Update Sun Mar 15 11:21:27 UTC 2026

2026-11-07 04:29:23 -10:00 · 2026-03-15 11:21:28 +00:00
1 parent 155809a1c2
commit 0d61883bdb
@@ -0,0 +1,17 @@
+### [CVE-2004-0920](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-0920)
+![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen)
+
+### Description
+
+Symantec Norton AntiVirus 2004, and earlier versions, allows a virus or other malicious code to avoid detection or cause a denial of service (application crash) using a filename containing an MS-DOS device name.
+
+### POC
+
+#### Reference
+- http://www.seifried.org/security/advisories/kssa-010.html
+
+#### Github
+No PoCs found on GitHub currently.
+
@@ -11,7 +11,7 @@ Eine problematische Schwachstelle wurde in Nway Pro 9 ausgemacht. Es geht hierbe
 ### POC

 #### Reference
-No PoCs from references.
+- https://vuldb.com/?id.255266

 #### Github
 - https://github.com/cnetsec/south-america-cve-hall
@@ -11,7 +11,7 @@ Es wurde eine kritische Schwachstelle in Campcodes House Rental Management Syste
 ### POC

 #### Reference
-No PoCs from references.
+- https://vuldb.com/?id.260484

 #### Github
 - https://github.com/fkie-cad/nvd-json-data-feeds
@@ -12,6 +12,7 @@ Es wurde eine kritische Schwachstelle in Ruijie RG-UAC bis 20240428 entdeckt. Hi

 #### Reference
 - https://vuldb.com/?ctiid.263106
+- https://vuldb.com/?id.263106

 #### Github
 - https://github.com/h0e4a0r1t/h0e4a0r1t
@@ -12,6 +12,7 @@ In ItsourceCode Learning Management System Project In PHP 1.0 wurde eine Schwach

 #### Reference
 - https://github.com/L1OudFd8cl09/CVE/issues/2
+- https://vuldb.com/?id.266590

 #### Github
 No PoCs found on GitHub currently.
@@ -0,0 +1,18 @@
+### [CVE-2024-7640](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-7640)
+![](https://img.shields.io/static/v1?label=Product&message=Kortex%20Lite%20Advocate%20Office%20Management%20System&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=1.0%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-89%20SQL%20Injection&color=brightgreen)
+
+### Description
+
+A vulnerability, which was classified as critical, has been found in SourceCodester Kortex Lite Advocate Office Management System 1.0. This issue affects some unknown processing of the file delete_register.php. The manipulation of the argument case_register_id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
+Eine Schwachstelle wurde in SourceCodester Kortex Lite Advocate Office Management System 1.0 entdeckt. Sie wurde als kritisch eingestuft. Es geht hierbei um eine nicht näher spezifizierte Funktion der Datei delete_register.php. Durch das Manipulieren des Arguments case_register_id mit unbekannten Daten kann eine sql injection-Schwachstelle ausgenutzt werden. Der Angriff kann über das Netzwerk angegangen werden. Der Exploit steht zur öffentlichen Verfügung.
+
+### POC
+
+#### Reference
+- https://vuldb.com/?id.274061
+
+#### Github
+No PoCs found on GitHub currently.
+
@@ -32,6 +32,7 @@ In D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DN

 #### Reference
 - https://github.com/BuaaIOTTeam/Iot_Dlink_NAS/blob/main/DNS_cgi_set_cover.md
+- https://vuldb.com/?ctiid.274726

 #### Github
 - https://github.com/fkie-cad/nvd-json-data-feeds
@@ -13,6 +13,7 @@ Eine Schwachstelle wurde in D-Link DIR-823X 250416 gefunden. Es ist betroffen ei

 #### Reference
 - https://github.com/n1ptune/dink/blob/main/delete_offline_device.md
+- https://vuldb.com/?submit.661911

 #### Github
 No PoCs found on GitHub currently.
@@ -0,0 +1,19 @@
+### [CVE-2025-2624](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-2624)
+![](https://img.shields.io/static/v1?label=Product&message=CicadasCMS&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=1.0%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=Injection&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=SQL%20Injection&color=brightgreen)
+
+### Description
+
+A vulnerability was found in westboy CicadasCMS 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /system/cms/content/save. The manipulation of the argument content/fujian/laiyuan leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
+Eine kritische Schwachstelle wurde in westboy CicadasCMS 1.0 ausgemacht. Es geht hierbei um eine nicht näher spezifizierte Funktion der Datei /system/cms/content/save. Durch das Manipulieren des Arguments content/fujian/laiyuan mit unbekannten Daten kann eine sql injection-Schwachstelle ausgenutzt werden. Der Angriff kann über das Netzwerk angegangen werden. Der Exploit steht zur öffentlichen Verfügung.
+
+### POC
+
+#### Reference
+- https://vuldb.com/?id.300626
+
+#### Github
+No PoCs found on GitHub currently.
+
@@ -10,7 +10,7 @@ A spoofing issue in WhatsApp for Windows prior to version 2.2450.6 displayed att
 ### POC

 #### Reference
-No PoCs from references.
+- https://www.whatsapp.com/security/advisories/2025/

 #### Github
 - https://github.com/PuddinCat/GithubRepoSpider
@@ -0,0 +1,18 @@
+### [CVE-2025-54920](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-54920)
+![](https://img.shields.io/static/v1?label=Product&message=Apache%20Spark&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Version&message=4.0.0%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-502%20Deserialization%20of%20Untrusted%20Data&color=brightgreen)
+
+### Description
+
+This issue affects Apache Spark: before 3.5.7 and 4.0.1. Users are recommended to upgrade to version 3.5.7 or 4.0.1 and above, which fixes the issue.SummaryApache Spark 3.5.4 and earlier versions contain a code execution vulnerability in the Spark History Web UI due to overly permissive Jackson deserialization of event log data. This allows an attacker with access to the Spark event logs directory to inject malicious JSON payloads that trigger deserialization of arbitrary classes, enabling command execution on the host running the Spark History Server.DetailsThe vulnerability arises because the Spark History Server uses Jackson polymorphic deserialization with @JsonTypeInfo.Id.CLASS on SparkListenerEvent objects, allowing an attacker to specify arbitrary class names in the event JSON. This behavior permits instantiating unintended classes, such as org.apache.hive.jdbc.HiveConnection, which can perform network calls or other malicious actions during deserialization.The attacker can exploit this by injecting crafted JSON content into the Spark event log files, which the History Server then deserializes on startup or when loading event logs. For example, the attacker can force the History Server to open a JDBC connection to a remote attacker-controlled server, demonstrating remote command injection capability.Proof of Concept:1. Run Spark with event logging enabled, writing to a writable directory (spark-logs).2. Inject the following JSON at the beginning of an event log file:{  "Event": "org.apache.hive.jdbc.HiveConnection",  "uri": "jdbc:hive2://<IP>:<PORT>/",  "info": {    "hive.metastore.uris": "thrift://<IP>:<PORT>"  }}3. Start the Spark History Server with logs pointing to the modified directory.4. The Spark History Server initiates a JDBC connection to the attacker’s server, confirming the injection.ImpactAn attacker with write access to Spark event logs can execute arbitrary code on the server running the History Server, potentially compromising the entire system.
+
+### POC
+
+#### Reference
+- http://www.openwall.com/lists/oss-security/2026/03/13/4
+
+#### Github
+No PoCs found on GitHub currently.
+
@@ -12,7 +12,7 @@ Incomplete authorization of linked device synchronization messages in WhatsApp f
 ### POC

 #### Reference
-No PoCs from references.
+- https://www.whatsapp.com/security/advisories/2025/

 #### Github
 - https://github.com/ARPSyndicate/cve-scores
@@ -0,0 +1,20 @@
+### [CVE-2025-55179](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-55179)
+![](https://img.shields.io/static/v1?label=Product&message=WhatsApp%20Business%20for%20iOS&color=blue)
+![](https://img.shields.io/static/v1?label=Product&message=WhatsApp%20Desktop%20for%20Mac&color=blue)
+![](https://img.shields.io/static/v1?label=Product&message=WhatsApp%20for%20iOS&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=2.25.8.14%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Version&message=2.25.8.17%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=Incorrect%20Authorization%20(CWE-863)&color=brightgreen)
+
+### Description
+
+Incomplete validation of rich response messages in WhatsApp for iOS prior to v2.25.23.73, WhatsApp Business for iOS v2.25.23.82, and WhatsApp for Mac v2.25.23.83 could have allowed a user to trigger processing of media content from an arbitrary URL on another user’s device. We have not seen evidence of exploitation in the wild.
+
+### POC
+
+#### Reference
+- https://www.whatsapp.com/security/advisories/2025/
+
+#### Github
+No PoCs found on GitHub currently.
+
@@ -0,0 +1,17 @@
+### [CVE-2025-65128](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-65128)
+![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen)
+
+### Description
+
+A missing authentication mechanism in the web management API components of Shenzhen Zhibotong Electronics ZBT WE2001 23.09.27 allows unauthenticated attackers on the local network to modify router and network configurations. By invoking operations whose names end with "*_nocommit" and supplying the parameters expected by the invoked function, an attacker can change configuration data, including SSID, Wi-Fi credentials, and administrative passwords, without authentication or an existing session.
+
+### POC
+
+#### Reference
+- https://neutsec.io/advisories/cve-2025-65128/
+
+#### Github
+No PoCs found on GitHub currently.
+
@@ -13,6 +13,7 @@ In code-projects Simple Online Hotel Reservation System 1.0 wurde eine Schwachst

 #### Reference
 - https://github.com/yangfan-lang/cve/issues/3
+- https://vuldb.com/?id.313774

 #### Github
 No PoCs found on GitHub currently.
@@ -0,0 +1,18 @@
+### [CVE-2026-2877](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2877)
+![](https://img.shields.io/static/v1?label=Product&message=A18&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=15.13.07.13%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=Memory%20Corruption&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=Stack-based%20Buffer%20Overflow&color=brightgreen)
+
+### Description
+
+A vulnerability has been found in Tenda A18 15.13.07.13. This affects the function strcpy of the file /goform/WifiExtraSet of the component Httpd Service. The manipulation of the argument wpapsk_crypto5g leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
+
+### POC
+
+#### Reference
+- https://vuldb.com/?id.347130
+
+#### Github
+No PoCs found on GitHub currently.
+
@@ -0,0 +1,19 @@
+### [CVE-2026-4171](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4171)
+![](https://img.shields.io/static/v1?label=Product&message=serverless-express&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=4.17.0%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Version&message=4.17.1%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=Authorization%20Bypass&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=Improper%20Authorization&color=brightgreen)
+
+### Description
+
+A security vulnerability has been detected in CodeGenieApp serverless-express up to 4.17.1. Affected by this issue is some unknown functionality of the file examples/lambda-function-url/packages/api/models/TodoList.ts of the component API Endpoint. The manipulation of the argument userId leads to authorization bypass. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
+
+### POC
+
+#### Reference
+- https://vuldb.com/?id.351078
+
+#### Github
+No PoCs found on GitHub currently.
+
@@ -1129,6 +1129,7 @@ CVE-2004-0902 - http://bugzilla.mozilla.org/show_bug.cgi?id=256316
 CVE-2004-0908 - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9745
 CVE-2004-0914 - http://www.linuxsecurity.com/content/view/106877/102/
 CVE-2004-0914 - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9943
+CVE-2004-0920 - http://www.seifried.org/security/advisories/kssa-010.html
 CVE-2004-0941 - http://www.mandriva.com/security/advisories?name=MDKSA-2006:122
 CVE-2004-0949 - http://marc.info/?l=bugtraq&m=110072140811965&w=2
 CVE-2004-0949 - http://security.e-matters.de/advisories/142004.html
@@ -115999,6 +116000,7 @@ CVE-2024-20052 - https://corp.mediatek.com/product-security-bulletin/April-2024
 CVE-2024-20053 - https://corp.mediatek.com/product-security-bulletin/April-2024
 CVE-2024-20054 - https://corp.mediatek.com/product-security-bulletin/April-2024
 CVE-2024-20055 - https://corp.mediatek.com/product-security-bulletin/April-2024
+CVE-2024-2009 - https://vuldb.com/?id.255266
 CVE-2024-2014 - https://github.com/mashroompc0527/CVE/blob/main/vul.md
 CVE-2024-2018 - https://melapress.com/support/kb/wp-activity-log-plugin-changelog/
 CVE-2024-2021 - https://github.com/dtxharry/cve/blob/main/cve.md
@@ -119710,6 +119712,7 @@ CVE-2024-3691 - https://github.com/nikhil-aniill/Small-CRM-CVE
 CVE-2024-3691 - https://vuldb.com/?submit.312975
 CVE-2024-3692 - https://wpscan.com/vulnerability/6f100f85-3a76-44be-8092-06eb8595b0c9/
 CVE-2024-3695 - https://vuldb.com/?id.260482
+CVE-2024-3697 - https://vuldb.com/?id.260484
 CVE-2024-36978 - https://git.kernel.org/stable/c/52b1aa07cda6a199cd6754d3798c7759023bc70f
 CVE-2024-36983 - https://research.splunk.com/application/1cf58ae1-9177-40b8-a26c-8966040f11ae/
 CVE-2024-36984 - https://research.splunk.com/application/1cf58ae1-9177-40b8-a26c-8966040f11ae/
@@ -121200,6 +121203,7 @@ CVE-2024-4496 - https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/i/
 CVE-2024-4497 - https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/i/i21/formexeCommand.md
 CVE-2024-4501 - https://vuldb.com/?id.263105
 CVE-2024-4502 - https://vuldb.com/?ctiid.263106
+CVE-2024-4502 - https://vuldb.com/?id.263106
 CVE-2024-45038 - https://github.com/meshtastic/firmware/security/advisories/GHSA-3x3r-vw9f-pxq5
 CVE-2024-45039 - https://github.com/Consensys/gnark/security/advisories/GHSA-q3hw-3gm4-w5cr
 CVE-2024-45040 - https://github.com/Consensys/gnark/security/advisories/GHSA-9xcg-3q8v-7fq6
@@ -122786,6 +122790,7 @@ CVE-2024-55160 - https://github.com/SuperDu1/CVE/issues/2
 CVE-2024-5517 - https://github.com/ppp-src/ha/issues/4
 CVE-2024-5518 - https://github.com/L1OudFd8cl09/CVE/issues/1
 CVE-2024-5519 - https://github.com/L1OudFd8cl09/CVE/issues/2
+CVE-2024-5519 - https://vuldb.com/?id.266590
 CVE-2024-55192 - https://github.com/AcademySoftwareFoundation/OpenImageIO/issues/4550
 CVE-2024-55193 - https://github.com/AcademySoftwareFoundation/OpenImageIO/issues/4551
 CVE-2024-55194 - https://github.com/AcademySoftwareFoundation/OpenImageIO/issues/4552
@@ -124056,6 +124061,7 @@ CVE-2024-7635 - https://github.com/space-security/cve/issues/2
 CVE-2024-7636 - https://github.com/space-security/cve/issues/1
 CVE-2024-7637 - https://github.com/space-security/cve/issues/3
 CVE-2024-7639 - https://vuldb.com/?id.274060
+CVE-2024-7640 - https://vuldb.com/?id.274061
 CVE-2024-7641 - https://vuldb.com/?id.274062
 CVE-2024-7643 - https://github.com/joinia/webray.com.cn/blob/main/Leads-Manager-Tool/leadmanagersql.md
 CVE-2024-7644 - https://github.com/joinia/webray.com.cn/blob/main/Leads-Manager-Tool/leadmanagerxss.md
@@ -124150,6 +124156,7 @@ CVE-2024-7818 - https://wpscan.com/vulnerability/3d2263b9-e1e7-4e86-8475-5e468ee
 CVE-2024-7820 - https://wpscan.com/vulnerability/31b2c97b-2458-43ee-93db-e57968ac8455/
 CVE-2024-7822 - https://wpscan.com/vulnerability/3a5bdd7e-7dd5-4749-9fad-ff4d7df20273/
 CVE-2024-7828 - https://github.com/BuaaIOTTeam/Iot_Dlink_NAS/blob/main/DNS_cgi_set_cover.md
+CVE-2024-7828 - https://vuldb.com/?ctiid.274726
 CVE-2024-7829 - https://github.com/BuaaIOTTeam/Iot_Dlink_NAS/blob/main/DNS_cgi_del_photo.md
 CVE-2024-7830 - https://github.com/BuaaIOTTeam/Iot_Dlink_NAS/blob/main/DNS_cgi_move_photo.md
 CVE-2024-7831 - https://github.com/BuaaIOTTeam/Iot_Dlink_NAS/blob/main/DNS_cgi_get_cooliris.md
@@ -125797,6 +125804,7 @@ CVE-2025-11090 - https://github.com/friendddy/cve/issues/1
 CVE-2025-11091 - https://github.com/maximdevere/CVE2/issues/2
 CVE-2025-11092 - https://github.com/maximdevere/CVE2/issues/4
 CVE-2025-11095 - https://github.com/n1ptune/dink/blob/main/delete_offline_device.md
+CVE-2025-11095 - https://vuldb.com/?submit.661911
 CVE-2025-11096 - https://github.com/n1ptune/dink/blob/main/diag_traceroute.md
 CVE-2025-11097 - https://github.com/n1ptune/dink/blob/main/set_device_name.md
 CVE-2025-11098 - https://github.com/n1ptune/dink/blob/main/set_wifi_blacklists.md
@@ -128706,6 +128714,7 @@ CVE-2025-26206 - https://github.com/xibhi/CVE-2025-26206
 CVE-2025-26210 - https://hackmd.io/@MrqrFIlhQFi7vUwkqbrXDw/deepseek
 CVE-2025-2622 - https://gitee.com/aizuda/snail-job/issues/IBSQ24
 CVE-2025-2622 - https://gitee.com/aizuda/snail-job/issues/IBSQ24#note_38500450_link
+CVE-2025-2624 - https://vuldb.com/?id.300626
 CVE-2025-26241 - https://members.backbox.org/osticket-sql-injection-bypass/
 CVE-2025-26258 - https://github.com/oye-ujjwal/CVEs/blob/main/Employee%20Management%20System%20App/CVE-2025-26258
 CVE-2025-26258 - https://www.sourcecodester.com/php/17847/employee-management-system-using-php-and-mysql-source-code.html
@@ -129483,6 +129492,7 @@ CVE-2025-3039 - https://github.com/xuzhuojia22/cve/blob/main/cvexuzhoujia.md
 CVE-2025-30397 - https://www.vicarius.io/vsociety/posts/cve-2025-30397-type-confusion-vulnerability-in-microsoft-scripting-engine-detection-script
 CVE-2025-30397 - https://www.vicarius.io/vsociety/posts/cve-2025-30397-type-confusion-vulnerability-in-microsoft-scripting-engine-mitigation-script
 CVE-2025-3040 - https://github.com/ydnd/cve/issues/11
+CVE-2025-30401 - https://www.whatsapp.com/security/advisories/2025/
 CVE-2025-30406 - https://gladinetsupport.s3.us-east-1.amazonaws.com/gladinet/securityadvisory-cve-2005.pdf
 CVE-2025-3041 - https://github.com/ydnd/cve/issues/12
 CVE-2025-3042 - https://github.com/ydnd/cve/issues/13
@@ -132414,6 +132424,7 @@ CVE-2025-54881 - https://github.com/mermaid-js/mermaid/security/advisories/GHSA-
 CVE-2025-54882 - https://github.com/himmelblau-idm/himmelblau/security/advisories/GHSA-phfx-rjfw-wj83
 CVE-2025-54886 - https://github.com/skops-dev/skops/security/advisories/GHSA-378x-6p4f-8jgm
 CVE-2025-54888 - https://github.com/fedify-dev/fedify/security/advisories/GHSA-6jcc-xgcr-q3h4
+CVE-2025-54920 - http://www.openwall.com/lists/oss-security/2026/03/13/4
 CVE-2025-5493 - https://medium.com/@luoluoxi311/sql-injection-in-baison-channel-middleware-product-version-2-0-1-e0d1ec95c697
 CVE-2025-5495 - https://github.com/Shuanunio/CVE_Requests/blob/main/Netgear/WNR614/ACL%20bypass%20Vulnerability%20in%20Netgear%20WNR614.md
 CVE-2025-54955 - https://github.com/Stolichnayer/OpenNebula-Account-Takeover
@@ -132456,6 +132467,8 @@ CVE-2025-55168 - https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GH
 CVE-2025-55169 - https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-mm3p-7573-4x4j
 CVE-2025-55170 - https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-77hc-c8f4-p3hc
 CVE-2025-55171 - https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-8rm5-3jvx-hcxv
+CVE-2025-55177 - https://www.whatsapp.com/security/advisories/2025/
+CVE-2025-55179 - https://www.whatsapp.com/security/advisories/2025/
 CVE-2025-55182 - https://aws.amazon.com/blogs/security/china-nexus-cyber-threat-groups-rapidly-exploit-react2shell-vulnerability-cve-2025-55182/
 CVE-2025-55182 - https://github.com/ejpir/CVE-2025-55182-poc
 CVE-2025-55182 - https://news.ycombinator.com/item?id=46136026
@@ -134237,6 +134250,7 @@ CVE-2025-65113 - https://github.com/MacWarrior/clipbucket-v5/security/advisories
 CVE-2025-65117 - https://www.aveva.com/en/support-and-success/cyber-security-updates/
 CVE-2025-65118 - https://www.aveva.com/en/support-and-success/cyber-security-updates/
 CVE-2025-65127 - https://neutsec.io/advisories/cve-2025-65127
+CVE-2025-65128 - https://neutsec.io/advisories/cve-2025-65128/
 CVE-2025-6514 - https://research.jfrog.com/vulnerabilities/mcp-remote-command-injection-rce-jfsa-2025-001290844/
 CVE-2025-6515 - https://research.jfrog.com/vulnerabilities/oatpp-mcp-prompt-hijacking-jfsa-2025-001494691/
 CVE-2025-6516 - https://github.com/HDFGroup/hdf5/issues/5581
@@ -134330,6 +134344,7 @@ CVE-2025-65742 - https://github.com/CBx216/CVE-2025-65742-Newgen-OmniDocs-LDAP-B
 CVE-2025-65754 - https://gist.github.com/Bnyt7/0faa90ff93c5d98093a0e29a1eb34d81
 CVE-2025-65754 - https://github.com/Bnyt7/CVE-2025-65754
 CVE-2025-6578 - https://github.com/yangfan-lang/cve/issues/3
+CVE-2025-6578 - https://vuldb.com/?id.313774
 CVE-2025-6579 - https://github.com/yangfan-lang/cve/issues/4
 CVE-2025-65790 - https://github.com/hunterxxx/FuguHub-8.1-Reflected-SVG-XSS-CVE-2025-65790
 CVE-2025-65792 - https://gist.github.com/X3J1n/82b047efdbfd74c414a6d63339ad12fb
@@ -136974,6 +136989,7 @@ CVE-2026-28517 - https://chocapikk.com/posts/2026/opendcim-sqli-to-rce/
 CVE-2026-2852 - https://github.com/yeqifu/warehouse/issues/63
 CVE-2026-2852 - https://github.com/yeqifu/warehouse/issues/63#issue-3846671301
 CVE-2026-2856 - https://github.com/LX-66-LX/cve-new/issues/13
+CVE-2026-2877 - https://vuldb.com/?id.347130
 CVE-2026-28802 - https://github.com/authlib/authlib/security/advisories/GHSA-7wc2-qxgw-g8gg
 CVE-2026-2889 - https://vuldb.com/?id.347182
 CVE-2026-29000 - https://www.codeant.ai/security-research/pac4j-jwt-authentication-bypass-public-key
@@ -137069,3 +137085,4 @@ CVE-2026-3767 - https://github.com/ltranquility/cve_submit/issues/9
 CVE-2026-3884 - https://security.snyk.io/vuln/SNYK-JS-SPINJS-15445079
 CVE-2026-3983 - https://github.com/LaneyYu/cve/issues/10
 CVE-2026-3989 - https://orca.security/resources/blog/sglang-llm-framework-rce-vulnerabilities/
+CVE-2026-4171 - https://vuldb.com/?id.351078