From 36c0a522c35d1a56456f74cb5e1c2fab95e7ca63 Mon Sep 17 00:00:00 2001 From: trickest-workflows Date: Wed, 19 Aug 2026 12:25:36 +0000 Subject: [PATCH] Update Wed Aug 19 12:25:35 UTC 2026 --- 2003/CVE-2003-0476.md | 1 + 2003/CVE-2003-0961.md | 1 + 2004/CVE-2004-0006.md | 1 + 2004/CVE-2004-0007.md | 1 + 2004/CVE-2004-0008.md | 1 + 2004/CVE-2004-0276.md | 1 + 2005/CVE-2005-0862.md | 17 ++ 2006/CVE-2006-1664.md | 2 + 2006/CVE-2006-1917.md | 1 + 2006/CVE-2006-2853.md | 17 ++ 2006/CVE-2006-2854.md | 17 ++ 2006/CVE-2006-3381.md | 17 ++ 2006/CVE-2006-3879.md | 1 + 2006/CVE-2006-4005.md | 1 + 2006/CVE-2006-4006.md | 1 + 2006/CVE-2006-4584.md | 1 + 2006/CVE-2006-4585.md | 1 + 2006/CVE-2006-4586.md | 1 + 2006/CVE-2006-4601.md | 1 + 2006/CVE-2006-5085.md | 1 + 2006/CVE-2006-5259.md | 1 + 2006/CVE-2006-5296.md | 1 + 2006/CVE-2006-5314.md | 1 + 2006/CVE-2006-5315.md | 1 + 2006/CVE-2006-5317.md | 1 + 2006/CVE-2006-5318.md | 1 + 2006/CVE-2006-5320.md | 1 + 2006/CVE-2006-5550.md | 1 + 2006/CVE-2006-5559.md | 1 + 2006/CVE-2006-6134.md | 1 + 2006/CVE-2006-6253.md | 1 + 2006/CVE-2006-6254.md | 1 + 2006/CVE-2006-6754.md | 1 + 2007/CVE-2007-0122.md | 1 + 2007/CVE-2007-0202.md | 1 + 2007/CVE-2007-0205.md | 1 + 2007/CVE-2007-4358.md | 1 + 2007/CVE-2007-4444.md | 1 + 2007/CVE-2007-4445.md | 1 + 2007/CVE-2007-4446.md | 1 + 2007/CVE-2007-4447.md | 1 + 2007/CVE-2007-4448.md | 1 + 2007/CVE-2007-4449.md | 1 + 2007/CVE-2007-4450.md | 1 + 2007/CVE-2007-4451.md | 1 + 2007/CVE-2007-4452.md | 1 + 2007/CVE-2007-4832.md | 1 + 2007/CVE-2007-4838.md | 1 + 2007/CVE-2007-4879.md | 1 + 2007/CVE-2007-5036.md | 1 + 2007/CVE-2007-5184.md | 1 + 2007/CVE-2007-6041.md | 1 + 2007/CVE-2007-6537.md | 1 + 2007/CVE-2007-6631.md | 1 + 2008/CVE-2008-0132.md | 1 + 2008/CVE-2008-0944.md | 1 + 2008/CVE-2008-0945.md | 1 + 2008/CVE-2008-0946.md | 1 + 2008/CVE-2008-0973.md | 1 + 2008/CVE-2008-0974.md | 1 + 2008/CVE-2008-0975.md | 1 + 2008/CVE-2008-0976.md | 1 + 2008/CVE-2008-0977.md | 1 + 2008/CVE-2008-0978.md | 1 + 2008/CVE-2008-0979.md | 1 + 2008/CVE-2008-1233.md | 1 + 2008/CVE-2008-1234.md | 1 + 2008/CVE-2008-1235.md | 1 + 2008/CVE-2008-1236.md | 1 + 2008/CVE-2008-1237.md | 1 + 2008/CVE-2008-1238.md | 1 + 2008/CVE-2008-1240.md | 1 + 2008/CVE-2008-1241.md | 1 + 2008/CVE-2008-1302.md | 1 + 2008/CVE-2008-1303.md | 1 + 2008/CVE-2008-1338.md | 1 + 2008/CVE-2008-1689.md | 1 + 2008/CVE-2008-1690.md | 1 + 2008/CVE-2008-1691.md | 1 + 2008/CVE-2008-1705.md | 1 + 2008/CVE-2008-1706.md | 1 + 2008/CVE-2008-1707.md | 1 + 2008/CVE-2008-1708.md | 1 + 2008/CVE-2008-3396.md | 1 + 2008/CVE-2008-5158.md | 1 + 2008/CVE-2008-5159.md | 1 + 2008/CVE-2008-5176.md | 1 + 2008/CVE-2008-5279.md | 1 + 2008/CVE-2008-5280.md | 1 + 2008/CVE-2008-6670.md | 1 + 2008/CVE-2008-6671.md | 1 + 2008/CVE-2008-6672.md | 1 + 2008/CVE-2008-6995.md | 1 + 2010/CVE-2010-1277.md | 1 + 2010/CVE-2010-2621.md | 1 + 2011/CVE-2011-4858.md | 1 + 2011/CVE-2011-4885.md | 1 + 2012/CVE-2012-4929.md | 1 + 2013/CVE-2013-0183.md | 17 ++ 2013/CVE-2013-3245.md | 1 + 2013/CVE-2013-3505.md | 1 + 2013/CVE-2013-3632.md | 1 + 2013/CVE-2013-5015.md | 1 + 2014/CVE-2014-1644.md | 17 ++ 2014/CVE-2014-1645.md | 17 ++ 2014/CVE-2014-1836.md | 1 + 2014/CVE-2014-2734.md | 1 + 2014/CVE-2014-3704.md | 1 + 2014/CVE-2014-4873.md | 1 + 2014/CVE-2014-5377.md | 1 + 2014/CVE-2014-5445.md | 1 + 2014/CVE-2014-5446.md | 1 + 2014/CVE-2014-7862.md | 1 + 2014/CVE-2014-7868.md | 1 + 2014/CVE-2014-8146.md | 1 + 2014/CVE-2014-8147.md | 1 + 2014/CVE-2014-8499.md | 1 + 2014/CVE-2014-9515.md | 1 + 2015/CVE-2015-0072.md | 1 + 2015/CVE-2015-4460.md | 1 + 2015/CVE-2015-4640.md | 1 + 2015/CVE-2015-4641.md | 1 + 2015/CVE-2015-8370.md | 1 + 2016/CVE-2016-0450.md | 1 + 2016/CVE-2016-0451.md | 1 + 2016/CVE-2016-10174.md | 1 + 2016/CVE-2016-10175.md | 1 + 2016/CVE-2016-10176.md | 1 + 2016/CVE-2016-4075.md | 1 + 2016/CVE-2016-5195.md | 1 + 2016/CVE-2016-5346.md | 1 + 2016/CVE-2016-6600.md | 1 + 2016/CVE-2016-6601.md | 1 + 2016/CVE-2016-6602.md | 1 + 2016/CVE-2016-6603.md | 1 + 2016/CVE-2016-9445.md | 1 + 2016/CVE-2016-9446.md | 1 + 2017/CVE-2017-2090.md | 17 ++ 2017/CVE-2017-2091.md | 17 ++ 2017/CVE-2017-2092.md | 17 ++ 2017/CVE-2017-2093.md | 17 ++ 2017/CVE-2017-2094.md | 17 ++ 2017/CVE-2017-2095.md | 17 ++ 2017/CVE-2017-2699.md | 17 ++ 2017/CVE-2017-5359.md | 1 + 2017/CVE-2017-5594.md | 1 + 2017/CVE-2017-5638.md | 1 + 2017/CVE-2017-5715.md | 1 + 2017/CVE-2017-5753.md | 1 + 2017/CVE-2017-5865.md | 17 ++ 2017/CVE-2017-5866.md | 17 ++ 2017/CVE-2017-6076.md | 1 + 2017/CVE-2017-6196.md | 1 + 2017/CVE-2017-6214.md | 8 +- 2017/CVE-2017-6298.md | 1 + 2017/CVE-2017-6299.md | 1 + 2017/CVE-2017-6300.md | 1 + 2017/CVE-2017-6301.md | 1 + 2017/CVE-2017-6302.md | 1 + 2017/CVE-2017-6303.md | 1 + 2017/CVE-2017-6304.md | 1 + 2017/CVE-2017-6305.md | 1 + 2017/CVE-2017-6306.md | 1 + 2017/CVE-2017-6307.md | 1 + 2017/CVE-2017-6308.md | 1 + 2017/CVE-2017-6309.md | 1 + 2017/CVE-2017-6310.md | 1 + 2017/CVE-2017-7240.md | 1 + 2017/CVE-2017-7625.md | 1 + 2017/CVE-2017-7994.md | 1 + 2017/CVE-2017-9239.md | 1 + 2018/CVE-2018-1002105.md | 1 + 2018/CVE-2018-4087.md | 1 + 2018/CVE-2018-4095.md | 1 + 2018/CVE-2018-5279.md | 1 + 2018/CVE-2018-8727.md | 2 +- 2019/CVE-2019-11687.md | 1 + 2019/CVE-2019-12279.md | 1 + 2019/CVE-2019-25714.md | 1 + 2019/CVE-2019-5736.md | 1 + 2019/CVE-2019-6555.md | 1 + 2021/CVE-2021-45572.md | 17 ++ 2021/CVE-2021-45912.md | 17 ++ 2021/CVE-2021-45913.md | 17 ++ 2024/CVE-2024-10234.md | 2 +- 2024/CVE-2024-21245.md | 17 ++ 2024/CVE-2024-34035.md | 17 ++ 2024/CVE-2024-44004.md | 4 +- 2025/CVE-2025-21489.md | 17 ++ 2025/CVE-2025-21490.md | 2 +- 2025/CVE-2025-21491.md | 2 +- 2025/CVE-2025-21492.md | 18 ++ 2025/CVE-2025-21493.md | 17 ++ 2025/CVE-2025-21494.md | 2 +- 2025/CVE-2025-21495.md | 17 ++ 2025/CVE-2025-21497.md | 2 +- 2025/CVE-2025-21498.md | 17 ++ 2025/CVE-2025-21499.md | 17 ++ 2025/CVE-2025-21500.md | 2 +- 2025/CVE-2025-21501.md | 2 +- 2025/CVE-2025-21502.md | 2 +- 2025/CVE-2025-21503.md | 2 +- 2025/CVE-2025-21504.md | 2 +- 2025/CVE-2025-21505.md | 2 +- 2025/CVE-2025-21506.md | 17 ++ 2025/CVE-2025-21507.md | 17 ++ 2025/CVE-2025-21508.md | 17 ++ 2025/CVE-2025-21509.md | 17 ++ 2025/CVE-2025-21510.md | 17 ++ 2025/CVE-2025-21511.md | 17 ++ 2025/CVE-2025-21512.md | 17 ++ 2025/CVE-2025-21513.md | 17 ++ 2025/CVE-2025-21514.md | 17 ++ 2025/CVE-2025-21515.md | 17 ++ 2025/CVE-2025-21516.md | 17 ++ 2025/CVE-2025-21517.md | 17 ++ 2025/CVE-2025-21518.md | 2 +- 2025/CVE-2025-21519.md | 2 +- 2025/CVE-2025-21520.md | 18 ++ 2025/CVE-2025-21521.md | 2 +- 2025/CVE-2025-21522.md | 2 +- 2025/CVE-2025-21523.md | 2 +- 2025/CVE-2025-21524.md | 17 ++ 2025/CVE-2025-21525.md | 2 +- 2025/CVE-2025-21526.md | 2 +- 2025/CVE-2025-21527.md | 17 ++ 2025/CVE-2025-21528.md | 20 ++ 2025/CVE-2025-21529.md | 2 +- 2025/CVE-2025-21530.md | 18 ++ 2025/CVE-2025-21531.md | 18 ++ 2025/CVE-2025-21532.md | 17 ++ 2025/CVE-2025-21533.md | 17 ++ 2025/CVE-2025-21534.md | 2 +- 2025/CVE-2025-21535.md | 18 ++ 2025/CVE-2025-21536.md | 2 +- 2025/CVE-2025-21537.md | 17 ++ 2025/CVE-2025-21538.md | 17 ++ 2025/CVE-2025-21539.md | 17 ++ 2025/CVE-2025-21540.md | 2 +- 2025/CVE-2025-21541.md | 17 ++ 2025/CVE-2025-21542.md | 19 ++ 2025/CVE-2025-21543.md | 18 ++ 2025/CVE-2025-21544.md | 19 ++ 2025/CVE-2025-21545.md | 18 ++ 2025/CVE-2025-21546.md | 2 +- 2025/CVE-2025-21547.md | 20 ++ 2025/CVE-2025-21548.md | 2 +- 2025/CVE-2025-21549.md | 17 ++ 2025/CVE-2025-21550.md | 19 ++ 2025/CVE-2025-21551.md | 17 ++ 2025/CVE-2025-21552.md | 17 ++ 2025/CVE-2025-21553.md | 19 ++ 2025/CVE-2025-21554.md | 19 ++ 2025/CVE-2025-21555.md | 2 +- 2025/CVE-2025-21556.md | 17 ++ 2025/CVE-2025-21557.md | 18 ++ 2025/CVE-2025-21558.md | 19 ++ 2025/CVE-2025-21559.md | 2 +- 2025/CVE-2025-21560.md | 17 ++ 2025/CVE-2025-21561.md | 17 ++ 2025/CVE-2025-21562.md | 17 ++ 2025/CVE-2025-21563.md | 17 ++ 2025/CVE-2025-21564.md | 17 ++ 2025/CVE-2025-21565.md | 17 ++ 2025/CVE-2025-21566.md | 17 ++ 2025/CVE-2025-21567.md | 17 ++ 2025/CVE-2025-21568.md | 17 ++ 2025/CVE-2025-21569.md | 17 ++ 2025/CVE-2025-21570.md | 17 ++ 2025/CVE-2025-21571.md | 17 ++ 2025/CVE-2025-2251.md | 2 +- 2025/CVE-2025-25137.md | 6 +- 2025/CVE-2025-25256.md | 10 +- 2025/CVE-2025-2842.md | 2 +- 2025/CVE-2025-5222.md | 2 +- 2025/CVE-2025-5278.md | 2 +- 2025/CVE-2025-5318.md | 2 +- 2025/CVE-2025-5914.md | 2 +- 2025/CVE-2025-7425.md | 2 +- 2025/CVE-2025-9784.md | 3 +- 2026/CVE-2026-0603.md | 3 +- 2026/CVE-2026-10953.md | 17 ++ 2026/CVE-2026-11430.md | 18 ++ 2026/CVE-2026-11565.md | 17 ++ 2026/CVE-2026-11770.md | 3 + 2026/CVE-2026-11788.md | 3 + 2026/CVE-2026-12983.md | 17 ++ 2026/CVE-2026-13169.md | 17 ++ 2026/CVE-2026-13173.md | 17 ++ 2026/CVE-2026-13174.md | 17 ++ 2026/CVE-2026-13175.md | 17 ++ 2026/CVE-2026-13775.md | 17 ++ 2026/CVE-2026-13815.md | 17 ++ 2026/CVE-2026-13867.md | 17 ++ 2026/CVE-2026-13876.md | 17 ++ 2026/CVE-2026-13920.md | 17 ++ 2026/CVE-2026-14164.md | 2 +- 2026/CVE-2026-14196.md | 17 ++ 2026/CVE-2026-14287.md | 17 ++ 2026/CVE-2026-14334.md | 17 ++ 2026/CVE-2026-14825.md | 17 ++ 2026/CVE-2026-14826.md | 17 ++ 2026/CVE-2026-14861.md | 17 ++ 2026/CVE-2026-15253.md | 17 ++ 2026/CVE-2026-16058.md | 17 ++ 2026/CVE-2026-16570.md | 17 ++ 2026/CVE-2026-16616.md | 17 ++ 2026/CVE-2026-16617.md | 17 ++ 2026/CVE-2026-16950.md | 17 ++ 2026/CVE-2026-16979.md | 17 ++ 2026/CVE-2026-17565.md | 17 ++ 2026/CVE-2026-18031.md | 17 ++ 2026/CVE-2026-18051.md | 17 ++ 2026/CVE-2026-18202.md | 17 ++ 2026/CVE-2026-18231.md | 17 ++ 2026/CVE-2026-18466.md | 17 ++ 2026/CVE-2026-18776.md | 17 ++ 2026/CVE-2026-18777.md | 17 ++ 2026/CVE-2026-18778.md | 17 ++ 2026/CVE-2026-18779.md | 17 ++ 2026/CVE-2026-18937.md | 17 ++ 2026/CVE-2026-19055.md | 17 ++ 2026/CVE-2026-19056.md | 17 ++ 2026/CVE-2026-19406.md | 17 ++ 2026/CVE-2026-19416.md | 17 ++ 2026/CVE-2026-19417.md | 17 ++ 2026/CVE-2026-19709.md | 17 ++ 2026/CVE-2026-19782.md | 17 ++ 2026/CVE-2026-19842.md | 17 ++ 2026/CVE-2026-20000.md | 18 ++ 2026/CVE-2026-20200.md | 54 +++++ 2026/CVE-2026-20288.md | 202 +++++++++++++++++ 2026/CVE-2026-25039.md | 17 ++ 2026/CVE-2026-25807.md | 17 ++ 2026/CVE-2026-25961.md | 18 ++ 2026/CVE-2026-32063.md | 18 ++ 2026/CVE-2026-32101.md | 17 ++ 2026/CVE-2026-32121.md | 17 ++ 2026/CVE-2026-32133.md | 17 ++ 2026/CVE-2026-32146.md | 1 + 2026/CVE-2026-32231.md | 18 ++ 2026/CVE-2026-32267.md | 18 ++ 2026/CVE-2026-32595.md | 19 ++ 2026/CVE-2026-32629.md | 18 ++ 2026/CVE-2026-32634.md | 18 ++ 2026/CVE-2026-32685.md | 1 + 2026/CVE-2026-32695.md | 19 ++ 2026/CVE-2026-32699.md | 17 ++ 2026/CVE-2026-32713.md | 17 ++ 2026/CVE-2026-32714.md | 17 ++ 2026/CVE-2026-32718.md | 17 ++ 2026/CVE-2026-32721.md | 20 ++ 2026/CVE-2026-32733.md | 17 ++ 2026/CVE-2026-32738.md | 18 ++ 2026/CVE-2026-32740.md | 17 ++ 2026/CVE-2026-32747.md | 18 ++ 2026/CVE-2026-32751.md | 17 ++ 2026/CVE-2026-32753.md | 17 ++ 2026/CVE-2026-32754.md | 18 ++ 2026/CVE-2026-32759.md | 17 ++ 2026/CVE-2026-32810.md | 17 ++ 2026/CVE-2026-32813.md | 17 ++ 2026/CVE-2026-32814.md | 18 ++ 2026/CVE-2026-32816.md | 17 ++ 2026/CVE-2026-32854.md | 18 ++ 2026/CVE-2026-32891.md | 19 ++ 2026/CVE-2026-32948.md | 17 ++ 2026/CVE-2026-33824.md | 42 ++++ 2026/CVE-2026-40102.md | 17 ++ 2026/CVE-2026-40150.md | 17 ++ 2026/CVE-2026-40153.md | 17 ++ 2026/CVE-2026-40285.md | 19 ++ 2026/CVE-2026-40570.md | 18 ++ 2026/CVE-2026-40593.md | 18 ++ 2026/CVE-2026-40868.md | 17 ++ 2026/CVE-2026-42338.md | 1 - 2026/CVE-2026-42499.md | 1 - 2026/CVE-2026-43969.md | 2 +- 2026/CVE-2026-47230.md | 18 ++ 2026/CVE-2026-47249.md | 17 ++ 2026/CVE-2026-47662.md | 19 ++ 2026/CVE-2026-47704.md | 17 ++ 2026/CVE-2026-4878.md | 2 +- 2026/CVE-2026-50768.md | 17 ++ 2026/CVE-2026-54025.md | 17 ++ 2026/CVE-2026-54027.md | 17 ++ 2026/CVE-2026-54091.md | 17 ++ 2026/CVE-2026-54092.md | 18 ++ 2026/CVE-2026-54093.md | 17 ++ 2026/CVE-2026-54317.md | 18 ++ 2026/CVE-2026-54332.md | 17 ++ 2026/CVE-2026-54344.md | 17 ++ 2026/CVE-2026-54481.md | 17 ++ 2026/CVE-2026-54555.md | 17 ++ 2026/CVE-2026-54572.md | 19 ++ 2026/CVE-2026-54684.md | 17 ++ 2026/CVE-2026-54696.md | 19 ++ 2026/CVE-2026-54765.md | 18 ++ 2026/CVE-2026-54917.md | 17 ++ 2026/CVE-2026-55165.md | 17 ++ 2026/CVE-2026-55166.md | 19 ++ 2026/CVE-2026-55195.md | 17 ++ 2026/CVE-2026-55206.md | 17 ++ 2026/CVE-2026-55390.md | 19 ++ 2026/CVE-2026-55426.md | 19 ++ 2026/CVE-2026-55450.md | 19 ++ 2026/CVE-2026-55460.md | 17 ++ 2026/CVE-2026-55462.md | 17 ++ 2026/CVE-2026-55470.md | 17 ++ 2026/CVE-2026-55477.md | 17 ++ 2026/CVE-2026-55524.md | 18 ++ 2026/CVE-2026-55548.md | 19 ++ 2026/CVE-2026-55593.md | 17 ++ 2026/CVE-2026-55651.md | 17 ++ 2026/CVE-2026-55833.md | 18 ++ 2026/CVE-2026-55886.md | 17 ++ 2026/CVE-2026-57157.md | 17 ++ 2026/CVE-2026-57158.md | 17 ++ 2026/CVE-2026-57218.md | 17 ++ 2026/CVE-2026-57233.md | 17 ++ 2026/CVE-2026-57439.md | 19 ++ 2026/CVE-2026-57485.md | 18 ++ 2026/CVE-2026-57516.md | 17 ++ 2026/CVE-2026-57573.md | 17 ++ 2026/CVE-2026-57850.md | 1 + 2026/CVE-2026-57859.md | 18 ++ 2026/CVE-2026-57862.md | 17 ++ 2026/CVE-2026-57894.md | 17 ++ 2026/CVE-2026-57942.md | 18 ++ 2026/CVE-2026-57947.md | 17 ++ 2026/CVE-2026-57951.md | 17 ++ 2026/CVE-2026-57958.md | 17 ++ 2026/CVE-2026-57961.md | 18 ++ 2026/CVE-2026-57997.md | 17 ++ 2026/CVE-2026-57999.md | 17 ++ 2026/CVE-2026-58372.md | 1 + 2026/CVE-2026-62184.md | 18 ++ 2026/CVE-2026-62239.md | 18 ++ 2026/CVE-2026-62240.md | 17 ++ 2026/CVE-2026-62241.md | 19 ++ 2026/CVE-2026-62246.md | 18 ++ 2026/CVE-2026-62290.md | 18 ++ 2026/CVE-2026-62291.md | 18 ++ 2026/CVE-2026-62292.md | 17 ++ 2026/CVE-2026-62293.md | 20 ++ 2026/CVE-2026-62295.md | 23 ++ 2026/CVE-2026-62296.md | 23 ++ 2026/CVE-2026-62299.md | 17 ++ 2026/CVE-2026-62323.md | 17 ++ 2026/CVE-2026-62324.md | 18 ++ 2026/CVE-2026-62325.md | 17 ++ 2026/CVE-2026-62350.md | 17 ++ 2026/CVE-2026-62353.md | 18 ++ 2026/CVE-2026-62377.md | 19 ++ 2026/CVE-2026-62378.md | 17 ++ 2026/CVE-2026-62420.md | 19 ++ 2026/CVE-2026-62663.md | 17 ++ 2026/CVE-2026-62684.md | 18 ++ 2026/CVE-2026-62845.md | 17 ++ 2026/CVE-2026-62857.md | 22 ++ 2026/CVE-2026-62948.md | 19 ++ 2026/CVE-2026-62959.md | 19 ++ 2026/CVE-2026-62982.md | 17 ++ 2026/CVE-2026-62988.md | 17 ++ 2026/CVE-2026-62994.md | 18 ++ 2026/CVE-2026-62996.md | 17 ++ 2026/CVE-2026-7246.md | 2 +- 2026/CVE-2026-75130.md | 17 ++ 2026/CVE-2026-75872.md | 17 ++ 2026/CVE-2026-7701.md | 24 ++ 2026/CVE-2026-7999.md | 17 ++ 2026/CVE-2026-8541.md | 17 ++ 2026/CVE-2026-8561.md | 17 ++ 2026/CVE-2026-9126.md | 17 ++ 2026/CVE-2026-9875.md | 17 ++ 2026/CVE-2026-9895.md | 17 ++ 2026/CVE-2026-9916.md | 17 ++ 2026/CVE-2026-9967.md | 17 ++ 2026/CVE-2026-9973.md | 17 ++ 2026/CVE-2026-9974.md | 17 ++ 2026/CVE-2026-9977.md | 17 ++ references.txt | 466 +++++++++++++++++++++++++++++++++++++++ 482 files changed, 5595 insertions(+), 52 deletions(-) create mode 100644 2005/CVE-2005-0862.md create mode 100644 2006/CVE-2006-2853.md create mode 100644 2006/CVE-2006-2854.md create mode 100644 2006/CVE-2006-3381.md create mode 100644 2013/CVE-2013-0183.md create mode 100644 2014/CVE-2014-1644.md create mode 100644 2014/CVE-2014-1645.md create mode 100644 2017/CVE-2017-2090.md create mode 100644 2017/CVE-2017-2091.md create mode 100644 2017/CVE-2017-2092.md create mode 100644 2017/CVE-2017-2093.md create mode 100644 2017/CVE-2017-2094.md create mode 100644 2017/CVE-2017-2095.md create mode 100644 2017/CVE-2017-2699.md create mode 100644 2017/CVE-2017-5865.md create mode 100644 2017/CVE-2017-5866.md create mode 100644 2021/CVE-2021-45572.md create mode 100644 2021/CVE-2021-45912.md create mode 100644 2021/CVE-2021-45913.md create mode 100644 2024/CVE-2024-21245.md create mode 100644 2024/CVE-2024-34035.md create mode 100644 2025/CVE-2025-21489.md create mode 100644 2025/CVE-2025-21492.md create mode 100644 2025/CVE-2025-21493.md create mode 100644 2025/CVE-2025-21495.md create mode 100644 2025/CVE-2025-21498.md create mode 100644 2025/CVE-2025-21499.md create mode 100644 2025/CVE-2025-21506.md create mode 100644 2025/CVE-2025-21507.md create mode 100644 2025/CVE-2025-21508.md create mode 100644 2025/CVE-2025-21509.md create mode 100644 2025/CVE-2025-21510.md create mode 100644 2025/CVE-2025-21511.md create mode 100644 2025/CVE-2025-21512.md create mode 100644 2025/CVE-2025-21513.md create mode 100644 2025/CVE-2025-21514.md create mode 100644 2025/CVE-2025-21515.md create mode 100644 2025/CVE-2025-21516.md create mode 100644 2025/CVE-2025-21517.md create mode 100644 2025/CVE-2025-21520.md create mode 100644 2025/CVE-2025-21524.md create mode 100644 2025/CVE-2025-21527.md create mode 100644 2025/CVE-2025-21528.md create mode 100644 2025/CVE-2025-21530.md create mode 100644 2025/CVE-2025-21531.md create mode 100644 2025/CVE-2025-21532.md create mode 100644 2025/CVE-2025-21533.md create mode 100644 2025/CVE-2025-21535.md create mode 100644 2025/CVE-2025-21537.md create mode 100644 2025/CVE-2025-21538.md create mode 100644 2025/CVE-2025-21539.md create mode 100644 2025/CVE-2025-21541.md create mode 100644 2025/CVE-2025-21542.md create mode 100644 2025/CVE-2025-21543.md create mode 100644 2025/CVE-2025-21544.md create mode 100644 2025/CVE-2025-21545.md create mode 100644 2025/CVE-2025-21547.md create mode 100644 2025/CVE-2025-21549.md create mode 100644 2025/CVE-2025-21550.md create mode 100644 2025/CVE-2025-21551.md create mode 100644 2025/CVE-2025-21552.md create mode 100644 2025/CVE-2025-21553.md create mode 100644 2025/CVE-2025-21554.md create mode 100644 2025/CVE-2025-21556.md create mode 100644 2025/CVE-2025-21557.md create mode 100644 2025/CVE-2025-21558.md create mode 100644 2025/CVE-2025-21560.md create mode 100644 2025/CVE-2025-21561.md create mode 100644 2025/CVE-2025-21562.md create mode 100644 2025/CVE-2025-21563.md create mode 100644 2025/CVE-2025-21564.md create mode 100644 2025/CVE-2025-21565.md create mode 100644 2025/CVE-2025-21566.md create mode 100644 2025/CVE-2025-21567.md create mode 100644 2025/CVE-2025-21568.md create mode 100644 2025/CVE-2025-21569.md create mode 100644 2025/CVE-2025-21570.md create mode 100644 2025/CVE-2025-21571.md create mode 100644 2026/CVE-2026-10953.md create mode 100644 2026/CVE-2026-11430.md create mode 100644 2026/CVE-2026-11565.md create mode 100644 2026/CVE-2026-12983.md create mode 100644 2026/CVE-2026-13169.md create mode 100644 2026/CVE-2026-13173.md create mode 100644 2026/CVE-2026-13174.md create mode 100644 2026/CVE-2026-13175.md create mode 100644 2026/CVE-2026-13775.md create mode 100644 2026/CVE-2026-13815.md create mode 100644 2026/CVE-2026-13867.md create mode 100644 2026/CVE-2026-13876.md create mode 100644 2026/CVE-2026-13920.md create mode 100644 2026/CVE-2026-14196.md create mode 100644 2026/CVE-2026-14287.md create mode 100644 2026/CVE-2026-14334.md create mode 100644 2026/CVE-2026-14825.md create mode 100644 2026/CVE-2026-14826.md create mode 100644 2026/CVE-2026-14861.md create mode 100644 2026/CVE-2026-15253.md create mode 100644 2026/CVE-2026-16058.md create mode 100644 2026/CVE-2026-16570.md create mode 100644 2026/CVE-2026-16616.md create mode 100644 2026/CVE-2026-16617.md create mode 100644 2026/CVE-2026-16950.md create mode 100644 2026/CVE-2026-16979.md create mode 100644 2026/CVE-2026-17565.md create mode 100644 2026/CVE-2026-18031.md create mode 100644 2026/CVE-2026-18051.md create mode 100644 2026/CVE-2026-18202.md create mode 100644 2026/CVE-2026-18231.md create mode 100644 2026/CVE-2026-18466.md create mode 100644 2026/CVE-2026-18776.md create mode 100644 2026/CVE-2026-18777.md create mode 100644 2026/CVE-2026-18778.md create mode 100644 2026/CVE-2026-18779.md create mode 100644 2026/CVE-2026-18937.md create mode 100644 2026/CVE-2026-19055.md create mode 100644 2026/CVE-2026-19056.md create mode 100644 2026/CVE-2026-19406.md create mode 100644 2026/CVE-2026-19416.md create mode 100644 2026/CVE-2026-19417.md create mode 100644 2026/CVE-2026-19709.md create mode 100644 2026/CVE-2026-19782.md create mode 100644 2026/CVE-2026-19842.md create mode 100644 2026/CVE-2026-20000.md create mode 100644 2026/CVE-2026-20200.md create mode 100644 2026/CVE-2026-20288.md create mode 100644 2026/CVE-2026-25039.md create mode 100644 2026/CVE-2026-25807.md create mode 100644 2026/CVE-2026-25961.md create mode 100644 2026/CVE-2026-32063.md create mode 100644 2026/CVE-2026-32101.md create mode 100644 2026/CVE-2026-32121.md create mode 100644 2026/CVE-2026-32133.md create mode 100644 2026/CVE-2026-32231.md create mode 100644 2026/CVE-2026-32267.md create mode 100644 2026/CVE-2026-32595.md create mode 100644 2026/CVE-2026-32629.md create mode 100644 2026/CVE-2026-32634.md create mode 100644 2026/CVE-2026-32695.md create mode 100644 2026/CVE-2026-32699.md create mode 100644 2026/CVE-2026-32713.md create mode 100644 2026/CVE-2026-32714.md create mode 100644 2026/CVE-2026-32718.md create mode 100644 2026/CVE-2026-32721.md create mode 100644 2026/CVE-2026-32733.md create mode 100644 2026/CVE-2026-32738.md create mode 100644 2026/CVE-2026-32740.md create mode 100644 2026/CVE-2026-32747.md create mode 100644 2026/CVE-2026-32751.md create mode 100644 2026/CVE-2026-32753.md create mode 100644 2026/CVE-2026-32754.md create mode 100644 2026/CVE-2026-32759.md create mode 100644 2026/CVE-2026-32810.md create mode 100644 2026/CVE-2026-32813.md create mode 100644 2026/CVE-2026-32814.md create mode 100644 2026/CVE-2026-32816.md create mode 100644 2026/CVE-2026-32854.md create mode 100644 2026/CVE-2026-32891.md create mode 100644 2026/CVE-2026-32948.md create mode 100644 2026/CVE-2026-33824.md create mode 100644 2026/CVE-2026-40102.md create mode 100644 2026/CVE-2026-40150.md create mode 100644 2026/CVE-2026-40153.md create mode 100644 2026/CVE-2026-40285.md create mode 100644 2026/CVE-2026-40570.md create mode 100644 2026/CVE-2026-40593.md create mode 100644 2026/CVE-2026-40868.md create mode 100644 2026/CVE-2026-47230.md create mode 100644 2026/CVE-2026-47249.md create mode 100644 2026/CVE-2026-47662.md create mode 100644 2026/CVE-2026-47704.md create mode 100644 2026/CVE-2026-50768.md create mode 100644 2026/CVE-2026-54025.md create mode 100644 2026/CVE-2026-54027.md create mode 100644 2026/CVE-2026-54091.md create mode 100644 2026/CVE-2026-54092.md create mode 100644 2026/CVE-2026-54093.md create mode 100644 2026/CVE-2026-54317.md create mode 100644 2026/CVE-2026-54332.md create mode 100644 2026/CVE-2026-54344.md create mode 100644 2026/CVE-2026-54481.md create mode 100644 2026/CVE-2026-54555.md create mode 100644 2026/CVE-2026-54572.md create mode 100644 2026/CVE-2026-54684.md create mode 100644 2026/CVE-2026-54696.md create mode 100644 2026/CVE-2026-54765.md create mode 100644 2026/CVE-2026-54917.md create mode 100644 2026/CVE-2026-55165.md create mode 100644 2026/CVE-2026-55166.md create mode 100644 2026/CVE-2026-55195.md create mode 100644 2026/CVE-2026-55206.md create mode 100644 2026/CVE-2026-55390.md create mode 100644 2026/CVE-2026-55426.md create mode 100644 2026/CVE-2026-55450.md create mode 100644 2026/CVE-2026-55460.md create mode 100644 2026/CVE-2026-55462.md create mode 100644 2026/CVE-2026-55470.md create mode 100644 2026/CVE-2026-55477.md create mode 100644 2026/CVE-2026-55524.md create mode 100644 2026/CVE-2026-55548.md create mode 100644 2026/CVE-2026-55593.md create mode 100644 2026/CVE-2026-55651.md create mode 100644 2026/CVE-2026-55833.md create mode 100644 2026/CVE-2026-55886.md create mode 100644 2026/CVE-2026-57157.md create mode 100644 2026/CVE-2026-57158.md create mode 100644 2026/CVE-2026-57218.md create mode 100644 2026/CVE-2026-57233.md create mode 100644 2026/CVE-2026-57439.md create mode 100644 2026/CVE-2026-57485.md create mode 100644 2026/CVE-2026-57516.md create mode 100644 2026/CVE-2026-57573.md create mode 100644 2026/CVE-2026-57859.md create mode 100644 2026/CVE-2026-57862.md create mode 100644 2026/CVE-2026-57894.md create mode 100644 2026/CVE-2026-57942.md create mode 100644 2026/CVE-2026-57947.md create mode 100644 2026/CVE-2026-57951.md create mode 100644 2026/CVE-2026-57958.md create mode 100644 2026/CVE-2026-57961.md create mode 100644 2026/CVE-2026-57997.md create mode 100644 2026/CVE-2026-57999.md create mode 100644 2026/CVE-2026-62184.md create mode 100644 2026/CVE-2026-62239.md create mode 100644 2026/CVE-2026-62240.md create mode 100644 2026/CVE-2026-62241.md create mode 100644 2026/CVE-2026-62246.md create mode 100644 2026/CVE-2026-62290.md create mode 100644 2026/CVE-2026-62291.md create mode 100644 2026/CVE-2026-62292.md create mode 100644 2026/CVE-2026-62293.md create mode 100644 2026/CVE-2026-62295.md create mode 100644 2026/CVE-2026-62296.md create mode 100644 2026/CVE-2026-62299.md create mode 100644 2026/CVE-2026-62323.md create mode 100644 2026/CVE-2026-62324.md create mode 100644 2026/CVE-2026-62325.md create mode 100644 2026/CVE-2026-62350.md create mode 100644 2026/CVE-2026-62353.md create mode 100644 2026/CVE-2026-62377.md create mode 100644 2026/CVE-2026-62378.md create mode 100644 2026/CVE-2026-62420.md create mode 100644 2026/CVE-2026-62663.md create mode 100644 2026/CVE-2026-62684.md create mode 100644 2026/CVE-2026-62845.md create mode 100644 2026/CVE-2026-62857.md create mode 100644 2026/CVE-2026-62948.md create mode 100644 2026/CVE-2026-62959.md create mode 100644 2026/CVE-2026-62982.md create mode 100644 2026/CVE-2026-62988.md create mode 100644 2026/CVE-2026-62994.md create mode 100644 2026/CVE-2026-62996.md create mode 100644 2026/CVE-2026-75130.md create mode 100644 2026/CVE-2026-75872.md create mode 100644 2026/CVE-2026-7701.md create mode 100644 2026/CVE-2026-7999.md create mode 100644 2026/CVE-2026-8541.md create mode 100644 2026/CVE-2026-8561.md create mode 100644 2026/CVE-2026-9126.md create mode 100644 2026/CVE-2026-9875.md create mode 100644 2026/CVE-2026-9895.md create mode 100644 2026/CVE-2026-9916.md create mode 100644 2026/CVE-2026-9967.md create mode 100644 2026/CVE-2026-9973.md create mode 100644 2026/CVE-2026-9974.md create mode 100644 2026/CVE-2026-9977.md diff --git a/2003/CVE-2003-0476.md b/2003/CVE-2003-0476.md index 7704a2c5ba..3e6de7c321 100644 --- a/2003/CVE-2003-0476.md +++ b/2003/CVE-2003-0476.md @@ -11,6 +11,7 @@ The execve system call in Linux 2.4.x records the file descriptor of the executa #### Reference - http://marc.info/?l=bugtraq&m=105664924024009&w=2 +- http://www.redhat.com/support/errata/RHSA-2003-368.html #### Github No PoCs found on GitHub currently. diff --git a/2003/CVE-2003-0961.md b/2003/CVE-2003-0961.md index ffe2c14083..6535efa858 100644 --- a/2003/CVE-2003-0961.md +++ b/2003/CVE-2003-0961.md @@ -11,6 +11,7 @@ Integer overflow in the do_brk function for the brk system call in Linux kernel #### Reference - http://marc.info/?l=bugtraq&m=107064830206816&w=2 +- http://www.redhat.com/support/errata/RHSA-2003-368.html #### Github - https://github.com/AnyMaster/EQGRP diff --git a/2004/CVE-2004-0006.md b/2004/CVE-2004-0006.md index 34db1432d1..4f46f64811 100644 --- a/2004/CVE-2004-0006.md +++ b/2004/CVE-2004-0006.md @@ -11,6 +11,7 @@ Multiple buffer overflows in Gaim 0.75 and earlier, and Ultramagnetic before 0.8 #### Reference - http://marc.info/?l=bugtraq&m=107513690306318&w=2 +- http://www.redhat.com/support/errata/RHSA-2004-032.html #### Github No PoCs found on GitHub currently. diff --git a/2004/CVE-2004-0007.md b/2004/CVE-2004-0007.md index ccf03f9339..1a6391c9e6 100644 --- a/2004/CVE-2004-0007.md +++ b/2004/CVE-2004-0007.md @@ -11,6 +11,7 @@ Buffer overflow in the Extract Info Field Function for (1) MSN and (2) YMSG prot #### Reference - http://marc.info/?l=bugtraq&m=107513690306318&w=2 +- http://www.redhat.com/support/errata/RHSA-2004-032.html - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9906 #### Github diff --git a/2004/CVE-2004-0008.md b/2004/CVE-2004-0008.md index 1855f7b7da..3cdb63de49 100644 --- a/2004/CVE-2004-0008.md +++ b/2004/CVE-2004-0008.md @@ -11,6 +11,7 @@ Integer overflow in Gaim 0.74 and earlier, and Ultramagnetic before 0.81, allows #### Reference - http://marc.info/?l=bugtraq&m=107513690306318&w=2 +- http://www.redhat.com/support/errata/RHSA-2004-032.html - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9469 #### Github diff --git a/2004/CVE-2004-0276.md b/2004/CVE-2004-0276.md index 36c99a3d07..4a13a2d999 100644 --- a/2004/CVE-2004-0276.md +++ b/2004/CVE-2004-0276.md @@ -12,6 +12,7 @@ The get_real_string function in Monkey HTTP Daemon (monkeyd) 0.8.1 and earlier a #### Reference - http://marc.info/?l=bugtraq&m=107652610506968&w=2 - http://monkeyd.sourceforge.net/ +- http://www.securityfocus.com/bid/9642 #### Github No PoCs found on GitHub currently. diff --git a/2005/CVE-2005-0862.md b/2005/CVE-2005-0862.md new file mode 100644 index 0000000000..161805611d --- /dev/null +++ b/2005/CVE-2005-0862.md @@ -0,0 +1,17 @@ +### [CVE-2005-0862](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-0862) +![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen) + +### Description + +Multiple PHP remote file inclusion vulnerabilities in PHPOpenChat 3.0.1 and earlier allow remote attackers to execute arbitrary PHP code via the phpbb_root_path parameter to (1) poc_loginform.php or (2) phpbb/poc.php, the poc_root_path parameter to (3) phpbb/poc.php, (4) phpnuke/ENGLISH_poc.php, (5) phpnuke/poc.php, or (6) yabbse/poc.php, or (7) the sourcedir parameter to yabbse/poc.php. + +### POC + +#### Reference +- http://www.securityfocus.com/bid/12817 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2006/CVE-2006-1664.md b/2006/CVE-2006-1664.md index 59c833d04d..125c53f321 100644 --- a/2006/CVE-2006-1664.md +++ b/2006/CVE-2006-1664.md @@ -11,6 +11,8 @@ Buffer overflow in xine_list_delete_current in libxine 1.14 and earlier, as dist #### Reference - http://sourceforge.net/project/shownotes.php?group_id=9655&release_id=571608 +- http://www.securityfocus.com/bid/17370 +- http://www.securityfocus.com/data/vulnerabilities/exploits/xinelib_poc.pl - https://www.exploit-db.com/exploits/1641 #### Github diff --git a/2006/CVE-2006-1917.md b/2006/CVE-2006-1917.md index 8b131cd6c5..60948a81b3 100644 --- a/2006/CVE-2006-1917.md +++ b/2006/CVE-2006-1917.md @@ -10,6 +10,7 @@ SQL injection vulnerability in member.php in Blackorpheus ClanMemberSkript 1.0 a ### POC #### Reference +- http://www.securityfocus.com/bid/17558 - https://www.exploit-db.com/exploits/1683 #### Github diff --git a/2006/CVE-2006-2853.md b/2006/CVE-2006-2853.md new file mode 100644 index 0000000000..4c2d5936a7 --- /dev/null +++ b/2006/CVE-2006-2853.md @@ -0,0 +1,17 @@ +### [CVE-2006-2853](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2853) +![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen) + +### Description + +SQL injection vulnerability in content.php in abarcar Realty Portal 5.1.5 allows remote attackers to execute arbitrary SQL commands via the cat parameter. + +### POC + +#### Reference +- http://www.securityfocus.com/bid/18218 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2006/CVE-2006-2854.md b/2006/CVE-2006-2854.md new file mode 100644 index 0000000000..6213a167ea --- /dev/null +++ b/2006/CVE-2006-2854.md @@ -0,0 +1,17 @@ +### [CVE-2006-2854](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2854) +![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen) + +### Description + +SQL injection vulnerability in index.php in iBWd Guestbook 1.0 allows remote attackers to execute arbitrary SQL commands via the offset parameter. + +### POC + +#### Reference +- http://www.securityfocus.com/bid/18256 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2006/CVE-2006-3381.md b/2006/CVE-2006-3381.md new file mode 100644 index 0000000000..4a9748d5a8 --- /dev/null +++ b/2006/CVE-2006-3381.md @@ -0,0 +1,17 @@ +### [CVE-2006-3381](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3381) +![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen) + +### Description + +SturGeoN Upload allows remote attackers to execute arbitrary PHP code by uploading a file with a .php extension, then directly accessing the file. NOTE: It is uncertain whether this is a vulnerability or a feature of the product. + +### POC + +#### Reference +- http://www.securityfocus.com/bid/18764 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2006/CVE-2006-3879.md b/2006/CVE-2006-3879.md index 1aac20d14b..fb68d4324b 100644 --- a/2006/CVE-2006-3879.md +++ b/2006/CVE-2006-3879.md @@ -13,6 +13,7 @@ Integer overflow in the loadChunk function in loaders/load_gt2.c in libmikmod in - http://aluigi.altervista.org/adv/lmmgt2ho-adv.txt - http://aluigi.org/poc/lmmgt2ho.zip - http://securityreason.com/securityalert/1288 +- http://www.securityfocus.com/bid/19134 #### Github - https://github.com/ARPSyndicate/cve-scores diff --git a/2006/CVE-2006-4005.md b/2006/CVE-2006-4005.md index 710f9d708c..592805307d 100644 --- a/2006/CVE-2006-4005.md +++ b/2006/CVE-2006-4005.md @@ -12,6 +12,7 @@ BomberClone 0.11.6 and earlier allows remote attackers to cause a denial of serv #### Reference - http://aluigi.altervista.org/adv/bcloneboom-adv.txt - http://aluigi.org/poc/bcloneboom.zip +- http://www.securityfocus.com/bid/19255 #### Github No PoCs found on GitHub currently. diff --git a/2006/CVE-2006-4006.md b/2006/CVE-2006-4006.md index bd46b1530c..db712f0cbd 100644 --- a/2006/CVE-2006-4006.md +++ b/2006/CVE-2006-4006.md @@ -12,6 +12,7 @@ The do_gameinfo function in BomberClone 0.11.6 and earlier, and possibly other f #### Reference - http://aluigi.altervista.org/adv/bcloneboom-adv.txt - http://aluigi.org/poc/bcloneboom.zip +- http://www.securityfocus.com/bid/19255 #### Github No PoCs found on GitHub currently. diff --git a/2006/CVE-2006-4584.md b/2006/CVE-2006-4584.md index f01cbfb9aa..86c33c6b68 100644 --- a/2006/CVE-2006-4584.md +++ b/2006/CVE-2006-4584.md @@ -11,6 +11,7 @@ Tr Forum 2.0 allows remote attackers to bypass authentication and add an adminis #### Reference - http://securityreason.com/securityalert/1508 +- http://www.securityfocus.com/bid/19834 - https://www.exploit-db.com/exploits/2297 #### Github diff --git a/2006/CVE-2006-4585.md b/2006/CVE-2006-4585.md index 2fae7d4e0b..1f144e62c6 100644 --- a/2006/CVE-2006-4585.md +++ b/2006/CVE-2006-4585.md @@ -11,6 +11,7 @@ SQL injection vulnerability in admin/editer.php in Tr Forum 2.0 allows remote au #### Reference - http://securityreason.com/securityalert/1508 +- http://www.securityfocus.com/bid/19834 - https://www.exploit-db.com/exploits/2297 #### Github diff --git a/2006/CVE-2006-4586.md b/2006/CVE-2006-4586.md index 424d1a2dde..c9b8146655 100644 --- a/2006/CVE-2006-4586.md +++ b/2006/CVE-2006-4586.md @@ -11,6 +11,7 @@ The admin panel in Tr Forum 2.0 accepts a username and password hash for authent #### Reference - http://securityreason.com/securityalert/1508 +- http://www.securityfocus.com/bid/19834 - https://www.exploit-db.com/exploits/2297 #### Github diff --git a/2006/CVE-2006-4601.md b/2006/CVE-2006-4601.md index 8d1f151e8c..f2918851b8 100644 --- a/2006/CVE-2006-4601.md +++ b/2006/CVE-2006-4601.md @@ -11,6 +11,7 @@ SQL injection vulnerability in index.php in Annuaire 1Two 2.2 allows remote atta #### Reference - http://securityreason.com/securityalert/1496 +- http://www.securityfocus.com/bid/19817 #### Github No PoCs found on GitHub currently. diff --git a/2006/CVE-2006-5085.md b/2006/CVE-2006-5085.md index 1ca01f9e2c..cc50bd8870 100644 --- a/2006/CVE-2006-5085.md +++ b/2006/CVE-2006-5085.md @@ -11,6 +11,7 @@ Static code injection vulnerability in config.php in Blog Pixel Motion 2.1.1 all #### Reference - http://securityreason.com/securityalert/1653 +- http://www.securityfocus.com/bid/20235 #### Github No PoCs found on GitHub currently. diff --git a/2006/CVE-2006-5259.md b/2006/CVE-2006-5259.md index 9345b173c9..d34dbfecec 100644 --- a/2006/CVE-2006-5259.md +++ b/2006/CVE-2006-5259.md @@ -11,6 +11,7 @@ PHP remote file inclusion vulnerability in param_editor.php in Compteur 2 allows #### Reference - http://marc.info/?l=bugtraq&m=116049484210942&w=2 +- http://www.securityfocus.com/bid/20432 - https://www.exploit-db.com/exploits/2503 #### Github diff --git a/2006/CVE-2006-5296.md b/2006/CVE-2006-5296.md index 8b5a46ed26..850f5e464c 100644 --- a/2006/CVE-2006-5296.md +++ b/2006/CVE-2006-5296.md @@ -11,6 +11,7 @@ PowerPoint in Microsoft Office 2003 does not properly handle a container object #### Reference - http://www.informationweek.com/management/showArticle.jhtml?articleID=193302553 +- http://www.securityfocus.com/bid/20495 - https://www.exploit-db.com/exploits/2523 #### Github diff --git a/2006/CVE-2006-5314.md b/2006/CVE-2006-5314.md index eea5149d3e..96e5248acb 100644 --- a/2006/CVE-2006-5314.md +++ b/2006/CVE-2006-5314.md @@ -11,6 +11,7 @@ PHP remote file inclusion vulnerability in ftag.php in TribunaLibre 3.12 Beta al #### Reference - http://securityreason.com/securityalert/1734 +- http://www.securityfocus.com/bid/20443 - https://www.exploit-db.com/exploits/2501 #### Github diff --git a/2006/CVE-2006-5315.md b/2006/CVE-2006-5315.md index b396503bdb..311aa0ed4d 100644 --- a/2006/CVE-2006-5315.md +++ b/2006/CVE-2006-5315.md @@ -11,6 +11,7 @@ PHP remote file inclusion vulnerability in main.php in registroTL allows remote #### Reference - http://securityreason.com/securityalert/1734 +- http://www.securityfocus.com/bid/20433 - https://www.exploit-db.com/exploits/2502 #### Github diff --git a/2006/CVE-2006-5317.md b/2006/CVE-2006-5317.md index 3ae23b7c9a..92659efba7 100644 --- a/2006/CVE-2006-5317.md +++ b/2006/CVE-2006-5317.md @@ -11,6 +11,7 @@ PHP remote file inclusion vulnerability in index.php in eboli allows remote atta #### Reference - http://securityreason.com/securityalert/1734 +- http://www.securityfocus.com/bid/20429 - https://www.exploit-db.com/exploits/2504 #### Github diff --git a/2006/CVE-2006-5318.md b/2006/CVE-2006-5318.md index d7399d80a2..cfc96ad2ad 100644 --- a/2006/CVE-2006-5318.md +++ b/2006/CVE-2006-5318.md @@ -10,6 +10,7 @@ PHP remote file inclusion vulnerability in index.php in Nayco JASmine (aka Jasmi ### POC #### Reference +- http://www.securityfocus.com/bid/20430 - https://www.exploit-db.com/exploits/2505 #### Github diff --git a/2006/CVE-2006-5320.md b/2006/CVE-2006-5320.md index a18150e69f..43d6ba949e 100644 --- a/2006/CVE-2006-5320.md +++ b/2006/CVE-2006-5320.md @@ -10,6 +10,7 @@ Directory traversal vulnerability in getimg.php in Album Photo Sans Nom 1.6 allo ### POC #### Reference +- http://www.securityfocus.com/bid/20441 - https://www.exploit-db.com/exploits/2507 #### Github diff --git a/2006/CVE-2006-5550.md b/2006/CVE-2006-5550.md index f82b6cf5d0..7827da1fda 100644 --- a/2006/CVE-2006-5550.md +++ b/2006/CVE-2006-5550.md @@ -11,6 +11,7 @@ The kernel in FreeBSD 6.1 and OpenBSD 4.0 allows local users to cause a denial o #### Reference - http://elegerov.blogspot.com/2006/10/here-is-lame-proof-of-concept-code-for.html +- http://www.securityfocus.com/bid/20713 #### Github No PoCs found on GitHub currently. diff --git a/2006/CVE-2006-5559.md b/2006/CVE-2006-5559.md index b7fc8b6c5d..e67fd763b1 100644 --- a/2006/CVE-2006-5559.md +++ b/2006/CVE-2006-5559.md @@ -11,6 +11,7 @@ The Execute method in the ADODB.Connection 2.7 and 2.8 ActiveX control objects ( #### Reference - http://www.kb.cert.org/vuls/id/589272 +- http://www.securityfocus.com/bid/20704 - https://docs.microsoft.com/en-us/security-updates/securitybulletins/2007/ms07-009 #### Github diff --git a/2006/CVE-2006-6134.md b/2006/CVE-2006-6134.md index 71496a7db8..87f1906faf 100644 --- a/2006/CVE-2006-6134.md +++ b/2006/CVE-2006-6134.md @@ -11,6 +11,7 @@ Heap-based buffer overflow in the WMCheckURLScheme function in WMVCORE.DLL in Mi #### Reference - http://www.kb.cert.org/vuls/id/208769 +- http://www.securityfocus.com/bid/21247 - https://docs.microsoft.com/en-us/security-updates/securitybulletins/2006/ms06-078 #### Github diff --git a/2006/CVE-2006-6253.md b/2006/CVE-2006-6253.md index e9cef95bf7..0214f7bfd1 100644 --- a/2006/CVE-2006-6253.md +++ b/2006/CVE-2006-6253.md @@ -11,6 +11,7 @@ Cahier de texte 2.0 stores sensitive information under the web root, possibly wi #### Reference - http://securityreason.com/securityalert/1961 +- http://www.securityfocus.com/bid/21283 #### Github No PoCs found on GitHub currently. diff --git a/2006/CVE-2006-6254.md b/2006/CVE-2006-6254.md index c7e17662c7..9475b26bca 100644 --- a/2006/CVE-2006-6254.md +++ b/2006/CVE-2006-6254.md @@ -11,6 +11,7 @@ administration/telecharger.php in Cahier de texte 2.0 allows remote attackers to #### Reference - http://securityreason.com/securityalert/1961 +- http://www.securityfocus.com/bid/21283 #### Github No PoCs found on GitHub currently. diff --git a/2006/CVE-2006-6754.md b/2006/CVE-2006-6754.md index 7ce021a2d7..c1411fbe6c 100644 --- a/2006/CVE-2006-6754.md +++ b/2006/CVE-2006-6754.md @@ -11,6 +11,7 @@ Multiple SQL injection vulnerabilities in Ixprim 1.2 allow remote attackers to e #### Reference - http://securityreason.com/securityalert/2073 +- http://www.securityfocus.com/bid/21710 #### Github No PoCs found on GitHub currently. diff --git a/2007/CVE-2007-0122.md b/2007/CVE-2007-0122.md index 10a0e94bb2..58bf0ff67a 100644 --- a/2007/CVE-2007-0122.md +++ b/2007/CVE-2007-0122.md @@ -11,6 +11,7 @@ Multiple SQL injection vulnerabilities in Coppermine Photo Gallery 1.4.10 and ea #### Reference - http://securityreason.com/securityalert/2123 +- http://www.securityfocus.com/bid/21894 - https://www.exploit-db.com/exploits/3085 #### Github diff --git a/2007/CVE-2007-0202.md b/2007/CVE-2007-0202.md index e45b762e75..c39e3132c7 100644 --- a/2007/CVE-2007-0202.md +++ b/2007/CVE-2007-0202.md @@ -11,6 +11,7 @@ SQL injection vulnerability in index.php in @lex Guestbook 4.0.2 and earlier, wh #### Reference - http://securityreason.com/securityalert/2135 +- http://www.securityfocus.com/bid/21926 - https://www.exploit-db.com/exploits/3103 #### Github diff --git a/2007/CVE-2007-0205.md b/2007/CVE-2007-0205.md index a409ec6463..c7bac05a5b 100644 --- a/2007/CVE-2007-0205.md +++ b/2007/CVE-2007-0205.md @@ -11,6 +11,7 @@ Directory traversal vulnerability in admin/skins.php for @lex Guestbook 4.0.2 an #### Reference - http://securityreason.com/securityalert/2135 +- http://www.securityfocus.com/bid/21926 - https://www.exploit-db.com/exploits/3103 #### Github diff --git a/2007/CVE-2007-4358.md b/2007/CVE-2007-4358.md index f600807818..8ef4d804ef 100644 --- a/2007/CVE-2007-4358.md +++ b/2007/CVE-2007-4358.md @@ -13,6 +13,7 @@ Zoidcom 0.6.7 and earlier allows remote attackers to cause a denial of service ( - http://aluigi.altervista.org/adv/zoidboom2-adv.txt - http://aluigi.org/poc/zoidboom2.zip - http://securityreason.com/securityalert/3014 +- http://www.securityfocus.com/bid/25326 #### Github No PoCs found on GitHub currently. diff --git a/2007/CVE-2007-4444.md b/2007/CVE-2007-4444.md index feae130d92..5fa6e6edf7 100644 --- a/2007/CVE-2007-4444.md +++ b/2007/CVE-2007-4444.md @@ -12,6 +12,7 @@ Multiple buffer overflows in Image Space rFactor 1.250 and earlier allow remote #### Reference - http://aluigi.org/poc/rfactorx.zip - http://securityreason.com/securityalert/3037 +- http://www.securityfocus.com/bid/25358 #### Github No PoCs found on GitHub currently. diff --git a/2007/CVE-2007-4445.md b/2007/CVE-2007-4445.md index d56cb330ff..8e161fd274 100644 --- a/2007/CVE-2007-4445.md +++ b/2007/CVE-2007-4445.md @@ -12,6 +12,7 @@ Image Space rFactor 1.250 and earlier allows remote attackers to cause a denial #### Reference - http://aluigi.org/poc/rfactorx.zip - http://securityreason.com/securityalert/3037 +- http://www.securityfocus.com/bid/25358 #### Github No PoCs found on GitHub currently. diff --git a/2007/CVE-2007-4446.md b/2007/CVE-2007-4446.md index eecbfd6bf2..4552aa40d8 100644 --- a/2007/CVE-2007-4446.md +++ b/2007/CVE-2007-4446.md @@ -12,6 +12,7 @@ Format string vulnerability in the server in Toribash 2.71 and earlier allows re #### Reference - http://aluigi.org/poc/toribashish.zip - http://securityreason.com/securityalert/3033 +- http://www.securityfocus.com/bid/25359 #### Github No PoCs found on GitHub currently. diff --git a/2007/CVE-2007-4447.md b/2007/CVE-2007-4447.md index 7f696d93d7..c1f24fa58c 100644 --- a/2007/CVE-2007-4447.md +++ b/2007/CVE-2007-4447.md @@ -12,6 +12,7 @@ Multiple buffer overflows in the client in Toribash 2.71 and earlier allow remot #### Reference - http://aluigi.org/poc/toribashish.zip - http://securityreason.com/securityalert/3033 +- http://www.securityfocus.com/bid/25359 #### Github No PoCs found on GitHub currently. diff --git a/2007/CVE-2007-4448.md b/2007/CVE-2007-4448.md index 2515abe4e1..1980234d7d 100644 --- a/2007/CVE-2007-4448.md +++ b/2007/CVE-2007-4448.md @@ -12,6 +12,7 @@ The server in Toribash 2.71 and earlier does not properly handle partially joine #### Reference - http://aluigi.org/poc/toribashish.zip - http://securityreason.com/securityalert/3033 +- http://www.securityfocus.com/bid/25359 #### Github No PoCs found on GitHub currently. diff --git a/2007/CVE-2007-4449.md b/2007/CVE-2007-4449.md index 56ef835666..f6fa5fc26d 100644 --- a/2007/CVE-2007-4449.md +++ b/2007/CVE-2007-4449.md @@ -12,6 +12,7 @@ The client in Toribash 2.71 and earlier allows remote attackers to cause a denia #### Reference - http://aluigi.org/poc/toribashish.zip - http://securityreason.com/securityalert/3033 +- http://www.securityfocus.com/bid/25359 #### Github No PoCs found on GitHub currently. diff --git a/2007/CVE-2007-4450.md b/2007/CVE-2007-4450.md index 1f3b4b8188..c9912613a3 100644 --- a/2007/CVE-2007-4450.md +++ b/2007/CVE-2007-4450.md @@ -12,6 +12,7 @@ The server in Toribash 2.71 and earlier does not properly handle long commands, #### Reference - http://aluigi.org/poc/toribashish.zip - http://securityreason.com/securityalert/3033 +- http://www.securityfocus.com/bid/25359 #### Github No PoCs found on GitHub currently. diff --git a/2007/CVE-2007-4451.md b/2007/CVE-2007-4451.md index b615556399..e566ea3664 100644 --- a/2007/CVE-2007-4451.md +++ b/2007/CVE-2007-4451.md @@ -12,6 +12,7 @@ The server in Toribash 2.71 and earlier on Windows allows remote attackers to ca #### Reference - http://aluigi.org/poc/toribashish.zip - http://securityreason.com/securityalert/3033 +- http://www.securityfocus.com/bid/25359 #### Github No PoCs found on GitHub currently. diff --git a/2007/CVE-2007-4452.md b/2007/CVE-2007-4452.md index 717adfc5a5..ca39604081 100644 --- a/2007/CVE-2007-4452.md +++ b/2007/CVE-2007-4452.md @@ -12,6 +12,7 @@ The client in Toribash 2.71 and earlier allows remote attackers to cause a denia #### Reference - http://aluigi.org/poc/toribashish.zip - http://securityreason.com/securityalert/3033 +- http://www.securityfocus.com/bid/25359 #### Github No PoCs found on GitHub currently. diff --git a/2007/CVE-2007-4832.md b/2007/CVE-2007-4832.md index 10dca08ffb..a5c515c88b 100644 --- a/2007/CVE-2007-4832.md +++ b/2007/CVE-2007-4832.md @@ -12,6 +12,7 @@ Format string vulnerability in CellFactor Revolution 1.03 and earlier allows rem #### Reference - http://aluigi.altervista.org/adv/cellfucktor-adv.txt - http://securityreason.com/securityalert/3130 +- http://www.securityfocus.com/bid/25625 #### Github No PoCs found on GitHub currently. diff --git a/2007/CVE-2007-4838.md b/2007/CVE-2007-4838.md index b08bd56229..b82dc2acab 100644 --- a/2007/CVE-2007-4838.md +++ b/2007/CVE-2007-4838.md @@ -13,6 +13,7 @@ Multiple buffer overflows in CellFactor Revolution 1.03 and earlier allow remote - http://aluigi.altervista.org/adv/cellfucktor-adv.txt - http://aluigi.org/poc/cellfucktor.zip - http://securityreason.com/securityalert/3130 +- http://www.securityfocus.com/bid/25625 #### Github No PoCs found on GitHub currently. diff --git a/2007/CVE-2007-4879.md b/2007/CVE-2007-4879.md index 7be0829d1b..c3abea664a 100644 --- a/2007/CVE-2007-4879.md +++ b/2007/CVE-2007-4879.md @@ -11,6 +11,7 @@ Mozilla Firefox before Firefox 2.0.0.13, and SeaMonkey before 1.1.9, can automat #### Reference - http://0x90.eu/ff_tls_poc.html +- http://www.securityfocus.com/bid/28448 - http://www.ubuntu.com/usn/usn-592-1 - https://bugzilla.mozilla.org/show_bug.cgi?id=395399 diff --git a/2007/CVE-2007-5036.md b/2007/CVE-2007-5036.md index f70fefaee4..587ac03cf7 100644 --- a/2007/CVE-2007-5036.md +++ b/2007/CVE-2007-5036.md @@ -10,6 +10,7 @@ Multiple buffer overflows in the AirDefense Airsensor M520 with firmware 4.3.1.1 ### POC #### Reference +- http://www.securityfocus.com/bid/25715 - https://www.exploit-db.com/exploits/4426 #### Github diff --git a/2007/CVE-2007-5184.md b/2007/CVE-2007-5184.md index 4655004f65..73bf05cd4a 100644 --- a/2007/CVE-2007-5184.md +++ b/2007/CVE-2007-5184.md @@ -10,6 +10,7 @@ Format string vulnerability in the SMBDirList function in dirlist.c in SmbFTPD 0 ### POC #### Reference +- http://www.securityfocus.com/bid/25871 - https://www.exploit-db.com/exploits/4478 #### Github diff --git a/2007/CVE-2007-6041.md b/2007/CVE-2007-6041.md index 90e7b4edcf..18af4a7e3a 100644 --- a/2007/CVE-2007-6041.md +++ b/2007/CVE-2007-6041.md @@ -12,6 +12,7 @@ Buffer overflow in the Sequencer::queueMessage function in sequencer.cpp in the #### Reference - http://aluigi.altervista.org/adv/rorbof-adv.txt - http://aluigi.org/poc/rorbof.zip +- http://www.securityfocus.com/bid/26502 #### Github - https://github.com/ARPSyndicate/cve-scores diff --git a/2007/CVE-2007-6537.md b/2007/CVE-2007-6537.md index 1c1ee6782a..9465fbe3c6 100644 --- a/2007/CVE-2007-6537.md +++ b/2007/CVE-2007-6537.md @@ -13,6 +13,7 @@ Stack-based buffer overflow in the zfile_gunzip function in zfile.c in WinUAE 1. - http://aluigi.altervista.org/adv/winuaebof-adv.txt - http://aluigi.org/poc/winuaebof.zip - http://securityreason.com/securityalert/3487 +- http://www.securityfocus.com/bid/26979 #### Github No PoCs found on GitHub currently. diff --git a/2007/CVE-2007-6631.md b/2007/CVE-2007-6631.md index a547dd6342..6c1d4c50b2 100644 --- a/2007/CVE-2007-6631.md +++ b/2007/CVE-2007-6631.md @@ -13,6 +13,7 @@ Multiple buffer overflows in LScube libnemesi 0.6.4-rc1 and earlier allow remote - http://aluigi.altervista.org/adv/libnemesibof-adv.txt - http://aluigi.org/poc/libnemesibof.zip - http://securityreason.com/securityalert/3513 +- http://www.securityfocus.com/bid/27048 #### Github No PoCs found on GitHub currently. diff --git a/2008/CVE-2008-0132.md b/2008/CVE-2008-0132.md index b53ef9589d..b3692d06dd 100644 --- a/2008/CVE-2008-0132.md +++ b/2008/CVE-2008-0132.md @@ -12,6 +12,7 @@ Pragma FortressSSH 5.0 Build 4 Revision 293 and earlier handles long input to ss #### Reference - http://aluigi.altervista.org/adv/pragmassh-adv.txt - http://aluigi.org/poc/pragmassh.zip +- http://www.securityfocus.com/bid/27141 #### Github - https://github.com/Live-Hack-CVE/CVE-2008-0132 diff --git a/2008/CVE-2008-0944.md b/2008/CVE-2008-0944.md index 26788e5bac..2175852f7a 100644 --- a/2008/CVE-2008-0944.md +++ b/2008/CVE-2008-0944.md @@ -12,6 +12,7 @@ Ipswitch Instant Messaging (IM) 2.0.8.1 and earlier allows remote attackers to c #### Reference - http://aluigi.altervista.org/adv/ipsimene-adv.txt - http://securityreason.com/securityalert/3697 +- http://www.securityfocus.com/bid/27677 #### Github No PoCs found on GitHub currently. diff --git a/2008/CVE-2008-0945.md b/2008/CVE-2008-0945.md index 5564d3964d..664797d699 100644 --- a/2008/CVE-2008-0945.md +++ b/2008/CVE-2008-0945.md @@ -13,6 +13,7 @@ Format string vulnerability in the logging function in the IM Server (aka IMserv - http://aluigi.altervista.org/adv/ipsimene-adv.txt - http://aluigi.org/poc/ipsimene.zip - http://securityreason.com/securityalert/3697 +- http://www.securityfocus.com/bid/27677 #### Github No PoCs found on GitHub currently. diff --git a/2008/CVE-2008-0946.md b/2008/CVE-2008-0946.md index 9ea23189e1..1b0dc5acfd 100644 --- a/2008/CVE-2008-0946.md +++ b/2008/CVE-2008-0946.md @@ -13,6 +13,7 @@ Directory traversal vulnerability in the IM Server (aka IMserve or IMserver) in - http://aluigi.altervista.org/adv/ipsimene-adv.txt - http://aluigi.org/poc/ipsimene.zip - http://securityreason.com/securityalert/3697 +- http://www.securityfocus.com/bid/27677 #### Github No PoCs found on GitHub currently. diff --git a/2008/CVE-2008-0973.md b/2008/CVE-2008-0973.md index d87ee440dc..ec74b9020a 100644 --- a/2008/CVE-2008-0973.md +++ b/2008/CVE-2008-0973.md @@ -13,6 +13,7 @@ Buffer overflow in Double-Take (aka HP StorageWorks Storage Mirroring) 4.5.0.162 - http://aluigi.altervista.org/adv/doubletakedown-adv.txt - http://aluigi.org/poc/doubletakedown.zip - http://securityreason.com/securityalert/3698 +- http://www.securityfocus.com/bid/27951 - http://www.vupen.com/english/advisories/2008/0666 #### Github diff --git a/2008/CVE-2008-0974.md b/2008/CVE-2008-0974.md index 9c24badadf..abcb5b3b14 100644 --- a/2008/CVE-2008-0974.md +++ b/2008/CVE-2008-0974.md @@ -13,6 +13,7 @@ Double-Take 5.0.0.2865 and earlier, distributed under the HP StorageWorks Storag - http://aluigi.altervista.org/adv/doubletakedown-adv.txt - http://aluigi.org/poc/doubletakedown.zip - http://securityreason.com/securityalert/3698 +- http://www.securityfocus.com/bid/27951 - http://www.vupen.com/english/advisories/2008/0666 #### Github diff --git a/2008/CVE-2008-0975.md b/2008/CVE-2008-0975.md index 3d2546b97b..8d3fb179b8 100644 --- a/2008/CVE-2008-0975.md +++ b/2008/CVE-2008-0975.md @@ -13,6 +13,7 @@ Double-Take 5.0.0.2865 and earlier, distributed under the HP StorageWorks Storag - http://aluigi.altervista.org/adv/doubletakedown-adv.txt - http://aluigi.org/poc/doubletakedown.zip - http://securityreason.com/securityalert/3698 +- http://www.securityfocus.com/bid/27951 - http://www.vupen.com/english/advisories/2008/0666 #### Github diff --git a/2008/CVE-2008-0976.md b/2008/CVE-2008-0976.md index a49b3d0e16..421bc7be4e 100644 --- a/2008/CVE-2008-0976.md +++ b/2008/CVE-2008-0976.md @@ -13,6 +13,7 @@ Double-Take 5.0.0.2865 and earlier, distributed under the HP StorageWorks Storag - http://aluigi.altervista.org/adv/doubletakedown-adv.txt - http://aluigi.org/poc/doubletakedown.zip - http://securityreason.com/securityalert/3698 +- http://www.securityfocus.com/bid/27951 - http://www.vupen.com/english/advisories/2008/0666 #### Github diff --git a/2008/CVE-2008-0977.md b/2008/CVE-2008-0977.md index 96c558c147..bdd2639776 100644 --- a/2008/CVE-2008-0977.md +++ b/2008/CVE-2008-0977.md @@ -13,6 +13,7 @@ Double-Take 5.0.0.2865 and earlier, distributed under the HP StorageWorks Storag - http://aluigi.altervista.org/adv/doubletakedown-adv.txt - http://aluigi.org/poc/doubletakedown.zip - http://securityreason.com/securityalert/3698 +- http://www.securityfocus.com/bid/27951 - http://www.vupen.com/english/advisories/2008/0666 #### Github diff --git a/2008/CVE-2008-0978.md b/2008/CVE-2008-0978.md index a50f7c3b6d..9c59bb5bec 100644 --- a/2008/CVE-2008-0978.md +++ b/2008/CVE-2008-0978.md @@ -13,6 +13,7 @@ Double-Take 5.0.0.2865 and earlier, distributed under the HP StorageWorks Storag - http://aluigi.altervista.org/adv/doubletakedown-adv.txt - http://aluigi.org/poc/doubletakedown.zip - http://securityreason.com/securityalert/3698 +- http://www.securityfocus.com/bid/27951 - http://www.vupen.com/english/advisories/2008/0666 #### Github diff --git a/2008/CVE-2008-0979.md b/2008/CVE-2008-0979.md index 17f1e2261c..4edfd19180 100644 --- a/2008/CVE-2008-0979.md +++ b/2008/CVE-2008-0979.md @@ -13,6 +13,7 @@ Stack consumption vulnerability in Double-Take 5.0.0.2865 and earlier, distribut - http://aluigi.altervista.org/adv/doubletakedown-adv.txt - http://aluigi.org/poc/doubletakedown.zip - http://securityreason.com/securityalert/3698 +- http://www.securityfocus.com/bid/27951 - http://www.vupen.com/english/advisories/2008/0666 #### Github diff --git a/2008/CVE-2008-1233.md b/2008/CVE-2008-1233.md index 169ef75923..20475050ff 100644 --- a/2008/CVE-2008-1233.md +++ b/2008/CVE-2008-1233.md @@ -10,6 +10,7 @@ Unspecified vulnerability in Mozilla Firefox before 2.0.0.13, Thunderbird before ### POC #### Reference +- http://www.securityfocus.com/bid/28448 - http://www.ubuntu.com/usn/usn-592-1 #### Github diff --git a/2008/CVE-2008-1234.md b/2008/CVE-2008-1234.md index 031e9e4c35..ca08ad1fcb 100644 --- a/2008/CVE-2008-1234.md +++ b/2008/CVE-2008-1234.md @@ -10,6 +10,7 @@ Cross-site scripting (XSS) vulnerability in Mozilla Firefox before 2.0.0.13, Thu ### POC #### Reference +- http://www.securityfocus.com/bid/28448 - http://www.ubuntu.com/usn/usn-592-1 - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9551 diff --git a/2008/CVE-2008-1235.md b/2008/CVE-2008-1235.md index b4f0d8b109..b947923832 100644 --- a/2008/CVE-2008-1235.md +++ b/2008/CVE-2008-1235.md @@ -10,6 +10,7 @@ Unspecified vulnerability in Mozilla Firefox before 2.0.0.13, Thunderbird before ### POC #### Reference +- http://www.securityfocus.com/bid/28448 - http://www.ubuntu.com/usn/usn-592-1 #### Github diff --git a/2008/CVE-2008-1236.md b/2008/CVE-2008-1236.md index 94edc55c44..aed8fb7c57 100644 --- a/2008/CVE-2008-1236.md +++ b/2008/CVE-2008-1236.md @@ -10,6 +10,7 @@ Multiple unspecified vulnerabilities in Mozilla Firefox before 2.0.0.13, Thunder ### POC #### Reference +- http://www.securityfocus.com/bid/28448 - http://www.ubuntu.com/usn/usn-592-1 #### Github diff --git a/2008/CVE-2008-1237.md b/2008/CVE-2008-1237.md index eeddb0f93e..bc06abeef1 100644 --- a/2008/CVE-2008-1237.md +++ b/2008/CVE-2008-1237.md @@ -10,6 +10,7 @@ Multiple unspecified vulnerabilities in Mozilla Firefox before 2.0.0.13, Thunder ### POC #### Reference +- http://www.securityfocus.com/bid/28448 - http://www.ubuntu.com/usn/usn-592-1 - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9651 diff --git a/2008/CVE-2008-1238.md b/2008/CVE-2008-1238.md index ebc4e3a352..f0ac650b46 100644 --- a/2008/CVE-2008-1238.md +++ b/2008/CVE-2008-1238.md @@ -10,6 +10,7 @@ Mozilla Firefox before 2.0.0.13 and SeaMonkey before 1.1.9, when generating the ### POC #### Reference +- http://www.securityfocus.com/bid/28448 - http://www.ubuntu.com/usn/usn-592-1 - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9889 diff --git a/2008/CVE-2008-1240.md b/2008/CVE-2008-1240.md index 3ef833c207..c15246e888 100644 --- a/2008/CVE-2008-1240.md +++ b/2008/CVE-2008-1240.md @@ -10,6 +10,7 @@ LiveConnect in Mozilla Firefox before 2.0.0.13 and SeaMonkey before 1.1.9 does n ### POC #### Reference +- http://www.securityfocus.com/bid/28448 - http://www.ubuntu.com/usn/usn-592-1 #### Github diff --git a/2008/CVE-2008-1241.md b/2008/CVE-2008-1241.md index fb63c8529c..41a938db4e 100644 --- a/2008/CVE-2008-1241.md +++ b/2008/CVE-2008-1241.md @@ -10,6 +10,7 @@ GUI overlay vulnerability in Mozilla Firefox before 2.0.0.13 and SeaMonkey befor ### POC #### Reference +- http://www.securityfocus.com/bid/28448 - http://www.ubuntu.com/usn/usn-592-1 #### Github diff --git a/2008/CVE-2008-1302.md b/2008/CVE-2008-1302.md index c5e9224289..b5166592cb 100644 --- a/2008/CVE-2008-1302.md +++ b/2008/CVE-2008-1302.md @@ -13,6 +13,7 @@ The Perforce service (p4s.exe) in Perforce Server 2007.3/143793 and earlier allo - http://aluigi.altervista.org/adv/perforces-adv.txt - http://aluigi.org/poc/perforces.zip - http://securityreason.com/securityalert/3735 +- http://www.securityfocus.com/bid/28108 #### Github No PoCs found on GitHub currently. diff --git a/2008/CVE-2008-1303.md b/2008/CVE-2008-1303.md index 4da87813ad..8253954a46 100644 --- a/2008/CVE-2008-1303.md +++ b/2008/CVE-2008-1303.md @@ -13,6 +13,7 @@ The Perforce service (p4s.exe) in Perforce Server 2007.3/143793 and earlier allo - http://aluigi.altervista.org/adv/perforces-adv.txt - http://aluigi.org/poc/perforces.zip - http://securityreason.com/securityalert/3735 +- http://www.securityfocus.com/bid/28108 #### Github No PoCs found on GitHub currently. diff --git a/2008/CVE-2008-1338.md b/2008/CVE-2008-1338.md index aeabbbb994..7442207029 100644 --- a/2008/CVE-2008-1338.md +++ b/2008/CVE-2008-1338.md @@ -13,6 +13,7 @@ The Perforce service (p4s.exe) in Perforce Server 2007.3/143793 and earlier allo - http://aluigi.altervista.org/adv/perforces-adv.txt - http://aluigi.org/poc/perforces.zip - http://securityreason.com/securityalert/3735 +- http://www.securityfocus.com/bid/28108 #### Github No PoCs found on GitHub currently. diff --git a/2008/CVE-2008-1689.md b/2008/CVE-2008-1689.md index f520c8e72a..6105816f43 100644 --- a/2008/CVE-2008-1689.md +++ b/2008/CVE-2008-1689.md @@ -12,6 +12,7 @@ Stack consumption vulnerability in WebContainer.exe 1.0.0.336 and earlier in SLM #### Reference - http://aluigi.altervista.org/adv/slmaildos-adv.txt - http://aluigi.org/poc/slmaildos.zip +- http://www.securityfocus.com/bid/28505 #### Github No PoCs found on GitHub currently. diff --git a/2008/CVE-2008-1690.md b/2008/CVE-2008-1690.md index d37e41b86a..719caebb6a 100644 --- a/2008/CVE-2008-1690.md +++ b/2008/CVE-2008-1690.md @@ -11,6 +11,7 @@ WebContainer.exe 1.0.0.336 and earlier in SLMail Pro 6.3.1.0 and earlier allows #### Reference - http://aluigi.org/poc/slmaildos.zip +- http://www.securityfocus.com/bid/28505 #### Github No PoCs found on GitHub currently. diff --git a/2008/CVE-2008-1691.md b/2008/CVE-2008-1691.md index 726fc7c8c7..cb329c6706 100644 --- a/2008/CVE-2008-1691.md +++ b/2008/CVE-2008-1691.md @@ -11,6 +11,7 @@ Unspecified vulnerability in SLMail.exe in SLMail Pro 6.3.1.0 and earlier allows #### Reference - http://aluigi.altervista.org/adv/slmaildos-adv.txt +- http://www.securityfocus.com/bid/28505 #### Github No PoCs found on GitHub currently. diff --git a/2008/CVE-2008-1705.md b/2008/CVE-2008-1705.md index 01313a0b04..725254d33b 100644 --- a/2008/CVE-2008-1705.md +++ b/2008/CVE-2008-1705.md @@ -12,6 +12,7 @@ Format string vulnerability in the logging function in IBM solidDB 06.00.1018 an #### Reference - http://aluigi.altervista.org/adv/soliduro-adv.txt - http://aluigi.org/poc/soliduro.zip +- http://www.securityfocus.com/bid/28468 #### Github No PoCs found on GitHub currently. diff --git a/2008/CVE-2008-1706.md b/2008/CVE-2008-1706.md index c03291140a..5183104b7a 100644 --- a/2008/CVE-2008-1706.md +++ b/2008/CVE-2008-1706.md @@ -12,6 +12,7 @@ Uncontrolled array index in IBM solidDB 06.00.1018 and earlier allows remote att #### Reference - http://aluigi.altervista.org/adv/soliduro-adv.txt - http://aluigi.org/poc/soliduro.zip +- http://www.securityfocus.com/bid/28468 #### Github No PoCs found on GitHub currently. diff --git a/2008/CVE-2008-1707.md b/2008/CVE-2008-1707.md index 546fd81f44..0aa11fbc5c 100644 --- a/2008/CVE-2008-1707.md +++ b/2008/CVE-2008-1707.md @@ -12,6 +12,7 @@ IBM solidDB 06.00.1018 and earlier allows remote attackers to cause a denial of #### Reference - http://aluigi.altervista.org/adv/soliduro-adv.txt - http://aluigi.org/poc/soliduro.zip +- http://www.securityfocus.com/bid/28468 #### Github No PoCs found on GitHub currently. diff --git a/2008/CVE-2008-1708.md b/2008/CVE-2008-1708.md index 97ae9bbd20..e86df40020 100644 --- a/2008/CVE-2008-1708.md +++ b/2008/CVE-2008-1708.md @@ -12,6 +12,7 @@ IBM solidDB 06.00.1018 and earlier does not validate a certain field that specif #### Reference - http://aluigi.altervista.org/adv/soliduro-adv.txt - http://aluigi.org/poc/soliduro.zip +- http://www.securityfocus.com/bid/28468 #### Github No PoCs found on GitHub currently. diff --git a/2008/CVE-2008-3396.md b/2008/CVE-2008-3396.md index d05501e2c4..6fa376f1c0 100644 --- a/2008/CVE-2008-3396.md +++ b/2008/CVE-2008-3396.md @@ -12,6 +12,7 @@ Unreal Tournament 2004 (UT2004) 3369 and earlier allows remote attackers to caus #### Reference - http://aluigi.altervista.org/adv/ut2004null-adv.txt - http://aluigi.org/poc/ut2004null.zip +- http://www.securityfocus.com/bid/30427 #### Github No PoCs found on GitHub currently. diff --git a/2008/CVE-2008-5158.md b/2008/CVE-2008-5158.md index 6b89ff6e2e..dc307948a6 100644 --- a/2008/CVE-2008-5158.md +++ b/2008/CVE-2008-5158.md @@ -13,6 +13,7 @@ Client Software WinCom LPD Total 3.0.2.623 and earlier allows remote attackers t - http://aluigi.org/adv/wincomalpd-adv.txt - http://aluigi.org/poc/wincomalpd.zip - http://securityreason.com/securityalert/4610 +- http://www.securityfocus.com/bid/27614 #### Github No PoCs found on GitHub currently. diff --git a/2008/CVE-2008-5159.md b/2008/CVE-2008-5159.md index 751cf95f2f..9843f03f17 100644 --- a/2008/CVE-2008-5159.md +++ b/2008/CVE-2008-5159.md @@ -13,6 +13,7 @@ Integer overflow in the remote administration protocol processing in Client Soft - http://aluigi.org/adv/wincomalpd-adv.txt - http://aluigi.org/poc/wincomalpd.zip - http://securityreason.com/securityalert/4610 +- http://www.securityfocus.com/bid/27614 #### Github No PoCs found on GitHub currently. diff --git a/2008/CVE-2008-5176.md b/2008/CVE-2008-5176.md index 8b25a9430b..c4b1a1f8e5 100644 --- a/2008/CVE-2008-5176.md +++ b/2008/CVE-2008-5176.md @@ -13,6 +13,7 @@ Multiple buffer overflows in Client Software WinCom LPD Total 3.0.2.623 and earl - http://aluigi.org/adv/wincomalpd-adv.txt - http://aluigi.org/poc/wincomalpd.zip - http://securityreason.com/securityalert/4610 +- http://www.securityfocus.com/bid/27614 #### Github No PoCs found on GitHub currently. diff --git a/2008/CVE-2008-5279.md b/2008/CVE-2008-5279.md index b5c36305f5..ae7714ebf0 100644 --- a/2008/CVE-2008-5279.md +++ b/2008/CVE-2008-5279.md @@ -12,6 +12,7 @@ The Local ZIM Server (zcs.exe) in Zilab Chat and Instant Messaging (ZIM) Server #### Reference - http://aluigi.altervista.org/adv/zilabzcsx-adv.txt - http://aluigi.org/poc/zilabzcsx.zip +- http://www.securityfocus.com/bid/27940 #### Github No PoCs found on GitHub currently. diff --git a/2008/CVE-2008-5280.md b/2008/CVE-2008-5280.md index 8389aeebb0..ac506c34b9 100644 --- a/2008/CVE-2008-5280.md +++ b/2008/CVE-2008-5280.md @@ -12,6 +12,7 @@ The Local ZIM Server in Zilab Chat and Instant Messaging (ZIM) Server 2.0 and 2. #### Reference - http://aluigi.altervista.org/adv/zilabzcsx-adv.txt - http://aluigi.org/poc/zilabzcsx.zip +- http://www.securityfocus.com/bid/27940 #### Github No PoCs found on GitHub currently. diff --git a/2008/CVE-2008-6670.md b/2008/CVE-2008-6670.md index 9f7d50a9e8..33b76b6aa6 100644 --- a/2008/CVE-2008-6670.md +++ b/2008/CVE-2008-6670.md @@ -12,6 +12,7 @@ Integer overflow in Vertex4 SunAge 1.08.1 and earlier allows remote attackers to #### Reference - http://aluigi.altervista.org/adv/sunagex-adv.txt - http://aluigi.org/poc/sunagex.zip +- http://www.securityfocus.com/bid/29889 #### Github No PoCs found on GitHub currently. diff --git a/2008/CVE-2008-6671.md b/2008/CVE-2008-6671.md index d105fd4f07..e9a7915efb 100644 --- a/2008/CVE-2008-6671.md +++ b/2008/CVE-2008-6671.md @@ -12,6 +12,7 @@ Vertex4 SunAge 1.08.1 and earlier allows remote attackers to cause a denial of s #### Reference - http://aluigi.altervista.org/adv/sunagex-adv.txt - http://aluigi.org/poc/sunagex.zip +- http://www.securityfocus.com/bid/29889 #### Github No PoCs found on GitHub currently. diff --git a/2008/CVE-2008-6672.md b/2008/CVE-2008-6672.md index 59636fa2ab..965744a041 100644 --- a/2008/CVE-2008-6672.md +++ b/2008/CVE-2008-6672.md @@ -12,6 +12,7 @@ Vertex4 SunAge 1.08.1 and earlier allows remote attackers to cause a denial of s #### Reference - http://aluigi.altervista.org/adv/sunagex-adv.txt - http://aluigi.org/poc/sunagex.zip +- http://www.securityfocus.com/bid/29889 #### Github No PoCs found on GitHub currently. diff --git a/2008/CVE-2008-6995.md b/2008/CVE-2008-6995.md index 0d19d74028..feb4a1271b 100644 --- a/2008/CVE-2008-6995.md +++ b/2008/CVE-2008-6995.md @@ -11,6 +11,7 @@ Integer underflow in net/base/escape.cc in chrome.dll in Google Chrome 0.2.149.2 #### Reference - http://evilfingers.com/advisory/google_chrome_poc.php +- http://www.securityfocus.com/bid/30983 - https://www.evilfingers.com/advisory/Google_Chrome_Browser_0.2.149.27_in_chrome_dll.php - https://www.exploit-db.com/exploits/6353 diff --git a/2010/CVE-2010-1277.md b/2010/CVE-2010-1277.md index 31ba82139e..1059d4e474 100644 --- a/2010/CVE-2010-1277.md +++ b/2010/CVE-2010-1277.md @@ -11,6 +11,7 @@ SQL injection vulnerability in the user.authenticate method in the API in Zabbix #### Reference - http://legalhackers.com/advisories/zabbix181api-sql.txt +- http://www.securityfocus.com/bid/39148 #### Github No PoCs found on GitHub currently. diff --git a/2010/CVE-2010-2621.md b/2010/CVE-2010-2621.md index d40667694e..0227a8ae04 100644 --- a/2010/CVE-2010-2621.md +++ b/2010/CVE-2010-2621.md @@ -12,6 +12,7 @@ The QSslSocketBackendPrivate::transmit function in src_network_ssl_qsslsocket_op #### Reference - http://aluigi.org/adv/qtsslame-adv.txt - http://aluigi.org/poc/qtsslame.zip +- http://www.securityfocus.com/bid/41250 #### Github - https://github.com/ARPSyndicate/cve-scores diff --git a/2011/CVE-2011-4858.md b/2011/CVE-2011-4858.md index 4fc392dee1..6159fe69dc 100644 --- a/2011/CVE-2011-4858.md +++ b/2011/CVE-2011-4858.md @@ -11,6 +11,7 @@ Apache Tomcat before 5.5.35, 6.x before 6.0.35, and 7.x before 7.0.23 computes h #### Reference - http://www.ocert.org/advisories/ocert-2011-003.html +- http://www.securityfocus.com/bid/51200 - https://github.com/FireFart/HashCollision-DOS-POC/blob/master/HashtablePOC.py #### Github diff --git a/2011/CVE-2011-4885.md b/2011/CVE-2011-4885.md index 437111d50c..7f090b9911 100644 --- a/2011/CVE-2011-4885.md +++ b/2011/CVE-2011-4885.md @@ -15,6 +15,7 @@ PHP before 5.3.9 computes hash values for form parameters without restricting th - http://www.ocert.org/advisories/ocert-2011-003.html - http://www.oracle.com/technetwork/topics/security/cpujul2012-392727.html - http://www.redhat.com/support/errata/RHSA-2012-0019.html +- http://www.securityfocus.com/bid/51193 - https://github.com/FireFart/HashCollision-DOS-POC/blob/master/HashtablePOC.py #### Github diff --git a/2012/CVE-2012-4929.md b/2012/CVE-2012-4929.md index 1d67846244..f41d1291a4 100644 --- a/2012/CVE-2012-4929.md +++ b/2012/CVE-2012-4929.md @@ -13,6 +13,7 @@ The TLS protocol 1.2 and earlier, as used in Mozilla Firefox, Google Chrome, Qt, - http://security.stackexchange.com/questions/19911/crime-how-to-beat-the-beast-successor - http://threatpost.com/en_us/blogs/crime-attack-uses-compression-ratio-tls-requests-side-channel-hijack-secure-sessions-091312 - http://threatpost.com/en_us/blogs/new-attack-uses-ssltls-information-leak-hijack-https-sessions-090512 +- http://www.securityfocus.com/bid/55704 - http://www.theregister.co.uk/2012/09/14/crime_tls_attack/ - http://www.ubuntu.com/usn/USN-1898-1 - https://community.qualys.com/blogs/securitylabs/2012/09/14/crime-information-leakage-attack-against-ssltls diff --git a/2013/CVE-2013-0183.md b/2013/CVE-2013-0183.md new file mode 100644 index 0000000000..5834785e9e --- /dev/null +++ b/2013/CVE-2013-0183.md @@ -0,0 +1,17 @@ +### [CVE-2013-0183](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0183) +![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen) + +### Description + +multipart/parser.rb in Rack 1.3.x before 1.3.8 and 1.4.x before 1.4.3 allows remote attackers to cause a denial of service (memory consumption and out-of-memory error) via a long string in a Multipart HTTP packet. + +### POC + +#### Reference +- https://groups.google.com/forum/#%21topic/rack-devel/7ZKPNAjgRSs + +#### Github +No PoCs found on GitHub currently. + diff --git a/2013/CVE-2013-3245.md b/2013/CVE-2013-3245.md index 0dd13d8e6d..95284c0f16 100644 --- a/2013/CVE-2013-3245.md +++ b/2013/CVE-2013-3245.md @@ -15,6 +15,7 @@ plugins/demux/libmkv_plugin.dll in VideoLAN VLC Media Player 2.0.7, and possibly - http://seclists.org/fulldisclosure/2013/Jul/79 - http://secunia.com/blog/372/ - http://www.jbkempf.com/blog/post/2013/More-lies-from-Secunia +- http://www.securityfocus.com/bid/61032 #### Github No PoCs found on GitHub currently. diff --git a/2013/CVE-2013-3505.md b/2013/CVE-2013-3505.md index 6776b99d92..3b30c93a26 100644 --- a/2013/CVE-2013-3505.md +++ b/2013/CVE-2013-3505.md @@ -11,6 +11,7 @@ The Nagios-App component in GroundWork Monitor Enterprise 6.7.0 allows remote au #### Reference - http://www.kb.cert.org/vuls/id/345260 +- http://www.securityfocus.com/bid/58410 #### Github No PoCs found on GitHub currently. diff --git a/2013/CVE-2013-3632.md b/2013/CVE-2013-3632.md index d4902bf290..59a5ed2757 100644 --- a/2013/CVE-2013-3632.md +++ b/2013/CVE-2013-3632.md @@ -10,6 +10,7 @@ The Cron service in rpc.php in OpenMediaVault allows remote authenticated users ### POC #### Reference +- http://www.securityfocus.com/bid/62873 - https://community.rapid7.com/community/metasploit/blog/2013/10/30/seven-tricks-and-treats #### Github diff --git a/2013/CVE-2013-5015.md b/2013/CVE-2013-5015.md index ffe9c50df2..9c07fa4ccc 100644 --- a/2013/CVE-2013-5015.md +++ b/2013/CVE-2013-5015.md @@ -12,6 +12,7 @@ SQL injection vulnerability in the management console in Symantec Endpoint Prote #### Reference - http://www.exploit-db.com/exploits/31853 - http://www.exploit-db.com/exploits/31917 +- http://www.securityfocus.com/bid/65467 #### Github No PoCs found on GitHub currently. diff --git a/2014/CVE-2014-1644.md b/2014/CVE-2014-1644.md new file mode 100644 index 0000000000..dc82187551 --- /dev/null +++ b/2014/CVE-2014-1644.md @@ -0,0 +1,17 @@ +### [CVE-2014-1644](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1644) +![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen) + +### Description + +The forgotten-password feature in forcepasswd.do in the management GUI in Symantec LiveUpdate Administrator (LUA) 2.x before 2.3.2.110 allows remote attackers to reset arbitrary passwords by providing the e-mail address associated with a user account. + +### POC + +#### Reference +- http://www.securityfocus.com/bid/66399 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2014/CVE-2014-1645.md b/2014/CVE-2014-1645.md new file mode 100644 index 0000000000..3a05f23f61 --- /dev/null +++ b/2014/CVE-2014-1645.md @@ -0,0 +1,17 @@ +### [CVE-2014-1645](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1645) +![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen) + +### Description + +SQL injection vulnerability in forcepasswd.do in the management GUI in Symantec LiveUpdate Administrator (LUA) 2.x before 2.3.2.110 allows remote attackers to execute arbitrary SQL commands via unspecified vectors. + +### POC + +#### Reference +- http://www.securityfocus.com/bid/66400 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2014/CVE-2014-1836.md b/2014/CVE-2014-1836.md index 0b2c8ee552..e9615330e2 100644 --- a/2014/CVE-2014-1836.md +++ b/2014/CVE-2014-1836.md @@ -11,6 +11,7 @@ Absolute path traversal vulnerability in htdocs/libraries/image-editor/image-edi #### Reference - http://seclists.org/fulldisclosure/2014/Feb/14 +- http://www.securityfocus.com/bid/65279 - https://github.com/pedrib/PoC/blob/master/generic/impresscms-1.3.5.txt #### Github diff --git a/2014/CVE-2014-2734.md b/2014/CVE-2014-2734.md index 8285a21ccd..203e96cb71 100644 --- a/2014/CVE-2014-2734.md +++ b/2014/CVE-2014-2734.md @@ -13,6 +13,7 @@ The openssl extension in Ruby 2.x does not properly maintain the state of proces - http://packetstormsecurity.com/files/126218/Ruby-OpenSSL-Private-Key-Spoofing.html - http://seclists.org/fulldisclosure/2014/Apr/231 - http://seclists.org/fulldisclosure/2014/May/13 +- http://www.securityfocus.com/bid/66956 - https://gist.github.com/emboss/91696b56cd227c8a0c13 - https://news.ycombinator.com/item?id=7601973 - https://www.ruby-lang.org/en/news/2014/05/09/dispute-of-vulnerability-cve-2014-2734/ diff --git a/2014/CVE-2014-3704.md b/2014/CVE-2014-3704.md index ff7ee22b36..8a1623febe 100644 --- a/2014/CVE-2014-3704.md +++ b/2014/CVE-2014-3704.md @@ -18,6 +18,7 @@ The expandArguments function in the database abstraction API in Drupal core 7.x - http://www.exploit-db.com/exploits/34993 - http://www.exploit-db.com/exploits/35150 - http://www.openwall.com/lists/oss-security/2014/10/15/23 +- http://www.securityfocus.com/bid/70595 - https://www.sektioneins.de/en/advisories/advisory-012014-drupal-pre-auth-sql-injection-vulnerability.html - https://www.sektioneins.de/en/blog/14-11-03-drupal-sql-injection-vulnerability-PoC.html diff --git a/2014/CVE-2014-4873.md b/2014/CVE-2014-4873.md index 4e24d325e6..5c71556d8f 100644 --- a/2014/CVE-2014-4873.md +++ b/2014/CVE-2014-4873.md @@ -11,6 +11,7 @@ SQL injection vulnerability in TrackItWeb/Grid/GetData in BMC Track-It! 11.3.0.3 #### Reference - http://packetstormsecurity.com/files/128594/BMC-Track-it-Remote-Code-Execution-SQL-Injection.html +- http://www.securityfocus.com/bid/70268 #### Github No PoCs found on GitHub currently. diff --git a/2014/CVE-2014-5377.md b/2014/CVE-2014-5377.md index aafcf23c74..8f15ebd6f2 100644 --- a/2014/CVE-2014-5377.md +++ b/2014/CVE-2014-5377.md @@ -15,6 +15,7 @@ ReadUsersFromMasterServlet in ManageEngine DeviceExpert before 5.9 build 5981 al - http://seclists.org/fulldisclosure/2014/Aug/76 - http://seclists.org/fulldisclosure/2014/Aug/84 - http://www.exploit-db.com/exploits/34449 +- http://www.securityfocus.com/bid/69443 #### Github No PoCs found on GitHub currently. diff --git a/2014/CVE-2014-5445.md b/2014/CVE-2014-5445.md index 06bf42947f..40f83e6dc7 100644 --- a/2014/CVE-2014-5445.md +++ b/2014/CVE-2014-5445.md @@ -12,6 +12,7 @@ Multiple absolute path traversal vulnerabilities in ZOHO ManageEngine Netflow An #### Reference - http://packetstormsecurity.com/files/129336/ManageEngine-Netflow-Analyzer-IT360-File-Download.html - http://seclists.org/fulldisclosure/2014/Dec/9 +- http://www.securityfocus.com/bid/71404 - https://github.com/rapid7/metasploit-framework/pull/4282 #### Github diff --git a/2014/CVE-2014-5446.md b/2014/CVE-2014-5446.md index 87017674e1..8b0b19a66d 100644 --- a/2014/CVE-2014-5446.md +++ b/2014/CVE-2014-5446.md @@ -12,6 +12,7 @@ Directory traversal vulnerability in the DisplayChartPDF servlet in ZOHO ManageE #### Reference - http://packetstormsecurity.com/files/129336/ManageEngine-Netflow-Analyzer-IT360-File-Download.html - http://seclists.org/fulldisclosure/2014/Dec/9 +- http://www.securityfocus.com/bid/71404 #### Github No PoCs found on GitHub currently. diff --git a/2014/CVE-2014-7862.md b/2014/CVE-2014-7862.md index 935ccd7e67..23a05c58e8 100644 --- a/2014/CVE-2014-7862.md +++ b/2014/CVE-2014-7862.md @@ -12,6 +12,7 @@ The DCPluginServelet servlet in ManageEngine Desktop Central and Desktop Central #### Reference - http://packetstormsecurity.com/files/129769/Desktop-Central-Add-Administrator.html - http://seclists.org/fulldisclosure/2015/Jan/2 +- http://www.securityfocus.com/bid/71849 - https://github.com/pedrib/PoC/blob/master/advisories/ManageEngine/me_dc9_admin.txt - https://www.rapid7.com/db/modules/auxiliary/admin/http/manage_engine_dc_create_admin diff --git a/2014/CVE-2014-7868.md b/2014/CVE-2014-7868.md index c5c60f0b57..7073d98a8a 100644 --- a/2014/CVE-2014-7868.md +++ b/2014/CVE-2014-7868.md @@ -12,6 +12,7 @@ Multiple SQL injection vulnerabilities in ZOHO ManageEngine OpManager 11.3 and 1 #### Reference - http://packetstormsecurity.com/files/129037/ManageEngine-OpManager-Social-IT-Plus-IT360-File-Upload-SQL-Injection.html - http://seclists.org/fulldisclosure/2014/Nov/21 +- http://www.securityfocus.com/bid/71002 #### Github No PoCs found on GitHub currently. diff --git a/2014/CVE-2014-8146.md b/2014/CVE-2014-8146.md index b6a90733ab..3e7486f1b2 100644 --- a/2014/CVE-2014-8146.md +++ b/2014/CVE-2014-8146.md @@ -16,6 +16,7 @@ The resolveImplicitLevels function in common/ubidi.c in the Unicode Bidirectiona - http://www.kb.cert.org/vuls/id/602540 - http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html - http://www.oracle.com/technetwork/topics/security/cpuoct2015-2367953.html +- http://www.securityfocus.com/bid/74457 - https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html #### Github diff --git a/2014/CVE-2014-8147.md b/2014/CVE-2014-8147.md index 29d38c3fde..d47f01320a 100644 --- a/2014/CVE-2014-8147.md +++ b/2014/CVE-2014-8147.md @@ -16,6 +16,7 @@ The resolveImplicitLevels function in common/ubidi.c in the Unicode Bidirectiona - http://www.kb.cert.org/vuls/id/602540 - http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html - http://www.oracle.com/technetwork/topics/security/cpuoct2015-2367953.html +- http://www.securityfocus.com/bid/74457 - https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html #### Github diff --git a/2014/CVE-2014-8499.md b/2014/CVE-2014-8499.md index 5d8147a022..609791d93a 100644 --- a/2014/CVE-2014-8499.md +++ b/2014/CVE-2014-8499.md @@ -13,6 +13,7 @@ Multiple SQL injection vulnerabilities in ManageEngine Password Manager Pro (PMP - http://packetstormsecurity.com/files/129036/Password-Manager-Pro-SQL-Injection.html - http://seclists.org/fulldisclosure/2014/Nov/18 - http://www.exploit-db.com/exploits/35210 +- http://www.securityfocus.com/bid/71018 #### Github No PoCs found on GitHub currently. diff --git a/2014/CVE-2014-9515.md b/2014/CVE-2014-9515.md index 63b2291547..c21a091530 100644 --- a/2014/CVE-2014-9515.md +++ b/2014/CVE-2014-9515.md @@ -11,6 +11,7 @@ Dozer improperly uses a reflection-based approach to type conversion, which migh ### POC #### Reference +- http://www.securityfocus.com/bid/107970 - https://github.com/DozerMapper/dozer/issues/217 - https://github.com/pentestingforfunandprofit/research/tree/master/dozer-rce - https://www.oracle.com/security-alerts/cpuApr2021.html diff --git a/2015/CVE-2015-0072.md b/2015/CVE-2015-0072.md index aca5f56561..0612fceb39 100644 --- a/2015/CVE-2015-0072.md +++ b/2015/CVE-2015-0072.md @@ -13,6 +13,7 @@ Cross-site scripting (XSS) vulnerability in Microsoft Internet Explorer 9 throug - http://innerht.ml/blog/ie-uxss.html - http://packetstormsecurity.com/files/130308/Microsoft-Internet-Explorer-Universal-XSS-Proof-Of-Concept.html - http://www.pcworld.com/article/2879372/dangerous-ie-vulnerability-opens-door-to-powerful-phishing-attacks.html +- http://www.securityfocus.com/bid/72489 - https://nakedsecurity.sophos.com/2015/02/04/internet-explorer-has-a-cross-site-scripting-zero-day-bug/ #### Github diff --git a/2015/CVE-2015-4460.md b/2015/CVE-2015-4460.md index 3431456247..c89435f3a6 100644 --- a/2015/CVE-2015-4460.md +++ b/2015/CVE-2015-4460.md @@ -10,6 +10,7 @@ Cross-site request forgery (CSRF) vulnerability in SecuritySetting/UserSecurity/ ### POC #### Reference +- http://www.securityfocus.com/bid/75569 - https://packetstormsecurity.com/files/132475/C2Box-4.0.0-r19171-Cross-Site-Request-Forgery.html - https://raw.githubusercontent.com/Siros96/CSRF/master/PoC - https://www.exploit-db.com/exploits/37447/ diff --git a/2015/CVE-2015-4640.md b/2015/CVE-2015-4640.md index 69ac3972d3..30f1d61596 100644 --- a/2015/CVE-2015-4640.md +++ b/2015/CVE-2015-4640.md @@ -11,6 +11,7 @@ The SwiftKey language-pack update implementation on Samsung Galaxy S4, S4 Mini, #### Reference - http://www.kb.cert.org/vuls/id/155412 +- http://www.securityfocus.com/bid/75347 - https://github.com/nowsecure/samsung-ime-rce-poc/ - https://www.nowsecure.com/blog/2015/06/16/remote-code-execution-as-system-user-on-samsung-phones/ diff --git a/2015/CVE-2015-4641.md b/2015/CVE-2015-4641.md index 19cbefa67b..993e13b666 100644 --- a/2015/CVE-2015-4641.md +++ b/2015/CVE-2015-4641.md @@ -11,6 +11,7 @@ Directory traversal vulnerability in the SwiftKey language-pack update implement #### Reference - http://www.kb.cert.org/vuls/id/155412 +- http://www.securityfocus.com/bid/75353 - https://github.com/nowsecure/samsung-ime-rce-poc/ - https://www.nowsecure.com/blog/2015/06/16/remote-code-execution-as-system-user-on-samsung-phones/ diff --git a/2015/CVE-2015-8370.md b/2015/CVE-2015-8370.md index a800e7f7b7..3f65583026 100644 --- a/2015/CVE-2015-8370.md +++ b/2015/CVE-2015-8370.md @@ -14,6 +14,7 @@ Multiple integer underflows in Grub2 1.98 through 2.02 allow physically proximat - http://packetstormsecurity.com/files/134831/Grub2-Authentication-Bypass.html - http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html - http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html +- http://www.securityfocus.com/bid/79358 #### Github - https://github.com/integeruser/on-pwning diff --git a/2016/CVE-2016-0450.md b/2016/CVE-2016-0450.md index 0e54491504..8626982e4e 100644 --- a/2016/CVE-2016-0450.md +++ b/2016/CVE-2016-0450.md @@ -11,6 +11,7 @@ Unspecified vulnerability in the Oracle GoldenGate component in Oracle GoldenGat #### Reference - http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html +- http://www.securityfocus.com/bid/81117 #### Github - https://github.com/ARPSyndicate/cvemon diff --git a/2016/CVE-2016-0451.md b/2016/CVE-2016-0451.md index ed29ba4cc6..f6478c5093 100644 --- a/2016/CVE-2016-0451.md +++ b/2016/CVE-2016-0451.md @@ -11,6 +11,7 @@ Unspecified vulnerability in the Oracle GoldenGate component in Oracle GoldenGat #### Reference - http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html +- http://www.securityfocus.com/bid/81125 #### Github - https://github.com/ARPSyndicate/cvemon diff --git a/2016/CVE-2016-10174.md b/2016/CVE-2016-10174.md index b36512dba6..2281d61165 100644 --- a/2016/CVE-2016-10174.md +++ b/2016/CVE-2016-10174.md @@ -11,6 +11,7 @@ The NETGEAR WNR2000v5 router contains a buffer overflow in the hidden_lang_avi p #### Reference - http://seclists.org/fulldisclosure/2016/Dec/72 +- http://www.securityfocus.com/bid/95867 - https://raw.githubusercontent.com/pedrib/PoC/master/advisories/netgear-wnr2000.txt - https://www.exploit-db.com/exploits/40949/ - https://www.exploit-db.com/exploits/41719/ diff --git a/2016/CVE-2016-10175.md b/2016/CVE-2016-10175.md index 1af79b0bee..01365c2e0a 100644 --- a/2016/CVE-2016-10175.md +++ b/2016/CVE-2016-10175.md @@ -11,6 +11,7 @@ The NETGEAR WNR2000v5 router leaks its serial number when performing a request t #### Reference - http://seclists.org/fulldisclosure/2016/Dec/72 +- http://www.securityfocus.com/bid/95867 - https://raw.githubusercontent.com/pedrib/PoC/master/advisories/netgear-wnr2000.txt - https://www.exploit-db.com/exploits/40949/ diff --git a/2016/CVE-2016-10176.md b/2016/CVE-2016-10176.md index eebea55271..80b58658c5 100644 --- a/2016/CVE-2016-10176.md +++ b/2016/CVE-2016-10176.md @@ -11,6 +11,7 @@ The NETGEAR WNR2000v5 router allows an administrator to perform sensitive action #### Reference - http://seclists.org/fulldisclosure/2016/Dec/72 +- http://www.securityfocus.com/bid/95867 - https://raw.githubusercontent.com/pedrib/PoC/master/advisories/netgear-wnr2000.txt - https://www.exploit-db.com/exploits/40949/ diff --git a/2016/CVE-2016-4075.md b/2016/CVE-2016-4075.md index 9dae73f452..b2c5d4f9cb 100644 --- a/2016/CVE-2016-4075.md +++ b/2016/CVE-2016-4075.md @@ -11,6 +11,7 @@ Opera Mini 13 and Opera Stable 36 allow remote attackers to spoof the displayed #### Reference - http://abhikafle.com.np/opera-url-spoofing-poc/ +- http://www.securityfocus.com/bid/98004 #### Github - https://github.com/ARPSyndicate/cvemon diff --git a/2016/CVE-2016-5195.md b/2016/CVE-2016-5195.md index a461acb5bc..d612f865ba 100644 --- a/2016/CVE-2016-5195.md +++ b/2016/CVE-2016-5195.md @@ -21,6 +21,7 @@ Race condition in mm/gup.c in the Linux kernel 2.x through 4.x before 4.8.3 allo - http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20161026-linux - http://www.openwall.com/lists/oss-security/2022/03/07/1 - http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html +- http://www.securityfocus.com/bid/93793 - http://www.ubuntu.com/usn/USN-3106-1 - https://bugzilla.redhat.com/show_bug.cgi?id=1384344 - https://github.com/dirtycow/dirtycow.github.io/wiki/PoCs diff --git a/2016/CVE-2016-5346.md b/2016/CVE-2016-5346.md index d756f5be5b..313ea26380 100644 --- a/2016/CVE-2016-5346.md +++ b/2016/CVE-2016-5346.md @@ -10,6 +10,7 @@ An Information Disclosure vulnerability exists in the Google Pixel/Pixel SL Qual ### POC #### Reference +- http://www.securityfocus.com/bid/97371 - https://github.com/ele7enxxh/poc-exp/tree/master/CVE-2016-5346 #### Github diff --git a/2016/CVE-2016-6600.md b/2016/CVE-2016-6600.md index 09f7158c80..0102f33347 100644 --- a/2016/CVE-2016-6600.md +++ b/2016/CVE-2016-6600.md @@ -12,6 +12,7 @@ Directory traversal vulnerability in the file upload functionality in ZOHO WebNM #### Reference - http://packetstormsecurity.com/files/138244/WebNMS-Framework-5.2-SP1-Traversal-Weak-Obfuscation-User-Impersonation.html - http://seclists.org/fulldisclosure/2016/Aug/54 +- http://www.securityfocus.com/bid/92402 - https://github.com/pedrib/PoC/blob/master/advisories/webnms-5.2-sp1-pwn.txt - https://www.exploit-db.com/exploits/40229/ diff --git a/2016/CVE-2016-6601.md b/2016/CVE-2016-6601.md index d79bfd837c..dfe93f9465 100644 --- a/2016/CVE-2016-6601.md +++ b/2016/CVE-2016-6601.md @@ -12,6 +12,7 @@ Directory traversal vulnerability in the file download functionality in ZOHO Web #### Reference - http://packetstormsecurity.com/files/138244/WebNMS-Framework-5.2-SP1-Traversal-Weak-Obfuscation-User-Impersonation.html - http://seclists.org/fulldisclosure/2016/Aug/54 +- http://www.securityfocus.com/bid/92402 - https://github.com/pedrib/PoC/blob/master/advisories/webnms-5.2-sp1-pwn.txt - https://www.exploit-db.com/exploits/40229/ diff --git a/2016/CVE-2016-6602.md b/2016/CVE-2016-6602.md index b43f942e2d..b15f4bc18c 100644 --- a/2016/CVE-2016-6602.md +++ b/2016/CVE-2016-6602.md @@ -12,6 +12,7 @@ ZOHO WebNMS Framework 5.2 and 5.2 SP1 use a weak obfuscation algorithm to store #### Reference - http://packetstormsecurity.com/files/138244/WebNMS-Framework-5.2-SP1-Traversal-Weak-Obfuscation-User-Impersonation.html - http://seclists.org/fulldisclosure/2016/Aug/54 +- http://www.securityfocus.com/bid/92402 - https://github.com/pedrib/PoC/blob/master/advisories/webnms-5.2-sp1-pwn.txt - https://www.exploit-db.com/exploits/40229/ diff --git a/2016/CVE-2016-6603.md b/2016/CVE-2016-6603.md index 2b8d3af825..c625a35249 100644 --- a/2016/CVE-2016-6603.md +++ b/2016/CVE-2016-6603.md @@ -12,6 +12,7 @@ ZOHO WebNMS Framework 5.2 and 5.2 SP1 allows remote attackers to bypass authenti #### Reference - http://packetstormsecurity.com/files/138244/WebNMS-Framework-5.2-SP1-Traversal-Weak-Obfuscation-User-Impersonation.html - http://seclists.org/fulldisclosure/2016/Aug/54 +- http://www.securityfocus.com/bid/92402 - https://github.com/pedrib/PoC/blob/master/advisories/webnms-5.2-sp1-pwn.txt - https://www.exploit-db.com/exploits/40229/ diff --git a/2016/CVE-2016-9445.md b/2016/CVE-2016-9445.md index c4e9cdff94..26a0d24ce5 100644 --- a/2016/CVE-2016-9445.md +++ b/2016/CVE-2016-9445.md @@ -12,6 +12,7 @@ Integer overflow in the vmnc decoder in the gstreamer allows remote attackers to #### Reference - http://www.openwall.com/lists/oss-security/2016/11/18/12 - http://www.openwall.com/lists/oss-security/2016/11/18/13 +- http://www.securityfocus.com/bid/94421 - https://bugzilla.gnome.org/show_bug.cgi?id=774533 - https://cgit.freedesktop.org/gstreamer/gst-plugins-bad/commit/gst/vmnc/vmncdec.c?id=4cb1bcf1422bbcd79c0f683edb7ee85e3f7a31fe - https://scarybeastsecurity.blogspot.de/2016/11/0day-poc-risky-design-decisions-in.html diff --git a/2016/CVE-2016-9446.md b/2016/CVE-2016-9446.md index 873bf92a04..19e49ce530 100644 --- a/2016/CVE-2016-9446.md +++ b/2016/CVE-2016-9446.md @@ -12,6 +12,7 @@ The vmnc decoder in the gstreamer does not initialize the render canvas, which a #### Reference - http://www.openwall.com/lists/oss-security/2016/11/18/12 - http://www.openwall.com/lists/oss-security/2016/11/18/13 +- http://www.securityfocus.com/bid/94423 - https://bugzilla.gnome.org/show_bug.cgi?id=774533 - https://cgit.freedesktop.org/gstreamer/gst-plugins-bad/commit/gst/vmnc/vmncdec.c?id=4cb1bcf1422bbcd79c0f683edb7ee85e3f7a31fe - https://scarybeastsecurity.blogspot.de/2016/11/0day-poc-risky-design-decisions-in.html diff --git a/2017/CVE-2017-2090.md b/2017/CVE-2017-2090.md new file mode 100644 index 0000000000..8edf9bbed4 --- /dev/null +++ b/2017/CVE-2017-2090.md @@ -0,0 +1,17 @@ +### [CVE-2017-2090](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-2090) +![](https://img.shields.io/static/v1?label=Product&message=Cybozu%20Garoon&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=3.0.0%20to%204.2.3%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=SQL%20Injection&color=brightgreen) + +### Description + +Directory traversal vulnerability in CubeCart versions prior to 6.1.4 allows remote authenticated attackers to read arbitrary files via unspecified vectors. + +### POC + +#### Reference +- http://www.securityfocus.com/bid/96429 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2017/CVE-2017-2091.md b/2017/CVE-2017-2091.md new file mode 100644 index 0000000000..99acb079c2 --- /dev/null +++ b/2017/CVE-2017-2091.md @@ -0,0 +1,17 @@ +### [CVE-2017-2091](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-2091) +![](https://img.shields.io/static/v1?label=Product&message=Cybozu%20Garoon&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=3.0.0%20to%204.2.3%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Fails%20to%20restrict%20access&color=brightgreen) + +### Description + +Cybozu Garoon 3.0.0 to 4.2.3 allows remote authenticated attackers to bypass access restriction in Phone Messages function to alter the status of phone messages via unspecified vectors. + +### POC + +#### Reference +- http://www.securityfocus.com/bid/96429 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2017/CVE-2017-2092.md b/2017/CVE-2017-2092.md new file mode 100644 index 0000000000..9ed11c9e3d --- /dev/null +++ b/2017/CVE-2017-2092.md @@ -0,0 +1,17 @@ +### [CVE-2017-2092](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-2092) +![](https://img.shields.io/static/v1?label=Product&message=Cybozu%20Garoon&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=3.0.0%20to%204.2.3%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Cross-site%20scripting&color=brightgreen) + +### Description + +Cross-site scripting vulnerability in Cybozu Garoon 3.0.0 to 4.2.3 allows remote authenticated attackers to inject arbitrary web script or HTML via unspecified vectors. + +### POC + +#### Reference +- http://www.securityfocus.com/bid/96429 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2017/CVE-2017-2093.md b/2017/CVE-2017-2093.md new file mode 100644 index 0000000000..c17c6bc58a --- /dev/null +++ b/2017/CVE-2017-2093.md @@ -0,0 +1,17 @@ +### [CVE-2017-2093](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-2093) +![](https://img.shields.io/static/v1?label=Product&message=Cybozu%20Garoon&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=3.0.0%20to%204.2.3%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Information%20Disclosure&color=brightgreen) + +### Description + +Cybozu Garoon 3.0.0 to 4.2.3 allow remote attackers to obtain tokens used for CSRF protection via unspecified vectors. + +### POC + +#### Reference +- http://www.securityfocus.com/bid/96429 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2017/CVE-2017-2094.md b/2017/CVE-2017-2094.md new file mode 100644 index 0000000000..ec2d55a34d --- /dev/null +++ b/2017/CVE-2017-2094.md @@ -0,0 +1,17 @@ +### [CVE-2017-2094](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-2094) +![](https://img.shields.io/static/v1?label=Product&message=Cybozu%20Garoon&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=3.0.0%20to%204.2.3%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Fails%20to%20restrict%20access&color=brightgreen) + +### Description + +Cybozu Garoon 3.0.0 to 4.2.3 allows remote authenticated attackers to bypass access restriction in Workflow and the "MultiReport" function to alter or delete information via unspecified vectors. + +### POC + +#### Reference +- http://www.securityfocus.com/bid/96429 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2017/CVE-2017-2095.md b/2017/CVE-2017-2095.md new file mode 100644 index 0000000000..72b26679c9 --- /dev/null +++ b/2017/CVE-2017-2095.md @@ -0,0 +1,17 @@ +### [CVE-2017-2095](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-2095) +![](https://img.shields.io/static/v1?label=Product&message=Cybozu%20Garoon&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=3.0.0%20to%204.2.3%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Fails%20to%20restrict%20access&color=brightgreen) + +### Description + +Cybozu Garoon 3.0.0 to 4.2.3 allows remote authenticated attackers to bypass access restriction in the mail function leading to an alteration of the order of mail folders via unspecified vectors. + +### POC + +#### Reference +- http://www.securityfocus.com/bid/96429 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2017/CVE-2017-2699.md b/2017/CVE-2017-2699.md new file mode 100644 index 0000000000..584c6b57c8 --- /dev/null +++ b/2017/CVE-2017-2699.md @@ -0,0 +1,17 @@ +### [CVE-2017-2699](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-2699) +![](https://img.shields.io/static/v1?label=Product&message=Honor%207%2C%20Mate%20S%2CLYO-L21&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=Earlier%20than%20PLK-UL00C17B385%20versions%2C%20Earlier%20than%20CRR-L09C432B380%20versions%2C%20Earlier%20than%20LYO-L21C577B128%20versions%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Privilege%20Elevation&color=brightgreen) + +### Description + +The Huawei Themes APP in versions earlier than PLK-UL00C17B385, versions earlier than CRR-L09C432B380, versions earlier than LYO-L21C577B128 has a privilege elevation vulnerability. An attacker could exploit this vulnerability to upload theme packs containing malicious files and trick users into installing the theme packets, resulting in the execution of arbitrary code. + +### POC + +#### Reference +- http://www.securityfocus.com/bid/96424 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2017/CVE-2017-5359.md b/2017/CVE-2017-5359.md index bf26b3fb06..d85f30fc85 100644 --- a/2017/CVE-2017-5359.md +++ b/2017/CVE-2017-5359.md @@ -13,6 +13,7 @@ EasyCom SQL iPlug allows remote attackers to cause a denial of service via the D - http://hyp3rlinx.altervista.org/advisories/EASYCOM-SQL-IPLUG-DENIAL-OF-SERVICE.txt - http://packetstormsecurity.com/files/141300/EasyCom-SQL-iPlug-Denial-Of-Service.html - http://seclists.org/fulldisclosure/2017/Feb/61 +- http://www.securityfocus.com/bid/96420 - https://www.exploit-db.com/exploits/41426/ #### Github diff --git a/2017/CVE-2017-5594.md b/2017/CVE-2017-5594.md index aa6a2e86d9..5eda71d26e 100644 --- a/2017/CVE-2017-5594.md +++ b/2017/CVE-2017-5594.md @@ -10,6 +10,7 @@ An issue was discovered in Pagekit CMS before 1.0.11. In this vulnerability the ### POC #### Reference +- http://www.securityfocus.com/bid/95806 - https://www.exploit-db.com/exploits/41143/ #### Github diff --git a/2017/CVE-2017-5638.md b/2017/CVE-2017-5638.md index 3282345858..6e43d8ab3d 100644 --- a/2017/CVE-2017-5638.md +++ b/2017/CVE-2017-5638.md @@ -14,6 +14,7 @@ The Jakarta Multipart parser in Apache Struts 2 2.3.x before 2.3.32 and 2.5.x be - http://blog.talosintelligence.com/2017/03/apache-0-day-exploited.html - http://blog.trendmicro.com/trendlabs-security-intelligence/cve-2017-5638-apache-struts-vulnerability-remote-code-execution/ - http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html +- http://www.securityfocus.com/bid/96729 - https://github.com/rapid7/metasploit-framework/issues/8064 - https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03723en_us - https://isc.sans.edu/diary/22169 diff --git a/2017/CVE-2017-5715.md b/2017/CVE-2017-5715.md index 094605bdc1..9c9250135b 100644 --- a/2017/CVE-2017-5715.md +++ b/2017/CVE-2017-5715.md @@ -16,6 +16,7 @@ Systems with microprocessors utilizing speculative execution and indirect branch - http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html - http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html - http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html +- http://www.securityfocus.com/bid/102376 - https://cert.vde.com/en-us/advisories/vde-2018-002 - https://cert.vde.com/en-us/advisories/vde-2018-003 - https://developer.arm.com/support/arm-security-updates/speculative-processor-vulnerability diff --git a/2017/CVE-2017-5753.md b/2017/CVE-2017-5753.md index 76f38d258c..2f10a5244e 100644 --- a/2017/CVE-2017-5753.md +++ b/2017/CVE-2017-5753.md @@ -13,6 +13,7 @@ Systems with microprocessors utilizing speculative execution and branch predicti - http://packetstormsecurity.com/files/145645/Spectre-Information-Disclosure-Proof-Of-Concept.html - http://www.kb.cert.org/vuls/id/584653 - http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html +- http://www.securityfocus.com/bid/102371 - https://cert.vde.com/en-us/advisories/vde-2018-002 - https://cert.vde.com/en-us/advisories/vde-2018-003 - https://developer.arm.com/support/arm-security-updates/speculative-processor-vulnerability diff --git a/2017/CVE-2017-5865.md b/2017/CVE-2017-5865.md new file mode 100644 index 0000000000..248f630c44 --- /dev/null +++ b/2017/CVE-2017-5865.md @@ -0,0 +1,17 @@ +### [CVE-2017-5865](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5865) +![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen) + +### Description + +The password reset functionality in ownCloud Server before 8.1.11, 8.2.x before 8.2.9, 9.0.x before 9.0.7, and 9.1.x before 9.1.3 sends different error messages depending on whether the username is valid, which allows remote attackers to enumerate user names via a large number of password reset attempts. + +### POC + +#### Reference +- http://www.securityfocus.com/bid/96425 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2017/CVE-2017-5866.md b/2017/CVE-2017-5866.md new file mode 100644 index 0000000000..20cba18342 --- /dev/null +++ b/2017/CVE-2017-5866.md @@ -0,0 +1,17 @@ +### [CVE-2017-5866](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5866) +![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen) + +### Description + +The autocomplete feature in the E-Mail share dialog in ownCloud Server before 8.1.11, 8.2.x before 8.2.9, 9.0.x before 9.0.7, and 9.1.x before 9.1.3 allows remote authenticated users to obtain sensitive information via unspecified vectors. + +### POC + +#### Reference +- http://www.securityfocus.com/bid/96426 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2017/CVE-2017-6076.md b/2017/CVE-2017-6076.md index 6a3e8ab1c9..6fc163ab6b 100644 --- a/2017/CVE-2017-6076.md +++ b/2017/CVE-2017-6076.md @@ -10,6 +10,7 @@ In versions of wolfSSL before 3.10.2 the function fp_mul_comba makes it easier t ### POC #### Reference +- http://www.securityfocus.com/bid/96422 - https://github.com/wolfSSL/wolfssl/releases/tag/v3.10.2-stable #### Github diff --git a/2017/CVE-2017-6196.md b/2017/CVE-2017-6196.md index 9b8c9cd1ae..b6b9406bfd 100644 --- a/2017/CVE-2017-6196.md +++ b/2017/CVE-2017-6196.md @@ -10,6 +10,7 @@ Multiple use-after-free vulnerabilities in the gx_image_enum_begin function in b ### POC #### Reference +- http://www.securityfocus.com/bid/96428 - https://bugs.ghostscript.com/show_bug.cgi?id=697596 #### Github diff --git a/2017/CVE-2017-6214.md b/2017/CVE-2017-6214.md index a27106792e..ec878a007b 100644 --- a/2017/CVE-2017-6214.md +++ b/2017/CVE-2017-6214.md @@ -1,7 +1,7 @@ ### [CVE-2017-6214](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-6214) ![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue) -![](https://img.shields.io/static/v1?label=Version&message=n%2Fa&color=blue) -![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brighgreen) +![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen) ### Description @@ -10,8 +10,8 @@ The tcp_splice_read function in net/ipv4/tcp.c in the Linux kernel before 4.9.11 ### POC #### Reference -No PoCs from references. +- http://www.securityfocus.com/bid/96421 #### Github -- https://github.com/thdusdl1219/CVE-Study +No PoCs found on GitHub currently. diff --git a/2017/CVE-2017-6298.md b/2017/CVE-2017-6298.md index 5d985c8d3f..bb1c3ec9a2 100644 --- a/2017/CVE-2017-6298.md +++ b/2017/CVE-2017-6298.md @@ -10,6 +10,7 @@ An issue was discovered in ytnef before 1.9.1. This is related to a patch descri ### POC #### Reference +- http://www.securityfocus.com/bid/96423 - https://github.com/Yeraze/ytnef/pull/27 #### Github diff --git a/2017/CVE-2017-6299.md b/2017/CVE-2017-6299.md index b0723ddaf2..a7aa477eb2 100644 --- a/2017/CVE-2017-6299.md +++ b/2017/CVE-2017-6299.md @@ -10,6 +10,7 @@ An issue was discovered in ytnef before 1.9.1. This is related to a patch descri ### POC #### Reference +- http://www.securityfocus.com/bid/96423 - https://github.com/Yeraze/ytnef/pull/27 #### Github diff --git a/2017/CVE-2017-6300.md b/2017/CVE-2017-6300.md index d6b40f61f6..f3c8eff9f7 100644 --- a/2017/CVE-2017-6300.md +++ b/2017/CVE-2017-6300.md @@ -10,6 +10,7 @@ An issue was discovered in ytnef before 1.9.1. This is related to a patch descri ### POC #### Reference +- http://www.securityfocus.com/bid/96423 - https://github.com/Yeraze/ytnef/pull/27 #### Github diff --git a/2017/CVE-2017-6301.md b/2017/CVE-2017-6301.md index 95611367b2..05417d93cc 100644 --- a/2017/CVE-2017-6301.md +++ b/2017/CVE-2017-6301.md @@ -10,6 +10,7 @@ An issue was discovered in ytnef before 1.9.1. This is related to a patch descri ### POC #### Reference +- http://www.securityfocus.com/bid/96423 - https://github.com/Yeraze/ytnef/pull/27 #### Github diff --git a/2017/CVE-2017-6302.md b/2017/CVE-2017-6302.md index ef7a14c7d7..71827399bd 100644 --- a/2017/CVE-2017-6302.md +++ b/2017/CVE-2017-6302.md @@ -10,6 +10,7 @@ An issue was discovered in ytnef before 1.9.1. This is related to a patch descri ### POC #### Reference +- http://www.securityfocus.com/bid/96423 - https://github.com/Yeraze/ytnef/pull/27 #### Github diff --git a/2017/CVE-2017-6303.md b/2017/CVE-2017-6303.md index fff2d45665..ad674239d4 100644 --- a/2017/CVE-2017-6303.md +++ b/2017/CVE-2017-6303.md @@ -10,6 +10,7 @@ An issue was discovered in ytnef before 1.9.1. This is related to a patch descri ### POC #### Reference +- http://www.securityfocus.com/bid/96423 - https://github.com/Yeraze/ytnef/pull/27 #### Github diff --git a/2017/CVE-2017-6304.md b/2017/CVE-2017-6304.md index 1823fe7d97..d98139c79d 100644 --- a/2017/CVE-2017-6304.md +++ b/2017/CVE-2017-6304.md @@ -10,6 +10,7 @@ An issue was discovered in ytnef before 1.9.1. This is related to a patch descri ### POC #### Reference +- http://www.securityfocus.com/bid/96423 - https://github.com/Yeraze/ytnef/pull/27 #### Github diff --git a/2017/CVE-2017-6305.md b/2017/CVE-2017-6305.md index 8ead8cf8db..e5e8f1ede4 100644 --- a/2017/CVE-2017-6305.md +++ b/2017/CVE-2017-6305.md @@ -10,6 +10,7 @@ An issue was discovered in ytnef before 1.9.1. This is related to a patch descri ### POC #### Reference +- http://www.securityfocus.com/bid/96423 - https://github.com/Yeraze/ytnef/pull/27 #### Github diff --git a/2017/CVE-2017-6306.md b/2017/CVE-2017-6306.md index dce3eae40c..7f0567a980 100644 --- a/2017/CVE-2017-6306.md +++ b/2017/CVE-2017-6306.md @@ -10,6 +10,7 @@ An issue was discovered in ytnef before 1.9.1. This is related to a patch descri ### POC #### Reference +- http://www.securityfocus.com/bid/96423 - https://github.com/Yeraze/ytnef/pull/27 #### Github diff --git a/2017/CVE-2017-6307.md b/2017/CVE-2017-6307.md index 2db5ad8ef0..b1ef2e8d13 100644 --- a/2017/CVE-2017-6307.md +++ b/2017/CVE-2017-6307.md @@ -10,6 +10,7 @@ An issue was discovered in tnef before 1.4.13. Two OOB Writes have been identifi ### POC #### Reference +- http://www.securityfocus.com/bid/96427 - https://github.com/verdammelt/tnef/blob/master/ChangeLog #### Github diff --git a/2017/CVE-2017-6308.md b/2017/CVE-2017-6308.md index 94a40e2334..47a2e10bdd 100644 --- a/2017/CVE-2017-6308.md +++ b/2017/CVE-2017-6308.md @@ -10,6 +10,7 @@ An issue was discovered in tnef before 1.4.13. Several Integer Overflows, which ### POC #### Reference +- http://www.securityfocus.com/bid/96427 - https://github.com/verdammelt/tnef/blob/master/ChangeLog #### Github diff --git a/2017/CVE-2017-6309.md b/2017/CVE-2017-6309.md index 33235bd3be..313902e2b5 100644 --- a/2017/CVE-2017-6309.md +++ b/2017/CVE-2017-6309.md @@ -10,6 +10,7 @@ An issue was discovered in tnef before 1.4.13. Two type confusions have been ide ### POC #### Reference +- http://www.securityfocus.com/bid/96427 - https://github.com/verdammelt/tnef/blob/master/ChangeLog #### Github diff --git a/2017/CVE-2017-6310.md b/2017/CVE-2017-6310.md index 920242239b..e4f33edbdb 100644 --- a/2017/CVE-2017-6310.md +++ b/2017/CVE-2017-6310.md @@ -10,6 +10,7 @@ An issue was discovered in tnef before 1.4.13. Four type confusions have been id ### POC #### Reference +- http://www.securityfocus.com/bid/96427 - https://github.com/verdammelt/tnef/blob/master/ChangeLog #### Github diff --git a/2017/CVE-2017-7240.md b/2017/CVE-2017-7240.md index d95f011060..b9adab7ede 100644 --- a/2017/CVE-2017-7240.md +++ b/2017/CVE-2017-7240.md @@ -11,6 +11,7 @@ An issue was discovered on Miele Professional PST10 devices. The corresponding e #### Reference - http://seclists.org/fulldisclosure/2017/Mar/63 +- http://www.securityfocus.com/bid/97080 - https://www.exploit-db.com/exploits/41718/ #### Github diff --git a/2017/CVE-2017-7625.md b/2017/CVE-2017-7625.md index 8f53bf628b..8075e748fb 100644 --- a/2017/CVE-2017-7625.md +++ b/2017/CVE-2017-7625.md @@ -10,6 +10,7 @@ In Fiyo CMS 2.x through 2.0.7, attackers may upload a webshell via the content p ### POC #### Reference +- http://www.securityfocus.com/bid/97571 - https://github.com/Xyntax/POC-T/blob/2.0/script/fiyo2.0.7-getshell.py #### Github diff --git a/2017/CVE-2017-7994.md b/2017/CVE-2017-7994.md index c6169effd2..2b50692609 100644 --- a/2017/CVE-2017-7994.md +++ b/2017/CVE-2017-7994.md @@ -10,6 +10,7 @@ The function TextExtractor::ExtractText in TextExtractor.cpp:77 in PoDoFo 0.9.5 ### POC #### Reference +- http://www.securityfocus.com/bid/97980 - https://github.com/icepng/PoC/tree/master/PoC1 - https://icepng.github.io/2017/04/21/PoDoFo-1/ diff --git a/2017/CVE-2017-9239.md b/2017/CVE-2017-9239.md index a3c169ec97..722ac25b62 100644 --- a/2017/CVE-2017-9239.md +++ b/2017/CVE-2017-9239.md @@ -10,6 +10,7 @@ An issue was discovered in Exiv2 0.26. When the data structure of the structure ### POC #### Reference +- http://www.securityfocus.com/bid/98720 - https://github.com/lolo-pop/poc/tree/master/Segmentation%20fault%20in%20convert-test%28exiv2%29 - https://github.com/lolo-pop/poc/tree/master/Segmentation%20fault%20in%20convert-test(exiv2) diff --git a/2018/CVE-2018-1002105.md b/2018/CVE-2018-1002105.md index 51c80e4524..2bf2956776 100644 --- a/2018/CVE-2018-1002105.md +++ b/2018/CVE-2018-1002105.md @@ -20,6 +20,7 @@ In all Kubernetes versions prior to v1.10.11, v1.11.5, and v1.12.3, incorrect ha ### POC #### Reference +- http://www.securityfocus.com/bid/106068 - https://github.com/evict/poc_CVE-2018-1002105 - https://www.exploit-db.com/exploits/46052/ - https://www.exploit-db.com/exploits/46053/ diff --git a/2018/CVE-2018-4087.md b/2018/CVE-2018-4087.md index 02012589ce..84347b2aae 100644 --- a/2018/CVE-2018-4087.md +++ b/2018/CVE-2018-4087.md @@ -10,6 +10,7 @@ An issue was discovered in certain Apple products. iOS before 11.2.5 is affected ### POC #### Reference +- http://www.securityfocus.com/bid/102774 - https://blog.zimperium.com/cve-2018-4087-poc-escaping-sandbox-misleading-bluetoothd/ - https://www.exploit-db.com/exploits/44215/ diff --git a/2018/CVE-2018-4095.md b/2018/CVE-2018-4095.md index cd2da74001..1956421b9c 100644 --- a/2018/CVE-2018-4095.md +++ b/2018/CVE-2018-4095.md @@ -10,6 +10,7 @@ An issue was discovered in certain Apple products. iOS before 11.2.5 is affected ### POC #### Reference +- http://www.securityfocus.com/bid/102774 - https://blog.zimperium.com/cve-2018-4087-poc-escaping-sandbox-misleading-bluetoothd/ #### Github diff --git a/2018/CVE-2018-5279.md b/2018/CVE-2018-5279.md index b64d3b6481..2c3d84fadf 100644 --- a/2018/CVE-2018-5279.md +++ b/2018/CVE-2018-5279.md @@ -11,6 +11,7 @@ In Malwarebytes Premium 3.3.1.2183, the driver file (FARFLT.SYS) allows local us ### POC #### Reference +- http://www.securityfocus.com/bid/102453 - https://github.com/ZhiyuanWang-Chengdu-Qihoo360/Malwarebytes_POC/tree/master/0x9c40e02c #### Github diff --git a/2018/CVE-2018-8727.md b/2018/CVE-2018-8727.md index cb9c52c8e4..f8385dfe5f 100644 --- a/2018/CVE-2018-8727.md +++ b/2018/CVE-2018-8727.md @@ -10,7 +10,7 @@ Path Traversal in Gateway in Mirasys DVMS Workstation 5.12.6 and earlier allows ### POC #### Reference -No PoCs from references. +- https://www.exploit-db.com/exploits/44907 #### Github - https://github.com/20142995/nuclei-templates diff --git a/2019/CVE-2019-11687.md b/2019/CVE-2019-11687.md index 073ea50359..1c763cdb10 100644 --- a/2019/CVE-2019-11687.md +++ b/2019/CVE-2019-11687.md @@ -10,6 +10,7 @@ An issue was discovered in the DICOM Part 10 File Format in the NEMA DICOM Stand ### POC #### Reference +- http://www.securityfocus.com/bid/108730 - https://github.com/d00rt/pedicom - https://github.com/d00rt/pedicom/blob/master/doc/Attacking_Digital_Imaging_and_Communication_in_Medicine_%28DICOM%29_file_format_standard_-_Markel_Picado_Ortiz_%28d00rt%29.pdf - https://github.com/d00rt/pedicom/blob/master/doc/Attacking_Digital_Imaging_and_Communication_in_Medicine_(DICOM)_file_format_standard_-_Markel_Picado_Ortiz_(d00rt).pdf diff --git a/2019/CVE-2019-12279.md b/2019/CVE-2019-12279.md index faa2582c7a..72d097fc9b 100644 --- a/2019/CVE-2019-12279.md +++ b/2019/CVE-2019-12279.md @@ -11,6 +11,7 @@ Nagios XI 5.6.1 allows SQL injection via the username parameter to login.php?for #### Reference - http://packetstormsecurity.com/files/153040/Nagios-XI-5.6.1-SQL-Injection.html +- http://www.securityfocus.com/bid/108446 - https://github.com/JameelNabbo/exploits/blob/master/nagiosxi%20username%20sql%20injection.txt #### Github diff --git a/2019/CVE-2019-25714.md b/2019/CVE-2019-25714.md index 92fd729aa0..0fc0b38665 100644 --- a/2019/CVE-2019-25714.md +++ b/2019/CVE-2019-25714.md @@ -16,6 +16,7 @@ Seeyon OA A8 contains an unauthenticated arbitrary file write vulnerability in t ### POC #### Reference +- https://wiki.96.mk/Web%E5%AE%89%E5%85%A8/%E8%87%B4%E8%BF%9Coa/%E8%87%B4%E8%BF%9C%20OA%20A8%20htmlofficeservlet%20getshell%20%E6%BC%8F%E6%B4%9E/ - https://www.vulncheck.com/advisories/seeyon-office-anywhere-oa-a8-unauthenticated-arbitrary-file-write-via-htmlofficeservlet #### Github diff --git a/2019/CVE-2019-5736.md b/2019/CVE-2019-5736.md index 1b952a7119..253fe6b124 100644 --- a/2019/CVE-2019-5736.md +++ b/2019/CVE-2019-5736.md @@ -12,6 +12,7 @@ runc through 1.0-rc6, as used in Docker before 18.09.2 and other products, allow #### Reference - http://packetstormsecurity.com/files/163339/Docker-Container-Escape.html - http://packetstormsecurity.com/files/165197/Docker-runc-Command-Execution-Proof-Of-Concept.html +- http://www.securityfocus.com/bid/106976 - https://azure.microsoft.com/en-us/updates/cve-2019-5736-and-runc-vulnerability/ - https://azure.microsoft.com/en-us/updates/iot-edge-fix-cve-2019-5736/ - https://blog.dragonsector.pl/2019/02/cve-2019-5736-escape-from-docker-and.html diff --git a/2019/CVE-2019-6555.md b/2019/CVE-2019-6555.md index 59f845942f..4c1645b4c8 100644 --- a/2019/CVE-2019-6555.md +++ b/2019/CVE-2019-6555.md @@ -10,6 +10,7 @@ Cscape, 9.80 SP4 and prior. An improper input validation vulnerability may be ex ### POC #### Reference +- http://www.securityfocus.com/bid/107087 - https://ics-cert.us-cert.gov/advisories/ICSA-19-050-03 #### Github diff --git a/2021/CVE-2021-45572.md b/2021/CVE-2021-45572.md new file mode 100644 index 0000000000..4b14a98943 --- /dev/null +++ b/2021/CVE-2021-45572.md @@ -0,0 +1,17 @@ +### [CVE-2021-45572](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-45572) +![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen) + +### Description + +Certain NETGEAR devices are affected by command injection by an authenticated user. This affects RBK752 before 3.2.16.6, RBR750 before 3.2.16.6, RBS750 before 3.2.16.6, RBK852 before 3.2.16.6, RBR850 before 3.2.16.6, and RBS850 before 3.2.16.6. + +### POC + +#### Reference +- https://kb.netgear.com/000064094/Security-Advisory-for-Post-Authentication-Command-Injection-on-Some-WiFi-Systems-PSV-2020-0080 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2021/CVE-2021-45912.md b/2021/CVE-2021-45912.md new file mode 100644 index 0000000000..de617bef33 --- /dev/null +++ b/2021/CVE-2021-45912.md @@ -0,0 +1,17 @@ +### [CVE-2021-45912](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-45912) +![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen) + +### Description + +An unauthenticated Named Pipe channel in Controlup Real-Time Agent (cuAgent.exe) before 8.5 potentially allows an attacker to run OS commands via the ProcessActionRequest WCF method. + +### POC + +#### Reference +- https://controlup.com + +#### Github +No PoCs found on GitHub currently. + diff --git a/2021/CVE-2021-45913.md b/2021/CVE-2021-45913.md new file mode 100644 index 0000000000..6172ce7cfd --- /dev/null +++ b/2021/CVE-2021-45913.md @@ -0,0 +1,17 @@ +### [CVE-2021-45913](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-45913) +![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen) + +### Description + +A hardcoded key in ControlUp Real-Time Agent (cuAgent.exe) before 8.2.5 may allow a potential attacker to run OS commands via a WCF channel. + +### POC + +#### Reference +- https://controlup.com + +#### Github +No PoCs found on GitHub currently. + diff --git a/2024/CVE-2024-10234.md b/2024/CVE-2024-10234.md index 2e75eaa722..401c24920f 100644 --- a/2024/CVE-2024-10234.md +++ b/2024/CVE-2024-10234.md @@ -3,10 +3,10 @@ ![](https://img.shields.io/static/v1?label=Product&message=Red%20Hat%20Build%20of%20Keycloak&color=blue) ![](https://img.shields.io/static/v1?label=Product&message=Red%20Hat%20Fuse%207&color=blue) ![](https://img.shields.io/static/v1?label=Product&message=Red%20Hat%20JBoss%20Data%20Grid%207&color=blue) +![](https://img.shields.io/static/v1?label=Product&message=Red%20Hat%20JBoss%20Enterprise%20Application%20Platform%207&color=blue) ![](https://img.shields.io/static/v1?label=Product&message=Red%20Hat%20JBoss%20Enterprise%20Application%20Platform%207.4%20for%20RHEL%208&color=blue) ![](https://img.shields.io/static/v1?label=Product&message=Red%20Hat%20JBoss%20Enterprise%20Application%20Platform%207.4%20for%20RHEL%209&color=blue) ![](https://img.shields.io/static/v1?label=Product&message=Red%20Hat%20JBoss%20Enterprise%20Application%20Platform%207.4%20on%20RHEL%207&color=blue) -![](https://img.shields.io/static/v1?label=Product&message=Red%20Hat%20JBoss%20Enterprise%20Application%20Platform%207.4.23&color=blue) ![](https://img.shields.io/static/v1?label=Product&message=Red%20Hat%20JBoss%20Enterprise%20Application%20Platform%208&color=blue) ![](https://img.shields.io/static/v1?label=Product&message=Red%20Hat%20JBoss%20Enterprise%20Application%20Platform%208.0%20for%20RHEL%208&color=blue) ![](https://img.shields.io/static/v1?label=Product&message=Red%20Hat%20JBoss%20Enterprise%20Application%20Platform%208.0%20for%20RHEL%209&color=blue) diff --git a/2024/CVE-2024-21245.md b/2024/CVE-2024-21245.md new file mode 100644 index 0000000000..9a6455c654 --- /dev/null +++ b/2024/CVE-2024-21245.md @@ -0,0 +1,17 @@ +### [CVE-2024-21245](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21245) +![](https://img.shields.io/static/v1?label=Product&message=JD%20Edwards%20EnterpriseOne%20Tools&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=*%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Easily%20exploitable%20vulnerability%20allows%20low%20privileged%20attacker%20with%20network%20access%20via%20HTTP%20to%20compromise%20JD%20Edwards%20EnterpriseOne%20Tools.%20%20Successful%20attacks%20require%20human%20interaction%20from%20a%20person%20other%20than%20the%20attacker%20and%20while%20the%20vulnerability%20is%20in%20JD%20Edwards%20EnterpriseOne%20Tools%2C%20attacks%20may%20significantly%20impact%20additional%20products%20(scope%20change).%20Successful%20attacks%20of%20this%20vulnerability%20can%20result%20in%20%20unauthorized%20update%2C%20insert%20or%20delete%20access%20to%20some%20of%20JD%20Edwards%20EnterpriseOne%20Tools%20accessible%20data%20as%20well%20as%20%20unauthorized%20read%20access%20to%20a%20subset%20of%20JD%20Edwards%20EnterpriseOne%20Tools%20accessible%20data.&color=brightgreen) + +### Description + +Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Business Logic Infra SEC). Supported versions that are affected are Prior to 9.2.9.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Tools. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in JD Edwards EnterpriseOne Tools, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of JD Edwards EnterpriseOne Tools accessible data as well as unauthorized read access to a subset of JD Edwards EnterpriseOne Tools accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N). + +### POC + +#### Reference +- https://www.oracle.com/security-alerts/cpujan2025.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2024/CVE-2024-34035.md b/2024/CVE-2024-34035.md new file mode 100644 index 0000000000..0bbbedf178 --- /dev/null +++ b/2024/CVE-2024-34035.md @@ -0,0 +1,17 @@ +### [CVE-2024-34035](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-34035) +![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen) + +### Description + +An issue was discovered in O-RAN Near Realtime RIC H-Release. To trigger the crashing of the e2mgr, an adversary must flood the system with a significant quantity of E2 Subscription Requests originating from an xApp. + +### POC + +#### Reference +- https://jira.o-ran-sc.org/browse/RIC-1056 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2024/CVE-2024-44004.md b/2024/CVE-2024-44004.md index 7cdd199e77..ca5ce976ce 100644 --- a/2024/CVE-2024-44004.md +++ b/2024/CVE-2024-44004.md @@ -1,11 +1,11 @@ ### [CVE-2024-44004](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-44004) ![](https://img.shields.io/static/v1?label=Product&message=WPCargo%20Track%20%26%20Trace&color=blue) ![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) -![](https://img.shields.io/static/v1?label=Vulnerability&message=Improper%20Neutralization%20of%20Special%20Elements%20used%20in%20an%20SQL%20Command%20('SQL%20Injection')&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-89%20Improper%20Neutralization%20of%20Special%20Elements%20used%20in%20an%20SQL%20Command%20('SQL%20Injection')&color=brightgreen) ### Description -Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Arni Cinco WPCargo Track & Trace wpcargo allows SQL Injection.This issue affects WPCargo Track & Trace: from n/a through <= 8.0.2. +Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Arni Cinco WPCargo Track & Trace wpcargo allows SQL Injection.This issue affects WPCargo Track & Trace: before 8.0.4. ### POC diff --git a/2025/CVE-2025-21489.md b/2025/CVE-2025-21489.md new file mode 100644 index 0000000000..3900782b63 --- /dev/null +++ b/2025/CVE-2025-21489.md @@ -0,0 +1,17 @@ +### [CVE-2025-21489](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21489) +![](https://img.shields.io/static/v1?label=Product&message=Oracle%20Advanced%20Outbound%20Telephony&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=12.2.3%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Easily%20exploitable%20vulnerability%20allows%20unauthenticated%20attacker%20with%20network%20access%20via%20HTTP%20to%20compromise%20Oracle%20Advanced%20Outbound%20Telephony.%20%20Successful%20attacks%20require%20human%20interaction%20from%20a%20person%20other%20than%20the%20attacker%20and%20while%20the%20vulnerability%20is%20in%20Oracle%20Advanced%20Outbound%20Telephony%2C%20attacks%20may%20significantly%20impact%20additional%20products%20(scope%20change).%20Successful%20attacks%20of%20this%20vulnerability%20can%20result%20in%20%20unauthorized%20update%2C%20insert%20or%20delete%20access%20to%20some%20of%20Oracle%20Advanced%20Outbound%20Telephony%20accessible%20data%20as%20well%20as%20%20unauthorized%20read%20access%20to%20a%20subset%20of%20Oracle%20Advanced%20Outbound%20Telephony%20accessible%20data.&color=brightgreen) + +### Description + +Vulnerability in the Oracle Advanced Outbound Telephony product of Oracle E-Business Suite (component: Region Mapping). Supported versions that are affected are 12.2.3-12.2.10. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Advanced Outbound Telephony. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Advanced Outbound Telephony, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Advanced Outbound Telephony accessible data as well as unauthorized read access to a subset of Oracle Advanced Outbound Telephony accessible data. CVSS 3.1 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). + +### POC + +#### Reference +- https://www.oracle.com/security-alerts/cpujan2025.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2025/CVE-2025-21490.md b/2025/CVE-2025-21490.md index a0856b1dd4..0275af725d 100644 --- a/2025/CVE-2025-21490.md +++ b/2025/CVE-2025-21490.md @@ -10,7 +10,7 @@ Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). ### POC #### Reference -No PoCs from references. +- https://www.oracle.com/security-alerts/cpujan2025.html #### Github - https://github.com/adegoodyer/kubernetes-admin-toolkit diff --git a/2025/CVE-2025-21491.md b/2025/CVE-2025-21491.md index 313cba2135..faca1b39ad 100644 --- a/2025/CVE-2025-21491.md +++ b/2025/CVE-2025-21491.md @@ -10,7 +10,7 @@ Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). ### POC #### Reference -No PoCs from references. +- https://www.oracle.com/security-alerts/cpujan2025.html #### Github - https://github.com/adegoodyer/kubernetes-admin-toolkit diff --git a/2025/CVE-2025-21492.md b/2025/CVE-2025-21492.md new file mode 100644 index 0000000000..cc2c67e828 --- /dev/null +++ b/2025/CVE-2025-21492.md @@ -0,0 +1,18 @@ +### [CVE-2025-21492](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21492) +![](https://img.shields.io/static/v1?label=Product&message=MySQL%20Server&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=*%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=8.4.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Easily%20exploitable%20vulnerability%20allows%20high%20privileged%20attacker%20with%20network%20access%20via%20multiple%20protocols%20to%20compromise%20MySQL%20Server.%20%20Successful%20attacks%20of%20this%20vulnerability%20can%20result%20in%20unauthorized%20ability%20to%20cause%20a%20hang%20or%20frequently%20repeatable%20crash%20(complete%20DOS)%20of%20MySQL%20Server.&color=brightgreen) + +### Description + +Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.36 and prior and 8.4.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). + +### POC + +#### Reference +- https://www.oracle.com/security-alerts/cpujan2025.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2025/CVE-2025-21493.md b/2025/CVE-2025-21493.md new file mode 100644 index 0000000000..bf066d274a --- /dev/null +++ b/2025/CVE-2025-21493.md @@ -0,0 +1,17 @@ +### [CVE-2025-21493](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21493) +![](https://img.shields.io/static/v1?label=Product&message=MySQL%20Server&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=*%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Difficult%20to%20exploit%20vulnerability%20allows%20high%20privileged%20attacker%20with%20network%20access%20via%20multiple%20protocols%20to%20compromise%20MySQL%20Server.%20%20Successful%20attacks%20of%20this%20vulnerability%20can%20result%20in%20unauthorized%20ability%20to%20cause%20a%20hang%20or%20frequently%20repeatable%20crash%20(complete%20DOS)%20of%20MySQL%20Server.&color=brightgreen) + +### Description + +Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Security: Privileges). Supported versions that are affected are 8.4.3 and prior and 9.1.0 and prior. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.4 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H). + +### POC + +#### Reference +- https://www.oracle.com/security-alerts/cpujan2025.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2025/CVE-2025-21494.md b/2025/CVE-2025-21494.md index 6e94b868a7..483d23f3bc 100644 --- a/2025/CVE-2025-21494.md +++ b/2025/CVE-2025-21494.md @@ -10,7 +10,7 @@ Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Se ### POC #### Reference -No PoCs from references. +- https://www.oracle.com/security-alerts/cpujan2025.html #### Github - https://github.com/adegoodyer/kubernetes-admin-toolkit diff --git a/2025/CVE-2025-21495.md b/2025/CVE-2025-21495.md new file mode 100644 index 0000000000..2e23f93c49 --- /dev/null +++ b/2025/CVE-2025-21495.md @@ -0,0 +1,17 @@ +### [CVE-2025-21495](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21495) +![](https://img.shields.io/static/v1?label=Product&message=MySQL%20Enterprise%20Firewall&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=*%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Difficult%20to%20exploit%20vulnerability%20allows%20high%20privileged%20attacker%20with%20network%20access%20via%20multiple%20protocols%20to%20compromise%20MySQL%20Enterprise%20Firewall.%20%20Successful%20attacks%20of%20this%20vulnerability%20can%20result%20in%20unauthorized%20ability%20to%20cause%20a%20hang%20or%20frequently%20repeatable%20crash%20(complete%20DOS)%20of%20MySQL%20Enterprise%20Firewall.&color=brightgreen) + +### Description + +Vulnerability in the MySQL Enterprise Firewall product of Oracle MySQL (component: Firewall). Supported versions that are affected are 8.0.40 and prior, 8.4.3 and prior and 9.1.0 and prior. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Enterprise Firewall. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Enterprise Firewall. CVSS 3.1 Base Score 4.4 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H). + +### POC + +#### Reference +- https://www.oracle.com/security-alerts/cpujan2025.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2025/CVE-2025-21497.md b/2025/CVE-2025-21497.md index 2fa7efcc26..763eabec25 100644 --- a/2025/CVE-2025-21497.md +++ b/2025/CVE-2025-21497.md @@ -10,7 +10,7 @@ Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). ### POC #### Reference -No PoCs from references. +- https://www.oracle.com/security-alerts/cpujan2025.html #### Github - https://github.com/Urbank-61/Urbank-61-CSC180CVEProject diff --git a/2025/CVE-2025-21498.md b/2025/CVE-2025-21498.md new file mode 100644 index 0000000000..528937cce8 --- /dev/null +++ b/2025/CVE-2025-21498.md @@ -0,0 +1,17 @@ +### [CVE-2025-21498](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21498) +![](https://img.shields.io/static/v1?label=Product&message=Oracle%20HTTP%20Server&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=12.2.1.4.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Easily%20exploitable%20vulnerability%20allows%20unauthenticated%20attacker%20with%20network%20access%20via%20HTTP%20to%20compromise%20Oracle%20HTTP%20Server.%20%20Successful%20attacks%20of%20this%20vulnerability%20can%20result%20in%20%20unauthorized%20read%20access%20to%20a%20subset%20of%20Oracle%20HTTP%20Server%20accessible%20data.&color=brightgreen) + +### Description + +Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: Core). The supported version that is affected is 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle HTTP Server. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle HTTP Server accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N). + +### POC + +#### Reference +- https://www.oracle.com/security-alerts/cpujan2025.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2025/CVE-2025-21499.md b/2025/CVE-2025-21499.md new file mode 100644 index 0000000000..24f9f618e2 --- /dev/null +++ b/2025/CVE-2025-21499.md @@ -0,0 +1,17 @@ +### [CVE-2025-21499](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21499) +![](https://img.shields.io/static/v1?label=Product&message=MySQL%20Server&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=*%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Easily%20exploitable%20vulnerability%20allows%20high%20privileged%20attacker%20with%20network%20access%20via%20multiple%20protocols%20to%20compromise%20MySQL%20Server.%20%20Successful%20attacks%20of%20this%20vulnerability%20can%20result%20in%20unauthorized%20ability%20to%20cause%20a%20hang%20or%20frequently%20repeatable%20crash%20(complete%20DOS)%20of%20MySQL%20Server.&color=brightgreen) + +### Description + +Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DDL). Supported versions that are affected are 8.4.3 and prior and 9.1.0 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). + +### POC + +#### Reference +- https://www.oracle.com/security-alerts/cpujan2025.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2025/CVE-2025-21500.md b/2025/CVE-2025-21500.md index 8c23581f32..bc7c46ab0f 100644 --- a/2025/CVE-2025-21500.md +++ b/2025/CVE-2025-21500.md @@ -10,7 +10,7 @@ Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Op ### POC #### Reference -No PoCs from references. +- https://www.oracle.com/security-alerts/cpujan2025.html #### Github - https://github.com/adegoodyer/kubernetes-admin-toolkit diff --git a/2025/CVE-2025-21501.md b/2025/CVE-2025-21501.md index 9ce4624e45..61d293cfd7 100644 --- a/2025/CVE-2025-21501.md +++ b/2025/CVE-2025-21501.md @@ -10,7 +10,7 @@ Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Op ### POC #### Reference -No PoCs from references. +- https://www.oracle.com/security-alerts/cpujan2025.html #### Github - https://github.com/adegoodyer/kubernetes-admin-toolkit diff --git a/2025/CVE-2025-21502.md b/2025/CVE-2025-21502.md index fb17fa0f98..c3a99d466a 100644 --- a/2025/CVE-2025-21502.md +++ b/2025/CVE-2025-21502.md @@ -19,7 +19,7 @@ Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Ente ### POC #### Reference -No PoCs from references. +- https://www.oracle.com/security-alerts/cpujan2025.html #### Github - https://github.com/w4zu/Debian_security diff --git a/2025/CVE-2025-21503.md b/2025/CVE-2025-21503.md index 3858fffd67..6cfa1d2914 100644 --- a/2025/CVE-2025-21503.md +++ b/2025/CVE-2025-21503.md @@ -10,7 +10,7 @@ Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). ### POC #### Reference -No PoCs from references. +- https://www.oracle.com/security-alerts/cpujan2025.html #### Github - https://github.com/adegoodyer/kubernetes-admin-toolkit diff --git a/2025/CVE-2025-21504.md b/2025/CVE-2025-21504.md index 5c8ad6272e..aa1794a107 100644 --- a/2025/CVE-2025-21504.md +++ b/2025/CVE-2025-21504.md @@ -10,7 +10,7 @@ Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Op ### POC #### Reference -No PoCs from references. +- https://www.oracle.com/security-alerts/cpujan2025.html #### Github - https://github.com/adegoodyer/kubernetes-admin-toolkit diff --git a/2025/CVE-2025-21505.md b/2025/CVE-2025-21505.md index 6350997305..2d33c1a483 100644 --- a/2025/CVE-2025-21505.md +++ b/2025/CVE-2025-21505.md @@ -10,7 +10,7 @@ Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Co ### POC #### Reference -No PoCs from references. +- https://www.oracle.com/security-alerts/cpujan2025.html #### Github - https://github.com/adegoodyer/kubernetes-admin-toolkit diff --git a/2025/CVE-2025-21506.md b/2025/CVE-2025-21506.md new file mode 100644 index 0000000000..102f2bef5f --- /dev/null +++ b/2025/CVE-2025-21506.md @@ -0,0 +1,17 @@ +### [CVE-2025-21506](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21506) +![](https://img.shields.io/static/v1?label=Product&message=Oracle%20Project%20Foundation&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=12.2.3%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Easily%20exploitable%20vulnerability%20allows%20low%20privileged%20attacker%20with%20network%20access%20via%20HTTP%20to%20compromise%20Oracle%20Project%20Foundation.%20%20Successful%20attacks%20of%20this%20vulnerability%20can%20result%20in%20%20unauthorized%20creation%2C%20deletion%20or%20modification%20access%20to%20critical%20data%20or%20all%20Oracle%20Project%20Foundation%20accessible%20data%20as%20well%20as%20%20unauthorized%20access%20to%20critical%20data%20or%20complete%20access%20to%20all%20Oracle%20Project%20Foundation%20accessible%20data.&color=brightgreen) + +### Description + +Vulnerability in the Oracle Project Foundation product of Oracle E-Business Suite (component: Technology Foundation). Supported versions that are affected are 12.2.3-12.2.13. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Project Foundation. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Project Foundation accessible data as well as unauthorized access to critical data or complete access to all Oracle Project Foundation accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N). + +### POC + +#### Reference +- https://www.oracle.com/security-alerts/cpujan2025.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2025/CVE-2025-21507.md b/2025/CVE-2025-21507.md new file mode 100644 index 0000000000..7f9faa2822 --- /dev/null +++ b/2025/CVE-2025-21507.md @@ -0,0 +1,17 @@ +### [CVE-2025-21507](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21507) +![](https://img.shields.io/static/v1?label=Product&message=JD%20Edwards%20EnterpriseOne%20Tools&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=*%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Easily%20exploitable%20vulnerability%20allows%20low%20privileged%20attacker%20with%20network%20access%20via%20HTTP%20to%20compromise%20JD%20Edwards%20EnterpriseOne%20Tools.%20%20Successful%20attacks%20require%20human%20interaction%20from%20a%20person%20other%20than%20the%20attacker%20and%20while%20the%20vulnerability%20is%20in%20JD%20Edwards%20EnterpriseOne%20Tools%2C%20attacks%20may%20significantly%20impact%20additional%20products%20(scope%20change).%20Successful%20attacks%20of%20this%20vulnerability%20can%20result%20in%20%20unauthorized%20update%2C%20insert%20or%20delete%20access%20to%20some%20of%20JD%20Edwards%20EnterpriseOne%20Tools%20accessible%20data%20as%20well%20as%20%20unauthorized%20read%20access%20to%20a%20subset%20of%20JD%20Edwards%20EnterpriseOne%20Tools%20accessible%20data.&color=brightgreen) + +### Description + +Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Web Runtime SEC). Supported versions that are affected are Prior to 9.2.9.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Tools. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in JD Edwards EnterpriseOne Tools, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of JD Edwards EnterpriseOne Tools accessible data as well as unauthorized read access to a subset of JD Edwards EnterpriseOne Tools accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N). + +### POC + +#### Reference +- https://www.oracle.com/security-alerts/cpujan2025.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2025/CVE-2025-21508.md b/2025/CVE-2025-21508.md new file mode 100644 index 0000000000..4fc1a92fc6 --- /dev/null +++ b/2025/CVE-2025-21508.md @@ -0,0 +1,17 @@ +### [CVE-2025-21508](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21508) +![](https://img.shields.io/static/v1?label=Product&message=JD%20Edwards%20EnterpriseOne%20Tools&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=*%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Easily%20exploitable%20vulnerability%20allows%20low%20privileged%20attacker%20with%20network%20access%20via%20HTTP%20to%20compromise%20JD%20Edwards%20EnterpriseOne%20Tools.%20%20Successful%20attacks%20of%20this%20vulnerability%20can%20result%20in%20unauthorized%20ability%20to%20cause%20a%20hang%20or%20frequently%20repeatable%20crash%20(complete%20DOS)%20of%20JD%20Edwards%20EnterpriseOne%20Tools.&color=brightgreen) + +### Description + +Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Web Runtime SEC). Supported versions that are affected are Prior to 9.2.9.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Tools. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 6.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). + +### POC + +#### Reference +- https://www.oracle.com/security-alerts/cpujan2025.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2025/CVE-2025-21509.md b/2025/CVE-2025-21509.md new file mode 100644 index 0000000000..a352c5f3e3 --- /dev/null +++ b/2025/CVE-2025-21509.md @@ -0,0 +1,17 @@ +### [CVE-2025-21509](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21509) +![](https://img.shields.io/static/v1?label=Product&message=JD%20Edwards%20EnterpriseOne%20Tools&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=*%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Easily%20exploitable%20vulnerability%20allows%20low%20privileged%20attacker%20with%20network%20access%20via%20HTTP%20to%20compromise%20JD%20Edwards%20EnterpriseOne%20Tools.%20%20Successful%20attacks%20of%20this%20vulnerability%20can%20result%20in%20unauthorized%20ability%20to%20cause%20a%20hang%20or%20frequently%20repeatable%20crash%20(complete%20DOS)%20of%20JD%20Edwards%20EnterpriseOne%20Tools.&color=brightgreen) + +### Description + +Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Web Runtime SEC). Supported versions that are affected are Prior to 9.2.9.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Tools. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 6.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). + +### POC + +#### Reference +- https://www.oracle.com/security-alerts/cpujan2025.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2025/CVE-2025-21510.md b/2025/CVE-2025-21510.md new file mode 100644 index 0000000000..f603992ed2 --- /dev/null +++ b/2025/CVE-2025-21510.md @@ -0,0 +1,17 @@ +### [CVE-2025-21510](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21510) +![](https://img.shields.io/static/v1?label=Product&message=JD%20Edwards%20EnterpriseOne%20Tools&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=*%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Easily%20exploitable%20vulnerability%20allows%20unauthenticated%20attacker%20with%20network%20access%20via%20HTTP%20to%20compromise%20JD%20Edwards%20EnterpriseOne%20Tools.%20%20Successful%20attacks%20of%20this%20vulnerability%20can%20result%20in%20%20unauthorized%20access%20to%20critical%20data%20or%20complete%20access%20to%20all%20JD%20Edwards%20EnterpriseOne%20Tools%20accessible%20data.&color=brightgreen) + +### Description + +Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Web Runtime SEC). Supported versions that are affected are Prior to 9.2.9.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Tools. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all JD Edwards EnterpriseOne Tools accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). + +### POC + +#### Reference +- https://www.oracle.com/security-alerts/cpujan2025.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2025/CVE-2025-21511.md b/2025/CVE-2025-21511.md new file mode 100644 index 0000000000..034a8727fd --- /dev/null +++ b/2025/CVE-2025-21511.md @@ -0,0 +1,17 @@ +### [CVE-2025-21511](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21511) +![](https://img.shields.io/static/v1?label=Product&message=JD%20Edwards%20EnterpriseOne%20Tools&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=*%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Easily%20exploitable%20vulnerability%20allows%20unauthenticated%20attacker%20with%20network%20access%20via%20HTTP%20to%20compromise%20JD%20Edwards%20EnterpriseOne%20Tools.%20%20Successful%20attacks%20of%20this%20vulnerability%20can%20result%20in%20%20unauthorized%20access%20to%20critical%20data%20or%20complete%20access%20to%20all%20JD%20Edwards%20EnterpriseOne%20Tools%20accessible%20data.&color=brightgreen) + +### Description + +Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Web Runtime SEC). Supported versions that are affected are Prior to 9.2.9.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Tools. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all JD Edwards EnterpriseOne Tools accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). + +### POC + +#### Reference +- https://www.oracle.com/security-alerts/cpujan2025.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2025/CVE-2025-21512.md b/2025/CVE-2025-21512.md new file mode 100644 index 0000000000..997ac1b825 --- /dev/null +++ b/2025/CVE-2025-21512.md @@ -0,0 +1,17 @@ +### [CVE-2025-21512](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21512) +![](https://img.shields.io/static/v1?label=Product&message=JD%20Edwards%20EnterpriseOne%20Tools&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=*%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Easily%20exploitable%20vulnerability%20allows%20unauthenticated%20attacker%20with%20network%20access%20via%20HTTP%20to%20compromise%20JD%20Edwards%20EnterpriseOne%20Tools.%20%20Successful%20attacks%20require%20human%20interaction%20from%20a%20person%20other%20than%20the%20attacker%20and%20while%20the%20vulnerability%20is%20in%20JD%20Edwards%20EnterpriseOne%20Tools%2C%20attacks%20may%20significantly%20impact%20additional%20products%20(scope%20change).%20Successful%20attacks%20of%20this%20vulnerability%20can%20result%20in%20%20unauthorized%20update%2C%20insert%20or%20delete%20access%20to%20some%20of%20JD%20Edwards%20EnterpriseOne%20Tools%20accessible%20data%20as%20well%20as%20%20unauthorized%20read%20access%20to%20a%20subset%20of%20JD%20Edwards%20EnterpriseOne%20Tools%20accessible%20data.&color=brightgreen) + +### Description + +Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Web Runtime SEC). Supported versions that are affected are Prior to 9.2.9.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Tools. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in JD Edwards EnterpriseOne Tools, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of JD Edwards EnterpriseOne Tools accessible data as well as unauthorized read access to a subset of JD Edwards EnterpriseOne Tools accessible data. CVSS 3.1 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). + +### POC + +#### Reference +- https://www.oracle.com/security-alerts/cpujan2025.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2025/CVE-2025-21513.md b/2025/CVE-2025-21513.md new file mode 100644 index 0000000000..35ded450c6 --- /dev/null +++ b/2025/CVE-2025-21513.md @@ -0,0 +1,17 @@ +### [CVE-2025-21513](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21513) +![](https://img.shields.io/static/v1?label=Product&message=JD%20Edwards%20EnterpriseOne%20Tools&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=*%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Easily%20exploitable%20vulnerability%20allows%20unauthenticated%20attacker%20with%20network%20access%20via%20HTTP%20to%20compromise%20JD%20Edwards%20EnterpriseOne%20Tools.%20%20Successful%20attacks%20require%20human%20interaction%20from%20a%20person%20other%20than%20the%20attacker%20and%20while%20the%20vulnerability%20is%20in%20JD%20Edwards%20EnterpriseOne%20Tools%2C%20attacks%20may%20significantly%20impact%20additional%20products%20(scope%20change).%20Successful%20attacks%20of%20this%20vulnerability%20can%20result%20in%20%20unauthorized%20update%2C%20insert%20or%20delete%20access%20to%20some%20of%20JD%20Edwards%20EnterpriseOne%20Tools%20accessible%20data%20as%20well%20as%20%20unauthorized%20read%20access%20to%20a%20subset%20of%20JD%20Edwards%20EnterpriseOne%20Tools%20accessible%20data.&color=brightgreen) + +### Description + +Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Web Runtime SEC). Supported versions that are affected are Prior to 9.2.9.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Tools. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in JD Edwards EnterpriseOne Tools, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of JD Edwards EnterpriseOne Tools accessible data as well as unauthorized read access to a subset of JD Edwards EnterpriseOne Tools accessible data. CVSS 3.1 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). + +### POC + +#### Reference +- https://www.oracle.com/security-alerts/cpujan2025.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2025/CVE-2025-21514.md b/2025/CVE-2025-21514.md new file mode 100644 index 0000000000..6bb05d0be5 --- /dev/null +++ b/2025/CVE-2025-21514.md @@ -0,0 +1,17 @@ +### [CVE-2025-21514](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21514) +![](https://img.shields.io/static/v1?label=Product&message=JD%20Edwards%20EnterpriseOne%20Tools&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=*%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Easily%20exploitable%20vulnerability%20allows%20unauthenticated%20attacker%20with%20network%20access%20via%20HTTP%20to%20compromise%20JD%20Edwards%20EnterpriseOne%20Tools.%20%20Successful%20attacks%20of%20this%20vulnerability%20can%20result%20in%20%20unauthorized%20read%20access%20to%20a%20subset%20of%20JD%20Edwards%20EnterpriseOne%20Tools%20accessible%20data.&color=brightgreen) + +### Description + +Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Web Runtime SEC). Supported versions that are affected are Prior to 9.2.9.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Tools. Successful attacks of this vulnerability can result in unauthorized read access to a subset of JD Edwards EnterpriseOne Tools accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N). + +### POC + +#### Reference +- https://www.oracle.com/security-alerts/cpujan2025.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2025/CVE-2025-21515.md b/2025/CVE-2025-21515.md new file mode 100644 index 0000000000..5799f0f0a2 --- /dev/null +++ b/2025/CVE-2025-21515.md @@ -0,0 +1,17 @@ +### [CVE-2025-21515](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21515) +![](https://img.shields.io/static/v1?label=Product&message=JD%20Edwards%20EnterpriseOne%20Tools&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=*%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Easily%20exploitable%20vulnerability%20allows%20low%20privileged%20attacker%20with%20network%20access%20via%20HTTP%20to%20compromise%20JD%20Edwards%20EnterpriseOne%20Tools.%20%20Successful%20attacks%20of%20this%20vulnerability%20can%20result%20in%20takeover%20of%20JD%20Edwards%20EnterpriseOne%20Tools.&color=brightgreen) + +### Description + +Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Web Runtime SEC). Supported versions that are affected are Prior to 9.2.9.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Tools. Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). + +### POC + +#### Reference +- https://www.oracle.com/security-alerts/cpujan2025.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2025/CVE-2025-21516.md b/2025/CVE-2025-21516.md new file mode 100644 index 0000000000..9196f3c6fe --- /dev/null +++ b/2025/CVE-2025-21516.md @@ -0,0 +1,17 @@ +### [CVE-2025-21516](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21516) +![](https://img.shields.io/static/v1?label=Product&message=Oracle%20Customer%20Care&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=12.2.5%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Easily%20exploitable%20vulnerability%20allows%20low%20privileged%20attacker%20with%20network%20access%20via%20HTTP%20to%20compromise%20Oracle%20Customer%20Care.%20%20Successful%20attacks%20of%20this%20vulnerability%20can%20result%20in%20%20unauthorized%20creation%2C%20deletion%20or%20modification%20access%20to%20critical%20data%20or%20all%20Oracle%20Customer%20Care%20accessible%20data%20as%20well%20as%20%20unauthorized%20access%20to%20critical%20data%20or%20complete%20access%20to%20all%20Oracle%20Customer%20Care%20accessible%20data.&color=brightgreen) + +### Description + +Vulnerability in the Oracle Customer Care product of Oracle E-Business Suite (component: Service Requests). Supported versions that are affected are 12.2.5-12.2.13. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Customer Care. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Customer Care accessible data as well as unauthorized access to critical data or complete access to all Oracle Customer Care accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N). + +### POC + +#### Reference +- https://www.oracle.com/security-alerts/cpujan2025.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2025/CVE-2025-21517.md b/2025/CVE-2025-21517.md new file mode 100644 index 0000000000..f0be1e83ca --- /dev/null +++ b/2025/CVE-2025-21517.md @@ -0,0 +1,17 @@ +### [CVE-2025-21517](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21517) +![](https://img.shields.io/static/v1?label=Product&message=JD%20Edwards%20EnterpriseOne%20Tools&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=*%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Easily%20exploitable%20vulnerability%20allows%20low%20privileged%20attacker%20with%20network%20access%20via%20HTTP%20to%20compromise%20JD%20Edwards%20EnterpriseOne%20Tools.%20%20Successful%20attacks%20of%20this%20vulnerability%20can%20result%20in%20%20unauthorized%20update%2C%20insert%20or%20delete%20access%20to%20some%20of%20JD%20Edwards%20EnterpriseOne%20Tools%20accessible%20data.&color=brightgreen) + +### Description + +Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Web Runtime SEC). Supported versions that are affected are Prior to 9.2.9.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Tools. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of JD Edwards EnterpriseOne Tools accessible data. CVSS 3.1 Base Score 4.3 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N). + +### POC + +#### Reference +- https://www.oracle.com/security-alerts/cpujan2025.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2025/CVE-2025-21518.md b/2025/CVE-2025-21518.md index f22646452b..7738ba2589 100644 --- a/2025/CVE-2025-21518.md +++ b/2025/CVE-2025-21518.md @@ -11,7 +11,7 @@ Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Op ### POC #### Reference -No PoCs from references. +- https://www.oracle.com/security-alerts/cpujan2025.html #### Github - https://github.com/adegoodyer/kubernetes-admin-toolkit diff --git a/2025/CVE-2025-21519.md b/2025/CVE-2025-21519.md index a736caace4..8af24097ad 100644 --- a/2025/CVE-2025-21519.md +++ b/2025/CVE-2025-21519.md @@ -10,7 +10,7 @@ Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Se ### POC #### Reference -No PoCs from references. +- https://www.oracle.com/security-alerts/cpujan2025.html #### Github - https://github.com/adegoodyer/kubernetes-admin-toolkit diff --git a/2025/CVE-2025-21520.md b/2025/CVE-2025-21520.md new file mode 100644 index 0000000000..d802c39c1d --- /dev/null +++ b/2025/CVE-2025-21520.md @@ -0,0 +1,18 @@ +### [CVE-2025-21520](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21520) +![](https://img.shields.io/static/v1?label=Product&message=MySQL%20Cluster&color=blue) +![](https://img.shields.io/static/v1?label=Product&message=MySQL%20Server&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=*%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Difficult%20to%20exploit%20vulnerability%20allows%20high%20privileged%20attacker%20with%20logon%20to%20the%20infrastructure%20where%20MySQL%20Cluster%20executes%20to%20compromise%20MySQL%20Cluster.%20%20Successful%20attacks%20require%20human%20interaction%20from%20a%20person%20other%20than%20the%20attacker.%20Successful%20attacks%20of%20this%20vulnerability%20can%20result%20in%20%20unauthorized%20read%20access%20to%20a%20subset%20of%20MySQL%20Cluster%20accessible%20data.&color=brightgreen) + +### Description + +Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Options). Supported versions that are affected are 8.0.40 and prior, 8.4.3 and prior and 9.1.0 and prior. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where MySQL Server executes to compromise MySQL Server. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized read access to a subset of MySQL Server accessible data. CVSS 3.1 Base Score 1.8 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:L/I:N/A:N). + +### POC + +#### Reference +- https://www.oracle.com/security-alerts/cpujan2025.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2025/CVE-2025-21521.md b/2025/CVE-2025-21521.md index 42f22ee68d..d65b2a6abc 100644 --- a/2025/CVE-2025-21521.md +++ b/2025/CVE-2025-21521.md @@ -10,7 +10,7 @@ Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Th ### POC #### Reference -No PoCs from references. +- https://www.oracle.com/security-alerts/cpujan2025.html #### Github - https://github.com/adegoodyer/kubernetes-admin-toolkit diff --git a/2025/CVE-2025-21522.md b/2025/CVE-2025-21522.md index 8330739f66..a75ef09414 100644 --- a/2025/CVE-2025-21522.md +++ b/2025/CVE-2025-21522.md @@ -10,7 +10,7 @@ Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Pa ### POC #### Reference -No PoCs from references. +- https://www.oracle.com/security-alerts/cpujan2025.html #### Github - https://github.com/adegoodyer/kubernetes-admin-toolkit diff --git a/2025/CVE-2025-21523.md b/2025/CVE-2025-21523.md index 81dc144b39..142e54a296 100644 --- a/2025/CVE-2025-21523.md +++ b/2025/CVE-2025-21523.md @@ -10,7 +10,7 @@ Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). ### POC #### Reference -No PoCs from references. +- https://www.oracle.com/security-alerts/cpujan2025.html #### Github - https://github.com/adegoodyer/kubernetes-admin-toolkit diff --git a/2025/CVE-2025-21524.md b/2025/CVE-2025-21524.md new file mode 100644 index 0000000000..ec49a36f91 --- /dev/null +++ b/2025/CVE-2025-21524.md @@ -0,0 +1,17 @@ +### [CVE-2025-21524](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21524) +![](https://img.shields.io/static/v1?label=Product&message=JD%20Edwards%20EnterpriseOne%20Tools&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=*%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Easily%20exploitable%20vulnerability%20allows%20unauthenticated%20attacker%20with%20network%20access%20via%20HTTP%20to%20compromise%20JD%20Edwards%20EnterpriseOne%20Tools.%20%20Successful%20attacks%20of%20this%20vulnerability%20can%20result%20in%20takeover%20of%20JD%20Edwards%20EnterpriseOne%20Tools.&color=brightgreen) + +### Description + +Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Monitoring and Diagnostics SEC). Supported versions that are affected are Prior to 9.2.9.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Tools. Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). + +### POC + +#### Reference +- https://www.oracle.com/security-alerts/cpujan2025.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2025/CVE-2025-21525.md b/2025/CVE-2025-21525.md index e9d11dd823..90f45e7e47 100644 --- a/2025/CVE-2025-21525.md +++ b/2025/CVE-2025-21525.md @@ -10,7 +10,7 @@ Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DD ### POC #### Reference -No PoCs from references. +- https://www.oracle.com/security-alerts/cpujan2025.html #### Github - https://github.com/adegoodyer/kubernetes-admin-toolkit diff --git a/2025/CVE-2025-21526.md b/2025/CVE-2025-21526.md index cfd01044b7..a62af6d029 100644 --- a/2025/CVE-2025-21526.md +++ b/2025/CVE-2025-21526.md @@ -13,7 +13,7 @@ Vulnerability in the Primavera P6 Enterprise Project Portfolio Management produc ### POC #### Reference -No PoCs from references. +- https://www.oracle.com/security-alerts/cpujan2025.html #### Github - https://github.com/sonalvijit/cve diff --git a/2025/CVE-2025-21527.md b/2025/CVE-2025-21527.md new file mode 100644 index 0000000000..9881b1108b --- /dev/null +++ b/2025/CVE-2025-21527.md @@ -0,0 +1,17 @@ +### [CVE-2025-21527](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21527) +![](https://img.shields.io/static/v1?label=Product&message=JD%20Edwards%20EnterpriseOne%20Tools&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=*%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Easily%20exploitable%20vulnerability%20allows%20unauthenticated%20attacker%20with%20network%20access%20via%20HTTP%20to%20compromise%20JD%20Edwards%20EnterpriseOne%20Tools.%20%20Successful%20attacks%20require%20human%20interaction%20from%20a%20person%20other%20than%20the%20attacker%20and%20while%20the%20vulnerability%20is%20in%20JD%20Edwards%20EnterpriseOne%20Tools%2C%20attacks%20may%20significantly%20impact%20additional%20products%20(scope%20change).%20Successful%20attacks%20of%20this%20vulnerability%20can%20result%20in%20%20unauthorized%20update%2C%20insert%20or%20delete%20access%20to%20some%20of%20JD%20Edwards%20EnterpriseOne%20Tools%20accessible%20data%20as%20well%20as%20%20unauthorized%20read%20access%20to%20a%20subset%20of%20JD%20Edwards%20EnterpriseOne%20Tools%20accessible%20data.&color=brightgreen) + +### Description + +Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Design Tools SEC). Supported versions that are affected are Prior to 9.2.9.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Tools. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in JD Edwards EnterpriseOne Tools, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of JD Edwards EnterpriseOne Tools accessible data as well as unauthorized read access to a subset of JD Edwards EnterpriseOne Tools accessible data. CVSS 3.1 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). + +### POC + +#### Reference +- https://www.oracle.com/security-alerts/cpujan2025.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2025/CVE-2025-21528.md b/2025/CVE-2025-21528.md new file mode 100644 index 0000000000..5c3a29bd43 --- /dev/null +++ b/2025/CVE-2025-21528.md @@ -0,0 +1,20 @@ +### [CVE-2025-21528](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21528) +![](https://img.shields.io/static/v1?label=Product&message=Primavera%20P6%20Enterprise%20Project%20Portfolio%20Management&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=20.12.1.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=21.12.1.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=22.12.1.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=23.12.1.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Easily%20exploitable%20vulnerability%20allows%20unauthenticated%20attacker%20with%20network%20access%20via%20HTTP%20to%20compromise%20Primavera%20P6%20Enterprise%20Project%20Portfolio%20Management.%20%20Successful%20attacks%20require%20human%20interaction%20from%20a%20person%20other%20than%20the%20attacker.%20Successful%20attacks%20of%20this%20vulnerability%20can%20result%20in%20%20unauthorized%20update%2C%20insert%20or%20delete%20access%20to%20some%20of%20Primavera%20P6%20Enterprise%20Project%20Portfolio%20Management%20accessible%20data.&color=brightgreen) + +### Description + +Vulnerability in the Primavera P6 Enterprise Project Portfolio Management product of Oracle Construction and Engineering (component: Web Access). Supported versions that are affected are 20.12.1.0-20.12.21.5, 21.12.1.0-21.12.20.0, 22.12.1.0-22.12.16.0 and 23.12.1.0-23.12.10.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Primavera P6 Enterprise Project Portfolio Management. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Primavera P6 Enterprise Project Portfolio Management accessible data. CVSS 3.1 Base Score 4.3 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N). + +### POC + +#### Reference +- https://www.oracle.com/security-alerts/cpujan2025.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2025/CVE-2025-21529.md b/2025/CVE-2025-21529.md index d381083c19..e51f3e2614 100644 --- a/2025/CVE-2025-21529.md +++ b/2025/CVE-2025-21529.md @@ -10,7 +10,7 @@ Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: In ### POC #### Reference -No PoCs from references. +- https://www.oracle.com/security-alerts/cpujan2025.html #### Github - https://github.com/adegoodyer/kubernetes-admin-toolkit diff --git a/2025/CVE-2025-21530.md b/2025/CVE-2025-21530.md new file mode 100644 index 0000000000..79762b97e5 --- /dev/null +++ b/2025/CVE-2025-21530.md @@ -0,0 +1,18 @@ +### [CVE-2025-21530](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21530) +![](https://img.shields.io/static/v1?label=Product&message=PeopleSoft%20Enterprise%20PeopleTools&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=8.60%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=8.61%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Easily%20exploitable%20vulnerability%20allows%20low%20privileged%20attacker%20with%20network%20access%20via%20HTTP%20to%20compromise%20PeopleSoft%20Enterprise%20PeopleTools.%20%20Successful%20attacks%20of%20this%20vulnerability%20can%20result%20in%20%20unauthorized%20read%20access%20to%20a%20subset%20of%20PeopleSoft%20Enterprise%20PeopleTools%20accessible%20data.&color=brightgreen) + +### Description + +Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Panel Processor). Supported versions that are affected are 8.60 and 8.61. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. Successful attacks of this vulnerability can result in unauthorized read access to a subset of PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.1 Base Score 4.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N). + +### POC + +#### Reference +- https://www.oracle.com/security-alerts/cpujan2025.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2025/CVE-2025-21531.md b/2025/CVE-2025-21531.md new file mode 100644 index 0000000000..77c4e2f301 --- /dev/null +++ b/2025/CVE-2025-21531.md @@ -0,0 +1,18 @@ +### [CVE-2025-21531](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21531) +![](https://img.shields.io/static/v1?label=Product&message=MySQL%20Cluster&color=blue) +![](https://img.shields.io/static/v1?label=Product&message=MySQL%20Server&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=*%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Easily%20exploitable%20vulnerability%20allows%20high%20privileged%20attacker%20with%20network%20access%20via%20multiple%20protocols%20to%20compromise%20MySQL%20Cluster.%20%20Successful%20attacks%20of%20this%20vulnerability%20can%20result%20in%20unauthorized%20ability%20to%20cause%20a%20hang%20or%20frequently%20repeatable%20crash%20(complete%20DOS)%20of%20MySQL%20Cluster.&color=brightgreen) + +### Description + +Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.40 and prior, 8.4.3 and prior and 9.1.0 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). + +### POC + +#### Reference +- https://www.oracle.com/security-alerts/cpujan2025.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2025/CVE-2025-21532.md b/2025/CVE-2025-21532.md new file mode 100644 index 0000000000..0601601837 --- /dev/null +++ b/2025/CVE-2025-21532.md @@ -0,0 +1,17 @@ +### [CVE-2025-21532](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21532) +![](https://img.shields.io/static/v1?label=Product&message=Oracle%20Analytics%20Desktop&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=*%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Easily%20exploitable%20vulnerability%20allows%20low%20privileged%20attacker%20with%20logon%20to%20the%20infrastructure%20where%20Oracle%20Analytics%20Desktop%20executes%20to%20compromise%20Oracle%20Analytics%20Desktop.%20%20Successful%20attacks%20of%20this%20vulnerability%20can%20result%20in%20takeover%20of%20Oracle%20Analytics%20Desktop.&color=brightgreen) + +### Description + +Vulnerability in the Oracle Analytics Desktop product of Oracle Analytics (component: Install). Supported versions that are affected are Prior to 8.1.0. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Analytics Desktop executes to compromise Oracle Analytics Desktop. Successful attacks of this vulnerability can result in takeover of Oracle Analytics Desktop. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). + +### POC + +#### Reference +- https://www.oracle.com/security-alerts/cpujan2025.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2025/CVE-2025-21533.md b/2025/CVE-2025-21533.md new file mode 100644 index 0000000000..1f3f2d0bac --- /dev/null +++ b/2025/CVE-2025-21533.md @@ -0,0 +1,17 @@ +### [CVE-2025-21533](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21533) +![](https://img.shields.io/static/v1?label=Product&message=Oracle%20VM%20VirtualBox&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=*%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Easily%20exploitable%20vulnerability%20allows%20low%20privileged%20attacker%20with%20logon%20to%20the%20infrastructure%20where%20Oracle%20VM%20VirtualBox%20executes%20to%20compromise%20Oracle%20VM%20VirtualBox.%20%20Successful%20attacks%20of%20this%20vulnerability%20can%20result%20in%20%20unauthorized%20access%20to%20critical%20data%20or%20complete%20access%20to%20all%20Oracle%20VM%20VirtualBox%20accessible%20data.&color=brightgreen) + +### Description + +Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 7.0.24 and prior to 7.1.6. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle VM VirtualBox accessible data. CVSS 3.1 Base Score 5.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). + +### POC + +#### Reference +- https://www.oracle.com/security-alerts/cpujan2025.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2025/CVE-2025-21534.md b/2025/CVE-2025-21534.md index 2016ad664a..4f9ea187f8 100644 --- a/2025/CVE-2025-21534.md +++ b/2025/CVE-2025-21534.md @@ -10,7 +10,7 @@ Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Pe ### POC #### Reference -No PoCs from references. +- https://www.oracle.com/security-alerts/cpujan2025.html #### Github - https://github.com/adegoodyer/kubernetes-admin-toolkit diff --git a/2025/CVE-2025-21535.md b/2025/CVE-2025-21535.md new file mode 100644 index 0000000000..2ce803f83c --- /dev/null +++ b/2025/CVE-2025-21535.md @@ -0,0 +1,18 @@ +### [CVE-2025-21535](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21535) +![](https://img.shields.io/static/v1?label=Product&message=Oracle%20WebLogic%20Server&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=12.2.1.4.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=14.1.1.0.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Easily%20exploitable%20vulnerability%20allows%20unauthenticated%20attacker%20with%20network%20access%20via%20T3%2C%20IIOP%20to%20compromise%20Oracle%20WebLogic%20Server.%20%20Successful%20attacks%20of%20this%20vulnerability%20can%20result%20in%20takeover%20of%20Oracle%20WebLogic%20Server.&color=brightgreen) + +### Description + +Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). + +### POC + +#### Reference +- https://www.oracle.com/security-alerts/cpujan2025.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2025/CVE-2025-21536.md b/2025/CVE-2025-21536.md index f2c134395c..c1fc949dcc 100644 --- a/2025/CVE-2025-21536.md +++ b/2025/CVE-2025-21536.md @@ -10,7 +10,7 @@ Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Op ### POC #### Reference -No PoCs from references. +- https://www.oracle.com/security-alerts/cpujan2025.html #### Github - https://github.com/adegoodyer/kubernetes-admin-toolkit diff --git a/2025/CVE-2025-21537.md b/2025/CVE-2025-21537.md new file mode 100644 index 0000000000..0774d54969 --- /dev/null +++ b/2025/CVE-2025-21537.md @@ -0,0 +1,17 @@ +### [CVE-2025-21537](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21537) +![](https://img.shields.io/static/v1?label=Product&message=PeopleSoft%20Enterprise%20FIN%20Cash%20Management&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=9.2%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Easily%20exploitable%20vulnerability%20allows%20low%20privileged%20attacker%20with%20network%20access%20via%20HTTP%20to%20compromise%20PeopleSoft%20Enterprise%20FIN%20Cash%20Management.%20%20Successful%20attacks%20of%20this%20vulnerability%20can%20result%20in%20%20unauthorized%20update%2C%20insert%20or%20delete%20access%20to%20some%20of%20PeopleSoft%20Enterprise%20FIN%20Cash%20Management%20accessible%20data%20as%20well%20as%20%20unauthorized%20read%20access%20to%20a%20subset%20of%20PeopleSoft%20Enterprise%20FIN%20Cash%20Management%20accessible%20data.&color=brightgreen) + +### Description + +Vulnerability in the PeopleSoft Enterprise FIN Cash Management product of Oracle PeopleSoft (component: Cash Management). The supported version that is affected is 9.2. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise FIN Cash Management. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of PeopleSoft Enterprise FIN Cash Management accessible data as well as unauthorized read access to a subset of PeopleSoft Enterprise FIN Cash Management accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N). + +### POC + +#### Reference +- https://www.oracle.com/security-alerts/cpujan2025.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2025/CVE-2025-21538.md b/2025/CVE-2025-21538.md new file mode 100644 index 0000000000..0fa32c90c8 --- /dev/null +++ b/2025/CVE-2025-21538.md @@ -0,0 +1,17 @@ +### [CVE-2025-21538](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21538) +![](https://img.shields.io/static/v1?label=Product&message=JD%20Edwards%20EnterpriseOne%20Tools&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=*%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Easily%20exploitable%20vulnerability%20allows%20unauthenticated%20attacker%20with%20network%20access%20via%20HTTP%20to%20compromise%20JD%20Edwards%20EnterpriseOne%20Tools.%20%20Successful%20attacks%20require%20human%20interaction%20from%20a%20person%20other%20than%20the%20attacker%20and%20while%20the%20vulnerability%20is%20in%20JD%20Edwards%20EnterpriseOne%20Tools%2C%20attacks%20may%20significantly%20impact%20additional%20products%20(scope%20change).%20Successful%20attacks%20of%20this%20vulnerability%20can%20result%20in%20%20unauthorized%20update%2C%20insert%20or%20delete%20access%20to%20some%20of%20JD%20Edwards%20EnterpriseOne%20Tools%20accessible%20data%20as%20well%20as%20%20unauthorized%20read%20access%20to%20a%20subset%20of%20JD%20Edwards%20EnterpriseOne%20Tools%20accessible%20data.&color=brightgreen) + +### Description + +Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Web Runtime SEC). Supported versions that are affected are Prior to 9.2.9.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Tools. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in JD Edwards EnterpriseOne Tools, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of JD Edwards EnterpriseOne Tools accessible data as well as unauthorized read access to a subset of JD Edwards EnterpriseOne Tools accessible data. CVSS 3.1 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). + +### POC + +#### Reference +- https://www.oracle.com/security-alerts/cpujan2025.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2025/CVE-2025-21539.md b/2025/CVE-2025-21539.md new file mode 100644 index 0000000000..5f22082a26 --- /dev/null +++ b/2025/CVE-2025-21539.md @@ -0,0 +1,17 @@ +### [CVE-2025-21539](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21539) +![](https://img.shields.io/static/v1?label=Product&message=PeopleSoft%20Enterprise%20FIN%20eSettlements&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=9.2%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Easily%20exploitable%20vulnerability%20allows%20low%20privileged%20attacker%20with%20network%20access%20via%20HTTP%20to%20compromise%20PeopleSoft%20Enterprise%20FIN%20eSettlements.%20%20Successful%20attacks%20of%20this%20vulnerability%20can%20result%20in%20%20unauthorized%20update%2C%20insert%20or%20delete%20access%20to%20some%20of%20PeopleSoft%20Enterprise%20FIN%20eSettlements%20accessible%20data%20as%20well%20as%20%20unauthorized%20read%20access%20to%20a%20subset%20of%20PeopleSoft%20Enterprise%20FIN%20eSettlements%20accessible%20data.&color=brightgreen) + +### Description + +Vulnerability in the PeopleSoft Enterprise FIN eSettlements product of Oracle PeopleSoft (component: eSettlements). The supported version that is affected is 9.2. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise FIN eSettlements. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of PeopleSoft Enterprise FIN eSettlements accessible data as well as unauthorized read access to a subset of PeopleSoft Enterprise FIN eSettlements accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N). + +### POC + +#### Reference +- https://www.oracle.com/security-alerts/cpujan2025.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2025/CVE-2025-21540.md b/2025/CVE-2025-21540.md index 3542ac93df..823a21c47a 100644 --- a/2025/CVE-2025-21540.md +++ b/2025/CVE-2025-21540.md @@ -10,7 +10,7 @@ Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Se ### POC #### Reference -No PoCs from references. +- https://www.oracle.com/security-alerts/cpujan2025.html #### Github - https://github.com/adegoodyer/kubernetes-admin-toolkit diff --git a/2025/CVE-2025-21541.md b/2025/CVE-2025-21541.md new file mode 100644 index 0000000000..52d2443093 --- /dev/null +++ b/2025/CVE-2025-21541.md @@ -0,0 +1,17 @@ +### [CVE-2025-21541](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21541) +![](https://img.shields.io/static/v1?label=Product&message=Oracle%20Workflow&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=12.2.3%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Easily%20exploitable%20vulnerability%20allows%20low%20privileged%20attacker%20with%20network%20access%20via%20HTTP%20to%20compromise%20Oracle%20Workflow.%20%20Successful%20attacks%20of%20this%20vulnerability%20can%20result%20in%20%20unauthorized%20update%2C%20insert%20or%20delete%20access%20to%20some%20of%20Oracle%20Workflow%20accessible%20data%20as%20well%20as%20%20unauthorized%20read%20access%20to%20a%20subset%20of%20Oracle%20Workflow%20accessible%20data.&color=brightgreen) + +### Description + +Vulnerability in the Oracle Workflow product of Oracle E-Business Suite (component: Admin Screens and Grants UI). Supported versions that are affected are 12.2.3-12.2.14. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Workflow. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Workflow accessible data as well as unauthorized read access to a subset of Oracle Workflow accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N). + +### POC + +#### Reference +- https://www.oracle.com/security-alerts/cpujan2025.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2025/CVE-2025-21542.md b/2025/CVE-2025-21542.md new file mode 100644 index 0000000000..6ebe58cdd8 --- /dev/null +++ b/2025/CVE-2025-21542.md @@ -0,0 +1,19 @@ +### [CVE-2025-21542](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21542) +![](https://img.shields.io/static/v1?label=Product&message=Oracle%20Communications%20Order%20and%20Service%20Management&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=7.4.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=7.4.1%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=7.5.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Easily%20exploitable%20vulnerability%20allows%20low%20privileged%20attacker%20with%20network%20access%20via%20HTTP%20to%20compromise%20Oracle%20Communications%20Order%20and%20Service%20Management.%20%20Successful%20attacks%20of%20this%20vulnerability%20can%20result%20in%20%20unauthorized%20update%2C%20insert%20or%20delete%20access%20to%20some%20of%20Oracle%20Communications%20Order%20and%20Service%20Management%20accessible%20data%20as%20well%20as%20%20unauthorized%20read%20access%20to%20a%20subset%20of%20Oracle%20Communications%20Order%20and%20Service%20Management%20accessible%20data%20and%20unauthorized%20ability%20to%20cause%20a%20partial%20denial%20of%20service%20(partial%20DOS)%20of%20Oracle%20Communications%20Order%20and%20Service%20Management.&color=brightgreen) + +### Description + +Vulnerability in the Oracle Communications Order and Service Management product of Oracle Communications Applications (component: Security). Supported versions that are affected are 7.4.0, 7.4.1 and 7.5.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Communications Order and Service Management. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Communications Order and Service Management accessible data as well as unauthorized read access to a subset of Oracle Communications Order and Service Management accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Communications Order and Service Management. CVSS 3.1 Base Score 6.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L). + +### POC + +#### Reference +- https://www.oracle.com/security-alerts/cpujan2025.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2025/CVE-2025-21543.md b/2025/CVE-2025-21543.md new file mode 100644 index 0000000000..01b98d4b30 --- /dev/null +++ b/2025/CVE-2025-21543.md @@ -0,0 +1,18 @@ +### [CVE-2025-21543](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21543) +![](https://img.shields.io/static/v1?label=Product&message=MySQL%20Cluster&color=blue) +![](https://img.shields.io/static/v1?label=Product&message=MySQL%20Server&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=*%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Easily%20exploitable%20vulnerability%20allows%20high%20privileged%20attacker%20with%20network%20access%20via%20multiple%20protocols%20to%20compromise%20MySQL%20Cluster.%20%20Successful%20attacks%20of%20this%20vulnerability%20can%20result%20in%20unauthorized%20ability%20to%20cause%20a%20hang%20or%20frequently%20repeatable%20crash%20(complete%20DOS)%20of%20MySQL%20Cluster.&color=brightgreen) + +### Description + +Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Packaging). Supported versions that are affected are 8.0.40 and prior, 8.4.3 and prior and 9.1.0 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). + +### POC + +#### Reference +- https://www.oracle.com/security-alerts/cpujan2025.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2025/CVE-2025-21544.md b/2025/CVE-2025-21544.md new file mode 100644 index 0000000000..e5a9f12c67 --- /dev/null +++ b/2025/CVE-2025-21544.md @@ -0,0 +1,19 @@ +### [CVE-2025-21544](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21544) +![](https://img.shields.io/static/v1?label=Product&message=Oracle%20Communications%20Order%20and%20Service%20Management&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=7.4.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=7.4.1%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=7.5.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Easily%20exploitable%20vulnerability%20allows%20low%20privileged%20attacker%20with%20network%20access%20via%20HTTP%20to%20compromise%20Oracle%20Communications%20Order%20and%20Service%20Management.%20%20Successful%20attacks%20require%20human%20interaction%20from%20a%20person%20other%20than%20the%20attacker%20and%20while%20the%20vulnerability%20is%20in%20Oracle%20Communications%20Order%20and%20Service%20Management%2C%20attacks%20may%20significantly%20impact%20additional%20products%20(scope%20change).%20Successful%20attacks%20of%20this%20vulnerability%20can%20result%20in%20%20unauthorized%20update%2C%20insert%20or%20delete%20access%20to%20some%20of%20Oracle%20Communications%20Order%20and%20Service%20Management%20accessible%20data%20as%20well%20as%20%20unauthorized%20read%20access%20to%20a%20subset%20of%20Oracle%20Communications%20Order%20and%20Service%20Management%20accessible%20data.&color=brightgreen) + +### Description + +Vulnerability in the Oracle Communications Order and Service Management product of Oracle Communications Applications (component: Security). Supported versions that are affected are 7.4.0, 7.4.1 and 7.5.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Communications Order and Service Management. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Communications Order and Service Management, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Communications Order and Service Management accessible data as well as unauthorized read access to a subset of Oracle Communications Order and Service Management accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N). + +### POC + +#### Reference +- https://www.oracle.com/security-alerts/cpujan2025.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2025/CVE-2025-21545.md b/2025/CVE-2025-21545.md new file mode 100644 index 0000000000..276b55cbc7 --- /dev/null +++ b/2025/CVE-2025-21545.md @@ -0,0 +1,18 @@ +### [CVE-2025-21545](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21545) +![](https://img.shields.io/static/v1?label=Product&message=PeopleSoft%20Enterprise%20PeopleTools&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=8.60%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=8.61%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Easily%20exploitable%20vulnerability%20allows%20unauthenticated%20attacker%20with%20network%20access%20via%20HTTP%20to%20compromise%20PeopleSoft%20Enterprise%20PeopleTools.%20%20Successful%20attacks%20of%20this%20vulnerability%20can%20result%20in%20unauthorized%20ability%20to%20cause%20a%20hang%20or%20frequently%20repeatable%20crash%20(complete%20DOS)%20of%20PeopleSoft%20Enterprise%20PeopleTools.&color=brightgreen) + +### Description + +Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: OpenSearch). Supported versions that are affected are 8.60 and 8.61. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of PeopleSoft Enterprise PeopleTools. CVSS 3.1 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). + +### POC + +#### Reference +- https://www.oracle.com/security-alerts/cpujan2025.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2025/CVE-2025-21546.md b/2025/CVE-2025-21546.md index 6c4e81a788..63e3d783ce 100644 --- a/2025/CVE-2025-21546.md +++ b/2025/CVE-2025-21546.md @@ -10,7 +10,7 @@ Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Se ### POC #### Reference -No PoCs from references. +- https://www.oracle.com/security-alerts/cpujan2025.html #### Github - https://github.com/adegoodyer/kubernetes-admin-toolkit diff --git a/2025/CVE-2025-21547.md b/2025/CVE-2025-21547.md new file mode 100644 index 0000000000..3f1069fed5 --- /dev/null +++ b/2025/CVE-2025-21547.md @@ -0,0 +1,20 @@ +### [CVE-2025-21547](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21547) +![](https://img.shields.io/static/v1?label=Product&message=Oracle%20Hospitality%20OPERA%205&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=5.6.19.20%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=5.6.25.8%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=5.6.26.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=5.6.27.1%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Easily%20exploitable%20vulnerability%20allows%20unauthenticated%20attacker%20with%20network%20access%20via%20HTTP%20to%20compromise%20Oracle%20Hospitality%20OPERA%205.%20%20Successful%20attacks%20of%20this%20vulnerability%20can%20result%20in%20%20unauthorized%20access%20to%20critical%20data%20or%20complete%20access%20to%20all%20Oracle%20Hospitality%20OPERA%205%20accessible%20data%20and%20unauthorized%20ability%20to%20cause%20a%20hang%20or%20frequently%20repeatable%20crash%20(complete%20DOS)%20of%20Oracle%20Hospitality%20OPERA%205.&color=brightgreen) + +### Description + +Vulnerability in the Oracle Hospitality OPERA 5 product of Oracle Hospitality Applications (component: Opera Servlet). Supported versions that are affected are 5.6.19.20, 5.6.25.8, 5.6.26.6 and 5.6.27.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Hospitality OPERA 5. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Hospitality OPERA 5 accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Hospitality OPERA 5. CVSS 3.1 Base Score 9.1 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H). + +### POC + +#### Reference +- https://www.oracle.com/security-alerts/cpujan2025.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2025/CVE-2025-21548.md b/2025/CVE-2025-21548.md index bb511bf184..39c582165f 100644 --- a/2025/CVE-2025-21548.md +++ b/2025/CVE-2025-21548.md @@ -10,7 +10,7 @@ Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connec ### POC #### Reference -No PoCs from references. +- https://www.oracle.com/security-alerts/cpujan2025.html #### Github - https://github.com/ARPSyndicate/cve-scores diff --git a/2025/CVE-2025-21549.md b/2025/CVE-2025-21549.md new file mode 100644 index 0000000000..451fdab0b9 --- /dev/null +++ b/2025/CVE-2025-21549.md @@ -0,0 +1,17 @@ +### [CVE-2025-21549](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21549) +![](https://img.shields.io/static/v1?label=Product&message=Oracle%20WebLogic%20Server&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=14.1.1.0.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Easily%20exploitable%20vulnerability%20allows%20unauthenticated%20attacker%20with%20network%20access%20via%20HTTP%2F2%20to%20compromise%20Oracle%20WebLogic%20Server.%20%20Successful%20attacks%20of%20this%20vulnerability%20can%20result%20in%20unauthorized%20ability%20to%20cause%20a%20hang%20or%20frequently%20repeatable%20crash%20(complete%20DOS)%20of%20Oracle%20WebLogic%20Server.&color=brightgreen) + +### Description + +Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). The supported version that is affected is 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP/2 to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle WebLogic Server. CVSS 3.1 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). + +### POC + +#### Reference +- https://www.oracle.com/security-alerts/cpujan2025.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2025/CVE-2025-21550.md b/2025/CVE-2025-21550.md new file mode 100644 index 0000000000..e05b653239 --- /dev/null +++ b/2025/CVE-2025-21550.md @@ -0,0 +1,19 @@ +### [CVE-2025-21550](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21550) +![](https://img.shields.io/static/v1?label=Product&message=Oracle%20Financial%20Services%20Behavior%20Detection%20Platform&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=8.0.8.1%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=8.1.2.7%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=8.1.2.8%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Easily%20exploitable%20vulnerability%20allows%20unauthenticated%20attacker%20with%20network%20access%20via%20HTTP%20to%20compromise%20Oracle%20Financial%20Services%20Behavior%20Detection%20Platform.%20%20Successful%20attacks%20require%20human%20interaction%20from%20a%20person%20other%20than%20the%20attacker%20and%20while%20the%20vulnerability%20is%20in%20Oracle%20Financial%20Services%20Behavior%20Detection%20Platform%2C%20attacks%20may%20significantly%20impact%20additional%20products%20(scope%20change).%20Successful%20attacks%20of%20this%20vulnerability%20can%20result%20in%20%20unauthorized%20update%2C%20insert%20or%20delete%20access%20to%20some%20of%20Oracle%20Financial%20Services%20Behavior%20Detection%20Platform%20accessible%20data%20as%20well%20as%20%20unauthorized%20read%20access%20to%20a%20subset%20of%20Oracle%20Financial%20Services%20Behavior%20Detection%20Platform%20accessible%20data.&color=brightgreen) + +### Description + +Vulnerability in the Oracle Financial Services Behavior Detection Platform product of Oracle Financial Services Applications (component: Web UI). Supported versions that are affected are 8.0.8.1, 8.1.2.7 and 8.1.2.8. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Financial Services Behavior Detection Platform. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Financial Services Behavior Detection Platform, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Financial Services Behavior Detection Platform accessible data as well as unauthorized read access to a subset of Oracle Financial Services Behavior Detection Platform accessible data. CVSS 3.1 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). + +### POC + +#### Reference +- https://www.oracle.com/security-alerts/cpujan2025.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2025/CVE-2025-21551.md b/2025/CVE-2025-21551.md new file mode 100644 index 0000000000..0e8fa842dd --- /dev/null +++ b/2025/CVE-2025-21551.md @@ -0,0 +1,17 @@ +### [CVE-2025-21551](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21551) +![](https://img.shields.io/static/v1?label=Product&message=Oracle%20Solaris&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=11%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Easily%20exploitable%20vulnerability%20allows%20high%20privileged%20attacker%20with%20logon%20to%20the%20infrastructure%20where%20Oracle%20Solaris%20executes%20to%20compromise%20Oracle%20Solaris.%20%20Successful%20attacks%20of%20this%20vulnerability%20can%20result%20in%20%20unauthorized%20creation%2C%20deletion%20or%20modification%20access%20to%20critical%20data%20or%20all%20Oracle%20Solaris%20accessible%20data%20and%20unauthorized%20ability%20to%20cause%20a%20hang%20or%20frequently%20repeatable%20crash%20(complete%20DOS)%20of%20Oracle%20Solaris.&color=brightgreen) + +### Description + +Vulnerability in the Oracle Solaris product of Oracle Systems (component: File system). The supported version that is affected is 11. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle Solaris executes to compromise Oracle Solaris. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Solaris accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Solaris. CVSS 3.1 Base Score 6.0 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H). + +### POC + +#### Reference +- https://www.oracle.com/security-alerts/cpujan2025.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2025/CVE-2025-21552.md b/2025/CVE-2025-21552.md new file mode 100644 index 0000000000..2af17c390e --- /dev/null +++ b/2025/CVE-2025-21552.md @@ -0,0 +1,17 @@ +### [CVE-2025-21552](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21552) +![](https://img.shields.io/static/v1?label=Product&message=JD%20Edwards%20EnterpriseOne%20Orchestrator&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=*%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Easily%20exploitable%20vulnerability%20allows%20low%20privileged%20attacker%20with%20network%20access%20via%20HTTP%20to%20compromise%20JD%20Edwards%20EnterpriseOne%20Orchestrator.%20%20Successful%20attacks%20of%20this%20vulnerability%20can%20result%20in%20%20unauthorized%20access%20to%20critical%20data%20or%20complete%20access%20to%20all%20JD%20Edwards%20EnterpriseOne%20Orchestrator%20accessible%20data.&color=brightgreen) + +### Description + +Vulnerability in the JD Edwards EnterpriseOne Orchestrator product of Oracle JD Edwards (component: E1 IOT Orchestrator Security). Supported versions that are affected are Prior to 9.2.9.2. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Orchestrator. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all JD Edwards EnterpriseOne Orchestrator accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). + +### POC + +#### Reference +- https://www.oracle.com/security-alerts/cpujan2025.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2025/CVE-2025-21553.md b/2025/CVE-2025-21553.md new file mode 100644 index 0000000000..dae34dc37e --- /dev/null +++ b/2025/CVE-2025-21553.md @@ -0,0 +1,19 @@ +### [CVE-2025-21553](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21553) +![](https://img.shields.io/static/v1?label=Product&message=Oracle%20Database%20Server&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=19.3%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=21.3%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=23.4%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Difficult%20to%20exploit%20vulnerability%20allows%20low%20privileged%20attacker%20having%20Create%20Session%2C%20Create%20Procedure%20privilege%20with%20network%20access%20via%20Oracle%20Net%20to%20compromise%20Java%20VM.%20%20Successful%20attacks%20of%20this%20vulnerability%20can%20result%20in%20%20unauthorized%20update%2C%20insert%20or%20delete%20access%20to%20some%20of%20Java%20VM%20accessible%20data%20as%20well%20as%20%20unauthorized%20read%20access%20to%20a%20subset%20of%20Java%20VM%20accessible%20data.&color=brightgreen) + +### Description + +Vulnerability in the Java VM component of Oracle Database Server. Supported versions that are affected are 19.3-19.25, 21.3-21.16 and 23.4-23.6. Difficult to exploit vulnerability allows low privileged attacker having Create Session, Create Procedure privilege with network access via Oracle Net to compromise Java VM. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Java VM accessible data as well as unauthorized read access to a subset of Java VM accessible data. CVSS 3.1 Base Score 4.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N). + +### POC + +#### Reference +- https://www.oracle.com/security-alerts/cpujan2025.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2025/CVE-2025-21554.md b/2025/CVE-2025-21554.md new file mode 100644 index 0000000000..af238c4796 --- /dev/null +++ b/2025/CVE-2025-21554.md @@ -0,0 +1,19 @@ +### [CVE-2025-21554](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21554) +![](https://img.shields.io/static/v1?label=Product&message=Oracle%20Communications%20Order%20and%20Service%20Management&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=7.4.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=7.4.1%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=7.5.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Easily%20exploitable%20vulnerability%20allows%20unauthenticated%20attacker%20with%20network%20access%20via%20HTTP%20to%20compromise%20Oracle%20Communications%20Order%20and%20Service%20Management.%20%20Successful%20attacks%20of%20this%20vulnerability%20can%20result%20in%20%20unauthorized%20read%20access%20to%20a%20subset%20of%20Oracle%20Communications%20Order%20and%20Service%20Management%20accessible%20data.&color=brightgreen) + +### Description + +Vulnerability in the Oracle Communications Order and Service Management product of Oracle Communications Applications (component: Security). Supported versions that are affected are 7.4.0, 7.4.1 and 7.5.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Order and Service Management. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Communications Order and Service Management accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N). + +### POC + +#### Reference +- https://www.oracle.com/security-alerts/cpujan2025.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2025/CVE-2025-21555.md b/2025/CVE-2025-21555.md index 3a72f3fcd0..79eaccc220 100644 --- a/2025/CVE-2025-21555.md +++ b/2025/CVE-2025-21555.md @@ -10,7 +10,7 @@ Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). ### POC #### Reference -No PoCs from references. +- https://www.oracle.com/security-alerts/cpujan2025.html #### Github - https://github.com/adegoodyer/kubernetes-admin-toolkit diff --git a/2025/CVE-2025-21556.md b/2025/CVE-2025-21556.md new file mode 100644 index 0000000000..fc5551f56f --- /dev/null +++ b/2025/CVE-2025-21556.md @@ -0,0 +1,17 @@ +### [CVE-2025-21556](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21556) +![](https://img.shields.io/static/v1?label=Product&message=Oracle%20Agile%20PLM%20Framework&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=9.3.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Easily%20exploitable%20vulnerability%20allows%20low%20privileged%20attacker%20with%20network%20access%20via%20HTTP%20to%20compromise%20Oracle%20Agile%20PLM%20Framework.%20%20While%20the%20vulnerability%20is%20in%20Oracle%20Agile%20PLM%20Framework%2C%20attacks%20may%20significantly%20impact%20additional%20products%20(scope%20change).%20%20Successful%20attacks%20of%20this%20vulnerability%20can%20result%20in%20takeover%20of%20Oracle%20Agile%20PLM%20Framework.&color=brightgreen) + +### Description + +Vulnerability in the Oracle Agile PLM Framework product of Oracle Supply Chain (component: Agile Integration Services). The supported version that is affected is 9.3.6. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Agile PLM Framework. While the vulnerability is in Oracle Agile PLM Framework, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Agile PLM Framework. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H). + +### POC + +#### Reference +- https://www.oracle.com/security-alerts/cpujan2025.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2025/CVE-2025-21557.md b/2025/CVE-2025-21557.md new file mode 100644 index 0000000000..a09c0f988d --- /dev/null +++ b/2025/CVE-2025-21557.md @@ -0,0 +1,18 @@ +### [CVE-2025-21557](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21557) +![](https://img.shields.io/static/v1?label=Product&message=Oracle%20Application%20Express&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=23.2%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=24.1%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Easily%20exploitable%20vulnerability%20allows%20low%20privileged%20attacker%20with%20network%20access%20via%20HTTP%20to%20compromise%20Oracle%20Application%20Express.%20%20Successful%20attacks%20require%20human%20interaction%20from%20a%20person%20other%20than%20the%20attacker%20and%20while%20the%20vulnerability%20is%20in%20Oracle%20Application%20Express%2C%20attacks%20may%20significantly%20impact%20additional%20products%20(scope%20change).%20Successful%20attacks%20of%20this%20vulnerability%20can%20result%20in%20%20unauthorized%20update%2C%20insert%20or%20delete%20access%20to%20some%20of%20Oracle%20Application%20Express%20accessible%20data%20as%20well%20as%20%20unauthorized%20read%20access%20to%20a%20subset%20of%20Oracle%20Application%20Express%20accessible%20data.&color=brightgreen) + +### Description + +Vulnerability in Oracle Application Express (component: General). Supported versions that are affected are 23.2 and 24.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Application Express. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Application Express, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Application Express accessible data as well as unauthorized read access to a subset of Oracle Application Express accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N). + +### POC + +#### Reference +- https://www.oracle.com/security-alerts/cpujan2025.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2025/CVE-2025-21558.md b/2025/CVE-2025-21558.md new file mode 100644 index 0000000000..7c133bf83d --- /dev/null +++ b/2025/CVE-2025-21558.md @@ -0,0 +1,19 @@ +### [CVE-2025-21558](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21558) +![](https://img.shields.io/static/v1?label=Product&message=Primavera%20P6%20Enterprise%20Project%20Portfolio%20Management&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=20.12.1.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=21.12.1.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=22.12.1.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Easily%20exploitable%20vulnerability%20allows%20low%20privileged%20attacker%20with%20network%20access%20via%20HTTP%20to%20compromise%20Primavera%20P6%20Enterprise%20Project%20Portfolio%20Management.%20%20Successful%20attacks%20require%20human%20interaction%20from%20a%20person%20other%20than%20the%20attacker%20and%20while%20the%20vulnerability%20is%20in%20Primavera%20P6%20Enterprise%20Project%20Portfolio%20Management%2C%20attacks%20may%20significantly%20impact%20additional%20products%20(scope%20change).%20Successful%20attacks%20of%20this%20vulnerability%20can%20result%20in%20%20unauthorized%20update%2C%20insert%20or%20delete%20access%20to%20some%20of%20Primavera%20P6%20Enterprise%20Project%20Portfolio%20Management%20accessible%20data%20as%20well%20as%20%20unauthorized%20read%20access%20to%20a%20subset%20of%20Primavera%20P6%20Enterprise%20Project%20Portfolio%20Management%20accessible%20data.&color=brightgreen) + +### Description + +Vulnerability in the Primavera P6 Enterprise Project Portfolio Management product of Oracle Construction and Engineering (component: Web Access). Supported versions that are affected are 20.12.1.0-20.12.21.5, 21.12.1.0-21.12.20.0 and 22.12.1.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Primavera P6 Enterprise Project Portfolio Management. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Primavera P6 Enterprise Project Portfolio Management, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Primavera P6 Enterprise Project Portfolio Management accessible data as well as unauthorized read access to a subset of Primavera P6 Enterprise Project Portfolio Management accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N). + +### POC + +#### Reference +- https://www.oracle.com/security-alerts/cpujan2025.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2025/CVE-2025-21559.md b/2025/CVE-2025-21559.md index a0edb3c22e..8aa74b715e 100644 --- a/2025/CVE-2025-21559.md +++ b/2025/CVE-2025-21559.md @@ -10,7 +10,7 @@ Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). ### POC #### Reference -No PoCs from references. +- https://www.oracle.com/security-alerts/cpujan2025.html #### Github - https://github.com/adegoodyer/kubernetes-admin-toolkit diff --git a/2025/CVE-2025-21560.md b/2025/CVE-2025-21560.md new file mode 100644 index 0000000000..c7cd3a810e --- /dev/null +++ b/2025/CVE-2025-21560.md @@ -0,0 +1,17 @@ +### [CVE-2025-21560](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21560) +![](https://img.shields.io/static/v1?label=Product&message=Oracle%20Agile%20PLM%20Framework&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=9.3.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Easily%20exploitable%20vulnerability%20allows%20low%20privileged%20attacker%20with%20network%20access%20via%20HTTP%20to%20compromise%20Oracle%20Agile%20PLM%20Framework.%20%20Successful%20attacks%20of%20this%20vulnerability%20can%20result%20in%20%20unauthorized%20access%20to%20critical%20data%20or%20complete%20access%20to%20all%20Oracle%20Agile%20PLM%20Framework%20accessible%20data.&color=brightgreen) + +### Description + +Vulnerability in the Oracle Agile PLM Framework product of Oracle Supply Chain (component: SDK-Software Development Kit). The supported version that is affected is 9.3.6. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Agile PLM Framework. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Agile PLM Framework accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). + +### POC + +#### Reference +- https://www.oracle.com/security-alerts/cpujan2025.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2025/CVE-2025-21561.md b/2025/CVE-2025-21561.md new file mode 100644 index 0000000000..ea3e591cee --- /dev/null +++ b/2025/CVE-2025-21561.md @@ -0,0 +1,17 @@ +### [CVE-2025-21561](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21561) +![](https://img.shields.io/static/v1?label=Product&message=PeopleSoft%20Enterprise%20SCM%20Purchasing&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=9.2%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Easily%20exploitable%20vulnerability%20allows%20low%20privileged%20attacker%20with%20network%20access%20via%20HTTP%20to%20compromise%20PeopleSoft%20Enterprise%20SCM%20Purchasing.%20%20Successful%20attacks%20of%20this%20vulnerability%20can%20result%20in%20%20unauthorized%20update%2C%20insert%20or%20delete%20access%20to%20some%20of%20PeopleSoft%20Enterprise%20SCM%20Purchasing%20accessible%20data%20as%20well%20as%20%20unauthorized%20read%20access%20to%20a%20subset%20of%20PeopleSoft%20Enterprise%20SCM%20Purchasing%20accessible%20data.&color=brightgreen) + +### Description + +Vulnerability in the PeopleSoft Enterprise SCM Purchasing product of Oracle PeopleSoft (component: Purchasing). The supported version that is affected is 9.2. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise SCM Purchasing. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of PeopleSoft Enterprise SCM Purchasing accessible data as well as unauthorized read access to a subset of PeopleSoft Enterprise SCM Purchasing accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N). + +### POC + +#### Reference +- https://www.oracle.com/security-alerts/cpujan2025.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2025/CVE-2025-21562.md b/2025/CVE-2025-21562.md new file mode 100644 index 0000000000..ee556a30f7 --- /dev/null +++ b/2025/CVE-2025-21562.md @@ -0,0 +1,17 @@ +### [CVE-2025-21562](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21562) +![](https://img.shields.io/static/v1?label=Product&message=PeopleSoft%20Enterprise%20CC%20Common%20Application%20Objects&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=9.2%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Easily%20exploitable%20vulnerability%20allows%20low%20privileged%20attacker%20with%20network%20access%20via%20HTTP%20to%20compromise%20PeopleSoft%20Enterprise%20CC%20Common%20Application%20Objects.%20%20Successful%20attacks%20of%20this%20vulnerability%20can%20result%20in%20%20unauthorized%20read%20access%20to%20a%20subset%20of%20PeopleSoft%20Enterprise%20CC%20Common%20Application%20Objects%20accessible%20data.&color=brightgreen) + +### Description + +Vulnerability in the PeopleSoft Enterprise CC Common Application Objects product of Oracle PeopleSoft (component: Run Control Management). The supported version that is affected is 9.2. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise CC Common Application Objects. Successful attacks of this vulnerability can result in unauthorized read access to a subset of PeopleSoft Enterprise CC Common Application Objects accessible data. CVSS 3.1 Base Score 4.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N). + +### POC + +#### Reference +- https://www.oracle.com/security-alerts/cpujan2025.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2025/CVE-2025-21563.md b/2025/CVE-2025-21563.md new file mode 100644 index 0000000000..6cff460a10 --- /dev/null +++ b/2025/CVE-2025-21563.md @@ -0,0 +1,17 @@ +### [CVE-2025-21563](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21563) +![](https://img.shields.io/static/v1?label=Product&message=PeopleSoft%20Enterprise%20CC%20Common%20Application%20Objects&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=9.2%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Easily%20exploitable%20vulnerability%20allows%20low%20privileged%20attacker%20with%20network%20access%20via%20HTTP%20to%20compromise%20PeopleSoft%20Enterprise%20CC%20Common%20Application%20Objects.%20%20Successful%20attacks%20of%20this%20vulnerability%20can%20result%20in%20%20unauthorized%20update%2C%20insert%20or%20delete%20access%20to%20some%20of%20PeopleSoft%20Enterprise%20CC%20Common%20Application%20Objects%20accessible%20data.&color=brightgreen) + +### Description + +Vulnerability in the PeopleSoft Enterprise CC Common Application Objects product of Oracle PeopleSoft (component: Run Control Management). The supported version that is affected is 9.2. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise CC Common Application Objects. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of PeopleSoft Enterprise CC Common Application Objects accessible data. CVSS 3.1 Base Score 4.3 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N). + +### POC + +#### Reference +- https://www.oracle.com/security-alerts/cpujan2025.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2025/CVE-2025-21564.md b/2025/CVE-2025-21564.md new file mode 100644 index 0000000000..c32cb45c67 --- /dev/null +++ b/2025/CVE-2025-21564.md @@ -0,0 +1,17 @@ +### [CVE-2025-21564](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21564) +![](https://img.shields.io/static/v1?label=Product&message=Oracle%20Agile%20PLM%20Framework&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=9.3.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Easily%20exploitable%20vulnerability%20allows%20low%20privileged%20attacker%20with%20network%20access%20via%20HTTP%20to%20compromise%20Oracle%20Agile%20PLM%20Framework.%20%20Successful%20attacks%20of%20this%20vulnerability%20can%20result%20in%20%20unauthorized%20access%20to%20critical%20data%20or%20complete%20access%20to%20all%20Oracle%20Agile%20PLM%20Framework%20accessible%20data%20and%20unauthorized%20ability%20to%20cause%20a%20hang%20or%20frequently%20repeatable%20crash%20(complete%20DOS)%20of%20Oracle%20Agile%20PLM%20Framework.&color=brightgreen) + +### Description + +Vulnerability in the Oracle Agile PLM Framework product of Oracle Supply Chain (component: Agile Integration Services). The supported version that is affected is 9.3.6. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Agile PLM Framework. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Agile PLM Framework accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Agile PLM Framework. CVSS 3.1 Base Score 8.1 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H). + +### POC + +#### Reference +- https://www.oracle.com/security-alerts/cpujan2025.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2025/CVE-2025-21565.md b/2025/CVE-2025-21565.md new file mode 100644 index 0000000000..1092836c35 --- /dev/null +++ b/2025/CVE-2025-21565.md @@ -0,0 +1,17 @@ +### [CVE-2025-21565](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21565) +![](https://img.shields.io/static/v1?label=Product&message=Oracle%20Agile%20PLM%20Framework&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=9.3.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Easily%20exploitable%20vulnerability%20allows%20unauthenticated%20attacker%20with%20network%20access%20via%20HTTP%20to%20compromise%20Oracle%20Agile%20PLM%20Framework.%20%20Successful%20attacks%20of%20this%20vulnerability%20can%20result%20in%20%20unauthorized%20access%20to%20critical%20data%20or%20complete%20access%20to%20all%20Oracle%20Agile%20PLM%20Framework%20accessible%20data.&color=brightgreen) + +### Description + +Vulnerability in the Oracle Agile PLM Framework product of Oracle Supply Chain (component: Install). The supported version that is affected is 9.3.6. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Agile PLM Framework. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Agile PLM Framework accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). + +### POC + +#### Reference +- https://www.oracle.com/security-alerts/cpujan2025.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2025/CVE-2025-21566.md b/2025/CVE-2025-21566.md new file mode 100644 index 0000000000..fc673bff08 --- /dev/null +++ b/2025/CVE-2025-21566.md @@ -0,0 +1,17 @@ +### [CVE-2025-21566](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21566) +![](https://img.shields.io/static/v1?label=Product&message=MySQL%20Server&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=*%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Easily%20exploitable%20vulnerability%20allows%20low%20privileged%20attacker%20with%20network%20access%20via%20multiple%20protocols%20to%20compromise%20MySQL%20Server.%20%20Successful%20attacks%20of%20this%20vulnerability%20can%20result%20in%20unauthorized%20ability%20to%20cause%20a%20hang%20or%20frequently%20repeatable%20crash%20(complete%20DOS)%20of%20MySQL%20Server.&color=brightgreen) + +### Description + +Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 9.1.0 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 6.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). + +### POC + +#### Reference +- https://www.oracle.com/security-alerts/cpujan2025.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2025/CVE-2025-21567.md b/2025/CVE-2025-21567.md new file mode 100644 index 0000000000..c4727ace34 --- /dev/null +++ b/2025/CVE-2025-21567.md @@ -0,0 +1,17 @@ +### [CVE-2025-21567](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21567) +![](https://img.shields.io/static/v1?label=Product&message=MySQL%20Server&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=*%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Easily%20exploitable%20vulnerability%20allows%20low%20privileged%20attacker%20with%20network%20access%20via%20multiple%20protocols%20to%20compromise%20MySQL%20Server.%20%20Successful%20attacks%20of%20this%20vulnerability%20can%20result%20in%20%20unauthorized%20read%20access%20to%20a%20subset%20of%20MySQL%20Server%20accessible%20data.&color=brightgreen) + +### Description + +Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Security: Privileges). Supported versions that are affected are 9.1.0 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized read access to a subset of MySQL Server accessible data. CVSS 3.1 Base Score 4.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N). + +### POC + +#### Reference +- https://www.oracle.com/security-alerts/cpujan2025.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2025/CVE-2025-21568.md b/2025/CVE-2025-21568.md new file mode 100644 index 0000000000..e6cff05800 --- /dev/null +++ b/2025/CVE-2025-21568.md @@ -0,0 +1,17 @@ +### [CVE-2025-21568](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21568) +![](https://img.shields.io/static/v1?label=Product&message=Oracle%20Hyperion%20Data%20Relationship%20Management&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=11.2.19.0.000%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Easily%20exploitable%20vulnerability%20allows%20high%20privileged%20attacker%20with%20network%20access%20via%20HTTP%20to%20compromise%20Oracle%20Hyperion%20Data%20Relationship%20Management.%20%20Successful%20attacks%20require%20human%20interaction%20from%20a%20person%20other%20than%20the%20attacker.%20Successful%20attacks%20of%20this%20vulnerability%20can%20result%20in%20%20unauthorized%20access%20to%20critical%20data%20or%20complete%20access%20to%20all%20Oracle%20Hyperion%20Data%20Relationship%20Management%20accessible%20data.&color=brightgreen) + +### Description + +Vulnerability in the Oracle Hyperion Data Relationship Management product of Oracle Hyperion (component: Access and Security). The supported version that is affected is 11.2.19.0.000. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Hyperion Data Relationship Management. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Hyperion Data Relationship Management accessible data. CVSS 3.1 Base Score 4.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N). + +### POC + +#### Reference +- https://www.oracle.com/security-alerts/cpujan2025.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2025/CVE-2025-21569.md b/2025/CVE-2025-21569.md new file mode 100644 index 0000000000..b27d85ef44 --- /dev/null +++ b/2025/CVE-2025-21569.md @@ -0,0 +1,17 @@ +### [CVE-2025-21569](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21569) +![](https://img.shields.io/static/v1?label=Product&message=Oracle%20Hyperion%20Data%20Relationship%20Management&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=11.2.19.0.000%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Difficult%20to%20exploit%20vulnerability%20allows%20high%20privileged%20attacker%20with%20network%20access%20via%20HTTP%20to%20compromise%20Oracle%20Hyperion%20Data%20Relationship%20Management.%20%20Successful%20attacks%20of%20this%20vulnerability%20can%20result%20in%20takeover%20of%20Oracle%20Hyperion%20Data%20Relationship%20Management.&color=brightgreen) + +### Description + +Vulnerability in the Oracle Hyperion Data Relationship Management product of Oracle Hyperion (component: Web Services). The supported version that is affected is 11.2.19.0.000. Difficult to exploit vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Hyperion Data Relationship Management. Successful attacks of this vulnerability can result in takeover of Oracle Hyperion Data Relationship Management. CVSS 3.1 Base Score 6.6 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H). + +### POC + +#### Reference +- https://www.oracle.com/security-alerts/cpujan2025.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2025/CVE-2025-21570.md b/2025/CVE-2025-21570.md new file mode 100644 index 0000000000..0ceed23782 --- /dev/null +++ b/2025/CVE-2025-21570.md @@ -0,0 +1,17 @@ +### [CVE-2025-21570](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21570) +![](https://img.shields.io/static/v1?label=Product&message=Oracle%20Life%20Sciences%20Argus%20Safety&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=8.2.3%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Easily%20exploitable%20vulnerability%20allows%20unauthenticated%20attacker%20with%20network%20access%20via%20HTTP%20to%20compromise%20Oracle%20Life%20Sciences%20Argus%20Safety.%20%20Successful%20attacks%20require%20human%20interaction%20from%20a%20person%20other%20than%20the%20attacker%20and%20while%20the%20vulnerability%20is%20in%20Oracle%20Life%20Sciences%20Argus%20Safety%2C%20attacks%20may%20significantly%20impact%20additional%20products%20(scope%20change).%20Successful%20attacks%20of%20this%20vulnerability%20can%20result%20in%20%20unauthorized%20update%2C%20insert%20or%20delete%20access%20to%20some%20of%20Oracle%20Life%20Sciences%20Argus%20Safety%20accessible%20data%20as%20well%20as%20%20unauthorized%20read%20access%20to%20a%20subset%20of%20Oracle%20Life%20Sciences%20Argus%20Safety%20accessible%20data.&color=brightgreen) + +### Description + +Vulnerability in the Oracle Life Sciences Argus Safety product of Oracle Health Sciences Applications (component: Login). The supported version that is affected is 8.2.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Life Sciences Argus Safety. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Life Sciences Argus Safety, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Life Sciences Argus Safety accessible data as well as unauthorized read access to a subset of Oracle Life Sciences Argus Safety accessible data. CVSS 3.1 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). + +### POC + +#### Reference +- https://www.oracle.com/security-alerts/cpujan2025.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2025/CVE-2025-21571.md b/2025/CVE-2025-21571.md new file mode 100644 index 0000000000..6930bf4e48 --- /dev/null +++ b/2025/CVE-2025-21571.md @@ -0,0 +1,17 @@ +### [CVE-2025-21571](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21571) +![](https://img.shields.io/static/v1?label=Product&message=Oracle%20VM%20VirtualBox&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=*%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Easily%20exploitable%20vulnerability%20allows%20high%20privileged%20attacker%20with%20logon%20to%20the%20infrastructure%20where%20Oracle%20VM%20VirtualBox%20executes%20to%20compromise%20Oracle%20VM%20VirtualBox.%20%20While%20the%20vulnerability%20is%20in%20Oracle%20VM%20VirtualBox%2C%20attacks%20may%20significantly%20impact%20additional%20products%20(scope%20change).%20%20Successful%20attacks%20of%20this%20vulnerability%20can%20result%20in%20%20unauthorized%20creation%2C%20deletion%20or%20modification%20access%20to%20critical%20data%20or%20all%20Oracle%20VM%20VirtualBox%20accessible%20data%20as%20well%20as%20%20unauthorized%20read%20access%20to%20a%20subset%20of%20Oracle%20VM%20VirtualBox%20accessible%20data%20and%20unauthorized%20ability%20to%20cause%20a%20partial%20denial%20of%20service%20(partial%20DOS)%20of%20Oracle%20VM%20VirtualBox.&color=brightgreen) + +### Description + +Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 7.0.24 and prior to 7.1.6. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle VM VirtualBox accessible data as well as unauthorized read access to a subset of Oracle VM VirtualBox accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle VM VirtualBox. CVSS 3.1 Base Score 7.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:H/A:L). + +### POC + +#### Reference +- https://www.oracle.com/security-alerts/cpujan2025.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2025/CVE-2025-2251.md b/2025/CVE-2025-2251.md index 89d77dee19..ffc9548a55 100644 --- a/2025/CVE-2025-2251.md +++ b/2025/CVE-2025-2251.md @@ -1,8 +1,8 @@ ### [CVE-2025-2251](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-2251) +![](https://img.shields.io/static/v1?label=Product&message=Red%20Hat%20JBoss%20Enterprise%20Application%20Platform%207&color=blue) ![](https://img.shields.io/static/v1?label=Product&message=Red%20Hat%20JBoss%20Enterprise%20Application%20Platform%207.4%20for%20RHEL%208&color=blue) ![](https://img.shields.io/static/v1?label=Product&message=Red%20Hat%20JBoss%20Enterprise%20Application%20Platform%207.4%20for%20RHEL%209&color=blue) ![](https://img.shields.io/static/v1?label=Product&message=Red%20Hat%20JBoss%20Enterprise%20Application%20Platform%207.4%20on%20RHEL%207&color=blue) -![](https://img.shields.io/static/v1?label=Product&message=Red%20Hat%20JBoss%20Enterprise%20Application%20Platform%207.4.23&color=blue) ![](https://img.shields.io/static/v1?label=Product&message=Red%20Hat%20JBoss%20Enterprise%20Application%20Platform%208.0%20for%20RHEL%208&color=blue) ![](https://img.shields.io/static/v1?label=Product&message=Red%20Hat%20JBoss%20Enterprise%20Application%20Platform%208.0%20for%20RHEL%209&color=blue) ![](https://img.shields.io/static/v1?label=Product&message=Red%20Hat%20JBoss%20Enterprise%20Application%20Platform%208.0.8&color=blue) diff --git a/2025/CVE-2025-25137.md b/2025/CVE-2025-25137.md index c9ae6bd8ea..525a642a9e 100644 --- a/2025/CVE-2025-25137.md +++ b/2025/CVE-2025-25137.md @@ -1,11 +1,11 @@ ### [CVE-2025-25137](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-25137) ![](https://img.shields.io/static/v1?label=Product&message=Social%20Links&color=blue) -![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) -![](https://img.shields.io/static/v1?label=Vulnerability&message=Cross-Site%20Request%20Forgery%20(CSRF)&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-352%20Cross-Site%20Request%20Forgery%20(CSRF)&color=brightgreen) ### Description -Cross-Site Request Forgery (CSRF) vulnerability in kareemsultan Social Links social-links allows Stored XSS.This issue affects Social Links: from n/a through <= 1.0.11. +Cross-Site Request Forgery (CSRF) vulnerability in kareemsultan Social Links social-links allows Cross Site Request Forgery.This issue affects Social Links: from n/a through 1.0.11. ### POC diff --git a/2025/CVE-2025-25256.md b/2025/CVE-2025-25256.md index 2bbb140b1f..e0cc029070 100644 --- a/2025/CVE-2025-25256.md +++ b/2025/CVE-2025-25256.md @@ -1,5 +1,13 @@ ### [CVE-2025-25256](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-25256) ![](https://img.shields.io/static/v1?label=Product&message=FortiSIEM&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=4.10.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4.7.2%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4.9.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=5.0.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=5.1.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=5.2.1%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=5.2.5%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=5.3.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=5.4.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=6.1.0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=6.2.0%20&color=brightgreen) @@ -16,7 +24,7 @@ ### Description -An improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability [CWE-78] in Fortinet FortiSIEM version 7.3.0 through 7.3.1, 7.2.0 through 7.2.5, 7.1.0 through 7.1.7, 7.0.0 through 7.0.3 and before 6.7.9 allows an unauthenticated attacker to execute unauthorized code or commands via crafted CLI requests. +An improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability [CWE-78] vulnerability in Fortinet FortiSIEM 7.3.0 through 7.3.1, FortiSIEM 7.2.0 through 7.2.5, FortiSIEM 7.1.0 through 7.1.7, FortiSIEM 7.0.0 through 7.0.3, FortiSIEM 6.7.0 through 6.7.9, FortiSIEM 6.6 all versions, FortiSIEM 6.5 all versions, FortiSIEM 6.4 all versions, FortiSIEM 6.3 all versions, FortiSIEM 6.2 all versions, FortiSIEM 6.1 all versions, FortiSIEM 5.4 all versions, FortiSIEM 5.3 all versions, FortiSIEM 5.2 all versions, FortiSIEM 5.1 all versions, FortiSIEM 5.0 all versions, FortiSIEM 4.10 all versions, FortiSIEM 4.9 all versions, FortiSIEM 4.7 all versions allows an unauthenticated attacker to execute unauthorized code or commands via crafted CLI requests. ### POC diff --git a/2025/CVE-2025-2842.md b/2025/CVE-2025-2842.md index 2bb274eb11..351397698d 100644 --- a/2025/CVE-2025-2842.md +++ b/2025/CVE-2025-2842.md @@ -1,6 +1,6 @@ ### [CVE-2025-2842](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-2842) ![](https://img.shields.io/static/v1?label=Product&message=Red%20Hat%20OpenShift%20distributed%20tracing%203&color=blue) -![](https://img.shields.io/static/v1?label=Product&message=Red%20Hat%20OpenShift%20distributed%20tracing%203.5.3&color=blue) +![](https://img.shields.io/static/v1?label=Product&message=Red%20Hat%20OpenShift%20distributed%20tracing%203.5&color=blue) ![](https://img.shields.io/static/v1?label=Product&message=null&color=blue) ![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) diff --git a/2025/CVE-2025-5222.md b/2025/CVE-2025-5222.md index 75fbf594f0..de1619afa0 100644 --- a/2025/CVE-2025-5222.md +++ b/2025/CVE-2025-5222.md @@ -7,7 +7,7 @@ ![](https://img.shields.io/static/v1?label=Product&message=Red%20Hat%20Enterprise%20Linux%209.0%20Update%20Services%20for%20SAP%20Solutions&color=blue) ![](https://img.shields.io/static/v1?label=Product&message=Red%20Hat%20Enterprise%20Linux%209.2%20Update%20Services%20for%20SAP%20Solutions&color=blue) ![](https://img.shields.io/static/v1?label=Product&message=Red%20Hat%20Enterprise%20Linux%209.4%20Extended%20Update%20Support&color=blue) -![](https://img.shields.io/static/v1?label=Product&message=Red%20Hat%20OpenShift%20Container%20Platform%204&color=blue) +![](https://img.shields.io/static/v1?label=Product&message=Red%20Hat%20OpenShift%20Container%20Platform%204.20&color=blue) ![](https://img.shields.io/static/v1?label=Product&message=null&color=blue) ![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) diff --git a/2025/CVE-2025-5278.md b/2025/CVE-2025-5278.md index 1539f711dd..5f50e0d930 100644 --- a/2025/CVE-2025-5278.md +++ b/2025/CVE-2025-5278.md @@ -8,7 +8,7 @@ ![](https://img.shields.io/static/v1?label=Product&message=Red%20Hat%20Enterprise%20Linux%209&color=blue) ![](https://img.shields.io/static/v1?label=Product&message=Red%20Hat%20Insights%20proxy%201.5&color=blue) ![](https://img.shields.io/static/v1?label=Product&message=Red%20Hat%20OpenShift%20Container%20Platform%204&color=blue) -![](https://img.shields.io/static/v1?label=Product&message=Red%20Hat%20OpenShift%20distributed%20tracing%203.10.0&color=blue) +![](https://img.shields.io/static/v1?label=Product&message=Red%20Hat%20OpenShift%20distributed%20tracing%203.10.1&color=blue) ![](https://img.shields.io/static/v1?label=Product&message=Red%20Hat%20Update%20Infrastructure%205&color=blue) ![](https://img.shields.io/static/v1?label=Product&message=null&color=blue) ![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) diff --git a/2025/CVE-2025-5318.md b/2025/CVE-2025-5318.md index 9442ef1173..c0078fd94c 100644 --- a/2025/CVE-2025-5318.md +++ b/2025/CVE-2025-5318.md @@ -23,7 +23,7 @@ ![](https://img.shields.io/static/v1?label=Product&message=Red%20Hat%20OpenShift%20Container%20Platform%204.18&color=blue) ![](https://img.shields.io/static/v1?label=Product&message=Red%20Hat%20OpenShift%20Container%20Platform%204.19&color=blue) ![](https://img.shields.io/static/v1?label=Product&message=Red%20Hat%20OpenShift%20Container%20Platform%204.20&color=blue) -![](https://img.shields.io/static/v1?label=Product&message=Red%20Hat%20OpenShift%20distributed%20tracing%203.7.0&color=blue) +![](https://img.shields.io/static/v1?label=Product&message=Red%20Hat%20OpenShift%20distributed%20tracing%203.7.1&color=blue) ![](https://img.shields.io/static/v1?label=Product&message=null&color=blue) ![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) diff --git a/2025/CVE-2025-5914.md b/2025/CVE-2025-5914.md index 41277dcb50..82125d21b6 100644 --- a/2025/CVE-2025-5914.md +++ b/2025/CVE-2025-5914.md @@ -27,7 +27,7 @@ ![](https://img.shields.io/static/v1?label=Product&message=Red%20Hat%20OpenShift%20Container%20Platform%204.18&color=blue) ![](https://img.shields.io/static/v1?label=Product&message=Red%20Hat%20OpenShift%20Container%20Platform%204.19&color=blue) ![](https://img.shields.io/static/v1?label=Product&message=Red%20Hat%20OpenShift%20Container%20Platform%204.20&color=blue) -![](https://img.shields.io/static/v1?label=Product&message=Red%20Hat%20OpenShift%20distributed%20tracing%203.5.2&color=blue) +![](https://img.shields.io/static/v1?label=Product&message=Red%20Hat%20OpenShift%20distributed%20tracing%203.5&color=blue) ![](https://img.shields.io/static/v1?label=Product&message=Red%20Hat%20OpenShift%20sandboxed%20containers%201.1&color=blue) ![](https://img.shields.io/static/v1?label=Product&message=Red%20Hat%20Web%20Terminal%201.11%20on%20RHEL%209&color=blue) ![](https://img.shields.io/static/v1?label=Product&message=Red%20Hat%20Web%20Terminal%201.12%20on%20RHEL%209&color=blue) diff --git a/2025/CVE-2025-7425.md b/2025/CVE-2025-7425.md index 1d6bc4548d..d868d72675 100644 --- a/2025/CVE-2025-7425.md +++ b/2025/CVE-2025-7425.md @@ -29,7 +29,7 @@ ![](https://img.shields.io/static/v1?label=Product&message=Red%20Hat%20OpenShift%20Container%20Platform%204.17&color=blue) ![](https://img.shields.io/static/v1?label=Product&message=Red%20Hat%20OpenShift%20Container%20Platform%204.18&color=blue) ![](https://img.shields.io/static/v1?label=Product&message=Red%20Hat%20OpenShift%20Container%20Platform%204.19&color=blue) -![](https://img.shields.io/static/v1?label=Product&message=Red%20Hat%20OpenShift%20distributed%20tracing%203.5.2&color=blue) +![](https://img.shields.io/static/v1?label=Product&message=Red%20Hat%20OpenShift%20distributed%20tracing%203.5&color=blue) ![](https://img.shields.io/static/v1?label=Product&message=Red%20Hat%20Web%20Terminal%201.11%20on%20RHEL%209&color=blue) ![](https://img.shields.io/static/v1?label=Product&message=Red%20Hat%20Web%20Terminal%201.12%20on%20RHEL%209&color=blue) ![](https://img.shields.io/static/v1?label=Product&message=cert-manager%20operator%20for%20Red%20Hat%20OpenShift%201.16&color=blue) diff --git a/2025/CVE-2025-9784.md b/2025/CVE-2025-9784.md index b5ea92d4e3..4b6a4c4cca 100644 --- a/2025/CVE-2025-9784.md +++ b/2025/CVE-2025-9784.md @@ -4,12 +4,13 @@ ![](https://img.shields.io/static/v1?label=Product&message=Red%20Hat%20Enterprise%20Linux%208&color=blue) ![](https://img.shields.io/static/v1?label=Product&message=Red%20Hat%20Enterprise%20Linux%209&color=blue) ![](https://img.shields.io/static/v1?label=Product&message=Red%20Hat%20Fuse%207&color=blue) +![](https://img.shields.io/static/v1?label=Product&message=Red%20Hat%20JBoss%20Enterprise%20Application%20Platform%207&color=blue) ![](https://img.shields.io/static/v1?label=Product&message=Red%20Hat%20JBoss%20Enterprise%20Application%20Platform%207.1%20EUS%20for%20RHEL%207&color=blue) ![](https://img.shields.io/static/v1?label=Product&message=Red%20Hat%20JBoss%20Enterprise%20Application%20Platform%207.3%20EUS%20for%20RHEL%207&color=blue) ![](https://img.shields.io/static/v1?label=Product&message=Red%20Hat%20JBoss%20Enterprise%20Application%20Platform%207.4%20ELS%20on%20RHEL%207&color=blue) ![](https://img.shields.io/static/v1?label=Product&message=Red%20Hat%20JBoss%20Enterprise%20Application%20Platform%207.4%20ELS%20on%20RHEL%208&color=blue) ![](https://img.shields.io/static/v1?label=Product&message=Red%20Hat%20JBoss%20Enterprise%20Application%20Platform%207.4%20ELS%20on%20RHEL%209&color=blue) -![](https://img.shields.io/static/v1?label=Product&message=Red%20Hat%20JBoss%20Enterprise%20Application%20Platform%207.4&color=blue) +![](https://img.shields.io/static/v1?label=Product&message=Red%20Hat%20JBoss%20Enterprise%20Application%20Platform%207.4.24&color=blue) ![](https://img.shields.io/static/v1?label=Product&message=Red%20Hat%20JBoss%20Enterprise%20Application%20Platform%208&color=blue) ![](https://img.shields.io/static/v1?label=Product&message=Red%20Hat%20JBoss%20Enterprise%20Application%20Platform%208.0%20for%20RHEL%208&color=blue) ![](https://img.shields.io/static/v1?label=Product&message=Red%20Hat%20JBoss%20Enterprise%20Application%20Platform%208.0%20for%20RHEL%209&color=blue) diff --git a/2026/CVE-2026-0603.md b/2026/CVE-2026-0603.md index 52f6c12374..697b257a52 100644 --- a/2026/CVE-2026-0603.md +++ b/2026/CVE-2026-0603.md @@ -2,12 +2,13 @@ ![](https://img.shields.io/static/v1?label=Product&message=Red%20Hat%20AMQ%20Broker%207&color=blue) ![](https://img.shields.io/static/v1?label=Product&message=Red%20Hat%20Data%20Grid%208&color=blue) ![](https://img.shields.io/static/v1?label=Product&message=Red%20Hat%20Fuse%207&color=blue) +![](https://img.shields.io/static/v1?label=Product&message=Red%20Hat%20JBoss%20Enterprise%20Application%20Platform%207&color=blue) ![](https://img.shields.io/static/v1?label=Product&message=Red%20Hat%20JBoss%20Enterprise%20Application%20Platform%207.1%20EUS%20for%20RHEL%207&color=blue) ![](https://img.shields.io/static/v1?label=Product&message=Red%20Hat%20JBoss%20Enterprise%20Application%20Platform%207.3%20EUS%20for%20RHEL%207&color=blue) ![](https://img.shields.io/static/v1?label=Product&message=Red%20Hat%20JBoss%20Enterprise%20Application%20Platform%207.4%20ELS%20on%20RHEL%207&color=blue) ![](https://img.shields.io/static/v1?label=Product&message=Red%20Hat%20JBoss%20Enterprise%20Application%20Platform%207.4%20ELS%20on%20RHEL%208&color=blue) ![](https://img.shields.io/static/v1?label=Product&message=Red%20Hat%20JBoss%20Enterprise%20Application%20Platform%207.4%20ELS%20on%20RHEL%209&color=blue) -![](https://img.shields.io/static/v1?label=Product&message=Red%20Hat%20JBoss%20Enterprise%20Application%20Platform%207.4&color=blue) +![](https://img.shields.io/static/v1?label=Product&message=Red%20Hat%20JBoss%20Enterprise%20Application%20Platform%207.4.24&color=blue) ![](https://img.shields.io/static/v1?label=Product&message=Red%20Hat%20JBoss%20Enterprise%20Application%20Platform%208&color=blue) ![](https://img.shields.io/static/v1?label=Product&message=Red%20Hat%20JBoss%20Enterprise%20Application%20Platform%20Expansion%20Pack&color=blue) ![](https://img.shields.io/static/v1?label=Product&message=Red%20Hat%20OpenShift%20AI%20(RHOAI)&color=blue) diff --git a/2026/CVE-2026-10953.md b/2026/CVE-2026-10953.md new file mode 100644 index 0000000000..81d03a064c --- /dev/null +++ b/2026/CVE-2026-10953.md @@ -0,0 +1,17 @@ +### [CVE-2026-10953](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-10953) +![](https://img.shields.io/static/v1?label=Product&message=Chrome&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=149.0.7827.53%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Use%20after%20free&color=brightgreen) + +### Description + +Use after free in Core in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High) + +### POC + +#### Reference +- https://issues.chromium.org/issues/506147564 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-11430.md b/2026/CVE-2026-11430.md new file mode 100644 index 0000000000..295cc16462 --- /dev/null +++ b/2026/CVE-2026-11430.md @@ -0,0 +1,18 @@ +### [CVE-2026-11430](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-11430) +![](https://img.shields.io/static/v1?label=Product&message=getgrav%2Fgrav&color=blue) +![](https://img.shields.io/static/v1?label=Product&message=grav-plugin-scheduler-webhook&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Incorrect%20Implementation%20of%20Authentication%20Algorithm&color=brightgreen) + +### Description + +Grav CMS's scheduler-webhook plugin contains an authentication bypass in the webhook token check. When the webhook feature is enabled but no webhookToken is configured, a compound conditional short-circuits and skips token validation, so an unauthenticated remote attacker who can reach POST /scheduler/webhook can trigger the operator's already-configured scheduled jobs by sending a single request. The primitive is triggering-existing-jobs, not attacker-chosen command execution: the attacker controls when the jobs run and which one runs (via ?job=), but does not control what the jobs do. Code execution follows only when the operator has configured a job that shells out, and even then the attacker controls timing rather than payload. Not a default-install issue: reaching the endpoint requires the separate scheduler-webhook GPM plugin to be installed, scheduler.modern.webhook.enabled to be true (default false), and no webhookToken to be configured; a stock Grav or Grav-Admin install exposes nothing here. + +### POC + +#### Reference +- https://github.com/getgrav/grav/security/advisories/GHSA-xwv3-2mv2-w33x + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-11565.md b/2026/CVE-2026-11565.md new file mode 100644 index 0000000000..f2bfdbd482 --- /dev/null +++ b/2026/CVE-2026-11565.md @@ -0,0 +1,17 @@ +### [CVE-2026-11565](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-11565) +![](https://img.shields.io/static/v1?label=Product&message=Advanced%20File%20Manager&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-862%20Missing%20Authorization&color=brightgreen) + +### Description + +The Advanced File Manager WordPress plugin before 5.4.13 does not perform capability checks in several of its file management AJAX actions, allowing users with any role to which an administrator has granted file-manager access (as low as Subscriber) to read arbitrary files on the server — including sensitive configuration files — and to overwrite existing non-PHP files, which can be leveraged to compromise administrator accounts and the whole site. + +### POC + +#### Reference +- https://wpscan.com/vulnerability/5e03858d-db0b-4b65-99cc-eb01ad4195e9/ + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-11770.md b/2026/CVE-2026-11770.md index c8b322a726..f4658601a1 100644 --- a/2026/CVE-2026-11770.md +++ b/2026/CVE-2026-11770.md @@ -1,6 +1,9 @@ ### [CVE-2026-11770](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-11770) +![](https://img.shields.io/static/v1?label=Product&message=Red%20Hat%20Directory%20Server%2011.7%20E4S%20for%20RHEL%208&color=blue) ![](https://img.shields.io/static/v1?label=Product&message=Red%20Hat%20Directory%20Server%2011.9%20for%20RHEL%208&color=blue) ![](https://img.shields.io/static/v1?label=Product&message=Red%20Hat%20Directory%20Server%2012&color=blue) +![](https://img.shields.io/static/v1?label=Product&message=Red%20Hat%20Directory%20Server%2012.2%20E4S%20for%20RHEL%209&color=blue) +![](https://img.shields.io/static/v1?label=Product&message=Red%20Hat%20Directory%20Server%2012.4%20E4S%20for%20RHEL%209&color=blue) ![](https://img.shields.io/static/v1?label=Product&message=Red%20Hat%20Directory%20Server%2013&color=blue) ![](https://img.shields.io/static/v1?label=Product&message=Red%20Hat%20Enterprise%20Linux%2010&color=blue) ![](https://img.shields.io/static/v1?label=Product&message=Red%20Hat%20Enterprise%20Linux%2010.0%20Extended%20Update%20Support&color=blue) diff --git a/2026/CVE-2026-11788.md b/2026/CVE-2026-11788.md index 16a42900b6..c08359ae71 100644 --- a/2026/CVE-2026-11788.md +++ b/2026/CVE-2026-11788.md @@ -1,6 +1,9 @@ ### [CVE-2026-11788](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-11788) +![](https://img.shields.io/static/v1?label=Product&message=Red%20Hat%20Directory%20Server%2011.7%20E4S%20for%20RHEL%208&color=blue) ![](https://img.shields.io/static/v1?label=Product&message=Red%20Hat%20Directory%20Server%2011.9%20for%20RHEL%208&color=blue) ![](https://img.shields.io/static/v1?label=Product&message=Red%20Hat%20Directory%20Server%2012&color=blue) +![](https://img.shields.io/static/v1?label=Product&message=Red%20Hat%20Directory%20Server%2012.2%20E4S%20for%20RHEL%209&color=blue) +![](https://img.shields.io/static/v1?label=Product&message=Red%20Hat%20Directory%20Server%2012.4%20E4S%20for%20RHEL%209&color=blue) ![](https://img.shields.io/static/v1?label=Product&message=Red%20Hat%20Directory%20Server%2013&color=blue) ![](https://img.shields.io/static/v1?label=Product&message=Red%20Hat%20Enterprise%20Linux%2010&color=blue) ![](https://img.shields.io/static/v1?label=Product&message=Red%20Hat%20Enterprise%20Linux%2010.0%20Extended%20Update%20Support&color=blue) diff --git a/2026/CVE-2026-12983.md b/2026/CVE-2026-12983.md new file mode 100644 index 0000000000..b78c871d10 --- /dev/null +++ b/2026/CVE-2026-12983.md @@ -0,0 +1,17 @@ +### [CVE-2026-12983](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-12983) +![](https://img.shields.io/static/v1?label=Product&message=Dinatur&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-89%20SQL%20Injection&color=brightgreen) + +### Description + +The Dinatur WordPress plugin through 1.18 does not sanitize and escape user input before using it in a SQL query, allowing unauthenticated users to perform SQL injection attacks. The same handler also performs a database table truncation without any authorization check, allowing any unauthenticated visitor to wipe the Dinatur WordPress plugin through 1.18's data. + +### POC + +#### Reference +- https://wpscan.com/vulnerability/1369f95a-4ad3-4b0e-a87f-da88d200685e/ + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-13169.md b/2026/CVE-2026-13169.md new file mode 100644 index 0000000000..da6f88fac7 --- /dev/null +++ b/2026/CVE-2026-13169.md @@ -0,0 +1,17 @@ +### [CVE-2026-13169](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13169) +![](https://img.shields.io/static/v1?label=Product&message=Eventin&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-639%20Authorization%20Bypass%20Through%20User-Controlled%20Key&color=brightgreen) + +### Description + +The Eventin WordPress plugin before 4.1.21 does not properly verify ownership of events before allowing them to be modified, deleted, or reassigned to a different author, allowing users with contributor-level access and above to alter, delete, or take over events created by other users including administrators. + +### POC + +#### Reference +- https://wpscan.com/vulnerability/cf2b1152-7190-467b-a860-1f7bd806575d/ + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-13173.md b/2026/CVE-2026-13173.md new file mode 100644 index 0000000000..3a743dbe7a --- /dev/null +++ b/2026/CVE-2026-13173.md @@ -0,0 +1,17 @@ +### [CVE-2026-13173](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13173) +![](https://img.shields.io/static/v1?label=Product&message=Eventin&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-862%20Missing%20Authorization&color=brightgreen) + +### Description + +The Eventin WordPress plugin before 4.1.21 does not verify the current user's permission to edit other users before assigning roles and updating user metadata during speaker creation, allowing users with contributor-level access and above to modify other users' roles and metadata. + +### POC + +#### Reference +- https://wpscan.com/vulnerability/f1bb2ee8-85b2-415e-ab41-97b9958e5e70/ + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-13174.md b/2026/CVE-2026-13174.md new file mode 100644 index 0000000000..39e6b54387 --- /dev/null +++ b/2026/CVE-2026-13174.md @@ -0,0 +1,17 @@ +### [CVE-2026-13174](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13174) +![](https://img.shields.io/static/v1?label=Product&message=Eventin&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-284%20Improper%20Access%20Control&color=brightgreen) + +### Description + +The Eventin WordPress plugin before 4.1.21 does not verify ownership or capability before deleting user accounts, allowing users with contributor-level access and above to permanently delete other users' accounts. + +### POC + +#### Reference +- https://wpscan.com/vulnerability/849478d1-640f-49e0-8fa5-918e41654923/ + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-13175.md b/2026/CVE-2026-13175.md new file mode 100644 index 0000000000..c4bec949f6 --- /dev/null +++ b/2026/CVE-2026-13175.md @@ -0,0 +1,17 @@ +### [CVE-2026-13175](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13175) +![](https://img.shields.io/static/v1?label=Product&message=Eventin&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-639%20Authorization%20Bypass%20Through%20User-Controlled%20Key&color=brightgreen) + +### Description + +The Eventin WordPress plugin before 4.1.21 does not verify ownership before allowing schedule records to be modified or deleted, allowing users with contributor-level access and above to alter or delete schedule entries created by other users. + +### POC + +#### Reference +- https://wpscan.com/vulnerability/10762bf3-9663-40dc-9794-88ec7aa5b048/ + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-13775.md b/2026/CVE-2026-13775.md new file mode 100644 index 0000000000..eb86c17d96 --- /dev/null +++ b/2026/CVE-2026-13775.md @@ -0,0 +1,17 @@ +### [CVE-2026-13775](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13775) +![](https://img.shields.io/static/v1?label=Product&message=Chrome&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=150.0.7871.47%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Use%20after%20free&color=brightgreen) + +### Description + +Use after free in GPU in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical) + +### POC + +#### Reference +- https://issues.chromium.org/issues/511766407 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-13815.md b/2026/CVE-2026-13815.md new file mode 100644 index 0000000000..b71438b01b --- /dev/null +++ b/2026/CVE-2026-13815.md @@ -0,0 +1,17 @@ +### [CVE-2026-13815](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13815) +![](https://img.shields.io/static/v1?label=Product&message=Chrome&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=150.0.7871.47%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Use%20after%20free&color=brightgreen) + +### Description + +Use after free in Blink in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High) + +### POC + +#### Reference +- https://issues.chromium.org/issues/511722207 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-13867.md b/2026/CVE-2026-13867.md new file mode 100644 index 0000000000..a66ed17f55 --- /dev/null +++ b/2026/CVE-2026-13867.md @@ -0,0 +1,17 @@ +### [CVE-2026-13867](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13867) +![](https://img.shields.io/static/v1?label=Product&message=Chrome&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=150.0.7871.47%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Inappropriate%20implementation&color=brightgreen) + +### Description + +Inappropriate implementation in Geolocation in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium) + +### POC + +#### Reference +- https://issues.chromium.org/issues/497345177 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-13876.md b/2026/CVE-2026-13876.md new file mode 100644 index 0000000000..14ea9e9570 --- /dev/null +++ b/2026/CVE-2026-13876.md @@ -0,0 +1,17 @@ +### [CVE-2026-13876](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13876) +![](https://img.shields.io/static/v1?label=Product&message=Chrome&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=150.0.7871.47%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Inappropriate%20implementation&color=brightgreen) + +### Description + +Inappropriate implementation in Network in Google Chrome prior to 150.0.7871.47 allowed an attacker in a privileged network position to bypass content security policy via malicious network traffic. (Chromium security severity: Medium) + +### POC + +#### Reference +- https://issues.chromium.org/issues/498722200 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-13920.md b/2026/CVE-2026-13920.md new file mode 100644 index 0000000000..0e64779431 --- /dev/null +++ b/2026/CVE-2026-13920.md @@ -0,0 +1,17 @@ +### [CVE-2026-13920](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13920) +![](https://img.shields.io/static/v1?label=Product&message=Chrome&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=150.0.7871.47%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Insufficient%20validation%20of%20untrusted%20input&color=brightgreen) + +### Description + +Insufficient validation of untrusted input in Media in Google Chrome on Windows prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium) + +### POC + +#### Reference +- https://issues.chromium.org/issues/511722559 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-14164.md b/2026/CVE-2026-14164.md index 33b4653234..5b5eddfe39 100644 --- a/2026/CVE-2026-14164.md +++ b/2026/CVE-2026-14164.md @@ -6,7 +6,7 @@ ![](https://img.shields.io/static/v1?label=Product&message=Red%20Hat%20Enterprise%20Linux%208&color=blue) ![](https://img.shields.io/static/v1?label=Product&message=Red%20Hat%20Enterprise%20Linux%209&color=blue) ![](https://img.shields.io/static/v1?label=Product&message=Red%20Hat%20Hardened%20Images&color=blue) -![](https://img.shields.io/static/v1?label=Product&message=Red%20Hat%20OpenShift%20Container%20Platform%204&color=blue) +![](https://img.shields.io/static/v1?label=Product&message=Red%20Hat%20OpenShift%20Container%20Platform%204.22&color=blue) ![](https://img.shields.io/static/v1?label=Product&message=Red%20Hat%20Update%20Infrastructure%205&color=blue) ![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=Double%20Free&color=brightgreen) diff --git a/2026/CVE-2026-14196.md b/2026/CVE-2026-14196.md new file mode 100644 index 0000000000..4a2c6c7580 --- /dev/null +++ b/2026/CVE-2026-14196.md @@ -0,0 +1,17 @@ +### [CVE-2026-14196](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-14196) +![](https://img.shields.io/static/v1?label=Product&message=WCFM%20Marketplace&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-639%20Authorization%20Bypass%20Through%20User-Controlled%20Key&color=brightgreen) + +### Description + +The WCFM Marketplace WordPress plugin before 3.8.1 does not verify that a marketplace vendor owns a review before allowing it to be unapproved or deleted, allowing any vendor to modify or permanently delete reviews belonging to other vendors' stores. + +### POC + +#### Reference +- https://wpscan.com/vulnerability/877936f4-5664-4e17-b3cd-28f8f33f18ac/ + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-14287.md b/2026/CVE-2026-14287.md new file mode 100644 index 0000000000..a053d5a65c --- /dev/null +++ b/2026/CVE-2026-14287.md @@ -0,0 +1,17 @@ +### [CVE-2026-14287](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-14287) +![](https://img.shields.io/static/v1?label=Product&message=10Web%20Booster&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-79%20Cross-Site%20Scripting%20(XSS)&color=brightgreen) + +### Description + +The 10Web Booster WordPress plugin before 2.33.5 does not correctly validate an access token on an unauthenticated request handler and does not escape attacker-supplied stylesheet content before rendering it into the page head, allowing an unauthenticated attacker to store markup that executes as JavaScript in the browser of anonymous visitors to an affected page. + +### POC + +#### Reference +- https://wpscan.com/vulnerability/a0519e86-b77e-4354-a91d-ff729514d570/ + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-14334.md b/2026/CVE-2026-14334.md new file mode 100644 index 0000000000..4aff390d06 --- /dev/null +++ b/2026/CVE-2026-14334.md @@ -0,0 +1,17 @@ +### [CVE-2026-14334](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-14334) +![](https://img.shields.io/static/v1?label=Product&message=Booking%20calendar%2C%20Appointment%20Booking%20System&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=3.2.18%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-79%20Cross-Site%20Scripting%20(XSS)&color=brightgreen) + +### Description + +The Booking calendar, Appointment Booking System WordPress plugin through 3.2.36 does not properly sanitize uploaded SVG files, allowing unauthenticated attackers to upload a file that bypasses the Booking calendar, Appointment Booking System WordPress plugin through 3.2.36's script-stripping and executes arbitrary JavaScript when the SVG is opened, including in the session of an administrator who reviews the submitted booking. + +### POC + +#### Reference +- https://wpscan.com/vulnerability/9ddd1628-0b06-461b-8a5f-ba977f83fa7f/ + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-14825.md b/2026/CVE-2026-14825.md new file mode 100644 index 0000000000..8fa3c7bd6b --- /dev/null +++ b/2026/CVE-2026-14825.md @@ -0,0 +1,17 @@ +### [CVE-2026-14825](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-14825) +![](https://img.shields.io/static/v1?label=Product&message=Quiz%20and%20Survey%20Master%20(QSM)&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-639%20Authorization%20Bypass%20Through%20User-Controlled%20Key&color=brightgreen) + +### Description + +The Quiz and Survey Master (QSM) WordPress plugin before 11.2.4 does not perform a per-object ownership check before saving a quiz's front-end text settings, allowing users with contributor-level access and above to modify the text settings of quizzes created by other users. + +### POC + +#### Reference +- https://wpscan.com/vulnerability/fb66cb33-e16f-47ee-88d6-5cf141e92a4b/ + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-14826.md b/2026/CVE-2026-14826.md new file mode 100644 index 0000000000..f00123768e --- /dev/null +++ b/2026/CVE-2026-14826.md @@ -0,0 +1,17 @@ +### [CVE-2026-14826](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-14826) +![](https://img.shields.io/static/v1?label=Product&message=Quiz%20and%20Survey%20Master%20(QSM)&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-639%20Authorization%20Bypass%20Through%20User-Controlled%20Key&color=brightgreen) + +### Description + +The Quiz and Survey Master (QSM) WordPress plugin before 11.2.4 does not perform a per-object ownership check on the REST routes that return a quiz's email-notification and results-page configuration, allowing users with contributor-level access and above to read the configuration, including notification recipient addresses, of quizzes created by other users. + +### POC + +#### Reference +- https://wpscan.com/vulnerability/bb9cac20-4df5-4834-89f0-746a5eab20ea/ + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-14861.md b/2026/CVE-2026-14861.md new file mode 100644 index 0000000000..1fc61157a0 --- /dev/null +++ b/2026/CVE-2026-14861.md @@ -0,0 +1,17 @@ +### [CVE-2026-14861](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-14861) +![](https://img.shields.io/static/v1?label=Product&message=User%20Verification%20by%20PickPlugins&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-639%20Authorization%20Bypass%20Through%20User-Controlled%20Key&color=brightgreen) + +### Description + +The User Verification by PickPlugins WordPress plugin through 2.0.47 does not verify that a request to resend a verification email is authorized to act on the supplied user, nor bind the protecting token to that user, allowing unauthenticated attackers to reset arbitrary users' email-verification status and lock them, including administrators, out of their accounts. + +### POC + +#### Reference +- https://wpscan.com/vulnerability/4dff3634-4b4f-48e2-a8c9-dda7e2b682fd/ + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-15253.md b/2026/CVE-2026-15253.md new file mode 100644 index 0000000000..68ae6a0abe --- /dev/null +++ b/2026/CVE-2026-15253.md @@ -0,0 +1,17 @@ +### [CVE-2026-15253](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-15253) +![](https://img.shields.io/static/v1?label=Product&message=Easy%20Media%20Replace&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-79%20Cross-Site%20Scripting%20(XSS)&color=brightgreen) + +### Description + +The Easy Media Replace WordPress plugin through 0.2.0 does not sanitise and escape an attachment title before outputting it in an HTML attribute in the media library list view, allowing users with the Author role and above to inject arbitrary web scripts that are executed in the browser of a higher privileged user who views the media library. + +### POC + +#### Reference +- https://wpscan.com/vulnerability/46eda528-3737-4c0d-bf72-df7fc6423907/ + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-16058.md b/2026/CVE-2026-16058.md new file mode 100644 index 0000000000..bf47415707 --- /dev/null +++ b/2026/CVE-2026-16058.md @@ -0,0 +1,17 @@ +### [CVE-2026-16058](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-16058) +![](https://img.shields.io/static/v1?label=Product&message=YayCurrency&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-639%20Authorization%20Bypass%20Through%20User-Controlled%20Key&color=brightgreen) + +### Description + +The YayCurrency WordPress plugin before 3.3.5 does not perform any capability or ownership check on several of its multi-vendor integration handlers that are reachable by unauthenticated users, allowing anyone to read the store's order totals and its vendors' earnings, balance ledgers, and withdrawal histories by iterating identifiers. + +### POC + +#### Reference +- https://wpscan.com/vulnerability/d32d7086-9a43-4d98-80d7-18a3f82797bb/ + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-16570.md b/2026/CVE-2026-16570.md new file mode 100644 index 0000000000..767f57b507 --- /dev/null +++ b/2026/CVE-2026-16570.md @@ -0,0 +1,17 @@ +### [CVE-2026-16570](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-16570) +![](https://img.shields.io/static/v1?label=Product&message=NextScripts%3A%20Social%20Networks%20Auto-Poster&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-79%20Cross-Site%20Scripting%20(XSS)&color=brightgreen) + +### Description + +The NextScripts: Social Networks Auto-Poster WordPress plugin before 4.4.8 does not escape some of the query-string parameters it reflects back on one of its admin pages, allowing attackers to perform Reflected Cross-Site Scripting attacks against logged-in users such as administrators who are tricked into opening a crafted link. + +### POC + +#### Reference +- https://wpscan.com/vulnerability/25c42ca3-ff25-4b43-a712-2876398d82ab/ + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-16616.md b/2026/CVE-2026-16616.md new file mode 100644 index 0000000000..ad46f6d348 --- /dev/null +++ b/2026/CVE-2026-16616.md @@ -0,0 +1,17 @@ +### [CVE-2026-16616](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-16616) +![](https://img.shields.io/static/v1?label=Product&message=Simple%20File%20List&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-22%20Improper%20Limitation%20of%20a%20Pathname%20to%20a%20Restricted%20Directory%20('Path%20Traversal')&color=brightgreen) + +### Description + +The Simple File List WordPress plugin through 6.3.11 does not validate the source path of a file-move operation reachable by unauthenticated users, allowing them to read arbitrary files on the server and to relocate critical files out of the web root, leading to sensitive information disclosure and potential site takeover. + +### POC + +#### Reference +- https://wpscan.com/vulnerability/9631c97e-42e5-43b0-8998-e106f474ffba/ + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-16617.md b/2026/CVE-2026-16617.md new file mode 100644 index 0000000000..097e99b54d --- /dev/null +++ b/2026/CVE-2026-16617.md @@ -0,0 +1,17 @@ +### [CVE-2026-16617](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-16617) +![](https://img.shields.io/static/v1?label=Product&message=Simple%20File%20List&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-79%20Cross-Site%20Scripting%20(XSS)&color=brightgreen) + +### Description + +The Simple File List WordPress plugin through 6.3.11 does not properly sanitise and escape a file's description before outputting it on the public file list, allowing unauthenticated users (when front-end file management is enabled) to perform Stored Cross-Site Scripting attacks that execute in the browser of any visitor viewing the list. + +### POC + +#### Reference +- https://wpscan.com/vulnerability/fc51a940-8e67-45d0-b47d-b16da288ebb3/ + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-16950.md b/2026/CVE-2026-16950.md new file mode 100644 index 0000000000..a88d267bc3 --- /dev/null +++ b/2026/CVE-2026-16950.md @@ -0,0 +1,17 @@ +### [CVE-2026-16950](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-16950) +![](https://img.shields.io/static/v1?label=Product&message=Product%20Shortlist&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-89%20SQL%20Injection&color=brightgreen) + +### Description + +The Product Shortlist WordPress plugin through 1.0.4 does not properly sanitise and escape a parameter before using it in a SQL statement, allowing unauthenticated attackers to perform SQL injection attacks. + +### POC + +#### Reference +- https://wpscan.com/vulnerability/c1a2635a-9919-460f-b662-e5e3f80d2361/ + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-16979.md b/2026/CVE-2026-16979.md new file mode 100644 index 0000000000..5ea37887b2 --- /dev/null +++ b/2026/CVE-2026-16979.md @@ -0,0 +1,17 @@ +### [CVE-2026-16979](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-16979) +![](https://img.shields.io/static/v1?label=Product&message=SmartCrawl%20SEO%20checker%2C%20analyzer%20%26%20optimizer&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-639%20Authorization%20Bypass%20Through%20User-Controlled%20Key&color=brightgreen) + +### Description + +The SmartCrawl SEO checker, analyzer & optimizer WordPress plugin before 3.16.3 does not perform capability checks on two of its AJAX actions, allowing users with at least the Subscriber role to read the titles of private and draft posts by ID and to enumerate stored post-meta key names. + +### POC + +#### Reference +- https://wpscan.com/vulnerability/c9eb27aa-c5f9-4f1c-b87c-337ebaf192dd/ + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-17565.md b/2026/CVE-2026-17565.md new file mode 100644 index 0000000000..c54bed715f --- /dev/null +++ b/2026/CVE-2026-17565.md @@ -0,0 +1,17 @@ +### [CVE-2026-17565](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-17565) +![](https://img.shields.io/static/v1?label=Product&message=Animation%20Addons%20for%20Elementor&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-918%20Server-Side%20Request%20Forgery%20(SSRF)&color=brightgreen) + +### Description + +The Animation Addons for Elementor WordPress plugin before 2.7.2 does not validate a user-supplied value before using it to build the host of a server-side HTTP request, allowing unauthenticated users to make the site issue requests to internal hosts and read the responses back. + +### POC + +#### Reference +- https://wpscan.com/vulnerability/e88e0b71-145c-4edd-9b62-783215b64c67/ + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-18031.md b/2026/CVE-2026-18031.md new file mode 100644 index 0000000000..83d5870694 --- /dev/null +++ b/2026/CVE-2026-18031.md @@ -0,0 +1,17 @@ +### [CVE-2026-18031](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-18031) +![](https://img.shields.io/static/v1?label=Product&message=TabaPay%20Gateway&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-287%20Improper%20Authentication&color=brightgreen) + +### Description + +The TabaPay Gateway WordPress plugin through 1.4.0 does not validate the payment callback before establishing a session for the account associated with the referenced order, allowing unauthenticated attackers to log in as any registered user, including an administrator. + +### POC + +#### Reference +- https://wpscan.com/vulnerability/6576dcd1-aea6-47c0-9157-4ca56f426612/ + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-18051.md b/2026/CVE-2026-18051.md new file mode 100644 index 0000000000..75cfaeeb45 --- /dev/null +++ b/2026/CVE-2026-18051.md @@ -0,0 +1,17 @@ +### [CVE-2026-18051](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-18051) +![](https://img.shields.io/static/v1?label=Product&message=W3%20Total%20Cache&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-22%20Improper%20Limitation%20of%20a%20Pathname%20to%20a%20Restricted%20Directory%20('Path%20Traversal')&color=brightgreen) + +### Description + +The W3 Total Cache WordPress plugin before 2.10.5 does not properly validate the request path it uses to build cache file names, allowing unauthenticated attackers to write a file into any existing directory on the server, inside or outside the web root, overwriting whatever occupies the target name.On Apache, the same flaw overwrites the site's .htaccess files, which breaks the site and can strip hardening rules that other security measures rely on. + +### POC + +#### Reference +- https://wpscan.com/vulnerability/dc56cdd2-419b-4a64-9d2a-29dc7e79cb6d/ + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-18202.md b/2026/CVE-2026-18202.md new file mode 100644 index 0000000000..bd1b54d262 --- /dev/null +++ b/2026/CVE-2026-18202.md @@ -0,0 +1,17 @@ +### [CVE-2026-18202](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-18202) +![](https://img.shields.io/static/v1?label=Product&message=JetEngine&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-79%20Cross-Site%20Scripting%20(XSS)&color=brightgreen) + +### Description + +The JetEngine WordPress plugin before 3.8.14 adds SVG to the site-wide list of allowed upload types without sanitising the file contents, allowing users with the upload files capability, such as Authors, to upload a file containing malicious JavaScript that executes in the browser of any user who opens it (Stored Cross-Site Scripting). On multisite, this also overrides an upload-type restriction set by the network administrator. + +### POC + +#### Reference +- https://wpscan.com/vulnerability/911d3b5a-0f03-4423-b4b0-84e588c323d8/ + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-18231.md b/2026/CVE-2026-18231.md new file mode 100644 index 0000000000..e8db232a08 --- /dev/null +++ b/2026/CVE-2026-18231.md @@ -0,0 +1,17 @@ +### [CVE-2026-18231](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-18231) +![](https://img.shields.io/static/v1?label=Product&message=WP%20Directory%20Kit&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-200%20Information%20Exposure&color=brightgreen) + +### Description + +The WP Directory Kit WordPress plugin before 1.5.7 does not perform any authorization check on one of its public AJAX actions and returns unfiltered database rows, allowing unauthenticated attackers to retrieve the usernames and email addresses of users holding the WP Directory Kit WordPress plugin before 1.5.7's own roles. + +### POC + +#### Reference +- https://wpscan.com/vulnerability/c4508c33-40ac-42c6-aa7e-cf9004d381bd/ + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-18466.md b/2026/CVE-2026-18466.md new file mode 100644 index 0000000000..43be7d50ae --- /dev/null +++ b/2026/CVE-2026-18466.md @@ -0,0 +1,17 @@ +### [CVE-2026-18466](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-18466) +![](https://img.shields.io/static/v1?label=Product&message=WP%20Maps&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-284%20Improper%20Access%20Control&color=brightgreen) + +### Description + +The WP Maps WordPress plugin before 4.9.8 does not perform a capability check, nor validate a nonce, in one of its AJAX actions, allowing users with a Subscriber account to create an unlimited number of options in the database, each of which is loaded on every page request. + +### POC + +#### Reference +- https://wpscan.com/vulnerability/2e12d9cf-520a-4602-aeee-7dbc26f79951/ + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-18776.md b/2026/CVE-2026-18776.md new file mode 100644 index 0000000000..754884af09 --- /dev/null +++ b/2026/CVE-2026-18776.md @@ -0,0 +1,17 @@ +### [CVE-2026-18776](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-18776) +![](https://img.shields.io/static/v1?label=Product&message=TrueBooker&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-269%20Improper%20Privilege%20Management&color=brightgreen) + +### Description + +The TrueBooker WordPress plugin before 1.2.7 does not have proper authorisation checks in some of its AJAX actions, allowing unauthenticated users to change the email address of arbitrary users, including administrators, and subsequently take over their account via the password reset flow. + +### POC + +#### Reference +- https://wpscan.com/vulnerability/4b6abb2d-941b-429f-a480-33d1aafad450/ + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-18777.md b/2026/CVE-2026-18777.md new file mode 100644 index 0000000000..d066d72b4a --- /dev/null +++ b/2026/CVE-2026-18777.md @@ -0,0 +1,17 @@ +### [CVE-2026-18777](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-18777) +![](https://img.shields.io/static/v1?label=Product&message=TrueBooker&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-862%20Missing%20Authorization&color=brightgreen) + +### Description + +The TrueBooker WordPress plugin before 1.2.7 does not have proper authorisation checks in one of its AJAX actions, allowing unauthenticated users to change the status of arbitrary appointments, as well as to trigger notification emails to the affected customers. + +### POC + +#### Reference +- https://wpscan.com/vulnerability/05a09ba7-b781-4462-8c50-3a45f2757cb2/ + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-18778.md b/2026/CVE-2026-18778.md new file mode 100644 index 0000000000..35b32d2581 --- /dev/null +++ b/2026/CVE-2026-18778.md @@ -0,0 +1,17 @@ +### [CVE-2026-18778](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-18778) +![](https://img.shields.io/static/v1?label=Product&message=TrueBooker&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-200%20Information%20Exposure&color=brightgreen) + +### Description + +The TrueBooker WordPress plugin before 1.2.7 does not have proper authorisation checks in some of its AJAX actions, allowing unauthenticated users to retrieve the personal information of customers who booked an appointment, including their name, email address, phone number and postal address. + +### POC + +#### Reference +- https://wpscan.com/vulnerability/0a9b6706-ff3a-4a41-b85c-fce696471217/ + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-18779.md b/2026/CVE-2026-18779.md new file mode 100644 index 0000000000..8da16fc024 --- /dev/null +++ b/2026/CVE-2026-18779.md @@ -0,0 +1,17 @@ +### [CVE-2026-18779](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-18779) +![](https://img.shields.io/static/v1?label=Product&message=TrueBooker&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-862%20Missing%20Authorization&color=brightgreen) + +### Description + +The TrueBooker WordPress plugin before 1.2.7 does not have proper authorisation checks in one of its AJAX actions, allowing unauthenticated users to delete arbitrary appointment records along with their associated booking items and payment records. + +### POC + +#### Reference +- https://wpscan.com/vulnerability/9d7f9a09-a144-4a0a-998c-e5bc5037fc1b/ + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-18937.md b/2026/CVE-2026-18937.md new file mode 100644 index 0000000000..6e9de94b8b --- /dev/null +++ b/2026/CVE-2026-18937.md @@ -0,0 +1,17 @@ +### [CVE-2026-18937](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-18937) +![](https://img.shields.io/static/v1?label=Product&message=Broken%20Link%20Checker&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-94%20Improper%20Control%20of%20Generation%20of%20Code%20('Code%20Injection')&color=brightgreen) + +### Description + +The Broken Link Checker WordPress plugin before 2.4.12 does not limit which query variables it accepts from user input on sites using plain permalinks, allowing unauthenticated users to overwrite arbitrary PHP global variables, and to execute arbitrary code on the server when a classic (non-block) is active. + +### POC + +#### Reference +- https://wpscan.com/vulnerability/a23b76eb-107d-4e02-8eae-c3c5fa5b003d/ + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-19055.md b/2026/CVE-2026-19055.md new file mode 100644 index 0000000000..09cbe82140 --- /dev/null +++ b/2026/CVE-2026-19055.md @@ -0,0 +1,17 @@ +### [CVE-2026-19055](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-19055) +![](https://img.shields.io/static/v1?label=Product&message=ProSolution%20WP%20Client&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-79%20Cross-Site%20Scripting%20(XSS)&color=brightgreen) + +### Description + +The ProSolution WP Client WordPress plugin before 2.0.11 does not sanitise and escape several parameters before reflecting them into HTML attributes on its public pages, leading to reflected Cross-Site Scripting that can be triggered against any visitor, including a logged-in administrator. + +### POC + +#### Reference +- https://wpscan.com/vulnerability/a1243ff3-3f0e-4068-a716-722e7cf4856b/ + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-19056.md b/2026/CVE-2026-19056.md new file mode 100644 index 0000000000..e0dbad32ef --- /dev/null +++ b/2026/CVE-2026-19056.md @@ -0,0 +1,17 @@ +### [CVE-2026-19056](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-19056) +![](https://img.shields.io/static/v1?label=Product&message=ProSolution%20WP%20Client&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-79%20Cross-Site%20Scripting%20(XSS)&color=brightgreen) + +### Description + +The ProSolution WP Client WordPress plugin before 2.0.11 does not sanitise and escape a parameter before reflecting it into an HTML attribute on one of its administrative pages, leading to reflected Cross-Site Scripting that runs in the session of an administrator induced to submit a crafted request. + +### POC + +#### Reference +- https://wpscan.com/vulnerability/83ad2038-3755-40a5-a8af-e6fac94341d1/ + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-19406.md b/2026/CVE-2026-19406.md new file mode 100644 index 0000000000..6b22ec0549 --- /dev/null +++ b/2026/CVE-2026-19406.md @@ -0,0 +1,17 @@ +### [CVE-2026-19406](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-19406) +![](https://img.shields.io/static/v1?label=Product&message=Easy%20Appointments&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=3.12.28%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-200%20Information%20Exposure&color=brightgreen) + +### Description + +The Easy Appointments WordPress plugin before 4.0.1 does not restrict one of its appointment-listing REST endpoints to the records belonging to the requesting user, allowing users with contributor-level access to read all bookings on the site, including customer names, schedules, and statuses. + +### POC + +#### Reference +- https://wpscan.com/vulnerability/53cfb207-8f26-438c-a928-bc9271f312f0/ + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-19416.md b/2026/CVE-2026-19416.md new file mode 100644 index 0000000000..08faece496 --- /dev/null +++ b/2026/CVE-2026-19416.md @@ -0,0 +1,17 @@ +### [CVE-2026-19416](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-19416) +![](https://img.shields.io/static/v1?label=Product&message=KiviCare&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-639%20Authorization%20Bypass%20Through%20User-Controlled%20Key&color=brightgreen) + +### Description + +The KiviCare WordPress plugin before 4.5.4 does not verify that the requesting user owns the appointment being modified, allowing authenticated patient-level users to cancel and reschedule other patients' appointments. + +### POC + +#### Reference +- https://wpscan.com/vulnerability/ef2aa44b-3624-4e6d-9b25-e33d4a1a21d2/ + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-19417.md b/2026/CVE-2026-19417.md new file mode 100644 index 0000000000..cbed91094c --- /dev/null +++ b/2026/CVE-2026-19417.md @@ -0,0 +1,17 @@ +### [CVE-2026-19417](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-19417) +![](https://img.shields.io/static/v1?label=Product&message=KiviCare&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-639%20Authorization%20Bypass%20Through%20User-Controlled%20Key&color=brightgreen) + +### Description + +The KiviCare WordPress plugin before 4.5.4 does not verify that the requesting user is entitled to the media file being served, allowing authenticated patient-level users to download any file in the media library, including other patients' uploaded medical reports. + +### POC + +#### Reference +- https://wpscan.com/vulnerability/4270b160-cbb8-46b2-853c-927651ca16bf/ + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-19709.md b/2026/CVE-2026-19709.md new file mode 100644 index 0000000000..11e73d7770 --- /dev/null +++ b/2026/CVE-2026-19709.md @@ -0,0 +1,17 @@ +### [CVE-2026-19709](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-19709) +![](https://img.shields.io/static/v1?label=Product&message=Membership%20For%20WooCommerce&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-287%20Improper%20Authentication&color=brightgreen) + +### Description + +The Membership For WooCommerce WordPress plugin before 3.1.2 does not check that an API consumer secret has actually been generated before comparing it against the one supplied in a request, allowing unauthenticated attackers to reach its REST routes and disclose any user's membership plan details on sites where the API has been enabled but no keys were ever generated. + +### POC + +#### Reference +- https://wpscan.com/vulnerability/957888a4-bb11-42c6-930a-8c836170452b/ + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-19782.md b/2026/CVE-2026-19782.md new file mode 100644 index 0000000000..38a30bf94e --- /dev/null +++ b/2026/CVE-2026-19782.md @@ -0,0 +1,17 @@ +### [CVE-2026-19782](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-19782) +![](https://img.shields.io/static/v1?label=Product&message=WPS%20Bidouille&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-200%20Information%20Exposure&color=brightgreen) + +### Description + +The WPS Bidouille WordPress plugin before 1.33.5 does not have proper authorisation checks in an AJAX action, allowing any authenticated user, such as a subscriber, to retrieve the email addresses of all registered users. + +### POC + +#### Reference +- https://wpscan.com/vulnerability/8dabc48e-15ee-482c-be77-6ad6fb312a7a/ + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-19842.md b/2026/CVE-2026-19842.md new file mode 100644 index 0000000000..8e66bb51a8 --- /dev/null +++ b/2026/CVE-2026-19842.md @@ -0,0 +1,17 @@ +### [CVE-2026-19842](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-19842) +![](https://img.shields.io/static/v1?label=Product&message=SAML%20Single%20Sign%20On&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=4.8.85%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-287%20Improper%20Authentication&color=brightgreen) + +### Description + +The SAML Single Sign On WordPress plugin before 5.4.7 does not verify the signature of a SAML response before storing the certificate it carries, and offers an administrator a one-click control that promotes that stored certificate to the site's trusted signing certificate, allowing unauthenticated attackers to have a certificate of their own trusted and then authenticate as any user, including an administrator. + +### POC + +#### Reference +- https://wpscan.com/vulnerability/7b79d86e-d3f8-4d4f-929b-fd00540cc00f/ + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-20000.md b/2026/CVE-2026-20000.md new file mode 100644 index 0000000000..f04f2bf2fd --- /dev/null +++ b/2026/CVE-2026-20000.md @@ -0,0 +1,18 @@ +### [CVE-2026-20000](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-20000) +![](https://img.shields.io/static/v1?label=Product&message=Hospital%20Management%20System&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=1.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Injection&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=SQL%20Injection&color=brightgreen) + +### Description + +A vulnerability was detected in itsourcecode Hospital Management System 1.0. The impacted element is an unknown function of the file /viewprescriptionrecord.php. The manipulation of the argument delid results in sql injection. It is possible to launch the attack remotely. The exploit is now public and may be used. + +### POC + +#### Reference +- https://github.com/Kristin5634487/cve/issues/3 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-20200.md b/2026/CVE-2026-20200.md new file mode 100644 index 0000000000..e270523916 --- /dev/null +++ b/2026/CVE-2026-20200.md @@ -0,0 +1,54 @@ +### [CVE-2026-20200](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-20200) +![](https://img.shields.io/static/v1?label=Product&message=Cisco%20Unified%20Computing%20System%20(Standalone)&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=4.3(1.230097)%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4.3(1.230124)%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4.3(1.230138)%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4.3(2.230207)%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4.3(2.230270)%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4.3(2.240002)%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4.3(3.240022)%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4.3(3.240043)%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4.3(4.240142)%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4.3(4.240152)%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4.3(4.241014)%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4.3(4.241063)%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4.3(4.242028)%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4.3(4.242038)%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4.3(4.242066)%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4.3(4.252001)%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4.3(4.252002)%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4.3(5.240021)%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4.3(5.250001)%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4.3(5.250030)%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4.3(5.250033)%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4.3(5.250043)%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4.3(5.250045)%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4.3(6.250039)%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4.3(6.250040)%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4.3(6.250044)%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4.3(6.250053)%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4.3(6.250060)%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4.3(6.250101)%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4.3(6.250117)%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4.3(6.260003)%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4.3(6.260017)%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=6.0(1.250127)%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=6.0(1.250130)%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=6.0(1.250131)%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=6.0(1.250174)%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=6.0(1.250192)%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=6.0(1.250194)%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Improper%20Neutralization%20of%20Parameter%2FArgument%20Delimiters&color=brightgreen) + +### Description + +A vulnerability in the web-based management interface of Cisco IMC could allow an authenticated, remote attacker with low privileges to execute arbitrary commands on the underlying operating system of an affected system and elevate privileges to root.  This vulnerability is due to improper validation of user-supplied input. An attacker could exploit this vulnerability by entering crafted inputs to the web-based management interface of the affected software. A successful exploit could allow the attacker to execute arbitrary commands on the underlying operating system as the root user.  + +### POC + +#### Reference +- https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cimc-arg-inject-upSHdMfU + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-20288.md b/2026/CVE-2026-20288.md new file mode 100644 index 0000000000..e461925217 --- /dev/null +++ b/2026/CVE-2026-20288.md @@ -0,0 +1,202 @@ +### [CVE-2026-20288](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-20288) +![](https://img.shields.io/static/v1?label=Product&message=Cisco%20Unified%20Computing%20System%20(Standalone)&color=blue) +![](https://img.shields.io/static/v1?label=Product&message=Cisco%20Unified%20Computing%20System%20E-Series%20Software%20(UCSE)&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=3.1(1d)%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=3.1(2b)%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=3.1(2c)%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=3.1(2d)%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=3.1(2e)%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=3.1(2g)%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=3.1(2i)%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=3.1(3a)%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=3.1(3b)%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=3.1(3c)%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=3.1(3d)%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=3.1(3g)%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=3.1(3h)%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=3.1(3i)%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=3.1(3j)%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=3.1(3k)%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=3.1.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=3.1.1%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=3.1.2%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=3.1.3%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=3.1.4%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=3.1.5%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=3.2.1%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=3.2.10%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=3.2.11.1%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=3.2.11.3%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=3.2.11.5%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=3.2.12.2%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=3.2.13.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=3.2.14%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=3.2.15%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=3.2.15.3%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=3.2.16.1%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=3.2.17.1%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=3.2.2%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=3.2.3%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=3.2.4%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=3.2.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=3.2.7%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=3.2.8%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4.0(1.240)%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4.0(1a)%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4.0(1b)%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4.0(1c)%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4.0(1d)%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4.0(1e)%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4.0(1g)%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4.0(1h)%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4.0(2c)%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4.0(2d)%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4.0(2f)%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4.0(2g)%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4.0(2h)%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4.0(2i)%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4.0(2k)%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4.0(2l)%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4.0(2m)%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4.0(2n)%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4.0(2o)%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4.0(2p)%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4.0(2q)%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4.0(2r)%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4.0(4b)%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4.0(4c)%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4.0(4d)%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4.0(4e)%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4.0(4f)%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4.0(4h)%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4.0(4i)%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4.0(4j)%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4.0(4k)%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4.0(4l)%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4.0(4m)%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4.0(4n)%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4.1(1c)%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4.1(1d)%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4.1(1f)%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4.1(1g)%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4.1(1h)%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4.1(2a)%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4.1(2b)%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4.1(2d)%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4.1(2e)%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4.1(2f)%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4.1(2g)%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4.1(2h)%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4.1(2j)%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4.1(2k)%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4.1(2l)%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4.1(2m)%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4.1(3b)%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4.1(3c)%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4.1(3d)%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4.1(3f)%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4.1(3g)%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4.1(3h)%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4.1(3i)%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4.1(3l)%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4.1(3m)%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4.1(3n)%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4.11.1%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4.12.1%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4.12.2%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4.15.2%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4.15.3%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4.2(1a)%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4.2(1b)%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4.2(1c)%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4.2(1e)%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4.2(1f)%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4.2(1g)%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4.2(1i)%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4.2(1j)%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4.2(2a)%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4.2(2f)%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4.2(2g)%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4.2(3b)%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4.2(3d)%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4.2(3e)%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4.2(3g)%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4.2(3h)%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4.2(3i)%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4.2(3j)%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4.2(3k)%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4.2(3l)%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4.2(3m)%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4.2(3n)%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4.2(3o)%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4.2(3p)%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4.2(3q)%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4.3(1.230097)%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4.3(1.230124)%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4.3(1.230138)%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4.3(2.230207)%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4.3(2.230270)%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4.3(2.240002)%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4.3(2.240009)%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4.3(2.240037)%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4.3(2.240053)%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4.3(2.240077)%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4.3(2.240090)%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4.3(2.240107)%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4.3(2.250016)%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4.3(2.250021)%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4.3(2.250022)%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4.3(2.250037)%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4.3(2.250045)%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4.3(2.250063)%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4.3(2.260007)%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4.3(3.240022)%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4.3(3.240041)%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4.3(3.240043)%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4.3(4.240142)%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4.3(4.240152)%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4.3(4.241014)%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4.3(4.241063)%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4.3(4.242028)%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4.3(4.242038)%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4.3(4.242066)%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4.3(4.252001)%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4.3(4.252002)%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4.3(5.240021)%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4.3(5.250001)%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4.3(5.250030)%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4.3(5.250033)%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4.3(5.250043)%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4.3(5.250045)%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4.3(6.250039)%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4.3(6.250040)%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4.3(6.250044)%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4.3(6.250053)%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4.3(6.250060)%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4.3(6.250101)%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4.3(6.250117)%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4.3(6.260003)%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4.3(6.260017)%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4.3(6.260033)%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=6.0(1.250127)%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=6.0(1.250130)%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=6.0(1.250131)%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=6.0(1.250174)%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=6.0(1.250192)%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=6.0(1.250194)%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=6.0(2.260044)%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=6.0(2.260069)%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Improper%20Neutralization%20of%20Expression%2FCommand%20Delimiters&color=brightgreen) + +### Description + +A vulnerability in the web-based management interface of Cisco IMC could allow an authenticated, remote attacker with Admin privileges to execute arbitrary commands on the underlying operating system of an affected system and elevate privileges to root.  This vulnerability is due to improper validation of user-supplied input. An attacker could exploit this vulnerability by entering crafted inputs to the web-based management interface of the affected software. A successful exploit could allow the attacker to execute arbitrary commands on the underlying operating system as the root user.  Cisco has assigned this vulnerability a SIR of High rather than Medium as the score indicates because additional security implications could occur when the attacker becomes root. + +### POC + +#### Reference +- https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cimc-arg-inject-upSHdMfU + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-25039.md b/2026/CVE-2026-25039.md new file mode 100644 index 0000000000..b761460da9 --- /dev/null +++ b/2026/CVE-2026-25039.md @@ -0,0 +1,17 @@ +### [CVE-2026-25039](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-25039) +![](https://img.shields.io/static/v1?label=Product&message=parsec-cloud&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=%3C%203.3.3-rc.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-40%3A%20Path%20Traversal%3A%20'UNCsharename'%20(Windows%20UNC%20Share)&color=brightgreen) + +### Description + +Parsec is a cloud-based application for simple and cryptographically secure file sharing. The application does not sanitize the workspace name, creating a vulnerability if that workspace name is a UNC path. When creating mountpoint in the windows filesystem to mount the workspace of an organization, the application does not sanitize the workspace name. The cause issue if the workspace name evaluate to a UNC path since it's allowed for the name to containt `\` char. If the UNC path is invalid (or the targeted resource is not available) the application become unresponsive otherwise the system will interact with the mounted UNC path allowing the attacker to retrieve to [`NTLM`] hash. + +### POC + +#### Reference +- https://github.com/Scille/parsec-cloud/security/advisories/GHSA-qx56-wxpm-j4m6 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-25807.md b/2026/CVE-2026-25807.md new file mode 100644 index 0000000000..52e89cbbdb --- /dev/null +++ b/2026/CVE-2026-25807.md @@ -0,0 +1,17 @@ +### [CVE-2026-25807](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-25807) +![](https://img.shields.io/static/v1?label=Product&message=zai-shell&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=%3C%209.0.3%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-94%3A%20Improper%20Control%20of%20Generation%20of%20Code%20('Code%20Injection')&color=brightgreen) + +### Description + +ZAI Shell is an autonomous SysOps agent designed to navigate, repair, and secure complex environments. Prior to 9.0.3, the P2P terminal sharing feature (share start) opens a TCP socket on port 5757 without any authentication mechanism. Any remote attacker can connect to this port using a simple socket script. An attacker who connects to a ZAI-Shell P2P session running in --no-ai mode can send arbitrary system commands. If the host user approves the command without reviewing its contents, the command executes directly with the user's privileges, bypassing all Sentinel safety checks. This vulnerability is fixed in 9.0.3. + +### POC + +#### Reference +- https://github.com/TaklaXBR/zai-shell/security/advisories/GHSA-6pjj-r955-34rr + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-25961.md b/2026/CVE-2026-25961.md new file mode 100644 index 0000000000..1d85b6807e --- /dev/null +++ b/2026/CVE-2026-25961.md @@ -0,0 +1,18 @@ +### [CVE-2026-25961](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-25961) +![](https://img.shields.io/static/v1?label=Product&message=sumatrapdf&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=%3E%3D%203.5.0%2C%20%3C%3D%203.5.2%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-295%3A%20Improper%20Certificate%20Validation&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-494%3A%20Download%20of%20Code%20Without%20Integrity%20Check&color=brightgreen) + +### Description + +SumatraPDF is a multi-format reader for Windows. In 3.5.0 through 3.5.2, SumatraPDF's update mechanism disables TLS hostname verification (INTERNET_FLAG_IGNORE_CERT_CN_INVALID) and executes installers without signature checks. A network attacker with any valid TLS certificate (e.g., Let's Encrypt) can intercept the update check request, inject a malicious installer URL, and achieve arbitrary code execution. + +### POC + +#### Reference +- https://github.com/sumatrapdfreader/sumatrapdf/security/advisories/GHSA-xpm2-rr5m-x96q + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-32063.md b/2026/CVE-2026-32063.md new file mode 100644 index 0000000000..f38b0393bf --- /dev/null +++ b/2026/CVE-2026-32063.md @@ -0,0 +1,18 @@ +### [CVE-2026-32063](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32063) +![](https://img.shields.io/static/v1?label=Product&message=openclaw&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=2026.2.19-2%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Improper%20Neutralization%20of%20Special%20Elements%20used%20in%20a%20Command%20('Command%20Injection')&color=brightgreen) + +### Description + +OpenClaw version 2026.2.19-2 prior to 2026.2.21 contains a command injection vulnerability in systemd unit file generation where attacker-controlled environment values are not validated for CR/LF characters, allowing newline injection to break out of Environment= lines and inject arbitrary systemd directives. An attacker who can influence config.env.vars and trigger service install or restart can execute arbitrary commands with the privileges of the OpenClaw gateway service user. + +### POC + +#### Reference +- https://github.com/openclaw/openclaw/security/advisories/GHSA-vffc-f7r7-rx2w + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-32101.md b/2026/CVE-2026-32101.md new file mode 100644 index 0000000000..589ed5aa9e --- /dev/null +++ b/2026/CVE-2026-32101.md @@ -0,0 +1,17 @@ +### [CVE-2026-32101](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32101) +![](https://img.shields.io/static/v1?label=Product&message=s3-storage&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=%3C%200.3.1%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-863%3A%20Incorrect%20Authorization&color=brightgreen) + +### Description + +StudioCMS is a server-side-rendered, Astro native, headless content management system. Prior to 0.3.1, the S3 storage manager's isAuthorized() function is declared async (returns Promise) but is called without await in both the POST and PUT handlers. Since a Promise object is always truthy in JavaScript, !isAuthorized(type) always evaluates to false, completely bypassing the authorization check. Any authenticated user with the lowest visitor role can upload, delete, rename, and list all files in the S3 bucket. This vulnerability is fixed in 0.3.1. + +### POC + +#### Reference +- https://github.com/withstudiocms/studiocms/security/advisories/GHSA-mm78-fgq8-6pgr + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-32121.md b/2026/CVE-2026-32121.md new file mode 100644 index 0000000000..536589645a --- /dev/null +++ b/2026/CVE-2026-32121.md @@ -0,0 +1,17 @@ +### [CVE-2026-32121](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32121) +![](https://img.shields.io/static/v1?label=Product&message=openemr&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=%3C%208.0.0.1%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-79%3A%20Improper%20Neutralization%20of%20Input%20During%20Web%20Page%20Generation%20('Cross-site%20Scripting')&color=brightgreen) + +### Description + +OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.0.0.1, Stored XSS in prescription CSS/HTML print view via patient demographics. That finding involves server-side rendering of patient names via raw PHP echo. This finding involves client-side DOM-based rendering via jQuery .html() in a completely different component (portal/sign/assets/signer_api.js). The two share the same root cause (unsanitized patient names in patient_data), but they have different sinks, different affected components, different trigger actions, and require independent fixes. This vulnerability is fixed in 8.0.0.1. + +### POC + +#### Reference +- https://github.com/openemr/openemr/security/advisories/GHSA-68fr-xm3v-p4vw + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-32133.md b/2026/CVE-2026-32133.md new file mode 100644 index 0000000000..3d1690f1e0 --- /dev/null +++ b/2026/CVE-2026-32133.md @@ -0,0 +1,17 @@ +### [CVE-2026-32133](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32133) +![](https://img.shields.io/static/v1?label=Product&message=2FAuth&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=%3C%206.1.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-918%3A%20Server-Side%20Request%20Forgery%20(SSRF)&color=brightgreen) + +### Description + +2FAuth is a web app to manage Two-Factor Authentication (2FA) accounts and generate their security codes. Prior to 6.1.0, a blind SSRF vulnerability exists in 2FAuth that allows authenticated users to make arbitrary HTTP requests from the server to internal networks and cloud metadata endpoints. The image parameter in OTP URL is not properly validated for internal / private IP addresses before making HTTP requests. While the previous fix added response validation to ensure only valid images are stored but HTTP request is still made to arbitrary URLs before this validation occurs. This vulnerability is fixed in 6.1.0. + +### POC + +#### Reference +- https://github.com/Bubka/2FAuth/security/advisories/GHSA-8qp3-x2mp-j6f8 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-32146.md b/2026/CVE-2026-32146.md index 10ec4f18f5..3ad1d601e9 100644 --- a/2026/CVE-2026-32146.md +++ b/2026/CVE-2026-32146.md @@ -22,6 +22,7 @@ Improper path validation vulnerability in the Gleam compiler's handling of git d #### Reference - https://cna.erlef.org/cves/CVE-2026-32146.html +- https://github.com/gleam-lang/gleam/security/advisories/GHSA-vq5j-55vx-wq8j #### Github No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-32231.md b/2026/CVE-2026-32231.md new file mode 100644 index 0000000000..8f87941021 --- /dev/null +++ b/2026/CVE-2026-32231.md @@ -0,0 +1,18 @@ +### [CVE-2026-32231](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32231) +![](https://img.shields.io/static/v1?label=Product&message=zeptoclaw&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=%3C%200.7.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-306%3A%20Missing%20Authentication%20for%20Critical%20Function&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-345%3A%20Insufficient%20Verification%20of%20Data%20Authenticity&color=brightgreen) + +### Description + +ZeptoClaw is a personal AI assistant. Prior to 0.7.6, the generic webhook channel trusts caller-supplied identity fields (sender, chat_id) from the request body and applies authorization checks to those untrusted values. Because authentication is optional and defaults to disabled (auth_token: None), an attacker who can reach POST /webhook can spoof an allowlisted sender and choose arbitrary chat_id values, enabling high-risk message spoofing and potential IDOR-style session/chat routing abuse. This vulnerability is fixed in 0.7.6. + +### POC + +#### Reference +- https://github.com/qhkm/zeptoclaw/security/advisories/GHSA-46q5-g3j9-wx5c + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-32267.md b/2026/CVE-2026-32267.md new file mode 100644 index 0000000000..75337284e2 --- /dev/null +++ b/2026/CVE-2026-32267.md @@ -0,0 +1,18 @@ +### [CVE-2026-32267](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32267) +![](https://img.shields.io/static/v1?label=Product&message=cms&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=%3E%3D%204.0.0-RC1%2C%20%3C%204.17.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=%3E%3D%205.0.0-RC1%2C%20%3C%205.9.12%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-863%3A%20Incorrect%20Authorization&color=brightgreen) + +### Description + +Craft CMS is a content management system (CMS). From version 4.0.0-RC1 to before version 4.17.6 and from version 5.0.0-RC1 to before version 5.9.12, a low-privilege user (or an unauthenticated user who has been sent a shared URL) can escalate their privileges to admin by abusing UsersController->actionImpersonateWithToken. This issue has been patched in versions 4.17.6 and 5.9.12. + +### POC + +#### Reference +- https://github.com/craftcms/cms/security/advisories/GHSA-cc7p-2j3x-x7xf + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-32595.md b/2026/CVE-2026-32595.md new file mode 100644 index 0000000000..01204f2cea --- /dev/null +++ b/2026/CVE-2026-32595.md @@ -0,0 +1,19 @@ +### [CVE-2026-32595](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32595) +![](https://img.shields.io/static/v1?label=Product&message=traefik&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=%3C%202.11.41%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=%3E%3D%203.0.0-beta1%2C%20%3C%203.6.11%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=%3E%3D%203.7.0-ea.1%2C%20%3C%203.7.0-ea.2%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-208%3A%20Observable%20Timing%20Discrepancy&color=brightgreen) + +### Description + +Traefik is an HTTP reverse proxy and load balancer. Versions 2.11.40 and below, 3.0.0-beta1 through 3.6.11, and 3.7.0-ea.1 comtain BasicAuth middleware that allows username enumeration via a timing attack. When a submitted username exists, the middleware performs a bcrypt password comparison taking ~166ms. When the username does not exist, the response returns immediately in ~0.6ms. This ~298x timing difference is observable over the network and allows an unauthenticated attacker to reliably distinguish valid from invalid usernames. This issue is patched in versions 2.11.41, 3.6.11 and 3.7.0-ea.2. + +### POC + +#### Reference +- https://github.com/traefik/traefik/security/advisories/GHSA-g3hg-j4jv-cwfr + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-32629.md b/2026/CVE-2026-32629.md new file mode 100644 index 0000000000..b985d0bf1d --- /dev/null +++ b/2026/CVE-2026-32629.md @@ -0,0 +1,18 @@ +### [CVE-2026-32629](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32629) +![](https://img.shields.io/static/v1?label=Product&message=phpMyFAQ&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=%3C%204.1.1%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-20%3A%20Improper%20Input%20Validation&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-79%3A%20Improper%20Neutralization%20of%20Input%20During%20Web%20Page%20Generation%20('Cross-site%20Scripting')&color=brightgreen) + +### Description + +phpMyFAQ is an open source FAQ web application. Prior to version 4.1.1, an unauthenticated attacker can submit a guest FAQ with an email address that is syntactically valid per RFC 5321 (quoted local part) yet contains raw HTML — for example ""@evil.com. PHP's FILTER_VALIDATE_EMAIL accepts this email as valid. The email is stored in the database without HTML sanitization and later rendered in the admin FAQ editor template using Twig's |raw filter, which bypasses auto-escaping entirely. This issue has been patched in version 4.1.1. + +### POC + +#### Reference +- https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-98gw-w575-h2ph + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-32634.md b/2026/CVE-2026-32634.md new file mode 100644 index 0000000000..754c2c3e7a --- /dev/null +++ b/2026/CVE-2026-32634.md @@ -0,0 +1,18 @@ +### [CVE-2026-32634](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32634) +![](https://img.shields.io/static/v1?label=Product&message=glances&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=%3C%204.5.2%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-346%3A%20Origin%20Validation%20Error&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-522%3A%20Insufficiently%20Protected%20Credentials&color=brightgreen) + +### Description + +Glances is an open-source system cross-platform monitoring tool. Prior to version 4.5.2, in Central Browser mode, Glances stores both the Zeroconf-advertised server name and the discovered IP address for dynamic servers, but later builds connection URIs from the untrusted advertised name instead of the discovered IP. When a dynamic server reports itself as protected, Glances also uses that same untrusted name as the lookup key for saved passwords and the global `[passwords] default` credential. An attacker on the same local network can advertise a fake Glances service over Zeroconf and cause the browser to automatically send a reusable Glances authentication secret to an attacker-controlled host. This affects the background polling path and the REST/WebUI click-through path in Central Browser mode. Version 4.5.2 fixes the issue. + +### POC + +#### Reference +- https://github.com/nicolargo/glances/security/advisories/GHSA-vx5f-957p-qpvm + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-32685.md b/2026/CVE-2026-32685.md index 71ac17b490..13e09ac76a 100644 --- a/2026/CVE-2026-32685.md +++ b/2026/CVE-2026-32685.md @@ -22,6 +22,7 @@ Path traversal vulnerability in Gleam's handling of custom documentation pages a #### Reference - https://cna.erlef.org/cves/CVE-2026-32685.html +- https://github.com/gleam-lang/gleam/security/advisories/GHSA-wjx8-7w8m-p4v7 #### Github No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-32695.md b/2026/CVE-2026-32695.md new file mode 100644 index 0000000000..b703c98c3a --- /dev/null +++ b/2026/CVE-2026-32695.md @@ -0,0 +1,19 @@ +### [CVE-2026-32695](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32695) +![](https://img.shields.io/static/v1?label=Product&message=traefik&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=%3C%203.6.11%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=%3E%3D%203.7.0-ea.1%2C%20%3C%203.7.0-ea.2%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-74%3A%20Improper%20Neutralization%20of%20Special%20Elements%20in%20Output%20Used%20by%20a%20Downstream%20Component%20('Injection')&color=brightgreen) + +### Description + +Traefik is an HTTP reverse proxy and load balancer. Prior to versions 3.6.11 and 3.7.0-ea.2, Traefik's Knative provider builds router rules by interpolating user-controlled values into backtick-delimited rule expressions without escaping. In live cluster validation, Knative `rules[].hosts[]` was exploitable for host restriction bypass (for example `tenant.example.com`) || Host(`attacker.com`), producing a router that serves attacker-controlled hosts. Knative `headers[].exact` also allows rule-syntax injection and proves unsafe rule construction. In multi-tenant clusters, this can route unauthorized traffic to victim services and lead to cross-tenant traffic exposure. Versions 3.6.11 and 3.7.0-ea.2 patch the issue. + +### POC + +#### Reference +- https://github.com/traefik/traefik/security/advisories/GHSA-67jx-r9pv-98rj + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-32699.md b/2026/CVE-2026-32699.md new file mode 100644 index 0000000000..3e7039e565 --- /dev/null +++ b/2026/CVE-2026-32699.md @@ -0,0 +1,17 @@ +### [CVE-2026-32699](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32699) +![](https://img.shields.io/static/v1?label=Product&message=facturascripts&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=%3C%3D%202025.92%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-472%3A%20External%20Control%20of%20Assumed-Immutable%20Web%20Parameter&color=brightgreen) + +### Description + +FacturaScripts is an open source accounting and invoicing software. In versions 2025.92 and earlier, the application fails to validate the nick parameter during a POST request to the EditUser controller. Although the user interface prevents editing this field, a user can bypass this restriction by intercepting the request and modifying the nick form-data parameter to rename any account, including the administrator account. This leads to unauthorized modification of a field intended to be immutable. + +### POC + +#### Reference +- https://github.com/NeoRazorX/facturascripts/security/advisories/GHSA-pp79-hqv6-vmc3 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-32713.md b/2026/CVE-2026-32713.md new file mode 100644 index 0000000000..81406cce51 --- /dev/null +++ b/2026/CVE-2026-32713.md @@ -0,0 +1,17 @@ +### [CVE-2026-32713](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32713) +![](https://img.shields.io/static/v1?label=Product&message=PX4-Autopilot&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=%3C%201.17.0-rc2%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-670%3A%20Always-Incorrect%20Control%20Flow%20Implementation&color=brightgreen) + +### Description + +PX4 autopilot is a flight control solution for drones. Prior to 1.17.0-rc2, A logic error in the PX4 Autopilot MAVLink FTP session validation uses incorrect boolean logic (&& instead of ||), allowing BurstReadFile and WriteFile operations to proceed with invalid sessions or closed file descriptors. This enables an unauthenticated attacker to put the FTP subsystem into an inconsistent state, trigger operations on invalid file descriptors, and bypass session isolation checks. This vulnerability is fixed in 1.17.0-rc2. + +### POC + +#### Reference +- https://github.com/PX4/PX4-Autopilot/security/advisories/GHSA-pp2c-jr5g-6f2m + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-32714.md b/2026/CVE-2026-32714.md new file mode 100644 index 0000000000..8a441148a0 --- /dev/null +++ b/2026/CVE-2026-32714.md @@ -0,0 +1,17 @@ +### [CVE-2026-32714](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32714) +![](https://img.shields.io/static/v1?label=Product&message=scitokens&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=%3C%201.9.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-89%3A%20Improper%20Neutralization%20of%20Special%20Elements%20used%20in%20an%20SQL%20Command%20('SQL%20Injection')&color=brightgreen) + +### Description + +SciTokens is a reference library for generating and using SciTokens. Prior to version 1.9.6, the KeyCache class in scitokens was vulnerable to SQL Injection because it used Python's str.format() to construct SQL queries with user-supplied data (such as issuer and key_id). This allowed an attacker to execute arbitrary SQL commands against the local SQLite database. This issue has been patched in version 1.9.6. + +### POC + +#### Reference +- https://github.com/scitokens/scitokens/security/advisories/GHSA-rh5m-2482-966c + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-32718.md b/2026/CVE-2026-32718.md new file mode 100644 index 0000000000..8d60cd1380 --- /dev/null +++ b/2026/CVE-2026-32718.md @@ -0,0 +1,17 @@ +### [CVE-2026-32718](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32718) +![](https://img.shields.io/static/v1?label=Product&message=coolify&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=%3C%204.0.0-beta.466%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-863%3A%20Incorrect%20Authorization&color=brightgreen) + +### Description + +Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.466, mutating API validation endpoints are guarded by read ability, allowing read-scoped API tokens to perform state-changing operations such as validating cloud tokens and servers. This issue is fixed in version 4.0.0-beta.466. + +### POC + +#### Reference +- https://github.com/coollabsio/coolify/security/advisories/GHSA-f47p-xrgc-977v + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-32721.md b/2026/CVE-2026-32721.md new file mode 100644 index 0000000000..60745eb12c --- /dev/null +++ b/2026/CVE-2026-32721.md @@ -0,0 +1,20 @@ +### [CVE-2026-32721](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32721) +![](https://img.shields.io/static/v1?label=Product&message=luci&color=blue) +![](https://img.shields.io/static/v1?label=Product&message=openwrt&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=%3C%2024.10.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=%3C%2026.072.65753~068150b%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=%3E%3D%2025.12.0%2C%20%3C%2025.12.1%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-79%3A%20Improper%20Neutralization%20of%20Input%20During%20Web%20Page%20Generation%20('Cross-site%20Scripting')&color=brightgreen) + +### Description + +LuCI is the OpenWrt Configuration Interface. Versions prior to both 24.10.5 and 25.12.0, contain a stored XSS vulnerability in the wireless scan modal, where SSID values from scan results are rendered as raw HTML without any sanitization. The wireless.js file in the luci-mod-network package passes SSIDs via a template literal to dom.append(), which processes them through innerHTML, allowing an attacker to craft a malicious SSID containing arbitrary HTML/JavaScript. Exploitation requires the user to actively open the wireless scan modal (e.g., to connect to a Wi-Fi access point or survey nearby channels), and only affects OpenWrt versions newer than 23.05/22.03 up to the patched releases (24.10.6 and 25.12.1). The issue has been fixed in version LuCI 26.072.65753~068150b. + +### POC + +#### Reference +- https://github.com/openwrt/luci/security/advisories/GHSA-vvj6-7362-pjrw + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-32733.md b/2026/CVE-2026-32733.md new file mode 100644 index 0000000000..de92c9df77 --- /dev/null +++ b/2026/CVE-2026-32733.md @@ -0,0 +1,17 @@ +### [CVE-2026-32733](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32733) +![](https://img.shields.io/static/v1?label=Product&message=halloy&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=%3C%3D%202026.4%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-22%3A%20Improper%20Limitation%20of%20a%20Pathname%20to%20a%20Restricted%20Directory%20('Path%20Traversal')&color=brightgreen) + +### Description + +Halloy is an IRC application written in Rust. Prior to commit 0f77b2cfc5f822517a256ea5a4b94bad8bfe38b6, the DCC receive flow did not sanitize filenames from incoming `DCC SEND` requests. A remote IRC user could send a filename with path traversal sequences like `../../.ssh/authorized_keys` and the file would be written outside the user's configured `save_directory`. With auto-accept enabled this required zero interaction from the victim. Starting with commit 0f77b2cfc5f822517a256ea5a4b94bad8bfe38b6, all identified code paths sanitize filenames through a shared `sanitize_filename` function. + +### POC + +#### Reference +- https://github.com/squidowl/halloy/security/advisories/GHSA-fqrv-rfg4-rv89 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-32738.md b/2026/CVE-2026-32738.md new file mode 100644 index 0000000000..691bb4aaf6 --- /dev/null +++ b/2026/CVE-2026-32738.md @@ -0,0 +1,18 @@ +### [CVE-2026-32738](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32738) +![](https://img.shields.io/static/v1?label=Product&message=libheif&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=%3C%201.22.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-125%3A%20Out-of-bounds%20Read&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-476%3A%20NULL%20Pointer%20Dereference&color=brightgreen) + +### Description + +libheif is a HEIF and AVIF file format decoder and encoder. In versions 1.21.2 and below, a crafted 792-byte HEIF sequence file with samples_per_chunk=0 in the stsc box causes an unsigned integer underflow in the Chunk constructor (m_last_sample = 0 + 0 - 1 = UINT32_MAX), mapping all samples to an empty chunk and resulting in a denial of service. When any sample is accessed, the library reads from index 0 of an empty std::vector, causing a guaranteed SEGV (null-page read). The file parses successfully without producing an error; the crash occurs on the first frame access. This issue has been fixed in version 1.22.0. + +### POC + +#### Reference +- https://github.com/strukturag/libheif/security/advisories/GHSA-7f2h-cmpf-v9ww + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-32740.md b/2026/CVE-2026-32740.md new file mode 100644 index 0000000000..b7f8127a99 --- /dev/null +++ b/2026/CVE-2026-32740.md @@ -0,0 +1,17 @@ +### [CVE-2026-32740](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32740) +![](https://img.shields.io/static/v1?label=Product&message=libheif&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=%3C%201.22.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-787%3A%20Out-of-bounds%20Write&color=brightgreen) + +### Description + +libheif is a HEIF and AVIF file format decoder and encoder. Versions 1.21.2 and prior contain a heap-buffer-overflow (write) vulnerability in the grid tile compositing, allowing an attacker to write 64 bytes of fully attacker-controlled data past the end of a chroma plane heap allocation by crafting a HEIF/AVIF file with a 1×4 grid of odd-height tiles. The overflow is triggered during normal image decoding with default build configuration. The written bytes are chroma (Cb/Cr) pixel values from the attacking tile, giving the attacker full control over the overflow content. This issue has been fixed in version 1.22.0. + +### POC + +#### Reference +- https://github.com/strukturag/libheif/security/advisories/GHSA-frfr-f3vg-2g6j + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-32747.md b/2026/CVE-2026-32747.md new file mode 100644 index 0000000000..12b14213a4 --- /dev/null +++ b/2026/CVE-2026-32747.md @@ -0,0 +1,18 @@ +### [CVE-2026-32747](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32747) +![](https://img.shields.io/static/v1?label=Product&message=siyuan&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=%3C%203.6.1%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-184%3A%20Incomplete%20List%20of%20Disallowed%20Inputs&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-22%3A%20Improper%20Limitation%20of%20a%20Pathname%20to%20a%20Restricted%20Directory%20('Path%20Traversal')&color=brightgreen) + +### Description + +SiYuan is a personal knowledge management system. In versions 3.6.0 and below, the globalCopyFiles API eads source files using filepath.Abs() with no workspace boundary check, relying solely on util.IsSensitivePath() whose blocklist omits /proc/, /run/secrets/, and home directory dotfiles. An admin can copy /proc/1/environ or Docker secrets into the workspace and read them via the standard file API. An admin can exfiltrate any file readable by the SiYuan process that falls outside the incomplete blocklist. In containerized deployments this includes all injected secrets and environment variables - a common pattern for passing credentials to containers. The exfiltrated files are then accessible via the standard workspace file API and persist until manually deleted. This issue has been fixed in version 3.6.1. + +### POC + +#### Reference +- https://github.com/siyuan-note/siyuan/security/advisories/GHSA-h5vh-m7fg-w5h6 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-32751.md b/2026/CVE-2026-32751.md new file mode 100644 index 0000000000..0e209d49d3 --- /dev/null +++ b/2026/CVE-2026-32751.md @@ -0,0 +1,17 @@ +### [CVE-2026-32751](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32751) +![](https://img.shields.io/static/v1?label=Product&message=siyuan&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=%3C%203.6.1%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-79%3A%20Improper%20Neutralization%20of%20Input%20During%20Web%20Page%20Generation%20('Cross-site%20Scripting')&color=brightgreen) + +### Description + +SiYuan is a personal knowledge management system. In versions 3.6.0 and below, the mobile file tree (MobileFiles.ts) renders notebook names via innerHTML without HTML escaping when processing renamenotebook WebSocket events. The desktop version (Files.ts) properly uses escapeHtml() for the same operation. An authenticated user who can rename notebooks can inject arbitrary HTML/JavaScript that executes on any mobile client viewing the file tree. Since Electron is configured with nodeIntegration: true and contextIsolation: false, the injected JavaScript has full Node.js access, escalating stored XSS to full remote code execution. The mobile layout is also used in the Electron desktop app when the window is narrow, making this exploitable on desktop as well. This issue has been fixed in version 3.6.1. + +### POC + +#### Reference +- https://github.com/siyuan-note/siyuan/security/advisories/GHSA-qr46-rcv3-4hq3 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-32753.md b/2026/CVE-2026-32753.md new file mode 100644 index 0000000000..9176cc2e61 --- /dev/null +++ b/2026/CVE-2026-32753.md @@ -0,0 +1,17 @@ +### [CVE-2026-32753](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32753) +![](https://img.shields.io/static/v1?label=Product&message=freescout&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=%3C%201.8.209%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-80%3A%20Improper%20Neutralization%20of%20Script-Related%20HTML%20Tags%20in%20a%20Web%20Page%20(Basic%20XSS)&color=brightgreen) + +### Description + +FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. In versions 1.8.208 and below, bypasses of the attachment view logic and SVG sanitizer make it possible to upload and render an SVG that runs malicious JavaScript. An extension of .png with content type of image/svg+xml is allowed, and a fallback mechanism on invalid XML leads to unsafe sanitization. The application restricts which uploaded files are rendered inline: only files considered "safe" are displayed in the browser; others are served with Content-Disposition: attachment. This decision is based on two checks: the file extension (e.g. .png is allowed, while .svg may not be) and the declared Content-Type (e.g. image/* is allowed). By using a filename with an allowed extension (e.g. xss.png) and a Content-Type of image/svg+xml, an attacker can satisfy both checks and cause the server to treat the upload as a safe image and render it inline, even though the body is SVG and can contain scripted behavior. Any authenticated user can set up a specific URL, and whenever another user or administrator visits it, XSS can perform any action on their behalf. This issue has been fixed in version 1.8.209. + +### POC + +#### Reference +- https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-cvr8-cw5c-5pfw + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-32754.md b/2026/CVE-2026-32754.md new file mode 100644 index 0000000000..c5fba9dbaf --- /dev/null +++ b/2026/CVE-2026-32754.md @@ -0,0 +1,18 @@ +### [CVE-2026-32754](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32754) +![](https://img.shields.io/static/v1?label=Product&message=freescout&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=%3C%201.8.209%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-116%3A%20Improper%20Encoding%20or%20Escaping%20of%20Output&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-79%3A%20Improper%20Neutralization%20of%20Input%20During%20Web%20Page%20Generation%20('Cross-site%20Scripting')&color=brightgreen) + +### Description + +FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Versions 1.8.208 and below are vulnerable to Stored Cross-Site Scripting (XSS) through FreeScout's email notification templates. Incoming email bodies are stored in the database without sanitization and rendered unescaped in outgoing email notifications using Blade's raw output syntax {!! $thread->body !!}. An unauthenticated attacker can exploit this vulnerability by simply sending an email, and when opened by any subscribed agent or admin as part of their normal workflow, enabling universal HTML injection (phishing, tracking) and, in vulnerable email clients, JavaScript execution (session hijacking, credential theft, account takeover) affecting all recipients simultaneously. This issue has been fixed in version 1.8.209. + +### POC + +#### Reference +- https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-56h2-5556-r6mg + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-32759.md b/2026/CVE-2026-32759.md new file mode 100644 index 0000000000..36fd867b12 --- /dev/null +++ b/2026/CVE-2026-32759.md @@ -0,0 +1,17 @@ +### [CVE-2026-32759](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32759) +![](https://img.shields.io/static/v1?label=Product&message=filebrowser&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=%3C%202.33.8%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-190%3A%20Integer%20Overflow%20or%20Wraparound&color=brightgreen) + +### Description + +File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. In versions on the 2.x branch prior to 2.33.8, the TUS resumable upload handler parses the Upload-Length header as a signed 64-bit integer without validating that the value is non-negative, allowing an authenticated user to supply a negative value that instantly satisfies the upload completion condition upon the first PATCH request. This causes the server to fire after_upload exec hooks with empty or partial files, enabling an attacker to repeatedly trigger any configured hook with arbitrary filenames and zero bytes written. The impact ranges from DoS through expensive processing hooks, to command injection amplification when combined with malicious filenames, to abuse of upload-driven workflows like S3 ingestion or database inserts. Even without exec hooks enabled, the negative Upload-Length creates inconsistent cache entries where files are marked complete but contain no data. All deployments using the TUS upload endpoint (/api/tus) are affected, with the enableExec flag escalating the impact from cache inconsistency to remote command execution. This feature has been disabled by default for all installations from v2.33.8 onwards, including for existent installations. To exploit this vulnerability, the instance administrator must turn on a feature and ignore all the warnings about known vulnerabilities. + +### POC + +#### Reference +- https://github.com/filebrowser/filebrowser/security/advisories/GHSA-ffx7-75gc-jg7c + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-32810.md b/2026/CVE-2026-32810.md new file mode 100644 index 0000000000..f0701e7ee8 --- /dev/null +++ b/2026/CVE-2026-32810.md @@ -0,0 +1,17 @@ +### [CVE-2026-32810](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32810) +![](https://img.shields.io/static/v1?label=Product&message=halloy&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=%3C%3D%202026.4%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-732%3A%20Incorrect%20Permission%20Assignment%20for%20Critical%20Resource&color=brightgreen) + +### Description + +Halloy is an IRC application written in Rust. In versions on \*nix and macOS prior to commit f180e41061db393acf65bc99f5c5e7397586d9cb, halloy creates its config directory and files using default umask permissions, which typically results in `0644` on files and `0755` on directories. This allows any local user on the system to read plaintext credentials stored in `config.toml` or referenced `password_file` paths. Commit f180e41061db393acf65bc99f5c5e7397586d9cb patches the issue. + +### POC + +#### Reference +- https://github.com/squidowl/halloy/security/advisories/GHSA-x5j2-fr4h-9p7g + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-32813.md b/2026/CVE-2026-32813.md new file mode 100644 index 0000000000..38c56153e5 --- /dev/null +++ b/2026/CVE-2026-32813.md @@ -0,0 +1,17 @@ +### [CVE-2026-32813](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32813) +![](https://img.shields.io/static/v1?label=Product&message=admidio&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=%3C%205.0.7%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-89%3A%20Improper%20Neutralization%20of%20Special%20Elements%20used%20in%20an%20SQL%20Command%20('SQL%20Injection')&color=brightgreen) + +### Description + +Admidio is an open-source user management solution. Versions 5.0.6 and below are vulnerable to arbitrary SQL Injection through the MyList configuration feature. The MyList configuration feature lets authenticated users define custom list column layouts, storing user-supplied column names, sort directions, and filter conditions in the adm_list_columns table via prepared statements. However, these stored values are later read back and interpolated directly into dynamically constructed SQL queries without sanitization or parameterization, creating a classic second-order SQL injection vulnerability (safe write, unsafe read). An attacker can exploit this to inject arbitrary SQL, potentially reading, modifying, or deleting any data in the database and achieving full database compromise. This issue has been fixed in version 5.0.7. + +### POC + +#### Reference +- https://github.com/Admidio/admidio/security/advisories/GHSA-3x67-4c2c-w45m + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-32814.md b/2026/CVE-2026-32814.md new file mode 100644 index 0000000000..b535115e29 --- /dev/null +++ b/2026/CVE-2026-32814.md @@ -0,0 +1,18 @@ +### [CVE-2026-32814](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32814) +![](https://img.shields.io/static/v1?label=Product&message=libheif&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=%3C%201.22.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-200%3A%20Exposure%20of%20Sensitive%20Information%20to%20an%20Unauthorized%20Actor&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-908%3A%20Use%20of%20Uninitialized%20Resource&color=brightgreen) + +### Description + +libheif is a HEIF and AVIF file format decoder and encoder. In versions 1.21.2 and prior, when decoding a HEIF grid image with strict_decoding=false (the default), a corrupted tile silently fails to decode and the library returns heif_error_Ok with no indication of failure, leading to an uninitialized heap memory information leak. The canvas is allocated via create_clone_image_at_new_size() → plane.alloc() → new (std::nothrow) uint8_t[allocation_size] which does not zero the memory; only the alpha plane is explicitly initialized via fill_plane(), so the Y, Cb, and Cr planes contain whatever was previously at that heap address. The failed tile's region of the canvas is never written. It retains uninitialized heap data that is delivered to the caller as decoded pixel values (4,096 bytes per Y/Cb/Cr plane = 12,288+ bytes total). Any application using libheif to decode grid-based HEIF/AVIF files with default settings is vulnerable: a crafted .heic or .avif file causes 4,096+ bytes of heap memory to appear as pixel values in the decoded image, and the calling application receives heif_error_Ok, so it has no indication the output contains heap garbage. In server-side image processing, an uploaded crafted HEIF decoded and re-encoded (e.g., as PNG/JPEG for thumbnails, CDN, social media) can leak cross-user data such as auth tokens, database results, and other users' image data. This issue has been fixed in version 1.22.0. + +### POC + +#### Reference +- https://github.com/strukturag/libheif/security/advisories/GHSA-4m8r-34pg-rvwc + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-32816.md b/2026/CVE-2026-32816.md new file mode 100644 index 0000000000..ffdd46cf91 --- /dev/null +++ b/2026/CVE-2026-32816.md @@ -0,0 +1,17 @@ +### [CVE-2026-32816](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32816) +![](https://img.shields.io/static/v1?label=Product&message=admidio&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=%3E%3D%205.0.0%2C%20%3C%205.0.7%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-352%3A%20Cross-Site%20Request%20Forgery%20(CSRF)&color=brightgreen) + +### Description + +Admidio is an open-source user management solution. In versions 5.0.0 through 5.0.6, the delete, activate, and deactivate modes in modules/groups-roles/groups_roles.php perform destructive state changes on organizational roles but never validate an anti-CSRF token. The client-side UI passes a CSRF token to callUrlHideElement(), which includes it in the POST body, but the server-side handlers ignore $_POST["adm_csrf_token"] entirely for these three modes. An attacker who can discover a role UUID (visible in the public cards view when the module is publicly accessible) can embed a forged POST form on any external page and trick any user with the rol_assign_roles right into deleting or toggling roles for the organization. Role deletion is permanent and cascades to all memberships, event associations, and rights data. If exploited, an attacker can trick any user with delegated role-assignment rights into permanently deleting roles, mass-revoking all associated memberships and access to events, documents, and mailing lists, or silently activating or deactivating entire groups, with target role UUIDs trivially harvested from the unauthenticated public cards view and no undo path short of a database restore. This issue has been fixed in version 5.0.7. + +### POC + +#### Reference +- https://github.com/Admidio/admidio/security/advisories/GHSA-wwg8-6ffr-h4q2 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-32854.md b/2026/CVE-2026-32854.md new file mode 100644 index 0000000000..8e7de03441 --- /dev/null +++ b/2026/CVE-2026-32854.md @@ -0,0 +1,18 @@ +### [CVE-2026-32854](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32854) +![](https://img.shields.io/static/v1?label=Product&message=LibVNCServer&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-476%20NULL%20pointer%20dereference&color=brightgreen) + +### Description + +LibVNCServer versions 0.9.15 and prior (fixed in commit dc78dee) contain null pointer dereference vulnerabilities in the HTTP proxy handlers within httpProcessInput() in httpd.c that allow remote attackers to cause a denial of service by sending specially crafted HTTP requests. Attackers can exploit missing validation of strchr() return values in the CONNECT and GET proxy handling paths to trigger null pointer dereferences and crash the server when httpd and proxy features are enabled. + +### POC + +#### Reference +- https://github.com/LibVNC/libvncserver/security/advisories/GHSA-xjp8-4qqv-5x4x + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-32891.md b/2026/CVE-2026-32891.md new file mode 100644 index 0000000000..da0f86963f --- /dev/null +++ b/2026/CVE-2026-32891.md @@ -0,0 +1,19 @@ +### [CVE-2026-32891](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32891) +![](https://img.shields.io/static/v1?label=Product&message=Anchorr&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=%3C%201.4.2%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-212%3A%20Improper%20Removal%20of%20Sensitive%20Information%20Before%20Storage%20or%20Transfer&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-311%3A%20Missing%20Encryption%20of%20Sensitive%20Data&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-80%3A%20Improper%20Neutralization%20of%20Script-Related%20HTML%20Tags%20in%20a%20Web%20Page%20(Basic%20XSS)&color=brightgreen) + +### Description + +Anchorr is a Discord bot for requesting movies and TV shows and receiving notifications when items are added to a media server. Versions 1.4.1 and below contain a stored XSS vulnerability in the Jellyseerr user selector. Jellyseerr allows any account holder to execute arbitrary JavaScript in the Anchorr admin's browser session. The injected script calls the authenticated /api/config endpoint - which returns the full application configuration in plaintext. This allows the attacker to forge a valid Anchorr session token and gain full admin access to the dashboard with no knowledge of the admin password. The same response also exposes the API keys and tokens for every integrated service, resulting in simultaneous account takeover of the Jellyfin media server (via JELLYFIN_API_KEY), the Jellyseerr request manager (via JELLYSEERR_API_KEY), and the Discord bot (via DISCORD_TOKEN). This issue has been fixed in version 1.4.2. + +### POC + +#### Reference +- https://github.com/openVESSL/Anchorr/security/advisories/GHSA-6mg4-788h-7g9g + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-32948.md b/2026/CVE-2026-32948.md new file mode 100644 index 0000000000..e5084a89b2 --- /dev/null +++ b/2026/CVE-2026-32948.md @@ -0,0 +1,17 @@ +### [CVE-2026-32948](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32948) +![](https://img.shields.io/static/v1?label=Product&message=sbt&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=%3E%3D%200.9.5%2C%20%3C%201.12.7%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-78%3A%20Improper%20Neutralization%20of%20Special%20Elements%20used%20in%20an%20OS%20Command%20('OS%20Command%20Injection')&color=brightgreen) + +### Description + +sbt is a build tool for Scala, Java, and others. From version 0.9.5 to before version 1.12.7, on Windows, sbt uses Process("cmd", "/c", ...) to run VCS commands (git, hg, svn). The URI fragment (branch, tag, revision) is user-controlled via the build definition and passed to these commands without validation. Because cmd /c interprets &, |, and ; as command separators, a malicious fragment can execute arbitrary commands. This issue has been patched in version 1.12.7. + +### POC + +#### Reference +- https://github.com/sbt/sbt/security/advisories/GHSA-x4ff-q6h8-v7gw + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-33824.md b/2026/CVE-2026-33824.md new file mode 100644 index 0000000000..b3f0c48078 --- /dev/null +++ b/2026/CVE-2026-33824.md @@ -0,0 +1,42 @@ +### [CVE-2026-33824](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33824) +![](https://img.shields.io/static/v1?label=Product&message=Windows%2010%20Version%201607&color=blue) +![](https://img.shields.io/static/v1?label=Product&message=Windows%2010%20Version%201809&color=blue) +![](https://img.shields.io/static/v1?label=Product&message=Windows%2010%20Version%2021H2&color=blue) +![](https://img.shields.io/static/v1?label=Product&message=Windows%2010%20Version%2022H2&color=blue) +![](https://img.shields.io/static/v1?label=Product&message=Windows%2011%20Version%2023H2&color=blue) +![](https://img.shields.io/static/v1?label=Product&message=Windows%2011%20Version%2024H2&color=blue) +![](https://img.shields.io/static/v1?label=Product&message=Windows%2011%20Version%2025H2&color=blue) +![](https://img.shields.io/static/v1?label=Product&message=Windows%2011%20version%2022H3&color=blue) +![](https://img.shields.io/static/v1?label=Product&message=Windows%2011%20version%2026H1&color=blue) +![](https://img.shields.io/static/v1?label=Product&message=Windows%20Server%202016%20(Server%20Core%20installation)&color=blue) +![](https://img.shields.io/static/v1?label=Product&message=Windows%20Server%202016&color=blue) +![](https://img.shields.io/static/v1?label=Product&message=Windows%20Server%202019%20(Server%20Core%20installation)&color=blue) +![](https://img.shields.io/static/v1?label=Product&message=Windows%20Server%202019&color=blue) +![](https://img.shields.io/static/v1?label=Product&message=Windows%20Server%202022%2C%2023H2%20Edition%20(Server%20Core%20installation)&color=blue) +![](https://img.shields.io/static/v1?label=Product&message=Windows%20Server%202022&color=blue) +![](https://img.shields.io/static/v1?label=Product&message=Windows%20Server%202025%20(Server%20Core%20installation)&color=blue) +![](https://img.shields.io/static/v1?label=Product&message=Windows%20Server%202025&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=10.0.14393.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=10.0.17763.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=10.0.19044.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=10.0.19045.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=10.0.20348.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=10.0.22631.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=10.0.25398.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=10.0.26100.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=10.0.26200.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=10.0.28000.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-415%3A%20Double%20Free&color=brightgreen) + +### Description + +Double free in Windows IKE Extension allows an unauthorized attacker to execute code over a network. + +### POC + +#### Reference +- https://unit42.paloaltonetworks.com/autonomous-ai-cyber-attack-campaign/ + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-40102.md b/2026/CVE-2026-40102.md new file mode 100644 index 0000000000..6625aaffb7 --- /dev/null +++ b/2026/CVE-2026-40102.md @@ -0,0 +1,17 @@ +### [CVE-2026-40102](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-40102) +![](https://img.shields.io/static/v1?label=Product&message=plane&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=%3C%201.3.1%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-943%3A%20Improper%20Neutralization%20of%20Special%20Elements%20in%20Data%20Query%20Logic&color=brightgreen) + +### Description + +Plane is an open-source project management tool. In versions 1.3.0 and below, SavedAnalyticEndpoint passes the user-controlled segment query parameter directly to a Django F() expression without validation (unlike the regular AnalyticsEndpoint, which checks against an allowlist), causing ORM Field Reference Injection. An authenticated workspace MEMBER can send GET /api/workspaces//saved-analytic-view// with a crafted segment value that is forwarded into build_graph_plot() and traverses foreign-key relationships (e.g. workspace__owner__password) before being projected via .values("dimension", "segment"), returning the referenced field values directly in the JSON response. This exposes sensitive data such as bcrypt password hashes, API tokens, and related users' email addresses, making it a stronger primitive than the related order_by injection where values are only leaked through ordering. This issue has been fixed in version 1.3.1. + +### POC + +#### Reference +- https://github.com/makeplane/plane/security/advisories/GHSA-93x3-ghh7-72j3 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-40150.md b/2026/CVE-2026-40150.md new file mode 100644 index 0000000000..4492ca6c58 --- /dev/null +++ b/2026/CVE-2026-40150.md @@ -0,0 +1,17 @@ +### [CVE-2026-40150](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-40150) +![](https://img.shields.io/static/v1?label=Product&message=PraisonAIAgents&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=%3C%201.5.128%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-918%3A%20Server-Side%20Request%20Forgery%20(SSRF)&color=brightgreen) + +### Description + +PraisonAIAgents is a multi-agent teams system. Prior to 1.5.128, the web_crawl() function in praisonaiagents/tools/web_crawl_tools.py accepts arbitrary URLs from AI agents with zero validation. No scheme allowlisting, hostname/IP blocklisting, or private network checks are applied before fetching. This allows an attacker (or prompt injection in crawled content) to force the agent to fetch cloud metadata endpoints, internal services, or local files via file:// URLs. This vulnerability is fixed in 1.5.128. + +### POC + +#### Reference +- https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-8f4v-xfm9-3244 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-40153.md b/2026/CVE-2026-40153.md new file mode 100644 index 0000000000..793bb2ea3c --- /dev/null +++ b/2026/CVE-2026-40153.md @@ -0,0 +1,17 @@ +### [CVE-2026-40153](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-40153) +![](https://img.shields.io/static/v1?label=Product&message=PraisonAIAgents&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=%3C%201.5.128%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-526%3A%20Cleartext%20Storage%20of%20Sensitive%20Information%20in%20an%20Environment%20Variable&color=brightgreen) + +### Description + +PraisonAIAgents is a multi-agent teams system. Prior to 1.5.128, the execute_command function in shell_tools.py calls os.path.expandvars() on every command argument at line 64, manually re-implementing shell-level environment variable expansion despite using shell=False (line 88) for security. This allows exfiltration of secrets stored in environment variables (database credentials, API keys, cloud access keys). The approval system displays the unexpanded $VAR references to human reviewers, creating a deceptive approval where the displayed command differs from what actually executes. This vulnerability is fixed in 1.5.128. + +### POC + +#### Reference +- https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-v8g7-9q6v-p3x8 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-40285.md b/2026/CVE-2026-40285.md new file mode 100644 index 0000000000..fe7c310e06 --- /dev/null +++ b/2026/CVE-2026-40285.md @@ -0,0 +1,19 @@ +### [CVE-2026-40285](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-40285) +![](https://img.shields.io/static/v1?label=Product&message=WeGIA&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=%3C%203.6.10%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-302%3A%20Authentication%20Bypass%20by%20Assumed-Immutable%20Data&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-473%3A%20PHP%20External%20Variable%20Modification&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-89%3A%20Improper%20Neutralization%20of%20Special%20Elements%20used%20in%20an%20SQL%20Command%20('SQL%20Injection')&color=brightgreen) + +### Description + +WeGIA is a web manager for charitable institutions. Versions prior to 3.6.10 contain a SQL injection vulnerability in dao/memorando/UsuarioDAO.php. The cpf_usuario POST parameter overwrites the session-stored user identity via extract($_REQUEST) in DespachoControle::verificarDespacho(), and the attacker-controlled value is then interpolated directly into a raw SQL query, allowing any authenticated user to query the database under an arbitrary identity. Version 3.6.10 fixes the issue. + +### POC + +#### Reference +- https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-666r-v2m7-xgp9 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-40570.md b/2026/CVE-2026-40570.md new file mode 100644 index 0000000000..8350081ef9 --- /dev/null +++ b/2026/CVE-2026-40570.md @@ -0,0 +1,18 @@ +### [CVE-2026-40570](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-40570) +![](https://img.shields.io/static/v1?label=Product&message=freescout&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=%3C%201.8.213%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-639%3A%20Authorization%20Bypass%20Through%20User-Controlled%20Key&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-862%3A%20Missing%20Authorization&color=brightgreen) + +### Description + +FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.213, the `load_customer_info` action in `POST /conversation/ajax` returns complete customer profile data to any authenticated user without verifying mailbox access. An attacker only needs a valid email address to retrieve all customer PII. Version 1.8.213 fixes the issue. + +### POC + +#### Reference +- https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-w77q-wjfp-c822 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-40593.md b/2026/CVE-2026-40593.md new file mode 100644 index 0000000000..b6d13746d7 --- /dev/null +++ b/2026/CVE-2026-40593.md @@ -0,0 +1,18 @@ +### [CVE-2026-40593](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-40593) +![](https://img.shields.io/static/v1?label=Product&message=CRM&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=%3C%207.2.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-116%3A%20Improper%20Encoding%20or%20Escaping%20of%20Output&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-79%3A%20Improper%20Neutralization%20of%20Input%20During%20Web%20Page%20Generation%20('Cross-site%20Scripting')&color=brightgreen) + +### Description + +ChurchCRM is an open-source church management system. In versions prior to 7.2.0, the User Editor (UserEditor.php) renders stored usernames directly into an HTML input value attribute without applying htmlspecialchars(). An administrator can save a username containing HTML attribute-breaking characters and event handlers, which execute in the browser of any administrator who subsequently views that user's editor page, resulting in stored XSS. This issue has been fixed in version 7.2.0. + +### POC + +#### Reference +- https://github.com/ChurchCRM/CRM/security/advisories/GHSA-7h46-9f64-p49q + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-40868.md b/2026/CVE-2026-40868.md new file mode 100644 index 0000000000..f81311d1ae --- /dev/null +++ b/2026/CVE-2026-40868.md @@ -0,0 +1,17 @@ +### [CVE-2026-40868](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-40868) +![](https://img.shields.io/static/v1?label=Product&message=kyverno&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=%3C%201.16.4%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-922%3A%20Insecure%20Storage%20of%20Sensitive%20Information&color=brightgreen) + +### Description + +Kyverno is a policy engine designed for cloud native platform engineering teams. Prior to 1.16.4, kyverno’s apiCall servicecall helper implicitly injects Authorization: Bearer ... using the kyverno controller serviceaccount token when a policy does not explicitly set an Authorization header. Because context.apiCall.service.url is policy-controlled, this can send the kyverno serviceaccount token to an attacker-controlled endpoint (confused deputy). Namespaced policies are blocked from servicecall usage by the namespaced urlPath gate in pkg/engine/apicall/apiCall.go, so this report is scoped to ClusterPolicy and global context usage. This vulnerability is fixed in 1.16.4. + +### POC + +#### Reference +- https://github.com/kyverno/kyverno/security/advisories/GHSA-q93q-v844-jrqp + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-42338.md b/2026/CVE-2026-42338.md index a53c96554a..c84ab4214f 100644 --- a/2026/CVE-2026-42338.md +++ b/2026/CVE-2026-42338.md @@ -1,7 +1,6 @@ ### [CVE-2026-42338](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42338) ![](https://img.shields.io/static/v1?label=Product&message=ip-address&color=blue) ![](https://img.shields.io/static/v1?label=Version&message=%3C%2010.1.1%20&color=brightgreen) -![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-79%3A%20Improper%20Neutralization%20of%20Input%20During%20Web%20Page%20Generation%20('Cross-site%20Scripting')&color=brightgreen) ### Description diff --git a/2026/CVE-2026-42499.md b/2026/CVE-2026-42499.md index c06084a6a8..08dc109915 100644 --- a/2026/CVE-2026-42499.md +++ b/2026/CVE-2026-42499.md @@ -1,6 +1,5 @@ ### [CVE-2026-42499](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42499) ![](https://img.shields.io/static/v1?label=Product&message=net%2Fmail&color=blue) -![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Version&message=1.26.0-0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-407%3A%20Inefficient%20Algorithmic%20Complexity&color=brightgreen) diff --git a/2026/CVE-2026-43969.md b/2026/CVE-2026-43969.md index 90e83fda64..c27c01401f 100644 --- a/2026/CVE-2026-43969.md +++ b/2026/CVE-2026-43969.md @@ -6,7 +6,7 @@ ### Description -Improper Neutralization of CRLF Sequences ('CRLF Injection') vulnerability in ninenines cowlib allows HTTP request splitting and cookie smuggling via unvalidated cookie name and value fields.cow_cookie:cookie/1 in cowlib builds a client-side Cookie: request header from a list of name-value pairs without validating either field. An attacker who controls the cookie names or values passed to this function can inject ;, ,, CR, LF, or TAB characters into the serialized header. This enables two classes of attack: cookie smuggling within a single header (e.g. injecting "; admin=1" to introduce a phantom cookie that the receiving server treats as authentic) and HTTP request header splitting (injecting CRLF to append arbitrary headers or smuggle a complete second request against a shared upstream proxy). The decoder side (parse_cookie_name/1, parse_cookie_value/1) and setcookie/3 already validate and reject these characters; the encoder alone is missing the check.This issue affects cowlib from 2.9.0. +Improper Neutralization of CRLF Sequences ('CRLF Injection') vulnerability in ninenines cowlib allows HTTP request splitting and cookie smuggling via unvalidated cookie name and value fields.cow_cookie:cookie/1 in cowlib builds a client-side Cookie: request header from a list of name-value pairs without validating either field. An attacker who controls the cookie names or values passed to this function can inject ;, ,, CR, LF, or TAB characters into the serialized header. This enables two classes of attack: cookie smuggling within a single header (e.g. injecting ; admin=1 to introduce a phantom cookie that the receiving server treats as authentic) and HTTP request header splitting (injecting CRLF to append arbitrary headers or smuggle a complete second request against a shared upstream proxy). The decoder side (parse_cookie_name/1, parse_cookie_value/1) and setcookie/3 already validate and reject these characters; the encoder alone is missing the check.This issue affects cowlib: from 2.9.0 onward. ### POC diff --git a/2026/CVE-2026-47230.md b/2026/CVE-2026-47230.md new file mode 100644 index 0000000000..e2755a67b2 --- /dev/null +++ b/2026/CVE-2026-47230.md @@ -0,0 +1,18 @@ +### [CVE-2026-47230](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-47230) +![](https://img.shields.io/static/v1?label=Product&message=admidio&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=%3C%205.0.10%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-639%3A%20Authorization%20Bypass%20Through%20User-Controlled%20Key&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-863%3A%20Incorrect%20Authorization&color=brightgreen) + +### Description + +Admidio is an open-source user management solution. Prior to version 5.0.10, `modules/documents-files.php` mode `file_rename_save` shares the same root-cause shape as the cross-folder move bug (`05-documents-cross-folder-move-idor.md`): the top-level rights check at lines 79-89 validates `hasUploadRight()` on the URL parameter `folder_uuid`, but the rename operation acts on `file_uuid` — a separate URL parameter — without re-checking the folder that actually contains the file. `DocumentsService::renameFile()` resolves the target file via `getFileForDownload()` (which permits view-readable files) but does not require upload right on the file's source folder. Result: a user with upload right on any folder A can rename a file in folder B as long as they can view it. They can also overwrite the file's description. Version 5.0.10 contains a fix. + +### POC + +#### Reference +- https://github.com/Admidio/admidio/security/advisories/GHSA-q6w3-hpfv-rg36 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-47249.md b/2026/CVE-2026-47249.md new file mode 100644 index 0000000000..e9d4746fe7 --- /dev/null +++ b/2026/CVE-2026-47249.md @@ -0,0 +1,17 @@ +### [CVE-2026-47249](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-47249) +![](https://img.shields.io/static/v1?label=Product&message=klever-go&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=%3C%201.7.18%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-400%3A%20Uncontrolled%20Resource%20Consumption&color=brightgreen) + +### Description + +Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.18, the P2P resolver request handling logic is vulnerable to hash-array amplification. A connected peer can send a compressed RequestDataType_HashArrayType direct request that is only 442 bytes on the wire but expands into 200,000 decoded hash entries inside the resolver path. The resolver's antiflood logic counts only a single logical message and the compressed wire size, and while Batch.Decompress() caps the decompressed byte size, it never limits the number of decoded repeated-field items. As a result, both TxResolver and TrieNodeResolver preallocate and iterate over the entire unchecked set of decoded hashes, causing remote memory and CPU amplification against any node that accepts P2P peer connections. This issue is fixed in version 1.7.18. + +### POC + +#### Reference +- https://github.com/klever-io/klever-go/security/advisories/GHSA-w342-mj6g-v9c4 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-47662.md b/2026/CVE-2026-47662.md new file mode 100644 index 0000000000..b45dceb14d --- /dev/null +++ b/2026/CVE-2026-47662.md @@ -0,0 +1,19 @@ +### [CVE-2026-47662](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-47662) +![](https://img.shields.io/static/v1?label=Product&message=pathling&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=%3C%202.0.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-20%3A%20Improper%20Input%20Validation&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-522%3A%20Insufficiently%20Protected%20Credentials&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-918%3A%20Server-Side%20Request%20Forgery%20(SSRF)&color=brightgreen) + +### Description + +Pathling is a set of tools that make it easier to use FHIR and clinical terminology within health data analytics. Prior to version 2.0.0 of Pathling Server, Pathling's typed CRUD/search/batch FHIR surface allows an authenticated caller with only coarse operation authorities to act on attacker-chosen resource families because those entrypoints do not consistently enforce the documented per-resource `read` and `write` authorities. The documented authorization model requires an operation authority (e.g. `pathling:search`) to be paired with the matching per-resource `read` or `write` authority (e.g. `pathling:read:Patient`). Delete and batch are documented to require write authority for all referenced resource types. However, typed search, update, and related handlers are annotated only with `@OperationAccess(...)` and act on the provider-selected resource type without checking the corresponding per-resource authority. This is fixed in Pathling Server 2.0.0. + +### POC + +#### Reference +- https://github.com/aehrc/pathling/security/advisories/GHSA-26hp-x47g-x95q + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-47704.md b/2026/CVE-2026-47704.md new file mode 100644 index 0000000000..9051d1c0f1 --- /dev/null +++ b/2026/CVE-2026-47704.md @@ -0,0 +1,17 @@ +### [CVE-2026-47704](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-47704) +![](https://img.shields.io/static/v1?label=Product&message=typebot.io&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=%3C%203.17.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-639%3A%20Authorization%20Bypass%20Through%20User-Controlled%20Key&color=brightgreen) + +### Description + +TypeBot is a chatbot builder tool. Prior to version 3.17.0, an authenticated user who has read access to any typebot can resume a waiting webhook session that belongs to a different typebot by mixing an authorized `typebotId` and `blockId` and a foreign live `resultId`. The webhook resume handler authorizes the parent typebot first, but then resolves the descendant `result` only by `resultId`. As a result, an attacker can inject arbitrary webhook JSON into another typebot's suspended session and advance its execution without any access to the victim typebot. Version 3.17.0 patches the issue. + +### POC + +#### Reference +- https://github.com/baptisteArno/typebot.io/security/advisories/GHSA-h67g-6q6g-58cj + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-4878.md b/2026/CVE-2026-4878.md index c6c340169b..b0117ed387 100644 --- a/2026/CVE-2026-4878.md +++ b/2026/CVE-2026-4878.md @@ -26,7 +26,7 @@ ![](https://img.shields.io/static/v1?label=Product&message=Red%20Hat%20OpenShift%20Container%20Platform%204.17&color=blue) ![](https://img.shields.io/static/v1?label=Product&message=Red%20Hat%20OpenShift%20Container%20Platform%204.18&color=blue) ![](https://img.shields.io/static/v1?label=Product&message=Red%20Hat%20OpenShift%20Container%20Platform%204.19&color=blue) -![](https://img.shields.io/static/v1?label=Product&message=Red%20Hat%20OpenShift%20distributed%20tracing%203.9.1&color=blue) +![](https://img.shields.io/static/v1?label=Product&message=Red%20Hat%20OpenShift%20distributed%20tracing%203.9.2&color=blue) ![](https://img.shields.io/static/v1?label=Product&message=Red%20Hat%20Update%20Infrastructure%205&color=blue) ![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=Time-of-check%20Time-of-use%20(TOCTOU)%20Race%20Condition&color=brightgreen) diff --git a/2026/CVE-2026-50768.md b/2026/CVE-2026-50768.md new file mode 100644 index 0000000000..45f4595995 --- /dev/null +++ b/2026/CVE-2026-50768.md @@ -0,0 +1,17 @@ +### [CVE-2026-50768](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-50768) +![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen) + +### Description + +File Upload vulnerability in T-Systems International GmbH ImageMaster Version: 9.14.2.8.1 allows a remote attacker to execute arbitrary code via the add attachments feature in the create new document function. + +### POC + +#### Reference +- https://www.t-systems.com/in/en/content-and-collaboration/solutions/enterprise-content-management/imagemaster + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-54025.md b/2026/CVE-2026-54025.md new file mode 100644 index 0000000000..2e7f561357 --- /dev/null +++ b/2026/CVE-2026-54025.md @@ -0,0 +1,17 @@ +### [CVE-2026-54025](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-54025) +![](https://img.shields.io/static/v1?label=Product&message=LibreChat&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=%3C%200.8.4-rc1%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-79%3A%20Improper%20Neutralization%20of%20Input%20During%20Web%20Page%20Generation%20('Cross-site%20Scripting')&color=brightgreen) + +### Description + +LibreChat is an enhanced ChatGPT clone that supports multiple AI providers. Prior to 0.8.4-rc1, there is a vulnerability in LibreChat's markdown artifact preview pipeline. The marked library v15.0.12 does not HTML-escape double-quote characters in image alt text when a custom renderer falls through to the default renderer. LibreChat's generateMarkdownHtml function (in client/src/utils/markdown.ts) installs a custom image renderer that returns false for URLs passing the isSafeUrl allowlist check, which causes marked to fall back to its built-in renderer. That built-in renderer inserts the raw alt text into the alt="..." attribute without escaping double-quote characters. An attacker can craft an alt text such as " onload="payload to break out of the attribute and inject an arbitrary event handler. The resulting HTML is then assigned to document.getElementById('content').innerHTML inside the Sandpack preview iframe, causing the payload to execute in the victim's browser. This vulnerability is fixed in 0.8.4-rc1. + +### POC + +#### Reference +- https://github.com/danny-avila/LibreChat/security/advisories/GHSA-3phr-62qf-cxf3 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-54027.md b/2026/CVE-2026-54027.md new file mode 100644 index 0000000000..fd7fa39100 --- /dev/null +++ b/2026/CVE-2026-54027.md @@ -0,0 +1,17 @@ +### [CVE-2026-54027](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-54027) +![](https://img.shields.io/static/v1?label=Product&message=LibreChat&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=%3C%200.8.4-rc1%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-862%3A%20Missing%20Authorization&color=brightgreen) + +### Description + +LibreChat is an enhanced ChatGPT clone that supports multiple AI providers. Prior to 0.8.4-rc1, the POST /api/files/images endpoint allows any authenticated user to upload files into any agent's tool_resources (e.g., context, execute_code) without verifying ownership or EDIT permission on the target agent. A permission check was added to the POST /api/files route in a previous patch, but the image upload route was never updated with the same check. An attacker can simply use the image endpoint instead of the file endpoint to bypass the authorization entirely. This vulnerability is fixed in 0.8.4-rc1. + +### POC + +#### Reference +- https://github.com/danny-avila/LibreChat/security/advisories/GHSA-c55r-p24w-hcj5 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-54091.md b/2026/CVE-2026-54091.md new file mode 100644 index 0000000000..e7be54cd1d --- /dev/null +++ b/2026/CVE-2026-54091.md @@ -0,0 +1,17 @@ +### [CVE-2026-54091](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-54091) +![](https://img.shields.io/static/v1?label=Product&message=filebrowser&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=%3C%202.63.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-863%3A%20Incorrect%20Authorization&color=brightgreen) + +### Description + +File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Prior to 2.63.6, File Browser's public share handlers rebase the share owner's filesystem root to the shared directory and then evaluate descendant paths against the owner's global and per-user rules using the rebased relative path instead of the original path relative to the owner's scope. As a result, an attacker who knows a public directory share URL can access files and subdirectories that the owner explicitly blocked with rules, as long as those blocked paths are located underneath the shared directory. In the simplest case this is an unauthenticated information disclosure through `GET /api/public/share/*` and `GET /api/public/dl/*`. This vulnerability is fixed in 2.63.6. + +### POC + +#### Reference +- https://github.com/filebrowser/filebrowser/security/advisories/GHSA-j9jx-hp4c-ghhh + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-54092.md b/2026/CVE-2026-54092.md new file mode 100644 index 0000000000..2d2bfedf00 --- /dev/null +++ b/2026/CVE-2026-54092.md @@ -0,0 +1,18 @@ +### [CVE-2026-54092](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-54092) +![](https://img.shields.io/static/v1?label=Product&message=filebrowser&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=%3C%202.63.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-1284%3A%20Improper%20Validation%20of%20Specified%20Quantity%20in%20Input&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-400%3A%20Uncontrolled%20Resource%20Consumption&color=brightgreen) + +### Description + +File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Prior to 2.63.6, unchecked passwords maximums allow for an arbitrarily large password to be passed into the login API. This spikes CPU and memory, and after testing, crashes, heavily lags any container created, and has even made my docker daemon start to send errors with status code 500 even after the container was destroyed. This vulnerability is fixed in 2.63.6. + +### POC + +#### Reference +- https://github.com/filebrowser/filebrowser/security/advisories/GHSA-w5fm-68j4-fpc4 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-54093.md b/2026/CVE-2026-54093.md new file mode 100644 index 0000000000..8725ee0d7b --- /dev/null +++ b/2026/CVE-2026-54093.md @@ -0,0 +1,17 @@ +### [CVE-2026-54093](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-54093) +![](https://img.shields.io/static/v1?label=Product&message=filebrowser&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=%3C%202.63.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-22%3A%20Improper%20Limitation%20of%20a%20Pathname%20to%20a%20Restricted%20Directory%20('Path%20Traversal')&color=brightgreen) + +### Description + +File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Prior to 2.63.6, filebrowser builds the download-as-zip / download-as-tar archive entry names with filepath.ToSlash, which on a Linux host is a no-op for backslashes (\ is only a path separator on Windows). A file whose name contains Windows-style traversal is accepted by the resource handlers, stored on the Linux filesystem with a literal backslash name, and then emitted verbatim as the archive entry name. Windows extractors interpret \ as a path separator and write the extracted file outside the extraction directory — arbitrary file write on the victim who downloads and extracts the archive. This vulnerability is fixed in 2.63.6. + +### POC + +#### Reference +- https://github.com/filebrowser/filebrowser/security/advisories/GHSA-gxjx-7m74-hcq8 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-54317.md b/2026/CVE-2026-54317.md new file mode 100644 index 0000000000..1e4c4e06a0 --- /dev/null +++ b/2026/CVE-2026-54317.md @@ -0,0 +1,18 @@ +### [CVE-2026-54317](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-54317) +![](https://img.shields.io/static/v1?label=Product&message=core&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=%3C%202026.6.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-200%3A%20Exposure%20of%20Sensitive%20Information%20to%20an%20Unauthorized%20Actor&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-306%3A%20Missing%20Authentication%20for%20Critical%20Function&color=brightgreen) + +### Description + +Home Assistant is open source home automation software that puts local control and privacy first. Prior to 2026.6.0, the Konnected integration registers an HTTP endpoint, KonnectedView (homeassistant/components/konnected/__init__.py), that is marked as not requiring authentication (requires_auth = False). A comment next to that line says auth is instead handled "via the access token from configuration." That promise is only half true. Write requests (POST and PUT) are handled by update_sensor(), which does check the request's Authorization: Bearer header against the integration's stored access tokens (using hmac.compare_digest). Read requests (GET) are handled by a separate get() method that has no authentication check at all. This vulnerability is fixed in 2026.6.0. + +### POC + +#### Reference +- https://github.com/home-assistant/core/security/advisories/GHSA-x84v-g949-293w + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-54332.md b/2026/CVE-2026-54332.md new file mode 100644 index 0000000000..3ddb66139d --- /dev/null +++ b/2026/CVE-2026-54332.md @@ -0,0 +1,17 @@ +### [CVE-2026-54332](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-54332) +![](https://img.shields.io/static/v1?label=Product&message=gopacket&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=%3C%201.6.1%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-770%3A%20Allocation%20of%20Resources%20Without%20Limits%20or%20Throttling&color=brightgreen) + +### Description + +gopacket provides packet processing capabilities for Go. In version 1.6.0 and earlier, the sFlow ExtendedGatewayFlow decoder in layers/sflow.go reads an attacker-controlled 32-bit community count and AS path member count and sizes a slice allocation from those counts without bounding them against the bytes remaining in the datagram, so a 104-byte UDP datagram can drive an allocation of up to 16 GiB and cause an unauthenticated remote denial of service. This issue is fixed in version 1.6.1. + +### POC + +#### Reference +- https://github.com/gopacket/gopacket/security/advisories/GHSA-g6v3-7xmc-w563 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-54344.md b/2026/CVE-2026-54344.md new file mode 100644 index 0000000000..34c9ea5ac3 --- /dev/null +++ b/2026/CVE-2026-54344.md @@ -0,0 +1,17 @@ +### [CVE-2026-54344](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-54344) +![](https://img.shields.io/static/v1?label=Product&message=ToolJet&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=%3C%203.20.180%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-78%3A%20Improper%20Neutralization%20of%20Special%20Elements%20used%20in%20an%20OS%20Command%20('OS%20Command%20Injection')&color=brightgreen) + +### Description + +ToolJet is an open-source low-code platform for building internal tools. Prior to 3.20.180, ToolJet's render preview deployment workflow interpolates github.event.comment.body directly into a bash conditional in a run step, allowing any GitHub user who can comment on an open pull request with a deploy command to execute shell commands on the CI runner and exfiltrate deployment secrets. This issue is reported as fixed in version 3.20.180. + +### POC + +#### Reference +- https://github.com/ToolJet/ToolJet/security/advisories/GHSA-4pm2-w6g5-28mm + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-54481.md b/2026/CVE-2026-54481.md new file mode 100644 index 0000000000..ff79e08e3c --- /dev/null +++ b/2026/CVE-2026-54481.md @@ -0,0 +1,17 @@ +### [CVE-2026-54481](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-54481) +![](https://img.shields.io/static/v1?label=Product&message=Gitea%20Open%20Source%20Git%20Server&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-295&color=brightgreen) + +### Description + +Internal API HTTP client hardcodes InsecureSkipVerify:true with no config override (CWE-295) + +### POC + +#### Reference +- https://github.com/go-gitea/gitea/security/advisories/GHSA-94v3-77j7-vm48 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-54555.md b/2026/CVE-2026-54555.md new file mode 100644 index 0000000000..9c2c1691bc --- /dev/null +++ b/2026/CVE-2026-54555.md @@ -0,0 +1,17 @@ +### [CVE-2026-54555](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-54555) +![](https://img.shields.io/static/v1?label=Product&message=rtk&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=%3C%200.42.2%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-863%3A%20Incorrect%20Authorization&color=brightgreen) + +### Description + +rtk filters and compresses command outputs before they reach your LLM context. Prior to 0.42.2, the permission splitter did not conservatively split or reject several shell constructs that Bash treats as command execution boundaries or nested execution. As a result, a command beginning with an allowed prefix such as git could hide a second command behind one of these constructs. rtk rewrite returned exit code 0, causing the Claude hook to emit permissionDecision: "allow". The rewritten command still contained the hidden command, so it ran without the user confirmation or denial that the permission rules were intended to enforce. This vulnerability is fixed in 0.42.2. + +### POC + +#### Reference +- https://github.com/rtk-ai/rtk/security/advisories/GHSA-7gxq-fvfc-g327 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-54572.md b/2026/CVE-2026-54572.md new file mode 100644 index 0000000000..8a14f3e0b9 --- /dev/null +++ b/2026/CVE-2026-54572.md @@ -0,0 +1,19 @@ +### [CVE-2026-54572](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-54572) +![](https://img.shields.io/static/v1?label=Product&message=rclone&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=%3C%201.74.4%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-59%3A%20Improper%20Link%20Resolution%20Before%20File%20Access%20('Link%20Following')&color=brightgreen) + +### Description + +Rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.74.4, with -l/--links, rclone serializes symlinks as .rclonelink text objects and recreates them on a local destination without validating the target, allowing an attacker-controlled remote to plant an escaping symlink and cause a following object write to land outside the destination with attacker-chosen contents. This issue is fixed in version 1.74.4. + +### POC + +#### Reference +- https://github.com/rclone/rclone/commit/1154afebee986180b489084d38e2a0c578751498 +- https://github.com/rclone/rclone/commit/874a804f5289517defdd7de68b2a374837080265 +- https://github.com/rclone/rclone/security/advisories/GHSA-cf44-9pgv-m4xc + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-54684.md b/2026/CVE-2026-54684.md new file mode 100644 index 0000000000..16e6304931 --- /dev/null +++ b/2026/CVE-2026-54684.md @@ -0,0 +1,17 @@ +### [CVE-2026-54684](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-54684) +![](https://img.shields.io/static/v1?label=Product&message=jadx&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=%3E%3D%201.5.2%2C%20%3C%201.5.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-22%3A%20Improper%20Limitation%20of%20a%20Pathname%20to%20a%20Restricted%20Directory%20('Path%20Traversal')&color=brightgreen) + +### Description + +jadx is a Dex to Java decompiler. From 1.5.2 to 1.5.5, a malicious .xapk file can cause jadx to write attacker-controlled archive entry contents outside the intended XAPK plugin temporary unpack directory because XApkLoader resolves each entry name directly with tmpDir.resolve(fileName) after a CWD-based ZIP security check. When jadx is launched from a directory that is an ancestor of the config directory, the arbitrary write can plant a JAR in plugins/dropins, and the next jadx run loads the JAR with URLClassLoader and ServiceLoader, executing attacker-controlled plugin code. This issue is fixed in version 1.5.6. + +### POC + +#### Reference +- https://github.com/skylot/jadx/security/advisories/GHSA-gpvc-ccw7-744v + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-54696.md b/2026/CVE-2026-54696.md new file mode 100644 index 0000000000..2812def104 --- /dev/null +++ b/2026/CVE-2026-54696.md @@ -0,0 +1,19 @@ +### [CVE-2026-54696](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-54696) +![](https://img.shields.io/static/v1?label=Product&message=json&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=%3E%3D%202.9.0%2C%20%3C%202.19.9%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-122%3A%20Heap-based%20Buffer%20Overflow&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-131%3A%20Incorrect%20Calculation%20of%20Buffer%20Size&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-787%3A%20Out-of-bounds%20Write&color=brightgreen) + +### Description + +Ruby JSON is a JSON implementation for Ruby. Versions 2.9.0 through 2.19.8 are vulnerable to heap buffer overflow when the JSON generator is provided with an oversized streamed object. When streaming to an IO JSON.dump(obj, io) and JSON::State#generate(obj, io) can write past the internal JSON generator buffer when a streamed object contains anattacker-controlled string near 16 KB. Exploitation would result in a reliable process crash/denial of service. This issue has been fixed in version 2.19.9. + +### POC + +#### Reference +- https://github.com/ruby/json/security/advisories/GHSA-x2f5-4prf-w687 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-54765.md b/2026/CVE-2026-54765.md new file mode 100644 index 0000000000..3aad23da59 --- /dev/null +++ b/2026/CVE-2026-54765.md @@ -0,0 +1,18 @@ +### [CVE-2026-54765](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-54765) +![](https://img.shields.io/static/v1?label=Product&message=traefik&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=%3E%3D%203.7.0%2C%20%3C%203.7.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-284%3A%20Improper%20Access%20Control&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-863%3A%20Incorrect%20Authorization&color=brightgreen) + +### Description + +Traefik is an open source HTTP reverse proxy and load balancer. From v3.7.0 prior to v3.7.6, Traefik's Kubernetes Gateway API provider may resolve two accepted HTTPRoutes that target the same backend Service:port but configure different backendRef filters to the same child service and apply only one route's filter set to all requests reaching that backend. In Gateway deployments where backendRef filters set security-sensitive headers, such as tenant identity, authorization context, or values the backend trusts, an attacker who can create an accepted HTTPRoute sharing the same backend Service:port may cause their route's filter context to be applied to another route's requests, potentially crossing namespace boundaries when a ReferenceGrant permits cross-namespace targeting. This issue is fixed in version v3.7.6. + +### POC + +#### Reference +- https://github.com/traefik/traefik/security/advisories/GHSA-6p8f-p8j2-rqmv + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-54917.md b/2026/CVE-2026-54917.md new file mode 100644 index 0000000000..49a4a5532b --- /dev/null +++ b/2026/CVE-2026-54917.md @@ -0,0 +1,17 @@ +### [CVE-2026-54917](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-54917) +![](https://img.shields.io/static/v1?label=Product&message=seaweedfs&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=%3C%204.30%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-22%3A%20Improper%20Limitation%20of%20a%20Pathname%20to%20a%20Restricted%20Directory%20('Path%20Traversal')&color=brightgreen) + +### Description + +SeaweedFS is a distributed storage system for object storage (S3), file systems, and Iceberg tables. Prior to 4.30, the S3 API gateway and the Iceberg REST catalog gateway construct their routers with mux.NewRouter().SkipClean(true). With path cleaning disabled, a .. segment inside the URL survives routing, so a request such as `GET /bucket-A/../evil-bucket/key`, is matched as bucket=bucket-A, object=../evil-bucket/key. The captured object key is then joined into a filer path with util.JoinPath (S3) / path.Join (Iceberg), which collapse the .. server-side, so the actual read or write lands in evil-bucket. This vulnerability is fixed in 4.30. + +### POC + +#### Reference +- https://github.com/seaweedfs/seaweedfs/security/advisories/GHSA-w62w-66v9-vvgv + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-55165.md b/2026/CVE-2026-55165.md new file mode 100644 index 0000000000..ddd554f854 --- /dev/null +++ b/2026/CVE-2026-55165.md @@ -0,0 +1,17 @@ +### [CVE-2026-55165](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-55165) +![](https://img.shields.io/static/v1?label=Product&message=lemur&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=%3C%201.9.2%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-347%3A%20Improper%20Verification%20of%20Cryptographic%20Signature&color=brightgreen) + +### Description + +Lemur manages TLS certificate creation. Prior to 1.9.2, the JWT verifier in lemur/auth/service.py:130-137 used fetch_token_header to read header_data["alg"] from an unverified token and passed that attacker-controlled value to decode_with_multiple_secrets. PyJWT 2.x rejects alg=none with the configured key, so the flaw is a defense-in-depth gap rather than a direct authentication bypass in the shipped configuration. The unpinned algorithm can become exploitable after an asymmetric-signing migration through algorithm confusion, and it weakens algorithm-based anomaly detection because the token chooses the recorded value. A separate disclosure of LEMUR_TOKEN_SECRET would also permit forged HS256 tokens, although that disclosure is an independent prerequisite. The fix introduces the server-controlled LEMUR_TOKEN_ALGORITHMS allowlist and defaults it to HS256. This issue is fixed in version 1.9.2. + +### POC + +#### Reference +- https://github.com/Netflix/lemur/security/advisories/GHSA-r9gp-7f88-9r54 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-55166.md b/2026/CVE-2026-55166.md new file mode 100644 index 0000000000..809274ea23 --- /dev/null +++ b/2026/CVE-2026-55166.md @@ -0,0 +1,19 @@ +### [CVE-2026-55166](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-55166) +![](https://img.shields.io/static/v1?label=Product&message=lemur&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=%3C%201.9.2%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-285%3A%20Improper%20Authorization&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-639%3A%20Authorization%20Bypass%20Through%20User-Controlled%20Key&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-918%3A%20Server-Side%20Request%20Forgery%20(SSRF)&color=brightgreen) + +### Description + +Lemur manages TLS certificate creation. Prior to 1.9.2, authenticated users could influence an ACME authority acme_url without an effective server-side destination restriction and trigger AcmeHandler.setup_acme_client to make backend requests. An attacker could target cloud instance metadata or internal services from Lemur network context, potentially obtaining credentials available to the host. The advisory also identifies creator-equality authorization behavior that could preserve access to certificate key material after ownership or role changes, with insufficient export_private_key audit context to distinguish that access path. Together, the acme_url server-side request forgery and authorization weakness could expose cloud credentials and long-lived PKI private-key access. The fix adds ACME_DIRECTORY_HOST_ALLOWLIST validation and enriches key-export audit events with creator and current-owner context. This issue is fixed in version 1.9.2. + +### POC + +#### Reference +- https://github.com/Netflix/lemur/security/advisories/GHSA-v2wp-frmc-5q3v + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-55195.md b/2026/CVE-2026-55195.md new file mode 100644 index 0000000000..a2f79aab20 --- /dev/null +++ b/2026/CVE-2026-55195.md @@ -0,0 +1,17 @@ +### [CVE-2026-55195](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-55195) +![](https://img.shields.io/static/v1?label=Product&message=py7zr&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=%3C%201.1.3%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-409%3A%20Improper%20Handling%20of%20Highly%20Compressed%20Data%20(Data%20Amplification)&color=brightgreen) + +### Description + +py7zr is a Python-based library and utility to support 7zip archive compression, decompression, encryption and decryption. Prior to 1.1.3, py7zr's Worker.decompress() extracted archive entries without tracking total decompressed size, allowing a crafted .7z file such as a 15.6 KB archive that expands to 100 MB to exhaust disk or memory before extraction completes. This issue is fixed in version 1.1.3. + +### POC + +#### Reference +- https://github.com/miurahr/py7zr/security/advisories/GHSA-gjrg-mpp7-g774 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-55206.md b/2026/CVE-2026-55206.md new file mode 100644 index 0000000000..f0580d0dae --- /dev/null +++ b/2026/CVE-2026-55206.md @@ -0,0 +1,17 @@ +### [CVE-2026-55206](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-55206) +![](https://img.shields.io/static/v1?label=Product&message=py7zr&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=%3C%201.1.3%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-407%3A%20Inefficient%20Algorithmic%20Complexity&color=brightgreen) + +### Description + +py7zr is a Python-based library and utility to support 7zip archive compression, decompression, encryption and decryption. Prior to 1.1.3, PackInfo._read() in archiveinfo.py used an O(n^2) cumulative sum pattern for attacker-controlled numstreams values parsed from archive headers, allowing a crafted .7z archive to cause excessive CPU consumption during SevenZipFile.init() before extraction. This issue is fixed in version 1.1.3. + +### POC + +#### Reference +- https://github.com/miurahr/py7zr/security/advisories/GHSA-h4gh-22qq-72r7 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-55390.md b/2026/CVE-2026-55390.md new file mode 100644 index 0000000000..5bbfa89b54 --- /dev/null +++ b/2026/CVE-2026-55390.md @@ -0,0 +1,19 @@ +### [CVE-2026-55390](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-55390) +![](https://img.shields.io/static/v1?label=Product&message=datamodel-code-generator&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=%3E%3D%200.59.0%2C%20%3C%200.62.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-200%3A%20Exposure%20of%20Sensitive%20Information%20to%20an%20Unauthorized%20Actor&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-22%3A%20Improper%20Limitation%20of%20a%20Pathname%20to%20a%20Restricted%20Directory%20('Path%20Traversal')&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-610%3A%20Externally%20Controlled%20Reference%20to%20a%20Resource%20in%20Another%20Sphere&color=brightgreen) + +### Description + +datamodel-code-generator generates Python data models from schema definitions. From 0.59.0 until 0.62.0, XML Schema parsing in src/datamodel_code_generator/parser/xmlschema.py for --input-file-type xmlschema resolves xs:include, xs:import, xs:redefine, and xs:override schemaLocation values outside the input base path, allowing arbitrary local files to be read and reflected into generated models. This issue is fixed in version 0.62.0. + +### POC + +#### Reference +- https://github.com/koxudaxi/datamodel-code-generator/security/advisories/GHSA-442q-2j6p-642g + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-55426.md b/2026/CVE-2026-55426.md new file mode 100644 index 0000000000..19e70d93b4 --- /dev/null +++ b/2026/CVE-2026-55426.md @@ -0,0 +1,19 @@ +### [CVE-2026-55426](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-55426) +![](https://img.shields.io/static/v1?label=Product&message=lib&color=blue) +![](https://img.shields.io/static/v1?label=Product&message=monitoring-plugins&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=%3C%205.0.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=%3C%206.0.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-78%3A%20Improper%20Neutralization%20of%20Special%20Elements%20used%20in%20an%20OS%20Command%20('OS%20Command%20Injection')&color=brightgreen) + +### Description + +linuxfabrik-lib provides Python modules for database access, caching, shell execution, and API integrations, and Linuxfabrik Monitoring Plugins uses those modules to run external monitoring commands. From the earliest affected releases until linuxfabrik-lib 5.0.0 and Linuxfabrik Monitoring Plugins 6.0.0, check plugins embedded user-controlled values in command strings passed to lib.shell.shell_exec(), which split strings at pipe characters and executed the resulting commands. In check-plugins/restic-check/restic-check, the --repo parameter could inject a pipe-delimited command into a constructed restic invocation, and sudo-authorized execution allowed a compromised nagios or icinga account to run that command as root. The shared library also accepted command strings and a shell parameter, while numerous plugins constructed external commands from attacker-influenced arguments. The fixes require argv lists, always use shell=False, remove pipe splitting, and reject option-like positional values through lib.shell.safe_cli_value(). These issues are fixed in linuxfabrik-lib 5.0.0 and Linuxfabrik Monitoring Plugins 6.0.0. + +### POC + +#### Reference +- https://github.com/Linuxfabrik/monitoring-plugins/security/advisories/GHSA-798h-hpph-m24j + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-55450.md b/2026/CVE-2026-55450.md new file mode 100644 index 0000000000..0e833a3b09 --- /dev/null +++ b/2026/CVE-2026-55450.md @@ -0,0 +1,19 @@ +### [CVE-2026-55450](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-55450) +![](https://img.shields.io/static/v1?label=Product&message=langflow&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=%3C%201.9.1%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-200%3A%20Exposure%20of%20Sensitive%20Information%20to%20an%20Unauthorized%20Actor&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-306%3A%20Missing%20Authentication%20for%20Critical%20Function&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-400%3A%20Uncontrolled%20Resource%20Consumption&color=brightgreen) + +### Description + +Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.9.1, unauthenticated users can upload any amount of data to the server without any limitations. No need for any prior knowledge, only network access to Langflow. This can lead to space exhaustion on the server. In addition, in the response, the absolute path of the uploaded file is reported to the attacker, which is an information leak that can assist in chaining other primitives. This vulnerability is fixed in 1.9.1. + +### POC + +#### Reference +- https://github.com/langflow-ai/langflow/security/advisories/GHSA-x223-p2gf-v735 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-55460.md b/2026/CVE-2026-55460.md new file mode 100644 index 0000000000..1dc457bac1 --- /dev/null +++ b/2026/CVE-2026-55460.md @@ -0,0 +1,17 @@ +### [CVE-2026-55460](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-55460) +![](https://img.shields.io/static/v1?label=Product&message=snipe-it&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=%3C%208.6.2%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-863%3A%20Incorrect%20Authorization&color=brightgreen) + +### Description + +Snipe-IT is an IT asset/license management system. Prior to 8.6.2, an authenticated non-admin user with users.view and users.edit but without users.delete can directly POST to /users/bulksave with delete_user=1 because BulkUsersController::destroy() authorizes only update, allowing the user to soft-delete another non-admin user. This issue is fixed in version 8.6.2. + +### POC + +#### Reference +- https://github.com/grokability/snipe-it/security/advisories/GHSA-vgx7-c78r-69w9 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-55462.md b/2026/CVE-2026-55462.md new file mode 100644 index 0000000000..757cb1a636 --- /dev/null +++ b/2026/CVE-2026-55462.md @@ -0,0 +1,17 @@ +### [CVE-2026-55462](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-55462) +![](https://img.shields.io/static/v1?label=Product&message=snipe-it&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=%3C%208.6.2%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-863%3A%20Incorrect%20Authorization&color=brightgreen) + +### Description + +Snipe-IT is an IT asset/license management system. Prior to 8.6.2, UsersController::show() and printInventory() authorize only user viewing before loading and rendering assigned license, accessory, and consumable relationships, allowing an authenticated user with only users.view to see inventory and cost/order metadata from modules that direct permissions would otherwise deny. This issue is fixed in version 8.6.2. + +### POC + +#### Reference +- https://github.com/grokability/snipe-it/security/advisories/GHSA-fc33-6w3q-538h + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-55470.md b/2026/CVE-2026-55470.md new file mode 100644 index 0000000000..c758389435 --- /dev/null +++ b/2026/CVE-2026-55470.md @@ -0,0 +1,17 @@ +### [CVE-2026-55470](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-55470) +![](https://img.shields.io/static/v1?label=Product&message=org.hl7.fhir.core&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=%3C%206.9.10%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-1333%3A%20Inefficient%20Regular%20Expression%20Complexity&color=brightgreen) + +### Description + +HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to 6.9.10, the fix for CVE-2026-45367 incompletely patched the DSTU2 module, leaving FHIRPathEngine.matches() in org.hl7.fhir.dstu2/utils/FHIRPathEngine.java to call raw String.matches(sw) without RegexTimeout protection while replaceMatches() was updated, allowing an unauthenticated attacker to trigger catastrophic regex backtracking and exhaust server CPU. This issue is fixed in version 6.9.10. + +### POC + +#### Reference +- https://github.com/hapifhir/org.hl7.fhir.core/security/advisories/GHSA-fxj4-p9xp-37v5 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-55477.md b/2026/CVE-2026-55477.md new file mode 100644 index 0000000000..9c0222ac03 --- /dev/null +++ b/2026/CVE-2026-55477.md @@ -0,0 +1,17 @@ +### [CVE-2026-55477](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-55477) +![](https://img.shields.io/static/v1?label=Product&message=3x-ui&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=%3C%203.3.1%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-73%3A%20External%20Control%20of%20File%20Name%20or%20Path&color=brightgreen) + +### Description + +3X-UI is a web control panel for managing Xray-core servers. Prior to 3.3.1, an authenticated administrator can abuse the database import functionality to achieve arbitrary file write on the host by modifying Xray configuration values stored in the database. This can be leveraged to obtain code execution and persistent access as the user running Xray (including root when Xray is running as root). This vulnerability is fixed in 3.3.1. + +### POC + +#### Reference +- https://github.com/MHSanaei/3x-ui/security/advisories/GHSA-jm48-m3rr-9hgg + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-55524.md b/2026/CVE-2026-55524.md new file mode 100644 index 0000000000..250033be45 --- /dev/null +++ b/2026/CVE-2026-55524.md @@ -0,0 +1,18 @@ +### [CVE-2026-55524](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-55524) +![](https://img.shields.io/static/v1?label=Product&message=PraisonAI&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=%3C%201.6.58%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-367%3A%20Time-of-check%20Time-of-use%20(TOCTOU)%20Race%20Condition&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-918%3A%20Server-Side%20Request%20Forgery%20(SSRF)&color=brightgreen) + +### Description + +PraisonAI is a multi-agent teams system. In versions prior to 1.6.58, the web_crawl tool performs its SSRF check only on the initially supplied URL, allowing the protection to be bypassed so the tool connects to attacker-chosen internal destinations. The check resolves the hostname once with socket.gethostbyname and rejects private/loopback/link-local results, but then passes the URL to a fetcher using httpx.Client(follow_redirects=True) (or urllib.request.urlopen when httpx is absent, which also follows redirects) that re-resolves the hostname at connect time with no further validation. This validate-here/fetch-there gap is exploitable through both HTTP redirects and DNS rebinding. If an attacker can influence URLs passed to web_crawl(), directly or through an agent/tool workflow, they can cause the PraisonAI host to fetch loopback, private-network, or cloud metadata endpoints reachable from that host, with the response body returned in the web_crawl() result. This issue has been fixed in version 1.6.58. + +### POC + +#### Reference +- https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-vg6p-v9vm-6fgj + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-55548.md b/2026/CVE-2026-55548.md new file mode 100644 index 0000000000..33d3a46daa --- /dev/null +++ b/2026/CVE-2026-55548.md @@ -0,0 +1,19 @@ +### [CVE-2026-55548](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-55548) +![](https://img.shields.io/static/v1?label=Product&message=yamcs&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=%3C%205.12.8%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=%3E%3D%205.13.0%2C%20%3C%205.13.2%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-284%3A%20Improper%20Access%20Control&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-862%3A%20Missing%20Authorization&color=brightgreen) + +### Description + +Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, the PacketsApi.exportPackets endpoint in yamcs-core/src/main/java/org/yamcs/http/api/PacketsApi.java failed to enforce object-level ReadPacket privileges when a request omitted specific packet names: with an empty name list the ctx.checkObjectPrivileges(ObjectPrivilegeType.ReadPacket, nameSet) call passed over an empty set, no WHERE pname IN filter was applied to the resulting SELECT * FROM tm query, and the onTuple handler streamed every retrieved packet without any per-row authorization check, so a low-privileged or zero-privilege authenticated user could dump the entire raw telemetry packet archive and bypass the role-based access control model. This issue is fixed in versions 5.12.8 and 5.13.2, which enforce per-packet ReadPacket checks in exportPackets. + +### POC + +#### Reference +- https://github.com/yamcs/yamcs/security/advisories/GHSA-8xjq-pr36-ccgf + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-55593.md b/2026/CVE-2026-55593.md new file mode 100644 index 0000000000..e0421d3889 --- /dev/null +++ b/2026/CVE-2026-55593.md @@ -0,0 +1,17 @@ +### [CVE-2026-55593](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-55593) +![](https://img.shields.io/static/v1?label=Product&message=froxlor&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=%3C%202.3.8%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-352%3A%20Cross-Site%20Request%20Forgery%20(CSRF)&color=brightgreen) + +### Description + +Froxlor is open source server administration software. Prior to 2.3.8, the standalone lib/ajax.php entry point bypasses the centralized request validation in lib/init.php, and Ajax::handle in lib/Froxlor/Ajax/Ajax.php checks only for a valid session before routing state-changing requests. The editapikey action in Ajax::editApiKey updates allowed_from and valid_until without validating a CSRF token, while templates/Froxlor/assets/js/jquery/apikeys.js sends no token because the endpoint does not require one. An unauthenticated attacker can induce an authenticated administrator's browser to submit a forged request that adds an attacker-controlled address to an API key's allowed_from list or removes its expiration, weakening the key's security restrictions. This issue is fixed in version 2.3.8. + +### POC + +#### Reference +- https://github.com/froxlor/froxlor/security/advisories/GHSA-xpr4-8vp6-c87j + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-55651.md b/2026/CVE-2026-55651.md new file mode 100644 index 0000000000..7c9dece7a3 --- /dev/null +++ b/2026/CVE-2026-55651.md @@ -0,0 +1,17 @@ +### [CVE-2026-55651](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-55651) +![](https://img.shields.io/static/v1?label=Product&message=easyappointments&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=%3D%201.5.2%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-200%3A%20Exposure%20of%20Sensitive%20Information%20to%20an%20Unauthorized%20Actor&color=brightgreen) + +### Description + +Easy!Appointments is a self hosted appointment scheduler. In version 1.5.2, an Excessive Data Exposure vulnerability in the customers search endpoint allows an authenticated user to obtain appointment hashes belonging to other users.Using these hashes, an attacker can modify or delete appointments of other providers, resulting in an Appointments Takeover. Version 1.6.0 fixes the issue. + +### POC + +#### Reference +- https://github.com/alextselegidis/easyappointments/security/advisories/GHSA-4vmm-5qvc-w5p7 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-55833.md b/2026/CVE-2026-55833.md new file mode 100644 index 0000000000..c00ec53751 --- /dev/null +++ b/2026/CVE-2026-55833.md @@ -0,0 +1,18 @@ +### [CVE-2026-55833](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-55833) +![](https://img.shields.io/static/v1?label=Product&message=netty&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=%3E%3D%204.1.0.Final%2C%20%3C%204.1.136.Final%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=%3E%3D%204.2.0.Final%2C%20%3C%204.2.16.Final%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-400%3A%20Uncontrolled%20Resource%20Consumption&color=brightgreen) + +### Description + +Netty is a network application framework for development of protocol servers and clients. Prior to 4.1.136.Final and 4.2.16.Final, Netty SPDY header decoding continues inflating zlib-compressed header blocks after the raw header parser has exceeded `maxHeaderSize` and marked the frame truncated in `SpdyFrameCodec`, allowing a remote peer to send a small compressed `HEADERS` block that expands into much larger raw header data and causes compression-amplified CPU and allocation churn. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final. + +### POC + +#### Reference +- https://github.com/netty/netty/security/advisories/GHSA-mvh2-crg5-v77c + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-55886.md b/2026/CVE-2026-55886.md new file mode 100644 index 0000000000..028481606b --- /dev/null +++ b/2026/CVE-2026-55886.md @@ -0,0 +1,17 @@ +### [CVE-2026-55886](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-55886) +![](https://img.shields.io/static/v1?label=Product&message=jodit&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=%3C%204.12.26%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-1321%3A%20Improperly%20Controlled%20Modification%20of%20Object%20Prototype%20Attributes%20('Prototype%20Pollution')&color=brightgreen) + +### Description + +Jodit Editor is a WYSIWYG editor with written in pure TypeScript file and image editing capabilities. Versions prior to 4.12.26 are vulnerable to Prototype Pollution through Jodit.modules.Helpers.set(chain, value, obj), which walks the dot-separated chain, creating and following each path segment without filtering prototype-mutating keys. A chain that begins with (or contains) __proto__, constructor, or prototype lets the final assignment reach and mutate Object.prototype. Applications that pass a user-controlled or partially user-controlled key path into Jodit.modules.Helpers.set() could be vulnerable, causing unexpected property injection, logic bypass, denial of service, or secondary security issues. This issue has been fixed in version 4.12.26. + +### POC + +#### Reference +- https://github.com/xdan/jodit/security/advisories/GHSA-vpmm-x3fm-qr5c + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-57157.md b/2026/CVE-2026-57157.md new file mode 100644 index 0000000000..61a2f9392d --- /dev/null +++ b/2026/CVE-2026-57157.md @@ -0,0 +1,17 @@ +### [CVE-2026-57157](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-57157) +![](https://img.shields.io/static/v1?label=Product&message=FreeRDP&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=%3C%203.28.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-125%3A%20Out-of-bounds%20Read&color=brightgreen) + +### Description + +FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.28.0, FreeRDP server implementations with the MS-RDPECAM camera device enumerator channel enabled scan attacker-supplied DeviceName and VirtualChannelName fields for a NUL terminator in channels/rdpecam/server/camera_device_enumerator_main.c and then dereference once past the scan bound, allowing a malicious RDP client to trigger a 1- to 2-byte out-of-bounds heap read. This issue is fixed in version 3.28.0. + +### POC + +#### Reference +- https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-47fr-jw86-c3fj + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-57158.md b/2026/CVE-2026-57158.md new file mode 100644 index 0000000000..5bd28ecb57 --- /dev/null +++ b/2026/CVE-2026-57158.md @@ -0,0 +1,17 @@ +### [CVE-2026-57158](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-57158) +![](https://img.shields.io/static/v1?label=Product&message=FreeRDP&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=%3E%3D%203.21.0%2C%20%3C%203.28.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-125%3A%20Out-of-bounds%20Read&color=brightgreen) + +### Description + +FreeRDP is a free implementation of the Remote Desktop Protocol. From 3.21.0 before 3.28.0, FreeRDP clients using the GFX pipeline contain an incomplete fix for CVE-2026-23530 in planar_decompress_plane_rle_only in libfreerdp/codec/planar.c, allowing a malicious RDP server to send a truncated RDPGFX_CMDID_WIRETOSURFACE_1 planar payload that reads one byte past the input buffer. This issue is fixed in version 3.28.0. + +### POC + +#### Reference +- https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-mp3f-59pg-c5pp + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-57218.md b/2026/CVE-2026-57218.md new file mode 100644 index 0000000000..9b12ac6f63 --- /dev/null +++ b/2026/CVE-2026-57218.md @@ -0,0 +1,17 @@ +### [CVE-2026-57218](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-57218) +![](https://img.shields.io/static/v1?label=Product&message=rabbitmq-server&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=%3E%3D%204.2.0%2C%20%3C%204.2.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-863%3A%20Incorrect%20Authorization&color=brightgreen) + +### Description + +RabbitMQ is a messaging and streaming broker. Prior to 4.2.6, RabbitMQ AMQP 0-9-1 allows an existing consumer to keep receiving messages after OAuth token expiry or connection.update_secret refresh to reduced scopes because existing consumers are not canceled or reauthorized at delivery time after the channel user state changes. This issue is fixed in version 4.2.6. + +### POC + +#### Reference +- https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-wmrr-4h5v-5ch7 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-57233.md b/2026/CVE-2026-57233.md new file mode 100644 index 0000000000..800f86a987 --- /dev/null +++ b/2026/CVE-2026-57233.md @@ -0,0 +1,17 @@ +### [CVE-2026-57233](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-57233) +![](https://img.shields.io/static/v1?label=Product&message=notepad-plus-plus&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=%3C%208.9.7%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-22%3A%20Improper%20Limitation%20of%20a%20Pathname%20to%20a%20Restricted%20Directory%20('Path%20Traversal')&color=brightgreen) + +### Description + +Notepad++ is a free and open-source source code editor. Prior to 8.9.7, the WinGup decompress function joins untrusted ZIP entry names to unzipDestTo without canonical containment validation, allowing an entry such as ../mimeTools/mimeTools.dll to overwrite a DLL in a sibling plugin directory and execute attacker-controlled code when Notepad++ next loads that plugin. This issue is fixed in version 8.9.7. + +### POC + +#### Reference +- https://github.com/notepad-plus-plus/notepad-plus-plus/security/advisories/GHSA-hjxw-84rf-wg5r + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-57439.md b/2026/CVE-2026-57439.md new file mode 100644 index 0000000000..37d6f58825 --- /dev/null +++ b/2026/CVE-2026-57439.md @@ -0,0 +1,19 @@ +### [CVE-2026-57439](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-57439) +![](https://img.shields.io/static/v1?label=Product&message=CyberChef&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=%3C%2011.2.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-1321%3A%20Improperly%20Controlled%20Modification%20of%20Object%20Prototype%20Attributes%20('Prototype%20Pollution')&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-79%3A%20Improper%20Neutralization%20of%20Input%20During%20Web%20Page%20Generation%20('Cross-site%20Scripting')&color=brightgreen) + +### Description + +CyberChef is a web app for encryption, encoding, compression, and data analysis. Prior to 11.2.0, the Series Chart operation accepts __proto__ as a key while parsing user-supplied CSV, allowing prototype pollution that can be chained with operations such as Parse UDP to inject malicious JavaScript into HTML output. This issue is fixed in version 11.2.0. + +### POC + +#### Reference +- https://github.com/gchq/CyberChef/issues/2568 +- https://github.com/gchq/CyberChef/security/advisories/GHSA-fx6f-382r-j72c + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-57485.md b/2026/CVE-2026-57485.md new file mode 100644 index 0000000000..2077c1b002 --- /dev/null +++ b/2026/CVE-2026-57485.md @@ -0,0 +1,18 @@ +### [CVE-2026-57485](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-57485) +![](https://img.shields.io/static/v1?label=Product&message=Stirling-PDF&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=%3C%202.9.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-200%3A%20Exposure%20of%20Sensitive%20Information%20to%20an%20Unauthorized%20Actor&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-522%3A%20Insufficiently%20Protected%20Credentials&color=brightgreen) + +### Description + +Stirling-PDF is a locally hosted web application that facilitates various operations on PDF files. Prior to 2.9.0, the /api/v1/pipeline/handleData endpoint in app/core/src/main/java/stirling/software/SPDF/controller/api/pipeline/PipelineProcessor.java injects the STIRLING-PDF-BACKEND-API-USER API key into pipeline subrequests, allowing an authenticated ROLE_USER to retrieve the key through /api/v1/user/get-api-key, impersonate the internal service account, bypass normal rate limits, and access internal endpoints including /api/v1/info/requests/all and /api/v1/info/load/all. This issue is fixed in version 2.9.0. + +### POC + +#### Reference +- https://github.com/Stirling-Tools/Stirling-PDF/security/advisories/GHSA-3xxh-mm3g-c9w5 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-57516.md b/2026/CVE-2026-57516.md new file mode 100644 index 0000000000..e8662c1573 --- /dev/null +++ b/2026/CVE-2026-57516.md @@ -0,0 +1,17 @@ +### [CVE-2026-57516](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-57516) +![](https://img.shields.io/static/v1?label=Product&message=Ray&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Deserialization%20of%20Untrusted%20Data&color=brightgreen) + +### Description + +Ray prior to 2.56.0 contains an unsafe deserialization vulnerability in the WebDataset reader that allows attackers to achieve remote code execution by supplying a malicious tar archive to the read_webdataset() function. The _default_decoder() function in webdataset_datasource.py unconditionally calls pickle.loads() on tar entries with .pkl/.pickle extensions and torch.load() with weights_only=False on .pt/.pth entries, executing arbitrary code inside Ray remote workers on every worker that processes the malicious archive. + +### POC + +#### Reference +- https://github.com/ray-project/ray/security/advisories/GHSA-hhrp-gw25-jr43 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-57573.md b/2026/CVE-2026-57573.md new file mode 100644 index 0000000000..660132f756 --- /dev/null +++ b/2026/CVE-2026-57573.md @@ -0,0 +1,17 @@ +### [CVE-2026-57573](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-57573) +![](https://img.shields.io/static/v1?label=Product&message=crawl4ai&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=%3C%200.9.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-918%3A%20Server-Side%20Request%20Forgery%20(SSRF)&color=brightgreen) + +### Description + +Crawl4AI is an open-source LLM-friendly web crawler and scraper. Prior to 0.9.0, the Docker API server applied its SSRF destination check on the non-streaming /crawl path but not on the streaming path. handle_stream_crawl_request passed seed URLs straight to the crawler with no destination validation, allowing a remote unauthenticated client to call POST /crawl/stream or POST /crawl with crawler_config.stream=true with a URL pointing at an internal, private, or link-local address; the server fetched it and streamed the response body back. This issue is fixed in version 0.9.0. + +### POC + +#### Reference +- https://github.com/unclecode/crawl4ai/security/advisories/GHSA-wm69-2pc3-rmmf + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-57850.md b/2026/CVE-2026-57850.md index 1629ddc6f8..43adec903d 100644 --- a/2026/CVE-2026-57850.md +++ b/2026/CVE-2026-57850.md @@ -10,6 +10,7 @@ RustDesk before 1.4.9 does not enforce a session's authorized connection scope o ### POC #### Reference +- https://github.com/sn0x-sharma/CVE-2026-57850 - https://www.vulncheck.com/advisories/rustdesk-missing-session-scope-enforcement-allows-out-of-scope-control-message-injection #### Github diff --git a/2026/CVE-2026-57859.md b/2026/CVE-2026-57859.md new file mode 100644 index 0000000000..d9ca1b4f5c --- /dev/null +++ b/2026/CVE-2026-57859.md @@ -0,0 +1,18 @@ +### [CVE-2026-57859](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-57859) +![](https://img.shields.io/static/v1?label=Product&message=e107&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Deserialization%20of%20Untrusted%20Data&color=brightgreen) + +### Description + +e107 prior to version 2.3.8 contains a code execution vulnerability in the e_array deserialization handler that allows an attacker with out-of-band database write access to execute arbitrary PHP code by storing a crafted payload in the user_prefs column. The e_array::unserialize() function in e107_handlers/core_functions.php performs only a prefix check for the string 'array' before passing the stored value to eval(), causing automatic PHP execution whenever the affected user's preferences are materialized through e_user_pref::load(). + +### POC + +#### Reference +- https://github.com/e107inc/e107/security/advisories/GHSA-568x-w5qj-vr7c + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-57862.md b/2026/CVE-2026-57862.md new file mode 100644 index 0000000000..6987e2e207 --- /dev/null +++ b/2026/CVE-2026-57862.md @@ -0,0 +1,17 @@ +### [CVE-2026-57862](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-57862) +![](https://img.shields.io/static/v1?label=Product&message=Kanboard&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Server-Side%20Request%20Forgery%20(SSRF)&color=brightgreen) + +### Description + +Kanboard 1.2.52 and prior contains a server-side request forgery vulnerability that allows authenticated users to bypass SSRF protections by supplying hexadecimal IP address notation in user-controlled URLs. Attackers can submit hexadecimal-encoded internal IP addresses through the web link creation feature, causing cURL to resolve and connect to internal network resources such as cloud instance metadata services, localhost services, and RFC1918 addresses while the isPrivateURL() filter in app/Core/Http/Client.php incorrectly treats the input as safe due to FILTER_VALIDATE_IP rejecting non-dotted-decimal notation. + +### POC + +#### Reference +- https://gist.github.com/sermikr0/67c8acfc395e465127e729dc309da3ae + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-57894.md b/2026/CVE-2026-57894.md new file mode 100644 index 0000000000..c8dc469b9f --- /dev/null +++ b/2026/CVE-2026-57894.md @@ -0,0 +1,17 @@ +### [CVE-2026-57894](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-57894) +![](https://img.shields.io/static/v1?label=Product&message=Gitea%20Open%20Source%20Git%20Server&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-918&color=brightgreen) + +### Description + +Repository Migration Follows Git HTTP Redirects After URL Allow/Block Validation, Enabling Internal Git Repository Exfiltration + +### POC + +#### Reference +- https://github.com/go-gitea/gitea/security/advisories/GHSA-82f7-87hm-852x + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-57942.md b/2026/CVE-2026-57942.md new file mode 100644 index 0000000000..663a1f164d --- /dev/null +++ b/2026/CVE-2026-57942.md @@ -0,0 +1,18 @@ +### [CVE-2026-57942](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-57942) +![](https://img.shields.io/static/v1?label=Product&message=LibreTranslate&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Use%20of%20Less%20Trusted%20Source&color=brightgreen) + +### Description + +LibreTranslate through 1.9.7, fixed in commit 397fd22, contains an IP spoofing vulnerability in the get_remote_address() function that allows unauthenticated attackers to spoof client IP addresses by injecting arbitrary values into the X-Forwarded-For header without trusted proxy validation. Attackers can bypass per-IP rate limiting and flood bans by supplying forged addresses in the X-Forwarded-For header to enable unlimited API abuse. + +### POC + +#### Reference +- https://github.com/LibreTranslate/LibreTranslate/issues/986 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-57947.md b/2026/CVE-2026-57947.md new file mode 100644 index 0000000000..1b620d962f --- /dev/null +++ b/2026/CVE-2026-57947.md @@ -0,0 +1,17 @@ +### [CVE-2026-57947](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-57947) +![](https://img.shields.io/static/v1?label=Product&message=pinpoint&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Server-Side%20Request%20Forgery%20(SSRF)&color=brightgreen) + +### Description + +Pinpoint through 3.1.0 contains a server-side request forgery vulnerability in the webhook registration endpoint that allows authenticated users to register internal URLs due to missing SSRF protection. Attackers can trigger alarm threshold breaches to force the server to issue POST requests to internal hosts and metadata endpoints, enabling unauthorized access to internal network resources. + +### POC + +#### Reference +- https://github.com/pinpoint-apm/pinpoint/issues/13857 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-57951.md b/2026/CVE-2026-57951.md new file mode 100644 index 0000000000..c9cf7c06dd --- /dev/null +++ b/2026/CVE-2026-57951.md @@ -0,0 +1,17 @@ +### [CVE-2026-57951](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-57951) +![](https://img.shields.io/static/v1?label=Product&message=Mythic&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Incorrect%20Authorization&color=brightgreen) + +### Description + +Mythic before 3.4.0.60 contains a broken hasura permission filter on the payload_build_step table with an always-satisfied _or condition that bypasses operation-scoped access controls. Authenticated operators and spectators can query payload_build_step to read step_stdout, step_stderr, step_name, and step_description across all operations on the server. + +### POC + +#### Reference +- https://github.com/its-a-feature/Mythic/issues/563 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-57958.md b/2026/CVE-2026-57958.md new file mode 100644 index 0000000000..31dce4c936 --- /dev/null +++ b/2026/CVE-2026-57958.md @@ -0,0 +1,17 @@ +### [CVE-2026-57958](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-57958) +![](https://img.shields.io/static/v1?label=Product&message=mixpost&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Improper%20Neutralization%20of%20Input%20During%20Web%20Page%20Generation%20('Cross-site%20Scripting')&color=brightgreen) + +### Description + +Mixpost through 2.6.0 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to execute arbitrary JavaScript in authenticated users' browsers by crafting malicious OAuth callback URLs with unsanitized error query parameters. Attackers can exploit the OAuth callback controller's failure to sanitize error parameters before rendering them through Laravel flash messages via the Vue v-html directive to hijack authenticated user sessions or perform unauthorized actions. + +### POC + +#### Reference +- https://github.com/inovector/mixpost/issues/204 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-57961.md b/2026/CVE-2026-57961.md new file mode 100644 index 0000000000..fbed0e1b1d --- /dev/null +++ b/2026/CVE-2026-57961.md @@ -0,0 +1,18 @@ +### [CVE-2026-57961](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-57961) +![](https://img.shields.io/static/v1?label=Product&message=phpMyFAQ&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Improper%20Limitation%20of%20a%20Pathname%20to%20a%20Restricted%20Directory%20('Path%20Traversal')&color=brightgreen) + +### Description + +phpMyFAQ before 4.1.5 contains a potential authenticated path traversal vulnerability in the concatenatePaths() function within src/phpMyFAQ/Export/Pdf/Wrapper.php. A user with FAQ editing privileges can store HTML containing crafted image paths that are processed during PDF generation. The path resolution logic locates the substring "content" within a user-controlled path using strpos(); when "content" is absent, strpos() returns false, which becomes 0 when cast to an integer, preserving the entire attacker-controlled path. This path is later passed to file_get_contents() without canonicalization or root-directory containment validation, which may allow reading of files outside the intended content directory. + +### POC + +#### Reference +- https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-88g4-74f3-63x9 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-57997.md b/2026/CVE-2026-57997.md new file mode 100644 index 0000000000..586b00c033 --- /dev/null +++ b/2026/CVE-2026-57997.md @@ -0,0 +1,17 @@ +### [CVE-2026-57997](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-57997) +![](https://img.shields.io/static/v1?label=Product&message=strapi&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Use%20of%20a%20Broken%20or%20Risky%20Cryptographic%20Algorithm&color=brightgreen) + +### Description + +Strapi users-permissions plugin fails to restrict JWT algorithms when plugin::users-permissions.jwt.algorithm is not explicitly configured, allowing acceptance of HS384 and HS512 tokens alongside HS256. Attackers possessing the jwtSecret can mint tokens with non-standard HMAC variants to bypass algorithm restrictions and weaken authentication controls. + +### POC + +#### Reference +- https://github.com/strapi/strapi/issues/26587 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-57999.md b/2026/CVE-2026-57999.md new file mode 100644 index 0000000000..dae4544408 --- /dev/null +++ b/2026/CVE-2026-57999.md @@ -0,0 +1,17 @@ +### [CVE-2026-57999](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-57999) +![](https://img.shields.io/static/v1?label=Product&message=luci-app-tailscale-community&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Improper%20Neutralization%20of%20Special%20Elements%20used%20in%20an%20OS%20Command%20('OS%20Command%20Injection')&color=brightgreen) + +### Description + +luci-app-tailscale-community contains a command injection vulnerability in the tailscale.do_login RPC method that allows authenticated users to execute arbitrary commands as root. The vulnerability exists because user-controlled loginserver and loginserver_authkey parameters are improperly quoted within a double-quoted shell command, allowing shell substitutions like $() to be evaluated by the outer shell before argument processing. + +### POC + +#### Reference +- https://github.com/openwrt/luci/security/advisories/GHSA-xwc5-mx58-rh35 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-58372.md b/2026/CVE-2026-58372.md index 23e7a13b4d..eab1cbbfd0 100644 --- a/2026/CVE-2026-58372.md +++ b/2026/CVE-2026-58372.md @@ -11,6 +11,7 @@ SeaweedFS before 4.34 contains a path traversal vulnerability in the S3 gateway #### Reference - https://github.com/geo-chen/oss/blob/main/seaweedfs.md +- https://github.com/seaweedfs/seaweedfs/security/advisories/GHSA-w62w-66v9-vvgv #### Github No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-62184.md b/2026/CVE-2026-62184.md new file mode 100644 index 0000000000..a67a994598 --- /dev/null +++ b/2026/CVE-2026-62184.md @@ -0,0 +1,18 @@ +### [CVE-2026-62184](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-62184) +![](https://img.shields.io/static/v1?label=Product&message=luci-app-banip&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Improper%20Encoding%20or%20Escaping%20of%20Output&color=brightgreen) + +### Description + +luci-app-banip contains a log parsing vulnerability where the awk-based parser extracts the first IPv4 address from log lines regardless of field position, allowing attackers to inject arbitrary IPs via attacker-controlled fields like usernames. An unauthenticated remote attacker can inject an IP address into the login username field, causing banIP to block the wrong target while the real attacker remains unblocked. + +### POC + +#### Reference +- https://github.com/openwrt/luci/security/advisories/GHSA-r6hx-4f83-vp8m + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-62239.md b/2026/CVE-2026-62239.md new file mode 100644 index 0000000000..a336830025 --- /dev/null +++ b/2026/CVE-2026-62239.md @@ -0,0 +1,18 @@ +### [CVE-2026-62239](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-62239) +![](https://img.shields.io/static/v1?label=Product&message=flash-attention&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Improper%20Link%20Resolution%20Before%20File%20Access%20('Link%20Following')&color=brightgreen) + +### Description + +FlashAttention through 2.8.3.post1, fixed in commit 0816ef1, contains a symlink attack vulnerability in the download_and_copy() function within hopper/setup.py that extracts NVIDIA toolchain archives without validating symlinks or filtering tar members. A local attacker can pre-plant a symlink in the predictable cache directory to redirect extracted binaries to an attacker-chosen location, enabling arbitrary file write with victim privileges during build time. + +### POC + +#### Reference +- https://github.com/Dao-AILab/flash-attention/issues/2637 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-62240.md b/2026/CVE-2026-62240.md new file mode 100644 index 0000000000..c6a41161a7 --- /dev/null +++ b/2026/CVE-2026-62240.md @@ -0,0 +1,17 @@ +### [CVE-2026-62240](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-62240) +![](https://img.shields.io/static/v1?label=Product&message=crewAI&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Server-Side%20Request%20Forgery%20(SSRF)&color=brightgreen) + +### Description + +CrewAI before 1.15.1 contains a server-side request forgery vulnerability in the validate_url function that performs one-shot DNS resolution and blocklist checks before returning the original URL unchanged. Attackers can bypass the security filter by supplying URLs that redirect to internal addresses or use DNS rebinding techniques to access internal services and cloud metadata endpoints. + +### POC + +#### Reference +- https://github.com/crewAIInc/crewAI/issues/6520 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-62241.md b/2026/CVE-2026-62241.md new file mode 100644 index 0000000000..0ab92aa7ca --- /dev/null +++ b/2026/CVE-2026-62241.md @@ -0,0 +1,19 @@ +### [CVE-2026-62241](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-62241) +![](https://img.shields.io/static/v1?label=Product&message=clawvet&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Missing%20Authentication%20for%20Critical%20Function&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Use%20of%20Hard-coded%20Cryptographic%20Key&color=brightgreen) + +### Description + +clawvet self-hosted API server (apps/api) before 0.7.5 hard-codes a fallback JWT secret ('clawvet-dev-secret-change-me') in auth.ts and ships it as the default in .env.example. Because GET /api/v1/scans returns scan records containing userId values without authentication, a remote unauthenticated attacker can harvest a victim's userId, forge a valid HS256 cg_session cookie offline using the known secret, and call GET /api/v1/auth/me to obtain the victim's email address, subscription plan, and secret apiKey. The published clawvet npm package (CLI only) is not affected. + +### POC + +#### Reference +- https://github.com/MohibShaikh/clawvet/security/advisories/GHSA-9mww-p953-jfc9 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-62246.md b/2026/CVE-2026-62246.md new file mode 100644 index 0000000000..94035a9a7c --- /dev/null +++ b/2026/CVE-2026-62246.md @@ -0,0 +1,18 @@ +### [CVE-2026-62246](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-62246) +![](https://img.shields.io/static/v1?label=Product&message=kamaji&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=%3C%2026.7.4-edge%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-284%3A%20Improper%20Access%20Control&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-653%3A%20Improper%20Isolation%20or%20Compartmentalization&color=brightgreen) + +### Description + +Kamaji is the Hosted Control Plane Manager for Kubernetes. Prior to 26.7.4-edge, Kamaji derives a TenantControlPlane datastore schema, database user, and etcd key prefix from a lossy namespace-and-name normalization in GetDefaultDatastoreSchema() and GetDefaultDatastoreUsername(), allowing distinct tenants with colliding normalized identifiers to share control-plane state and read, modify, or destroy another tenant's Kubernetes data. This issue is fixed in version 26.7.4-edge. + +### POC + +#### Reference +- https://github.com/clastix/kamaji/security/advisories/GHSA-4f3f-65vx-r34f + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-62290.md b/2026/CVE-2026-62290.md new file mode 100644 index 0000000000..57d3464628 --- /dev/null +++ b/2026/CVE-2026-62290.md @@ -0,0 +1,18 @@ +### [CVE-2026-62290](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-62290) +![](https://img.shields.io/static/v1?label=Product&message=cert-manager&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=%3E%3D%201.18.0%2C%20%3C%201.19.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=%3E%3D%201.20.0%2C%20%3C%201.20.3%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-863%3A%20Incorrect%20Authorization&color=brightgreen) + +### Description + +cert-manager adds certificates and certificate issuers as resource types in Kubernetes clusters, and simplifies the process of obtaining, renewing and using those certificates. From 1.18.0 until 1.19.6 and 1.20.3, Challenge resources under acme.cert-manager.io can be created directly by namespace users without admission validation tying the Challenge to an Order, owner reference, or Issuer-selected solver, allowing attacker-controlled Challenge.spec.solver values referencing a ClusterIssuer to bypass DNS01 solver selectors such as dnsZones, dnsNames, and matchLabels and cause cert-manager to use ClusterIssuer DNS credentials for attacker-selected provider settings and DNS names, including disclosure of X-Api-User and X-Api-Key headers for acme-dns. This issue is fixed in versions 1.19.6 and 1.20.3. + +### POC + +#### Reference +- https://github.com/cert-manager/cert-manager/security/advisories/GHSA-8rvj-mm4h-c258 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-62291.md b/2026/CVE-2026-62291.md new file mode 100644 index 0000000000..44f95575c7 --- /dev/null +++ b/2026/CVE-2026-62291.md @@ -0,0 +1,18 @@ +### [CVE-2026-62291](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-62291) +![](https://img.shields.io/static/v1?label=Product&message=libheif&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=%3C%201.23.1%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-125%3A%20Out-of-bounds%20Read&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-787%3A%20Out-of-bounds%20Write&color=brightgreen) + +### Description + +libheif is a HEIF and AVIF file format decoder and encoder. In 1.23.0 and earlier, a crafted image sequence with a 2x2 primary plane and a 256x256 auxiliary alpha plane can cause attacker-controlled heap corruption during a normal decode and re-encode workflow. Track_Visual::decode_next_image_sample() calls transfer_channel_from_image_as() without checking that the auxiliary alpha dimensions match the main frame. The resulting inconsistent image reaches heif_track_decode_next_image() and then heif_context_encode_image(). In unc_encoder::encode(), unc_encoder_component_interleave::encode_tile() sizes its buffer with compute_tile_data_size_bytes() using the primary dimensions but copies each component using its actual plane dimensions. The oversized alpha plane is therefore copied beyond the allocation, causing an out-of-bounds write; the inverse size mismatch can also produce an out-of-bounds read. This issue is fixed in version 1.23.1. + +### POC + +#### Reference +- https://github.com/strukturag/libheif/security/advisories/GHSA-xpw3-9rhw-482x + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-62292.md b/2026/CVE-2026-62292.md new file mode 100644 index 0000000000..92854a812e --- /dev/null +++ b/2026/CVE-2026-62292.md @@ -0,0 +1,17 @@ +### [CVE-2026-62292](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-62292) +![](https://img.shields.io/static/v1?label=Product&message=libheif&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=%3E%3D%201.19.0%2C%20%3C%201.23.1%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-125%3A%20Out-of-bounds%20Read&color=brightgreen) + +### Description + +libheif is a HEIF and AVIF file format decoder and encoder. From 1.19.0 until 1.23.1, a crafted uncompressed HEIF image using generic zlib unci full-item compression can crash an application that decodes an advertised tile with heif_image_handle_decode_image_tile(). In libheif/codecs/uncompressed/unc_decoder.cc, unc_decoder::fetch_tile_data() computes a large tile offset and unc_decoder::get_compressed_image_data_uncompressed() validates it with range_start_offset plus range_size. For the last advertised tile (4095, 4095), the addition can wrap to zero, bypass the bounds check, and pass an invalid source pointer and a one-terabyte length to memcpy. The observed result is an out-of-bounds read and process crash; opening the file alone does not trigger the issue because tile decoding is required. This issue is fixed in version 1.23.1. + +### POC + +#### Reference +- https://github.com/strukturag/libheif/security/advisories/GHSA-73p7-m7gg-w2jv + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-62293.md b/2026/CVE-2026-62293.md new file mode 100644 index 0000000000..edcb291660 --- /dev/null +++ b/2026/CVE-2026-62293.md @@ -0,0 +1,20 @@ +### [CVE-2026-62293](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-62293) +![](https://img.shields.io/static/v1?label=Product&message=ca.uhn.hapi.fhir%3Aorg.hl7.fhir.validation&color=blue) +![](https://img.shields.io/static/v1?label=Product&message=ca.uhn.hapi.fhir%3Aorg.hl7.fhir.validation.cli&color=blue) +![](https://img.shields.io/static/v1?label=Product&message=org.hl7.fhir.core&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=%3C%206.9.11%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-20%3A%20Improper%20Input%20Validation&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-79%3A%20Improper%20Neutralization%20of%20Input%20During%20Web%20Page%20Generation%20('Cross-site%20Scripting')&color=brightgreen) + +### Description + +HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to 6.9.11, the hidden scan command concatenates attacker-controlled Implementation Guide titles, profile titles, and source references into scan.html without escaping in Scanner.java. As a result, a user who scans an attacker-supplied IG/profile and then opens or publishes the generated local/CI HTML report can trigger stored cross-site scripting, executing attacker-controlled JavaScript in the report's browser context. This issue is fixed in version 6.9.11. + +### POC + +#### Reference +- https://github.com/hapifhir/org.hl7.fhir.core/security/advisories/GHSA-6vcw-fq7v-4vhw + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-62295.md b/2026/CVE-2026-62295.md new file mode 100644 index 0000000000..420e4a4fe3 --- /dev/null +++ b/2026/CVE-2026-62295.md @@ -0,0 +1,23 @@ +### [CVE-2026-62295](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-62295) +![](https://img.shields.io/static/v1?label=Product&message=ca.uhn.hapi.fhir%3Aorg.hl7.fhir.r5&color=blue) +![](https://img.shields.io/static/v1?label=Product&message=ca.uhn.hapi.fhir%3Aorg.hl7.fhir.utilities&color=blue) +![](https://img.shields.io/static/v1?label=Product&message=ca.uhn.hapi.fhir%3Aorg.hl7.fhir.validation&color=blue) +![](https://img.shields.io/static/v1?label=Product&message=ca.uhn.hapi.fhir%3Aorg.hl7.fhir.validation.cli&color=blue) +![](https://img.shields.io/static/v1?label=Product&message=org.hl7.fhir.core&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=%3C%206.9.11%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-20%3A%20Improper%20Input%20Validation&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-400%3A%20Uncontrolled%20Resource%20Consumption&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-674%3A%20Uncontrolled%20Recursion&color=brightgreen) + +### Description + +HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to 6.9.11, the JSON utility parser in org.hl7.fhir.utilities.json.parser.JsonParser enforces no maximum nesting depth for arrays or objects. As a result, a small but deeply nested, syntactically valid FHIR JSON document can trigger unbounded readArray() or readObject() recursion, raising a StackOverflowError before structural validation runs. An attacker who can submit JSON resources for validation can thus crash the request thread, and services that do not isolate StackOverflowError safely may experience worker loss or process instability — a denial-of-service condition. This issue is fixed in version 6.9.11. + +### POC + +#### Reference +- https://github.com/hapifhir/org.hl7.fhir.core/security/advisories/GHSA-2cq7-hg49-56gc + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-62296.md b/2026/CVE-2026-62296.md new file mode 100644 index 0000000000..fa45f7c153 --- /dev/null +++ b/2026/CVE-2026-62296.md @@ -0,0 +1,23 @@ +### [CVE-2026-62296](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-62296) +![](https://img.shields.io/static/v1?label=Product&message=ca.uhn.hapi.fhir%3Aorg.hl7.fhir.r5&color=blue) +![](https://img.shields.io/static/v1?label=Product&message=ca.uhn.hapi.fhir%3Aorg.hl7.fhir.utilities&color=blue) +![](https://img.shields.io/static/v1?label=Product&message=ca.uhn.hapi.fhir%3Aorg.hl7.fhir.validation&color=blue) +![](https://img.shields.io/static/v1?label=Product&message=ca.uhn.hapi.fhir%3Aorg.hl7.fhir.validation.cli&color=blue) +![](https://img.shields.io/static/v1?label=Product&message=org.hl7.fhir.core&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=%3C%206.9.11%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-20%3A%20Improper%20Input%20Validation&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-400%3A%20Uncontrolled%20Resource%20Consumption&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-674%3A%20Uncontrolled%20Recursion&color=brightgreen) + +### Description + +HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to 6.9.11, XhtmlParser.java imposes no maximum element nesting depth, so a deeply nested text.div narrative triggers unbounded recursion between parseElementInner() and parseElement(), raising a StackOverflowError. An attacker who can submit FHIR resources containing such narratives can thus crash a parsing or validation worker thread, affecting validator services and any application that parses attacker-supplied FHIR JSON or XML. This issue is fixed in version 6.9.11. + +### POC + +#### Reference +- https://github.com/hapifhir/org.hl7.fhir.core/security/advisories/GHSA-5v24-q6x8-hc38 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-62299.md b/2026/CVE-2026-62299.md new file mode 100644 index 0000000000..592cda589f --- /dev/null +++ b/2026/CVE-2026-62299.md @@ -0,0 +1,17 @@ +### [CVE-2026-62299](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-62299) +![](https://img.shields.io/static/v1?label=Product&message=coredns&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=%3C%201.14.5%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-476%3A%20NULL%20Pointer%20Dereference&color=brightgreen) + +### Description + +CoreDNS is a DNS server written in Go. Prior to 1.14.5, the CoreDNS rewrite plugin supports edns0 rewrite rules with an optional revert flag, and two response rules, edns0SetResponseRule and edns0ReplaceResponseRule[T] in plugin/rewrite/edns0.go, call res.IsEdns0() and immediately dereference the returned *dns.OPT without a nil check when a downstream plugin returns a response with no OPT record. A remote, unauthenticated client can send a single ordinary DNS query matching a rewrite edns0 ... revert rule, causing ResponseReverter in plugin/rewrite/reverter.go to panic, return SERVFAIL, and degrade availability, or crash the CoreDNS process if the debug directive disables recovery. This issue is fixed in version 1.14.5. + +### POC + +#### Reference +- https://github.com/coredns/coredns/security/advisories/GHSA-9pmm-cxww-rrr7 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-62323.md b/2026/CVE-2026-62323.md new file mode 100644 index 0000000000..843d0d085b --- /dev/null +++ b/2026/CVE-2026-62323.md @@ -0,0 +1,17 @@ +### [CVE-2026-62323](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-62323) +![](https://img.shields.io/static/v1?label=Product&message=cloudreve&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=%3C%204.17.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-863%3A%20Incorrect%20Authorization&color=brightgreen) + +### Description + +Cloudreve is a self-hosted file management and sharing system. Prior to 4.17.0, ViewerSessionValidation uses only the session-id prefix of a WOPI access token and does not enforce the requested viewer action, allowing a malicious or compromised WOPI viewer with a view session to forge the token suffix and invoke WOPI write routes for the underlying file. This issue is fixed in version 4.17.0. + +### POC + +#### Reference +- https://github.com/cloudreve/cloudreve/security/advisories/GHSA-c3jm-gv5r-9wcp + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-62324.md b/2026/CVE-2026-62324.md new file mode 100644 index 0000000000..c6a18c8cf2 --- /dev/null +++ b/2026/CVE-2026-62324.md @@ -0,0 +1,18 @@ +### [CVE-2026-62324](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-62324) +![](https://img.shields.io/static/v1?label=Product&message=jodit&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=%3C%204.12.31%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-79%3A%20Improper%20Neutralization%20of%20Input%20During%20Web%20Page%20Generation%20('Cross-site%20Scripting')&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-83%3A%20Improper%20Neutralization%20of%20Script%20in%20Attributes%20in%20a%20Web%20Page&color=brightgreen) + +### Description + +Jodit Editor is a WYSIWYG editor with a built-in file browser & image editor. Prior to 4.12.31, Jodit's sanitizeHTMLElement method fails to use isDangerousUrl to normalize javascript: href values before checking the scheme, allowing case variants, control-byte prefixes, and embedded tabs or newlines to bypass filtering and execute attacker-controlled script when a victim clicks a stored link rendered by an application. This issue is fixed in version 4.12.31. + +### POC + +#### Reference +- https://github.com/xdan/jodit/security/advisories/GHSA-j839-gqq4-gf9j + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-62325.md b/2026/CVE-2026-62325.md new file mode 100644 index 0000000000..82e20f7f4c --- /dev/null +++ b/2026/CVE-2026-62325.md @@ -0,0 +1,17 @@ +### [CVE-2026-62325](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-62325) +![](https://img.shields.io/static/v1?label=Product&message=goshs&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=%3E%3D%202.1.3%2C%20%3C%202.1.4%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-306%3A%20Missing%20Authentication%20for%20Critical%20Function&color=brightgreen) + +### Description + +goshs is a feature-rich single-binary file server for red teamers and developers. From 2.1.3 until 2.1.4, the sftpserver/sftpserver.go password handler used Username != "" && Password != "", so running goshs with -b 'admin:' -sftp and no -fkf left both SFTP authentication handlers unset and allowed unauthenticated file access. This issue is fixed in version 2.1.4. + +### POC + +#### Reference +- https://github.com/goshs-labs/goshs/security/advisories/GHSA-rjrw-mjq6-hpmm + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-62350.md b/2026/CVE-2026-62350.md new file mode 100644 index 0000000000..dbaf07dcb7 --- /dev/null +++ b/2026/CVE-2026-62350.md @@ -0,0 +1,17 @@ +### [CVE-2026-62350](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-62350) +![](https://img.shields.io/static/v1?label=Product&message=TDengine&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=%3C%203.4.1.15%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-94%3A%20Improper%20Control%20of%20Generation%20of%20Code%20('Code%20Injection')&color=brightgreen) + +### Description + +TDengine is an open source, time-series database optimized for Internet of Things devices. Prior to 3.4.1.15, a user with create udf privilege could upload a crafted shared library and install it as a user-defined function, such as eval, then execute arbitrary C code on the TDengine server side through database queries. This issue is fixed in version 3.4.1.15. + +### POC + +#### Reference +- https://github.com/taosdata/TDengine/security/advisories/GHSA-f7wh-p233-87xv + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-62353.md b/2026/CVE-2026-62353.md new file mode 100644 index 0000000000..e190939aaa --- /dev/null +++ b/2026/CVE-2026-62353.md @@ -0,0 +1,18 @@ +### [CVE-2026-62353](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-62353) +![](https://img.shields.io/static/v1?label=Product&message=TDengine&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=%3C%203.4.1.14%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-125%3A%20Out-of-bounds%20Read&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-126%3A%20Buffer%20Over-read&color=brightgreen) + +### Description + +TDengine is a time-series database optimized for Internet of Things devices. Prior to 3.4.1.14, source/libs/parser/src/parTokenizer.c tGetToken() incremented past a trailing backslash in a SQL string literal such as 'abc\ and read one byte beyond the null terminator, allowing an authenticated user who can submit SQL queries to crash the server and possibly leak adjacent memory. This issue is fixed in version 3.4.1.14. + +### POC + +#### Reference +- https://github.com/taosdata/TDengine/security/advisories/GHSA-5r9p-3j4f-gmgp + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-62377.md b/2026/CVE-2026-62377.md new file mode 100644 index 0000000000..f6bf3ec535 --- /dev/null +++ b/2026/CVE-2026-62377.md @@ -0,0 +1,19 @@ +### [CVE-2026-62377](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-62377) +![](https://img.shields.io/static/v1?label=Product&message=libheif&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=%3C%201.23.1%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-617%3A%20Reachable%20Assertion&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-908%3A%20Use%20of%20Uninitialized%20Resource&color=brightgreen) + +### Description + +libheif is a HEIF and AVIF file format decoder and encoder. In 1.23.0 and earlier, a crafted HEIF sequence accepted by heif_context_read_from_memory() can leave the context with no registered sequence tracks and crash when heif_context_get_track(ctx, 0) is called. HeifContext::get_track() in libheif/context.cc executes assert(has_sequence()) before its normal error handling, so assert-enabled builds abort instead of allowing the public wrapper in libheif/api/libheif/heif_sequences.cc to return null. In release builds, removing the assertion lets the track_id zero path dereference m_tracks.begin()->second on an empty map, which is undefined behavior and typically crashes. The issue is reachable through documented public APIs after parsing attacker-controlled bytes. This issue is fixed in version 1.23.1. + +### POC + +#### Reference +- https://github.com/strukturag/libheif/issues/1844 +- https://github.com/strukturag/libheif/security/advisories/GHSA-9ww4-9v47-m7pj + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-62378.md b/2026/CVE-2026-62378.md new file mode 100644 index 0000000000..4f5d46da1e --- /dev/null +++ b/2026/CVE-2026-62378.md @@ -0,0 +1,17 @@ +### [CVE-2026-62378](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-62378) +![](https://img.shields.io/static/v1?label=Product&message=console&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=%3E%3D%200.1.7%2C%20%3C%200.1.10%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-79%3A%20Improper%20Neutralization%20of%20Input%20During%20Web%20Page%20Generation%20('Cross-site%20Scripting')&color=brightgreen) + +### Description + +RustFS Console is a web management console for the RustFS distributed file system. From 0.1.7 until 0.1.10, the RustFS Console components/object/preview-modal.tsx and components/object/pdf-viewer.tsx extension-based PDF preview path can render HTML content uploaded as .pdf, allowing stored cross-site scripting in the management console and exposure of administrator AccessKeyId, SecretAccessKey, and SessionToken values. This is caused by a regression of CVE-2026-27822. This vulnerability is fixed in 0.1.10. + +### POC + +#### Reference +- https://github.com/rustfs/rustfs/security/advisories/GHSA-7gcx-wg4x-q9x6 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-62420.md b/2026/CVE-2026-62420.md new file mode 100644 index 0000000000..310b69d8c0 --- /dev/null +++ b/2026/CVE-2026-62420.md @@ -0,0 +1,19 @@ +### [CVE-2026-62420](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-62420) +![](https://img.shields.io/static/v1?label=Product&message=LXD&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=5.0.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=5.21.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=6.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-863%20Incorrect%20Authorization&color=brightgreen) + +### Description + +An authorization bypass vulnerability in LXD allows an authenticated attacker to bypass target project security restrictions during cross-project instance migrations. When moving an instance cross-project to a different cluster member via POST /1.0/instances/{name} with migration: true, project: , and target: , the destination node skips all project restriction checks because the request arrives as an internal cluster notification. An attacker can exploit this to introduce disallowed instance configurations into a restricted project. + +### POC + +#### Reference +- https://github.com/canonical/lxd/security/advisories/GHSA-v9wr-9r7q-fh4g + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-62663.md b/2026/CVE-2026-62663.md new file mode 100644 index 0000000000..c9023f1b33 --- /dev/null +++ b/2026/CVE-2026-62663.md @@ -0,0 +1,17 @@ +### [CVE-2026-62663](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-62663) +![](https://img.shields.io/static/v1?label=Product&message=banks&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=%3C%202.4.4%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-22%3A%20Improper%20Limitation%20of%20a%20Pathname%20to%20a%20Restricted%20Directory%20('Path%20Traversal')&color=brightgreen) + +### Description + +Banks generates meaningful LLM prompts using a simple template language. In versions prior to 2.4.4, all four media filters (image, audio, video, document) in banks accept untrusted user input as file paths via Path(value) and pass them directly to open(file_path, "rb") without any path sanitization, canonicalization, or directory restriction. An attacker who controls template variables passed to a banks Prompt can use path traversal (../) to read arbitrary files accessible to the Python process—including .env files, SSH keys, cloud credentials, source code, /etc/passwd, and /etc/shadow—with the content returned base64-encoded in the rendered prompt output, making exfiltration trivial. This is particularly dangerous for applications that use banks to process user-provided template variables before sending prompts to an LLM. This issue has been fixed in version 2.4.4. + +### POC + +#### Reference +- https://github.com/masci/banks/security/advisories/GHSA-98rr-gvc9-3cjh + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-62684.md b/2026/CVE-2026-62684.md new file mode 100644 index 0000000000..421d40fb00 --- /dev/null +++ b/2026/CVE-2026-62684.md @@ -0,0 +1,18 @@ +### [CVE-2026-62684](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-62684) +![](https://img.shields.io/static/v1?label=Product&message=filebrowser&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=%3C%202.63.17%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-200%3A%20Exposure%20of%20Sensitive%20Information%20to%20an%20Unauthorized%20Actor&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-522%3A%20Insufficiently%20Protected%20Credentials&color=brightgreen) + +### Description + +File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Prior to 2.63.17, the Link storage struct is serialized directly by sharePostHandler, shareListHandler, and shareGetsHandler through renderJSON, causing POST /api/share/{path} and GET /api/shares to expose password_hash and the bypass token, while an administrator can retrieve these secrets for every user's shares, enabling offline password cracking and direct access to protected shares. This issue is fixed in version 2.63.17. + +### POC + +#### Reference +- https://github.com/filebrowser/filebrowser/security/advisories/GHSA-833g-cqhp-h72j + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-62845.md b/2026/CVE-2026-62845.md new file mode 100644 index 0000000000..d63461ef58 --- /dev/null +++ b/2026/CVE-2026-62845.md @@ -0,0 +1,17 @@ +### [CVE-2026-62845](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-62845) +![](https://img.shields.io/static/v1?label=Product&message=kamaji&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=%3C%2026.6.4-edge%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-89%3A%20Improper%20Neutralization%20of%20Special%20Elements%20used%20in%20an%20SQL%20Command%20('SQL%20Injection')&color=brightgreen) + +### Description + +Kamaji is the Hosted Control Plane Manager for Kubernetes. Prior to 26.7.4-edge, the PostgreSQL and MySQL datastore drivers build DDL statements by interpolating the user-supplied DataStoreUsername/DataStoreSchema directly into SQL via fmt.Sprintf, without escaping identifiers. These fields have no format validation, so a value containing a quote character breaks out of the quoted identifier — SQL injection executed over Kamaji's root connection to the shared datastore. etcd driver is not affected.This issue is fixed in version 26.7.4-edge. + +### POC + +#### Reference +- https://github.com/clastix/kamaji/security/advisories/GHSA-r47v-ppwp-fh4r + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-62857.md b/2026/CVE-2026-62857.md new file mode 100644 index 0000000000..8b4cb006b1 --- /dev/null +++ b/2026/CVE-2026-62857.md @@ -0,0 +1,22 @@ +### [CVE-2026-62857](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-62857) +![](https://img.shields.io/static/v1?label=Product&message=fedify&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=%3E%3D%201.10.0%2C%20%3C%201.10.12%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=%3E%3D%201.2.0%2C%20%3C%201.9.13%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=%3E%3D%202.0.0%2C%20%3C%202.0.22%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=%3E%3D%202.1.0%2C%20%3C%202.1.18%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=%3E%3D%202.2.0%2C%20%3C%202.2.7%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=%3E%3D%202.3.0%2C%20%3C%202.3.2%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-918%3A%20Server-Side%20Request%20Forgery%20(SSRF)&color=brightgreen) + +### Description + +Fedify is a TypeScript library for building federated server apps powered by ActivityPub. From version 1.2.0 through the affected 1.9, 1.10, 2.0, 2.1, 2.2, and 2.3 maintenance lines, getNodeInfo() follows an attacker-controlled links[].href value from /.well-known/nodeinfo without scheme, redirect, or private-address validation, allowing requests to loopback, link-local, cloud metadata, and private-network services and returning their response bodies. This issue is fixed in versions 1.9.13, 1.10.12, 2.0.22, 2.1.18, 2.2.7, and 2.3.2. + +### POC + +#### Reference +- https://github.com/fedify-dev/fedify/security/advisories/GHSA-hqph-j65v-8cq5 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-62948.md b/2026/CVE-2026-62948.md new file mode 100644 index 0000000000..366503f3f1 --- /dev/null +++ b/2026/CVE-2026-62948.md @@ -0,0 +1,19 @@ +### [CVE-2026-62948](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-62948) +![](https://img.shields.io/static/v1?label=Product&message=openwrt&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=%3C%2025.12.5%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-117%3A%20Improper%20Output%20Neutralization%20for%20Logs&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-150%3A%20Improper%20Neutralization%20of%20Escape%2C%20Meta%2C%20or%20Control%20Sequences&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-79%3A%20Improper%20Neutralization%20of%20Input%20During%20Web%20Page%20Generation%20('Cross-site%20Scripting')&color=brightgreen) + +### Description + +OpenWrt is a Linux operating system targeting embedded devices. Prior to 25.12.5, odhcpd writes a DHCPv6 client FQDN option 39 hostname into /tmp/odhcpd.leases through src/statefiles.c statefiles_write_state6() and statefiles_write_state4() without escaping, allowing newline injection of forged lease lines that LuCI rpcd-mod-luci getDHCPLeases displays through htdocs/luci-static/resources/view/status/include/40_dhcp.js and htdocs/luci-static/resources/luci.js dom.append as live HTML in the Active DHCPv6 Leases admin page. This vulnerability is fixed in 25.12.5. + +### POC + +#### Reference +- https://github.com/openwrt/openwrt/security/advisories/GHSA-hhmc-92hw-535f + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-62959.md b/2026/CVE-2026-62959.md new file mode 100644 index 0000000000..4e12d4efd4 --- /dev/null +++ b/2026/CVE-2026-62959.md @@ -0,0 +1,19 @@ +### [CVE-2026-62959](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-62959) +![](https://img.shields.io/static/v1?label=Product&message=coturn&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=%3E%3D%204.5.2%2C%20%3C%204.15.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-125%3A%20Out-of-bounds%20Read&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-195%3A%20Signed%20to%20Unsigned%20Conversion%20Error&color=brightgreen) + +### Description + +Coturn is a free open source implementation of TURN and STUN Server. From 4.5.2 through 4.14.0, when Coturn is started with --acme-redirect and exposes a plaintext-TCP listener, an unauthenticated remote client can send a single ordinary HTTP GET request and receive a 301 response whose Location header contains up to ~870 bytes of adjacent process heap memory. The leaked region is a recycled network receive buffer that is reused without being zeroed, so on a busy server it can contain data from other clients' requests (TURN credentials, OAuth tokens, relayed payloads). Root cause is a signed→unsigned conversion. This issue is fixed in version 4.15.0. + +### POC + +#### Reference +- https://github.com/coturn/coturn/commit/960835886692fa04cf63ddd970c3f330740c87f4 +- https://github.com/coturn/coturn/security/advisories/GHSA-m23x-5qf5-988g + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-62982.md b/2026/CVE-2026-62982.md new file mode 100644 index 0000000000..4ad820ee7c --- /dev/null +++ b/2026/CVE-2026-62982.md @@ -0,0 +1,17 @@ +### [CVE-2026-62982](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-62982) +![](https://img.shields.io/static/v1?label=Product&message=glances&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=%3E%3D%204.5.2%2C%20%3C%204.5.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-78%3A%20Improper%20Neutralization%20of%20Special%20Elements%20used%20in%20an%20OS%20Command%20('OS%20Command%20Injection')&color=brightgreen) + +### Description + +Glances is an open-source system cross-platform monitoring tool. From 4.5.2 until 4.5.6, _sanitize_mustache_dict() in glances/actions.py skips nested list and dictionary strings such as process cmdline values, allowing pipe characters to survive chevron.render() and be executed by secure_popen() through administrator-configured action templates. This issue is fixed in 4.5.6. + +### POC + +#### Reference +- https://github.com/nicolargo/glances/security/advisories/GHSA-73wf-9vmv-5pv9 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-62988.md b/2026/CVE-2026-62988.md new file mode 100644 index 0000000000..55cf2f9744 --- /dev/null +++ b/2026/CVE-2026-62988.md @@ -0,0 +1,17 @@ +### [CVE-2026-62988](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-62988) +![](https://img.shields.io/static/v1?label=Product&message=froxlor&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=%3C%202.3.8%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-200%3A%20Exposure%20of%20Sensitive%20Information%20to%20an%20Unauthorized%20Actor&color=brightgreen) + +### Description + +Froxlor is open source server administration software. From 2.3.7 until 2.3.8, the Customers.get, Customers.listing, Admins.get, Admins.listing, Ftps.get, and Ftps.listing API commands in lib/Froxlor/Api/Commands/Customers.php, lib/Froxlor/Api/Commands/Admins.php, and lib/Froxlor/Api/Commands/Ftps.php retrieve full database rows and return them without removing password and data_2fa fields. An authenticated API caller with permission to use these endpoints can obtain customer, administrator, and FTP password hashes as well as Base32-encoded TOTP seeds for administrator and customer accounts. Password hashes can be cracked offline, and TOTP seeds can generate valid second-factor codes until two-factor authentication is reset. Exposure of both values for an account can enable takeover of the hosting panel or hosted resources and can defeat both authentication factors. This issue is fixed in version 2.3.8. + +### POC + +#### Reference +- https://github.com/froxlor/froxlor/security/advisories/GHSA-7788-ghfq-c6mh + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-62994.md b/2026/CVE-2026-62994.md new file mode 100644 index 0000000000..222738a48c --- /dev/null +++ b/2026/CVE-2026-62994.md @@ -0,0 +1,18 @@ +### [CVE-2026-62994](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-62994) +![](https://img.shields.io/static/v1?label=Product&message=coredns&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=%3E%3D%201.9.4%2C%20%3C%201.14.5%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-248%3A%20Uncaught%20Exception&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-755%3A%20Improper%20Handling%20of%20Exceptional%20Conditions&color=brightgreen) + +### Description + +CoreDNS is a DNS server written in Go. From 1.9.4 until 1.14.5, a network DNS client allowed to request AXFR for a CoreDNS zone can trigger a panic when CoreDNS is configured with k8s_external headless-service zone transfers and Kubernetes contains a headless service endpoint with no declared ports; plugin/kubernetes/object/endpoint.go creates Port: -1, plugin/k8s_external/msg_to_dns.go skips that service, plugin/k8s_external/transfer.go sends an empty []dns.RR batch, and plugin/transfer/transfer.go indexes records[0] without checking the batch is non-empty. This issue is fixed in version 1.14.5. + +### POC + +#### Reference +- https://github.com/coredns/coredns/security/advisories/GHSA-74w3-63xv-x9mv + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-62996.md b/2026/CVE-2026-62996.md new file mode 100644 index 0000000000..dde2a3cdf2 --- /dev/null +++ b/2026/CVE-2026-62996.md @@ -0,0 +1,17 @@ +### [CVE-2026-62996](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-62996) +![](https://img.shields.io/static/v1?label=Product&message=smarty&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=%3E%3D%205.0.0%2C%20%3C%205.8.4%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-22%3A%20Improper%20Limitation%20of%20a%20Pathname%20to%20a%20Restricted%20Directory%20('Path%20Traversal')&color=brightgreen) + +### Description + +Smarty is a template engine for PHP, facilitating the separation of presentation (HTML/CSS) from application logic. From 5.0.0 until 5.8.4, Smarty's stream: resource-name handling does not adequately restrict which PHP stream wrappers and filter chains can be referenced from a template, allowing a php://filter-wrapped resource name to be used to read the contents of arbitrary local files accessible to the PHP process. An attacker able to author or influence a template's resource reference could exploit this to disclose sensitive file contents outside the intended template/config scope. This issue is fixed in version 5.8.4. + +### POC + +#### Reference +- https://github.com/smarty-php/smarty/security/advisories/GHSA-rjhh-76wf-8xmw + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-7246.md b/2026/CVE-2026-7246.md index 9a7ddbc1a5..0a06aa07d1 100644 --- a/2026/CVE-2026-7246.md +++ b/2026/CVE-2026-7246.md @@ -6,7 +6,7 @@ ### Description -Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account. +This CVE record was assigned not following CNA/CVE rules and is not considered a valid vulnerability by the Pallets Click project. The original CVE record description is preserved below:Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account. ### POC diff --git a/2026/CVE-2026-75130.md b/2026/CVE-2026-75130.md new file mode 100644 index 0000000000..549d4ec86c --- /dev/null +++ b/2026/CVE-2026-75130.md @@ -0,0 +1,17 @@ +### [CVE-2026-75130](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-75130) +![](https://img.shields.io/static/v1?label=Product&message=Context7&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Improper%20Neutralization%20of%20Input%20Used%20for%20LLM%20Prompting&color=brightgreen) + +### Description + +Context7 through 2.1.2 contains a prompt injection vulnerability that allows attackers to execute malicious instructions in connected AI coding agents by injecting unsanitized content through the Custom AI Instructions feature served via the MCP server. Attackers can poison the custom instructions to exfiltrate credentials from environment files to an attacker-controlled service and perform destructive file deletion on the victim's machine when the agent makes a routine library documentation request. + +### POC + +#### Reference +- https://noma.security/blog/contextcrush-context7-the-mcp-server-vulnerability/ + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-75872.md b/2026/CVE-2026-75872.md new file mode 100644 index 0000000000..848c258482 --- /dev/null +++ b/2026/CVE-2026-75872.md @@ -0,0 +1,17 @@ +### [CVE-2026-75872](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-75872) +![](https://img.shields.io/static/v1?label=Product&message=MailerUp&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-80%20Improper%20neutralization%20of%20Script-Related%20HTML%20tags%20in%20a%20web%20page%20(basic%20XSS)&color=brightgreen) + +### Description + +HTML Injection in the public subscription form in maalfer MailerUp before 1.1.3 allows unauthenticated remote attackers to have the application send a message carrying arbitrary HTML, to an attacker-chosen address and from the form owner's configured sending identity, via the first_name field of the subscription request, which is interpolated unescaped into the double opt-in verification email. + +### POC + +#### Reference +- https://secur0.com/en/cna/cve-list/cve-2026-75872-html-injection-in-mailerup-double-optin-verification-email + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-7701.md b/2026/CVE-2026-7701.md new file mode 100644 index 0000000000..c5f679fefc --- /dev/null +++ b/2026/CVE-2026-7701.md @@ -0,0 +1,24 @@ +### [CVE-2026-7701](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-7701) +![](https://img.shields.io/static/v1?label=Product&message=Desktop&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=6.7.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=6.7.1%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=6.7.2%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=6.7.3%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=6.7.4%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=6.7.5%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Denial%20of%20Service&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=NULL%20Pointer%20Dereference&color=brightgreen) + +### Description + +A security vulnerability has been detected in Telegram Desktop up to 6.7.5. This vulnerability affects the function RequestButton of the file Telegram/SourceFiles/boxes/url_auth_box.cpp of the component Bot API. The manipulation of the argument login_url leads to null pointer dereference. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used. There is ongoing doubt regarding the real existence of this vulnerability. Upgrading to version 6.7.6 is able to resolve this issue. Upgrading the affected component is recommended. The vendor provides this rationale for the dispute: "[T]he described scenario does not lead to any security issue or vulnerability, and only causes a one-time crash. In the outlined scenario, the targeted user must perform an active action, which doesn't produce any consequences after the app is relaunched." + +### POC + +#### Reference +- https://www.youtube.com/watch?v=xo9Bplsy1K8 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-7999.md b/2026/CVE-2026-7999.md new file mode 100644 index 0000000000..f953c30ee7 --- /dev/null +++ b/2026/CVE-2026-7999.md @@ -0,0 +1,17 @@ +### [CVE-2026-7999](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-7999) +![](https://img.shields.io/static/v1?label=Product&message=Chrome&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=148.0.7778.96%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Inappropriate%20implementation&color=brightgreen) + +### Description + +Inappropriate implementation in V8 in Google Chrome prior to 148.0.7778.96 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Low) + +### POC + +#### Reference +- https://issues.chromium.org/issues/493099941 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-8541.md b/2026/CVE-2026-8541.md new file mode 100644 index 0000000000..c956b612c9 --- /dev/null +++ b/2026/CVE-2026-8541.md @@ -0,0 +1,17 @@ +### [CVE-2026-8541](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-8541) +![](https://img.shields.io/static/v1?label=Product&message=Chrome&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=148.0.7778.168%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Out%20of%20bounds%20read&color=brightgreen) + +### Description + +Out of bounds read in UI in Google Chrome prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: High) + +### POC + +#### Reference +- https://issues.chromium.org/issues/496645393 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-8561.md b/2026/CVE-2026-8561.md new file mode 100644 index 0000000000..a1fd86c4a5 --- /dev/null +++ b/2026/CVE-2026-8561.md @@ -0,0 +1,17 @@ +### [CVE-2026-8561](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-8561) +![](https://img.shields.io/static/v1?label=Product&message=Chrome&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=148.0.7778.168%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Incorrect%20security%20UI&color=brightgreen) + +### Description + +Incorrect security UI in Fullscreen in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium) + +### POC + +#### Reference +- https://issues.chromium.org/issues/343352552 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-9126.md b/2026/CVE-2026-9126.md new file mode 100644 index 0000000000..2605f29ad7 --- /dev/null +++ b/2026/CVE-2026-9126.md @@ -0,0 +1,17 @@ +### [CVE-2026-9126](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-9126) +![](https://img.shields.io/static/v1?label=Product&message=Chrome&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=148.0.7778.179%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Use%20after%20free&color=brightgreen) + +### Description + +Use after free in DOM in Google Chrome on prior to 148.0.7778.179 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium) + +### POC + +#### Reference +- https://issues.chromium.org/issues/496280532 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-9875.md b/2026/CVE-2026-9875.md new file mode 100644 index 0000000000..f8dedd5179 --- /dev/null +++ b/2026/CVE-2026-9875.md @@ -0,0 +1,17 @@ +### [CVE-2026-9875](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-9875) +![](https://img.shields.io/static/v1?label=Product&message=Chrome&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=148.0.7778.216%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Out%20of%20bounds%20read&color=brightgreen) + +### Description + +Out of bounds read in WebGL in Google Chrome on Android prior to 148.0.7778.216 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical) + +### POC + +#### Reference +- https://issues.chromium.org/issues/507508103 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-9895.md b/2026/CVE-2026-9895.md new file mode 100644 index 0000000000..ae9415054e --- /dev/null +++ b/2026/CVE-2026-9895.md @@ -0,0 +1,17 @@ +### [CVE-2026-9895](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-9895) +![](https://img.shields.io/static/v1?label=Product&message=Chrome&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=148.0.7778.216%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Out%20of%20bounds%20read&color=brightgreen) + +### Description + +Out of bounds read in GPU in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High) + +### POC + +#### Reference +- https://issues.chromium.org/issues/491685406 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-9916.md b/2026/CVE-2026-9916.md new file mode 100644 index 0000000000..f80f136604 --- /dev/null +++ b/2026/CVE-2026-9916.md @@ -0,0 +1,17 @@ +### [CVE-2026-9916](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-9916) +![](https://img.shields.io/static/v1?label=Product&message=Chrome&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=148.0.7778.216%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Out%20of%20bounds%20write&color=brightgreen) + +### Description + +Out of bounds write in ANGLE in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High) + +### POC + +#### Reference +- https://issues.chromium.org/issues/500080303 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-9967.md b/2026/CVE-2026-9967.md new file mode 100644 index 0000000000..c54442e192 --- /dev/null +++ b/2026/CVE-2026-9967.md @@ -0,0 +1,17 @@ +### [CVE-2026-9967](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-9967) +![](https://img.shields.io/static/v1?label=Product&message=Chrome&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=148.0.7778.216%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Out%20of%20bounds%20write&color=brightgreen) + +### Description + +Out of bounds write in GPU in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High) + +### POC + +#### Reference +- https://issues.chromium.org/issues/506414791 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-9973.md b/2026/CVE-2026-9973.md new file mode 100644 index 0000000000..ce85b6636e --- /dev/null +++ b/2026/CVE-2026-9973.md @@ -0,0 +1,17 @@ +### [CVE-2026-9973](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-9973) +![](https://img.shields.io/static/v1?label=Product&message=Chrome&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=148.0.7778.216%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Out%20of%20bounds%20write&color=brightgreen) + +### Description + +Out of bounds write in V8 in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High) + +### POC + +#### Reference +- https://issues.chromium.org/issues/509268941 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-9974.md b/2026/CVE-2026-9974.md new file mode 100644 index 0000000000..731ea590e0 --- /dev/null +++ b/2026/CVE-2026-9974.md @@ -0,0 +1,17 @@ +### [CVE-2026-9974](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-9974) +![](https://img.shields.io/static/v1?label=Product&message=Chrome&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=148.0.7778.216%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Out%20of%20bounds%20write&color=brightgreen) + +### Description + +Out of bounds write in GPU in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High) + +### POC + +#### Reference +- https://issues.chromium.org/issues/511710468 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-9977.md b/2026/CVE-2026-9977.md new file mode 100644 index 0000000000..84ebf17694 --- /dev/null +++ b/2026/CVE-2026-9977.md @@ -0,0 +1,17 @@ +### [CVE-2026-9977](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-9977) +![](https://img.shields.io/static/v1?label=Product&message=Chrome&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=148.0.7778.216%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Insufficient%20validation%20of%20untrusted%20input&color=brightgreen) + +### Description + +Insufficient validation of untrusted input in WebShare in Google Chrome on Android prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High) + +### POC + +#### Reference +- https://issues.chromium.org/issues/511741173 + +#### Github +No PoCs found on GitHub currently. + diff --git a/references.txt b/references.txt index 98405df4bd..fd24d92407 100644 --- a/references.txt +++ b/references.txt @@ -670,6 +670,7 @@ CVE-2003-0462 - http://www.redhat.com/support/errata/RHSA-2003-239.html CVE-2003-0462 - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A309 CVE-2003-0471 - http://marc.info/?l=bugtraq&m=105648385900792&w=2 CVE-2003-0476 - http://marc.info/?l=bugtraq&m=105664924024009&w=2 +CVE-2003-0476 - http://www.redhat.com/support/errata/RHSA-2003-368.html CVE-2003-0485 - http://marc.info/?l=bugtraq&m=105613243117155&w=2 CVE-2003-0486 - http://www.phpbb.com/phpBB/viewtopic.php?t=112052 CVE-2003-0501 - http://marc.info/?l=bugtraq&m=105621758104242 @@ -782,6 +783,7 @@ CVE-2003-0935 - https://oval.cisecurity.org/repository/search/definition/oval%3A CVE-2003-0936 - http://marc.info/?l=bugtraq&m=106875764826251&w=2 CVE-2003-0946 - http://marc.info/?l=bugtraq&m=106867135830683&w=2 CVE-2003-0961 - http://marc.info/?l=bugtraq&m=107064830206816&w=2 +CVE-2003-0961 - http://www.redhat.com/support/errata/RHSA-2003-368.html CVE-2003-0962 - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9415 CVE-2003-0967 - http://marc.info/?l=bugtraq&m=106944220426970 CVE-2003-0968 - http://marc.info/?l=bugtraq&m=106986437621130&w=2 @@ -885,9 +887,12 @@ CVE-2004-0003 - http://www.redhat.com/support/errata/RHSA-2004-065.html CVE-2004-0003 - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9204 CVE-2004-0005 - http://marc.info/?l=bugtraq&m=107513690306318&w=2 CVE-2004-0006 - http://marc.info/?l=bugtraq&m=107513690306318&w=2 +CVE-2004-0006 - http://www.redhat.com/support/errata/RHSA-2004-032.html CVE-2004-0007 - http://marc.info/?l=bugtraq&m=107513690306318&w=2 +CVE-2004-0007 - http://www.redhat.com/support/errata/RHSA-2004-032.html CVE-2004-0007 - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9906 CVE-2004-0008 - http://marc.info/?l=bugtraq&m=107513690306318&w=2 +CVE-2004-0008 - http://www.redhat.com/support/errata/RHSA-2004-032.html CVE-2004-0008 - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9469 CVE-2004-0010 - http://www.redhat.com/support/errata/RHSA-2004-065.html CVE-2004-0034 - http://marc.info/?l=bugtraq&m=107340481804110&w=2 @@ -1025,6 +1030,7 @@ CVE-2004-0272 - http://marc.info/?l=bugtraq&m=107643014606515&w=2 CVE-2004-0273 - http://marc.info/?l=bugtraq&m=107642978524321&w=2 CVE-2004-0276 - http://marc.info/?l=bugtraq&m=107652610506968&w=2 CVE-2004-0276 - http://monkeyd.sourceforge.net/ +CVE-2004-0276 - http://www.securityfocus.com/bid/9642 CVE-2004-0277 - http://www.security-protocols.com/modules.php?name=News&file=article&sid=1722 CVE-2004-0278 - http://marc.info/?l=bugtraq&m=107655269820530&w=2 CVE-2004-0288 - https://exchange.xforce.ibmcloud.com/vulnerabilities/15209 @@ -2073,6 +2079,7 @@ CVE-2005-0848 - http://aluigi.altervista.org/adv/funlabsboom-adv.txt CVE-2005-0849 - http://aluigi.altervista.org/adv/funlabsboom-adv.txt CVE-2005-0853 - https://www.exploit-db.com/exploits/7499 CVE-2005-0859 - https://www.exploit-db.com/exploits/2009 +CVE-2005-0862 - http://www.securityfocus.com/bid/12817 CVE-2005-0867 - http://www.redhat.com/support/errata/RHSA-2005-366.html CVE-2005-0867 - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10867 CVE-2005-0876 - http://www.thekelleys.org.uk/dnsmasq/CHANGELOG @@ -4272,6 +4279,8 @@ CVE-2006-1657 - http://securityreason.com/securityalert/741 CVE-2006-1658 - http://evuln.com/vulns/121/summary.html CVE-2006-1662 - http://securityreason.com/securityalert/519 CVE-2006-1664 - http://sourceforge.net/project/shownotes.php?group_id=9655&release_id=571608 +CVE-2006-1664 - http://www.securityfocus.com/bid/17370 +CVE-2006-1664 - http://www.securityfocus.com/data/vulnerabilities/exploits/xinelib_poc.pl CVE-2006-1664 - https://www.exploit-db.com/exploits/1641 CVE-2006-1667 - https://www.exploit-db.com/exploits/1645 CVE-2006-1668 - https://www.exploit-db.com/exploits/1645 @@ -4384,6 +4393,7 @@ CVE-2006-1864 - http://www.vmware.com/download/esx/esx-254-200610-patch.html CVE-2006-1888 - http://securityreason.com/securityalert/733 CVE-2006-1891 - http://securityreason.com/securityalert/765 CVE-2006-1906 - http://securityreason.com/securityalert/770 +CVE-2006-1917 - http://www.securityfocus.com/bid/17558 CVE-2006-1917 - https://www.exploit-db.com/exploits/1683 CVE-2006-1919 - https://www.exploit-db.com/exploits/1694 CVE-2006-1921 - https://www.exploit-db.com/exploits/1695 @@ -4817,6 +4827,8 @@ CVE-2006-2847 - https://www.exploit-db.com/exploits/1859 CVE-2006-2848 - https://www.exploit-db.com/exploits/1859 CVE-2006-2849 - https://www.exploit-db.com/exploits/1860 CVE-2006-2851 - http://sourceforge.net/project/shownotes.php?release_id=422371 +CVE-2006-2853 - http://www.securityfocus.com/bid/18218 +CVE-2006-2854 - http://www.securityfocus.com/bid/18256 CVE-2006-2860 - https://www.exploit-db.com/exploits/1871 CVE-2006-2861 - http://pridels0.blogspot.com/2006/06/particle-wiki-sql-inj.html CVE-2006-2863 - https://www.exploit-db.com/exploits/1872 @@ -5038,6 +5050,7 @@ CVE-2006-3362 - https://www.exploit-db.com/exploits/6344 CVE-2006-3364 - http://www.vupen.com/english/advisories/2006/2582 CVE-2006-3375 - https://www.exploit-db.com/exploits/1971 CVE-2006-3376 - http://securityreason.com/securityalert/1190 +CVE-2006-3381 - http://www.securityfocus.com/bid/18764 CVE-2006-3382 - http://securityreason.com/securityalert/1189 CVE-2006-3387 - https://www.exploit-db.com/exploits/1812 CVE-2006-3394 - https://www.exploit-db.com/exploits/1975 @@ -5295,6 +5308,7 @@ CVE-2006-3877 - https://docs.microsoft.com/en-us/security-updates/securitybullet CVE-2006-3879 - http://aluigi.altervista.org/adv/lmmgt2ho-adv.txt CVE-2006-3879 - http://aluigi.org/poc/lmmgt2ho.zip CVE-2006-3879 - http://securityreason.com/securityalert/1288 +CVE-2006-3879 - http://www.securityfocus.com/bid/19134 CVE-2006-3880 - http://securityreason.com/securityalert/1282 CVE-2006-3883 - http://securityreason.com/securityalert/1287 CVE-2006-3884 - http://securityreason.com/securityalert/1287 @@ -5380,8 +5394,10 @@ CVE-2006-3999 - http://securityreason.com/securityalert/1338 CVE-2006-4004 - https://www.exploit-db.com/exploits/2087 CVE-2006-4005 - http://aluigi.altervista.org/adv/bcloneboom-adv.txt CVE-2006-4005 - http://aluigi.org/poc/bcloneboom.zip +CVE-2006-4005 - http://www.securityfocus.com/bid/19255 CVE-2006-4006 - http://aluigi.altervista.org/adv/bcloneboom-adv.txt CVE-2006-4006 - http://aluigi.org/poc/bcloneboom.zip +CVE-2006-4006 - http://www.securityfocus.com/bid/19255 CVE-2006-4007 - http://securityreason.com/securityalert/1333 CVE-2006-4008 - http://securityreason.com/securityalert/1332 CVE-2006-4009 - http://securityreason.com/securityalert/1331 @@ -5795,10 +5811,13 @@ CVE-2006-4571 - http://www.vupen.com/english/advisories/2008/0083 CVE-2006-4574 - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9740 CVE-2006-4583 - https://www.exploit-db.com/exploits/2293 CVE-2006-4584 - http://securityreason.com/securityalert/1508 +CVE-2006-4584 - http://www.securityfocus.com/bid/19834 CVE-2006-4584 - https://www.exploit-db.com/exploits/2297 CVE-2006-4585 - http://securityreason.com/securityalert/1508 +CVE-2006-4585 - http://www.securityfocus.com/bid/19834 CVE-2006-4585 - https://www.exploit-db.com/exploits/2297 CVE-2006-4586 - http://securityreason.com/securityalert/1508 +CVE-2006-4586 - http://www.securityfocus.com/bid/19834 CVE-2006-4586 - https://www.exploit-db.com/exploits/2297 CVE-2006-4589 - https://www.exploit-db.com/exploits/2290 CVE-2006-4592 - https://www.exploit-db.com/exploits/2296 @@ -5808,6 +5827,7 @@ CVE-2006-4597 - https://www.exploit-db.com/exploits/2287 CVE-2006-4599 - http://securityreason.com/securityalert/1494 CVE-2006-4600 - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9618 CVE-2006-4601 - http://securityreason.com/securityalert/1496 +CVE-2006-4601 - http://www.securityfocus.com/bid/19817 CVE-2006-4602 - http://isc.sans.org/diary.php?storyid=1672 CVE-2006-4602 - https://www.exploit-db.com/exploits/2288 CVE-2006-4604 - https://www.exploit-db.com/exploits/2280 @@ -6100,6 +6120,7 @@ CVE-2006-5083 - https://www.exploit-db.com/exploits/2430 CVE-2006-5084 - http://security-protocols.com/vids/skype_osx_0day.htm CVE-2006-5084 - http://www.security-protocols.com/modules.php?name=News&file=article&sid=3259 CVE-2006-5085 - http://securityreason.com/securityalert/1653 +CVE-2006-5085 - http://www.securityfocus.com/bid/20235 CVE-2006-5086 - http://securityreason.com/securityalert/1653 CVE-2006-5087 - https://www.exploit-db.com/exploits/2431 CVE-2006-5092 - https://www.exploit-db.com/exploits/2436 @@ -6215,6 +6236,7 @@ CVE-2006-5254 - https://www.exploit-db.com/exploits/2379 CVE-2006-5256 - https://www.exploit-db.com/exploits/2510 CVE-2006-5257 - https://www.exploit-db.com/exploits/2489 CVE-2006-5259 - http://marc.info/?l=bugtraq&m=116049484210942&w=2 +CVE-2006-5259 - http://www.securityfocus.com/bid/20432 CVE-2006-5259 - https://www.exploit-db.com/exploits/2503 CVE-2006-5261 - http://securityreason.com/securityalert/1720 CVE-2006-5261 - https://www.exploit-db.com/exploits/2488 @@ -6244,6 +6266,7 @@ CVE-2006-5292 - https://www.exploit-db.com/exploits/2509 CVE-2006-5293 - http://securityreason.com/securityalert/1724 CVE-2006-5294 - http://securityreason.com/securityalert/1728 CVE-2006-5296 - http://www.informationweek.com/management/showArticle.jhtml?articleID=193302553 +CVE-2006-5296 - http://www.securityfocus.com/bid/20495 CVE-2006-5296 - https://www.exploit-db.com/exploits/2523 CVE-2006-5299 - http://securityreason.com/securityalert/1725 CVE-2006-5300 - http://securityreason.com/securityalert/1727 @@ -6261,16 +6284,21 @@ CVE-2006-5310 - https://www.exploit-db.com/exploits/2535 CVE-2006-5312 - https://www.exploit-db.com/exploits/2532 CVE-2006-5313 - http://hastymail.sourceforge.net/security.php CVE-2006-5314 - http://securityreason.com/securityalert/1734 +CVE-2006-5314 - http://www.securityfocus.com/bid/20443 CVE-2006-5314 - https://www.exploit-db.com/exploits/2501 CVE-2006-5315 - http://securityreason.com/securityalert/1734 +CVE-2006-5315 - http://www.securityfocus.com/bid/20433 CVE-2006-5315 - https://www.exploit-db.com/exploits/2502 CVE-2006-5316 - http://securityreason.com/securityalert/1734 CVE-2006-5316 - https://www.exploit-db.com/exploits/2502 CVE-2006-5317 - http://securityreason.com/securityalert/1734 +CVE-2006-5317 - http://www.securityfocus.com/bid/20429 CVE-2006-5317 - https://www.exploit-db.com/exploits/2504 +CVE-2006-5318 - http://www.securityfocus.com/bid/20430 CVE-2006-5318 - https://www.exploit-db.com/exploits/2505 CVE-2006-5319 - http://securityreason.com/securityalert/1734 CVE-2006-5319 - https://www.exploit-db.com/exploits/2506 +CVE-2006-5320 - http://www.securityfocus.com/bid/20441 CVE-2006-5320 - https://www.exploit-db.com/exploits/2507 CVE-2006-5331 - http://www.linuxgrill.com/anonymous/kernel/v2.6/ChangeLog-2.6.19 CVE-2006-5379 - http://securityreason.com/securityalert/1742 @@ -6364,6 +6392,7 @@ CVE-2006-5546 - https://www.exploit-db.com/exploits/2622 CVE-2006-5547 - https://www.exploit-db.com/exploits/2622 CVE-2006-5548 - https://www.exploit-db.com/exploits/2622 CVE-2006-5550 - http://elegerov.blogspot.com/2006/10/here-is-lame-proof-of-concept-code-for.html +CVE-2006-5550 - http://www.securityfocus.com/bid/20713 CVE-2006-5551 - https://www.exploit-db.com/exploits/2625 CVE-2006-5552 - https://www.exploit-db.com/exploits/2650 CVE-2006-5554 - https://www.exploit-db.com/exploits/2647 @@ -6373,6 +6402,7 @@ CVE-2006-5557 - https://www.exploit-db.com/exploits/2633 CVE-2006-5557 - https://www.exploit-db.com/exploits/2634 CVE-2006-5558 - https://www.exploit-db.com/exploits/2635 CVE-2006-5559 - http://www.kb.cert.org/vuls/id/589272 +CVE-2006-5559 - http://www.securityfocus.com/bid/20704 CVE-2006-5559 - https://docs.microsoft.com/en-us/security-updates/securitybulletins/2007/ms07-009 CVE-2006-5560 - http://securityreason.com/securityalert/1782 CVE-2006-5561 - https://www.exploit-db.com/exploits/2644 @@ -6717,6 +6747,7 @@ CVE-2006-6117 - https://www.exploit-db.com/exploits/2829 CVE-2006-6121 - https://docs.microsoft.com/en-us/security-updates/securitybulletins/2007/ms07-027 CVE-2006-6133 - https://docs.microsoft.com/en-us/security-updates/securitybulletins/2007/ms07-052 CVE-2006-6134 - http://www.kb.cert.org/vuls/id/208769 +CVE-2006-6134 - http://www.securityfocus.com/bid/21247 CVE-2006-6134 - https://docs.microsoft.com/en-us/security-updates/securitybulletins/2006/ms06-078 CVE-2006-6137 - https://www.exploit-db.com/exploits/2847 CVE-2006-6138 - https://www.exploit-db.com/exploits/2847 @@ -6774,7 +6805,9 @@ CVE-2006-6250 - https://www.exploit-db.com/exploits/2861 CVE-2006-6251 - https://www.exploit-db.com/exploits/2870 CVE-2006-6251 - https://www.exploit-db.com/exploits/2872 CVE-2006-6253 - http://securityreason.com/securityalert/1961 +CVE-2006-6253 - http://www.securityfocus.com/bid/21283 CVE-2006-6254 - http://securityreason.com/securityalert/1961 +CVE-2006-6254 - http://www.securityfocus.com/bid/21283 CVE-2006-6255 - https://www.exploit-db.com/exploits/2843 CVE-2006-6261 - https://www.exploit-db.com/exploits/2860 CVE-2006-6268 - http://www.nukedx.com/?viewdoc=51 @@ -7002,6 +7035,7 @@ CVE-2006-6745 - https://oval.cisecurity.org/repository/search/definition/oval%3A CVE-2006-6746 - http://securityreason.com/securityalert/2058 CVE-2006-6747 - http://securityreason.com/securityalert/2058 CVE-2006-6754 - http://securityreason.com/securityalert/2073 +CVE-2006-6754 - http://www.securityfocus.com/bid/21710 CVE-2006-6755 - http://securityreason.com/securityalert/2073 CVE-2006-6755 - https://www.exploit-db.com/exploits/2975 CVE-2006-6756 - http://securityreason.com/securityalert/2073 @@ -7337,6 +7371,7 @@ CVE-2007-0116 - http://securityreason.com/securityalert/2109 CVE-2007-0120 - https://www.exploit-db.com/exploits/3078 CVE-2007-0121 - http://securityreason.com/securityalert/2108 CVE-2007-0122 - http://securityreason.com/securityalert/2123 +CVE-2007-0122 - http://www.securityfocus.com/bid/21894 CVE-2007-0122 - https://www.exploit-db.com/exploits/3085 CVE-2007-0123 - http://securityreason.com/securityalert/2116 CVE-2007-0124 - http://securityreason.com/securityalert/2115 @@ -7389,8 +7424,10 @@ CVE-2007-0198 - http://www.cisco.com/warp/public/707/cisco-sa-20070110-jtapi.sht CVE-2007-0199 - http://www.cisco.com/warp/public/707/cisco-sa-20070110-dlsw.shtml CVE-2007-0200 - https://www.exploit-db.com/exploits/3108 CVE-2007-0202 - http://securityreason.com/securityalert/2135 +CVE-2007-0202 - http://www.securityfocus.com/bid/21926 CVE-2007-0202 - https://www.exploit-db.com/exploits/3103 CVE-2007-0205 - http://securityreason.com/securityalert/2135 +CVE-2007-0205 - http://www.securityfocus.com/bid/21926 CVE-2007-0205 - https://www.exploit-db.com/exploits/3103 CVE-2007-0206 - http://securityreason.com/securityalert/2140 CVE-2007-0208 - https://docs.microsoft.com/en-us/security-updates/securitybulletins/2007/ms07-014 @@ -9631,6 +9668,7 @@ CVE-2007-4352 - https://oval.cisecurity.org/repository/search/definition/oval%3A CVE-2007-4358 - http://aluigi.altervista.org/adv/zoidboom2-adv.txt CVE-2007-4358 - http://aluigi.org/poc/zoidboom2.zip CVE-2007-4358 - http://securityreason.com/securityalert/3014 +CVE-2007-4358 - http://www.securityfocus.com/bid/25326 CVE-2007-4362 - https://www.exploit-db.com/exploits/4284 CVE-2007-4366 - http://securityreason.com/securityalert/3015 CVE-2007-4366 - https://www.exploit-db.com/exploits/4281 @@ -9697,22 +9735,31 @@ CVE-2007-4443 - http://aluigi.org/poc/unrwebdos.zip CVE-2007-4443 - http://securityreason.com/securityalert/3039 CVE-2007-4444 - http://aluigi.org/poc/rfactorx.zip CVE-2007-4444 - http://securityreason.com/securityalert/3037 +CVE-2007-4444 - http://www.securityfocus.com/bid/25358 CVE-2007-4445 - http://aluigi.org/poc/rfactorx.zip CVE-2007-4445 - http://securityreason.com/securityalert/3037 +CVE-2007-4445 - http://www.securityfocus.com/bid/25358 CVE-2007-4446 - http://aluigi.org/poc/toribashish.zip CVE-2007-4446 - http://securityreason.com/securityalert/3033 +CVE-2007-4446 - http://www.securityfocus.com/bid/25359 CVE-2007-4447 - http://aluigi.org/poc/toribashish.zip CVE-2007-4447 - http://securityreason.com/securityalert/3033 +CVE-2007-4447 - http://www.securityfocus.com/bid/25359 CVE-2007-4448 - http://aluigi.org/poc/toribashish.zip CVE-2007-4448 - http://securityreason.com/securityalert/3033 +CVE-2007-4448 - http://www.securityfocus.com/bid/25359 CVE-2007-4449 - http://aluigi.org/poc/toribashish.zip CVE-2007-4449 - http://securityreason.com/securityalert/3033 +CVE-2007-4449 - http://www.securityfocus.com/bid/25359 CVE-2007-4450 - http://aluigi.org/poc/toribashish.zip CVE-2007-4450 - http://securityreason.com/securityalert/3033 +CVE-2007-4450 - http://www.securityfocus.com/bid/25359 CVE-2007-4451 - http://aluigi.org/poc/toribashish.zip CVE-2007-4451 - http://securityreason.com/securityalert/3033 +CVE-2007-4451 - http://www.securityfocus.com/bid/25359 CVE-2007-4452 - http://aluigi.org/poc/toribashish.zip CVE-2007-4452 - http://securityreason.com/securityalert/3033 +CVE-2007-4452 - http://www.securityfocus.com/bid/25359 CVE-2007-4454 - http://securityreason.com/securityalert/3038 CVE-2007-4456 - https://www.exploit-db.com/exploits/4296 CVE-2007-4459 - http://www.cisco.com/warp/public/707/cisco-sr-20070821-sip.shtml @@ -9921,6 +9968,7 @@ CVE-2007-4825 - http://securityreason.com/securityalert/3119 CVE-2007-4827 - http://www.nessus.org/plugins/index.php?view=single&id=26066 CVE-2007-4832 - http://aluigi.altervista.org/adv/cellfucktor-adv.txt CVE-2007-4832 - http://securityreason.com/securityalert/3130 +CVE-2007-4832 - http://www.securityfocus.com/bid/25625 CVE-2007-4834 - https://www.exploit-db.com/exploits/4387 CVE-2007-4835 - http://securityreason.com/securityalert/3120 CVE-2007-4836 - http://securityreason.com/securityalert/3120 @@ -9928,6 +9976,7 @@ CVE-2007-4837 - http://securityreason.com/securityalert/3121 CVE-2007-4838 - http://aluigi.altervista.org/adv/cellfucktor-adv.txt CVE-2007-4838 - http://aluigi.org/poc/cellfucktor.zip CVE-2007-4838 - http://securityreason.com/securityalert/3130 +CVE-2007-4838 - http://www.securityfocus.com/bid/25625 CVE-2007-4840 - http://securityreason.com/securityalert/3122 CVE-2007-4841 - http://www.vupen.com/english/advisories/2007/3544 CVE-2007-4841 - http://www.vupen.com/english/advisories/2008/0083 @@ -9940,6 +9989,7 @@ CVE-2007-4872 - http://securityreason.com/securityalert/3174 CVE-2007-4873 - http://securityreason.com/securityalert/3173 CVE-2007-4874 - http://securityreason.com/securityalert/3166 CVE-2007-4879 - http://0x90.eu/ff_tls_poc.html +CVE-2007-4879 - http://www.securityfocus.com/bid/28448 CVE-2007-4879 - http://www.ubuntu.com/usn/usn-592-1 CVE-2007-4879 - https://bugzilla.mozilla.org/show_bug.cgi?id=395399 CVE-2007-4880 - http://securityreason.com/securityalert/3184 @@ -10047,6 +10097,7 @@ CVE-2007-5027 - http://securityreason.com/securityalert/3159 CVE-2007-5032 - http://securityreason.com/securityalert/3157 CVE-2007-5033 - http://securityreason.com/securityalert/3158 CVE-2007-5034 - http://www.ubuntu.com/usn/usn-519-1 +CVE-2007-5036 - http://www.securityfocus.com/bid/25715 CVE-2007-5036 - https://www.exploit-db.com/exploits/4426 CVE-2007-5039 - http://securityreason.com/securityalert/3161 CVE-2007-5040 - http://securityreason.com/securityalert/3161 @@ -10147,6 +10198,7 @@ CVE-2007-5180 - http://packetstormsecurity.org/0709-exploits/ohesa-sql.txt CVE-2007-5181 - http://packetstormsecurity.org/0709-exploits/netkamp-sql.txt CVE-2007-5182 - http://packetstormsecurity.org/0709-exploits/netkamp-sql.txt CVE-2007-5183 - http://pridels-team.blogspot.com/2007/10/odysseysuite-internet-banking-vuln.html +CVE-2007-5184 - http://www.securityfocus.com/bid/25871 CVE-2007-5184 - https://www.exploit-db.com/exploits/4478 CVE-2007-5185 - https://www.exploit-db.com/exploits/4477 CVE-2007-5186 - https://www.exploit-db.com/exploits/4476 @@ -10606,6 +10658,7 @@ CVE-2007-6039 - http://securityreason.com/securityalert/3365 CVE-2007-6039 - http://securityreason.com/securityalert/3366 CVE-2007-6041 - http://aluigi.altervista.org/adv/rorbof-adv.txt CVE-2007-6041 - http://aluigi.org/poc/rorbof.zip +CVE-2007-6041 - http://www.securityfocus.com/bid/26502 CVE-2007-6043 - http://www.computerworld.com.au/index.php/id%3B1165210682%3Bfp%3B2%3Bfpid%3B1 CVE-2007-6043 - http://www.computerworld.com.au/index.php/id;1165210682;fp;2;fpid;1 CVE-2007-6055 - http://securityreason.com/securityalert/3379 @@ -10865,6 +10918,7 @@ CVE-2007-6534 - http://securityreason.com/securityalert/3490 CVE-2007-6537 - http://aluigi.altervista.org/adv/winuaebof-adv.txt CVE-2007-6537 - http://aluigi.org/poc/winuaebof.zip CVE-2007-6537 - http://securityreason.com/securityalert/3487 +CVE-2007-6537 - http://www.securityfocus.com/bid/26979 CVE-2007-6538 - http://securityreason.com/securityalert/3492 CVE-2007-6542 - https://www.exploit-db.com/exploits/4764 CVE-2007-6543 - https://www.exploit-db.com/exploits/4791 @@ -10950,6 +11004,7 @@ CVE-2007-6630 - http://securityreason.com/securityalert/3507 CVE-2007-6631 - http://aluigi.altervista.org/adv/libnemesibof-adv.txt CVE-2007-6631 - http://aluigi.org/poc/libnemesibof.zip CVE-2007-6631 - http://securityreason.com/securityalert/3513 +CVE-2007-6631 - http://www.securityfocus.com/bid/27048 CVE-2007-6632 - https://www.exploit-db.com/exploits/4800 CVE-2007-6637 - http://www.vupen.com/english/advisories/2008/1697 CVE-2007-6637 - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9828 @@ -11130,6 +11185,7 @@ CVE-2008-0128 - http://community.ca.com/blogs/casecurityresponseblog/archive/200 CVE-2008-0129 - https://www.exploit-db.com/exploits/4832 CVE-2008-0132 - http://aluigi.altervista.org/adv/pragmassh-adv.txt CVE-2008-0132 - http://aluigi.org/poc/pragmassh.zip +CVE-2008-0132 - http://www.securityfocus.com/bid/27141 CVE-2008-0133 - https://www.exploit-db.com/exploits/4840 CVE-2008-0134 - http://www.packetstormsecurity.org/0801-exploits/snitz-multi.txt CVE-2008-0135 - http://www.packetstormsecurity.org/0801-exploits/snitz-multi.txt @@ -11664,12 +11720,15 @@ CVE-2008-0934 - https://www.exploit-db.com/exploits/5172 CVE-2008-0939 - https://www.exploit-db.com/exploits/5135 CVE-2008-0944 - http://aluigi.altervista.org/adv/ipsimene-adv.txt CVE-2008-0944 - http://securityreason.com/securityalert/3697 +CVE-2008-0944 - http://www.securityfocus.com/bid/27677 CVE-2008-0945 - http://aluigi.altervista.org/adv/ipsimene-adv.txt CVE-2008-0945 - http://aluigi.org/poc/ipsimene.zip CVE-2008-0945 - http://securityreason.com/securityalert/3697 +CVE-2008-0945 - http://www.securityfocus.com/bid/27677 CVE-2008-0946 - http://aluigi.altervista.org/adv/ipsimene-adv.txt CVE-2008-0946 - http://aluigi.org/poc/ipsimene.zip CVE-2008-0946 - http://securityreason.com/securityalert/3697 +CVE-2008-0946 - http://www.securityfocus.com/bid/27677 CVE-2008-0947 - http://securityreason.com/securityalert/3752 CVE-2008-0947 - http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2008-002.txt CVE-2008-0948 - http://securityreason.com/securityalert/3752 @@ -11694,30 +11753,37 @@ CVE-2008-0971 - http://securityreason.com/securityalert/4792 CVE-2008-0973 - http://aluigi.altervista.org/adv/doubletakedown-adv.txt CVE-2008-0973 - http://aluigi.org/poc/doubletakedown.zip CVE-2008-0973 - http://securityreason.com/securityalert/3698 +CVE-2008-0973 - http://www.securityfocus.com/bid/27951 CVE-2008-0973 - http://www.vupen.com/english/advisories/2008/0666 CVE-2008-0974 - http://aluigi.altervista.org/adv/doubletakedown-adv.txt CVE-2008-0974 - http://aluigi.org/poc/doubletakedown.zip CVE-2008-0974 - http://securityreason.com/securityalert/3698 +CVE-2008-0974 - http://www.securityfocus.com/bid/27951 CVE-2008-0974 - http://www.vupen.com/english/advisories/2008/0666 CVE-2008-0975 - http://aluigi.altervista.org/adv/doubletakedown-adv.txt CVE-2008-0975 - http://aluigi.org/poc/doubletakedown.zip CVE-2008-0975 - http://securityreason.com/securityalert/3698 +CVE-2008-0975 - http://www.securityfocus.com/bid/27951 CVE-2008-0975 - http://www.vupen.com/english/advisories/2008/0666 CVE-2008-0976 - http://aluigi.altervista.org/adv/doubletakedown-adv.txt CVE-2008-0976 - http://aluigi.org/poc/doubletakedown.zip CVE-2008-0976 - http://securityreason.com/securityalert/3698 +CVE-2008-0976 - http://www.securityfocus.com/bid/27951 CVE-2008-0976 - http://www.vupen.com/english/advisories/2008/0666 CVE-2008-0977 - http://aluigi.altervista.org/adv/doubletakedown-adv.txt CVE-2008-0977 - http://aluigi.org/poc/doubletakedown.zip CVE-2008-0977 - http://securityreason.com/securityalert/3698 +CVE-2008-0977 - http://www.securityfocus.com/bid/27951 CVE-2008-0977 - http://www.vupen.com/english/advisories/2008/0666 CVE-2008-0978 - http://aluigi.altervista.org/adv/doubletakedown-adv.txt CVE-2008-0978 - http://aluigi.org/poc/doubletakedown.zip CVE-2008-0978 - http://securityreason.com/securityalert/3698 +CVE-2008-0978 - http://www.securityfocus.com/bid/27951 CVE-2008-0978 - http://www.vupen.com/english/advisories/2008/0666 CVE-2008-0979 - http://aluigi.altervista.org/adv/doubletakedown-adv.txt CVE-2008-0979 - http://aluigi.org/poc/doubletakedown.zip CVE-2008-0979 - http://securityreason.com/securityalert/3698 +CVE-2008-0979 - http://www.securityfocus.com/bid/27951 CVE-2008-0979 - http://www.vupen.com/english/advisories/2008/0666 CVE-2008-0980 - http://securityreason.com/securityalert/3699 CVE-2008-0981 - http://securityreason.com/securityalert/3699 @@ -11847,16 +11913,24 @@ CVE-2008-1232 - http://community.ca.com/blogs/casecurityresponseblog/archive/200 CVE-2008-1232 - http://securityreason.com/securityalert/4098 CVE-2008-1232 - http://www.redhat.com/support/errata/RHSA-2008-0862.html CVE-2008-1232 - http://www.vmware.com/security/advisories/VMSA-2009-0016.html +CVE-2008-1233 - http://www.securityfocus.com/bid/28448 CVE-2008-1233 - http://www.ubuntu.com/usn/usn-592-1 +CVE-2008-1234 - http://www.securityfocus.com/bid/28448 CVE-2008-1234 - http://www.ubuntu.com/usn/usn-592-1 CVE-2008-1234 - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9551 +CVE-2008-1235 - http://www.securityfocus.com/bid/28448 CVE-2008-1235 - http://www.ubuntu.com/usn/usn-592-1 +CVE-2008-1236 - http://www.securityfocus.com/bid/28448 CVE-2008-1236 - http://www.ubuntu.com/usn/usn-592-1 +CVE-2008-1237 - http://www.securityfocus.com/bid/28448 CVE-2008-1237 - http://www.ubuntu.com/usn/usn-592-1 CVE-2008-1237 - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9651 +CVE-2008-1238 - http://www.securityfocus.com/bid/28448 CVE-2008-1238 - http://www.ubuntu.com/usn/usn-592-1 CVE-2008-1238 - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9889 +CVE-2008-1240 - http://www.securityfocus.com/bid/28448 CVE-2008-1240 - http://www.ubuntu.com/usn/usn-592-1 +CVE-2008-1241 - http://www.securityfocus.com/bid/28448 CVE-2008-1241 - http://www.ubuntu.com/usn/usn-592-1 CVE-2008-1247 - https://www.exploit-db.com/exploits/5313 CVE-2008-1247 - https://www.exploit-db.com/exploits/5926 @@ -11881,9 +11955,11 @@ CVE-2008-1297 - https://www.exploit-db.com/exploits/5226 CVE-2008-1302 - http://aluigi.altervista.org/adv/perforces-adv.txt CVE-2008-1302 - http://aluigi.org/poc/perforces.zip CVE-2008-1302 - http://securityreason.com/securityalert/3735 +CVE-2008-1302 - http://www.securityfocus.com/bid/28108 CVE-2008-1303 - http://aluigi.altervista.org/adv/perforces-adv.txt CVE-2008-1303 - http://aluigi.org/poc/perforces.zip CVE-2008-1303 - http://securityreason.com/securityalert/3735 +CVE-2008-1303 - http://www.securityfocus.com/bid/28108 CVE-2008-1305 - https://www.exploit-db.com/exploits/5236 CVE-2008-1307 - https://www.exploit-db.com/exploits/5225 CVE-2008-1309 - https://www.exploit-db.com/exploits/5332 @@ -11914,6 +11990,7 @@ CVE-2008-1337 - http://securityreason.com/securityalert/3741 CVE-2008-1338 - http://aluigi.altervista.org/adv/perforces-adv.txt CVE-2008-1338 - http://aluigi.org/poc/perforces.zip CVE-2008-1338 - http://securityreason.com/securityalert/3735 +CVE-2008-1338 - http://www.securityfocus.com/bid/28108 CVE-2008-1340 - http://www.vmware.com/support/ace2/doc/releasenotes_ace2.html CVE-2008-1340 - http://www.vmware.com/support/player2/doc/releasenotes_player2.html CVE-2008-1340 - http://www.vmware.com/support/ws6/doc/releasenotes_ws6.html @@ -12128,20 +12205,27 @@ CVE-2008-1680 - https://www.exploit-db.com/exploits/5295 CVE-2008-1682 - https://www.exploit-db.com/exploits/5345 CVE-2008-1689 - http://aluigi.altervista.org/adv/slmaildos-adv.txt CVE-2008-1689 - http://aluigi.org/poc/slmaildos.zip +CVE-2008-1689 - http://www.securityfocus.com/bid/28505 CVE-2008-1690 - http://aluigi.org/poc/slmaildos.zip +CVE-2008-1690 - http://www.securityfocus.com/bid/28505 CVE-2008-1691 - http://aluigi.altervista.org/adv/slmaildos-adv.txt +CVE-2008-1691 - http://www.securityfocus.com/bid/28505 CVE-2008-1696 - https://www.exploit-db.com/exploits/5347 CVE-2008-1697 - https://www.exploit-db.com/exploits/5342 CVE-2008-1700 - http://www.mwrinfosecurity.com/publications/mwri_interwoven-worksite-activex-control-remote-code-execution_2008-03-10.pdf CVE-2008-1702 - https://www.exploit-db.com/exploits/5308 CVE-2008-1705 - http://aluigi.altervista.org/adv/soliduro-adv.txt CVE-2008-1705 - http://aluigi.org/poc/soliduro.zip +CVE-2008-1705 - http://www.securityfocus.com/bid/28468 CVE-2008-1706 - http://aluigi.altervista.org/adv/soliduro-adv.txt CVE-2008-1706 - http://aluigi.org/poc/soliduro.zip +CVE-2008-1706 - http://www.securityfocus.com/bid/28468 CVE-2008-1707 - http://aluigi.altervista.org/adv/soliduro-adv.txt CVE-2008-1707 - http://aluigi.org/poc/soliduro.zip +CVE-2008-1707 - http://www.securityfocus.com/bid/28468 CVE-2008-1708 - http://aluigi.altervista.org/adv/soliduro-adv.txt CVE-2008-1708 - http://aluigi.org/poc/soliduro.zip +CVE-2008-1708 - http://www.securityfocus.com/bid/28468 CVE-2008-1709 - https://www.exploit-db.com/exploits/5349 CVE-2008-1711 - https://www.exploit-db.com/exploits/5364 CVE-2008-1712 - https://www.exploit-db.com/exploits/5323 @@ -13401,6 +13485,7 @@ CVE-2008-3390 - http://securityreason.com/securityalert/4080 CVE-2008-3390 - https://www.exploit-db.com/exploits/6156 CVE-2008-3396 - http://aluigi.altervista.org/adv/ut2004null-adv.txt CVE-2008-3396 - http://aluigi.org/poc/ut2004null.zip +CVE-2008-3396 - http://www.securityfocus.com/bid/30427 CVE-2008-3398 - http://securityreason.com/securityalert/4081 CVE-2008-3398 - https://www.exploit-db.com/exploits/6131 CVE-2008-3399 - http://securityreason.com/securityalert/4081 @@ -15107,9 +15192,11 @@ CVE-2008-5132 - https://www.exploit-db.com/exploits/7114 CVE-2008-5158 - http://aluigi.org/adv/wincomalpd-adv.txt CVE-2008-5158 - http://aluigi.org/poc/wincomalpd.zip CVE-2008-5158 - http://securityreason.com/securityalert/4610 +CVE-2008-5158 - http://www.securityfocus.com/bid/27614 CVE-2008-5159 - http://aluigi.org/adv/wincomalpd-adv.txt CVE-2008-5159 - http://aluigi.org/poc/wincomalpd.zip CVE-2008-5159 - http://securityreason.com/securityalert/4610 +CVE-2008-5159 - http://www.securityfocus.com/bid/27614 CVE-2008-5160 - http://securityreason.com/securityalert/4609 CVE-2008-5160 - https://www.exploit-db.com/exploits/5184 CVE-2008-5161 - http://isc.sans.org/diary.html?storyid=5366 @@ -15135,6 +15222,7 @@ CVE-2008-5175 - http://vuln.sg/aceftp3803-en.html CVE-2008-5176 - http://aluigi.org/adv/wincomalpd-adv.txt CVE-2008-5176 - http://aluigi.org/poc/wincomalpd.zip CVE-2008-5176 - http://securityreason.com/securityalert/4610 +CVE-2008-5176 - http://www.securityfocus.com/bid/27614 CVE-2008-5177 - http://www.insight-tech.org/index.php?p=Yosemite-backup-8-7-DtbClsLogin-Buffer-Overflow-Vulnerability CVE-2008-5178 - https://www.exploit-db.com/exploits/7135 CVE-2008-5180 - https://www.exploit-db.com/exploits/7262 @@ -15250,8 +15338,10 @@ CVE-2008-5276 - http://securityreason.com/securityalert/4680 CVE-2008-5278 - http://securityreason.com/securityalert/4662 CVE-2008-5279 - http://aluigi.altervista.org/adv/zilabzcsx-adv.txt CVE-2008-5279 - http://aluigi.org/poc/zilabzcsx.zip +CVE-2008-5279 - http://www.securityfocus.com/bid/27940 CVE-2008-5280 - http://aluigi.altervista.org/adv/zilabzcsx-adv.txt CVE-2008-5280 - http://aluigi.org/poc/zilabzcsx.zip +CVE-2008-5280 - http://www.securityfocus.com/bid/27940 CVE-2008-5281 - http://packetstormsecurity.org/0802-exploits/titan-heap-py.txt CVE-2008-5282 - http://securityreason.com/securityalert/4657 CVE-2008-5284 - http://aluigi.altervista.org/adv/emerdal-adv.txt @@ -16454,10 +16544,13 @@ CVE-2008-6668 - https://www.exploit-db.com/exploits/5856 CVE-2008-6669 - https://www.exploit-db.com/exploits/5856 CVE-2008-6670 - http://aluigi.altervista.org/adv/sunagex-adv.txt CVE-2008-6670 - http://aluigi.org/poc/sunagex.zip +CVE-2008-6670 - http://www.securityfocus.com/bid/29889 CVE-2008-6671 - http://aluigi.altervista.org/adv/sunagex-adv.txt CVE-2008-6671 - http://aluigi.org/poc/sunagex.zip +CVE-2008-6671 - http://www.securityfocus.com/bid/29889 CVE-2008-6672 - http://aluigi.altervista.org/adv/sunagex-adv.txt CVE-2008-6672 - http://aluigi.org/poc/sunagex.zip +CVE-2008-6672 - http://www.securityfocus.com/bid/29889 CVE-2008-6679 - http://www.openwall.com/lists/oss-security/2009/04/01/10 CVE-2008-6679 - https://bugzilla.redhat.com/show_bug.cgi?id=493445 CVE-2008-6683 - https://www.exploit-db.com/exploits/6956 @@ -16677,6 +16770,7 @@ CVE-2008-6994 - http://www.infoworld.com/d/security-central/critical-vulnerabili CVE-2008-6994 - https://www.exploit-db.com/exploits/6365 CVE-2008-6994 - https://www.exploit-db.com/exploits/6367 CVE-2008-6995 - http://evilfingers.com/advisory/google_chrome_poc.php +CVE-2008-6995 - http://www.securityfocus.com/bid/30983 CVE-2008-6995 - https://www.evilfingers.com/advisory/Google_Chrome_Browser_0.2.149.27_in_chrome_dll.php CVE-2008-6995 - https://www.exploit-db.com/exploits/6353 CVE-2008-6996 - https://www.exploit-db.com/exploits/6355 @@ -20132,6 +20226,7 @@ CVE-2010-1271 - http://packetstormsecurity.org/1003-exploits/smartplugs-sql.txt CVE-2010-1272 - http://packetstormsecurity.org/1003-exploits/gnattgp-rfi.txt CVE-2010-1272 - http://www.exploit-db.com/exploits/11621 CVE-2010-1277 - http://legalhackers.com/advisories/zabbix181api-sql.txt +CVE-2010-1277 - http://www.securityfocus.com/bid/39148 CVE-2010-1280 - http://www.zeroscience.mk/codes/shockwave_mem.txt CVE-2010-1280 - http://www.zeroscience.mk/en/vulnerabilities/ZSL-2010-4937.php CVE-2010-1296 - http://www.exploit-db.com/exploits/12751 @@ -20931,6 +21026,7 @@ CVE-2010-2618 - http://packetstormsecurity.org/1006-exploits/adaptcms200-rfi.txt CVE-2010-2618 - http://www.exploit-db.com/exploits/14016 CVE-2010-2621 - http://aluigi.org/adv/qtsslame-adv.txt CVE-2010-2621 - http://aluigi.org/poc/qtsslame.zip +CVE-2010-2621 - http://www.securityfocus.com/bid/41250 CVE-2010-2632 - http://securityreason.com/achievement_securityalert/89 CVE-2010-2632 - http://securityreason.com/achievement_securityalert/97 CVE-2010-2632 - http://www.oracle.com/technetwork/topics/security/cpujan2011-194091.html @@ -24270,6 +24366,7 @@ CVE-2011-4855 - http://xss.cx/kb/parallels/xss-parallelspleskpanel.v10.4.4_build CVE-2011-4856 - http://xss.cx/kb/parallels/xss-parallelspleskpanel.v10.4.4_build20111103.18-os_windows-2003-2008-reflected-cross-site-scripting-cwe79-capec86-javascript-injection-example-poc-report.html CVE-2011-4857 - http://forums.winamp.com/showthread.php?t=332010 CVE-2011-4858 - http://www.ocert.org/advisories/ocert-2011-003.html +CVE-2011-4858 - http://www.securityfocus.com/bid/51200 CVE-2011-4858 - https://github.com/FireFart/HashCollision-DOS-POC/blob/master/HashtablePOC.py CVE-2011-4873 - http://aluigi.altervista.org/adv/atvise_1-adv.txt CVE-2011-4885 - http://www.exploit-db.com/exploits/18305 @@ -24277,6 +24374,7 @@ CVE-2011-4885 - http://www.mandriva.com/security/advisories?name=MDVSA-2013:150 CVE-2011-4885 - http://www.ocert.org/advisories/ocert-2011-003.html CVE-2011-4885 - http://www.oracle.com/technetwork/topics/security/cpujul2012-392727.html CVE-2011-4885 - http://www.redhat.com/support/errata/RHSA-2012-0019.html +CVE-2011-4885 - http://www.securityfocus.com/bid/51193 CVE-2011-4885 - https://github.com/FireFart/HashCollision-DOS-POC/blob/master/HashtablePOC.py CVE-2011-4898 - http://www.exploit-db.com/exploits/18417 CVE-2011-4899 - http://www.exploit-db.com/exploits/18417 @@ -26489,6 +26587,7 @@ CVE-2012-4928 - http://packetstormsecurity.org/files/110046/Oxwall-1.1.1-Cross-S CVE-2012-4929 - http://security.stackexchange.com/questions/19911/crime-how-to-beat-the-beast-successor CVE-2012-4929 - http://threatpost.com/en_us/blogs/crime-attack-uses-compression-ratio-tls-requests-side-channel-hijack-secure-sessions-091312 CVE-2012-4929 - http://threatpost.com/en_us/blogs/new-attack-uses-ssltls-information-leak-hijack-https-sessions-090512 +CVE-2012-4929 - http://www.securityfocus.com/bid/55704 CVE-2012-4929 - http://www.theregister.co.uk/2012/09/14/crime_tls_attack/ CVE-2012-4929 - http://www.ubuntu.com/usn/USN-1898-1 CVE-2012-4929 - https://community.qualys.com/blogs/securitylabs/2012/09/14/crime-information-leakage-attack-against-ssltls @@ -27072,6 +27171,7 @@ CVE-2013-0169 - https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US& CVE-2013-0175 - https://github.com/sferik/multi_xml/pull/34 CVE-2013-0177 - http://packetstormsecurity.com/files/119673/Apache-OFBiz-Cross-Site-Scripting.html CVE-2013-0182 - http://drupalcode.org/project/payment.git/commitdiff/62c9186 +CVE-2013-0183 - https://groups.google.com/forum/#%21topic/rack-devel/7ZKPNAjgRSs CVE-2013-0191 - http://sourceforge.net/p/pam-pgsql/bugs/13/ CVE-2013-0200 - http://www.ubuntu.com/usn/USN-1981-1 CVE-2013-0213 - https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05115993 @@ -28592,6 +28692,7 @@ CVE-2013-3245 - http://seclists.org/fulldisclosure/2013/Jul/77 CVE-2013-3245 - http://seclists.org/fulldisclosure/2013/Jul/79 CVE-2013-3245 - http://secunia.com/blog/372/ CVE-2013-3245 - http://www.jbkempf.com/blog/post/2013/More-lies-from-Secunia +CVE-2013-3245 - http://www.securityfocus.com/bid/61032 CVE-2013-3281 - http://www.kb.cert.org/vuls/id/466876 CVE-2013-3294 - http://packetstormsecurity.com/files/121643/Exponent-CMS-2.2.0-Beta-3-LFI-SQL-Injection.html CVE-2013-3294 - http://seclists.org/bugtraq/2013/May/57 @@ -28628,6 +28729,7 @@ CVE-2013-3502 - http://www.kb.cert.org/vuls/id/345260 CVE-2013-3503 - http://www.kb.cert.org/vuls/id/345260 CVE-2013-3504 - http://www.kb.cert.org/vuls/id/345260 CVE-2013-3505 - http://www.kb.cert.org/vuls/id/345260 +CVE-2013-3505 - http://www.securityfocus.com/bid/58410 CVE-2013-3506 - http://www.kb.cert.org/vuls/id/345260 CVE-2013-3507 - http://www.kb.cert.org/vuls/id/345260 CVE-2013-3508 - http://www.kb.cert.org/vuls/id/345260 @@ -28706,6 +28808,7 @@ CVE-2013-3630 - http://packetstormsecurity.com/files/164479/Moodle-Authenticated CVE-2013-3630 - https://community.rapid7.com/community/metasploit/blog/2013/10/30/seven-tricks-and-treats CVE-2013-3631 - http://www.kb.cert.org/vuls/id/326830 CVE-2013-3631 - https://community.rapid7.com/community/metasploit/blog/2013/10/30/seven-tricks-and-treats +CVE-2013-3632 - http://www.securityfocus.com/bid/62873 CVE-2013-3632 - https://community.rapid7.com/community/metasploit/blog/2013/10/30/seven-tricks-and-treats CVE-2013-3635 - http://packetstormsecurity.com/files/122341/Project-Pier-0.8.8-XSS-Insecure-Cookies.html CVE-2013-3636 - http://packetstormsecurity.com/files/122341/Project-Pier-0.8.8-XSS-Insecure-Cookies.html @@ -29218,6 +29321,7 @@ CVE-2013-5014 - http://www.exploit-db.com/exploits/31853 CVE-2013-5014 - http://www.exploit-db.com/exploits/31917 CVE-2013-5015 - http://www.exploit-db.com/exploits/31853 CVE-2013-5015 - http://www.exploit-db.com/exploits/31917 +CVE-2013-5015 - http://www.securityfocus.com/bid/65467 CVE-2013-5019 - https://www.exploit-db.com/exploits/44472/ CVE-2013-5023 - http://digital.ni.com/public.nsf/allkb/E6BC4F119D49A97A86257BD3004FE019?OpenDocument CVE-2013-5024 - http://digital.ni.com/public.nsf/allkb/548965C170D6AA2586257BD3004B146B?OpenDocument @@ -31111,6 +31215,8 @@ CVE-2014-1620 - http://packetstormsecurity.com/files/124681/Hiox-Guest-Book-5.0- CVE-2014-1635 - https://labs.integrity.pt/advisories/cve-2014-1635/ CVE-2014-1636 - http://packetstormsecurity.com/files/124708/Command-School-Student-Management-System-1.06.01-SQL-Injection-CSRF-XSS.html CVE-2014-1637 - http://packetstormsecurity.com/files/124708/Command-School-Student-Management-System-1.06.01-SQL-Injection-CSRF-XSS.html +CVE-2014-1644 - http://www.securityfocus.com/bid/66399 +CVE-2014-1645 - http://www.securityfocus.com/bid/66400 CVE-2014-1648 - http://seclists.org/fulldisclosure/2014/Apr/256 CVE-2014-1665 - https://packetstormsecurity.com/files/125086 CVE-2014-1665 - https://www.exploit-db.com/exploits/31427/ @@ -31151,6 +31257,7 @@ CVE-2014-1827 - http://www.madirish.net/559 CVE-2014-1828 - http://www.madirish.net/559 CVE-2014-1833 - http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=737160 CVE-2014-1836 - http://seclists.org/fulldisclosure/2014/Feb/14 +CVE-2014-1836 - http://www.securityfocus.com/bid/65279 CVE-2014-1836 - https://github.com/pedrib/PoC/blob/master/generic/impresscms-1.3.5.txt CVE-2014-1840 - http://osandamalith.wordpress.com/2014/02/02/mybb-1-6-12-post-xss-0day/ CVE-2014-1840 - http://packetstormsecurity.com/files/125038/MyBB-1.6.12-POST-Cross-Site-Scripting.html @@ -31569,6 +31676,7 @@ CVE-2014-2729 - http://packetstormsecurity.com/files/126187/Ektron-CMS-8.7-Cross CVE-2014-2734 - http://packetstormsecurity.com/files/126218/Ruby-OpenSSL-Private-Key-Spoofing.html CVE-2014-2734 - http://seclists.org/fulldisclosure/2014/Apr/231 CVE-2014-2734 - http://seclists.org/fulldisclosure/2014/May/13 +CVE-2014-2734 - http://www.securityfocus.com/bid/66956 CVE-2014-2734 - https://gist.github.com/emboss/91696b56cd227c8a0c13 CVE-2014-2734 - https://news.ycombinator.com/item?id=7601973 CVE-2014-2734 - https://www.ruby-lang.org/en/news/2014/05/09/dispute-of-vulnerability-cve-2014-2734/ @@ -31983,6 +32091,7 @@ CVE-2014-3704 - http://www.exploit-db.com/exploits/34984 CVE-2014-3704 - http://www.exploit-db.com/exploits/34993 CVE-2014-3704 - http://www.exploit-db.com/exploits/35150 CVE-2014-3704 - http://www.openwall.com/lists/oss-security/2014/10/15/23 +CVE-2014-3704 - http://www.securityfocus.com/bid/70595 CVE-2014-3704 - https://www.sektioneins.de/en/advisories/advisory-012014-drupal-pre-auth-sql-injection-vulnerability.html CVE-2014-3704 - https://www.sektioneins.de/en/blog/14-11-03-drupal-sql-injection-vulnerability-PoC.html CVE-2014-3707 - http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html @@ -32629,6 +32738,7 @@ CVE-2014-4870 - http://www.kb.cert.org/vuls/id/111588 CVE-2014-4871 - http://www.kb.cert.org/vuls/id/941108 CVE-2014-4872 - http://packetstormsecurity.com/files/128594/BMC-Track-it-Remote-Code-Execution-SQL-Injection.html CVE-2014-4873 - http://packetstormsecurity.com/files/128594/BMC-Track-it-Remote-Code-Execution-SQL-Injection.html +CVE-2014-4873 - http://www.securityfocus.com/bid/70268 CVE-2014-4874 - http://packetstormsecurity.com/files/128594/BMC-Track-it-Remote-Code-Execution-SQL-Injection.html CVE-2014-4875 - http://www.kb.cert.org/vuls/id/301788 CVE-2014-4875 - http://www.kb.cert.org/vuls/id/JLAD-9X4SPN @@ -32918,6 +33028,7 @@ CVE-2014-5377 - http://seclists.org/fulldisclosure/2014/Aug/75 CVE-2014-5377 - http://seclists.org/fulldisclosure/2014/Aug/76 CVE-2014-5377 - http://seclists.org/fulldisclosure/2014/Aug/84 CVE-2014-5377 - http://www.exploit-db.com/exploits/34449 +CVE-2014-5377 - http://www.securityfocus.com/bid/69443 CVE-2014-5380 - http://packetstormsecurity.com/files/128003/Grand-MA-300-Fingerprint-Reader-Weak-PIN-Verification.html CVE-2014-5380 - http://seclists.org/fulldisclosure/2014/Aug/70 CVE-2014-5381 - http://packetstormsecurity.com/files/128003/Grand-MA-300-Fingerprint-Reader-Weak-PIN-Verification.html @@ -32947,9 +33058,11 @@ CVE-2014-5440 - http://packetstormsecurity.com/files/128064/MX-SmartTimer-13.18. CVE-2014-5441 - http://packetstormsecurity.com/files/127978/Fatt-Free-CRM-Cross-Site-Scripting.html CVE-2014-5445 - http://packetstormsecurity.com/files/129336/ManageEngine-Netflow-Analyzer-IT360-File-Download.html CVE-2014-5445 - http://seclists.org/fulldisclosure/2014/Dec/9 +CVE-2014-5445 - http://www.securityfocus.com/bid/71404 CVE-2014-5445 - https://github.com/rapid7/metasploit-framework/pull/4282 CVE-2014-5446 - http://packetstormsecurity.com/files/129336/ManageEngine-Netflow-Analyzer-IT360-File-Download.html CVE-2014-5446 - http://seclists.org/fulldisclosure/2014/Dec/9 +CVE-2014-5446 - http://www.securityfocus.com/bid/71404 CVE-2014-5451 - http://packetstormsecurity.com/files/128302/MODX-Revolution-2.3.1-pl-Cross-Site-Scripting.html CVE-2014-5453 - http://www.zeroscience.mk/en/vulnerabilities/ZSL-2014-5191.php CVE-2014-5454 - http://packetstormsecurity.com/files/127866/SAS-Visual-Analytics-6.4M1-Arbitrary-File-Upload.html @@ -36299,6 +36412,7 @@ CVE-2014-7859 - http://packetstormsecurity.com/files/132075/D-Link-Bypass-Buffer CVE-2014-7860 - http://packetstormsecurity.com/files/132075/D-Link-Bypass-Buffer-Overflow.html CVE-2014-7862 - http://packetstormsecurity.com/files/129769/Desktop-Central-Add-Administrator.html CVE-2014-7862 - http://seclists.org/fulldisclosure/2015/Jan/2 +CVE-2014-7862 - http://www.securityfocus.com/bid/71849 CVE-2014-7862 - https://github.com/pedrib/PoC/blob/master/advisories/ManageEngine/me_dc9_admin.txt CVE-2014-7862 - https://www.rapid7.com/db/modules/auxiliary/admin/http/manage_engine_dc_create_admin CVE-2014-7863 - http://packetstormsecurity.com/files/130162/ManageEngine-File-Download-Content-Disclosure-SQL-Injection.html @@ -36309,6 +36423,7 @@ CVE-2014-7866 - http://packetstormsecurity.com/files/129037/ManageEngine-OpManag CVE-2014-7866 - http://seclists.org/fulldisclosure/2014/Nov/21 CVE-2014-7868 - http://packetstormsecurity.com/files/129037/ManageEngine-OpManager-Social-IT-Plus-IT360-File-Upload-SQL-Injection.html CVE-2014-7868 - http://seclists.org/fulldisclosure/2014/Nov/21 +CVE-2014-7868 - http://www.securityfocus.com/bid/71002 CVE-2014-7870 - http://seclists.org/fulldisclosure/2014/Apr/41 CVE-2014-7871 - http://packetstormsecurity.com/files/129020/OX-App-Suite-7.6.0-SQL-Injection.html CVE-2014-7872 - http://packetstormsecurity.com/files/135841/Comodo-Internet-Security-VNC-Server-Exposure.html @@ -36425,6 +36540,7 @@ CVE-2014-8146 - http://seclists.org/fulldisclosure/2015/May/14 CVE-2014-8146 - http://www.kb.cert.org/vuls/id/602540 CVE-2014-8146 - http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html CVE-2014-8146 - http://www.oracle.com/technetwork/topics/security/cpuoct2015-2367953.html +CVE-2014-8146 - http://www.securityfocus.com/bid/74457 CVE-2014-8146 - https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html CVE-2014-8147 - http://bugs.icu-project.org/trac/changeset/37080 CVE-2014-8147 - http://openwall.com/lists/oss-security/2015/05/05/6 @@ -36432,6 +36548,7 @@ CVE-2014-8147 - http://seclists.org/fulldisclosure/2015/May/14 CVE-2014-8147 - http://www.kb.cert.org/vuls/id/602540 CVE-2014-8147 - http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html CVE-2014-8147 - http://www.oracle.com/technetwork/topics/security/cpuoct2015-2367953.html +CVE-2014-8147 - http://www.securityfocus.com/bid/74457 CVE-2014-8147 - https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html CVE-2014-8150 - http://www.oracle.com/technetwork/topics/security/bulletinjan2015-2370101.html CVE-2014-8150 - http://www.oracle.com/technetwork/topics/security/cpuoct2015-2367953.html @@ -36612,6 +36729,7 @@ CVE-2014-8498 - http://www.securityfocus.com/bid/71016 CVE-2014-8499 - http://packetstormsecurity.com/files/129036/Password-Manager-Pro-SQL-Injection.html CVE-2014-8499 - http://seclists.org/fulldisclosure/2014/Nov/18 CVE-2014-8499 - http://www.exploit-db.com/exploits/35210 +CVE-2014-8499 - http://www.securityfocus.com/bid/71018 CVE-2014-8500 - http://www.kb.cert.org/vuls/id/264212 CVE-2014-8500 - http://www.oracle.com/technetwork/topics/security/bulletinjan2015-2370101.html CVE-2014-8500 - http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html @@ -37199,6 +37317,7 @@ CVE-2014-9495 - http://www.oracle.com/technetwork/topics/security/bulletinjul201 CVE-2014-9496 - http://www.oracle.com/technetwork/topics/security/bulletinjan2015-2370101.html CVE-2014-9512 - http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html CVE-2014-9512 - http://www.ubuntu.com/usn/USN-2879-1 +CVE-2014-9515 - http://www.securityfocus.com/bid/107970 CVE-2014-9515 - https://github.com/DozerMapper/dozer/issues/217 CVE-2014-9515 - https://github.com/pentestingforfunandprofit/research/tree/master/dozer-rce CVE-2014-9515 - https://www.oracle.com/security-alerts/cpuApr2021.html @@ -37455,6 +37574,7 @@ CVE-2015-0065 - https://www.exploit-db.com/exploits/37966/ CVE-2015-0072 - http://innerht.ml/blog/ie-uxss.html CVE-2015-0072 - http://packetstormsecurity.com/files/130308/Microsoft-Internet-Explorer-Universal-XSS-Proof-Of-Concept.html CVE-2015-0072 - http://www.pcworld.com/article/2879372/dangerous-ie-vulnerability-opens-door-to-powerful-phishing-attacks.html +CVE-2015-0072 - http://www.securityfocus.com/bid/72489 CVE-2015-0072 - https://nakedsecurity.sophos.com/2015/02/04/internet-explorer-has-a-cross-site-scripting-zero-day-bug/ CVE-2015-0097 - https://www.exploit-db.com/exploits/37657/ CVE-2015-0138 - http://www-01.ibm.com/support/docview.wss?uid=swg21883640 @@ -39898,6 +40018,7 @@ CVE-2015-4427 - http://packetstormsecurity.com/files/132105/Ektron-CMS-9.10-SP1- CVE-2015-4453 - http://packetstormsecurity.com/files/132368/OpenEMR-4.2.0-Authentication-Bypass.html CVE-2015-4455 - http://packetstormsecurity.com/files/132256/WordPress-Aviary-Image-Editor-Add-On-For-Gravity-Forms-3.0-Beta-Shell-Upload.html CVE-2015-4459 - https://hackerone.com/reports/66724 +CVE-2015-4460 - http://www.securityfocus.com/bid/75569 CVE-2015-4460 - https://packetstormsecurity.com/files/132475/C2Box-4.0.0-r19171-Cross-Site-Request-Forgery.html CVE-2015-4460 - https://raw.githubusercontent.com/Siros96/CSRF/master/PoC CVE-2015-4460 - https://www.exploit-db.com/exploits/37447/ @@ -40094,9 +40215,11 @@ CVE-2015-4633 - https://packetstormsecurity.com/files/132458/Koha-ILS-3.20.x-CSR CVE-2015-4633 - https://seclists.org/fulldisclosure/2015/Jun/80 CVE-2015-4633 - https://www.exploit-db.com/exploits/37387/ CVE-2015-4640 - http://www.kb.cert.org/vuls/id/155412 +CVE-2015-4640 - http://www.securityfocus.com/bid/75347 CVE-2015-4640 - https://github.com/nowsecure/samsung-ime-rce-poc/ CVE-2015-4640 - https://www.nowsecure.com/blog/2015/06/16/remote-code-execution-as-system-user-on-samsung-phones/ CVE-2015-4641 - http://www.kb.cert.org/vuls/id/155412 +CVE-2015-4641 - http://www.securityfocus.com/bid/75353 CVE-2015-4641 - https://github.com/nowsecure/samsung-ime-rce-poc/ CVE-2015-4641 - https://www.nowsecure.com/blog/2015/06/16/remote-code-execution-as-system-user-on-samsung-phones/ CVE-2015-4642 - https://bugs.php.net/bug.php?id=69646 @@ -42223,6 +42346,7 @@ CVE-2015-8370 - http://hmarco.org/bugs/CVE-2015-8370-Grub2-authentication-bypass CVE-2015-8370 - http://packetstormsecurity.com/files/134831/Grub2-Authentication-Bypass.html CVE-2015-8370 - http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html CVE-2015-8370 - http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html +CVE-2015-8370 - http://www.securityfocus.com/bid/79358 CVE-2015-8371 - https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/composer/composer/CVE-2015-8371.yml CVE-2015-8374 - http://www.oracle.com/technetwork/topics/security/ovmbulletinoct2016-3090547.html CVE-2015-8374 - http://www.ubuntu.com/usn/USN-2886-1 @@ -43259,7 +43383,9 @@ CVE-2016-0448 - http://www.oracle.com/technetwork/topics/security/cpujan2016-236 CVE-2016-0448 - http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html CVE-2016-0449 - http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html CVE-2016-0450 - http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html +CVE-2016-0450 - http://www.securityfocus.com/bid/81117 CVE-2016-0451 - http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html +CVE-2016-0451 - http://www.securityfocus.com/bid/81125 CVE-2016-0452 - http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html CVE-2016-0453 - http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html CVE-2016-0454 - http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html @@ -43989,13 +44115,16 @@ CVE-2016-10165 - http://www.oracle.com/technetwork/security-advisory/cpuoct2017- CVE-2016-10165 - https://usn.ubuntu.com/3770-1/ CVE-2016-10173 - https://github.com/halostatue/minitar/issues/16 CVE-2016-10174 - http://seclists.org/fulldisclosure/2016/Dec/72 +CVE-2016-10174 - http://www.securityfocus.com/bid/95867 CVE-2016-10174 - https://raw.githubusercontent.com/pedrib/PoC/master/advisories/netgear-wnr2000.txt CVE-2016-10174 - https://www.exploit-db.com/exploits/40949/ CVE-2016-10174 - https://www.exploit-db.com/exploits/41719/ CVE-2016-10175 - http://seclists.org/fulldisclosure/2016/Dec/72 +CVE-2016-10175 - http://www.securityfocus.com/bid/95867 CVE-2016-10175 - https://raw.githubusercontent.com/pedrib/PoC/master/advisories/netgear-wnr2000.txt CVE-2016-10175 - https://www.exploit-db.com/exploits/40949/ CVE-2016-10176 - http://seclists.org/fulldisclosure/2016/Dec/72 +CVE-2016-10176 - http://www.securityfocus.com/bid/95867 CVE-2016-10176 - https://raw.githubusercontent.com/pedrib/PoC/master/advisories/netgear-wnr2000.txt CVE-2016-10176 - https://www.exploit-db.com/exploits/40949/ CVE-2016-10177 - https://pierrekim.github.io/blog/2016-09-28-dlink-dwr-932b-lte-routers-vulnerabilities.html @@ -46440,6 +46569,7 @@ CVE-2016-4071 - https://www.exploit-db.com/exploits/39645/ CVE-2016-4072 - https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05390722 CVE-2016-4074 - https://github.com/NixOS/nixpkgs/pull/18908 CVE-2016-4075 - http://abhikafle.com.np/opera-url-spoofing-poc/ +CVE-2016-4075 - http://www.securityfocus.com/bid/98004 CVE-2016-4078 - http://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.html CVE-2016-4079 - http://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.html CVE-2016-4080 - http://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.html @@ -46899,6 +47029,7 @@ CVE-2016-5195 - http://seclists.org/fulldisclosure/2024/Aug/35 CVE-2016-5195 - http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20161026-linux CVE-2016-5195 - http://www.openwall.com/lists/oss-security/2022/03/07/1 CVE-2016-5195 - http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html +CVE-2016-5195 - http://www.securityfocus.com/bid/93793 CVE-2016-5195 - http://www.ubuntu.com/usn/USN-3106-1 CVE-2016-5195 - https://bugzilla.redhat.com/show_bug.cgi?id=1384344 CVE-2016-5195 - https://github.com/dirtycow/dirtycow.github.io/wiki/PoCs @@ -47008,6 +47139,7 @@ CVE-2016-5330 - https://securify.nl/advisory/SFY20151201/dll_side_loading_vulner CVE-2016-5331 - http://packetstormsecurity.com/files/138211/VMware-vSphere-Hypervisor-ESXi-HTTP-Response-Injection.html CVE-2016-5331 - http://seclists.org/fulldisclosure/2016/Aug/38 CVE-2016-5333 - http://www.theregister.co.uk/2016/08/16/vmware_shipped_public_key_with_its_photon_osforcontainers/ +CVE-2016-5346 - http://www.securityfocus.com/bid/97371 CVE-2016-5346 - https://github.com/ele7enxxh/poc-exp/tree/master/CVE-2016-5346 CVE-2016-5348 - https://www.exploit-db.com/exploits/40502/ CVE-2016-5350 - http://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.html @@ -47713,18 +47845,22 @@ CVE-2016-6599 - http://seclists.org/fulldisclosure/2018/Jan/92 CVE-2016-6599 - https://github.com/pedrib/PoC/blob/master/advisories/bmc-track-it-11.4.txt CVE-2016-6600 - http://packetstormsecurity.com/files/138244/WebNMS-Framework-5.2-SP1-Traversal-Weak-Obfuscation-User-Impersonation.html CVE-2016-6600 - http://seclists.org/fulldisclosure/2016/Aug/54 +CVE-2016-6600 - http://www.securityfocus.com/bid/92402 CVE-2016-6600 - https://github.com/pedrib/PoC/blob/master/advisories/webnms-5.2-sp1-pwn.txt CVE-2016-6600 - https://www.exploit-db.com/exploits/40229/ CVE-2016-6601 - http://packetstormsecurity.com/files/138244/WebNMS-Framework-5.2-SP1-Traversal-Weak-Obfuscation-User-Impersonation.html CVE-2016-6601 - http://seclists.org/fulldisclosure/2016/Aug/54 +CVE-2016-6601 - http://www.securityfocus.com/bid/92402 CVE-2016-6601 - https://github.com/pedrib/PoC/blob/master/advisories/webnms-5.2-sp1-pwn.txt CVE-2016-6601 - https://www.exploit-db.com/exploits/40229/ CVE-2016-6602 - http://packetstormsecurity.com/files/138244/WebNMS-Framework-5.2-SP1-Traversal-Weak-Obfuscation-User-Impersonation.html CVE-2016-6602 - http://seclists.org/fulldisclosure/2016/Aug/54 +CVE-2016-6602 - http://www.securityfocus.com/bid/92402 CVE-2016-6602 - https://github.com/pedrib/PoC/blob/master/advisories/webnms-5.2-sp1-pwn.txt CVE-2016-6602 - https://www.exploit-db.com/exploits/40229/ CVE-2016-6603 - http://packetstormsecurity.com/files/138244/WebNMS-Framework-5.2-SP1-Traversal-Weak-Obfuscation-User-Impersonation.html CVE-2016-6603 - http://seclists.org/fulldisclosure/2016/Aug/54 +CVE-2016-6603 - http://www.securityfocus.com/bid/92402 CVE-2016-6603 - https://github.com/pedrib/PoC/blob/master/advisories/webnms-5.2-sp1-pwn.txt CVE-2016-6603 - https://www.exploit-db.com/exploits/40229/ CVE-2016-6615 - http://www.securityfocus.com/bid/95041 @@ -48634,11 +48770,13 @@ CVE-2016-9443 - http://www.securityfocus.com/bid/94407 CVE-2016-9443 - https://github.com/tats/w3m/blob/master/ChangeLog CVE-2016-9445 - http://www.openwall.com/lists/oss-security/2016/11/18/12 CVE-2016-9445 - http://www.openwall.com/lists/oss-security/2016/11/18/13 +CVE-2016-9445 - http://www.securityfocus.com/bid/94421 CVE-2016-9445 - https://bugzilla.gnome.org/show_bug.cgi?id=774533 CVE-2016-9445 - https://cgit.freedesktop.org/gstreamer/gst-plugins-bad/commit/gst/vmnc/vmncdec.c?id=4cb1bcf1422bbcd79c0f683edb7ee85e3f7a31fe CVE-2016-9445 - https://scarybeastsecurity.blogspot.de/2016/11/0day-poc-risky-design-decisions-in.html CVE-2016-9446 - http://www.openwall.com/lists/oss-security/2016/11/18/12 CVE-2016-9446 - http://www.openwall.com/lists/oss-security/2016/11/18/13 +CVE-2016-9446 - http://www.securityfocus.com/bid/94423 CVE-2016-9446 - https://bugzilla.gnome.org/show_bug.cgi?id=774533 CVE-2016-9446 - https://cgit.freedesktop.org/gstreamer/gst-plugins-bad/commit/gst/vmnc/vmncdec.c?id=4cb1bcf1422bbcd79c0f683edb7ee85e3f7a31fe CVE-2016-9446 - https://scarybeastsecurity.blogspot.de/2016/11/0day-poc-risky-design-decisions-in.html @@ -53316,6 +53454,12 @@ CVE-2017-20279 - https://www.exploit-db.com/exploits/42113 CVE-2017-20280 - https://www.exploit-db.com/exploits/41930 CVE-2017-20281 - https://www.exploit-db.com/exploits/41663 CVE-2017-20282 - https://www.exploit-db.com/exploits/41642 +CVE-2017-2090 - http://www.securityfocus.com/bid/96429 +CVE-2017-2091 - http://www.securityfocus.com/bid/96429 +CVE-2017-2092 - http://www.securityfocus.com/bid/96429 +CVE-2017-2093 - http://www.securityfocus.com/bid/96429 +CVE-2017-2094 - http://www.securityfocus.com/bid/96429 +CVE-2017-2095 - http://www.securityfocus.com/bid/96429 CVE-2017-2096 - http://jvn.jp/en/jp/JVN50197114/index.html CVE-2017-2122 - https://www.tenable.com/security/tns-2017-01 CVE-2017-2137 - https://kb.netgear.com/000038443/Security-Advisory-for-Insecure-SOAP-Access-in-ProSAFE-Plus-Configuration-Utility-PSV-2017-1997 @@ -53435,6 +53579,7 @@ CVE-2017-2662 - https://access.redhat.com/errata/RHSA-2021:1313 CVE-2017-2671 - https://github.com/danieljiang0415/android_kernel_crash_poc CVE-2017-2671 - https://twitter.com/danieljiang0415/status/845116665184497664 CVE-2017-2671 - https://www.exploit-db.com/exploits/42135/ +CVE-2017-2699 - http://www.securityfocus.com/bid/96424 CVE-2017-2711 - http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20170118-03-smartphone-en CVE-2017-2741 - https://www.exploit-db.com/exploits/42176/ CVE-2017-2741 - https://www.exploit-db.com/exploits/45273/ @@ -54280,6 +54425,7 @@ CVE-2017-5358 - https://www.exploit-db.com/exploits/41425/ CVE-2017-5359 - http://hyp3rlinx.altervista.org/advisories/EASYCOM-SQL-IPLUG-DENIAL-OF-SERVICE.txt CVE-2017-5359 - http://packetstormsecurity.com/files/141300/EasyCom-SQL-iPlug-Denial-Of-Service.html CVE-2017-5359 - http://seclists.org/fulldisclosure/2017/Feb/61 +CVE-2017-5359 - http://www.securityfocus.com/bid/96420 CVE-2017-5359 - https://www.exploit-db.com/exploits/41426/ CVE-2017-5364 - https://www.foxitsoftware.com/support/security-bulletins.php CVE-2017-5367 - http://seclists.org/bugtraq/2017/Feb/6 @@ -54471,6 +54617,7 @@ CVE-2017-5585 - http://packetstormsecurity.com/files/141124/OpenText-Documentum- CVE-2017-5586 - http://packetstormsecurity.com/files/141105/OpenText-Documentum-D2-4.x-Remote-Code-Execution.html CVE-2017-5586 - https://www.exploit-db.com/exploits/41366/ CVE-2017-5591 - https://github.com/poezio/slixmpp/commit/22664ee7b86c8e010f312b66d12590fb47160ad8 +CVE-2017-5594 - http://www.securityfocus.com/bid/95806 CVE-2017-5594 - https://www.exploit-db.com/exploits/41143/ CVE-2017-5595 - http://seclists.org/bugtraq/2017/Feb/6 CVE-2017-5595 - http://seclists.org/fulldisclosure/2017/Feb/11 @@ -54496,6 +54643,7 @@ CVE-2017-5637 - https://www.oracle.com/security-alerts/cpujul2020.html CVE-2017-5638 - http://blog.talosintelligence.com/2017/03/apache-0-day-exploited.html CVE-2017-5638 - http://blog.trendmicro.com/trendlabs-security-intelligence/cve-2017-5638-apache-struts-vulnerability-remote-code-execution/ CVE-2017-5638 - http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html +CVE-2017-5638 - http://www.securityfocus.com/bid/96729 CVE-2017-5638 - https://github.com/rapid7/metasploit-framework/issues/8064 CVE-2017-5638 - https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03723en_us CVE-2017-5638 - https://isc.sans.edu/diary/22169 @@ -54554,6 +54702,7 @@ CVE-2017-5715 - http://www.kb.cert.org/vuls/id/584653 CVE-2017-5715 - http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html CVE-2017-5715 - http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html CVE-2017-5715 - http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html +CVE-2017-5715 - http://www.securityfocus.com/bid/102376 CVE-2017-5715 - https://cert.vde.com/en-us/advisories/vde-2018-002 CVE-2017-5715 - https://cert.vde.com/en-us/advisories/vde-2018-003 CVE-2017-5715 - https://developer.arm.com/support/arm-security-updates/speculative-processor-vulnerability @@ -54580,6 +54729,7 @@ CVE-2017-5717 - https://www.exploit-db.com/exploits/43373/ CVE-2017-5753 - http://packetstormsecurity.com/files/145645/Spectre-Information-Disclosure-Proof-Of-Concept.html CVE-2017-5753 - http://www.kb.cert.org/vuls/id/584653 CVE-2017-5753 - http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html +CVE-2017-5753 - http://www.securityfocus.com/bid/102371 CVE-2017-5753 - https://cert.vde.com/en-us/advisories/vde-2018-002 CVE-2017-5753 - https://cert.vde.com/en-us/advisories/vde-2018-003 CVE-2017-5753 - https://developer.arm.com/support/arm-security-updates/speculative-processor-vulnerability @@ -54666,6 +54816,8 @@ CVE-2017-5854 - http://www.openwall.com/lists/oss-security/2017/02/01/14 CVE-2017-5854 - https://blogs.gentoo.org/ago/2017/02/01/podofo-null-pointer-dereference-in-pdfoutputstream-cpp/ CVE-2017-5855 - https://blogs.gentoo.org/ago/2017/02/01/podofo-null-pointer-dereference-in-podofopdfparserreadxrefsubsection-pdfparser-cpp/ CVE-2017-5856 - https://bugzilla.redhat.com/show_bug.cgi?id=1418342 +CVE-2017-5865 - http://www.securityfocus.com/bid/96425 +CVE-2017-5866 - http://www.securityfocus.com/bid/96426 CVE-2017-5868 - https://hackerone.com/reports/231508 CVE-2017-5868 - https://hackerone.com/reports/232327 CVE-2017-5869 - http://www.openwall.com/lists/oss-security/2017/03/23/6 @@ -54762,6 +54914,7 @@ CVE-2017-6074 - http://www.oracle.com/technetwork/security-advisory/cpujul2018-4 CVE-2017-6074 - https://hackerone.com/reports/347282 CVE-2017-6074 - https://www.exploit-db.com/exploits/41457/ CVE-2017-6074 - https://www.exploit-db.com/exploits/41458/ +CVE-2017-6076 - http://www.securityfocus.com/bid/96422 CVE-2017-6076 - https://github.com/wolfSSL/wolfssl/releases/tag/v3.10.2-stable CVE-2017-6077 - https://www.exploit-db.com/exploits/41394/ CVE-2017-6078 - https://github.com/ilsani/rd/tree/master/security-advisories/faststone/maxview-cve-2017-6078 @@ -54811,6 +54964,7 @@ CVE-2017-6193 - https://www.exploit-db.com/exploits/41668/ CVE-2017-6193 - https://www.exploit-db.com/exploits/41669/ CVE-2017-6194 - https://github.com/radare/radare2/issues/6829 CVE-2017-6195 - https://www.siberas.de/assets/papers/ssa-1705_IPSWITCH_SQLinjection.txt +CVE-2017-6196 - http://www.securityfocus.com/bid/96428 CVE-2017-6196 - https://bugs.ghostscript.com/show_bug.cgi?id=697596 CVE-2017-6197 - https://github.com/radare/radare2/issues/6816 CVE-2017-6199 - https://github.com/sandstorm-io/sandstorm/blob/v0.202/shell/packages/sandstorm-db/db.js#L1112 @@ -54819,6 +54973,7 @@ CVE-2017-6200 - https://sandstorm.io/news/2017-03-02-security-review CVE-2017-6201 - https://sandstorm.io/news/2017-03-02-security-review CVE-2017-6206 - https://github.com/varangamin/CVE-2017-6206 CVE-2017-6206 - https://www.exploit-db.com/exploits/41662/ +CVE-2017-6214 - http://www.securityfocus.com/bid/96421 CVE-2017-6266 - http://nvidia.custhelp.com/app/answers/detail/a_id/4544 CVE-2017-6267 - http://nvidia.custhelp.com/app/answers/detail/a_id/4544 CVE-2017-6268 - http://nvidia.custhelp.com/app/answers/detail/a_id/4544 @@ -54830,18 +54985,31 @@ CVE-2017-6273 - http://nvidia.custhelp.com/app/answers/detail/a_id/4561 CVE-2017-6275 - https://nvidia.custhelp.com/app/answers/detail/a_id/4804 CVE-2017-6277 - http://nvidia.custhelp.com/app/answers/detail/a_id/4544 CVE-2017-6297 - https://blog.milne.it/2017/02/24/mikrotik-routeros-security-vulnerability-l2tp-tunnel-unencrypted-cve-2017-6297/ +CVE-2017-6298 - http://www.securityfocus.com/bid/96423 CVE-2017-6298 - https://github.com/Yeraze/ytnef/pull/27 +CVE-2017-6299 - http://www.securityfocus.com/bid/96423 CVE-2017-6299 - https://github.com/Yeraze/ytnef/pull/27 +CVE-2017-6300 - http://www.securityfocus.com/bid/96423 CVE-2017-6300 - https://github.com/Yeraze/ytnef/pull/27 +CVE-2017-6301 - http://www.securityfocus.com/bid/96423 CVE-2017-6301 - https://github.com/Yeraze/ytnef/pull/27 +CVE-2017-6302 - http://www.securityfocus.com/bid/96423 CVE-2017-6302 - https://github.com/Yeraze/ytnef/pull/27 +CVE-2017-6303 - http://www.securityfocus.com/bid/96423 CVE-2017-6303 - https://github.com/Yeraze/ytnef/pull/27 +CVE-2017-6304 - http://www.securityfocus.com/bid/96423 CVE-2017-6304 - https://github.com/Yeraze/ytnef/pull/27 +CVE-2017-6305 - http://www.securityfocus.com/bid/96423 CVE-2017-6305 - https://github.com/Yeraze/ytnef/pull/27 +CVE-2017-6306 - http://www.securityfocus.com/bid/96423 CVE-2017-6306 - https://github.com/Yeraze/ytnef/pull/27 +CVE-2017-6307 - http://www.securityfocus.com/bid/96427 CVE-2017-6307 - https://github.com/verdammelt/tnef/blob/master/ChangeLog +CVE-2017-6308 - http://www.securityfocus.com/bid/96427 CVE-2017-6308 - https://github.com/verdammelt/tnef/blob/master/ChangeLog +CVE-2017-6309 - http://www.securityfocus.com/bid/96427 CVE-2017-6309 - https://github.com/verdammelt/tnef/blob/master/ChangeLog +CVE-2017-6310 - http://www.securityfocus.com/bid/96427 CVE-2017-6310 - https://github.com/verdammelt/tnef/blob/master/ChangeLog CVE-2017-6315 - https://www.exploit-db.com/exploits/42726/ CVE-2017-6316 - https://www.exploit-db.com/exploits/42345/ @@ -55135,6 +55303,7 @@ CVE-2017-7237 - http://hyp3rlinx.altervista.org/advisories/SPICEWORKS-IMPROPER-A CVE-2017-7237 - https://community.spiceworks.com/support/inventory/docs/network-config#security CVE-2017-7237 - https://www.exploit-db.com/exploits/41825/ CVE-2017-7240 - http://seclists.org/fulldisclosure/2017/Mar/63 +CVE-2017-7240 - http://www.securityfocus.com/bid/97080 CVE-2017-7240 - https://www.exploit-db.com/exploits/41718/ CVE-2017-7244 - https://blogs.gentoo.org/ago/2017/03/20/libpcre-invalid-memory-read-in-_pcre32_xclass-pcre_xclass-c/ CVE-2017-7245 - https://blogs.gentoo.org/ago/2017/03/20/libpcre-two-stack-based-buffer-overflow-write-in-pcre32_copy_substring-pcre_get-c/ @@ -55295,6 +55464,7 @@ CVE-2017-7620 - https://mantisbt.org/bugs/view.php?id=22816 CVE-2017-7620 - https://www.exploit-db.com/exploits/42043/ CVE-2017-7621 - https://sudoat.blogspot.in/2017/04/xss-vulnerability-in-multiple-emli.html CVE-2017-7622 - https://github.com/kings-way/deepinhack/blob/master/dde_daemon_poc.py +CVE-2017-7625 - http://www.securityfocus.com/bid/97571 CVE-2017-7625 - https://github.com/Xyntax/POC-T/blob/2.0/script/fiyo2.0.7-getshell.py CVE-2017-7642 - http://seclists.org/fulldisclosure/2017/Jul/29 CVE-2017-7642 - https://www.exploit-db.com/exploits/42334/ @@ -55438,6 +55608,7 @@ CVE-2017-7990 - https://www.youtube.com/watch?v=pfrIaNvIuFY CVE-2017-7991 - http://seclists.org/fulldisclosure/2017/Apr/78 CVE-2017-7991 - https://gist.github.com/404notf0und/ab59234d71fbf35b4926ffd646324f29 CVE-2017-7991 - https://packetstormsecurity.com/files/142258/Exponent-CMS-2.4.1-SQL-Injection.html +CVE-2017-7994 - http://www.securityfocus.com/bid/97980 CVE-2017-7994 - https://github.com/icepng/PoC/tree/master/PoC1 CVE-2017-7994 - https://icepng.github.io/2017/04/21/PoDoFo-1/ CVE-2017-7997 - http://seclists.org/fulldisclosure/2018/Jan/14 @@ -55925,6 +56096,7 @@ CVE-2017-9223 - http://seclists.org/fulldisclosure/2017/Jun/32 CVE-2017-9227 - https://github.com/kkos/oniguruma/issues/58 CVE-2017-9232 - https://www.exploit-db.com/exploits/44023/ CVE-2017-9233 - http://www.securityfocus.com/bid/99276 +CVE-2017-9239 - http://www.securityfocus.com/bid/98720 CVE-2017-9239 - https://github.com/lolo-pop/poc/tree/master/Segmentation%20fault%20in%20convert-test%28exiv2%29 CVE-2017-9239 - https://github.com/lolo-pop/poc/tree/master/Segmentation%20fault%20in%20convert-test(exiv2) CVE-2017-9243 - http://touhidshaikh.com/blog/poc/qwr-1104-wireless-n-router-xss/ @@ -56753,6 +56925,7 @@ CVE-2018-10021 - https://usn.ubuntu.com/3696-1/ CVE-2018-1002100 - https://github.com/kubernetes/kubernetes/issues/61297 CVE-2018-1002100 - https://hansmi.ch/articles/2018-04-openshift-s2i-security CVE-2018-1002104 - https://github.com/kubernetes/ingress-nginx/pull/3125 +CVE-2018-1002105 - http://www.securityfocus.com/bid/106068 CVE-2018-1002105 - https://github.com/evict/poc_CVE-2018-1002105 CVE-2018-1002105 - https://www.exploit-db.com/exploits/46052/ CVE-2018-1002105 - https://www.exploit-db.com/exploits/46053/ @@ -64068,10 +64241,12 @@ CVE-2018-4071 - https://talosintelligence.com/vulnerability_reports/TALOS-2018-0 CVE-2018-4072 - https://talosintelligence.com/vulnerability_reports/TALOS-2018-0756 CVE-2018-4073 - https://talosintelligence.com/vulnerability_reports/TALOS-2018-0756 CVE-2018-4083 - https://www.exploit-db.com/exploits/44007/ +CVE-2018-4087 - http://www.securityfocus.com/bid/102774 CVE-2018-4087 - https://blog.zimperium.com/cve-2018-4087-poc-escaping-sandbox-misleading-bluetoothd/ CVE-2018-4087 - https://www.exploit-db.com/exploits/44215/ CVE-2018-4089 - https://www.exploit-db.com/exploits/43937/ CVE-2018-4090 - https://www.exploit-db.com/exploits/43923/ +CVE-2018-4095 - http://www.securityfocus.com/bid/102774 CVE-2018-4095 - https://blog.zimperium.com/cve-2018-4087-poc-escaping-sandbox-misleading-bluetoothd/ CVE-2018-4121 - https://github.com/mwrlabs/CVE-2018-4121 CVE-2018-4121 - https://www.exploit-db.com/exploits/44427/ @@ -64257,6 +64432,7 @@ CVE-2018-5275 - https://github.com/ZhiyuanWang-Chengdu-Qihoo360/Malwarebytes_POC CVE-2018-5276 - https://github.com/ZhiyuanWang-Chengdu-Qihoo360/Malwarebytes_POC/tree/master/0x9c40e018 CVE-2018-5277 - https://github.com/ZhiyuanWang-Chengdu-Qihoo360/Malwarebytes_POC/tree/master/0x9c40e000 CVE-2018-5278 - https://github.com/ZhiyuanWang-Chengdu-Qihoo360/Malwarebytes_POC/tree/master/0x9c40e00c +CVE-2018-5279 - http://www.securityfocus.com/bid/102453 CVE-2018-5279 - https://github.com/ZhiyuanWang-Chengdu-Qihoo360/Malwarebytes_POC/tree/master/0x9c40e02c CVE-2018-5280 - https://www.vulnerability-lab.com/get_content.php?id=1725 CVE-2018-5281 - https://www.vulnerability-lab.com/get_content.php?id=1729 @@ -65514,6 +65690,7 @@ CVE-2018-8720 - https://packetstormsecurity.com/files/137427/ServiceNow-ITSM-Cro CVE-2018-8724 - https://support.k7computing.com/index.php?/selfhelp/view-article/Advisory-issued-on-6th-January-2021 CVE-2018-8725 - https://support.k7computing.com/index.php?/selfhelp/view-article/Advisory-issued-on-6th-January-2021 CVE-2018-8726 - https://support.k7computing.com/index.php?/selfhelp/view-article/Advisory-issued-on-6th-January-2021 +CVE-2018-8727 - https://www.exploit-db.com/exploits/44907 CVE-2018-8729 - https://www.exploit-db.com/exploits/44437/ CVE-2018-8732 - https://www.exploit-db.com/exploits/44384/ CVE-2018-8733 - https://www.exploit-db.com/exploits/44560/ @@ -67128,6 +67305,7 @@ CVE-2019-11682 - https://packetstormsecurity.com/files/152694/MailCarrier-2.51-H CVE-2019-11683 - https://usn.ubuntu.com/3979-1/ CVE-2019-11686 - https://www.westerndigital.com/support/productsecurity/wdc-19006-sandisk-x600-sata-ssd CVE-2019-11686 - https://www.westerndigital.com/support/productsecurity/wdc-19007-sandisk-x300-x400-sata-s +CVE-2019-11687 - http://www.securityfocus.com/bid/108730 CVE-2019-11687 - https://github.com/d00rt/pedicom CVE-2019-11687 - https://github.com/d00rt/pedicom/blob/master/doc/Attacking_Digital_Imaging_and_Communication_in_Medicine_%28DICOM%29_file_format_standard_-_Markel_Picado_Ortiz_%28d00rt%29.pdf CVE-2019-11687 - https://github.com/d00rt/pedicom/blob/master/doc/Attacking_Digital_Imaging_and_Communication_in_Medicine_(DICOM)_file_format_standard_-_Markel_Picado_Ortiz_(d00rt).pdf @@ -67421,6 +67599,7 @@ CVE-2019-12271 - http://packetstormsecurity.com/files/155355/Centraleyezer-Shell CVE-2019-12271 - https://link.medium.com/Y2S4ZJbMy1 CVE-2019-12276 - http://packetstormsecurity.com/files/153373/GrandNode-4.40-Path-Traversal-File-Download.html CVE-2019-12279 - http://packetstormsecurity.com/files/153040/Nagios-XI-5.6.1-SQL-Injection.html +CVE-2019-12279 - http://www.securityfocus.com/bid/108446 CVE-2019-12279 - https://github.com/JameelNabbo/exploits/blob/master/nagiosxi%20username%20sql%20injection.txt CVE-2019-12280 - http://packetstormsecurity.com/files/153374/PC-Doctor-Toolbox-DLL-Hijacking.html CVE-2019-12280 - https://safebreach.com/Press-Post/SafeBreach-Identifies-Serious-Vulnerability-In-PC-Doctor-Software @@ -72520,6 +72699,7 @@ CVE-2019-25710 - https://www.exploit-db.com/exploits/46095 CVE-2019-25711 - https://www.exploit-db.com/exploits/46088 CVE-2019-25712 - https://www.exploit-db.com/exploits/46087 CVE-2019-25713 - https://www.exploit-db.com/exploits/46084 +CVE-2019-25714 - https://wiki.96.mk/Web%E5%AE%89%E5%85%A8/%E8%87%B4%E8%BF%9Coa/%E8%87%B4%E8%BF%9C%20OA%20A8%20htmlofficeservlet%20getshell%20%E6%BC%8F%E6%B4%9E/ CVE-2019-25714 - https://www.vulncheck.com/advisories/seeyon-office-anywhere-oa-a8-unauthenticated-arbitrary-file-write-via-htmlofficeservlet CVE-2019-2572 - http://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html CVE-2019-25726 - https://www.exploit-db.com/exploits/46077 @@ -73788,6 +73968,7 @@ CVE-2019-5723 - https://seclists.org/bugtraq/2019/Jan/8 CVE-2019-5723 - https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2018-011.txt CVE-2019-5736 - http://packetstormsecurity.com/files/163339/Docker-Container-Escape.html CVE-2019-5736 - http://packetstormsecurity.com/files/165197/Docker-runc-Command-Execution-Proof-Of-Concept.html +CVE-2019-5736 - http://www.securityfocus.com/bid/106976 CVE-2019-5736 - https://azure.microsoft.com/en-us/updates/cve-2019-5736-and-runc-vulnerability/ CVE-2019-5736 - https://azure.microsoft.com/en-us/updates/iot-edge-fix-cve-2019-5736/ CVE-2019-5736 - https://blog.dragonsector.pl/2019/02/cve-2019-5736-escape-from-docker-and.html @@ -73993,6 +74174,7 @@ CVE-2019-6516 - https://wso2.com/security-patch-releases/dashboard-server CVE-2019-6543 - https://www.exploit-db.com/exploits/46342/ CVE-2019-6545 - https://www.exploit-db.com/exploits/46342/ CVE-2019-6551 - http://www.securityfocus.com/bid/107031 +CVE-2019-6555 - http://www.securityfocus.com/bid/107087 CVE-2019-6555 - https://ics-cert.us-cert.gov/advisories/ICSA-19-050-03 CVE-2019-6588 - http://packetstormsecurity.com/files/153252/Liferay-Portal-7.1-CE-GA4-Cross-Site-Scripting.html CVE-2019-6617 - https://github.com/mirchr/security-research/blob/master/vulnerabilities/F5/CVE-2019-6617.txt @@ -94866,6 +95048,7 @@ CVE-2021-45563 - https://kb.netgear.com/000064084/Security-Advisory-for-Post-Aut CVE-2021-45567 - https://kb.netgear.com/000064089/Security-Advisory-for-Post-Authentication-Command-Injection-on-Some-WiFi-Systems-PSV-2020-0075 CVE-2021-45568 - https://kb.netgear.com/000064090/Security-Advisory-for-Post-Authentication-Command-Injection-on-Some-WiFi-Systems-PSV-2020-0076 CVE-2021-45570 - https://kb.netgear.com/000064092/Security-Advisory-for-Post-Authentication-Command-Injection-on-Some-WiFi-Systems-PSV-2020-0078 +CVE-2021-45572 - https://kb.netgear.com/000064094/Security-Advisory-for-Post-Authentication-Command-Injection-on-Some-WiFi-Systems-PSV-2020-0080 CVE-2021-45574 - https://kb.netgear.com/000064096/Security-Advisory-for-Post-Authentication-Command-Injection-on-Some-WiFi-Systems-PSV-2020-0082 CVE-2021-45575 - https://kb.netgear.com/000064097/Security-Advisory-for-Post-Authentication-Command-Injection-on-Some-WiFi-Systems-PSV-2020-0083 CVE-2021-45576 - https://kb.netgear.com/000064098/Security-Advisory-for-Post-Authentication-Command-Injection-on-Some-WiFi-Systems-PSV-2020-0084 @@ -95004,6 +95187,8 @@ CVE-2021-45908 - https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1002669 CVE-2021-45909 - https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1002668 CVE-2021-45910 - https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1002667 CVE-2021-45911 - https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1002687 +CVE-2021-45912 - https://controlup.com +CVE-2021-45913 - https://controlup.com CVE-2021-45919 - https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/from-stored-xss-to-rce-using-beef-and-elfinder-cve-2021-45919/ CVE-2021-45932 - https://github.com/wolfSSL/wolfMQTT/commit/84d4b53122e0fa0280c7872350b89d5777dabbb2 CVE-2021-45933 - https://github.com/wolfSSL/wolfMQTT/commit/84d4b53122e0fa0280c7872350b89d5777dabbb2 @@ -119224,6 +119409,7 @@ CVE-2024-21241 - https://www.oracle.com/security-alerts/cpuoct2024.html CVE-2024-21242 - https://www.oracle.com/security-alerts/cpuoct2024.html CVE-2024-21243 - https://www.oracle.com/security-alerts/cpuoct2024.html CVE-2024-21244 - https://www.oracle.com/security-alerts/cpuoct2024.html +CVE-2024-21245 - https://www.oracle.com/security-alerts/cpujan2025.html CVE-2024-21246 - https://www.oracle.com/security-alerts/cpuoct2024.html CVE-2024-21247 - https://www.oracle.com/security-alerts/cpuoct2024.html CVE-2024-21248 - https://www.oracle.com/security-alerts/cpuoct2024.html @@ -122180,6 +122366,7 @@ CVE-2024-3400 - https://unit42.paloaltonetworks.com/cve-2024-3400/ CVE-2024-34020 - https://bugzilla.suse.com/show_bug.cgi?id=1223534 CVE-2024-34027 - https://cert-portal.siemens.com/productcert/html/ssa-265688.html CVE-2024-34029 - https://mattermost.com/security-updates +CVE-2024-34035 - https://jira.o-ran-sc.org/browse/RIC-1056 CVE-2024-34036 - https://jira.o-ran-sc.org/browse/RIC-1057 CVE-2024-34043 - https://jira.o-ran-sc.org/browse/RICAPP-235 CVE-2024-34044 - https://jira.o-ran-sc.org/browse/RIC-1043 @@ -131966,11 +132153,93 @@ CVE-2025-21371 - https://www.vicarius.io/vsociety/posts/windows-telephony-servic CVE-2025-21399 - https://www.vicarius.io/vsociety/posts/elevation-of-privilege-vulnerability-in-microsoft-edge-chromium-based-detection-script CVE-2025-21399 - https://www.vicarius.io/vsociety/posts/elevation-of-privilege-vulnerability-in-microsoft-edge-chromium-based-mitigation-script CVE-2025-2147 - https://vuldb.com/?id.299058 +CVE-2025-21489 - https://www.oracle.com/security-alerts/cpujan2025.html +CVE-2025-21490 - https://www.oracle.com/security-alerts/cpujan2025.html +CVE-2025-21491 - https://www.oracle.com/security-alerts/cpujan2025.html +CVE-2025-21492 - https://www.oracle.com/security-alerts/cpujan2025.html +CVE-2025-21493 - https://www.oracle.com/security-alerts/cpujan2025.html +CVE-2025-21494 - https://www.oracle.com/security-alerts/cpujan2025.html +CVE-2025-21495 - https://www.oracle.com/security-alerts/cpujan2025.html +CVE-2025-21497 - https://www.oracle.com/security-alerts/cpujan2025.html +CVE-2025-21498 - https://www.oracle.com/security-alerts/cpujan2025.html +CVE-2025-21499 - https://www.oracle.com/security-alerts/cpujan2025.html +CVE-2025-21500 - https://www.oracle.com/security-alerts/cpujan2025.html +CVE-2025-21501 - https://www.oracle.com/security-alerts/cpujan2025.html +CVE-2025-21502 - https://www.oracle.com/security-alerts/cpujan2025.html +CVE-2025-21503 - https://www.oracle.com/security-alerts/cpujan2025.html +CVE-2025-21504 - https://www.oracle.com/security-alerts/cpujan2025.html +CVE-2025-21505 - https://www.oracle.com/security-alerts/cpujan2025.html +CVE-2025-21506 - https://www.oracle.com/security-alerts/cpujan2025.html +CVE-2025-21507 - https://www.oracle.com/security-alerts/cpujan2025.html +CVE-2025-21508 - https://www.oracle.com/security-alerts/cpujan2025.html +CVE-2025-21509 - https://www.oracle.com/security-alerts/cpujan2025.html CVE-2025-2151 - https://github.com/assimp/assimp/issues/6016 CVE-2025-2151 - https://github.com/assimp/assimp/issues/6026 +CVE-2025-21510 - https://www.oracle.com/security-alerts/cpujan2025.html +CVE-2025-21511 - https://www.oracle.com/security-alerts/cpujan2025.html +CVE-2025-21512 - https://www.oracle.com/security-alerts/cpujan2025.html +CVE-2025-21513 - https://www.oracle.com/security-alerts/cpujan2025.html +CVE-2025-21514 - https://www.oracle.com/security-alerts/cpujan2025.html +CVE-2025-21515 - https://www.oracle.com/security-alerts/cpujan2025.html +CVE-2025-21516 - https://www.oracle.com/security-alerts/cpujan2025.html +CVE-2025-21517 - https://www.oracle.com/security-alerts/cpujan2025.html +CVE-2025-21518 - https://www.oracle.com/security-alerts/cpujan2025.html +CVE-2025-21519 - https://www.oracle.com/security-alerts/cpujan2025.html CVE-2025-2152 - https://github.com/assimp/assimp/issues/6027 CVE-2025-2152 - https://github.com/assimp/assimp/issues/6027#issue-2877629241 +CVE-2025-21520 - https://www.oracle.com/security-alerts/cpujan2025.html +CVE-2025-21521 - https://www.oracle.com/security-alerts/cpujan2025.html +CVE-2025-21522 - https://www.oracle.com/security-alerts/cpujan2025.html +CVE-2025-21523 - https://www.oracle.com/security-alerts/cpujan2025.html +CVE-2025-21524 - https://www.oracle.com/security-alerts/cpujan2025.html +CVE-2025-21525 - https://www.oracle.com/security-alerts/cpujan2025.html +CVE-2025-21526 - https://www.oracle.com/security-alerts/cpujan2025.html +CVE-2025-21527 - https://www.oracle.com/security-alerts/cpujan2025.html +CVE-2025-21528 - https://www.oracle.com/security-alerts/cpujan2025.html +CVE-2025-21529 - https://www.oracle.com/security-alerts/cpujan2025.html CVE-2025-2153 - https://github.com/HDFGroup/hdf5/issues/5329 +CVE-2025-21530 - https://www.oracle.com/security-alerts/cpujan2025.html +CVE-2025-21531 - https://www.oracle.com/security-alerts/cpujan2025.html +CVE-2025-21532 - https://www.oracle.com/security-alerts/cpujan2025.html +CVE-2025-21533 - https://www.oracle.com/security-alerts/cpujan2025.html +CVE-2025-21534 - https://www.oracle.com/security-alerts/cpujan2025.html +CVE-2025-21535 - https://www.oracle.com/security-alerts/cpujan2025.html +CVE-2025-21536 - https://www.oracle.com/security-alerts/cpujan2025.html +CVE-2025-21537 - https://www.oracle.com/security-alerts/cpujan2025.html +CVE-2025-21538 - https://www.oracle.com/security-alerts/cpujan2025.html +CVE-2025-21539 - https://www.oracle.com/security-alerts/cpujan2025.html +CVE-2025-21540 - https://www.oracle.com/security-alerts/cpujan2025.html +CVE-2025-21541 - https://www.oracle.com/security-alerts/cpujan2025.html +CVE-2025-21542 - https://www.oracle.com/security-alerts/cpujan2025.html +CVE-2025-21543 - https://www.oracle.com/security-alerts/cpujan2025.html +CVE-2025-21544 - https://www.oracle.com/security-alerts/cpujan2025.html +CVE-2025-21545 - https://www.oracle.com/security-alerts/cpujan2025.html +CVE-2025-21546 - https://www.oracle.com/security-alerts/cpujan2025.html +CVE-2025-21547 - https://www.oracle.com/security-alerts/cpujan2025.html +CVE-2025-21548 - https://www.oracle.com/security-alerts/cpujan2025.html +CVE-2025-21549 - https://www.oracle.com/security-alerts/cpujan2025.html +CVE-2025-21550 - https://www.oracle.com/security-alerts/cpujan2025.html +CVE-2025-21551 - https://www.oracle.com/security-alerts/cpujan2025.html +CVE-2025-21552 - https://www.oracle.com/security-alerts/cpujan2025.html +CVE-2025-21553 - https://www.oracle.com/security-alerts/cpujan2025.html +CVE-2025-21554 - https://www.oracle.com/security-alerts/cpujan2025.html +CVE-2025-21555 - https://www.oracle.com/security-alerts/cpujan2025.html +CVE-2025-21556 - https://www.oracle.com/security-alerts/cpujan2025.html +CVE-2025-21557 - https://www.oracle.com/security-alerts/cpujan2025.html +CVE-2025-21558 - https://www.oracle.com/security-alerts/cpujan2025.html +CVE-2025-21559 - https://www.oracle.com/security-alerts/cpujan2025.html +CVE-2025-21560 - https://www.oracle.com/security-alerts/cpujan2025.html +CVE-2025-21561 - https://www.oracle.com/security-alerts/cpujan2025.html +CVE-2025-21562 - https://www.oracle.com/security-alerts/cpujan2025.html +CVE-2025-21563 - https://www.oracle.com/security-alerts/cpujan2025.html +CVE-2025-21564 - https://www.oracle.com/security-alerts/cpujan2025.html +CVE-2025-21565 - https://www.oracle.com/security-alerts/cpujan2025.html +CVE-2025-21566 - https://www.oracle.com/security-alerts/cpujan2025.html +CVE-2025-21567 - https://www.oracle.com/security-alerts/cpujan2025.html +CVE-2025-21568 - https://www.oracle.com/security-alerts/cpujan2025.html +CVE-2025-21569 - https://www.oracle.com/security-alerts/cpujan2025.html +CVE-2025-21570 - https://www.oracle.com/security-alerts/cpujan2025.html +CVE-2025-21571 - https://www.oracle.com/security-alerts/cpujan2025.html CVE-2025-21605 - https://www.vicarius.io/vsociety/posts/cve-2025-21605-detection-script-memory-exhaustion-vulnerability-in-redis-database CVE-2025-21605 - https://www.vicarius.io/vsociety/posts/cve-2025-21605-mitigation-script-memory-exhaustion-vulnerability-in-redis-database CVE-2025-21607 - https://github.com/vyperlang/vyper/pull/4451 @@ -142512,6 +142781,7 @@ CVE-2026-10946 - https://issues.chromium.org/issues/504587797 CVE-2026-10947 - https://issues.chromium.org/issues/504597736 CVE-2026-10949 - https://issues.chromium.org/issues/504644843 CVE-2026-10951 - https://issues.chromium.org/issues/505191883 +CVE-2026-10953 - https://issues.chromium.org/issues/506147564 CVE-2026-10960 - https://issues.chromium.org/issues/507258786 CVE-2026-10961 - https://issues.chromium.org/issues/508281950 CVE-2026-10991 - https://issues.chromium.org/issues/503553614 @@ -142743,6 +143013,7 @@ CVE-2026-11412 - https://github.com/MichaelZhuang521/cve/issues/3 CVE-2026-11416 - https://github.com/jxxghp/MoviePilot/issues/5894 CVE-2026-1142 - https://github.com/Asim-QAZi/CSRF-Add-Subadmin-in-News-Portal-Project-in-PHP-and-MySql-in-PHPGurukul CVE-2026-11422 - https://github.com/shd101wyy/vscode-markdown-preview-enhanced/issues/2315 +CVE-2026-11430 - https://github.com/getgrav/grav/security/advisories/GHSA-xwv3-2mv2-w33x CVE-2026-11434 - https://hackmd.io/@noka/BkHdIMFAWx CVE-2026-11434 - https://karinagante.github.io/cve-2026-11434/ CVE-2026-11434 - https://karinagante.github.io/cve-2026-11434/#proof-of-concept-poc @@ -142815,6 +143086,7 @@ CVE-2026-11559 - https://github.com/Andelstander/cve/issues/1 CVE-2026-1156 - https://vuldb.com/?id.341750 CVE-2026-11562 - https://wpscan.com/vulnerability/e0283d75-0622-490c-9442-cf1aa0a1d167/ CVE-2026-11563 - https://wpscan.com/vulnerability/7f4b5f16-6c31-4dcc-94a4-120cb45631bb/ +CVE-2026-11565 - https://wpscan.com/vulnerability/5e03858d-db0b-4b65-99cc-eb01ad4195e9/ CVE-2026-11567 - https://wpscan.com/vulnerability/bd738da7-f950-4da9-bcc1-c1fe845d7faa/ CVE-2026-11568 - https://wpscan.com/vulnerability/e208fee5-dad5-4aeb-b9b5-fbd72a5633e4/ CVE-2026-11570 - https://wpscan.com/vulnerability/35c33c56-5b12-4be5-9d45-68f47cd854ec/ @@ -143107,6 +143379,7 @@ CVE-2026-12978 - https://wpscan.com/vulnerability/1b22645b-28cb-44f3-a5b9-c81a40 CVE-2026-12979 - https://wpscan.com/vulnerability/d81ca171-65eb-484d-917f-f41b0cd20351/ CVE-2026-12981 - https://wpscan.com/vulnerability/79fa8b91-f88e-4249-9f17-9e98e879f6fa/ CVE-2026-12982 - https://wpscan.com/vulnerability/a3c279ce-5db1-4331-ad74-4eef49619737/ +CVE-2026-12983 - https://wpscan.com/vulnerability/1369f95a-4ad3-4b0e-a87f-da88d200685e/ CVE-2026-12987 - https://wpscan.com/vulnerability/dac83702-298d-4422-b795-b7684cc3fb2b/ CVE-2026-12988 - https://wpscan.com/vulnerability/8aa6bf91-54ee-4326-a477-31f42284be22/ CVE-2026-13142 - https://wpscan.com/vulnerability/a34d9be7-c121-4c95-9ebb-a14c763e16bb/ @@ -143120,8 +143393,12 @@ CVE-2026-13156 - https://wpscan.com/vulnerability/595e653d-0904-43cf-8e61-d68459 CVE-2026-13157 - https://wpscan.com/vulnerability/5d6a6a8e-c224-4034-8ed5-2d63f37f9479/ CVE-2026-13158 - https://wpscan.com/vulnerability/f101071f-402a-40a2-bbdb-666512cd4049/ CVE-2026-13168 - https://wpscan.com/vulnerability/2c5a4930-4676-4ae0-aeb4-1c99d5069361/ +CVE-2026-13169 - https://wpscan.com/vulnerability/cf2b1152-7190-467b-a860-1f7bd806575d/ CVE-2026-13170 - https://wpscan.com/vulnerability/c7bdaa80-a446-4c72-be79-bfc5022a4eca/ CVE-2026-13171 - https://wpscan.com/vulnerability/90240025-4dca-4bdb-9698-b63f4c60f413/ +CVE-2026-13173 - https://wpscan.com/vulnerability/f1bb2ee8-85b2-415e-ab41-97b9958e5e70/ +CVE-2026-13174 - https://wpscan.com/vulnerability/849478d1-640f-49e0-8fa5-918e41654923/ +CVE-2026-13175 - https://wpscan.com/vulnerability/10762bf3-9663-40dc-9794-88ec7aa5b048/ CVE-2026-13177 - https://wpscan.com/vulnerability/424f774d-9e09-4594-8732-9c527dfc748c/ CVE-2026-13178 - https://wpscan.com/vulnerability/09d6135f-b38c-4cfe-8a9f-5d79552c720c/ CVE-2026-13211 - https://github.com/sbaresearch/advisories/tree/public/2026/SBA-ADV-20260424-01_Genucenter_Disclosure_of_SNMP_Credentials @@ -143253,20 +143530,25 @@ CVE-2026-13726 - https://wpscan.com/vulnerability/4f97b6c6-c05b-4ea5-987d-d289b8 CVE-2026-13729 - https://wpscan.com/vulnerability/24022bde-e87a-4bee-87da-68897cbb8b93/ CVE-2026-13742 - https://www.honeywell.com/us/en/product-security CVE-2026-13766 - https://github.com/exodist/DBIx-QuickORM/commit/43d7684682050780f056f25e1879191fb0a3265e.patch +CVE-2026-13775 - https://issues.chromium.org/issues/511766407 CVE-2026-13803 - https://issues.chromium.org/issues/501669642 CVE-2026-13807 - https://issues.chromium.org/issues/504194494 CVE-2026-13808 - https://issues.chromium.org/issues/504221510 +CVE-2026-13815 - https://issues.chromium.org/issues/511722207 CVE-2026-13856 - https://issues.chromium.org/issues/508092634 CVE-2026-13858 - https://issues.chromium.org/issues/507090179 CVE-2026-13862 - https://issues.chromium.org/issues/495897416 CVE-2026-13864 - https://issues.chromium.org/issues/496399913 +CVE-2026-13867 - https://issues.chromium.org/issues/497345177 CVE-2026-13869 - https://issues.chromium.org/issues/497610642 +CVE-2026-13876 - https://issues.chromium.org/issues/498722200 CVE-2026-13889 - https://issues.chromium.org/issues/500588580 CVE-2026-13894 - https://issues.chromium.org/issues/501741117 CVE-2026-13909 - https://issues.chromium.org/issues/505933538 CVE-2026-13910 - https://issues.chromium.org/issues/507231605 CVE-2026-13911 - https://issues.chromium.org/issues/507239830 CVE-2026-13916 - https://issues.chromium.org/issues/508283108 +CVE-2026-13920 - https://issues.chromium.org/issues/511722559 CVE-2026-13952 - https://issues.chromium.org/issues/513401808 CVE-2026-14030 - https://issues.chromium.org/issues/488762971 CVE-2026-14038 - https://issues.chromium.org/issues/497241148 @@ -143295,6 +143577,7 @@ CVE-2026-14189 - https://wpscan.com/vulnerability/e25ea94a-f5a0-4cae-975b-9e0a45 CVE-2026-14190 - https://wpscan.com/vulnerability/9b855913-a55e-469d-b3cd-324c31b0d4d8/ CVE-2026-14191 - https://www.securin.io/zero-days/cve-2026-14191-winrar-unrar-rar5-recovery-volume-rev-out-of-bounds-heap-write-in-recvolumes5-readheader CVE-2026-14195 - https://wpscan.com/vulnerability/2ed270b0-c01e-4615-b365-3455c161a2d9/ +CVE-2026-14196 - https://wpscan.com/vulnerability/877936f4-5664-4e17-b3cd-28f8f33f18ac/ CVE-2026-14197 - https://wpscan.com/vulnerability/cd488221-6efd-42a0-badc-315c60ec0b99/ CVE-2026-1420 - https://github.com/xyh4ck/iot_poc/blob/main/Tenda%20AC23_Buffer_Overflow_WifiExtraSet/Tenda%20AC23_Buffer_Overflow_WifiExtraSet.md CVE-2026-1420 - https://github.com/xyh4ck/iot_poc/blob/main/Tenda%20AC23_Buffer_Overflow_WifiExtraSet/Tenda%20AC23_Buffer_Overflow_WifiExtraSet.md#poc @@ -143325,6 +143608,7 @@ CVE-2026-14238 - https://wpscan.com/vulnerability/d526b352-74a4-444c-a251-754688 CVE-2026-14239 - https://wpscan.com/vulnerability/1cd293c6-10c3-4a5c-914e-b3bdcd316d2b/ CVE-2026-14240 - https://wpscan.com/vulnerability/17ac2656-3fb4-40c4-b349-a376df61f288/ CVE-2026-14254 - https://portal.perforce.com/s/cve/a91Qi0000036VKLIA2/improper-restriction-of-excessive-authentication-attempts-in-delphix-cd +CVE-2026-14287 - https://wpscan.com/vulnerability/a0519e86-b77e-4354-a91d-ff729514d570/ CVE-2026-14289 - https://wpscan.com/vulnerability/f08365f6-57d2-475a-82c8-c4d27286569e/ CVE-2026-14290 - https://wpscan.com/vulnerability/e8fae1ed-59a0-4e64-b82d-26328f460cad/ CVE-2026-14291 - https://wpscan.com/vulnerability/e62cfba9-4956-43ba-8554-6cdb0eb8815b/ @@ -143348,6 +143632,7 @@ CVE-2026-1433 - https://ntware.atlassian.net/wiki/spaces/SA/pages/13659504652/20 CVE-2026-14331 - https://wpscan.com/vulnerability/5ea58741-0c4c-4482-94dd-34721b19fc26/ CVE-2026-14332 - https://wpscan.com/vulnerability/75182c5d-c7f5-4da9-bffd-1f7bf54cfd04/ CVE-2026-14333 - https://wpscan.com/vulnerability/df673b6f-2957-460a-b6fe-6e656d9193e0/ +CVE-2026-14334 - https://wpscan.com/vulnerability/9ddd1628-0b06-461b-8a5f-ba977f83fa7f/ CVE-2026-14380 - https://metacpan.org/release/HMBRAND/DBI-1.650/changes CVE-2026-14385 - https://issues.chromium.org/issues/499006005 CVE-2026-14386 - https://issues.chromium.org/issues/499047960 @@ -143503,6 +143788,8 @@ CVE-2026-14821 - https://wpscan.com/vulnerability/a53df549-5af1-4a0b-9f0f-a8c789 CVE-2026-14822 - https://wpscan.com/vulnerability/ec32cf58-9fc0-4817-8492-92d80be74ef4/ CVE-2026-14823 - https://wpscan.com/vulnerability/50fcd505-11bc-4208-aa27-54651f82e80e/ CVE-2026-14824 - https://wpscan.com/vulnerability/ba8f3e6b-c2c9-4e72-825c-b98b4330c254/ +CVE-2026-14825 - https://wpscan.com/vulnerability/fb66cb33-e16f-47ee-88d6-5cf141e92a4b/ +CVE-2026-14826 - https://wpscan.com/vulnerability/bb9cac20-4df5-4834-89f0-746a5eab20ea/ CVE-2026-14827 - https://wpscan.com/vulnerability/b2981b41-b712-43d9-a327-3a376346cec5/ CVE-2026-14829 - https://wpscan.com/vulnerability/988d296f-9a85-4f6f-876e-c7379c9a3f3c/ CVE-2026-14830 - https://wpscan.com/vulnerability/b866258c-b49b-40db-a0ff-6c0921b5c89f/ @@ -143525,6 +143812,7 @@ CVE-2026-14857 - https://wpscan.com/vulnerability/2bd55d2f-2bcc-4c55-94cb-b6df92 CVE-2026-14858 - https://wpscan.com/vulnerability/59022a2a-29b2-485a-9512-cd0a27b6492b/ CVE-2026-14859 - https://wpscan.com/vulnerability/5bc0f382-7655-4f19-a057-917d49dae6e2/ CVE-2026-14860 - https://wpscan.com/vulnerability/ea752266-9bff-4c36-91aa-9aca0232c7af/ +CVE-2026-14861 - https://wpscan.com/vulnerability/4dff3634-4b4f-48e2-a8c9-dda7e2b682fd/ CVE-2026-14862 - https://wpscan.com/vulnerability/ef1c6fd5-e62c-4951-a0ba-0e61edb1e795/ CVE-2026-14864 - https://wpscan.com/vulnerability/7222601e-4f2b-4dfb-88aa-692a556f3e86/ CVE-2026-14870 - https://wpscan.com/vulnerability/d574b78c-df04-4dab-bd33-e3a22ff51918/ @@ -143614,6 +143902,7 @@ CVE-2026-15248 - https://wpscan.com/vulnerability/a101136d-606f-4529-ae78-a4fff7 CVE-2026-15249 - https://wpscan.com/vulnerability/ad42fc34-5d7e-4fb9-98fc-b9e80b552535/ CVE-2026-15250 - https://wpscan.com/vulnerability/2609e202-9be3-42b0-a1fb-ace310b93bd0/ CVE-2026-15252 - https://wpscan.com/vulnerability/a347a7a8-36d6-4806-8781-a9ae8eb94788/ +CVE-2026-15253 - https://wpscan.com/vulnerability/46eda528-3737-4c0d-bf72-df7fc6423907/ CVE-2026-15254 - https://wpscan.com/vulnerability/551554a8-12fb-4eb5-bd24-ae627b58dc3b/ CVE-2026-15255 - https://wpscan.com/vulnerability/21fa84b9-afa6-49f7-abb1-c1edabda3cd8/ CVE-2026-15256 - https://wpscan.com/vulnerability/9c96f977-c105-4b45-a3cd-4751fb4aa5a1/ @@ -143723,6 +144012,7 @@ CVE-2026-16054 - https://wpscan.com/vulnerability/3be51346-5d4c-4889-bc5c-f40749 CVE-2026-16055 - https://wpscan.com/vulnerability/fa83e5a0-ed6a-4043-8df3-8654bb354a99/ CVE-2026-16056 - https://wpscan.com/vulnerability/53aec8d3-da17-4183-91b3-73b45681fd20/ CVE-2026-16057 - https://wpscan.com/vulnerability/77b00d40-7188-466e-b021-105f7a91f89e/ +CVE-2026-16058 - https://wpscan.com/vulnerability/d32d7086-9a43-4d98-80d7-18a3f82797bb/ CVE-2026-16060 - https://wpscan.com/vulnerability/a5937e0d-c1bc-4787-9ab9-ab58b9789b68/ CVE-2026-16062 - https://wpscan.com/vulnerability/2e2bc528-0f06-4d99-8597-1f8a0fd57b39/ CVE-2026-16063 - https://wpscan.com/vulnerability/96f20744-6751-40a3-92b7-1e93e3b736a4/ @@ -143881,6 +144171,7 @@ CVE-2026-16562 - https://wpscan.com/vulnerability/09d79a3f-7bf0-47ab-bf6d-913eae CVE-2026-16563 - https://wpscan.com/vulnerability/eec480b0-67af-4642-b6b3-cba095394286/ CVE-2026-16564 - https://wpscan.com/vulnerability/293f5040-5831-483a-9e63-cbbcb3e7d28f/ CVE-2026-16565 - https://wpscan.com/vulnerability/82c341bb-64ad-45ee-9ac7-8d99927f0c0a/ +CVE-2026-16570 - https://wpscan.com/vulnerability/25c42ca3-ff25-4b43-a712-2876398d82ab/ CVE-2026-16572 - https://wpscan.com/vulnerability/2d9b816c-25b3-427f-ad72-f9812d9aa86d/ CVE-2026-16573 - https://wpscan.com/vulnerability/a102e6ba-02f3-46cf-b496-f129ea3d9c8f/ CVE-2026-16574 - https://wpscan.com/vulnerability/b38dc6a4-a590-402f-88e1-3624a22c7348/ @@ -143897,6 +144188,8 @@ CVE-2026-16605 - https://wpscan.com/vulnerability/e31c9bf0-7340-4bd7-ad6e-6ad017 CVE-2026-16608 - https://wpscan.com/vulnerability/f9573555-bd5c-451c-85dd-d964379d12d1/ CVE-2026-16611 - https://wpscan.com/vulnerability/87fe63af-5a43-4812-88ce-568b1cc1598f/ CVE-2026-16613 - https://wpscan.com/vulnerability/d9511e8a-be67-4c39-b947-7931b5569ffb/ +CVE-2026-16616 - https://wpscan.com/vulnerability/9631c97e-42e5-43b0-8998-e106f474ffba/ +CVE-2026-16617 - https://wpscan.com/vulnerability/fc51a940-8e67-45d0-b47d-b16da288ebb3/ CVE-2026-16618 - https://wpscan.com/vulnerability/3754d4c0-1b67-49a4-a29a-7169446638d1/ CVE-2026-16619 - https://wpscan.com/vulnerability/54fc1229-3e68-4d21-baec-59a44cf12a65/ CVE-2026-16620 - https://wpscan.com/vulnerability/71e6ccc0-5626-4cce-986e-5591f5df92bd/ @@ -143953,6 +144246,7 @@ CVE-2026-16940 - https://wpscan.com/vulnerability/a315a6ac-3ffb-4735-92ca-6e8533 CVE-2026-16942 - https://wpscan.com/vulnerability/cda6b957-2013-4707-a5b5-5ddc04be2f6a/ CVE-2026-16948 - https://wpscan.com/vulnerability/50e47ee9-cffc-4435-bc77-77fc65e9ff16/ CVE-2026-16949 - https://wpscan.com/vulnerability/3e07356a-5ac8-4d9f-bef2-65aaecbf1419/ +CVE-2026-16950 - https://wpscan.com/vulnerability/c1a2635a-9919-460f-b662-e5e3f80d2361/ CVE-2026-16953 - https://wpscan.com/vulnerability/8f5460a7-9764-4ce1-9cb4-8202b192765d/ CVE-2026-16954 - https://wpscan.com/vulnerability/badce355-e6ce-4dd4-8d9b-c87a7b9db12f/ CVE-2026-16955 - https://wpscan.com/vulnerability/1b413d84-61c7-4e19-a693-312d74f618ff/ @@ -143962,6 +144256,7 @@ CVE-2026-16968 - https://wpscan.com/vulnerability/d7a4e3ee-507d-44fb-9386-27ad67 CVE-2026-16970 - http://www.openwall.com/lists/oss-security/2026/07/30/12 CVE-2026-16970 - https://github.com/sbaresearch/advisories/tree/public/2026/SBA-ADV-20260128-04_DFIR-IRIS_Insufficient_Logout CVE-2026-16977 - https://wpscan.com/vulnerability/70430b75-9b5e-4f47-8b37-7be1da5ba063/ +CVE-2026-16979 - https://wpscan.com/vulnerability/c9eb27aa-c5f9-4f1c-b87c-337ebaf192dd/ CVE-2026-16981 - https://wpscan.com/vulnerability/61b3228d-50a0-4928-977a-23448939dff9/ CVE-2026-16985 - https://wpscan.com/vulnerability/045a15f3-5750-4c4e-977d-e1283e3c967d/ CVE-2026-16988 - https://wpscan.com/vulnerability/162fa8ab-4d80-46f8-9a15-63c8dfd0be33/ @@ -144035,6 +144330,7 @@ CVE-2026-17533 - https://wpscan.com/vulnerability/13b57cdc-d954-4db6-94c2-53ad04 CVE-2026-17540 - https://wpscan.com/vulnerability/096cb7df-26a5-4f5f-bbec-725e063a2b75/ CVE-2026-17541 - https://wpscan.com/vulnerability/972bf72f-08c4-41ec-b6e9-2d6083d21734/ CVE-2026-17542 - https://wpscan.com/vulnerability/d17f3de9-b0f9-4bbd-8a57-18cda9d43d79/ +CVE-2026-17565 - https://wpscan.com/vulnerability/e88e0b71-145c-4edd-9b62-783215b64c67/ CVE-2026-17568 - https://devolutions.net/security/advisories/DEVO-2026-0026/ CVE-2026-17569 - https://devolutions.net/security/advisories/DEVO-2026-0026/ CVE-2026-17570 - https://devolutions.net/security/advisories/DEVO-2026-0026/ @@ -144050,6 +144346,7 @@ CVE-2026-1769 - https://securitydocs.business.xerox.com/wp-content/uploads/2026/ CVE-2026-1803 - https://github.com/Blackhole23-Lab/-/blob/main/vulns/ssh-backdoor.md CVE-2026-1803 - https://github.com/Blackhole23-Lab/-/blob/main/vulns/ssh-backdoor.md#proof-of-concept CVE-2026-18030 - https://wpscan.com/vulnerability/15463bda-fb39-4629-b96b-34b83191bab7/ +CVE-2026-18031 - https://wpscan.com/vulnerability/6576dcd1-aea6-47c0-9157-4ca56f426612/ CVE-2026-18032 - https://wpscan.com/vulnerability/1b6c5935-c8e0-4b9b-9ba6-0f16a0e2cdae/ CVE-2026-18035 - https://wpscan.com/vulnerability/9c5cae62-4c4c-434b-ae40-4654b257803f/ CVE-2026-18037 - https://wpscan.com/vulnerability/cd61ce2a-94ce-4ce3-a592-b7329f118f94/ @@ -144059,15 +144356,18 @@ CVE-2026-18046 - https://wpscan.com/vulnerability/4f5ee68e-3513-4f05-839e-60ae62 CVE-2026-18048 - https://wpscan.com/vulnerability/fbc145d3-a582-4975-bc6b-e56e633e51e6/ CVE-2026-18049 - https://wpscan.com/vulnerability/ee7a93ff-95f2-48f6-9e35-2e518a28e2ab/ CVE-2026-18050 - https://wpscan.com/vulnerability/84964951-d25a-4753-bf71-fe00e2492a89/ +CVE-2026-18051 - https://wpscan.com/vulnerability/dc56cdd2-419b-4a64-9d2a-29dc7e79cb6d/ CVE-2026-18057 - https://wpscan.com/vulnerability/e2685778-936f-4920-9b5c-0fcbb9da6d26/ CVE-2026-1810 - https://github.com/bolo-blog/bolo-solo/issues/326 CVE-2026-1811 - https://github.com/bolo-blog/bolo-solo/issues/327 CVE-2026-1812 - https://github.com/bolo-blog/bolo-solo/issues/328 CVE-2026-1813 - https://github.com/bolo-blog/bolo-solo/issues/329 CVE-2026-18200 - https://wpscan.com/vulnerability/a5864653-4df6-4d8d-9f8a-ace7b0220342/ +CVE-2026-18202 - https://wpscan.com/vulnerability/911d3b5a-0f03-4423-b4b0-84e588c323d8/ CVE-2026-18216 - https://wpscan.com/vulnerability/f12530c5-4069-42c2-9f1c-b00fc62aa387/ CVE-2026-18220 - https://bugzilla.redhat.com/show_bug.cgi?id=2507670 CVE-2026-18230 - https://wpscan.com/vulnerability/15789d28-053d-427b-94f3-c43125e4fea6/ +CVE-2026-18231 - https://wpscan.com/vulnerability/c4508c33-40ac-42c6-aa7e-cf9004d381bd/ CVE-2026-1835 - https://github.com/webzzaa/CVE-/issues/6 CVE-2026-18357 - https://wpscan.com/vulnerability/ff675d0a-03f2-4309-830c-0e96e1d95a62/ CVE-2026-18366 - https://wpscan.com/vulnerability/82767ce2-01e4-46ad-a52b-72d3ab2049bd/ @@ -144076,6 +144376,7 @@ CVE-2026-18395 - https://wpscan.com/vulnerability/999656c5-2e2d-4af8-9941-361845 CVE-2026-18403 - https://fluidattacks.com/es/advisories/rihanna CVE-2026-18464 - https://wpscan.com/vulnerability/45d1c2c2-c5da-43b6-a982-5323fb8d9014/ CVE-2026-18465 - https://wpscan.com/vulnerability/53da3a6d-1eab-4f61-ba61-fa7a04d2205a/ +CVE-2026-18466 - https://wpscan.com/vulnerability/2e12d9cf-520a-4602-aeee-7dbc26f79951/ CVE-2026-18468 - https://wpscan.com/vulnerability/0b567954-4bcc-4e2a-a2b5-024175012a19/ CVE-2026-18469 - https://wpscan.com/vulnerability/be74144a-b45b-469f-8631-7fdca6d19a66/ CVE-2026-18470 - https://wpscan.com/vulnerability/589b7661-4a0d-4041-8c29-2819d8b1e402/ @@ -144090,6 +144391,10 @@ CVE-2026-18666 - https://wpscan.com/vulnerability/7a9b3fff-f454-4764-ad60-0b2737 CVE-2026-1867 - https://wpscan.com/vulnerability/a78ebcd2-9355-4f4e-829e-b10867463576/ CVE-2026-1868 - https://gitlab.com/gitlab-org/modelops/applied-ml/code-suggestions/ai-assist/-/work_items/1850 CVE-2026-18770 - https://asciinema.org/a/1230301 +CVE-2026-18776 - https://wpscan.com/vulnerability/4b6abb2d-941b-429f-a480-33d1aafad450/ +CVE-2026-18777 - https://wpscan.com/vulnerability/05a09ba7-b781-4462-8c50-3a45f2757cb2/ +CVE-2026-18778 - https://wpscan.com/vulnerability/0a9b6706-ff3a-4a41-b85c-fce696471217/ +CVE-2026-18779 - https://wpscan.com/vulnerability/9d7f9a09-a144-4a0a-998c-e5bc5037fc1b/ CVE-2026-18786 - https://wpscan.com/vulnerability/f53e1706-e926-4a2c-a2a7-465b4ca5d102/ CVE-2026-18789 - https://wpscan.com/vulnerability/1e2ce237-dc91-4144-875a-339b5ea05f3a/ CVE-2026-1879 - https://gist.github.com/KaiqueFerreiraPeres/ba039887d7f894a7c38252314e0ef2cc @@ -144099,6 +144404,7 @@ CVE-2026-1884 - https://github.com/ez-lbz/ez-lbz.github.io/issues/9#issue-383284 CVE-2026-1884 - https://vuldb.com/?id.344264 CVE-2026-1890 - https://wpscan.com/vulnerability/9b88be70-b5cc-4a3f-a871-64d61cb02076/ CVE-2026-18934 - https://wpscan.com/vulnerability/f87c5a11-59a1-47cc-bc1c-d12108b510ab/ +CVE-2026-18937 - https://wpscan.com/vulnerability/a23b76eb-107d-4e02-8eae-c3c5fa5b003d/ CVE-2026-18943 - https://wpscan.com/vulnerability/9f2f3db0-1031-4e16-96f2-12a02b97ad06/ CVE-2026-18945 - https://wpscan.com/vulnerability/0d43b739-90de-4bae-90c1-3acaee8888e6/ CVE-2026-18946 - https://wpscan.com/vulnerability/fa13ebbb-8eea-492d-8f59-58228efb94d8/ @@ -144110,6 +144416,8 @@ CVE-2026-19049 - https://wpscan.com/vulnerability/5405c86c-1cf5-4123-9dea-864096 CVE-2026-19050 - https://wpscan.com/vulnerability/76d9ef00-5335-4373-903c-4ff368417f94/ CVE-2026-19052 - https://wpscan.com/vulnerability/39bf1b67-34f1-456a-b420-7bbf238964a1/ CVE-2026-19053 - https://wpscan.com/vulnerability/c9bad349-d2d6-4b67-a107-818f25d9bf76/ +CVE-2026-19055 - https://wpscan.com/vulnerability/a1243ff3-3f0e-4068-a716-722e7cf4856b/ +CVE-2026-19056 - https://wpscan.com/vulnerability/83ad2038-3755-40a5-a8af-e6fac94341d1/ CVE-2026-19065 - https://vuldb.com/cve/CVE-2026-19065 CVE-2026-19067 - https://github.com/ltranquility/submit_vuln/issues/12 CVE-2026-19068 - https://github.com/ltranquility/submit_vuln/issues/13 @@ -144130,6 +144438,9 @@ CVE-2026-19217 - https://wpscan.com/vulnerability/c27c1dcd-a6d2-4e1d-a9da-88dff8 CVE-2026-19230 - https://vuldb.com/vuln/386994/cti CVE-2026-19278 - https://bugzilla.redhat.com/show_bug.cgi?id=2512524 CVE-2026-19347 - https://github.com/ltranquility/submit_vuln/issues/17 +CVE-2026-19406 - https://wpscan.com/vulnerability/53cfb207-8f26-438c-a928-bc9271f312f0/ +CVE-2026-19416 - https://wpscan.com/vulnerability/ef2aa44b-3624-4e6d-9b25-e33d4a1a21d2/ +CVE-2026-19417 - https://wpscan.com/vulnerability/4270b160-cbb8-46b2-853c-927651ca16bf/ CVE-2026-19433 - https://secur0.com/en/cna/cve-list/cve-2026-19433-idor-in-prospero-flow-crm-contact-save-and-vcard-export CVE-2026-19434 - https://secur0.com/en/cna/cve-list/cve-2026-19434-stored-xss-in-pentestify-finding-severity-field CVE-2026-1953 - https://github.com/carlosbudiman/CVE-2026-1953-Disclosure @@ -144140,6 +144451,7 @@ CVE-2026-1966 - https://docs.yugabyte.com/stable/secure/vulnerability-disclosure CVE-2026-1969 - https://wpscan.com/vulnerability/762530ae-80a5-4ff8-9725-6adab9498c33/ CVE-2026-19694 - https://gitlab.com/wireshark/wireshark/-/work_items/21389 CVE-2026-19695 - https://gitlab.com/wireshark/wireshark/-/work_items/21475 +CVE-2026-19709 - https://wpscan.com/vulnerability/957888a4-bb11-42c6-930a-8c836170452b/ CVE-2026-19711 - https://wpscan.com/vulnerability/ba209669-49bb-40f0-976d-7b77fa0a3c85/ CVE-2026-19712 - https://wpscan.com/vulnerability/08c31101-ee38-46e9-b451-abb1ed70079c/ CVE-2026-19714 - https://wpscan.com/vulnerability/dc6e54eb-d856-484b-88c1-b3e04a37669d/ @@ -144158,8 +144470,10 @@ CVE-2026-1975 - https://github.com/free5gc/free5gc/issues/814 CVE-2026-1975 - https://github.com/free5gc/free5gc/issues/814#issue-3831993593 CVE-2026-19768 - https://devolutions.net/security/advisories/DEVO-2026-0028/ CVE-2026-1977 - https://github.com/isaacwasserman/mcp-vegalite-server/issues/9 +CVE-2026-19782 - https://wpscan.com/vulnerability/8dabc48e-15ee-482c-be77-6ad6fb312a7a/ CVE-2026-1979 - https://github.com/mruby/mruby/issues/6701 CVE-2026-1979 - https://github.com/mruby/mruby/issues/6701#issue-3802609843 +CVE-2026-19842 - https://wpscan.com/vulnerability/7b79d86e-d3f8-4d4f-929b-fd00540cc00f/ CVE-2026-19884 - https://gitlab.eclipse.org/security/vulnerability-reports/-/work_items/175 CVE-2026-19894 - https://github.com/ltranquility/submit_vuln/issues/18 CVE-2026-1990 - https://github.com/oatpp/oatpp/issues/1080 @@ -144168,6 +144482,7 @@ CVE-2026-19934 - https://github.com/ltranquility/submit_vuln/issues/19 CVE-2026-1998 - https://github.com/micropython/micropython/issues/18639 CVE-2026-1998 - https://github.com/micropython/micropython/issues/18639#issue-3780651410 CVE-2026-2000 - https://github.com/physicszq/Routers/tree/main/Dcme +CVE-2026-20000 - https://github.com/Kristin5634487/cve/issues/3 CVE-2026-20029 - https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-xxe-jWSbSDKt CVE-2026-2008 - https://github.com/abhiphile/fermat-mcp/issues/9 CVE-2026-2008 - https://github.com/abhiphile/fermat-mcp/issues/9#issue-3837794397 @@ -144192,9 +144507,11 @@ CVE-2026-2016 - https://github.com/happyfish100/libfastcommon/issues/55#issue-38 CVE-2026-2016 - https://github.com/happyfish100/libfastcommon/issues/55#issuecomment-3776757848 CVE-2026-2018 - https://github.com/ltranquility/CVE/issues/36 CVE-2026-2018 - https://vuldb.com/?submit.744075 +CVE-2026-20200 - https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cimc-arg-inject-upSHdMfU CVE-2026-20230 - https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cucm-ssrf-cXPnHcW CVE-2026-2025 - https://wpscan.com/vulnerability/1b815cde-cd9d-46fa-a6ab-3d2851705e7b/ CVE-2026-20253 - https://labs.watchtowr.com/why-use-app-level-auth-when-every-database-has-auth-splunk-enterprise-cve-2026-20253-pre-auth-rce/ +CVE-2026-20288 - https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cimc-arg-inject-upSHdMfU CVE-2026-20337 - https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-clamav-WuuvVd26 CVE-2026-20338 - https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-clamav-WuuvVd26 CVE-2026-20339 - https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-clamav-WuuvVd26 @@ -145103,6 +145420,7 @@ CVE-2026-24908 - https://github.com/openemr/openemr/security/advisories/GHSA-rcc CVE-2026-24909 - https://www.koi.ai/blog/packagegate-6-zero-days-in-js-package-managers-but-npm-wont-act CVE-2026-24910 - https://www.koi.ai/blog/packagegate-6-zero-days-in-js-package-managers-but-npm-wont-act CVE-2026-25038 - https://github.com/go-gitea/gitea/security/advisories/GHSA-v73x-hx65-6pf4 +CVE-2026-25039 - https://github.com/Scille/parsec-cloud/security/advisories/GHSA-qx56-wxpm-j4m6 CVE-2026-25040 - https://drive.google.com/file/d/1Dtn1WLJILRYUeoMjEbUfCbqQ3g2AW2Qz/view?usp=sharing CVE-2026-25040 - https://github.com/Budibase/budibase/security/advisories/GHSA-4wfw-r86x-qxrm CVE-2026-25043 - https://github.com/Budibase/budibase/security/advisories/GHSA-277c-prw2-rqgh @@ -145287,6 +145605,7 @@ CVE-2026-25791 - https://github.com/BishopFox/sliver/security/advisories/GHSA-wx CVE-2026-25792 - https://github.com/greenshot/greenshot/security/advisories/GHSA-f8v9-7fph-fr2j CVE-2026-25802 - https://github.com/QuantumNous/new-api/security/advisories/GHSA-299v-8pq9-5gjq CVE-2026-25805 - https://github.com/zed-industries/zed/security/advisories/GHSA-f2g4-87h6-4pxq +CVE-2026-25807 - https://github.com/TaklaXBR/zai-shell/security/advisories/GHSA-6pjj-r955-34rr CVE-2026-25808 - https://github.com/fedify-dev/hollo/security/advisories/GHSA-6r2w-3pcj-v4v5 CVE-2026-25855 - https://hackernoon.com/one-empty-header-to-admin-how-an-auth-bypass-breaks-openbullet2 CVE-2026-25856 - https://hackernoon.com/one-empty-header-to-admin-how-an-auth-bypass-breaks-openbullet2 @@ -145322,6 +145641,7 @@ CVE-2026-25953 - https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-p6r CVE-2026-25954 - https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-cc88-4j37-mw6j CVE-2026-25955 - https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-4g54-x8v7-559x CVE-2026-25959 - https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-78xg-v4p2-4w3c +CVE-2026-25961 - https://github.com/sumatrapdfreader/sumatrapdf/security/advisories/GHSA-xpm2-rr5m-x96q CVE-2026-25964 - https://github.com/TandoorRecipes/recipes/security/advisories/GHSA-6485-jr28-52xx CVE-2026-25992 - https://github.com/siyuan-note/siyuan/security/advisories/GHSA-f72r-2h5j-7639 CVE-2026-25996 - https://github.com/inspektor-gadget/inspektor-gadget/commit/d59cf72971f9b7110d9c179dc8ae8b7a11dbd6d2 @@ -146572,22 +146892,27 @@ CVE-2026-3201 - https://gitlab.com/wireshark/wireshark/-/issues/20972 CVE-2026-32017 - https://github.com/openclaw/openclaw/security/advisories/GHSA-3x3x-h76w-hp98 CVE-2026-32023 - https://github.com/openclaw/openclaw/security/advisories/GHSA-ccg8-46r6-9qgj CVE-2026-3204 - https://devolutions.net/security/advisories/DEVO-2026-0005 +CVE-2026-32063 - https://github.com/openclaw/openclaw/security/advisories/GHSA-vffc-f7r7-rx2w CVE-2026-32077 - https://www.vicarius.io/vsociety/posts/cve-2026-32077-detection-script-elevation-of-privilege-vulnerability-affecting-windows-upnp CVE-2026-32077 - https://www.vicarius.io/vsociety/posts/cve-2026-32077-mitigation-script-elevation-of-privilege-vulnerability-affecting-windows-upnp CVE-2026-32094 - https://github.com/ericcornelissen/shescape/security/advisories/GHSA-9jfh-9xrq-4vwm +CVE-2026-32101 - https://github.com/withstudiocms/studiocms/security/advisories/GHSA-mm78-fgq8-6pgr CVE-2026-32102 - https://github.com/OliveTin/OliveTin/security/advisories/GHSA-228v-wc5r-j8m7 CVE-2026-32103 - https://github.com/withstudiocms/studiocms/security/advisories/GHSA-h7vr-cg25-jf8c CVE-2026-32104 - https://github.com/withstudiocms/studiocms/security/advisories/GHSA-9v82-xrm4-mp52 CVE-2026-32117 - https://github.com/ekacnet/grafanacubism-panel/security/advisories/GHSA-q6fh-6m3m-5948 CVE-2026-32118 - https://github.com/openemr/openemr/security/advisories/GHSA-55qj-x8wh-m4rm CVE-2026-32120 - https://github.com/openemr/openemr/security/advisories/GHSA-pvvj-mv7h-7847 +CVE-2026-32121 - https://github.com/openemr/openemr/security/advisories/GHSA-68fr-xm3v-p4vw CVE-2026-32122 - https://github.com/openemr/openemr/security/advisories/GHSA-rwf9-px3c-3prw CVE-2026-32125 - https://github.com/openemr/openemr/security/advisories/GHSA-244w-vxhp-7x99 CVE-2026-32126 - https://github.com/openemr/openemr/security/advisories/GHSA-752v-x6m4-6cf8 +CVE-2026-32133 - https://github.com/Bubka/2FAuth/security/advisories/GHSA-8qp3-x2mp-j6f8 CVE-2026-32137 - https://github.com/dataease/dataease/security/advisories/GHSA-vgm2-269h-8624 CVE-2026-32144 - https://cna.erlef.org/cves/CVE-2026-32144.html CVE-2026-32145 - https://cna.erlef.org/cves/CVE-2026-32145.html CVE-2026-32146 - https://cna.erlef.org/cves/CVE-2026-32146.html +CVE-2026-32146 - https://github.com/gleam-lang/gleam/security/advisories/GHSA-vq5j-55vx-wq8j CVE-2026-32147 - https://cna.erlef.org/cves/CVE-2026-32147.html CVE-2026-32148 - https://cna.erlef.org/cves/CVE-2026-32148.html CVE-2026-32148 - https://github.com/hexpm/hex/security/advisories/GHSA-hmv9-4mfr-m92v @@ -146600,6 +146925,7 @@ CVE-2026-3221 - https://devolutions.net/security/advisories/DEVO-2026-0004/ CVE-2026-32223 - https://www.vicarius.io/vsociety/posts/cve-2026-32223-detection-script-heap-based-buffer-overflow-in-windows-usb-print-driver CVE-2026-32223 - https://www.vicarius.io/vsociety/posts/cve-2026-32223-mitigation-script-heap-based-buffer-overflow-in-windows-usb-print-driver CVE-2026-32230 - https://github.com/louislam/uptime-kuma/security/advisories/GHSA-c7hf-c5p5-5g6h +CVE-2026-32231 - https://github.com/qhkm/zeptoclaw/security/advisories/GHSA-46q5-g3j9-wx5c CVE-2026-32239 - https://capnproto.org/capnproto-c++-1.4.0.tar.gz CVE-2026-32239 - https://capnproto.org/capnproto-c++-win32-1.4.0.zip CVE-2026-3224 - https://devolutions.net/security/advisories/DEVO-2026-0005/ @@ -146607,6 +146933,7 @@ CVE-2026-32240 - https://capnproto.org/capnproto-c++-1.4.0.tar.gz CVE-2026-32240 - https://capnproto.org/capnproto-c++-win32-1.4.0.zip CVE-2026-32245 - https://github.com/steveiliop56/tinyauth/security/advisories/GHSA-xg2q-62g2-cvcm CVE-2026-32246 - https://github.com/steveiliop56/tinyauth/security/advisories/GHSA-3q28-qjrv-qr39 +CVE-2026-32267 - https://github.com/craftcms/cms/security/advisories/GHSA-cc7p-2j3x-x7xf CVE-2026-32271 - https://github.com/craftcms/commerce/security/advisories/GHSA-875v-7m49-8x88 CVE-2026-3229 - https://github.com/wolfSSL/wolfssl/pull/9827 CVE-2026-3230 - https://github.com/wolfSSL/wolfssl/pull/9754 @@ -146619,6 +146946,7 @@ CVE-2026-3231 - https://research.cleantalk.org/cve-2026-3231/ CVE-2026-32310 - https://github.com/cryptomator/cryptomator/security/advisories/GHSA-5phc-5pfx-hr52 CVE-2026-32311 - https://github.com/reconurge/flowsint/security/advisories/GHSA-9g44-8xv2-f2m9 CVE-2026-32313 - https://github.com/robrichards/xmlseclibs/security/advisories/GHSA-4v26-v6cg-g6f9 +CVE-2026-32595 - https://github.com/traefik/traefik/security/advisories/GHSA-g3hg-j4jv-cwfr CVE-2026-32596 - https://github.com/nicolargo/glances/security/advisories/GHSA-wvxv-4j8q-4wjq CVE-2026-32598 - https://github.com/OneUptime/oneuptime/security/advisories/GHSA-4524-cj9j-g4fj CVE-2026-32604 - https://zeropath.com/blog/spinnaker-rce-production-compromise @@ -146632,16 +146960,21 @@ CVE-2026-32617 - https://github.com/Mintplex-Labs/anything-llm/security/advisori CVE-2026-3262 - https://github.com/Ghufran2/CVE-Asp.Net-Core-Inventory-Order-Management-System-Advisories/blob/main/Asp.Net-Core-Inventory-Order-Management-System%20Privilege%20Escalation%20via%20Client-Side%20Redirect%20Bypass.md CVE-2026-32625 - https://github.com/danny-avila/LibreChat/security/advisories/GHSA-4pcc-j6m6-wcwx CVE-2026-32626 - https://github.com/Mintplex-Labs/anything-llm/security/advisories/GHSA-rrmw-2j6x-4mf2 +CVE-2026-32629 - https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-98gw-w575-h2ph +CVE-2026-32634 - https://github.com/nicolargo/glances/security/advisories/GHSA-vx5f-957p-qpvm CVE-2026-3264 - https://github.com/Ghufran2/CVE-Free-CRM-Advisories/blob/main/Free-CRM%20Privilege%20Escalation%20via%20Client-Side%20Redirect%20Authorization%20Bypass.md CVE-2026-3268 - https://github.com/AnalogyC0de/public_exp/issues/14 CVE-2026-32685 - https://cna.erlef.org/cves/CVE-2026-32685.html +CVE-2026-32685 - https://github.com/gleam-lang/gleam/security/advisories/GHSA-wjx8-7w8m-p4v7 CVE-2026-32686 - https://cna.erlef.org/cves/CVE-2026-32686.html CVE-2026-32686 - https://github.com/ericmj/decimal/security/advisories/GHSA-rhv4-8758-jx7v CVE-2026-32687 - https://cna.erlef.org/cves/CVE-2026-32687.html CVE-2026-32688 - https://cna.erlef.org/cves/CVE-2026-32688.html CVE-2026-32689 - https://cna.erlef.org/cves/CVE-2026-32689.html CVE-2026-3269 - https://github.com/AnalogyC0de/public_exp/issues/13 +CVE-2026-32695 - https://github.com/traefik/traefik/security/advisories/GHSA-67jx-r9pv-98rj CVE-2026-32696 - https://github.com/nanomq/nanomq/security/advisories/GHSA-77f4-wvq8-mp3p +CVE-2026-32699 - https://github.com/NeoRazorX/facturascripts/security/advisories/GHSA-pp79-hqv6-vmc3 CVE-2026-3270 - https://github.com/AnalogyC0de/public_exp/issues/12 CVE-2026-32702 - https://github.com/Cleanuparr/Cleanuparr/security/advisories/GHSA-gjmf-m27r-2c9v CVE-2026-32704 - https://github.com/siyuan-note/siyuan/security/advisories/GHSA-4j3x-hhg2-fm2x @@ -146651,22 +146984,34 @@ CVE-2026-32708 - https://github.com/PX4/PX4-Autopilot/security/advisories/GHSA-6 CVE-2026-32709 - https://github.com/PX4/PX4-Autopilot/security/advisories/GHSA-fh32-qxj9-x32f CVE-2026-3271 - https://github.com/Litengzheng/vul_db/blob/main/F453/vul_70/README.md CVE-2026-32711 - https://github.com/pydicom/pydicom/security/advisories/GHSA-v856-2rf8-9f28 +CVE-2026-32713 - https://github.com/PX4/PX4-Autopilot/security/advisories/GHSA-pp2c-jr5g-6f2m +CVE-2026-32714 - https://github.com/scitokens/scitokens/security/advisories/GHSA-rh5m-2482-966c CVE-2026-32716 - https://github.com/scitokens/scitokens/security/advisories/GHSA-w8fp-g9rh-34jh CVE-2026-32717 - https://github.com/Mintplex-Labs/anything-llm/security/advisories/GHSA-7754-8jcc-2rg3 +CVE-2026-32718 - https://github.com/coollabsio/coolify/security/advisories/GHSA-f47p-xrgc-977v CVE-2026-3272 - https://github.com/Litengzheng/vul_db/blob/main/F453/vul_71/README.md +CVE-2026-32721 - https://github.com/openwrt/luci/security/advisories/GHSA-vvj6-7362-pjrw CVE-2026-32722 - https://github.com/bloomberg/memray/security/advisories/GHSA-r5pr-887v-m2w9 CVE-2026-32726 - https://github.com/scitokens/scitokens-cpp/security/advisories/GHSA-q5fm-fgvx-32jq CVE-2026-3273 - https://github.com/Litengzheng/vul_db/blob/main/F453/vul_73/README.md CVE-2026-32730 - https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-v9xm-ffx2-7h35 +CVE-2026-32733 - https://github.com/squidowl/halloy/security/advisories/GHSA-fqrv-rfg4-rv89 CVE-2026-32736 - https://github.com/HytaleModding/wiki/security/advisories/GHSA-xvq7-wwhx-x2fh +CVE-2026-32738 - https://github.com/strukturag/libheif/security/advisories/GHSA-7f2h-cmpf-v9ww CVE-2026-32739 - https://github.com/strukturag/libheif/security/advisories/GHSA-j9g7-q9hv-gq8c CVE-2026-3274 - https://github.com/Litengzheng/vul_db/blob/main/F453/vul_74/README.md +CVE-2026-32740 - https://github.com/strukturag/libheif/security/advisories/GHSA-frfr-f3vg-2g6j CVE-2026-32741 - https://github.com/strukturag/libheif/security/advisories/GHSA-j3w5-7whq-p37q CVE-2026-32746 - https://lists.gnu.org/archive/html/bug-inetutils/2026-03/msg00031.html +CVE-2026-32747 - https://github.com/siyuan-note/siyuan/security/advisories/GHSA-h5vh-m7fg-w5h6 CVE-2026-3275 - https://github.com/Litengzheng/vul_db/blob/main/F453/vul_75/README.md +CVE-2026-32751 - https://github.com/siyuan-note/siyuan/security/advisories/GHSA-qr46-rcv3-4hq3 +CVE-2026-32753 - https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-cvr8-cw5c-5pfw +CVE-2026-32754 - https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-56h2-5556-r6mg CVE-2026-32755 - https://github.com/Admidio/admidio/security/advisories/GHSA-h8gr-qwr6-m9gx CVE-2026-32756 - https://github.com/Admidio/admidio/security/advisories/GHSA-95cq-p4w2-32w5 CVE-2026-32757 - https://github.com/Admidio/admidio/security/advisories/GHSA-4wr4-f2qf-x5wj +CVE-2026-32759 - https://github.com/filebrowser/filebrowser/security/advisories/GHSA-ffx7-75gc-jg7c CVE-2026-32763 - https://github.com/kysely-org/kysely/security/advisories/GHSA-wmrf-hv6w-mr66 CVE-2026-32767 - https://github.com/siyuan-note/siyuan/security/advisories/GHSA-j7wh-x834-p3r7 CVE-2026-3277 - https://devolutions.net/security/advisories/DEVO-2026-0006 @@ -146676,8 +147021,12 @@ CVE-2026-32776 - https://cert-portal.siemens.com/productcert/html/ssa-082556.htm CVE-2026-32777 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html CVE-2026-32778 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html CVE-2026-32808 - https://github.com/pyload/pyload/security/advisories/GHSA-7g4m-8hx2-4qh3 +CVE-2026-32810 - https://github.com/squidowl/halloy/security/advisories/GHSA-x5j2-fr4h-9p7g CVE-2026-32811 - https://github.com/dadrus/heimdall/security/advisories/GHSA-r8x2-fhmf-6mxp CVE-2026-32812 - https://github.com/Admidio/admidio/security/advisories/GHSA-6j68-gcc3-mq73 +CVE-2026-32813 - https://github.com/Admidio/admidio/security/advisories/GHSA-3x67-4c2c-w45m +CVE-2026-32814 - https://github.com/strukturag/libheif/security/advisories/GHSA-4m8r-34pg-rvwc +CVE-2026-32816 - https://github.com/Admidio/admidio/security/advisories/GHSA-wwg8-6ffr-h4q2 CVE-2026-32817 - https://github.com/Admidio/admidio/security/advisories/GHSA-rmpj-3x5m-9m5f CVE-2026-32837 - https://github.com/mackron/miniaudio/issues/1101 CVE-2026-32848 - https://nasm.re/posts/uaf_netbsd_crypto/ @@ -146686,6 +147035,7 @@ CVE-2026-32850 - https://karmainsecurity.com/KIS-2026-05 CVE-2026-32851 - https://karmainsecurity.com/KIS-2026-05 CVE-2026-32852 - https://karmainsecurity.com/KIS-2026-05 CVE-2026-32853 - https://github.com/LibVNC/libvncserver/security/advisories/GHSA-87q7-v983-qwcj +CVE-2026-32854 - https://github.com/LibVNC/libvncserver/security/advisories/GHSA-xjp8-4qqv-5x4x CVE-2026-32871 - https://github.com/PrefectHQ/fastmcp/security/advisories/GHSA-vv7q-7jx5-f767 CVE-2026-32873 - https://github.com/vshakitskiy/ewe/security/advisories/GHSA-4w98-xf39-23gp CVE-2026-32875 - https://github.com/ultrajson/ultrajson/issues/700 @@ -146695,6 +147045,7 @@ CVE-2026-32885 - https://github.com/ddev/ddev/security/advisories/GHSA-x2xq-qhjf CVE-2026-32888 - https://github.com/opensourcepos/opensourcepos/security/advisories/GHSA-hmjv-wm3j-pfhw CVE-2026-32889 - https://github.com/tinytag/tinytag/security/advisories/GHSA-f4rq-2259-hv29 CVE-2026-32890 - https://github.com/openVESSL/Anchorr/security/advisories/GHSA-qpmq-6wjc-w28q +CVE-2026-32891 - https://github.com/openVESSL/Anchorr/security/advisories/GHSA-6mg4-788h-7g9g CVE-2026-32894 - https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-rqpg-p95v-fv98 CVE-2026-3292 - https://gist.github.com/0psPwn/46468da7329f7c676c737b4b6b473ddc CVE-2026-3293 - https://github.com/snowflakedb/snowflake-jdbc/issues/2505 @@ -146706,6 +147057,7 @@ CVE-2026-32938 - https://github.com/siyuan-note/siyuan/security/advisories/GHSA- CVE-2026-32939 - https://github.com/dataease/dataease/security/advisories/GHSA-pj7p-3m49-52qq CVE-2026-32940 - https://github.com/advisories/GHSA-6865-qjcf-286f CVE-2026-32941 - https://github.com/BishopFox/sliver/security/advisories/GHSA-97vp-pwqj-46qc +CVE-2026-32948 - https://github.com/sbt/sbt/security/advisories/GHSA-x4ff-q6h8-v7gw CVE-2026-32949 - https://github.com/dataease/SQLBot/security/advisories/GHSA-wqj3-xcxf-j9m9 CVE-2026-32983 - https://github.com/wazuh/wazuh/security/advisories/GHSA-rr83-v9v7-jjhp CVE-2026-33006 - http://www.openwall.com/lists/oss-security/2026/05/04/21 @@ -146769,6 +147121,7 @@ CVE-2026-33811 - https://groups.google.com/g/golang-announce/c/qcCIEXso47M CVE-2026-33814 - https://groups.google.com/g/golang-announce/c/qcCIEXso47M CVE-2026-3382 - https://github.com/ChaiScript/ChaiScript/issues/635 CVE-2026-3382 - https://github.com/ChaiScript/ChaiScript/issues/635#issue-3828258513 +CVE-2026-33824 - https://unit42.paloaltonetworks.com/autonomous-ai-cyber-attack-campaign/ CVE-2026-33825 - https://www.huntress.com/blog/nightmare-eclipse-intrusion CVE-2026-3383 - https://github.com/ChaiScript/ChaiScript/issues/634 CVE-2026-3383 - https://github.com/ChaiScript/ChaiScript/issues/634#issue-3828234470 @@ -147512,6 +147865,7 @@ CVE-2026-40083 - https://github.com/Cacti/cacti/security/advisories/GHSA-j9jv-6x CVE-2026-40084 - https://github.com/Cacti/cacti/security/advisories/GHSA-mjvw-mhj5-9jcj CVE-2026-40086 - https://github.com/danielgatis/rembg/security/advisories/GHSA-3wqj-33cg-xc48 CVE-2026-40100 - https://github.com/labring/FastGPT/security/advisories/GHSA-jrhc-f3j7-f8g4 +CVE-2026-40102 - https://github.com/makeplane/plane/security/advisories/GHSA-93x3-ghh7-72j3 CVE-2026-40103 - https://github.com/go-vikunja/vikunja/security/advisories/GHSA-v479-vf79-mg83 CVE-2026-40106 - https://github.com/wazuh/wazuh/security/advisories/GHSA-qvrc-pcfc-jhqc CVE-2026-40107 - https://github.com/siyuan-note/siyuan/security/advisories/GHSA-w95v-4h65-j455 @@ -147527,8 +147881,10 @@ CVE-2026-40148 - https://github.com/MervinPraison/PraisonAI/security/advisories/ CVE-2026-4015 - https://github.com/gpac/gpac/issues/3467 CVE-2026-4015 - https://github.com/gpac/gpac/issues/3467#issuecomment-3945864390 CVE-2026-4015 - https://github.com/user-attachments/files/25493992/poc_texml_overflow.py +CVE-2026-40150 - https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-8f4v-xfm9-3244 CVE-2026-40151 - https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-pm96-6xpr-978x CVE-2026-40152 - https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-7j2f-xc8p-fjmq +CVE-2026-40153 - https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-v8g7-9q6v-p3x8 CVE-2026-40157 - https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-99g3-w8gr-x37c CVE-2026-4016 - https://github.com/gpac/gpac/issues/3468 CVE-2026-4016 - https://github.com/user-attachments/files/25494042/poc_dims_oob.py @@ -147563,6 +147919,7 @@ CVE-2026-40263 - https://github.com/enchant97/note-mark/security/advisories/GHSA CVE-2026-40265 - https://github.com/enchant97/note-mark/security/advisories/GHSA-p5w6-75f9-cc2p CVE-2026-40279 - https://github.com/bacnet-stack/bacnet-stack/security/advisories/GHSA-326g-j95f-gmxv CVE-2026-40284 - https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-mccp-8446-phw5 +CVE-2026-40285 - https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-666r-v2m7-xgp9 CVE-2026-40286 - https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-42rc-rvrx-cmmw CVE-2026-40287 - https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-g985-wjh9-qxxc CVE-2026-40288 - https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-vc46-vw85-3wvm @@ -147613,6 +147970,7 @@ CVE-2026-40566 - https://github.com/freescout-help-desk/freescout/security/advis CVE-2026-40567 - https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-q8v4-v62h-5528 CVE-2026-40568 - https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-w2f5-6wcv-677r CVE-2026-40569 - https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-hmqm-33wp-858j +CVE-2026-40570 - https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-w77q-wjfp-c822 CVE-2026-40571 - https://github.com/NamelessMC/Nameless/security/advisories/GHSA-47hr-jj6c-rqf9 CVE-2026-40572 - https://github.com/MinecAnton209/NovumOS/security/advisories/GHSA-rg7m-6vh7-f4v2 CVE-2026-40576 - https://github.com/haris-musa/excel-mcp-server/security/advisories/GHSA-j98m-w3xp-9f56 @@ -147621,6 +147979,7 @@ CVE-2026-40585 - https://github.com/blueprintue/blueprintue-self-hosted-edition/ CVE-2026-40586 - https://github.com/blueprintue/blueprintue-self-hosted-edition/security/advisories/GHSA-m6c2-6p3h-8jv2 CVE-2026-40587 - https://github.com/blueprintue/blueprintue-self-hosted-edition/security/advisories/GHSA-gqpq-x62g-p4mg CVE-2026-40591 - https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-9ff4-mmhv-x6jp +CVE-2026-40593 - https://github.com/ChurchCRM/CRM/security/advisories/GHSA-7h46-9f64-p49q CVE-2026-40594 - https://github.com/pyload/pyload/security/advisories/GHSA-mp82-fmj6-f22v CVE-2026-40596 - https://mantisbt.org/bugs/view.php?id=37011 CVE-2026-40599 - https://github.com/craigjbass/clearancekit/security/advisories/GHSA-w253-42qp-5f2x @@ -147638,6 +147997,7 @@ CVE-2026-4079 - https://wpscan.com/vulnerability/8ec92881-4ae5-458d-995b-f097f2b CVE-2026-40863 - https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-84wq-86v6-x5j6 CVE-2026-40865 - https://github.com/horilla/horilla-hr/security/advisories/GHSA-85cj-fwjh-fjv7 CVE-2026-40866 - https://github.com/horilla/horilla-hr/security/advisories/GHSA-q2qh-v828-r4p7 +CVE-2026-40868 - https://github.com/kyverno/kyverno/security/advisories/GHSA-q93q-v844-jrqp CVE-2026-40871 - https://github.com/mailcow/mailcow-dockerized/security/advisories/GHSA-r8fq-wrfm-cj2q CVE-2026-40872 - https://github.com/mailcow/mailcow-dockerized/security/advisories/GHSA-f9xf-vc72-rcgm CVE-2026-40873 - https://github.com/mailcow/mailcow-dockerized/security/advisories/GHSA-2xjc-rg88-jvpp @@ -149136,9 +149496,11 @@ CVE-2026-47221 - https://github.com/envoyproxy/envoy/security/advisories/GHSA-rc CVE-2026-47222 - https://github.com/M2Team/NanaZip/security/advisories/GHSA-mqqj-crf3-6q37 CVE-2026-47223 - https://github.com/M2Team/NanaZip/security/advisories/GHSA-qhc5-mh6j-4g75 CVE-2026-47224 - https://github.com/M2Team/NanaZip/security/advisories/GHSA-qcgf-c2vp-fwjr +CVE-2026-47230 - https://github.com/Admidio/admidio/security/advisories/GHSA-q6w3-hpfv-rg36 CVE-2026-47236 - https://github.com/solidtime-io/solidtime/security/advisories/GHSA-33xq-wf67-c7vh CVE-2026-47237 - https://github.com/kubeflow/community-distribution/security/advisories/GHSA-v824-8gxh-pgjw CVE-2026-47238 - https://github.com/MacWarrior/clipbucket-v5/security/advisories/GHSA-x468-whmw-c863 +CVE-2026-47249 - https://github.com/klever-io/klever-go/security/advisories/GHSA-w342-mj6g-v9c4 CVE-2026-47250 - https://github.com/Flux159/mcp-server-kubernetes/security/advisories/GHSA-6mx4-4h42-r8vh CVE-2026-47254 - https://github.com/strukturag/libheif/security/advisories/GHSA-wqjg-4x9g-6cvg CVE-2026-47260 - https://github.com/koel/koel/security/advisories/GHSA-7j2f-6h2r-6cqc @@ -149156,6 +149518,7 @@ CVE-2026-47407 - https://github.com/MervinPraison/PraisonAI/security/advisories/ CVE-2026-47423 - https://github.com/cure53/DOMPurify/security/advisories/GHSA-87xg-pxx2-7hvx CVE-2026-47428 - https://github.com/vitest-dev/vitest/security/advisories/GHSA-2h32-95rg-cppp CVE-2026-4749 - https://github.com/albfan/miraclecast/pull/555 +CVE-2026-47662 - https://github.com/aehrc/pathling/security/advisories/GHSA-26hp-x47g-x95q CVE-2026-47668 - https://github.com/dbgate/dbgate/security/advisories/GHSA-8v3q-9vmx-36vc CVE-2026-47669 - https://github.com/dbgate/dbgate/security/advisories/GHSA-h535-j5hr-mv56 CVE-2026-47671 - https://github.com/nhost/nhost/security/advisories/GHSA-64cj-qvx5-m4f3 @@ -149169,6 +149532,7 @@ CVE-2026-47693 - https://github.com/poweradmin/poweradmin/security/advisories/GH CVE-2026-47694 - https://github.com/WWBN/AVideo/security/advisories/GHSA-c8h8-vq34-9fw2 CVE-2026-47695 - https://github.com/cc-tweaked/CC-Tweaked/security/advisories/GHSA-5jh9-2h63-pw4q CVE-2026-47696 - https://github.com/WWBN/AVideo/security/advisories/GHSA-9392-pj54-qqf8 +CVE-2026-47704 - https://github.com/baptisteArno/typebot.io/security/advisories/GHSA-h67g-6q6g-58cj CVE-2026-47706 - https://github.com/strawberry-graphql/strawberry/security/advisories/GHSA-qfwv-87qj-98xq CVE-2026-47707 - https://github.com/strawberry-graphql/strawberry/security/advisories/GHSA-fr49-mhgj-crfc CVE-2026-47708 - https://github.com/SepineTam/mcp-for-stata/issues/74 @@ -149528,6 +149892,7 @@ CVE-2026-50751 - https://support.checkpoint.com/results/sk/sk185033 CVE-2026-50765 - https://lgnas.gitbook.io/findings/cve-2026-50765 CVE-2026-50766 - https://lgnas.gitbook.io/findings/cve-2026-50766 CVE-2026-50767 - https://lgnas.gitbook.io/findings/cve-2026-50767 +CVE-2026-50768 - https://www.t-systems.com/in/en/content-and-collaboration/solutions/enterprise-content-management/imagemaster CVE-2026-50869 - https://gist.github.com/pyuysig/95931ed2140f3bd85dc67057dd23a47f CVE-2026-50870 - https://gist.github.com/pyuysig/b15055668de5fa09d08448ce830bba10 CVE-2026-50874 - https://gist.github.com/pyuysig/7df16c08213f809592bbc7053c079aba @@ -149722,6 +150087,8 @@ CVE-2026-5394 - https://fluidattacks.com/es/advisories/dragons CVE-2026-53994 - https://www.vulncheck.com/advisories/proftpd-mod-sftp-heap-buffer-overflow-via-unsigned-integer-underflow-and-size-truncation CVE-2026-5402 - https://gitlab.com/wireshark/wireshark/-/issues/21090 CVE-2026-5402 - https://gitlab.com/wireshark/wireshark/-/work_items/21090 +CVE-2026-54025 - https://github.com/danny-avila/LibreChat/security/advisories/GHSA-3phr-62qf-cxf3 +CVE-2026-54027 - https://github.com/danny-avila/LibreChat/security/advisories/GHSA-c55r-p24w-hcj5 CVE-2026-5403 - https://gitlab.com/wireshark/wireshark/-/issues/21103 CVE-2026-5404 - https://gitlab.com/wireshark/wireshark/-/issues/21094 CVE-2026-5405 - https://gitlab.com/wireshark/wireshark/-/issues/21105 @@ -149730,11 +150097,17 @@ CVE-2026-5406 - https://gitlab.com/wireshark/wireshark/-/issues/21070 CVE-2026-5406 - https://gitlab.com/wireshark/wireshark/-/work_items/21070 CVE-2026-5407 - https://gitlab.com/wireshark/wireshark/-/issues/21073 CVE-2026-5407 - https://gitlab.com/wireshark/wireshark/-/work_items/21073 +CVE-2026-54091 - https://github.com/filebrowser/filebrowser/security/advisories/GHSA-j9jx-hp4c-ghhh +CVE-2026-54092 - https://github.com/filebrowser/filebrowser/security/advisories/GHSA-w5fm-68j4-fpc4 +CVE-2026-54093 - https://github.com/filebrowser/filebrowser/security/advisories/GHSA-gxjx-7m74-hcq8 CVE-2026-5420 - https://vuldb.com/vuln/354856 CVE-2026-5420 - https://vuldb.com/vuln/354856/cti CVE-2026-5428 - https://research.cleantalk.org/cve-2026-5428 +CVE-2026-54317 - https://github.com/home-assistant/core/security/advisories/GHSA-x84v-g949-293w CVE-2026-5433 - https://www.honeywell.com/us/en/product-security +CVE-2026-54332 - https://github.com/gopacket/gopacket/security/advisories/GHSA-g6v3-7xmc-w563 CVE-2026-5434 - https://www.honeywell.com/us/en/product-security +CVE-2026-54344 - https://github.com/ToolJet/ToolJet/security/advisories/GHSA-4pm2-w6g5-28mm CVE-2026-5435 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html CVE-2026-5437 - https://www.machinespirits.de/ CVE-2026-5438 - https://www.machinespirits.de/ @@ -149749,9 +150122,17 @@ CVE-2026-5445 - https://www.machinespirits.de/ CVE-2026-5446 - https://github.com/wolfSSL/wolfssl/pull/10111 CVE-2026-5447 - https://github.com/wolfSSL/wolfssl/pull/10112 CVE-2026-5448 - https://github.com/wolfSSL/wolfssl/pull/10071 +CVE-2026-54481 - https://github.com/go-gitea/gitea/security/advisories/GHSA-94v3-77j7-vm48 CVE-2026-5450 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html +CVE-2026-54555 - https://github.com/rtk-ai/rtk/security/advisories/GHSA-7gxq-fvfc-g327 +CVE-2026-54572 - https://github.com/rclone/rclone/commit/1154afebee986180b489084d38e2a0c578751498 +CVE-2026-54572 - https://github.com/rclone/rclone/commit/874a804f5289517defdd7de68b2a374837080265 +CVE-2026-54572 - https://github.com/rclone/rclone/security/advisories/GHSA-cf44-9pgv-m4xc CVE-2026-5468 - https://vuldb.com/vuln/355072 CVE-2026-5468 - https://vuldb.com/vuln/355072/cti +CVE-2026-54684 - https://github.com/skylot/jadx/security/advisories/GHSA-gpvc-ccw7-744v +CVE-2026-54696 - https://github.com/ruby/json/security/advisories/GHSA-x2f5-4prf-w687 +CVE-2026-54765 - https://github.com/traefik/traefik/security/advisories/GHSA-6p8f-p8j2-rqmv CVE-2026-5477 - https://github.com/wolfSSL/wolfssl/pull/10102 CVE-2026-5479 - https://github.com/wolfSSL/wolfssl/pull/10102 CVE-2026-5488 - https://research.cleantalk.org/cve-2026-5488 @@ -149766,17 +150147,22 @@ CVE-2026-54892 - https://cna.erlef.org/cves/CVE-2026-54892.html CVE-2026-54893 - https://cna.erlef.org/cves/CVE-2026-54893.html CVE-2026-54894 - https://cna.erlef.org/cves/CVE-2026-54894.html CVE-2026-54910 - https://github.com/gtsteffaniak/filebrowser/security/advisories/GHSA-vvp7-h4fj-m28w +CVE-2026-54917 - https://github.com/seaweedfs/seaweedfs/security/advisories/GHSA-w62w-66v9-vvgv CVE-2026-5500 - https://github.com/wolfSSL/wolfssl/pull/10102 CVE-2026-5501 - https://github.com/wolfSSL/wolfssl/pull/10102 CVE-2026-5503 - https://github.com/wolfSSL/wolfssl/pull/10102 CVE-2026-5504 - https://github.com/wolfSSL/wolfssl/pull/10088 CVE-2026-55040 - https://www.rapid7.com/blog/post/ra-microsoft-sharepoint-jwt-token-authentication-bypass-cve-2026-55040/ CVE-2026-5507 - https://github.com/wolfSSL/wolfssl/pull/10088 +CVE-2026-55165 - https://github.com/Netflix/lemur/security/advisories/GHSA-r9gp-7f88-9r54 +CVE-2026-55166 - https://github.com/Netflix/lemur/security/advisories/GHSA-v2wp-frmc-5q3v CVE-2026-55180 - https://github.com/pnpm/pnpm/security/advisories/GHSA-3qhv-2rgh-x77r CVE-2026-55187 - https://github.com/axllent/mailpit/security/advisories/GHSA-w4mc-hhc6-xp28 CVE-2026-55188 - https://github.com/rustfs/rustfs/security/advisories/GHSA-796f-j7xp-hwf4 CVE-2026-55189 - https://github.com/rustfs/rustfs/security/advisories/GHSA-3g29-xff2-92vp +CVE-2026-55195 - https://github.com/miurahr/py7zr/security/advisories/GHSA-gjrg-mpp7-g774 CVE-2026-55200 - https://web.archive.org/web/20260623211210/https://github.com/bikini/exploitarium/tree/main/libssh2-cve-2026-55200-poc +CVE-2026-55206 - https://github.com/miurahr/py7zr/security/advisories/GHSA-h4gh-22qq-72r7 CVE-2026-55212 - https://github.com/pimcore/pimcore/security/advisories/GHSA-f97c-ph8j-8vff CVE-2026-55229 - https://github.com/gotenberg/gotenberg/security/advisories/GHSA-2mrg-35hw-x3x9 CVE-2026-55234 - https://github.com/wekan/wekan/security/advisories/GHSA-gm7v-pc38-53jr @@ -149786,26 +150172,36 @@ CVE-2026-5536 - https://github.com/AnalogyC0de/public_exp/issues/26 CVE-2026-55379 - https://github.com/python-pillow/Pillow/security/advisories/GHSA-45hq-cxwh-f6vc CVE-2026-5538 - https://github.com/AnalogyC0de/public_exp/issues/27 CVE-2026-55388 - https://github.com/piscinajs/piscina/security/advisories/GHSA-x9g3-xrwr-cwfg +CVE-2026-55390 - https://github.com/koxudaxi/datamodel-code-generator/security/advisories/GHSA-442q-2j6p-642g CVE-2026-55410 - https://github.com/nocobase/nocobase/security/advisories/GHSA-p853-83gj-wjj3 CVE-2026-55411 - https://github.com/ToolJet/ToolJet/security/advisories/GHSA-x7qj-hfg8-p4cw CVE-2026-55413 - https://github.com/ToolJet/ToolJet/security/advisories/GHSA-jgmf-cw3v-r98x CVE-2026-55415 - https://github.com/koxudaxi/datamodel-code-generator/security/advisories/GHSA-5578-w22f-pfx9 CVE-2026-55418 - https://github.com/labring/FastGPT/security/advisories/GHSA-6rxv-p43w-mmx5 +CVE-2026-55426 - https://github.com/Linuxfabrik/monitoring-plugins/security/advisories/GHSA-798h-hpph-m24j CVE-2026-55438 - https://github.com/coder/coder/pull/26086 CVE-2026-55439 - https://github.com/halo-dev/halo/issues/10064 CVE-2026-55441 - https://github.com/jdx/mise/security/advisories/GHSA-77g9-363w-rccq CVE-2026-55446 - https://github.com/langflow-ai/langflow/security/advisories/GHSA-qwqc-p3q8-wcg9 +CVE-2026-55450 - https://github.com/langflow-ai/langflow/security/advisories/GHSA-x223-p2gf-v735 +CVE-2026-55460 - https://github.com/grokability/snipe-it/security/advisories/GHSA-vgx7-c78r-69w9 +CVE-2026-55462 - https://github.com/grokability/snipe-it/security/advisories/GHSA-fc33-6w3q-538h CVE-2026-55466 - https://github.com/grokability/snipe-it/security/advisories/GHSA-jhph-5q74-pmfx +CVE-2026-55470 - https://github.com/hapifhir/org.hl7.fhir.core/security/advisories/GHSA-fxj4-p9xp-37v5 CVE-2026-55471 - https://github.com/hapifhir/org.hl7.fhir.core/security/advisories/GHSA-2f55-g35j-5jmf +CVE-2026-55477 - https://github.com/MHSanaei/3x-ui/security/advisories/GHSA-jm48-m3rr-9hgg CVE-2026-55490 - https://github.com/openwrt/openwrt/security/advisories/GHSA-9558-77jp-g3fw CVE-2026-55501 - https://github.com/decolua/9router/security/advisories/GHSA-7cfm-pqrj-xgq7 CVE-2026-55515 - https://github.com/grokability/snipe-it/security/advisories/GHSA-35cr-9hqq-p2mg CVE-2026-55523 - https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-8hjw-25cg-g52h +CVE-2026-55524 - https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-vg6p-v9vm-6fgj +CVE-2026-55548 - https://github.com/yamcs/yamcs/security/advisories/GHSA-8xjq-pr36-ccgf CVE-2026-55550 - https://github.com/pdovhomilja/nextcrm-app/security/advisories/GHSA-wv63-cq38-qg58 CVE-2026-55575 - https://github.com/harttle/liquidjs/security/advisories/GHSA-g357-x5c3-c72p CVE-2026-55578 - https://github.com/advisories/GHSA-9643-6xjp-vx57 CVE-2026-55578 - https://github.com/pheditor/pheditor/security/advisories/GHSA-wg4w-wr5q-6vjc CVE-2026-55592 - https://github.com/lissy93/dashy/security/advisories/GHSA-58mp-4qr3-vmrc +CVE-2026-55593 - https://github.com/froxlor/froxlor/security/advisories/GHSA-xpr4-8vp6-c87j CVE-2026-55596 - https://github.com/udecode/plate/pull/5014 CVE-2026-55596 - https://github.com/udecode/plate/security/advisories/GHSA-qj6x-xx2h-8hvv CVE-2026-55599 - https://github.com/phpseclib/phpseclib/security/advisories/GHSA-m557-wrgg-6rp4 @@ -149816,6 +150212,7 @@ CVE-2026-55615 - https://github.com/langroid/langroid/security/advisories/GHSA-2 CVE-2026-5562 - https://vuldb.com/vuln/355332 CVE-2026-5562 - https://vuldb.com/vuln/355332/cti CVE-2026-55641 - https://github.com/decolua/9router/security/advisories/GHSA-86m2-fcxq-5q7c +CVE-2026-55651 - https://github.com/alextselegidis/easyappointments/security/advisories/GHSA-4vmm-5qvc-w5p7 CVE-2026-55686 - https://github.com/podman-container-tools/podman/security/advisories/GHSA-q6r4-3wmg-fwcq CVE-2026-55698 - https://github.com/pnpm/pnpm/security/advisories/GHSA-w466-c33r-3gjp CVE-2026-55699 - https://github.com/pnpm/pnpm/security/advisories/GHSA-4gxm-v5v7-fqc4 @@ -149841,9 +150238,11 @@ CVE-2026-55782 - https://github.com/M2Team/NanaZip/security/advisories/GHSA-qxhc CVE-2026-55798 - https://github.com/python-pillow/Pillow/security/advisories/GHSA-4x4j-2g7c-83w6 CVE-2026-55827 - https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-c495-h83v-3prp CVE-2026-55830 - https://github.com/zopefoundation/RestrictedPython/security/advisories/GHSA-ffg3-p8fm-mjx2 +CVE-2026-55833 - https://github.com/netty/netty/security/advisories/GHSA-mvh2-crg5-v77c CVE-2026-55838 - https://github.com/rustfs/rustfs/security/advisories/GHSA-f5cv-v44x-2xgf CVE-2026-55844 - https://github.com/home-assistant/core/security/advisories/GHSA-cm5v-547m-qh5h CVE-2026-55885 - https://github.com/getgrav/grav/security/advisories/GHSA-2f86-9cp8-6hcf +CVE-2026-55886 - https://github.com/xdan/jodit/security/advisories/GHSA-vpmm-x3fm-qr5c CVE-2026-55950 - https://cna.erlef.org/cves/CVE-2026-55950.html CVE-2026-55952 - https://cna.erlef.org/cves/CVE-2026-55952.html CVE-2026-55953 - https://cna.erlef.org/cves/CVE-2026-55953.html @@ -149987,16 +150386,24 @@ CVE-2026-5705 - https://vuldb.com/vuln/355521/cti CVE-2026-57053 - https://lists.gnu.org/archive/html/help-libidn/2026-05/msg00000.html CVE-2026-57053 - https://lists.gnu.org/archive/html/help-libidn/2026-06/msg00001.html CVE-2026-57156 - https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-v5wf-j8j4-77h7 +CVE-2026-57157 - https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-47fr-jw86-c3fj +CVE-2026-57158 - https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-mp3f-59pg-c5pp CVE-2026-57211 - https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-7v84-m3g5-vxq6 CVE-2026-57215 - https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-5cq3-v9jx-p3x3 CVE-2026-57216 - https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-36m6-588r-vqcw CVE-2026-57217 - https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-gpvw-75h5-3wvx +CVE-2026-57218 - https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-wmrr-4h5v-5ch7 CVE-2026-57220 - https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-f364-87q5-j35q CVE-2026-57221 - https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-9q2j-2hq8-22r2 +CVE-2026-57233 - https://github.com/notepad-plus-plus/notepad-plus-plus/security/advisories/GHSA-hjxw-84rf-wg5r CVE-2026-57256 - https://www.talosintelligence.com/vulnerability_reports/TALOS-2026-2420 CVE-2026-5740 - https://mattermost.com/security-updates +CVE-2026-57439 - https://github.com/gchq/CyberChef/issues/2568 +CVE-2026-57439 - https://github.com/gchq/CyberChef/security/advisories/GHSA-fx6f-382r-j72c +CVE-2026-57485 - https://github.com/Stirling-Tools/Stirling-PDF/security/advisories/GHSA-3xxh-mm3g-c9w5 CVE-2026-57495 - https://github.com/agenticmail/agenticmail/security/advisories/GHSA-fq4x-789w-jg5h CVE-2026-57498 - https://github.com/coollabsio/coolify/security/advisories/GHSA-725v-f5gh-22q9 +CVE-2026-57516 - https://github.com/ray-project/ray/security/advisories/GHSA-hhrp-gw25-jr43 CVE-2026-57517 - http://seclists.org/fulldisclosure/2026/Jul/9 CVE-2026-57517 - https://karmainsecurity.com/KIS-2026-12 CVE-2026-57518 - https://gist.github.com/sermikr0/6f0a67e9d101746fcdb04827de137847 @@ -150004,6 +150411,7 @@ CVE-2026-57527 - https://www.zaproxy.org/blog/2026-06-24-java-deserialization-vu CVE-2026-5755 - https://mattermost.com/security-updates CVE-2026-57571 - https://github.com/unclecode/crawl4ai/security/advisories/GHSA-2jq4-q6vv-4cp3 CVE-2026-57572 - https://github.com/unclecode/crawl4ai/security/advisories/GHSA-r253-r9jw-qg44 +CVE-2026-57573 - https://github.com/unclecode/crawl4ai/security/advisories/GHSA-wm69-2pc3-rmmf CVE-2026-5758 - https://morielharush.github.io/2026/04/12/cve-2026-5758-protocol-buffers-schema-prototype-pollution/ CVE-2026-57584 - https://github.com/phalcon/cphalcon/security/advisories/GHSA-x7rj-f32v-7jjg CVE-2026-57587 - https://www.tenable.com/security/tns-2026-17 @@ -150015,6 +150423,7 @@ CVE-2026-57827 - https://mysites.guru/blog/rsfiles-unauthenticated-file-upload-r CVE-2026-57828 - https://mysites.guru/blog/phoca-download-authenticated-file-upload-rce/ CVE-2026-57831 - https://mysites.guru/blog/dpcalendar-sql-injection-disclosure/ CVE-2026-57832 - https://mysites.guru/blog/edocman-sql-injection-disclosure/ +CVE-2026-57850 - https://github.com/sn0x-sharma/CVE-2026-57850 CVE-2026-57850 - https://www.vulncheck.com/advisories/rustdesk-missing-session-scope-enforcement-allows-out-of-scope-control-message-injection CVE-2026-57851 - https://github.com/readmsr/MSI_FeatureManager_CVE CVE-2026-57851 - https://www.vulncheck.com/advisories/msi-gamegaraj-kerncorelib64-sys-privilege-escalation-via-ioctl-handlers @@ -150022,18 +150431,28 @@ CVE-2026-57852 - https://github.com/getgrav/grav/security/advisories/GHSA-xwv3-2 CVE-2026-57855 - https://gist.github.com/sermikr0/821c4edd3c34e98a62a50b07707785bd CVE-2026-57856 - https://gist.github.com/sermikr0/821c4edd3c34e98a62a50b07707785bd CVE-2026-57858 - https://ashtonr.com/blog/cve-2026-57858/ +CVE-2026-57859 - https://github.com/e107inc/e107/security/advisories/GHSA-568x-w5qj-vr7c CVE-2026-57860 - https://github.com/tailcallhq/forgecode/issues/3022 +CVE-2026-57862 - https://gist.github.com/sermikr0/67c8acfc395e465127e729dc309da3ae +CVE-2026-57894 - https://github.com/go-gitea/gitea/security/advisories/GHSA-82f7-87hm-852x +CVE-2026-57942 - https://github.com/LibreTranslate/LibreTranslate/issues/986 CVE-2026-57943 - https://github.com/LibrePhotos/librephotos/issues/1860 CVE-2026-57946 - https://github.com/iv-org/invidious/issues/5775 +CVE-2026-57947 - https://github.com/pinpoint-apm/pinpoint/issues/13857 CVE-2026-57948 - https://github.com/pinpoint-apm/pinpoint/issues/13858 CVE-2026-57949 - https://github.com/YunaiV/ruoyi-vue-pro/issues/1159 CVE-2026-57950 - https://github.com/YunaiV/ruoyi-vue-pro/issues/1161 +CVE-2026-57951 - https://github.com/its-a-feature/Mythic/issues/563 CVE-2026-57952 - https://github.com/its-a-feature/Mythic/issues/564 CVE-2026-57953 - https://github.com/its-a-feature/Mythic/issues/565 CVE-2026-57954 - https://github.com/yahoo/elide/issues/3415 CVE-2026-57956 - https://github.com/SigNoz/signoz/issues/11830 CVE-2026-57957 - https://github.com/AstoKr/papermark/pull/1 +CVE-2026-57958 - https://github.com/inovector/mixpost/issues/204 +CVE-2026-57961 - https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-88g4-74f3-63x9 CVE-2026-57994 - https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-mf8r-wm2w-f8c5 +CVE-2026-57997 - https://github.com/strapi/strapi/issues/26587 +CVE-2026-57999 - https://github.com/openwrt/luci/security/advisories/GHSA-xwc5-mx58-rh35 CVE-2026-58000 - https://github.com/openwrt/luci/security/advisories/GHSA-pm9w-522m-8rrh CVE-2026-58049 - https://access.redhat.com/security/cve/CVE-2026-58049 CVE-2026-58049 - https://github.com/bikini/exploitarium/tree/main/ffmpeg-rasc-dlta-calc-poc @@ -150094,6 +150513,7 @@ CVE-2026-58304 - https://github.com/Samsung/escargot/issues/1573 CVE-2026-58307 - https://github.com/Samsung/escargot/issues/1577 CVE-2026-58371 - https://github.com/geo-chen/oss/blob/main/seaweedfs.md CVE-2026-58372 - https://github.com/geo-chen/oss/blob/main/seaweedfs.md +CVE-2026-58372 - https://github.com/seaweedfs/seaweedfs/security/advisories/GHSA-w62w-66v9-vvgv CVE-2026-58375 - https://github.com/jeecgboot/jimureport/issues/4694 CVE-2026-58376 - https://github.com/Dolibarr/dolibarr/issues/38768 CVE-2026-58377 - https://github.com/jeecgboot/JeecgBoot/issues/9705 @@ -150410,6 +150830,7 @@ CVE-2026-6198 - https://github.com/Litengzheng/vuldb_new/blob/main/F456/vul_115/ CVE-2026-6200 - https://github.com/Litengzheng/vuldb_new/blob/main/F456/vul_117/README.md CVE-2026-6201 - https://github.com/Xmyronn/CodeAstro-Online-Job-Portal-IDOR.git CVE-2026-6204 - https://projectblack.io/blog/librenms-authenticated-rce-and-xss/#binary-path-rce-poc +CVE-2026-62184 - https://github.com/openwrt/luci/security/advisories/GHSA-r6hx-4f83-vp8m CVE-2026-6219 - https://gist.github.com/ngocnn97/53a9f251d1cb99b1b8033e211407d1b1 CVE-2026-6220 - https://github.com/ccccccctiiiiiiii-lab/public_exp/issues/1 CVE-2026-62231 - https://github.com/getgrav/grav/security/advisories/GHSA-x7hm-jc32-v39j @@ -150417,26 +150838,57 @@ CVE-2026-62232 - https://github.com/getgrav/grav/security/advisories/GHSA-7mgc-c CVE-2026-62236 - https://github.com/getgrav/grav/security/advisories/GHSA-4px8-7p53-282r CVE-2026-62237 - https://github.com/getgrav/grav/security/advisories/GHSA-37f3-6p89-6qr9 CVE-2026-62238 - https://github.com/openremote/openremote/security/advisories/GHSA-cgfv-jrfp-2r7v +CVE-2026-62239 - https://github.com/Dao-AILab/flash-attention/issues/2637 CVE-2026-6224 - https://github.com/Pai-777/ai-cve/blob/main/docs/cve-drafts/nocobase-workflow-javascript-sandbox-escape.en.md +CVE-2026-62240 - https://github.com/crewAIInc/crewAI/issues/6520 +CVE-2026-62241 - https://github.com/MohibShaikh/clawvet/security/advisories/GHSA-9mww-p953-jfc9 +CVE-2026-62246 - https://github.com/clastix/kamaji/security/advisories/GHSA-4f3f-65vx-r34f CVE-2026-6229 - https://research.cleantalk.org/cve-2026-6229 +CVE-2026-62290 - https://github.com/cert-manager/cert-manager/security/advisories/GHSA-8rvj-mm4h-c258 +CVE-2026-62291 - https://github.com/strukturag/libheif/security/advisories/GHSA-xpw3-9rhw-482x +CVE-2026-62292 - https://github.com/strukturag/libheif/security/advisories/GHSA-73p7-m7gg-w2jv +CVE-2026-62293 - https://github.com/hapifhir/org.hl7.fhir.core/security/advisories/GHSA-6vcw-fq7v-4vhw +CVE-2026-62295 - https://github.com/hapifhir/org.hl7.fhir.core/security/advisories/GHSA-2cq7-hg49-56gc +CVE-2026-62296 - https://github.com/hapifhir/org.hl7.fhir.core/security/advisories/GHSA-5v24-q6x8-hc38 +CVE-2026-62299 - https://github.com/coredns/coredns/security/advisories/GHSA-9pmm-cxww-rrr7 CVE-2026-62314 - https://github.com/TecharoHQ/anubis/security/advisories/GHSA-6wcg-mqvh-fcvg +CVE-2026-62323 - https://github.com/cloudreve/cloudreve/security/advisories/GHSA-c3jm-gv5r-9wcp +CVE-2026-62324 - https://github.com/xdan/jodit/security/advisories/GHSA-j839-gqq4-gf9j +CVE-2026-62325 - https://github.com/goshs-labs/goshs/security/advisories/GHSA-rjrw-mjq6-hpmm CVE-2026-62349 - https://github.com/taosdata/TDengine/security/advisories/GHSA-4v5h-fxjw-vrmq +CVE-2026-62350 - https://github.com/taosdata/TDengine/security/advisories/GHSA-f7wh-p233-87xv CVE-2026-62351 - https://github.com/taosdata/TDengine/security/advisories/GHSA-8pc4-p252-f5m7 +CVE-2026-62353 - https://github.com/taosdata/TDengine/security/advisories/GHSA-5r9p-3j4f-gmgp CVE-2026-62361 - https://github.com/knadh/listmonk/security/advisories/GHSA-xgjr-7j9q-2h4r +CVE-2026-62377 - https://github.com/strukturag/libheif/issues/1844 +CVE-2026-62377 - https://github.com/strukturag/libheif/security/advisories/GHSA-9ww4-9v47-m7pj +CVE-2026-62378 - https://github.com/rustfs/rustfs/security/advisories/GHSA-7gcx-wg4x-q9x6 CVE-2026-6238 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html CVE-2026-62386 - https://github.com/getgrav/grav/security/advisories/GHSA-4hpj-wmpw-ghwq CVE-2026-62387 - https://github.com/getgrav/grav/security/advisories/GHSA-93px-98wh-6fj2 +CVE-2026-62420 - https://github.com/canonical/lxd/security/advisories/GHSA-v9wr-9r7q-fh4g CVE-2026-6265 - https://labs.reversec.com/advisories/2026/04/cerberus-ftp-server-elevation-of-privileges +CVE-2026-62663 - https://github.com/masci/banks/security/advisories/GHSA-98rr-gvc9-3cjh CVE-2026-6268 - https://wpscan.com/vulnerability/77192aeb-8e4b-4057-b5d7-2b95da634edd/ +CVE-2026-62684 - https://github.com/filebrowser/filebrowser/security/advisories/GHSA-833g-cqhp-h72j CVE-2026-62685 - https://github.com/filebrowser/filebrowser/security/advisories/GHSA-7rc3-g7h6-22m7 CVE-2026-6274 - https://github.com/bugresearch/CVE-2026-6274 CVE-2026-6277 - https://gitlab.com/gitlab-org/gitlab/-/work_items/596656 CVE-2026-62843 - https://github.com/filebrowser/filebrowser/security/advisories/GHSA-83xp-526h-j3ww +CVE-2026-62845 - https://github.com/clastix/kamaji/security/advisories/GHSA-r47v-ppwp-fh4r +CVE-2026-62857 - https://github.com/fedify-dev/fedify/security/advisories/GHSA-hqph-j65v-8cq5 CVE-2026-6291 - https://github.com/wolfSSL/wolfssl/pull/10203 CVE-2026-6291 - https://www.wolfssl.com/docs/security-vulnerabilities/ +CVE-2026-62948 - https://github.com/openwrt/openwrt/security/advisories/GHSA-hhmc-92hw-535f +CVE-2026-62959 - https://github.com/coturn/coturn/commit/960835886692fa04cf63ddd970c3f330740c87f4 +CVE-2026-62959 - https://github.com/coturn/coturn/security/advisories/GHSA-m23x-5qf5-988g CVE-2026-6296 - https://issues.chromium.org/issues/490170083 CVE-2026-6297 - https://issues.chromium.org/issues/493628982 CVE-2026-6298 - https://issues.chromium.org/issues/495700484 +CVE-2026-62982 - https://github.com/nicolargo/glances/security/advisories/GHSA-73wf-9vmv-5pv9 +CVE-2026-62988 - https://github.com/froxlor/froxlor/security/advisories/GHSA-7788-ghfq-c6mh +CVE-2026-62994 - https://github.com/coredns/coredns/security/advisories/GHSA-74w3-63xv-x9mv +CVE-2026-62996 - https://github.com/smarty-php/smarty/security/advisories/GHSA-rjhh-76wf-8xmw CVE-2026-6300 - https://issues.chromium.org/issues/491994185 CVE-2026-6301 - https://issues.chromium.org/issues/495273999 CVE-2026-6302 - https://issues.chromium.org/issues/495477995 @@ -151160,6 +151612,7 @@ CVE-2026-7506 - https://github.com/wangzhongyang085/CVE/issues/2 CVE-2026-7511 - https://github.com/wolfSSL/wolfssl/pull/10203 CVE-2026-7511 - https://www.wolfssl.com/docs/security-vulnerabilities/ CVE-2026-7513 - https://github.com/kirlic123/IOTvulner/blob/main/4035/4/4.md +CVE-2026-75130 - https://noma.security/blog/contextcrush-context7-the-mcp-server-vulnerability/ CVE-2026-7521 - https://mattermost.com/security-updates CVE-2026-7528 - https://www.ibm.com/support/pages/node/7273427 CVE-2026-7531 - https://github.com/wolfSSL/wolfssl/pull/10327 @@ -151173,6 +151626,7 @@ CVE-2026-7545 - https://github.com/eqwerwq/CVE/issues/2 CVE-2026-7548 - https://github.com/newym/cve/blob/main/totolink%20nr1800x%20command%20injection.md CVE-2026-7555 - https://github.com/nidieaaa/test/issues/9 CVE-2026-7582 - https://github.com/biniamf/pocs/tree/main/oiio_ddsinput-readimg +CVE-2026-75872 - https://secur0.com/en/cna/cve-list/cve-2026-75872-html-injection-in-mailerup-double-optin-verification-email CVE-2026-7588 - https://github.com/ggerve/coding-standards-mcp/issues/3 CVE-2026-7589 - https://github.com/ghantakiran/splunk-mcp-integration/issues/49 CVE-2026-7590 - https://github.com/eyal-gor/p_69_branch_monkey_mcp/issues/8 @@ -151225,6 +151679,7 @@ CVE-2026-7686 - https://github.com/xryj920/CVE/blob/main/adblock_plus_CVE_report CVE-2026-7689 - https://gist.github.com/Shaon-Xis/d6ae069fc54f006457b68a91d5a8e158 CVE-2026-7697 - https://github.com/testnet0/testnet/issues/74 CVE-2026-7699 - https://github.com/xpp3901/CVE_APPLY/tree/main/V-M001_MaxKey_Filters_SQL_Injection +CVE-2026-7701 - https://www.youtube.com/watch?v=xo9Bplsy1K8 CVE-2026-7702 - https://github.com/ngocnn97/security-advisories/blob/main/AFFiNE_BAC_PoC.mp4 CVE-2026-7703 - https://gist.github.com/TrebledJ/585a20525e45549f299d282233632608 CVE-2026-7704 - https://gist.github.com/TrebledJ/585a20525e45549f299d282233632608 @@ -151360,6 +151815,7 @@ CVE-2026-7993 - https://issues.chromium.org/issues/499099003 CVE-2026-7994 - https://issues.chromium.org/issues/499116954 CVE-2026-7996 - https://issues.chromium.org/issues/484547631 CVE-2026-7998 - https://issues.chromium.org/issues/491676472 +CVE-2026-7999 - https://issues.chromium.org/issues/493099941 CVE-2026-8000 - https://issues.chromium.org/issues/494464734 CVE-2026-8001 - https://issues.chromium.org/issues/494764371 CVE-2026-8002 - https://issues.chromium.org/issues/495779613 @@ -151437,6 +151893,7 @@ CVE-2026-8525 - https://issues.chromium.org/issues/497928952 CVE-2026-8529 - https://issues.chromium.org/issues/490222151 CVE-2026-8531 - https://issues.chromium.org/issues/492350403 CVE-2026-8533 - https://issues.chromium.org/issues/495247950 +CVE-2026-8541 - https://issues.chromium.org/issues/496645393 CVE-2026-8542 - https://issues.chromium.org/issues/497066659 CVE-2026-8547 - https://issues.chromium.org/issues/497632199 CVE-2026-8548 - https://issues.chromium.org/issues/497821764 @@ -151446,6 +151903,7 @@ CVE-2026-8555 - https://issues.chromium.org/issues/500033878 CVE-2026-8556 - https://issues.chromium.org/issues/500052361 CVE-2026-8557 - https://issues.chromium.org/issues/502978647 CVE-2026-8558 - https://issues.chromium.org/issues/503425922 +CVE-2026-8561 - https://issues.chromium.org/issues/343352552 CVE-2026-8564 - https://issues.chromium.org/issues/418273622 CVE-2026-8567 - https://issues.chromium.org/issues/484986863 CVE-2026-8571 - https://issues.chromium.org/issues/491422244 @@ -151501,6 +151959,7 @@ CVE-2026-9119 - https://issues.chromium.org/issues/502661101 CVE-2026-9120 - https://issues.chromium.org/issues/504620824 CVE-2026-9121 - https://issues.chromium.org/issues/488064108 CVE-2026-9122 - https://issues.chromium.org/issues/489579953 +CVE-2026-9126 - https://issues.chromium.org/issues/496280532 CVE-2026-9162 - https://mattermost.com/security-updates CVE-2026-9223 - https://devolutions.net/security/advisories/DEVO-2026-0013/ CVE-2026-9224 - https://devolutions.net/security/advisories/DEVO-2026-0013/ @@ -151622,6 +152081,7 @@ CVE-2026-9844 - https://diagnostics.roche.com/global/en/legal/product-security-a CVE-2026-9872 - https://issues.chromium.org/issues/505077859 CVE-2026-9873 - https://issues.chromium.org/issues/507365348 CVE-2026-9874 - https://issues.chromium.org/issues/500609038 +CVE-2026-9875 - https://issues.chromium.org/issues/507508103 CVE-2026-9878 - https://issues.chromium.org/issues/499054245 CVE-2026-9880 - https://issues.chromium.org/issues/503615025 CVE-2026-9881 - https://issues.chromium.org/issues/505140741 @@ -151629,6 +152089,7 @@ CVE-2026-9882 - https://issues.chromium.org/issues/506375217 CVE-2026-9883 - https://issues.chromium.org/issues/506477192 CVE-2026-9885 - https://issues.chromium.org/issues/508452241 CVE-2026-9894 - https://issues.chromium.org/issues/507707838 +CVE-2026-9895 - https://issues.chromium.org/issues/491685406 CVE-2026-9896 - https://issues.chromium.org/issues/508811474 CVE-2026-9898 - https://issues.chromium.org/issues/496282591 CVE-2026-9900 - https://issues.chromium.org/issues/497637277 @@ -151638,6 +152099,7 @@ CVE-2026-9909 - https://issues.chromium.org/issues/499152771 CVE-2026-9910 - https://issues.chromium.org/issues/499176133 CVE-2026-9911 - https://issues.chromium.org/issues/499205491 CVE-2026-9913 - https://issues.chromium.org/issues/500046096 +CVE-2026-9916 - https://issues.chromium.org/issues/500080303 CVE-2026-9917 - https://issues.chromium.org/issues/500095304 CVE-2026-9920 - https://issues.chromium.org/issues/500138014 CVE-2026-9924 - https://issues.chromium.org/issues/500398345 @@ -151665,5 +152127,9 @@ CVE-2026-9963 - https://issues.chromium.org/issues/505143241 CVE-2026-9964 - https://issues.chromium.org/issues/505190999 CVE-2026-9965 - https://issues.chromium.org/issues/506377574 CVE-2026-9966 - https://issues.chromium.org/issues/506388321 +CVE-2026-9967 - https://issues.chromium.org/issues/506414791 CVE-2026-9971 - https://issues.chromium.org/issues/508448586 CVE-2026-9972 - https://issues.chromium.org/issues/508463705 +CVE-2026-9973 - https://issues.chromium.org/issues/509268941 +CVE-2026-9974 - https://issues.chromium.org/issues/511710468 +CVE-2026-9977 - https://issues.chromium.org/issues/511741173