3 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to access any order's secret order_key…","s":7.5,"v":"HIGH","cwe":"CWE-862"},{"id":"CVE-2026-110019","p":1792127849850,"x":"The Bulk Page Generator – LPagery plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.1.0 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and…","s":4.3,"v":"MEDIUM","cwe":"CWE-862"},{"id":"CVE-2026-109998","p":1792127849717,"x":"The Mang Board plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'content' parameter in all versions up to, and including, 2.4.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will…","s":7.2,"v":"HIGH","cwe":"CWE-79"},{"id":"CVE-2026-109515","p":1792127849597,"x":"The MailOptin – Popup, Optin Forms & Email Newsletters for Mailchimp, HubSpot, AWeber Etc. plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.2.78.6 This is due to the `subscribe_to_email_list` endpoint accepting an attacker-supplied…","s":9.8,"v":"CRITICAL","cwe":"CWE-269"},{"id":"CVE-2026-109512","p":1792127849477,"x":"The Mang Board plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'content' parameter in all versions up to, and including, 2.4.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject…","s":6.4,"v":"MEDIUM","cwe":"CWE-79"},{"id":"CVE-2026-109400","p":1792127849350,"x":"The InstaWP Connect – 1-click WP Staging & Migration plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 0.1.4.1 This is due to the plugin registering its admin page via `add_management_page()` using a role name returned by `InstaWP_Setting::get_allowed_role()` as the…","s":7.5,"v":"HIGH","cwe":"CWE-269"},{"id":"CVE-2026-109221","p":1792127849227,"x":"The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the copy_file function in all versions up to, and including, 4.9.3 This makes it possible for authenticated attackers, with Sales Representative-level…","s":8.1,"v":"HIGH","cwe":"CWE-22"},{"id":"CVE-2026-109219","p":1792127849100,"x":"The Mang Board plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.4.4 via the mbw_file_upload function. This is due to missing file extension validation on the attacker-supplied image_path parameter, whose basename-derived file name bypasses the extension allowlist…","s":9.8,"v":"CRITICAL","cwe":"CWE-434"},{"id":"CVE-2026-109191","p":1792127848967,"x":"The Image Hub – Free Images from Unsplash, Pixabay, Pexels, Openverse & Giphy plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.2.0 via the 'image_hub_api_keys_* (6 options)' parameter. This makes it possible for authenticated attackers, with subscriber-level…","s":4.3,"v":"MEDIUM","cwe":"CWE-200"},{"id":"CVE-2026-107746","p":1792127848837,"x":"The FunnelKit – Funnel Builder for WooCommerce Checkout plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.16.0.6 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to…","s":7.5,"v":"HIGH","cwe":"CWE-862"},{"id":"CVE-2026-107659","p":1792127848710,"x":"The Modula Image Gallery – Photo Grid & Video Gallery plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.0.11 via the 'id (post ID in /wp-json/wp/v2/modula-gallery/{id}) or none for collection route' parameter. This makes it possible for unauthenticated…","s":7.5,"v":"HIGH","cwe":"CWE-862"},{"id":"CVE-2026-104798","p":1792127848580,"x":"The My Calendar – Accessible Event Manager plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.8.7. The public `mcs` GET parameter is reflected into post content unsanitized before WordPress core's `do_shortcode` filter runs, allowing an unauthenticated attacker to inject…","s":9.8,"v":"CRITICAL","cwe":"CWE-269"},{"id":"CVE-2026-103911","p":1792127848460,"x":"The The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.58.1. This is due to the software allowing users to execute an action that does not properly validate a value before running…","s":6.5,"v":"MEDIUM","cwe":"CWE-94"},{"id":"CVE-2026-103895","p":1792127848333,"x":"The miniOrange OTP Login, Verification and SMS Notifications plugin for WordPress is vulnerable to Authentication Bypass in versions up to, and including, 5.5.8 via the `mo_by_pass_login()` function. This is due to `mo_delay_otp_process()` short-circuiting the authentication flow before password validation or the…","s":8.1,"v":"HIGH","cwe":"CWE-287"},{"id":"CVE-2026-103525","p":1792127848210,"x":"The FluentCart A New Era of eCommerce – Faster, Lighter, and Simpler plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.7.0 via the 'order_id + billing_address_id (also shipping_address_id)' parameter due to missing validation on a user controlled key. This…","s":7.5,"v":"HIGH","cwe":"CWE-639"},{"id":"CVE-2026-103481","p":1792127848080,"x":"The Gwolle Guestbook plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'permalink' parameter in all versions up to, and including, 5.1.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages…","s":6.1,"v":"MEDIUM","cwe":"CWE-79"},{"id":"CVE-2026-101335","p":1792127847933,"x":"The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in versions up to, and including, 1.58.1. This is due to the forminator_replace_quiz_form_data() helper invoking do_shortcode() on the fully expanded notification body once the…","s":6.5,"v":"MEDIUM","cwe":"CWE-94"},{"id":"CVE-2026-97339","p":1792124324817,"x":"The Complianz GDPR/CCPA Cookie Consent Banner plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via yotu-wp Cookie-Blocker Filter in all versions up to, and including, 7.5.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated…","s":7.2,"v":"HIGH","cwe":"CWE-79"},{"id":"CVE-2026-93953","p":1792124323143,"x":"The Backuply – Backup, Restore, Migrate and Clone plugin for WordPress is vulnerable to SQL Injection via the Biographical Info field (second-order, via restore) in all versions up to, and including, 1.5.8 due to insufficient escaping on the user supplied parameter and the lack of sufficient preparation on an existing…","s":8,"v":"HIGH","cwe":"CWE-89"},{"id":"CVE-2026-93535","p":1792124321860,"x":"The Dark Mode – Improve Accessibility with AI Powered Dark Theme plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'icon_light' Shortcode Attribute in all versions up to, and including, 5.3.17 due to insufficient input sanitization and output escaping. This makes it possible for authenticated…","s":6.4,"v":"MEDIUM","cwe":"CWE-79"},{"id":"CVE-2026-89280","p":1792124321037,"x":"The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.2.1 via the 'password' parameter due to missing validation on a user controlled key. This makes it…","s":4.3,"v":"MEDIUM","cwe":"CWE-639"},{"id":"CVE-2026-77829","p":1792124318197,"x":"The Cooked – Recipe Management plugin for WordPress is vulnerable to Stored Cross-Site Scripting via [cooked-timer] Shortcode Content in all versions up to, and including, 1.16.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level…","s":6.4,"v":"MEDIUM","cwe":"CWE-79"},{"id":"CVE-2026-111451","p":1792124311667,"x":"Wheels CLI 4.0.0 through 4.1.1 insufficiently validates or escapes caller-supplied values and package contents. Deploy release/version/rollback values can execute shell commands on deploy hosts as the SSH user and on the CI runner during builds. Package removal and destroy paths can delete unintended files; package…","s":7.8,"v":"HIGH","cwe":"CWE-78"},{"id":"CVE-2026-111450","p":1792124311500,"x":"Wheels through 4.1.1 derives its default production error-email address from the Host header of the request that starts the application. If no explicit error-email recipient is configured, a mail server is configured, and the server accepts an attacker-chosen Host, an attacker whose request triggers a cold start can…","s":5.9,"v":"MEDIUM","cwe":"CWE-348"},{"id":"CVE-2026-111449","p":1792124311323,"x":"Wheels 3.0.0 through 4.1.1 can disclose detailed exceptions when allowIPBasedDebugAccess=true (disabled by default). An allowed administrator request changes error/debug-display settings in shared application scope. If it overlaps with an unauthorized client's request that raises an error, that client can receive full…","s":5.9,"v":"MEDIUM","cwe":"CWE-362"},{"id":"CVE-2026-111448","p":1792124311143,"x":"Wheels 4.0.0 through 4.1.2 uses case-insensitive comparisons in path-containment checks on case-sensitive filesystems. Canonical-path checks for zip entries, package mappings, development assets/docs, guide images and image tags can accept paths through an existing symlink to a case-distinct sibling directory,…","s":3.7,"v":"LOW","cwe":"CWE-178"},{"id":"CVE-2026-111447","p":1792124310960,"x":"Wheels 1.1 through 4.1.2 resolves nestedProperties() records by posted primary key without checking that they belong to the parent being saved. A user able to submit a nested form for their own parent can update and reassign another parent's hasMany or hasOne rows, or delete them when allowDelete=true. Nested…","s":8.1,"v":"HIGH","cwe":"CWE-472"},{"id":"CVE-2026-111446","p":1792124310763,"x":"Wheels 4.0.0 through 4.1.2 exposes password-less development tools under /wheels/* to remote clients when enablePublicComponent=true, as it is by default in development. Before 4.1.2 these tools have no local-access restriction; in 4.1.2 the restriction trusts client-supplied headers without checking the connecting…","s":8.6,"v":"HIGH","cwe":"CWE-863"},{"id":"CVE-2026-111445","p":1792124310563,"x":"Wheels 4.0.0 through 4.1.2 before 4.2.0 replaces incoming scope conditions with a primary-key condition in findByKey() and exists(key=). For exists(key=), production with error information disabled returns true for an out-of-scope key instead of throwing. Applications relying on scopes for ownership or tenant…","s":8.1,"v":"HIGH","cwe":"CWE-669"},{"id":"CVE-2026-111444","p":1792124310353,"x":"Wheels through 4.1.2 allows SQL injection on MySQL/MariaDB with backslash escaping enabled (NO_BACKSLASH_ESCAPES absent) when an application supplies request data to inline-literal paths. These include opt-in parameterize=false queries and IN lists, and positions in developer-written where strings that the parser does…","s":9.8,"v":"CRITICAL","cwe":"CWE-89"},{"id":"CVE-2026-111443","p":1792124310133,"x":"Wheels 4.0.6 through 4.1.2 lets an unauthenticated client switch a request into a separate test application context, including in production, by supplying an X-Wheels-Test-Context header or WHEELS_TEST_CONTEXT cookie with any value, or including a test-runner path anywhere in the URL, even the query string. The…","s":6.5,"v":"MEDIUM","cwe":"CWE-348"},{"id":"CVE-2026-111442","p":1792124309820,"x":"Backdrop CMS Core 1.35.x before 1.35.2 and 1.34.x before 1.34.6 does not sufficiently validate uploaded SVG images to ensure they lack potentially dangerous SVG tags. SVG images can contain clickable links or executable scripting. By uploading a crafted SVG, it is possible to execute scripting in the browser when an…","s":5.3,"v":"MEDIUM","cwe":"CWE-79"},{"id":"CVE-2026-109990","p":1792124306860,"x":"The Flying Scripts: Delay JavaScript to Improve Site Speed & Performance plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 1.2.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated…","s":7.2,"v":"HIGH","cwe":"CWE-79"},{"id":"CVE-2026-109207","p":1792124306583,"x":"The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'media:thumbnail@url' parameter in all versions up to, and including, 5.2.11 due to insufficient input sanitization and output escaping. This makes…","s":7.2,"v":"HIGH","cwe":"CWE-79"},{"id":"CVE-2026-107758","p":1792124304003,"x":"The Colibri Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 1.0.390 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages…","s":7.2,"v":"HIGH","cwe":"CWE-79"},{"id":"CVE-2026-104769","p":1792124303037,"x":"The Debloat – Remove Unused CSS, Optimize JS plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.3.0 via the 's' parameter parameter. This makes it possible for authenticated attackers, with administrator-level access and above, to read the contents of arbitrary files on…","s":5.9,"v":"MEDIUM","cwe":"CWE-22"},{"id":"CVE-2026-104745","p":1792124301607,"x":"The Customer Email Verification for WooCommerce plugin for WordPress is vulnerable to Privilege Escalation via the `alg_wc_ev_verify_email` parameter in versions up to, and including, 3.3.0. The vulnerability exists because `alg_wc_ev_generate_user_code()` generates the per-user activation secret using `wp_rand(100)`…","s":8.1,"v":"HIGH","cwe":"CWE-269"},{"id":"CVE-2026-103518","p":1792124301027,"x":"The FluentCart A New Era of eCommerce – Faster, Lighter, and Simpler plugin for WordPress is vulnerable to generic SQL Injection via the 'products[*].variants[*].<attacker-chosen key>' parameter in all versions up to, and including, 1.7.0 due to insufficient escaping on the user supplied parameter and lack of…","s":4.9,"v":"MEDIUM","cwe":"CWE-89"},{"id":"CVE-2026-111389","p":1792120686540,"x":"Frappe HRMS 14.x before 14.38.2, 15.x before 15.64.0, and 16.x before 16.18.0 contains a SQL injection vulnerability in some endpoints caused by missing input validation. Any authenticated attacker, including a low-privilege account, can send specially crafted requests to these endpoints to extract sensitive…","s":7.7,"v":"HIGH","cwe":"CWE-89"},{"id":"CVE-2026-111388","p":1792120686380,"x":"Frappe Framework before 15.120.0 and 16.x before 16.33.0 does not enforce the per-user restrict_ip allowlist for non-session authentication methods, including API key, OAuth, and header-based authentication. Attackers holding valid credentials of these types can authenticate from IP addresses outside the allowlist,…","s":5.4,"v":"MEDIUM","cwe":"CWE-284"},{"id":"CVE-2026-111387","p":1792120686217,"x":"Nezha from 2.2.5 before 2.3.15 contains an information disclosure vulnerability that allows authenticated users to retrieve third-party credentials because listDDNS omits WebhookURL and WebhookRequestBody redaction. Admins or PATs with nezha:ddns:read scope can call GET /api/v1/ddns to read cleartext tokens embedded…","s":6.5,"v":"MEDIUM","cwe":"CWE-212"},{"id":"CVE-2026-111386","p":1792120686057,"x":"Nezha from 1.7.0 before 2.3.15 contains an information disclosure vulnerability that allows authenticated members to enumerate other tenants' server IDs through differential responses. Attackers can sweep sequential IDs against getServerConfig and setServerConfig, distinguishing 'permission denied' from success…","s":4.3,"v":"MEDIUM","cwe":"CWE-204"},{"id":"CVE-2026-111385","p":1792120685893,"x":"Nezha from 2.1.0 before 2.3.15 contains a host header injection vulnerability in mintTransferTool that builds fs.download_url and fs.upload_url transfer URLs from the unvalidated Host header. Attackers who control the Host header seen on a victim's MCP request can redirect file uploads or capture one-time download…","s":4.8,"v":"MEDIUM","cwe":"CWE-601"},{"id":"CVE-2026-111384","p":1792120685740,"x":"Nezha 1.0.0 before 2.3.15 contains a memory exhaustion vulnerability in the dashboard file manager WebSocket endpoint because fmStream never calls SetReadLimit, leaving message size unbounded. Authenticated users with file manager scopes can send one oversized binary message to /api/v1/ws/file/:id, triggering an OOM…","s":6.5,"v":"MEDIUM","cwe":"CWE-770"},{"id":"CVE-2026-111383","p":1792120685537,"x":"Nezha from 2.0.13 before 2.3.15 contains a resource exhaustion vulnerability that allows authenticated users to open unbounded concurrent connections to the /api/v1/ws/transfer WebSocket endpoint. Attackers can hold thousands of subscriptions created by ServerTransferClass.Subscribe without limits, exhausting file…","s":6.5,"v":"MEDIUM","cwe":"CWE-770"},{"id":"CVE-2026-111382","p":1792120685400,"x":"FreeRDP before 3.32.0 contains a client-side heap out-of-bounds write vulnerability in general_LumaToYUV444 and general_ChromaV2ToYUV444 that allows malicious RDP servers to corrupt client memory. Attackers can send RDPGFX AVC444 or AVC444v2 frames with odd-height region rects ending at surface height to write past…","s":8.8,"v":"HIGH","cwe":"CWE-787"},{"id":"CVE-2026-111381","p":1792120685267,"x":"FreeRDP before 3.32.0 contains a heap buffer overflow vulnerability in persistent_cache_read_entry_v2 that allows local attackers to corrupt heap memory via integer wraparound in bitmap size calculation. Attackers can craft a persistent cache v2 file with oversized width and height values that causes mismatched entry…","s":7.3,"v":"HIGH","cwe":"CWE-122"},{"id":"CVE-2026-111380","p":1792120685123,"x":"FreeRDP from 3.29.0 before 3.32.0 contains an integer overflow in the Apple audin backends (audin_mac.m, audin_ios.m), which compute the audio queue buffer size as FramesPerPacket * 2 * nChannels in UINT32 arithmetic, bypassing the CVE-2026-91962 fix. A malicious RDP server can send FramesPerPacket of 2^30 in the…","s":8.8,"v":"HIGH","cwe":"CWE-190"},{"id":"CVE-2026-111379","p":1792120684980,"x":"FreeRDP before 3.32.0 contains a heap buffer overflow vulnerability in persistent_cache_read_entry_v3 that allows local attackers to corrupt memory by supplying a crafted v3 persistent cache file. Attackers can set large width and height values that wrap the size calculation in persist_cache_get_data, causing fread to…","s":7.3,"v":"HIGH","cwe":"CWE-122"},{"id":"CVE-2026-111378","p":1792120684850,"x":"FreeRDP from 3.0.0 before 3.32.0 contains an uncontrolled resource consumption vulnerability in parse_nla_mode_pdu that allows unauthenticated attackers to exhaust server memory. Attackers can complete TLS and stream bytes not beginning with the DER SEQUENCE tag 0x30, causing unbounded receive buffer growth before NLA…","s":7.5,"v":"HIGH","cwe":"CWE-400"},{"id":"CVE-2026-111377","p":1792120684703,"x":"FreeRDP from 2.0.0 before 3.32.0 contains an unbounded reassembly vulnerability in WTSProcessChannelData that fails to enforce cumulative fragment limits. Authenticated clients can start a static virtual channel message, withhold the LAST flag, and send endless fragments to exhaust server memory.","s":6.5,"v":"MEDIUM","cwe":"CWE-400"},{"id":"CVE-2026-111376","p":1792120684510,"x":"FreeRDP from 3.30.0 before 3.32.0 contains a heap out-of-bounds read vulnerability in the Windows client's CliprdrStream_New that allows malicious RDP servers to trigger invalid memory reads via short clipboard responses. Attackers can answer a FILECONTENTS_SIZE request with a cbRequested of fewer than eight bytes…","s":5,"v":"MEDIUM","cwe":"CWE-125"},{"id":"CVE-2026-111375","p":1792120684363,"x":"FreeRDP from 3.0.0 before 3.32.0 contains an out-of-bounds read vulnerability in the Windows RAIL client that allows malicious RDP servers to trigger heap over-reads by sending non-NUL-terminated window titles. Attackers can send a full-length WINDOW_ORDER_FIELD_TITLE update that wf_rail_window_common passes to…","s":4.8,"v":"MEDIUM","cwe":"CWE-125"},{"id":"CVE-2026-111374","p":1792120684223,"x":"FreeRDP from 3.30.0 before 3.32.0 contains a resource exhaustion vulnerability in the rdpecam client that lets malicious RDP servers request unadvertised camera media types. Attackers can send a StartStreamsRequest with oversized dimensions to force large pending-sample allocations and reconfigure the local camera…","s":5.3,"v":"MEDIUM","cwe":"CWE-20"},{"id":"CVE-2026-111373","p":1792120684063,"x":"FreeRDP before 3.32.0 contains a NULL pointer dereference vulnerability in the websocket transport that allows a malicious gateway to crash clients by sending zero-length pings. When the payload length is zero, websocket_reply_pong passes a nullptr stream to websocket_reply_close, triggering an assertion failure that…","s":5.3,"v":"MEDIUM","cwe":"CWE-476"},{"id":"CVE-2026-111237","p":1792120683880,"x":"A weakness has been identified in Ultralytics FastSAM up to b4ed20c2fed75eadc5aa7d8b09fedd137b873b52. This affects the function session.get_modelmeta.custom_metadata_map of the file ultralytics/nn/autobackend.py of the component AutoBackend Model Loading. This manipulation of the argument imgsz/names/kpt_shape causes…","s":5.3,"v":"MEDIUM","cwe":"CWE-94"},{"id":"CVE-2026-111212","p":1792120683650,"x":"A security flaw has been discovered in ImprintLab Medical-SAM-Adapter 0.1.0-alpha/0.1.0. Affected by this issue is the function session.get_modelmeta.custom_metadata_map of the file models/MobileSAMv2/ultralytics/nn/autobackend.py of the component AutoBackend Model Loading. The manipulation of the argument…","s":4.8,"v":"MEDIUM","cwe":"CWE-94"},{"id":"CVE-2026-109813","p":1792120682277,"x":"A hard-coded cryptographic key vulnerability exists in the `/usr/bin/sysman` of some of Moxa's industrial computing products. An unauthenticated attacker with adjacent network access could exploit the exposed private key material to compromise the confidentiality and integrity of communications.","s":8.6,"v":"HIGH","cwe":"CWE-321"},{"id":"CVE-2026-109812","p":1792120682120,"x":"A missing authorization vulnerability exists in the internal API `/api/v1/secrets/` of some of Moxa's industrial computing products. A low-privileged authenticated attacker with adjacent network access could exploit this vulnerability to access sensitive information, potentially resulting in the disclosure of…","s":6.9,"v":"MEDIUM","cwe":"CWE-862"},{"id":"CVE-2026-105228","p":1792120678517,"x":"This vulnerability allows remote attackers to disclose sensitive information on affected installations of Delta ISPSoft.","s":7,"v":"HIGH","cwe":"CWE-125"},{"id":"CVE-2026-105227","p":1792120678357,"x":"This vulnerability allows remote attackers to disclose sensitive information on affected installations of Delta ISPSoft.","s":7,"v":"HIGH","cwe":"CWE-125"},{"id":"CVE-2026-100159","p":1792120678000,"x":"The Popup Box plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in versions 6.4.1 to 6.4.2. This is due to the ays_popup_get_user_ip() function reading the client-controlled Client-IP / X-Forwarded-For / Forwarded / X-Forwarded / Forwarded-For request headers, sanitizing them only with…","s":4.8,"v":"MEDIUM","cwe":"CWE-94"},{"id":"CVE-2026-92777","p":1792109827333,"x":"A potential vulnerability was reported in some Lenovo Tablets that could allow a user with physical access to an unlocked tablet to bypass device protections and execute arbitrary code.","s":6.4,"v":"MEDIUM","cwe":"CWE-1394"},{"id":"CVE-2026-92629","p":1792109827190,"x":"A potential improper authorization vulnerability was reported in Lenovo Baiying PC Client, distributed exclusively in the Chinese market, that could allow a local authenticated user to execute arbitrary code with elevated privileges.","s":7.3,"v":"HIGH","cwe":"CWE-862"},{"id":"CVE-2026-89062","p":1792109827037,"x":"A potential out-of-bounds write vulnerability was reported in the Lenovo Energy Management driver that could allow a local authenticated user to cause a blue screen error.","s":5.5,"v":"MEDIUM","cwe":"CWE-787"},{"id":"CVE-2026-89057","p":1792109826417,"x":"A potential authentication bypass vulnerability was reported in some Lenovo tablets that could allow a user with physical access to gain unauthorized device access.","s":6.8,"v":"MEDIUM","cwe":"CWE-288"},{"id":"CVE-2026-84823","p":1792109825573,"x":"A flaw was found in WildFly. A user with the `Monitor` role, which is the lowest standard Role-Based Access Control (RBAC) role, can exploit a path traversal vulnerability in the `take-snapshot` operation. By manipulating the `name` parameter, this user can write a copy of the server configuration to an arbitrary…","s":7.1,"v":"HIGH","cwe":"CWE-22"},{"id":"CVE-2026-75941","p":1792109825420,"x":"A potential vulnerability was reported in the Lenovo Legion Zone application, distributed exclusively in the Chinese market, that could allow an attacker on the same logical network to execute arbitrary code.","s":8,"v":"HIGH","cwe":"CWE-502"},{"id":"CVE-2026-16755","p":1792109825220,"x":"A potential vulnerability was reported in Lenovo Smart Camera C33, distributed exclusively in the Chinese market, that could allow an unauthorized remote user to disclose sensitive information.","s":5.3,"v":"MEDIUM","cwe":"CWE-1393"},{"id":"CVE-2026-16754","p":1792109825020,"x":"A potential improper certificate validation vulnerability was reported in Lenovo Smart Camera C33, distributed exclusively in the Chinese market, that could allow an adjacent user to intercept or manipulate network communications.","s":4.8,"v":"MEDIUM","cwe":"CWE-295"},{"id":"CVE-2026-111210","p":1792109824180,"x":"A vulnerability was determined in bitcoinj up to 0.17. Affected is the function url.openConnection of the file PaymentSession.java of the component Payment Request Handler. Executing a manipulation of the argument pki_type can lead to server-side request forgery. It is possible to launch the attack remotely. The…","s":7.3,"v":"HIGH","cwe":"CWE-918"},{"id":"CVE-2026-96806","p":1792102879090,"x":"The Apache Airflow Keycloak auth manager did not end the session on logout: the logout route revoked the presented token, but `KeycloakJWTMiddleware` then issued a new, unrevoked token on the same response, so the user stayed logged in. Deployments using the Keycloak auth manager are affected: after a user logs out,…","s":5.8,"v":"MEDIUM","cwe":"CWE-613"},{"id":"CVE-2026-94135","p":1792102872140,"x":"The Apache Airflow SFTP provider's deferrable code paths (`SFTPTrigger`, `SFTPHookAsync`, `SFTPClientPool`) disable SSH host-key verification by default unless the connection explicitly sets `no_host_key_check` to false. Deployments that run SFTP sensors or operators in deferrable mode are affected. An attacker in a…","s":4.3,"v":"MEDIUM","cwe":"CWE-322"},{"id":"CVE-2026-94134","p":1792102872023,"x":"The Apache Airflow SSH provider hook disables SSH host-key verification by default: unless `host_key` is configured or `no_host_key_check` is explicitly set to false, it accepts any server key. This affects SSH and SFTP connections that rely on the default. An attacker in a machine-in-the-middle position between the…","s":9.1,"v":"CRITICAL","cwe":"CWE-322"},{"id":"CVE-2026-92228","p":1792102871410,"x":"The Apache Airflow Keycloak provider's multi-team provisioning (`_attach_team_permissions`) granted every team role global read access to audit logs. Deployments that enable multi-team mode with the Keycloak auth manager and provision teams through it are affected: any authenticated member of one team could read other…","s":6.5,"v":"MEDIUM","cwe":"CWE-732"},{"id":"CVE-2026-111369","p":1792102775013,"x":"ClassroomIO through 1.0.0 contains an incorrect authorization vulnerability in the PUT and DELETE /:lessonId lesson routes that allows any course member, including students, to modify lessons. Authenticated students can supply arbitrary lesson ids to change titles and stored HTML content or delete lessons in their…","s":7.1,"v":"HIGH","cwe":"CWE-863"},{"id":"CVE-2026-111368","p":1792102774847,"x":"ClassroomIO through 1.0.0 contains an insecure direct object reference vulnerability in the Hono API course submission routes that allows course tutors or admins to modify submissions in other courses. Attackers can supply their own course id with another course's submission UUID to PUT or DELETE handlers to overwrite…","s":6.4,"v":"MEDIUM","cwe":"CWE-639"},{"id":"CVE-2026-111367","p":1792102774703,"x":"BillionMail through 4.9 contains a hard-coded cryptographic key vulnerability that allows unauthenticated attackers to forge unsubscribe and subscribe-confirm JWTs by computing the key from shipped configuration constants. Attackers can submit forged tokens to /api/unsubscribe, /api/unsubscribe_new, or…","s":6.5,"v":"MEDIUM","cwe":"CWE-1394"},{"id":"CVE-2026-111366","p":1792102774557,"x":"cool-admin-midway through 8.0.0 contains an authorization bypass vulnerability that allows department-limited admins to manage users outside their departments by supplying arbitrary user ids. Attackers holding sys:user:* permissions can call /admin/sys/user/info, update, or delete to read records, reset passwords and…","s":7.2,"v":"HIGH","cwe":"CWE-639"},{"id":"CVE-2026-111365","p":1792102774407,"x":"cool-admin-midway through 8.0.0 contains an authorization bypass vulnerability that allows non-superadmin admins to read, modify, or delete other admins' roles by supplying arbitrary role ids. Attackers holding ordinary sys:role permissions can call /admin/sys/role/info, update, or delete with another admin's role id…","s":6,"v":"MEDIUM","cwe":"CWE-639"},{"id":"CVE-2026-111364","p":1792102774260,"x":"MinDoc through 2.2-beta.2 contains an insecure direct object reference vulnerability in DocumentController.Content that allows authenticated users to read documents from unauthorized books. Attackers holding a non-observer role on any book can name that book and iterate sequential document ids to read markdown and…","s":6.5,"v":"MEDIUM","cwe":"CWE-639"},{"id":"CVE-2026-111363","p":1792102774103,"x":"BISHENG through 3.0.0-beta4 contains an insecure direct object reference vulnerability that allows authenticated low-privileged users to read other users' parsed documents by supplying arbitrary file_id values. Attackers can enumerate sequential file ids against GET /api/v1/knowledge/file_bbox to retrieve extracted…","s":6.5,"v":"MEDIUM","cwe":"CWE-639"},{"id":"CVE-2026-111359","p":1792102773937,"x":"CRMEB 5.6.1 through 6.0.0 contains an insecure direct object reference vulnerability that allows authenticated storefront users to read and claim other users' orders via the gift-order API. Attackers can enumerate sequential order IDs in gift_detail to harvest buyer identities and the gift_key, then call receive_gift…","s":7.1,"v":"HIGH","cwe":"CWE-639"},{"id":"CVE-2026-111358","p":1792102773793,"x":"SendPortal sendportal-core through 4.0.1 contains an authorization bypass vulnerability that allows authenticated workspace members to attach subscribers to other workspaces' tags by supplying unvalidated tag IDs. Attackers can submit sequential tag IDs via the web subscriber form or CSV import to receive victim…","s":5.4,"v":"MEDIUM","cwe":"CWE-639"},{"id":"CVE-2026-111356","p":1792102773647,"x":"MacCMS v10 through 2026.1000.4056 does not limit attempts on the six-digit password recovery code, allowing unauthenticated attackers to take over member accounts. Attackers knowing a victim's email or phone can request a code and brute-force findpass_reset to overwrite the member's password.","s":7.4,"v":"HIGH","cwe":"CWE-307"},{"id":"CVE-2026-111355","p":1792102773503,"x":"zhontai Admin.Core through 10.1.0 contains an authorization bypass vulnerability that allows authenticated users to ignore department DataScope restrictions by supplying out-of-scope record ids. Attackers holding user or organization module permissions with Dept or Self scope can call UserService and OrgService by-id…","s":6.3,"v":"MEDIUM","cwe":"CWE-639"},{"id":"CVE-2026-111354","p":1792102773353,"x":"crmeb_java through 3.1 contains an authorization bypass vulnerability that allows authenticated members to read other members' orders by supplying their order numbers. Attackers can request /api/front/order/express/{orderId} or /api/front/order/apply/refund/{orderId} to view victims' tracking numbers, logistics…","s":3.1,"v":"LOW","cwe":"CWE-639"},{"id":"CVE-2026-111353","p":1792102773190,"x":"Peppermint through 0.5.5 contains a missing authorization vulnerability that allows any authenticated user to create time entries and attachments as other users by supplying a user id in the request body. Attackers can send POST requests to /api/v1/time/new or /api/v1/storage/ticket/:id/upload/single to attach files…","s":4.3,"v":"MEDIUM","cwe":"CWE-862"},{"id":"CVE-2026-111352","p":1792102773043,"x":"ThinkCMF through 8.0.1 contains an incorrect authorization vulnerability in RestAdminBaseController that allows restricted backend administrators to call every admin REST API endpoint because Auth::check() fails open when no admin_api rule exists. Attackers with a valid admin-type API token can list member emails and…","s":8.8,"v":"HIGH","cwe":"CWE-863"},{"id":"CVE-2026-111351","p":1792102772883,"x":"metasfresh through 5.175 contains a missing record-level authorization vulnerability in BoardRestController that allows authenticated low-privilege users to bypass role and organization access checks. Attackers can call the getBoard, getCard, addCard, removeCard and patchCard handlers to read records outside their…","s":4.2,"v":"MEDIUM","cwe":"CWE-639"},{"id":"CVE-2026-111350","p":1792102772737,"x":"Papermark through 0.22.0 contains a missing authorization vulnerability in the data room viewer group API that allows authenticated users to delete other teams' viewer groups and share links. Attackers who know a victim team's data room and group identifiers can send DELETE requests, read group links, or rewrite group…","s":5,"v":"MEDIUM","cwe":"CWE-862"},{"id":"CVE-2026-111349","p":1792102772587,"x":"Craftplan through 0.7.5 contains a missing authorization vulnerability in the CRM Customer resource that allows unauthenticated attackers to create customer records via JSON:API and GraphQL. Attackers can send anonymous requests to POST /api/json/customers or the create_customer mutation to insert attacker-chosen…","s":5.3,"v":"MEDIUM","cwe":"CWE-862"},{"id":"CVE-2026-111348","p":1792102772440,"x":"Likeshop through 3.5.1 contains an insecure direct object reference vulnerability in AfterSale.php and AfterSaleLogic.php that lets authenticated users access other customers' after-sale records by supplying their ids. Attackers with self-registered accounts can call the detail, goodsInfo, cancel, express, and again…","s":5.4,"v":"MEDIUM","cwe":"CWE-639"},{"id":"CVE-2026-111347","p":1792102772300,"x":"go-ldap-admin through 0.6.2 embeds a hard-coded RSA private key, published in the public repository, that protects encrypted login passwords. Unauthenticated attackers who capture encrypted passwords can decrypt them offline or via the /base/decryptpwd endpoint, recovering cleartext LDAP credentials for reuse.","s":5.9,"v":"MEDIUM","cwe":"CWE-321"},{"id":"CVE-2026-111346","p":1792102772150,"x":"ZenTao PMS through 22.6 contains an authorization bypass vulnerability in action::editComment that allows authenticated users to read and overwrite other users' comments by supplying an arbitrary actionID. Attackers can iterate sequential action ids to modify comments on bugs, stories, tasks, and documents in products…","s":5.4,"v":"MEDIUM","cwe":"CWE-639"},{"id":"CVE-2026-111345","p":1792102771980,"x":"Trudesk through 1.2.11 contains an authorization bypass vulnerability that allows any authenticated user to read private conversations by supplying another conversation's id. Attackers can request GET /api/v1/messages/conversation/:id, which lacks participant checks, to obtain full message history plus participants'…","s":4.3,"v":"MEDIUM","cwe":"CWE-639"},{"id":"CVE-2026-111344","p":1792102771813,"x":"APITable through 1.14.0-beta contains an authorization bypass vulnerability that allows authenticated users to read node descriptions from other spaces by supplying a user-controlled nodeId. Attackers can request GET /node/{nodeId}/description, which skips space membership and node permission checks, to disclose…","s":4.3,"v":"MEDIUM","cwe":"CWE-639"},{"id":"CVE-2026-111343","p":1792102771650,"x":"pig through 4.1.1 contains a missing authorization vulnerability in SysUserController.user that allows any authenticated user to read other users' profiles via GET /admin/user/details/{id}. Low-privilege attackers can enumerate sequential user ids to obtain usernames, real names, phone numbers, emails, linked…","s":4.3,"v":"MEDIUM","cwe":"CWE-862"},{"id":"CVE-2026-111332","p":1792102771507,"x":"OxiCloud 0.9.1 through 0.9.3 contains an incorrect authorization vulnerability that allows anonymous visitors to keep share access after password protection is added. Attackers holding an existing oxi_shares share-ring cookie can request content via GET /api/files/{id} to read shared files or folder contents despite…","s":3.7,"v":"LOW","cwe":"CWE-863"},{"id":"CVE-2026-111331","p":1792102771350,"x":"Dokploy through 0.30.8 contains a cross-organization authorization bypass in the port tRPC router that allows authenticated owners or admins of any organization to manage other tenants' ports because the target application's organization is never verified. Attackers supplying a known portId or applicationId to…","s":6.3,"v":"MEDIUM","cwe":"CWE-639"},{"id":"CVE-2026-111330","p":1792102771210,"x":"JuggleIM im-server through 1.8.16 contains a weak password hashing vulnerability that stores admin console passwords as unsalted SHA-1 digests via tools.SHA1 in services/accountservice.go. Attackers who obtain the accounts table through database access or backups can crack console passwords using precomputed tables or…","s":5.9,"v":"MEDIUM","cwe":"CWE-916"},{"id":"CVE-2026-111329","p":1792102771063,"x":"JuggleIM im-server through 1.8.16 ships default administrator credentials admin/123456 that allow unauthenticated remote attackers to access the admin console on port 8090. Attackers can log in as administrator, even after account deletion since CheckLogin recreates it, to control tenant applications and app secrets.","s":9.8,"v":"CRITICAL","cwe":"CWE-1392"},{"id":"CVE-2026-111324","p":1792102770927,"x":"rustdesk-api through 2.7 contains an authorization bypass vulnerability that allows unauthenticated attackers to overwrite existing peer records by supplying only a target device ID to POST /api/sysinfo. Attackers can overwrite hostname, username, OS and uuid without uuid verification, then log in presenting that uuid…","s":5.3,"v":"MEDIUM","cwe":"CWE-639"},{"id":"CVE-2026-111323","p":1792102770780,"x":"RedAmon through 7.0.1 contains an unauthenticated server-side request forgery vulnerability in the agent POST /tradecraft/verify endpoint because validate_url checks only the initial hostname. Attackers can submit a public URL that redirects or DNS-rebinds to internal addresses like cloud metadata services, receiving…","s":5.3,"v":"MEDIUM","cwe":"CWE-918"},{"id":"CVE-2026-111322","p":1792102770633,"x":"Archon 0.2.13 through 0.11.1 contains a missing authentication vulnerability that allows unauthenticated attackers to access the /api/* control API, which binds to 0.0.0.0 by default. Attackers with network access can send messages to the AI coding agent, which runs with bypassPermissions, to execute commands on the…","s":9.8,"v":"CRITICAL","cwe":"CWE-306"},{"id":"CVE-2026-111321","p":1792102770487,"x":"TaskingAI through 0.3.0 contains a server-side request forgery vulnerability that allows authenticated attackers to make the backend send arbitrary HTTP requests by supplying an unvalidated OpenAPI servers[0].url in a user-defined action. Attackers holding a project API key or console admin login can create an action…","s":5.4,"v":"MEDIUM","cwe":"CWE-918"},{"id":"CVE-2026-111320","p":1792102770343,"x":"ValueCell through 0.1.20 contains an unauthenticated server-side request forgery vulnerability that allows remote attackers to direct backend requests by setting an unvalidated provider base_url. Attackers can set base_url via the provider config endpoint and trigger POST /api/v1/models/check to reach internal or…","s":6.5,"v":"MEDIUM","cwe":"CWE-918"},{"id":"CVE-2026-111313","p":1792102770200,"x":"JobOps through 0.13.1 contains a server-side request forgery vulnerability in the POST /api/manual-jobs/fetch handler that allows authenticated users, or unauthenticated clients in demo mode, to make the server fetch internal destinations. Attackers can supply loopback, private, or cloud metadata addresses in the url…","s":6.5,"v":"MEDIUM","cwe":"CWE-918"},{"id":"CVE-2026-111312","p":1792102770053,"x":"OpenHealth through 0.2.0 contains a missing authentication and authorization vulnerability in the /api/health-data/[id] GET, PATCH and DELETE handlers that query records by id without session or authorId checks. Unauthenticated attackers who know a HealthData record id can read another user's medical record data and…","s":7.7,"v":"HIGH","cwe":"CWE-306"},{"id":"CVE-2026-111284","p":1792102769893,"x":"Aureus ERP through 1.6.0 contains a stored cross-site scripting vulnerability in HolidayAction.php that allows authenticated users to inject scripts via unescaped holiday names rendered as HtmlString. Attackers permitted to create Public Holidays or Mandatory Days can store JavaScript payloads that execute when HR…","s":5.4,"v":"MEDIUM","cwe":"CWE-79"},{"id":"CVE-2026-111283","p":1792102769747,"x":"BMC Helix Network Management on-prem before 26.3.01 contains an authentication bypass vulnerability that allows unauthenticated attackers to log in as the local administrator with any password when SAML single sign-on is configured. Attackers can submit the administrator username with an arbitrary password on the web…","s":9,"v":"CRITICAL","cwe":"CWE-305"},{"id":"CVE-2026-111282","p":1792102769600,"x":"Driftregion iso14229 before 0.10.1 contains an integer wraparound in Handle_0x38_RequestFileTransfer that lets unauthenticated attackers bypass the file path length check. Attackers can send a short RequestFileTransfer (SID 0x38) request with filePathAndNameLength 0xFFFC-0xFFFF, causing callbacks to read past the…","s":8.2,"v":"HIGH","cwe":"CWE-190"},{"id":"CVE-2026-111281","p":1792102769457,"x":"Jooan JA-A12 IP cameras with firmware 009_20171107 and 05.02.31.105 contain a remote code execution vulnerability that allows unauthenticated attackers to run root commands via hard-coded credentials. Attackers send singleCMD=SetDiagMode to /goform/SingleHandlebyCommand with an attacker-chosen authserverip and…","s":9.8,"v":"CRITICAL","cwe":"CWE-798"},{"id":"CVE-2026-111280","p":1792102769317,"x":"snap7 through 1.4.3 contains an out-of-bounds write vulnerability in TSnap7MicroClient::opReadArea() that allows malicious S7 peers to overflow client buffers via an unchecked DataLength field. Rogue or impersonated PLCs can return crafted ReadVar responses causing memcpy of up to 65535 bytes into caller buffers,…","s":7.4,"v":"HIGH","cwe":"CWE-787"},{"id":"CVE-2026-111279","p":1792102769157,"x":"Dragonfly through 2.0.2 contains an unbounded memory allocation vulnerability that allows unauthenticated clients to exhaust memory by passing a negative COUNT to HRANDFIELD, ZRANDMEMBER or SRANDMEMBER. Attackers can send a single command against a one-element key with a huge negative COUNT to trigger the OOM killer,…","s":7.5,"v":"HIGH","cwe":"CWE-789"},{"id":"CVE-2026-111278","p":1792102768963,"x":"NivoCart through 2.5.1 contains a CAPTCHA bypass vulnerability that allows unauthenticated attackers to defeat form protection because the expected code is printed as plain text in the HTML. Attackers can fetch protected forms, extract the captcha_image value with a pattern match, and submit it to automate spam,…","s":5.3,"v":"MEDIUM","cwe":"CWE-804"},{"id":"CVE-2026-111277","p":1792102768770,"x":"NivoCart through 2.5.1 contains a missing authorization vulnerability in the download() action of account/order that allows unauthenticated attackers to retrieve guest order invoices by supplying an order_id. Attackers can iterate the order_id parameter, which matches guest orders stored with customer_id 0, to…","s":7.5,"v":"HIGH","cwe":"CWE-862"},{"id":"CVE-2026-111275","p":1792102768623,"x":"nifti_clib through 3.0.1 contains a stack-based out-of-bounds read and write vulnerability in nifti_convert_n2hdr2nim() because the NIfTI-2 dim[0] value is never range-checked. Attackers can supply a crafted 540-byte NIfTI-2 header read via nifti_image_read() to crash applications or corrupt stack memory.","s":6.1,"v":"MEDIUM","cwe":"CWE-787"},{"id":"CVE-2026-111274","p":1792102768477,"x":"unarr through 1.1.1 contains a heap-based out-of-bounds read in zip_parse_extra_fields() in zip/parse-zip.c due to an incorrect ZIP64 extra field length check. Attackers can supply a crafted ZIP archive with 0xFFFFFFFF sentinel values and a truncated ZIP64 record to read past the heap buffer and crash the process.","s":5.5,"v":"MEDIUM","cwe":"CWE-125"},{"id":"CVE-2026-111273","p":1792102768333,"x":"unarr through 1.1.1 contains an off-by-one heap-based buffer overflow in tar_get_name() in tar/parse-tar.c, reachable through the ar_entry_get_name() API. Attackers can supply a crafted TAR archive with a full ustar prefix and name to write a NUL byte past the allocation, corrupting heap memory and crashing the…","s":6.1,"v":"MEDIUM","cwe":"CWE-193"},{"id":"CVE-2026-111272","p":1792102768100,"x":"LibRaw through 0.22.2 contains a heap-based out-of-bounds read in LibRaw::parseNikonMakernote() that allows attackers to read past a short ShotInfo buffer. Attackers can supply a crafted Nikon NEF/TIFF with a 5-byte ShotInfo tag declaring version 243 to crash applications decoding the image.","s":5.5,"v":"MEDIUM","cwe":"CWE-125"},{"id":"CVE-2026-111271","p":1792102767957,"x":"libmodplug through 0.8.9.1 contains a heap-based out-of-bounds read vulnerability in CSoundFile::ReadAMS2() in src/load_ams.cpp that allows attackers to read adjacent heap memory via crafted AMS files. Attackers can supply an AMS module whose pattern effect bytes keep bit 7 set, driving the decoder past the input…","s":5.5,"v":"MEDIUM","cwe":"CWE-125"},{"id":"CVE-2026-111270","p":1792102767820,"x":"libmodplug through 0.8.9.1 contains a heap-based out-of-bounds write in CSoundFile::ReadDSM() in src/load_dsm.cpp because nPat is never checked against MAX_PATTERNS. Attackers can supply a crafted DSM file with over 240 PATT chunks or a wrapping patt_len value to corrupt heap memory and crash the consuming process.","s":6.1,"v":"MEDIUM","cwe":"CWE-787"},{"id":"CVE-2026-111269","p":1792102767680,"x":"libical through 4.0.6 contains a heap-based out-of-bounds read in icalvalue_decode_ical_string() in src/libical/icalvalue.c when decoding input ending in a backslash. Attackers can supply escaped iCalendar text with a trailing backslash, causing the loop to read past the terminator and crash the application or leak…","s":6.1,"v":"MEDIUM","cwe":"CWE-125"},{"id":"CVE-2026-110922","p":1792102767570,"x":"Use after free in Prerender in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Critical)","s":8.8,"v":"HIGH","cwe":"CWE-416"},{"id":"CVE-2026-110921","p":1792102767473,"x":"Use after free in V8 in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)","s":8.8,"v":"HIGH","cwe":"CWE-416"},{"id":"CVE-2026-110920","p":1792102767367,"x":"Memory corruption in V8 in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)","s":8.8,"v":"HIGH","cwe":"CWE-119"},{"id":"CVE-2026-110919","p":1792102767267,"x":"Use after free in V8 in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)","s":8.8,"v":"HIGH","cwe":"CWE-416"},{"id":"CVE-2026-110918","p":1792102767160,"x":"Memory corruption in Core in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to read memory via a crafted HTML page. (Chromium security severity: High)","s":4.3,"v":"MEDIUM","cwe":"CWE-119"},{"id":"CVE-2026-110917","p":1792102767053,"x":"Memory corruption in SVG in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to read memory via a crafted HTML page. (Chromium security severity: High)","s":4.3,"v":"MEDIUM","cwe":"CWE-119"},{"id":"CVE-2026-110916","p":1792102766943,"x":"Improper input validation in Desktop in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)","s":9.6,"v":"CRITICAL","cwe":"CWE-20"},{"id":"CVE-2026-110915","p":1792102766843,"x":"Use after free in Compositing in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)","s":8.8,"v":"HIGH","cwe":"CWE-416"},{"id":"CVE-2026-110914","p":1792102766737,"x":"Memory corruption in Workers in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)","s":8.8,"v":"HIGH","cwe":"CWE-119"},{"id":"CVE-2026-110913","p":1792102766620,"x":"Memory corruption in DOM in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)","s":8.8,"v":"HIGH","cwe":"CWE-119"},{"id":"CVE-2024-58397","p":1792102686893,"x":"MP4v2 through 2.1.3 contains a heap-based out-of-bounds read in MP4File::GetChapters() that allows attackers to read past heap allocations via crafted QuickTime chapter samples. Attackers can supply an MP4 file whose chapter sample is shorter than its declared title length, crashing applications like mp4chaps or…","s":6.1,"v":"MEDIUM","cwe":"CWE-125"},{"id":"CVE-2026-111357","p":1792099033190,"x":"Ivanti Connect Secure 22.8R2.4 mishandles the manner in which the dsinvoked broker trusts DSCache configuration data, leading to privilege escalation to root, as exploited in the wild in October 2026.","s":7,"v":"HIGH","cwe":"CWE-829"},{"id":"CVE-2026-109468","p":1792099032880,"x":"Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.","s":7.5,"v":"HIGH","cwe":"CWE-770"},{"id":"CVE-2026-108455","p":1792099031267,"x":"Out-of-bounds read in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information over a network.","s":6.5,"v":"MEDIUM","cwe":"CWE-125"},{"id":"CVE-2026-108454","p":1792099031147,"x":"Buffer over-read in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information over a network.","s":6.5,"v":"MEDIUM","cwe":"CWE-126"},{"id":"CVE-2026-108453","p":1792099031027,"x":"Out-of-bounds read in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information over a network.","s":6.5,"v":"MEDIUM","cwe":"CWE-125"},{"id":"CVE-2026-108452","p":1792099030907,"x":"Improper limitation of a pathname to a restricted directory ('path traversal') in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.","s":8.8,"v":"HIGH","cwe":"CWE-22"},{"id":"CVE-2026-108451","p":1792099030790,"x":"Numeric truncation error in Microsoft Office Word allows an unauthorized attacker to execute code over a network.","s":8.8,"v":"HIGH","cwe":"CWE-122"},{"id":"CVE-2026-108450","p":1792099030673,"x":"Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.","s":8.8,"v":"HIGH","cwe":"CWE-122"},{"id":"CVE-2026-108449","p":1792099030553,"x":"Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.","s":8.8,"v":"HIGH","cwe":"CWE-122"},{"id":"CVE-2026-108448","p":1792099030440,"x":"Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.","s":7.5,"v":"HIGH","cwe":"CWE-122"},{"id":"CVE-2026-108447","p":1792099030317,"x":"Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.","s":8.8,"v":"HIGH","cwe":"CWE-122"},{"id":"CVE-2026-108446","p":1792099030200,"x":"Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.","s":8.8,"v":"HIGH","cwe":"CWE-416"},{"id":"CVE-2026-108445","p":1792099030077,"x":"Stack-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.","s":8.8,"v":"HIGH","cwe":"CWE-121"},{"id":"CVE-2026-108444","p":1792099029957,"x":"Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code over a network.","s":8.8,"v":"HIGH","cwe":"CWE-122"},{"id":"CVE-2026-108443","p":1792099029840,"x":"Off-by-one error in Microsoft Office Word allows an unauthorized attacker to execute code over a network.","s":8.8,"v":"HIGH","cwe":"CWE-193"},{"id":"CVE-2026-108442","p":1792099029727,"x":"Use after free in Microsoft Office Word allows an unauthorized attacker to execute code over a network.","s":8.8,"v":"HIGH","cwe":"CWE-416"},{"id":"CVE-2026-108441","p":1792099029607,"x":"Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.","s":8.8,"v":"HIGH","cwe":"CWE-122"},{"id":"CVE-2026-108440","p":1792099029493,"x":"Stack-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.","s":8.8,"v":"HIGH","cwe":"CWE-121"},{"id":"CVE-2026-108439","p":1792099029377,"x":"Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.","s":8.8,"v":"HIGH","cwe":"CWE-122"},{"id":"CVE-2026-108438","p":1792099029260,"x":"Use after free in Microsoft Office Word allows an unauthorized attacker to disclose information over a network.","s":6.5,"v":"MEDIUM","cwe":"CWE-416"},{"id":"CVE-2026-108437","p":1792099029140,"x":"Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.","s":8.8,"v":"HIGH","cwe":"CWE-122"},{"id":"CVE-2026-108436","p":1792099029020,"x":"Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to disclose information over a network.","s":6.5,"v":"MEDIUM","cwe":"CWE-125"},{"id":"CVE-2026-108435","p":1792099028903,"x":"Untrusted pointer dereference in Microsoft Office Word allows an unauthorized attacker to disclose information over a network.","s":6.5,"v":"MEDIUM","cwe":"CWE-822"},{"id":"CVE-2026-108434","p":1792099028777,"x":"Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to disclose information over a network.","s":6.5,"v":"MEDIUM","cwe":"CWE-125"},{"id":"CVE-2026-108433","p":1792099028657,"x":"Reliance on untrusted inputs in a security decision in Microsoft Office Word allows an unauthorized attacker to bypass a security feature locally.","s":7.8,"v":"HIGH","cwe":"CWE-807"},{"id":"CVE-2026-108432","p":1792099028540,"x":"Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.","s":8.8,"v":"HIGH","cwe":"CWE-122"},{"id":"CVE-2026-108431","p":1792099028420,"x":"Stack-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.","s":8.8,"v":"HIGH","cwe":"CWE-121"},{"id":"CVE-2026-108430","p":1792099028303,"x":"Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.","s":8.8,"v":"HIGH","cwe":"CWE-122"},{"id":"CVE-2026-108429","p":1792099028190,"x":"Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.","s":8.8,"v":"HIGH","cwe":"CWE-122"},{"id":"CVE-2026-108428","p":1792099028067,"x":"Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.","s":8.8,"v":"HIGH","cwe":"CWE-122"},{"id":"CVE-2026-108427","p":1792099027947,"x":"Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.","s":8.8,"v":"HIGH","cwe":"CWE-20"},{"id":"CVE-2026-108426","p":1792099027820,"x":"Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.","s":8.8,"v":"HIGH","cwe":"CWE-122"},{"id":"CVE-2026-105040","p":1792099024703,"x":"The EnergizeLab Eilik NestJS auth service accepts a user-controlled user ID in account update requests (mass assignment). A registered user can set another account's identifier and take over that account.","s":8.8,"v":"HIGH","cwe":"CWE-639"},{"id":"CVE-2026-105039","p":1792099024587,"x":"EnergizeLab station-middleware (NestJS) Docker images 1.6.5 through 1.8.2 do not check user roles on administrative APIs. Any authenticated low-privilege user can retrieve AI provider keys and change configuration and object-store contents.","s":9.6,"v":"CRITICAL","cwe":"CWE-862"},{"id":"CVE-2026-105038","p":1792099024467,"x":"The EnergizeLab Eilik and EilikO FastAPI AI inference and profiling services expose AI model administration functions without authentication. An unauthenticated remote attacker can change AI model configuration and switch the model in use at runtime.","s":9.8,"v":"CRITICAL","cwe":"CWE-306"},{"id":"CVE-2026-105037","p":1792099024350,"x":"EnergizeLab station-middleware (NestJS) Docker images 1.6.5 through 1.8.2 allow any registered, low-privilege account to read arbitrary files from the server by supplying an attacker-controlled file path. This exposes middleware files and server secrets.","s":9.9,"v":"CRITICAL","cwe":"CWE-73"},{"id":"CVE-2026-105036","p":1792099024230,"x":"EnergizeLab AI Station firmware, EilikO Linux robot firmware v2.1_20260617182218_release, and the EnergizeLab Windows desktop app 3.1.2 download firmware updates over plain HTTP and do not verify their integrity or authenticity. An attacker able to intercept or modify the traffic can substitute a malicious update.","s":7.5,"v":"HIGH","cwe":"CWE-494"},{"id":"CVE-2026-105035","p":1792099024113,"x":"The EnergizeLab FirmwareUpdater (AArch64 ELF, distributed in the CDN bin.zip) uses a single hard-coded AES key shared by all installations. An attacker who recovers the key from the updater can decrypt and forge firmware packages for any device that trusts it.","s":7.8,"v":"HIGH","cwe":"CWE-321"},{"id":"CVE-2026-105034","p":1792099023997,"x":"The EnergizeLab Eilik NestJS auth service issues device tokens for arbitrary robot serial numbers without authentication. An unauthenticated remote attacker can obtain a valid device token for any serial number and act as that device against the cloud services.","s":8.2,"v":"HIGH","cwe":"CWE-287"},{"id":"CVE-2026-105033","p":1792099023883,"x":"The EnergizeLab AI Station (RK3562) firmware image ships with default root credentials and SSH enabled. An attacker with network access to the device can log in as root and take full control of it.","s":8.8,"v":"HIGH","cwe":"CWE-798"},{"id":"CVE-2026-105032","p":1792099023753,"x":"The EnergizeLab Eilik and EilikO AI skill upload endpoint, served by the FastAPI AI inference and profiling services, does not require authentication and does not constrain uploaded file paths. An unauthenticated remote attacker can use path traversal to write arbitrary files, and thereby tamper with AI skill files…","s":9.1,"v":"CRITICAL","cwe":"CWE-22"},{"id":"CVE-2026-102764","p":1792099020117,"x":"The vulnerability exists within internal components of BeyondTrust’s Remote Support product. The components did not adequately validate the origin of the messages it received. Under the right conditions, this could allow an attacker to perform file operations on the appliance.","s":9.8,"v":"CRITICAL","cwe":"CWE-290"},{"id":"CVE-2026-106708","p":1792095426420,"x":"XXL-JOB 3.5.0-SNAPSHOT and earlier contains a Cross-Site Request Forgery (CSRF) vulnerability in the user management controller (JobUserController). The endpoints /user/insert, /user/update, and /user/delete lack CSRF protection and do not restrict HTTP method.","s":8.8,"v":"HIGH"},{"id":"CVE-2026-106700","p":1792095426297,"x":"ELADMIN v2.7 and earlier contains an improper access control vulnerability in the user-management endpoint PUT /api/users/resetPwd of me.zhengjie.modules.system.rest.UserController. The method lacks the method-level authorization check applied to all other user-management endpoints and performs no role-level or…","s":8.8,"v":"HIGH","cwe":"CWE-862"},{"id":"CVE-2026-104198","p":1792095426127,"x":"ZoneMinder is a free, open source closed-circuit television software application. In versions 1.34.0 through 1.36.38, the web interface mishandles failed token authentication in web/includes/auth.php. validateToken() returns false when a token is malformed or has an invalid signature, but the caller assigns that value…","s":5.3,"v":"MEDIUM","cwe":"CWE-287"},{"id":"CVE-2026-97370","p":1792091869983,"x":"Junrar is an open source Java RAR archive library. Prior to 7.6.1, RarVM.ExecuteCode in src/main/java/com/github/junrar/unpack/vm/RarVM.java can repeatedly execute a VM_JMP instruction whose target is greater than or equal to the prepared program's codeSize. The setIP() function returns success without changing the…","s":7.5,"v":"HIGH","cwe":"CWE-835"},{"id":"CVE-2026-96449","p":1792091869853,"x":"Missing Authorization vulnerability in WPExperts WP EasyPay wp-easy-pay allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP EasyPay: from n/a through 4.5.4.","s":5.3,"v":"MEDIUM","cwe":"CWE-862"},{"id":"CVE-2026-94621","p":1792091869410,"x":"AliasVault is a privacy-first password manager with built-in email aliasing. Prior to 0.30.3, the AliasVault server API favicon extractor validates a user-supplied hostname with a first DNS lookup but allows the HTTP client to perform a second DNS lookup when connecting. An authenticated low-privileged user operating…","s":6.3,"v":"MEDIUM","cwe":"CWE-367"},{"id":"CVE-2026-92707","p":1792091868703,"x":"MessagePack for C# is a MessagePack serializer for C#. Prior to 2.5.303 and 3.1.9, deserializing attacker-controlled MessagePack data as System.Object through PrimitiveObjectFormatter can cause excessive memory allocation. The formatter allocates an object[] from each declared array length before the configured…","s":5.3,"v":"MEDIUM","cwe":"CWE-1325"},{"id":"CVE-2026-87029","p":1792091867050,"x":"undici is an HTTP client library for Node.js. In versions 7.15.0 through 7.30.0 and 8.0.0 through 8.12.1, its decompress interceptor forwards decompressed response data to the downstream handler from zlib stream event callbacks without catching exceptions those callbacks may throw, and while undici's engine converts a…","s":5.9,"v":"MEDIUM","cwe":"CWE-248"},{"id":"CVE-2026-87018","p":1792091866600,"x":"undici is an HTTP client library for Node.js. In versions 4.2.1 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1, the client process crashes when a TLS 1.2 server renegotiates after the connection is established and presents a different, CA-trusted certificate whose hostname does not match the requested…","s":7.5,"v":"HIGH","cwe":"CWE-248"},{"id":"CVE-2026-63430","p":1792091862367,"x":"ammonia is a Rust library for repairing and securing untrusted HTML. Prior to 3.3.2, 4.0.2, and 4.1.3, applications that explicitly allow the math tag, annotation-xml, and at least one raw-text HTML element while disallowing the encoding attribute can permit mutation cross-site scripting. ammonia does not correctly…","s":6.3,"v":"MEDIUM","cwe":"CWE-79"},{"id":"CVE-2026-62322","p":1792091862213,"x":"Python Social Auth is a social authentication/registration mechanism. Prior to 5.0.2, the LINE backend exchanges an authorization code without validating the returned OAuth state. An attacker can begin authorization for an attacker-controlled LINE account and induce a victim to visit the resulting callback URL,…","s":6.5,"v":"MEDIUM","cwe":"CWE-352"},{"id":"CVE-2026-57496","p":1792091861733,"x":"NetLicensing MCP Server is a natural-language interface that enables agentic applications to manage the software-licensing lifecycle in Labs64 NetLicensing. Prior to 0.1.8, netlicensing_get_product passes the caller-controlled product_number to src/netlicensing_mcp/tools/products.py, which interpolates it into a REST…","s":9.6,"v":"CRITICAL","cwe":"CWE-22"},{"id":"CVE-2026-57183","p":1792091861447,"x":"Scoold is a Q&A and a knowledge sharing platform for teams. Prior to 1.69.1, checkApiAuth() in src/main/java/com/erudika/scoold/utils/ScooldUtils.java accepts a JWT signed with app_secret_key or para_secret_key for /api/config and /api/stats without requiring a registered API-key jti, and maps the request to the…","s":6.1,"v":"MEDIUM","cwe":"CWE-287"},{"id":"CVE-2026-55872","p":1792091861303,"x":"GYM One is open-source gym management software for fitness centers, personal trainers, and sports clubs. Prior to 1.4.1, GYM One's admin/users/index.php renders the stored firstname, lastname, and email profile fields into the administrator user list without HTML output encoding. An attacker who can store values in…","s":8.7,"v":"HIGH","cwe":"CWE-79"},{"id":"CVE-2026-55871","p":1792091861150,"x":"GYM One is open-source gym management software for fitness centers, personal trainers, and sports clubs. Prior to 1.4.1, GYM One's admin/users/index.php concatenates the search_name and search_email GET parameters into both the user-list query and the COUNT query used for pagination without prepared statements. An…","s":6.5,"v":"MEDIUM","cwe":"CWE-89"},{"id":"CVE-2026-55842","p":1792091860993,"x":"Scoold is a Q&A and a knowledge sharing platform for teams. Prior to 1.69.1, the apiCorsConfiguration() method in src/main/java/com/erudika/scoold/ScooldServer.java combines addAllowedOriginPattern(\"*\") with setAllowCredentials(true), causing Spring to reflect any requesting origin while allowing cookies or session…","s":5.4,"v":"MEDIUM","cwe":"CWE-346"},{"id":"CVE-2026-55840","p":1792091860823,"x":"Scoold is a Q&A and a knowledge sharing platform for teams. Prior to 1.69.1, the getBackToUrl() method in src/main/java/com/erudika/scoold/utils/HttpUtils.java validates the backto and returnto parameters with Strings.CI.startsWith against the configured server URL. An attacker can supply an absolute URL whose…","s":5.4,"v":"MEDIUM","cwe":"CWE-601"},{"id":"CVE-2026-55587","p":1792091860657,"x":"AliasVault is a privacy-first password manager with built-in email aliasing. Prior to 0.29.4, the AliasVault browser extension passkey provider does not bind passkey requests to the actual webpage origin or verify that the requested relying-party identifier matches the current website. A malicious website can provide…","s":8.1,"v":"HIGH","cwe":"CWE-346"},{"id":"CVE-2026-55240","p":1792091860290,"x":"Tianji is an open source analytics, uptime monitoring, and server status platform. Prior to 1.31.29, formatString() in src/server/utils/template.ts passes survey feedTemplate and monitor notification templates to lodash template(), while the default evaluate pattern remains enabled. A workspace administrator can store…","s":9.1,"v":"CRITICAL","cwe":"CWE-1336"},{"id":"CVE-2026-55239","p":1792091860143,"x":"Tianji is an open source analytics, uptime monitoring, and server status platform. Prior to 1.31.29, the getDateQuery() function in src/server/utils/prisma.ts constructs raw SQL through Prisma.sql() by interpolating the timezone request value without parameter binding. The timezone value can reach affected analytics…","s":8.8,"v":"HIGH","cwe":"CWE-89"},{"id":"CVE-2026-47218","p":1792091859257,"x":"runwasi facilitates running Wasm and WASI workloads managed by containerd. Prior to 0.6.1, containerd-shim-wasmtime-v1 can treat Wasmtime precompiled bytes supplied directly in an OCI image layer as a trusted artifact from the precompile-cache path and deserialize them as native code. An attacker who causes a victim…","s":9.3,"v":"CRITICAL","cwe":"CWE-502"},{"id":"CVE-2026-45165","p":1792091858653,"x":"An authorization flaw in Idira Conjur version 13.9.0 allows an authenticated user with limited privileges to perform unauthorized actions on a policy branch. Under specific circumstances, an attacker could potentially leverage this to retrieve unauthorized secrets, alter administrative access controls on the branch or…","s":8.6,"v":"HIGH","cwe":"CWE-863"},{"id":"CVE-2026-36436","p":1792091858520,"x":"An issue in Trisolutions BRPerfX version 1.4.4.0 exposes LDAP credentials in plaintext within the administrative configuration interface. An authenticated administrator can inspect the client-side code to retrieve the credential.","s":7.5,"v":"HIGH","cwe":"CWE-522"},{"id":"CVE-2026-111252","p":1792091856827,"x":"A denial of service vulnerability exists in the XML parsing of multiple versions of OpenNMS Meridian and Horizon. OpenNMS parsed XML without an effective limit on entity expansion. A document with a DOCTYPE that declares internal entities can expand to a very large value and exhaust the server memory. An authenticated…","s":6.5,"v":"MEDIUM","cwe":"CWE-400"},{"id":"CVE-2026-111235","p":1792091856693,"x":"An authorization bypass vulnerability exists in the REST API of multiple versions of OpenNMS Meridian and Horizon. The /rest/** Spring Security filter chains authorize requests with intercept-url rules that name the HTTP method as an uppercase token, compare the method case-sensitively, and have no terminal deny rule.…","s":9.1,"v":"CRITICAL","cwe":"CWE-204"},{"id":"CVE-2026-111234","p":1792091856543,"x":"SimplePie through 1.9.0 contains a local file read vulnerability that allows malicious feed servers to read server files by supplying file:// URLs in redirects or autodiscovery links. Attackers can return a Location header or feed link pointing to a file:// path, causing file_get_contents() to read files accessible to…","s":5.9,"v":"MEDIUM","cwe":"CWE-73"},{"id":"CVE-2026-111233","p":1792091856397,"x":"Netgate pfSense CE 2.7.1 through 2.9.0 contains a reflected cross-site scripting vulnerability in firewall_rules.php that allows remote attackers to inject script via the unencoded if parameter. When the non-default Require Firewall Interface option is enabled, attackers can lure users with firewall rules privileges…","s":4.7,"v":"MEDIUM","cwe":"CWE-79"},{"id":"CVE-2026-111232","p":1792091856257,"x":"Netgate pfSense CE 2.3.0 through 2.9.0 contains a stored cross-site scripting vulnerability that allows authenticated users with Firewall: Rules or NAT: Port Forward privileges to inject scripts via the separator color field. Attackers can submit a crafted separator[] color value that display_separator() renders…","s":4.8,"v":"MEDIUM","cwe":"CWE-79"},{"id":"CVE-2026-111231","p":1792091856110,"x":"Netgate pfSense CE through 2.9.0 contains an authorization bypass vulnerability that allows read-only WebGUI users to replace config.xml because config_restore() and config_install() ignore the 'User - Config: Deny Config Write' privilege. Attackers holding page privileges for services_acb.php, uploadconfig.php,…","s":7.2,"v":"HIGH","cwe":"CWE-863"},{"id":"CVE-2026-111230","p":1792091855960,"x":"Netgate pfSense CE through 2.9.0 contains a local file read vulnerability that allows users with the Dynamic DNS client privilege to read files as root by setting a file:// custom Update URL in services_dyndns_edit.php. Attackers can set a non-matching Result Match string so _checkStatus() logs file contents such as…","s":4.9,"v":"MEDIUM","cwe":"CWE-73"},{"id":"CVE-2026-111229","p":1792091855813,"x":"pfSense CE 2.7.0 through 2.9.0 contains a command injection vulnerability in services_captiveportal_hasync.php that allows users with only the Captive Portal HA privilege to execute commands as root. Attackers can set backwardsyncip to a malicious XMLRPC server returning connected_users with shell metacharacters in ip…","s":7.2,"v":"HIGH","cwe":"CWE-78"},{"id":"CVE-2026-111228","p":1792091855670,"x":"Netgate pfSense CE from 2.7.1 through 2.9.0 contains a CRLF injection vulnerability in services_unbound_advanced.php that allows authenticated users with DNS Resolver: Advanced privilege to inject Unbound directives. Attackers can embed CR/LF characters in the unvalidated sock_queue_timeout parameter, which is written…","s":5.5,"v":"MEDIUM","cwe":"CWE-93"},{"id":"CVE-2026-111227","p":1792091855527,"x":"Netgate pfSense CE through 2.9.0 contains a CRLF injection vulnerability in services_unbound_acls.php that allows authenticated users with the DNS Resolver: Access Lists privilege to inject Unbound configuration directives. Attackers can embed CR/LF characters in the aclname or aclaction fields written to…","s":5.5,"v":"MEDIUM","cwe":"CWE-93"},{"id":"CVE-2026-111226","p":1792091855373,"x":"pfSense CE 2.4.5 through 2.9.0 contains an OS command injection vulnerability that allows authenticated WebGUI users with Advanced Admin Access privilege to execute commands as root via Login Protection settings. Attackers can submit sshguard threshold, block time, or detection time values containing newlines or…","s":7.2,"v":"HIGH","cwe":"CWE-78"},{"id":"CVE-2026-111225","p":1792091855230,"x":"Netgate pfSense CE 2.5.0 through 2.9.0 contains an OS command injection vulnerability in openvpn.learn-address.sh that allows authenticated VPN clients to execute commands as the unbound user. Attackers can embed shell metacharacters in the certificate common name or username, which is interpolated unquoted into su -c…","s":5,"v":"MEDIUM","cwe":"CWE-78"},{"id":"CVE-2026-111224","p":1792091855090,"x":"pfSense CE through 2.9.0 contains an OS command injection vulnerability in the OpenVPN openvpn.connect_async.sh script that allows authenticated VPN users to execute commands as root via crafted usernames. Attackers authenticated through RADIUS or LDAP can use usernames containing single quotes and shell…","s":7.5,"v":"HIGH","cwe":"CWE-78"},{"id":"CVE-2026-111223","p":1792091854943,"x":"Netgate pfSense CE 2.7.0 through 2.9.0 contains a configuration injection vulnerability that allows authenticated users with IPsec Mobile privileges to execute commands as root via the login_banner field. Attackers can submit a single-line banner containing '}' to escape the unquoted strongswan.conf attr value and…","s":7.2,"v":"HIGH","cwe":"CWE-74"},{"id":"CVE-2026-111222","p":1792091854797,"x":"Netgate pfSense CE through 2.9.0 contains a php.ini injection vulnerability that allows authenticated users with General Setup privileges to inject directives by submitting an unvalidated timezone value. Attackers can embed a quote and newline to add auto_prepend_file pointing at /var/db/zoneinfo, executing PHP as…","s":6.6,"v":"MEDIUM","cwe":"CWE-93"},{"id":"CVE-2026-111221","p":1792091854650,"x":"Netgate pfSense CE through 2.9.0 contains a configuration injection vulnerability that allows authenticated WebGUI users to inject mpd5 commands by submitting an unescaped RADIUS shared secret. Attackers with L2TP or PPPoE Server edit privileges can POST a secret containing a quote and newline to vpn_l2tp.php or…","s":6.6,"v":"MEDIUM","cwe":"CWE-93"},{"id":"CVE-2026-111220","p":1792091854500,"x":"pfSense CE through 2.9.0 contains a crontab injection vulnerability in interfaces_ppps_edit.php that allows authenticated users to execute commands as root by injecting newlines into the ptpid or reset hour/minute fields. Attackers holding the 'WebCfg - Interfaces: PPPs: Edit' privilege can submit crafted POST values…","s":7.2,"v":"HIGH","cwe":"CWE-93"},{"id":"CVE-2026-111219","p":1792091854357,"x":"Netgate pfSense CE through 2.9.0 contains a newline injection vulnerability in services_pppoe_edit.php that allows privileged users to inject mpd.secret entries via unvalidated username POST fields. Attackers with the PPPoE Server Edit privilege can add a line whose secret begins with '!', making mpd5 run commands as…","s":6.6,"v":"MEDIUM","cwe":"CWE-93"},{"id":"CVE-2026-111218","p":1792091854210,"x":"Netgate pfSense CE 2.7.0 through 2.9.0 contains an OS command injection vulnerability that allows authenticated users with Traffic Shaper Limiters privileges to execute root commands by tampering with the limiter number field. Attackers can submit a malicious hidden 'number' value when editing a limiter, then delete…","s":7.2,"v":"HIGH","cwe":"CWE-78"},{"id":"CVE-2026-111217","p":1792091854067,"x":"Netgate pfSense CE through 2.9.0 contains an OS command injection vulnerability that allows authenticated users with Virtual IP edit privileges to execute commands as root by storing an unvalidated CARP VHID. Attackers can supply a VHID containing shell metacharacters that executes via interface_ipalias_configure()…","s":7.2,"v":"HIGH","cwe":"CWE-78"},{"id":"CVE-2026-111216","p":1792091853907,"x":"Netgate pfSense CE through 2.9.0 contains an OS command injection vulnerability that allows authenticated users with gateway edit privileges to execute commands as root by injecting shell metacharacters into an IPv6 link-local zone index. Attackers can set a gateway Monitor IP whose unvalidated zone carries a payload,…","s":7.2,"v":"HIGH","cwe":"CWE-78"},{"id":"CVE-2026-111215","p":1792091853757,"x":"Netgate pfSense CE through 2.9.0 contains an OS command injection vulnerability that allows authenticated users to execute commands as root by supplying a crafted wireless parent interface name. Attackers with limited Wireless Edit or Interface Assignments privileges can submit values like ath0;<cmd> via…","s":7.2,"v":"HIGH","cwe":"CWE-78"},{"id":"CVE-2026-111214","p":1792091853603,"x":"Netgate pfSense CE 2.7.0 through 2.9.0 contains an OS command injection vulnerability that allows authenticated users with QinQ edit privilege to run commands by storing an unvalidated parent interface name. Attackers can save a crafted 'if' value, then edit the QinQ entry so it is interpolated into ifconfig shell…","s":7.2,"v":"HIGH","cwe":"CWE-78"},{"id":"CVE-2026-111172","p":1792091853450,"x":"@casl/ability 6.7.5 before 7.0.2 contains a prototype pollution vulnerability in rulesToFields() that allows attackers to modify inherited builtins via dotted condition keys. Attackers controlling rule conditions can supply keys like 'toString.call' to alter shared builtin functions process-wide, causing denial of…","s":5.3,"v":"MEDIUM","cwe":"CWE-1321"},{"id":"CVE-2026-111171","p":1792091853300,"x":"Web3.py 7.15.0 through 7.16.0 and 8.0.0b2 through 8.0.0 contains a server-side request forgery vulnerability because _check_ip_blocked() does not unwrap IPv4-mapped IPv6 addresses in CCIP Read URL validation. Malicious contracts can return OffchainLookup URLs with IPv4-mapped IPv6 hosts or AAAA records, making clients…","s":5.4,"v":"MEDIUM","cwe":"CWE-918"},{"id":"CVE-2026-111170","p":1792091853153,"x":"kedro-datasets from 9.3.0 through 9.6.0 contains a path traversal vulnerability in MatplotlibDataset.save() that allows attackers to write files outside the dataset directory by supplying absolute plot names. Because validate_sub_path() strips leading slashes while pathlib's join discards the base path, attackers can…","s":6.5,"v":"MEDIUM","cwe":"CWE-22"},{"id":"CVE-2026-111169","p":1792091852977,"x":"La Suite Docs through 6.0.1 contains an authorization bypass vulnerability that allows authenticated users to write comments into threads of documents they cannot access. Attackers who know a thread UUID can route a POST comment request through their own document's resource_id, inserting comments into another…","s":3.1,"v":"LOW","cwe":"CWE-639"},{"id":"CVE-2026-111168","p":1792091852827,"x":"LibreDesk before 2.9.0-rc.8 contains a stored cross-site scripting vulnerability that allows authenticated agents to execute script by uploading SVGs with malformed Content-Type parameters. Attackers can upload an SVG typed 'image/svg+xml; x' via /api/v1/media so GET /uploads/{uuid} serves it inline without sandbox,…","s":5.4,"v":"MEDIUM","cwe":"CWE-79"},{"id":"CVE-2026-111167","p":1792091852640,"x":"GNU LibreDWG through 0.14.8612 contains a global out-of-bounds read vulnerability in the AcDs decoder acds_private() that allows attackers to read beyond a static table via an unchecked schema property type index. Attackers can supply a crafted R2004 or R2010+ DWG file with a large 'schdat' property type value to…","s":6.1,"v":"MEDIUM","cwe":"CWE-125"},{"id":"CVE-2026-111166","p":1792091852450,"x":"libmikmod through 3.3.15 contains a heap out-of-bounds read vulnerability in the IMF_Load() loader that allows attackers to read beyond allocated memory by supplying a crafted IMF module. Attackers can enable the linear-period header flag and map notes to out-of-range samples, causing noteindex indexing far past the…","s":5.5,"v":"MEDIUM","cwe":"CWE-125"},{"id":"CVE-2026-111165","p":1792091852287,"x":"libmikmod through 3.3.15 contains a global out-of-bounds read vulnerability in the MultiTracker loader MTM_Load() because the module channel count is never clamped. Attackers can supply a crafted .mtm file with a channel count above 32 to read past the static pat array, corrupting track indices and crashing the…","s":5.5,"v":"MEDIUM","cwe":"CWE-125"},{"id":"CVE-2026-111164","p":1792091851690,"x":"UADE through 3.05 contains an out-of-bounds read vulnerability in uade_filemagic() in amifilemagic.c caused by unsigned bufsize subtraction wrapping on short inputs. Attackers can supply a crafted short module that passes format probe bounds checks and reads far past the buffer, crashing applications that probe or…","s":5.5,"v":"MEDIUM","cwe":"CWE-125"},{"id":"CVE-2026-111163","p":1792091851550,"x":"WildMIDI through 0.5.0 contains a heap out-of-bounds read vulnerability in _WM_ParseNewHmi() in src/f_hmi.c that reads past buffers when handling 0xfe sub-events. Attackers can supply a crafted HMI file placing a 0xfe 0x10 sub-event near the buffer end to read up to four bytes past the allocation, crashing the…","s":5.5,"v":"MEDIUM","cwe":"CWE-125"},{"id":"CVE-2026-111162","p":1792091851403,"x":"WildMIDI through 0.5.0 contains a heap out-of-bounds read vulnerability in the HMP parser _WM_ParseNewHmp() that allows attackers to read beyond buffers via underflowed chunk lengths. Attackers can supply a crafted .hmp file with a chunk length of 0-12 that wraps to roughly 4 GB, crashing applications or exposing heap…","s":6.1,"v":"MEDIUM","cwe":"CWE-125"},{"id":"CVE-2026-111161","p":1792091851260,"x":"libADLMIDI 1.6.2 through 1.6.2.1 contains an off-by-one stack out-of-bounds write vulnerability in BW_MidiSequencer that allows attackers to corrupt stack memory via crafted MIDI files. Attackers can supply a MIDI file with a note-on using status 0x9F and note 0x7F through adl_openFile() or adl_openData() to crash the…","s":6.1,"v":"MEDIUM","cwe":"CWE-787"},{"id":"CVE-2026-111160","p":1792091851100,"x":"LightLLM through 1.2.0 contains a denial of service vulnerability that allows unauthenticated attackers to crash the inference worker by supplying the internal pd_kv_trans_params field to the /generate endpoint. Attackers can send a single request whose parameters cause pickle.loads to fail in InferSamplingParams,…","s":7.5,"v":"HIGH","cwe":"CWE-502"},{"id":"CVE-2026-111159","p":1792091850960,"x":"libewf through 20260924 contains a heap out-of-bounds read vulnerability in libewf_lef_extended_attribute_read_data() because UTF-16 name and value sizes are validated before being doubled. Attackers can supply a crafted .L01/.Lx01 file with oversized 'ea' metadata counts to crash the application or leak uninitialized…","s":6.1,"v":"MEDIUM","cwe":"CWE-125"},{"id":"CVE-2026-111158","p":1792091850810,"x":"EarthScope libmseed through 3.5.4 contains a heap out-of-bounds read vulnerability in ms3_detect() in parseutils.c that reads past truncated miniSEED 2 record buffers. Attackers can supply a 40 to 47 byte buffer passing MS2_ISVALIDHEADER to msr3_parse() or ms3_detect(), over-reading up to 8 bytes and potentially…","s":5.5,"v":"MEDIUM","cwe":"CWE-125"},{"id":"CVE-2026-111157","p":1792091850663,"x":"SoX through 14.4.2 contains a heap out-of-bounds write vulnerability in lsx_ms_adpcm_block_expand_i() in src/adpcm.c, triggered by an odd samplesPerBlock value in the WAV fmt chunk. Attackers can supply a crafted MS ADPCM WAV file to sox or any libsox consumer to write a partially controlled 16-bit sample past the…","s":6.1,"v":"MEDIUM","cwe":"CWE-787"},{"id":"CVE-2026-111156","p":1792091850527,"x":"libTiMidity through 0.2.8 contains an out-of-bounds access vulnerability in init_soundfont() in src/sndfont.c that allows attackers to corrupt memory by supplying unvalidated SF2 preset header bank and preset values. Attackers can craft a .sf2 file whose bank or preset indexes past the 128-entry tonebank or drumset…","s":6.1,"v":"MEDIUM","cwe":"CWE-787"},{"id":"CVE-2026-111155","p":1792091850387,"x":"libTiMidity through 0.2.8 contains a heap out-of-bounds read vulnerability in the SoundFont loader in src/sndfont.c that uses unvalidated sampleId and instrument generator values as table indices. Attackers can supply a crafted .sf2 file loaded through mid_set_soundfont() to read heap memory out of bounds and crash…","s":6.1,"v":"MEDIUM","cwe":"CWE-125"},{"id":"CVE-2026-111154","p":1792091850243,"x":"libTiMidity through 0.2.8 contains a stack out-of-bounds write vulnerability in the SoundFont loader that allows attackers to corrupt stack memory via unchecked generator operators in parse_gen. Attackers can supply a crafted .sf2 file with out-of-range pgen/igen operator values to write chosen 16-bit values near the…","s":6.1,"v":"MEDIUM","cwe":"CWE-787"},{"id":"CVE-2026-111153","p":1792091850103,"x":"Game Music Emu (libgme) through 0.6.5 contains a global out-of-bounds read vulnerability in Classic_Emu::mute_voices_ that allows attackers to crash applications by supplying NSF files whose voice count exceeds the 16-entry voice-type table. Attackers can craft an NSF header with chip_flags 0x3F, opened through…","s":5.5,"v":"MEDIUM","cwe":"CWE-125"},{"id":"CVE-2026-111152","p":1792091849957,"x":"Game Music Emu (libgme) through 0.6.5 contains a heap out-of-bounds read vulnerability in the AY loader get_data function caused by an integer underflow in the track-table bounds check. Attackers can supply a crafted ZXAYEMUL file with an oversized track table to read past the file buffer via gme_track_info or…","s":5.5,"v":"MEDIUM","cwe":"CWE-125"},{"id":"CVE-2026-111151","p":1792091849800,"x":"OpenJPH through 0.32.0 contains a heap out-of-bounds write vulnerability in the HTJ2K cleanup-pass decoder that allows attackers to corrupt memory via one-row codeblocks. Attackers can supply a crafted .j2c or .jph codestream with small precinct sizes, causing the decoder to write a second row past the codeblock…","s":6.1,"v":"MEDIUM","cwe":"CWE-787"},{"id":"CVE-2026-111150","p":1792091849650,"x":"ValleyBell libvgm through commit a6eed945 contains a heap out-of-bounds read vulnerability in the PCM data-block decompressor caused by an unbounded compression-table index. Attackers can supply a crafted .vgm file with a small type 0x7F table and wider compressed values, causing DecompressDataBlk to over-read heap…","s":5.5,"v":"MEDIUM","cwe":"CWE-125"},{"id":"CVE-2026-111149","p":1792091849503,"x":"FreeImage (danoli3 fork) through 3.19.23 contains a heap out-of-bounds read vulnerability in Unpack32Bits() in PluginPICT.cpp because rowBytes is never checked against the file-controlled PixMap width. Attackers can supply a crafted PICT file with a truncated or undersized rowBytes to over-read up to 64 KiB of heap,…","s":6.1,"v":"MEDIUM","cwe":"CWE-125"},{"id":"CVE-2026-111148","p":1792091849353,"x":"libsidplayfp through 3.1.1 contains a heap out-of-bounds read vulnerability that allows attackers to crash applications by supplying a PSID/RSID file with an unchecked data offset. Attackers can set the header data offset beyond the file size, wrapping the length calculation so resolveAddrs() reads up to 64 KiB past…","s":5.5,"v":"MEDIUM","cwe":"CWE-125"},{"id":"CVE-2026-111147","p":1792091849210,"x":"Libyal libesedb through 20260704 contains a heap out-of-bounds read vulnerability in libesedb_record_get_multi_value() that allows attackers to read past buffers via unbounded multi-value offset tables. Attackers can supply a crafted ESE/EDB database processed by esedbexport to crash the application or expose up to…","s":6.1,"v":"MEDIUM","cwe":"CWE-125"},{"id":"CVE-2026-111146","p":1792091849040,"x":"ytnef through 2.1.2 contains a heap out-of-bounds read vulnerability in MAPIPrint() that allows attackers to read past heap allocations by supplying compressed RTF properties. Attackers can deliver a crafted winmail.dat whose decompressed RTF lacks a NUL terminator, causing printf to over-read, crashing ytnefprint and…","s":6.1,"v":"MEDIUM","cwe":"CWE-125"},{"id":"CVE-2026-111145","p":1792091848873,"x":"ytnef through 2.1.2 contains a heap out-of-bounds read vulnerability in DecompressRTF() in lib/ytnef.c that never validates uncompressedSize for uncompressed RTF streams. Attackers can supply a crafted winmail.dat TNEF attachment with a malicious PT_BINARY MAPI property to crash ytnefprint or libytnef callers and leak…","s":6.1,"v":"MEDIUM","cwe":"CWE-125"},{"id":"CVE-2026-111144","p":1792091848707,"x":"libansilove 1.3.0 through 1.4.2 contains a NULL pointer dereference vulnerability in ansilove_xbin() that allows attackers to crash applications by supplying a crafted XBIN file. Attackers can set the 512-character flag without the custom-font flag, causing drawchar() to index a NULL high_font_data_xbin pointer and…","s":5.5,"v":"MEDIUM","cwe":"CWE-476"},{"id":"CVE-2026-111143","p":1792091848563,"x":"Ansilove libansilove through 1.4.2 contains an out-of-bounds read vulnerability in ansilove_xbin() in src/loaders/xbin.c that lacks bounds checks for compressed run-length records. Attackers can supply a crafted compressed XBIN file ending in a control byte such as 0x7F to read past the input buffer, crashing…","s":5.5,"v":"MEDIUM","cwe":"CWE-125"},{"id":"CVE-2026-111142","p":1792091848417,"x":"Zziplib through 0.13.80 contains an out-of-bounds read vulnerability in zzip/mmapped.c that allows attackers to over-read heap memory via a crafted ZIP central directory. Attackers can craft an end-of-central-directory record placing the first entry near the buffer end, causing zzip_disk_entry_strdup_name to read past…","s":5.5,"v":"MEDIUM","cwe":"CWE-125"},{"id":"CVE-2026-111141","p":1792091848267,"x":"zziplib through 0.13.80 contains an out-of-bounds read vulnerability in __zzip_parse_root_directory() in zzip/zip.c that allows attackers to read past the mapped central directory in mmap builds due to an ineffective bounds check. Attackers can supply a crafted ZIP whose entry name ends at the central directory end,…","s":4.7,"v":"MEDIUM","cwe":"CWE-125"},{"id":"CVE-2026-111140","p":1792091848127,"x":"libregf through 20260526 contains a heap out-of-bounds read in libregf_value_item_read_value_data() because it bounds value data size without subtracting the 4-byte old-format cell offset. Attackers can supply a crafted version 1.0/1.1 REGF hive with a value data cell ending its hive bin to leak adjacent heap bytes or…","s":6.1,"v":"MEDIUM","cwe":"CWE-125"},{"id":"CVE-2026-111139","p":1792091847983,"x":"NetSurf libnsbmp through 0.1.7 contains an out-of-bounds read vulnerability in bmp_decode_mask() that allows attackers to read one byte past the image buffer by supplying crafted ICO files. Attackers can provide an ICO whose inner bitmap width is not a multiple of 8, causing a heap over-read that can crash…","s":5.5,"v":"MEDIUM","cwe":"CWE-125"},{"id":"CVE-2026-111138","p":1792091847840,"x":"NetSurf libnsbmp through 0.1.7 contains an out-of-bounds read vulnerability in bmp_decode_rle8() and bmp_decode_rle4() because absolute-run bound checks omit the word-alignment pad byte. Attackers can supply a crafted RLE8 or RLE4 BMP ending on an odd-length absolute run to cause a one-byte heap over-read, crashing…","s":5.5,"v":"MEDIUM","cwe":"CWE-125"},{"id":"CVE-2026-111137","p":1792091847690,"x":"libsmi through 0.5.0 contains an out-of-bounds write vulnerability in smiValueAsString() in lib/smi.c that allows attackers to overflow a fixed 1024-byte static buffer through hex rendering of OCTET STRING values. Attackers can supply a crafted MIB with an OCTET STRING DEFVAL of 512 or more octets and a leading 0x00…","s":6.1,"v":"MEDIUM","cwe":"CWE-787"},{"id":"CVE-2026-111136","p":1792091847490,"x":"libInstPatch through 1.1.7 contains a heap out-of-bounds write vulnerability in the SoundFont 2 loader because ipatch_sf2_gen_is_valid() does not range-check generator IDs before the validity mask test. Attackers can supply crafted SF2 files with out-of-range pgen or igen generator IDs to write attacker-chosen values…","s":6.1,"v":"MEDIUM","cwe":"CWE-787"},{"id":"CVE-2026-111135","p":1792091847273,"x":"libfwsi through 20260522 contains a heap out-of-bounds read vulnerability in libfwsi_mtp_volume_values_read_data() that allows attackers to read past buffer bounds via crafted MTP volume shell items. Attackers can embed a 10 to 53 byte shell item with item data size of 44 or more in a .lnk file, jump list or shell bag…","s":6.1,"v":"MEDIUM","cwe":"CWE-125"},{"id":"CVE-2026-111134","p":1792091847127,"x":"libfwsi through 20260522 contains a heap out-of-bounds read vulnerability in libfwsi_mtp_file_entry_values_read_data() that allows attackers to read past buffer bounds via crafted MTP file entry shell items. Attackers can embed a 10 to 73 byte shell item with item data size of 44 or more in .lnk files, jump lists or…","s":6.1,"v":"MEDIUM","cwe":"CWE-125"},{"id":"CVE-2026-111133","p":1792091846957,"x":"libfsapfs through 20260921 contains an integer underflow in libfsapfs_key_encrypted_key_read_data() that allows attackers to trigger heap out-of-bounds reads via crafted KEK attributes. Attackers can supply a crafted encrypted APFS image with malformed HMAC or wrapped KEK attribute lengths to crash fsapfsinfo,…","s":6.1,"v":"MEDIUM","cwe":"CWE-125"},{"id":"CVE-2026-111132","p":1792091846810,"x":"GNOME libgxps through 0.3.2 contains a heap out-of-bounds read in path_geometry_start_element() that allows attackers to read past allocations via crafted PolyBezierSegment or PolyQuadraticBezierSegment Points attributes. Attackers can supply a point count not divisible by three or two in a crafted XPS document to…","s":6.1,"v":"MEDIUM","cwe":"CWE-125"},{"id":"CVE-2026-111131","p":1792091846660,"x":"libxmp through 4.7.4 contains an off-by-one stack out-of-bounds read vulnerability in the prowizard P61A depacker depack_p61a() in src/loaders/prowizard/p61a.c. Attackers can supply a crafted headerless P61A module with 31 samples and a 0xffe0 back-reference size word to leak stack memory into sample metadata or…","s":6.1,"v":"MEDIUM","cwe":"CWE-125"},{"id":"CVE-2026-111130","p":1792091846517,"x":"OpenSlide through 4.0.1 contains a heap out-of-bounds read vulnerability in the MIRAX reader that allows attackers to read past the slide_positions array via crafted Slidedat.ini values. Attackers can supply a MIRAX slide whose CameraImageDivisionsPerSide does not evenly divide the image counts, crashing applications…","s":6.1,"v":"MEDIUM","cwe":"CWE-125"},{"id":"CVE-2026-111129","p":1792091846370,"x":"Open Asset Import Library (assimp) through 6.0.5 contains a NULL pointer dereference vulnerability in the Ogre3D binary mesh importer's OgreBinarySerializer::ReadAnimationKeyFrames() handling of unvalidated animation track targets. Attackers can supply a crafted .mesh file with a morph animation track targeting a…","s":5.5,"v":"MEDIUM","cwe":"CWE-476"},{"id":"CVE-2026-111128","p":1792091846213,"x":"Assimp through 6.0.5 contains a NULL pointer dereference vulnerability in the Ogre3D importer that allows attackers to crash applications via unvalidated bone indices in OgreStructs.cpp. Attackers can supply a crafted .mesh and .skeleton file referencing a missing bone, causing BoneById() to return null and crash the…","s":5.5,"v":"MEDIUM","cwe":"CWE-476"},{"id":"CVE-2026-111127","p":1792091846073,"x":"catdoc through 0.95 contains an out-of-bounds read vulnerability in copy_unicode_string() in src/xlsparse.c that allows attackers to read past buffers via an unchecked string character count. Attackers can supply a crafted .xls file declaring 0xFFFF two-byte characters in LABEL, STRING, or SST records to disclose…","s":6.1,"v":"MEDIUM","cwe":"CWE-125"},{"id":"CVE-2026-111126","p":1792091845923,"x":"catdoc through 0.95 contains an out-of-bounds read vulnerability in the MULRK record handler of process_item() in src/xlsparse.c that allows attackers to read past the static rec buffer via a crafted end column. Attackers can supply a crafted .xls workbook or BIFF stream with a large endcol to xls2csv to disclose…","s":6.1,"v":"MEDIUM","cwe":"CWE-125"},{"id":"CVE-2026-111125","p":1792091845780,"x":"CFITSIO through 4.7.0 contains a heap-based out-of-bounds read vulnerability in the HCOMPRESS tile decoder that allows attackers to read past the compressed tile buffer via input_nnybble in fits_hdecompress.c. Attackers can supply a crafted FITS file with ZCMPTYPE HCOMPRESS_1 declaring oversized tile geometry to crash…","s":6.1,"v":"MEDIUM","cwe":"CWE-125"},{"id":"CVE-2026-111124","p":1792091845627,"x":"CFITSIO through 4.7.0 contains a heap-based out-of-bounds read vulnerability in the imcompress.c unquantize helpers that allows attackers to read memory before the fits_rand_value table via a zero or negative ZDITHER0 seed. Attackers can supply a crafted FITS file with a SUBTRACTIVE_DITHER_1 compressed image, read…","s":6.1,"v":"MEDIUM","cwe":"CWE-125"},{"id":"CVE-2026-111123","p":1792091845460,"x":"FluidSynth through 2.6.1 contains an out-of-bounds write vulnerability that allows attackers to corrupt heap and stack memory by supplying unvalidated SoundFont modulator destination values. Attackers can craft an SF2 file with PMOD/IMOD destinations of 63 to 255 that, when loaded and played, write past the voice…","s":6.1,"v":"MEDIUM","cwe":"CWE-787"},{"id":"CVE-2026-110878","p":1792091844967,"x":"Aureus ERP through 1.6.0 contains a stored cross-site scripting vulnerability that allows authenticated users to inject scripts via unescaped Operation Type and Location names in RuleForm.php and RuleInfolist.php. Attackers can store HTML/JavaScript payloads in names that execute when warehouse managers or…","s":5.4,"v":"MEDIUM","cwe":"CWE-79"},{"id":"CVE-2026-110877","p":1792091844823,"x":"AdPlug through 2.4 contains a heap out-of-bounds read vulnerability in CdmoLoader::load() in src/dmo.cpp that allows attackers to read past a heap allocation by supplying a truncated TwinTeam DMO file. Attackers can supply a 12- or 13-byte file passing dmo_unpacker::decrypt(), opened via CAdPlug::factory, to read…","s":5.5,"v":"MEDIUM","cwe":"CWE-125"},{"id":"CVE-2026-110876","p":1792091844687,"x":"AdPlug through 2.4 contains an out-of-bounds read vulnerability in src/xsm.cpp that allows attackers to read before note_table by supplying a negative note index. Attackers can craft an XSM file with the ofTAZ! signature and a song byte of 0x80 or higher, causing a global-buffer-overflow read during playback that may…","s":5.5,"v":"MEDIUM","cwe":"CWE-125"},{"id":"CVE-2026-110875","p":1792091844530,"x":"AdPlug through 2.4 contains a heap-based buffer overflow in CksmPlayer::update() in src/ksm.cpp that writes past the fixed databuf[2048] array without bounds checking. Attackers can supply a crafted .ksm module whose notes share one time slot to overflow the heap player object, causing memory corruption and denial of…","s":6.1,"v":"MEDIUM","cwe":"CWE-787"},{"id":"CVE-2026-110874","p":1792091844353,"x":"Dolibarr before 23.0.4 contains a PHP object injection vulnerability in jsonOrUnserialize() in functions.lib.php, which calls unserialize() without class restrictions when json_decode() fails. Attackers able to write stored extrafields, export configurations or blocked log entries can plant serialized objects that…","s":6.6,"v":"MEDIUM","cwe":"CWE-502"},{"id":"CVE-2026-110378","p":1792091843433,"x":"Missing Authorization vulnerability in WP E-Signature Ninja Forms Signature Contract Add-On ninja-signature-contract-forms-add-on allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ninja Forms Signature Contract Add-On: from n/a through 3.2.5.","s":5.3,"v":"MEDIUM","cwe":"CWE-862"},{"id":"CVE-2026-110375","p":1792091843300,"x":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Chill Download Monitor download-monitor allows Stored XSS.This issue affects Download Monitor: from n/a through 5.3.3.","s":6.5,"v":"MEDIUM","cwe":"CWE-79"},{"id":"CVE-2026-110374","p":1792091843150,"x":"Missing Authorization vulnerability in Hamid Alinia Login with phone number login-with-phone-number allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Login with phone number: from n/a through 1.8.77.","s":4.3,"v":"MEDIUM","cwe":"CWE-862"},{"id":"CVE-2026-110364","p":1792091842817,"x":"Missing Authorization vulnerability in WP Desk Flexible Quantity – Measurement Price Calculator for WooCommerce flexible-quantity-measurement-price-calculator-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Flexible Quantity – Measurement Price Calculator for…","s":5.3,"v":"MEDIUM","cwe":"CWE-862"},{"id":"CVE-2026-110362","p":1792091842687,"x":"Missing Authorization vulnerability in Planet studio PlanetStudio Payment Gateway planetstudio-payment-gateway allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects PlanetStudio Payment Gateway: from n/a through 1.3.3.","s":5.3,"v":"MEDIUM","cwe":"CWE-862"},{"id":"CVE-2026-110361","p":1792091842557,"x":"Insertion of Sensitive Information Into Sent Data vulnerability in ClikIT Infinite Uploads infinite-uploads allows Retrieve Embedded Sensitive Data.This issue affects Infinite Uploads: from n/a through 3.4.1.","s":6.5,"v":"MEDIUM","cwe":"CWE-201"},{"id":"CVE-2026-110360","p":1792091842433,"x":"Missing Authorization vulnerability in WPdreams Ajax Search Lite ajax-search-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ajax Search Lite: from n/a through 4.14.5.","s":5.3,"v":"MEDIUM","cwe":"CWE-862"},{"id":"CVE-2026-109932","p":1792091842300,"x":"undici is an HTTP client library for Node.js. In versions 5.15.0 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1, its WebSocket client, including the bundled WebSocket exposed by Node.js, can be driven to exhaust process memory by a malicious or compromised WebSocket server. For every PING frame…","s":5.9,"v":"MEDIUM","cwe":"CWE-400"},{"id":"CVE-2026-109924","p":1792091842180,"x":"undici is an HTTP client library for Node.js. In versions 6.5.0 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1, its EventSource client can be driven to exhaust process memory by a malicious or compromised Server-Sent Events peer. By sending millions of tiny completed data fields with no blank event…","s":5.9,"v":"MEDIUM","cwe":"CWE-770"},{"id":"CVE-2026-109897","p":1792091842050,"x":"Missing Authorization vulnerability in WP Chill Strong Testimonials strong-testimonials allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Strong Testimonials: from n/a through 3.3.12.","s":5.4,"v":"MEDIUM","cwe":"CWE-862"},{"id":"CVE-2026-109893","p":1792091841917,"x":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force Presto Player presto-player allows Stored XSS.This issue affects Presto Player: from n/a through 4.5.3.","s":6.5,"v":"MEDIUM","cwe":"CWE-79"},{"id":"CVE-2026-109869","p":1792091841770,"x":"undici is an HTTP client library for Node.js. In versions 6.23.0 through 6.29.0, 7.18.0 through 7.30.0, and 8.0.0 through 8.12.1, its fetch() implementation crashes the Node.js process when a malicious server returns a response with more than five content codings and closes the connection before sending the body.…","s":7.5,"v":"HIGH","cwe":"CWE-248"}]}