CVEs published May 8, 2026
424 CVEs were published on May 8, 2026: 54 critical, 137 high. 2 are now in CISA KEV.
- Published
- 424
- Critical
- 54
- High
- 137
- Medium
- 88
- Low
- 12
- Unrated
- 133
- Now in CISA KEV
- 2
- Fix available
- 227
Most affected products
- Linux
- 197
- Apache Software Foundation Apache CloudStack
- 7
- electerm
- 7
- labring FastGPT
- 6
- MervinPraison PraisonAI · praisonai
- 6
- SEPPmail AG Secure Email Gateway
- 6
- Open5GS
- 5
- org.opencms:opencms-core
- 4
- SourceCodester SUP Online Shopping
- 4
- BerriAI litellm · litellm
- 3
Critical 54
- CVE-2026-44313LinkWarden: Server-Side Request Forgery (SSRF) in Link Creation via fetchTitleAndHeaders Functionlinkwarden
- CVE-2026-42354Sentry: Improper authentication on SAML SSO process allows user identity linkinggetsentry sentry · sentry
- CVE-2026-42454Termix: OS Command Injection in Docker Container Management EndpointsTermix-SSH Termix
- CVE-2026-42298Postiz: Arbitrary Code Execution and Token Exfiltration in pr-docker-build.yml via untrusted Dockerfile.devgitroomhq postiz-app
- CVE-2026-42302FastGPT: Unauthenticated Remote Code Execution (RCE) via code-server Misconfiguration in agent-sandboxlabring FastGPT
- CVE-2026-42287Emlog: SQL Injection Vulnerability in log_model.php within addLog() and updateLog() Functionsemlog
- CVE-2026-42193Plunk: SNS webhook forgeryuseplunk plunk
- CVE-2026-42160Data Space Portal: Incorrect Authorization and Client-Side Enforcement of Server-Side Security in ghcr.io/sovity/ds-portal-ce-backendsovity dataspace-portal
- CVE-2026-42072Nornicdb: Improper Network Binding in NornicDB Bolt Server allows unauthorized remote accessorneryd NornicDB · github.com/orneryd/nornicdb
- CVE-2026-41070openvpn-auth-oauth2 returns FUNC_SUCCESS on client-deny, allowing unauthenticated VPN accessjkroepke openvpn-auth-oauth2 · github.com/jkroepke/openvpn-…
- CVE-2026-44498ZEBRA: Block Validator Undercounts Coinbase and P2SH SigopsZcashFoundation zebra · zebrad
- CVE-2026-44497ZEBRA: Consensus Divergence in Transparent Sighash Hash-Type Handling due to Stale BufferZcashFoundation zebra · zebra-script +1
- CVE-2026-41584ZEBRA: rk Identity Point Panic in Transaction VerificationZcashFoundation zebra · zebrad +1
- CVE-2026-41583ZEBRA: Consensus Divergence in Transparent Sighash Hash-Type HandlingZcashFoundation zebra · zebrad +1
- CVE-2026-41588RELATE: Timing Attack Vulnerability in course/auth.py — check_sign_in_key()inducer relate
- CVE-2026-41574Nhost Vulnerable to Account Takeover via OAuth Email Verification Bypassnhost · github.com/nhost/nhost
- CVE-2026-43465net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQLinux
- CVE-2026-43414scsi: qla2xxx: Completely fix fcport double freeLinux
- CVE-2026-43407libceph: Fix potential out-of-bounds access in ceph_handle_auth_reply()Linux
- CVE-2026-43406libceph: prevent potential out-of-bounds reads in process_message_header()Linux
- CVE-2026-43402kthread: consolidate kthread exit paths to prevent use-after-freeLinux
- CVE-2026-43384net/tcp-ao: Fix MAC comparison to be constant-timeLinux
- CVE-2026-43383net/tcp-md5: Fix MAC comparison to be constant-timeLinux
- CVE-2026-43379ksmbd: fix use-after-free in smb_lazy_parent_lease_break_close()Linux
- CVE-2026-43378smb: server: fix use-after-free in smb2_open()Linux
- CVE-2026-43376ksmbd: fix use-after-free by using call_rcu() for oplock_infoLinux
- CVE-2026-41512Remote code execution via JavaScript injection in `BrowserAutomation::PlaywrightService`0din-ai ai-scanner
- CVE-2026-41507Remote Code Execution (RCE) via String Literal Injection into math-codegenmauriciopoppe math-codegen · math-codegen
- CVE-2026-43341net/ipv6: ioam6: prevent schema length wraparound in trace fillLinux
- CVE-2026-44336PraisonAI MCP `tools/call` path-traversal and RCE via Python `.pth` injectionMervinPraison PraisonAI · praisonai
- CVE-2026-41497Incomplete fix for CVE-2026-34935: Command Injection in MervinPraison/PraisonAIMervinPraison PraisonAI · praisonai
- CVE-2026-44126Insecure deserializationSEPPmail AG Secure Email Gateway
- CVE-2026-44125Missing Authorization in GINAv2SEPPmail AG Secure Email Gateway
- CVE-2026-44128Unauthenticated Remote Code ExecutionSEPPmail AG Secure Email Gateway
- CVE-2026-43304libceph: define and enforce CEPH_MAX_KEY_LENLinux
- CVE-2022-50994DrayTek Vigor 2960 < 1.5.1.4 OS Command Injection via mainfunction.cgiDrayTek Vigor
- CVE-2026-25199Apache CloudStack: Proxmox Extension Allows Unauthorized Cross-Tenant Instance AccessApache Software Foundation Apache CloudStack
- CVE-2026-8076Weak credentials vulnerability in the CashDro 3 web administration panelCashDro 3 Administration Panel
- CVE-2026-8153Command injection in Dashboard Server interfaceUniversal Robots PolyScope
- CVE-2026-6213Remote Spark SparkView RCERemote Spark (https://www.remotespark.com/) SparkView
- CVE-2013-10075Apache::Session versions through 1.94 for Perl re-creates deleted sessionsCHORNY Apache::Session
- CVE-2026-42208LiteLLM: SQL injection in Proxy API key verificationBerriAI litellm · litellm
- CVE-2026-43944electerm: dangerous code can be run through links or command lineelecterm
- CVE-2026-43941Unvalidated shell.openExternal in electerm allows arbitrary protocol execution via terminal link clickelecterm
- CVE-2026-41500electerm has Command Injection Vulnerability via runMac functionelecterm
- CVE-2026-41501electerm has Command Injection Vulnerability via runLinux functionelecterm
- CVE-2023-46453Certain GL.iNet devices with 4.x firmware allow authentication bypass (resulting in administrative control of the device) via a username tha
- CVE-2024-51092LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command injection involving AboutController.php's index(),librenms/librenms
- CVE-2025-678871C-Bitrix through 25.100.500 allows Remote Code Execution because an actor with SOURCE/WRITE permissions for the Translate Module can upload
- CVE-2025-69599RayVentory Scan Engine through 12.6 Update 8 allows attackers to gain privileges if they control the value of the PATH environment variable.
- CVE-2025-69690Netgate pfSense CE 2.7.2 allows code execution by using the module installer with a backup file with a serialized PHP object containing the
- CVE-2025-69691Netgate pfSense CE 2.8.0 allows code execution in the XMLRPC API via pfsense.exec_php.
- CVE-2026-37431Beauty Parlour Management System v1.1 was discovered to contain a SQL injection vulnerability via the aptnumber parameter in the /appointmen
- CVE-2026-38360Directory Traversal vulnerability in fohrloop dash-uploader v.0.1.0 through v.0.7.0a2 allows a remote attacker to execute arbitrary code viadash-uploader
High 137
- CVE-2026-42455LinkWarden: Stored XSS via Client-Side Archive Upload (Unsanitized HTML served from same origin)linkwarden
- CVE-2026-42453Termix: Command injection in extractArchive/compressFiles via double-quote escaping bypassTermix-SSH Termix
- CVE-2026-42452Termix: Pending-TOTP temporary token can regenerate backup codes and neutralize TOTPTermix-SSH Termix
- CVE-2026-42352pygeoapi 0.23.x: Unauthenticated SSRF via OGC API - Processes Subscribergeopython pygeoapi · pygeoapi
- CVE-2026-42351pygeoapi: Path Traversal in STAC FileSystemProvidergeopython pygeoapi · pygeoapi
- CVE-2026-42556Postiz stored XSS in public preview pagegitroomhq postiz-app
- CVE-2026-42339New API: SSRF Filter Bypass via 0.0.0.0QuantumNous new-api · github.com/QuantumNous/new-api
- CVE-2026-41432New API: Stripe Webhook Signature Bypass via Empty Secret Enables Unlimited Quota FraudQuantumNous new-api · github.com/QuantumNous/new-api
- CVE-2026-42345FastGPT: Cloud metadata endpoint SSRF protection bypass via port specification, IPv6 mapping, hex/decimal IP encoding, and trailing dotlabring FastGPT
- CVE-2026-42224ipl/web is vulnerable to reflected XSS by malformed search requestsIcinga ipl-web · ipl/web
- CVE-2026-41520Cillium exposes sensitive information included in the cilium-bugtool debug archivecilium · github.com/cilium/cilium
- CVE-2026-42286Emlog: Cross-Site Request Forgery in Admin Functionsemlog
- CVE-2026-41486Ray: Remote Code Execution via Parquet Arrow Extension Type Deserializationray-project ray · ve-ray +1
- CVE-2026-42212SolidCAM-GPPL-IDE: XML External Entity (XXE) and billion-laughs DoS in VMID parseranzory SolidCAM-GPPL-IDE
- CVE-2026-42205Avo: Broken Access Control: Unauthorized Execution of Arbitrary Action Classes Across Resourcesavo-hq avo · avo
- CVE-2026-44400MailEnable Enterprise Premium < 10.55 Authorization Bypass via WebAdminMailEnable Enterprise Premium
- CVE-2026-7807SmarterTools SmarterMail < Build 9560 Server Local File Inclusion via the /api/v1/report/summary/{type} APISmarterTools SmarterMail
- CVE-2026-42189Russh: Pre-auth DoS via unbounded allocation in keyboard-interactive authEugeny russh · russh
- CVE-2026-44694n8n-MCP: Authenticated SSRF in n8n-mcp webhook and API client pathsczlonkowski n8n-mcp · n8n-mcp
- CVE-2026-29201Insufficient input validation of the feature file name in `feature::LOADFEATUREFILE` adminbin call can cause arbitrary file read when a relaWebPros cPanel · WebPros WP Squared
- CVE-2026-8178Remote Code Execution via Unsafe Class Loading in Amazon Redshift JDBC DriverAmazon Redshift JDBC Driver · com.amazon.redshift:redshift-…
- CVE-2026-6659Crypt::PasswdMD5 versions through 1.42 for Perl generates insecure random values for saltsRSAVAGE Crypt::PasswdMD5
- CVE-2026-41886locize Client SDK: Cross-origin DOM XSS & Handler Hijack Through Missing e.origin Validation in InContext Editorlocize
- CVE-2026-42793Atom table exhaustion via attacker-controlled GraphQL SDL names in absintheabsinthe-graphql absinthe
- CVE-2026-43967Quadratic fragment-name uniqueness check causes denial of service in absintheabsinthe-graphql absinthe
- CVE-2026-41693i18next-fs-backend: Path traversal via unsanitised lng/ns allows arbitrary file read/overwritei18next-fs-backend
- CVE-2026-41883OmniFaces: EL injection via crafted resource name in wildcard CDN mappingomnifaces · org.omnifaces:omnifaces
- CVE-2026-42353Path traversal / SSRF in i18next-http-middleware via user-controlled language and namespace parametersi18next-http-middleware
- CVE-2026-41683HTTP response splitting and DoS in i18next-http-middleware via unsanitised Content-Language headeri18next-http-middleware
- CVE-2026-41690Prototype pollution and path traversal in i18next-http-middleware via user-controlled language and namespace parametersi18next-http-middleware
- CVE-2026-44499ZEBRA: Permanent Block Discovery Halt via Gossip Queue Saturation and Syncer PoisoningZcashFoundation zebra · zebrad
- CVE-2026-41576Ajax30/BraveCMS-2.0: Stored HTML Injection in Contact Email via nl2br() and Unescaped Blade TemplateAjax30 BraveCMS-2.0
- CVE-2026-41524Ajax30/BraveCMS-2.0: Stored XSS in Page / Article ContentAjax30 BraveCMS-2.0
- CVE-2026-41570PHPUnit: Argument injection via newline in PHP INI values forwarded to child processessebastianbergmann phpunit · phpunit/phpunit
- CVE-2026-43469xprtrdma: Decrement re_receiving on the early exit pathsLinux
- CVE-2026-43466net/mlx5e: Fix DMA FIFO desync on error CQE SQ recoveryLinux
- CVE-2026-43464net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQLinux
- CVE-2026-43462net: spacemit: Fix error handling in emac_tx_mem_map()Linux
- CVE-2026-43461spi: amlogic: spifc-a4: Fix DMA mapping error handlingLinux
- CVE-2026-43459ASoC: soc-core: flush delayed work before removing DAIs and widgetsLinux
- CVE-2026-43456bonding: fix type confusion in bond_setup_by_slave()Linux
- CVE-2026-43454netfilter: nf_tables: Fix for duplicate device in netdev hooksLinux
- CVE-2026-43452netfilter: x_tables: guard option walkers against 1-byte tail readsLinux
- CVE-2026-43447iavf: fix PTP use-after-free during resetLinux
- CVE-2026-43442io_uring: fix physical SQE bounds check for SQE_MIXED 128-byte opsLinux
- CVE-2026-43441net: bonding: Fix nd_tbl NULL dereference when IPv6 is disabledLinux
- CVE-2026-43438sched_ext: Remove redundant css_put() in scx_cgroup_init()Linux
- CVE-2026-43437ALSA: pcm: fix use-after-free on linked stream runtime in snd_pcm_drain()Linux
- CVE-2026-43434rust_binder: check ownership before using vmaLinux
- CVE-2026-43433rust_binder: avoid reading the written value in offsets arrayLinux
- CVE-2025-67486Dolibarr has an Authenticated Remote Code Execution via eval() injection in user extrafieldsdolibarr
- CVE-2026-43408ceph: add a bunch of missing ceph_path_info initializersLinux
- CVE-2026-43405libceph: Use u32 for non-negative values in ceph_monmap_decode()Linux
- CVE-2026-43403nsfs: tighten permission checks for ns iteration ioctlsLinux
- CVE-2026-43391nsfs: tighten permission checks for handle openingLinux
- CVE-2026-43385net: Fix rcu_tasks stall in threaded busypollLinux
- CVE-2026-43380hwmon: (pmbus/q54sj108a2) fix stack overflow in debugfs readLinux
- CVE-2026-43377ksmbd: Don't log keys in SMB3 signing and encryption key generationLinux
- CVE-2026-43374net: nexthop: fix percpu use-after-free in remove_nh_grp_entryLinux
- CVE-2026-43373net: ncsi: fix skb leak in error pathsLinux
- CVE-2026-43370drm/amdgpu: Fix use-after-free race in VM acquireLinux
- CVE-2026-43368drm/i915: Fix potential overflow of shmem scatterlist lengthLinux
- CVE-2026-43366io_uring/kbuf: check if target buffer list is still legacy on recycleLinux
- CVE-2026-43365xfs: fix undersized l_iclog_roundoff valuesLinux
- CVE-2026-43362smb: client: fix in-place encryption corruption in SMB2_write()Linux
- CVE-2026-43353i3c: mipi-i3c-hci: Fix race in DMA ring dequeueLinux
- CVE-2026-43352i3c: mipi-i3c-hci: Correct RING_CTRL_ABORT handling in DMA dequeueLinux
- CVE-2026-43350smb: client: require a full NFS mode SID before reading mode bitsLinux
- CVE-2026-43347arm64: dts: qcom: monaco: Reserve full Gunyah metadata regionLinux
- CVE-2026-43345net: ipa: fix event ring index not programmed for IPA v5.0+Linux
- CVE-2026-44340PraisonAI: Symlink-extraction bypass of `_safe_extractall` writes outside `dest_dir`MervinPraison PraisonAI · praisonai
- CVE-2026-39816Apache NiFi: Missing Execute Code Required Permission on TinkerpopClientServiceApache Software Foundation Apache NiFi · org.apache.nifi:ni…
- CVE-2026-44339PraisonAI has unsafe tool resolution in `ToolExecutionMixin.execute_tool`: undeclared `__main__` callables executeMervinPraison PraisonAI · praisonaiagents +1
- CVE-2026-44338PraisonAI ships and generates a legacy API server with authentication disabled by default, allowing unauthenticated workflow executionMervinPraison PraisonAI · praisonai
- CVE-2026-43339ipv6: prevent possible UaF in addrconf_permanent_addr()Linux
- CVE-2026-43336lib/crypto: chacha: Zeroize permuted_state before it leaves scopeLinux
- CVE-2026-43334Bluetooth: SMP: force responder MITM requirements before building the pairing responseLinux
- CVE-2026-43332thermal: core: Fix thermal zone device registration error pathLinux
- CVE-2026-43330crypto: caam - fix overflow on long hmac keysLinux
- CVE-2026-43329netfilter: flowtable: strictly check for maximum number of actionsLinux
- CVE-2026-43324USB: dummy-hcd: Fix interrupt synchronization errorLinux
- CVE-2026-43322Bluetooth: hci_sync: Fix UAF in le_read_features_completeLinux
- CVE-2026-44335SSRF bypass in PraisonAIMervinPraison PraisonAI · praisonaiagents
- CVE-2026-43321bpf: Properly mark live registers for indirect jumpsLinux
- CVE-2025-71302drm/panthor: fix for dma-fence safe access rulesLinux
- CVE-2026-44334PraisonAI: Unauthenticated RCE via `tool_override.py`MervinPraison PraisonAI · praisonai
- CVE-2026-41496PraisonAI: SQL Injection via unvalidated `table_prefix` in 9 conversation store backends (incomplete fix for CVE-2026-40315)MervinPraison PraisonAI · praisonai +1
- CVE-2025-71300Revert "arm64: zynqmp: Add an OP-TEE node to the device tree"Linux
- CVE-2026-44129Server-side template injectionSEPPmail AG Secure Email Gateway
- CVE-2026-44127Local File Inclusion (LFI) and Arbitrary File DeletionSEPPmail AG Secure Email Gateway
- CVE-2026-43307iio: accel: adxl380: Avoid reading more entries than present in FIFOLinux
- CVE-2026-43303mm/page_alloc: clear page->private in free_pages_prepare()Linux
- CVE-2026-43296octeontx2-af: Workaround SQM/PSE stalls by disabling stickyLinux
- CVE-2026-43291net: nfc: nci: Fix parameter validation for packet dataLinux
- CVE-2026-43290media: uvcvideo: Return queued buffers on start_streaming() failureLinux
- CVE-2026-41491Dapr: Service Invocation path traversal ACL bypassdapr · github.com/dapr/dapr
- CVE-2026-41423Angular: SSRF via protocol-relative and backslash URLs in Angular Platform-Serverangular · @angular/platform-server
- CVE-2026-25077Apache CloudStack: Unauthenticated Command Injection in Direct Download TemplatesApache Software Foundation Apache CloudStack
- CVE-2025-66467Apache CloudStack: MinIO policy remains intact on bucket deletionApache Software Foundation Apache CloudStack
- CVE-2025-66172Apache CloudStack: Any user can attach a volume in their VMs from backups they should not have access toApache Software Foundation Apache CloudStack
- CVE-2026-8077Weak credentials vulnerability in the CashDro 3 web administration panelCashDro 3 Administration Panel
- CVE-2026-7330Auto Affiliate Links <= 6.8.8 - Unauthenticated Stored Cross-Site Scripting via 'url' Parameterthedark Auto Affiliate Links
- CVE-2026-5127User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration <= 4.3.1 - Authenticated (Subscriber+) PHP Object Injectionwedevs User Frontend: AI Powered Frontend Posting, User Dir…
- CVE-2026-43284xfrm: esp: avoid in-place decrypt on shared skb fragsLinux
- CVE-2026-4935SureTriggers < 1.1.23 – Unauthenticated SQLiOttoKit: All-in-One Automation Platform
- CVE-2026-8069PredatorSense V3: Local Privilege Escalation (LPE) vulnerabilityAcer PredatorSense
- CVE-2026-8148NAVER MYBOX Explorer for Windows before 3.0.11.160 allows a local attacker to escalate privileges to NT AUTHORITY\SYSTEM via registry manipuNAVER MYBOX Explorer
- CVE-2026-8138Tenda CX12L SetPptpServerCfg” formSetPPTPServer stack-based overflowTenda CX12L
- CVE-2026-8137Totolink X5000R formDdns sub_458E40 buffer overflowTotolink X5000R
- CVE-2026-42278UltraDAG: Smart Account Spending Policy Bypass via PocketsUltraDAGcom core
- CVE-2026-42275zrok: WebDAV drive backend follows symlinks outside DriveRoot, enabling host filesystem read/writeopenziti zrok · github.com/openziti/zrok +1
- CVE-2026-42274Heimdall: Authorization bypass via path normalization mismatchdadrus heimdall · github.com/dadrus/heimdall
- CVE-2026-42273Heimdall: Case-sensitive host matching may lead to policy bypassdadrus heimdall · github.com/dadrus/heimdall
- CVE-2026-42272Heimdall: Case-sensitive handling of URL-encoded slashes may lead to inconsistent path interpretationdadrus heimdall · github.com/dadrus/heimdall
- CVE-2026-42203LiteLLM: Server-Side Template Injection in /prompts/test endpointBerriAI litellm · litellm
- CVE-2026-42271LiteLLM: Authenticated command execution via MCP stdio test endpointsBerriAI litellm · litellm
- CVE-2026-41900OpenLearnX has Critical Remote Code Execution Through Python Sandbox Escape via Code Execution Environmentth30d4y OpenLearnX · openlearnx
- CVE-2026-42264Axios: Prototype pollution read-side gadgets in HTTP adapter allow credential injection and request hijackingaxios
- CVE-2026-42261PromptHub: Authenticated SSRF via IPv6 filter bypass in `POST /api/skills/fetch-remote`legeling PromptHub
- CVE-2026-43940electerm: Path traversal in electerm runWidget leads to arbitrary code executionelecterm
- CVE-2026-43943electerm: RCE via malicious SSH server filename in openFileWithEditorelecterm
- CVE-2022-26522The socket connection handler in aswArPot.sys in the Avast and AVG Windows Anti Rootkit driver before 22.1 allows local attackers to execute
- CVE-2023-42344Alkacon OpenCms before 10.5.1 allows remote unauthenticated attackers to obtain sensitive information via a cmis-online/query XXE attack on org.opencms:opencms-core
- CVE-2023-42346Alkacon OpenCms before 16 allows XXE when the <!DOCTYPE> refers to an external host.org.opencms:opencms-core
- CVE-2024-27686Mikrotik RouterOS (x86) 6.40.5 through 6.49.10 (fixed in 7) allows a remote attacker to cause a denial of service (device crash) via crafted
- CVE-2024-33288Prison Management System Using PHP v1.0 was discovered to contain a SQL injection vulnerability via the username on the Admin login page.
- CVE-2024-45257A Command Injection issue in the payload build page in BYOB (Build Your Own Botnet) 2.0 allows attackers to execute arbitrary commands on th
- CVE-2024-46507A SSTI (server side template injection) vulnerability in the custom template export function in yeti-platform yeti before 2.1.12 allows atta
- CVE-2024-46508yeti-platform yeti before 2.1.12 allows attackers to generate valid JWT tokens is the secret is not changed (by setting YETI_AUTH_SECRET_KEY
- CVE-2024-53326LINQPad before 5.52.01 Pro edition is vulnerable to Unsafe Deserialization in LINQPad.AutoRefManager::PopulateFromCache(), leading to code e
- CVE-2025-55449AstrBotDevs AstrBot 3.5.15 has Advanced_System_for_Text_Response_and_Bot_Operations_Tool as the hardcoded private key used to sign a JWT.astrbot
- CVE-2025-67888An issue was discovered in Control Web Panel (CWP) before 0.9.8.1209.
- CVE-2026-29972nanoMODBUS through v1.22.0 has a stack-based buffer overflow in recv_read_registers_res() in nanomodbus.c.
- CVE-2026-29974An issue was discovered in kosma minmea 0.3.0.
- CVE-2026-29975lwjson 1.8.1 contains an improper input validation vulnerability in the streaming JSON parser (lwjson_stream.c).
- CVE-2026-34354Akamai Guardicore Platform Agent (GPA) and Zero Trust Client on Linux and macOS allow TOCTOU-based local privilege escalation.Akamai Guardicore Platform Agent · Akamai Zero Trust Client
- CVE-2026-38361Multiple unauthenticated denial-of-service (DoS) issues in fohrloop dash-uploader v0.1.0 through v0.7.0a2.dash-uploader
Medium, low and unrated 233
- CVE-2026-42456AnythingLLM: Cross-User TTS Audio Disclosure via Chat ID (IDOR)Mintplex-Labs anything-llm
- CVE-2026-42451Grimmory: Stored XSS via Malicious EPUB Enables Session Token Theftgrimmory-tools grimmory
- CVE-2026-41682pupnp: Port truncation via atoi() cast in parse_uri() allows SSRF port confusionpupnp
- CVE-2026-45130Vim: Heap Buffer Overflow in spell file loadingvim
- CVE-2026-44656Vim: OS Command Injection via 'path' completionvim
- CVE-2026-42307Vim: OS Command Injection in netrwvim
- CVE-2026-42350Kargo: Open Redirect in UI OIDC Login Flow via redirectTo Query Parameterakuity kargo · github.com/akuity/kargo
- CVE-2026-42346Postiz: TOCTOU DNS rebinding bypasses all SSRF URL validation pathsgitroomhq postiz-app
- CVE-2026-44286FastGPT: SSRF Vulnerability in Laf Workflow Node via Missing Internal Address Validationlabring FastGPT
- CVE-2026-44284FastGPT: Stored MCP tool URL SSRF in FastGPT workflow executionlabring FastGPT
- CVE-2026-42344FastGPT: DNS rebinding TOCTOU bypass in isInternalAddress allows SSRF on all protected endpointslabring FastGPT
- CVE-2026-42343FastGPT: Uncontrolled Resource Consumption leading to Sandbox Exhaustionlabring FastGPT
- CVE-2026-44987SysReptor: Privilege Escalation from User Admin to SuperuserSyslifters sysreptor
- CVE-2026-42291SysReptor: Read-write access to personal notes by sharing-link creation with no authorization in SysReptor ProfessionalSyslifters sysreptor
- CVE-2026-42206Roadiz OpenID Connect nonce generated but never validated — ID token replay attackroadiz core-bundle-dev-app · roadiz/openid
- CVE-2026-41517Emlog: Remote Code Execution via Malicious Plugin Uploademlog
- CVE-2026-42209FlashMQ: Division by zero crash when using non-default deferred retained message settinghalfgaar FlashMQ
- CVE-2026-42213SolidCAM-GPPL-IDE: Path traversal in `inc` directive enables file probing and NTLM-hash leakanzory SolidCAM-GPPL-IDE
- CVE-2026-42195Unvalidated gitlab URL parameter redirects OAuth authorize step to attacker-controlled hostjgraph drawio
- CVE-2026-42202nova-toggle-5: Improper authorization on toggle endpoint allowed non-Nova users to modify boolean fieldsalmirhodzic nova-toggle-5 · almirhodzic/nova-toggle-5
- CVE-2026-42199Grid: Integer Overflow in Grid::expand_rows Leads to Safe-API Undefined Behaviorbecheran grid · grid
- CVE-2026-42192Plunk: Stored XSS in campaign viewuseplunk plunk
- CVE-2026-42190RedwoodSDK: Same-site CSRF in in server actionsredwoodjs sdk · rwsdk
- CVE-2026-42180Lemmy: SSRF in /api/v3/post via Webmention dispatchLemmyNet lemmy · lemmy_api_common
- CVE-2026-42181Lemmy: SSRF and internal image disclosure in post link metadata via unvalidated og:imageLemmyNet lemmy · lemmy_api_common
- CVE-2026-42185People: Privilege Escalation via Missing Role Ceiling in Mail Domain Invitationsuitenumerique people
- CVE-2026-42176Scoold: Persistent Admin Takeover by Overwriting the admins Configuration Setting via Forged JWT (missing `jti` validation)Erudika scoold
- CVE-2026-42282n8n-MCP: Sensitive MCP tool-call arguments logged on authenticated requests in HTTP modeczlonkowski n8n-mcp · n8n-mcp
- CVE-2026-41495n8n-MCP Logs Sensitive Request Data on Unauthorized /mcp Requestsczlonkowski n8n-mcp · n8n-mcp
- CVE-2026-41511OpenMcdf has an Infinite loop DoS via crafted CFB directory cycleironfede openmcdf · OpenMcdf
- CVE-2026-29202Insufficient input validation of the `plugin` parameter of the `create_user` plugin allows arbitrary Perl code execution on behalf of the alWebPros cPanel · WebPros WP Squared
- CVE-2026-29203A chmod call in the cPanel Nova plugin's Cpanel::Nova::Connector follows symlinks, allowing setting root permissions on arbitrary system filWebPros cPanel · WebPros WP Squared
- CVE-2026-42030MapServer: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) in OpenLayers viewerMapServer
- CVE-2026-42028novaGallery: Unauthenticated Path Traversal in Album and Cached Image Routes Allows Reading Images Outside Gallery Rootnovafacile novagallery
- CVE-2026-41889pgx: SQL Injection via placeholder confusion with dollar quoted string literalsjackc pgx · github.com/jackc/pgx +2
- CVE-2026-41887Flarum: Path traversal in LESS parser via theme color settings (incomplete fix for CVE-2023-27577)flarum framework · flarum/core
- CVE-2026-42794Reflected XSS via backslash bypass in GraphiQL js_escape in absinthe_plugabsinthe-graphql absinthe_plug
- CVE-2026-41885Path traversal / URL injection via unsanitised lng/ns/projectId/version in i18next-locize-backendi18next-locize-backend
- CVE-2026-41591Marko: XSS via case-insensitive script/style closing tag bypass in runtime HTML escapingmarko-js marko · marko +1
- CVE-2026-44500ZEBRA: Allocation Amplification in Inbound Network DeserializersZcashFoundation zebra · zebra-network +2
- CVE-2026-41585ZEBRA: Denial of Service via Interrupted JSON-RPC Requests from Authenticated ClientsZcashFoundation zebra · zebra-rpc +1
- CVE-2026-41575th30d4y/IP: DOM-Based Cross-Site Scripting (XSS) Vulnerabilityth30d4y IP
- CVE-2026-41308Password Pusher: JSON API `/p.json` file upload alias bypasses file-push authenticationpglombardo PasswordPusher
- CVE-2026-41487Langfuse: Improper role-based-access control in Langfuse LLM connection management allowed users of role “member” to retrieve stored LLM provider API keyslangfuse
- CVE-2026-43475scsi: storvsc: Fix scheduling while atomic on PREEMPT_RTLinux
- CVE-2026-43474fs: init flags_valid before calling vfs_fileattr_getLinux
- CVE-2026-43473scsi: mpi3mr: Add NULL checks when resetting request and reply queuesLinux
- CVE-2026-43472unshare: fix unshare_fs() handlingLinux
- CVE-2026-43471scsi: ufs: core: Fix possible NULL pointer dereference in ufshcd_add_command_trace()Linux
- CVE-2026-43470nfs: return EISDIR on nfs3_proc_create if d_alias is a dirLinux
- CVE-2026-43468net/mlx5: Fix deadlock between devlink lock and esw->wqLinux
- CVE-2026-43467net/mlx5: Fix crash when moving to switchdev modeLinux
- CVE-2026-43463rxrpc, afs: Fix missing error pointer check after rxrpc_kernel_lookup_peer()Linux
- CVE-2026-43460spi: rockchip-sfc: Fix double-free in remove() callbackLinux
- CVE-2026-43458serial: caif: hold tty->link reference in ldisc_open and ser_releaseLinux
- CVE-2026-43457mctp: i2c: fix skb memory leak in receive pathLinux
- CVE-2026-43455mctp: route: hold key->lock in mctp_flow_prepare_output()Linux
- CVE-2026-43453netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop()Linux
- CVE-2026-43451netfilter: nfnetlink_queue: fix entry leak in bridge verdict error pathLinux
- CVE-2026-43450netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table()Linux
- CVE-2026-43449nvme-pci: Fix slab-out-of-bounds in nvme_dbbuf_setLinux
- CVE-2026-43448nvme-pci: Fix race bug in nvme_poll_irqdisable()Linux
- CVE-2026-43446accel/amdxdna: Fix runtime suspend deadlock when there is pending jobLinux
- CVE-2026-43445e1000/e1000e: Fix leak in DMA error cleanupLinux
- CVE-2026-43444drm/amdkfd: Unreserve bo if queue update failedLinux
- CVE-2026-43443ASoC: amd: acp-mach-common: Add missing error check for clock acquisitionLinux
- CVE-2026-43440net/mana: Null service_wq on setup error to prevent double destroyLinux
- CVE-2026-43439cgroup: fix race between task migration and iterationLinux
- CVE-2026-43436ALSA: usb-audio: Check endpoint numbers at parsing Scarlett2 mixer interfacesLinux
- CVE-2026-43435rust_binder: fix oneway spam detectionLinux
- CVE-2026-43432usb: xhci: Fix memory leak in xhci_disable_slot()Linux
- CVE-2026-43431xhci: Fix NULL pointer dereference when reading portli debugfs filesLinux
- CVE-2026-43430usb: yurex: fix race in probeLinux
- CVE-2026-43429USB: usbtmc: Use usb_bulk_msg_killable() with user-specified timeoutsLinux
- CVE-2026-43428USB: core: Limit the length of unkillable synchronous timeoutsLinux
- CVE-2026-43427usb: class: cdc-wdm: fix reordering issue in read code pathLinux
- CVE-2026-43426usb: renesas_usbhs: fix use-after-free in ISR during device removalLinux
- CVE-2026-43425usb: image: mdc800: kill download URB on timeoutLinux
- CVE-2026-43424usb: gadget: f_tcm: Fix NULL pointer dereferences in nexus handlingLinux
- CVE-2026-43421usb: gadget: f_ncm: Fix net_device lifecycle with device_moveLinux
- CVE-2026-43420ceph: fix i_nlink underrun during async unlinkLinux
- CVE-2026-43419ceph: fix memory leaks in ceph_mdsc_build_path()Linux
- CVE-2026-43418sched/mmcid: Prevent CID stalls due to concurrent forksLinux
- CVE-2026-43417sched/mmcid: Handle vfork()/CLONE_VM correctlyLinux
- CVE-2026-43416powerpc, perf: Check that current->mm is alive before getting user callchainLinux
- CVE-2026-43415scsi: ufs: core: Fix SError in ufshcd_rtc_work() during UFS suspendLinux
- CVE-2026-43413scsi: hisi_sas: Fix NULL pointer exception during user_scan()Linux
- CVE-2026-43412ASoC: qcom: qdsp6: Fix q6apm remove ordering during ADSP stop and startLinux
- CVE-2026-43411tipc: fix divide-by-zero in tipc_sk_filter_connect()Linux
- CVE-2026-43410firmware: stratix10-rsu: Fix NULL pointer dereference when RSU is disabledLinux
- CVE-2026-43409kprobes: avoid crash when rmmod/insmod after ftrace killedLinux
- CVE-2026-43404mm: Fix a hmm_range_fault() livelock / starvation problemLinux
- CVE-2026-43401cpufreq: intel_pstate: Fix NULL pointer dereference in update_cpu_qos_request()Linux
- CVE-2026-43400drm/amdgpu: add upper bound check on user inputs in signal ioctlLinux
- CVE-2026-43399drm/amdgpu/userq: Fix reference leak in amdgpu_userq_wait_ioctlLinux
- CVE-2026-43398drm/amdgpu: add upper bound check on user inputs in wait ioctlLinux
- CVE-2026-43397drm/bridge: samsung-dsim: Fix memory leak in error pathLinux
- CVE-2026-43396drm/xe/sync: Fix user fence leak on alloc failureLinux
- CVE-2026-43395drm/xe/sync: Cleanup partially initialized sync on parse failureLinux
- CVE-2026-43394nfsd: Fix cred ref leak in nfsd_nl_listener_set_doit().Linux
- CVE-2026-43393btrfs: fix chunk map leak in btrfs_map_block() after btrfs_chunk_map_num_copies()Linux
- CVE-2026-43392sched_ext: Fix starvation of scx_enable() under fair-class saturationLinux
- CVE-2026-43390nstree: tighten permission checks for listingLinux
- CVE-2026-43389mm: memfd_luo: always dirty all foliosLinux
- CVE-2026-43388mm/damon/core: clear walk_control on inactive context in damos_walk()Linux
- CVE-2026-43387staging: rtl8723bs: properly validate the data in rtw_get_ie_ex()Linux
- CVE-2026-43386staging: rtl8723bs: fix potential out-of-bounds read in rtw_restruct_wmm_ieLinux
- CVE-2026-43382batman-adv: Avoid double-rtnl_lock ELP metric workerLinux
- CVE-2026-43381nouveau/dpcd: return EBUSY for aux xfer if the device is asleepLinux
- CVE-2026-43375net: mctp: fix device leak on probe failureLinux
- CVE-2026-43372net: dsa: microchip: Fix error path in PTP IRQ setupLinux
- CVE-2026-43371net: macb: Shuffle the tx ring before enabling txLinux
- CVE-2026-43369drm/amd: Fix NULL pointer dereference in device cleanupLinux
- CVE-2026-43367drm/amd: Fix a few more NULL pointer dereference in device cleanupLinux
- CVE-2026-43364ublk: fix NULL pointer dereference in ublk_ctrl_set_size()Linux
- CVE-2026-43363x86/apic: Disable x2apic on resume if the kernel expects soLinux
- CVE-2026-43361btrfs: fix transaction abort when snapshotting received subvolumesLinux
- CVE-2026-43360btrfs: fix transaction abort on file creation due to name hash collisionLinux
- CVE-2026-43359btrfs: fix transaction abort on set received ioctl due to item overflowLinux
- CVE-2026-43358btrfs: add missing RCU unlock in error path in try_release_subpage_extent_buffer()Linux
- CVE-2026-43357iio: gyro: mpu3050-core: fix pm_runtime error handlingLinux
- CVE-2026-43356iio: imu: adis: Fix NULL pointer dereference in adis_initLinux
- CVE-2026-43355iio: light: bh1780: fix PM runtime leak on error pathLinux
- CVE-2026-43354iio: proximity: hx9023s: Protect against division by zero in set_samp_freqLinux
- CVE-2026-43351KVM: arm64: Eagerly init vgic dist/redist on vgic creationLinux
- CVE-2026-32803Dell PowerScale OneFS versions 9.5.0.0 through 9.5.1.6, 9.6.0.0 through 9.7.1.13, 9.8.0.0 through 9.10.1.5 and 9.11.0.0 through 9.12.0.1 conDell PowerScale OneFS
- CVE-2026-41509Integer underflow in crypto_sign_open() leads to buffer overflowCROSS-signature CROSS-implementation
- CVE-2026-41506go-git Credential leak via cross-host redirect in smart HTTP transportgo-git · github.com/go-git/go-git/v5 +1
- CVE-2026-43349f2fs: fix to avoid uninit-value access in f2fs_sanity_check_node_footerLinux
- CVE-2026-43348mshv_vtl: Fix vmemmap_shift exceeding MAX_FOLIO_ORDERLinux
- CVE-2026-43346ice: ptp: don't WARN when controlling PF is unavailableLinux
- CVE-2026-43344perf/x86/intel/uncore: Fix die ID init and look up bugsLinux
- CVE-2026-43343usb: gadget: f_subset: Fix unbalanced refcnt in geth_freeLinux
- CVE-2026-43342usb: gadget: f_rndis: Protect RNDIS options with mutexLinux
- CVE-2026-43340comedi: Reinit dev->spinlock between attachments to low-level driversLinux
- CVE-2026-44337PraisonAI knowledge-store backends interpolate unvalidated collection names into SQL and CQL queriesMervinPraison PraisonAI · praisonai
- CVE-2026-43338btrfs: reserve enough transaction items for qgroup ioctlsLinux
- CVE-2026-43337drm/amd/display: Fix NULL pointer dereference in dcn401_init_hw()Linux
- CVE-2026-43335interconnect: qcom: sm8450: Fix NULL pointer dereference in icc_link_nodes()Linux
- CVE-2026-43333bpf: reject direct access to nullable PTR_TO_BUF pointersLinux
- CVE-2026-43331x86/kexec: Disable KCOV instrumentation after load_segments()Linux
- CVE-2026-43328cpufreq: governor: fix double free in cpufreq_dbs_governor_init() error pathLinux
- CVE-2026-43327USB: dummy-hcd: Fix locking/synchronization errorLinux
- CVE-2026-43326sched_ext: Fix SCX_KICK_WAIT deadlock by deferring wait to balance callbackLinux
- CVE-2026-43325wifi: iwlwifi: mvm: don't send a 6E related command when not supportedLinux
- CVE-2026-43323sched/fair: Fix zero_vruntime tracking fixLinux
- CVE-2026-43320drm/amd/display: Fix dsc eDP issueLinux
- CVE-2026-43319spi: spidev: fix lock inversion between spi_lock and buf_lockLinux
- CVE-2026-43318drm/amdgpu: fix sync handling in amdgpu_dma_buf_move_notifyLinux
- CVE-2026-43317most: core: fix leak on early registration failureLinux
- CVE-2026-43316media: solo6x10: Check for out of bounds chip_idLinux
- CVE-2025-71301drm/tests: shmem: Hold reservation lock around vmap/vunmapLinux
- CVE-2026-41493yard: Possible arbitrary path traversal and file access via yard serverlsegal yard · yard
- CVE-2026-7864Exposure of Sensitive Information to an Unauthorized ActorSEPPmail AG Secure Email Gateway
- CVE-2026-43315KVM: nSVM: Remove a user-triggerable WARN on nested_svm_load_cr3() succeedingLinux
- CVE-2026-43314dm: remove fake timeout to avoid leak requestLinux
- CVE-2026-43313ACPI: processor: Fix NULL-pointer dereference in acpi_processor_errata_piix4()Linux
- CVE-2026-43312media: i2c: ov5647: Initialize subdev before controlsLinux
- CVE-2026-43311soc/tegra: pmc: Fix unsafe generic_handle_irq() callLinux
- CVE-2026-43310media: verisilicon: Avoid G2 bus error while decoding H.264 and HEVCLinux
- CVE-2026-43309md raid: fix hang when stopping arrays with metadata through dm-raidLinux
- CVE-2026-43308btrfs: don't BUG() on unexpected delayed ref type in run_one_delayed_ref()Linux
- CVE-2026-43306bpf: crypto: Use the correct destructor kfunc typeLinux
- CVE-2026-43305drm/amd/display: Fix mismatched unlock for DMUB HW lock in HWSS fast pathLinux
- CVE-2026-43302drm/v3d: Set DMA segment size to avoid debug warningsLinux
- CVE-2026-43301media: chips-media: wave5: Fix PM runtime usage count underflowLinux
- CVE-2026-43300drm/panel: Fix a possible null-pointer dereference in jdi_panel_dsi_remove()Linux
- CVE-2026-43299btrfs: do not ASSERT() when the fs flips RO inside btrfs_repair_io_failure()Linux
- CVE-2026-43298drm/amdgpu: Skip vcn poison irq release on VFLinux
- CVE-2026-43297media: rockchip: rga: Fix possible ERR_PTR dereference in rga_buf_init()Linux
- CVE-2026-43295rapidio: replace rio_free_net() with kfree() in rio_scan_alloc_net()Linux
- CVE-2026-43294drm: renesas: rz-du: mipi_dsi: fix kernel panic when rebooting for some panelsLinux
- CVE-2026-43293media: chips-media: wave5: Fix kthread worker destruction in polling modeLinux
- CVE-2026-43292mm/vmalloc: prevent RCU stalls in kasan_release_vmalloc_nodeLinux
- CVE-2026-43289kexec: derive purgatory entry from symbolLinux
- CVE-2026-43288ext4: move ext4_percpu_param_init() before ext4_mb_init()Linux
- CVE-2026-43287drm: Account property blob allocations to memcgLinux
- CVE-2026-43286mm/hugetlb: restore failed global reservations to subpoolLinux
- CVE-2026-43285mm/slab: do not access current->mems_allowed_seq if !allow_spinLinux
- CVE-2025-71299spi: cadence-quadspi: Parse DT for flashes with the rest of the DT parsingLinux
- CVE-2025-71298drm/tests: shmem: Hold reservation lock around madviseLinux
- CVE-2025-71297wifi: rtw88: 8822b: Avoid WARNING in rtw8822b_config_trx_mode()Linux
- CVE-2025-71296drm/tests: shmem: Hold reservation lock around purgeLinux
- CVE-2026-41161Username Enumeration via Timing AttackSync-in server · @sync-in/server
- CVE-2025-69233Apache CloudStack: Domain/account resources limits not honoredApache Software Foundation Apache CloudStack
- CVE-2025-66171Apache CloudStack: Any user can create a new VM from backups they should not have access toApache Software Foundation Apache CloudStack
- CVE-2025-66170Apache CloudStack: Any user can list backups that they should not have access toApache Software Foundation Apache CloudStack
- CVE-2026-3318Multiple vulnerabilities in Cradle e-commerceCradle e-commerce
- CVE-2026-7475Sky Addons <= 3.3.2 - Authenticated (Author+) Stored Cross-Site Scripting via Custom Scriptwowdevs Sky Addons – Elementor Addons with Widgets & Templa…
- CVE-2026-5341NMR Strava activities <= 1.0.14 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributesmirceatm NMR Strava activities
- CVE-2026-7650E2Pdf – Export Pdf Tool for WordPress <= 1.32.17 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'id' Shortcode Attributeoleksandrz E2Pdf – Export Pdf Tool for WordPress
- CVE-2026-44928In uriparser before 1.0.2, the function family EqualsUri can misclassify two unequal URIs as equal.uriparser
- CVE-2026-44927In uriparser before 1.0.2, there is pointer difference truncation to int in various places.uriparser
- CVE-2026-44916In OpenStack Ironic before 35.0.2 (in a certain non-default configuration), instance_info['ks_template'] is rendered without sandboxing.OpenStack Ironic
- CVE-2026-8149GCM chunking can lead to bad tag exception on decryptionLegion of the Bouncy Castle BC-LTS · Legion of the Bounc… +1
- CVE-2026-42279solidtime: Time entry update endpoint allows cross-organization modification of a known time-entry UUIDsolidtime-io solidtime
- CVE-2026-42277Onyx: IDOR in /chat/file/{file_id} allows any authenticated user to download other users filesonyx-dot-app onyx
- CVE-2026-42276Onyx: IDOR in /chat/stop-chat-session allows any authenticated user to interrupt other users chat sessionsonyx-dot-app onyx
- CVE-2026-8136SourceCodester Pharmacy Sales and Inventory System index.php users cross site scriptingSourceCodester Pharmacy Sales and Inventory System
- CVE-2026-44298Kimai: Arbitrary file read in invoice PDF renderer (admin)kimai · kimai/kimai
- CVE-2026-41498Kimai: Team API Missing Object-Level Authorizationkimai · kimai/kimai
- CVE-2026-8133zyx0814 FilePress Shares Filelist API admin.php sql injectionzyx0814 FilePress
- CVE-2026-42267Kimai: Formula Injection via tag names in XLSX exportkimai · kimai/kimai
- CVE-2026-42150wlc: print_html outputs API data without HTML escaping, enabling stored XSSWeblateOrg wlc · wlc
- CVE-2026-41645Nuclei: Environment variable disclosure via Response-Derived DSL Expressionsprojectdiscovery nuclei · github.com/projectdiscovery/nu… +2
- CVE-2026-8132CodeAstro Leave Management System login.php sql injectionCodeAstro Leave Management System
- CVE-2026-41646Nuclei: Local File Read via require() Module Loader Bypassprojectdiscovery nuclei · github.com/projectdiscovery/nu… +2
- CVE-2026-43942electerm: Full process.env exposed to renderer via window.pre.env in electermelecterm
- CVE-2026-8131SourceCodester SUP Online Shopping replymsg.php sql injectionSourceCodester SUP Online Shopping
- CVE-2026-8130SourceCodester SUP Online Shopping message.php sql injectionSourceCodester SUP Online Shopping
- CVE-2026-8129SourceCodester SUP Online Shopping wishlist.php sql injectionSourceCodester SUP Online Shopping
- CVE-2026-8128SourceCodester SUP Online Shopping viewmsg.php sql injectionSourceCodester SUP Online Shopping
- CVE-2026-3508An Out-of-bounds Read vulnerability in the IOCTL handler in ASUS System Control Interface allows a local user to cause system crash (BSOD) vASUS System Control Interface
- CVE-2026-6737An Exposed IOCTL with Insufficient Access Control vulnerability in AsusPTPFilter allows a local user to bypass driver security mechanisms anAsusPTPFilter
- CVE-2026-8127eladmin Users API Endpoint UserController.java checkLevel access controleladmin
- CVE-2026-8126SourceCodester Comment System post_comment.php sql injectionSourceCodester Comment System
- CVE-2026-8125code-projects Simple Chat System sendMessage.php sql injectioncode-projects Simple Chat System
- CVE-2026-8124GPAC box_code_base.c sidx_box_read allocation of resourcesGPAC
- CVE-2026-8123Open5GS NSSF message.c ogs_sbi_discovery_option_add_snssais denial of serviceOpen5GS
- CVE-2026-8122Open5GS NSSF message.c ogs_sbi_discovery_option_add_service_names denial of serviceOpen5GS
- CVE-2026-8121Open5GS NSSF conv.c ogs_sbi_parse_plmn_list denial of serviceOpen5GS
- CVE-2026-8120Open5GS NSSF nnssf-handler.c denial of serviceOpen5GS
- CVE-2026-8119Open5GS NSSF nghttp2-server.c ogs_sbi_stream_find_by_id denial of serviceOpen5GS
- CVE-2022-23961In Thruk Monitoring through 2.46.3, the login field of the login form is vulnerable to reflected XSS.
- CVE-2022-26523The socket connection handler in aswArPot.sys in the Avast and AVG Windows Anti Rootkit driver before 22.1 allows local attackers to execute
- CVE-2022-45899Nokia Broadcast Message Center (BMC) before 13.1 allows an unauthenticated remote attacker to do OS command injection as root via shell meta
- CVE-2023-42343A Cross Site Scripting vulnerability in Alkacon OpenCms before 10.5.1 exists via cmis-online/type.org.opencms:opencms-core
- CVE-2023-42345A Cross Site Scripting vulnerability in Alkacon OpenCms before 16 exists via updateModelGroups.jsp.org.opencms:opencms-core
- CVE-2023-47268In libslic3r/GCode/PostProcessor.cpp in Prusa PrusaSlicer through 2.6.1, a crafted 3mf project file can execute arbitrary code on a host whe
- CVE-2024-30167/cgi-bin/time.cgi in Atlona AT-OME-MS42 Matrix Switcher 1.1.2 allow remote authenticated users to execute arbitrary commands as root via a P
- CVE-2024-33722SOPlanning 1.52.00 is vulnerable to SQL Injection by an authenticated user via projets.php with statut[].
- CVE-2024-33724SOPlanning 1.52.00 is vulnerable to Cross Site Scripting (XSS) via the groupe_id parameter to process/groupe_save.php.
- CVE-2025-67886Bitrix24 through 25.100.300 allows Remote Code Execution because an actor with SOURCE/WRITE permissions for the Translate Module can upload