From a52834dd8570772b7b17d2629e04d333801b20cd Mon Sep 17 00:00:00 2001 From: trickest-workflows Date: Sun, 30 Aug 2026 12:39:31 +0000 Subject: [PATCH] Update Sun Aug 30 12:39:30 UTC 2026 --- 2003/CVE-2003-1448.md | 17 ++++ 2004/CVE-2004-0368.md | 18 ++++ 2004/CVE-2004-0478.md | 17 ++++ 2004/CVE-2004-1080.md | 1 + 2004/CVE-2004-1812.md | 17 ++++ 2004/CVE-2004-2686.md | 17 ++++ 2005/CVE-2005-0575.md | 1 + 2005/CVE-2005-3294.md | 1 + 2005/CVE-2005-3912.md | 17 ++++ 2006/CVE-2006-0106.md | 17 ++++ 2006/CVE-2006-0454.md | 1 + 2006/CVE-2006-0580.md | 17 ++++ 2006/CVE-2006-0647.md | 18 ++++ 2006/CVE-2006-0696.md | 17 ++++ 2006/CVE-2006-0697.md | 17 ++++ 2006/CVE-2006-0698.md | 17 ++++ 2006/CVE-2006-0710.md | 17 ++++ 2006/CVE-2006-0717.md | 17 ++++ 2006/CVE-2006-0790.md | 17 ++++ 2006/CVE-2006-0900.md | 1 + 2006/CVE-2006-2183.md | 17 ++++ 2006/CVE-2006-3746.md | 2 +- 2006/CVE-2006-6332.md | 2 +- 2006/CVE-2006-6931.md | 17 ++++ 2007/CVE-2007-0675.md | 20 ++++ 2007/CVE-2007-1189.md | 1 + 2007/CVE-2007-1222.md | 17 ++++ 2007/CVE-2007-3634.md | 19 ++++ 2007/CVE-2007-3636.md | 17 ++++ 2007/CVE-2007-3637.md | 17 ++++ 2007/CVE-2007-3778.md | 2 + 2008/CVE-2008-0098.md | 17 ++++ 2008/CVE-2008-4434.md | 17 ++++ 2008/CVE-2008-4609.md | 1 + 2008/CVE-2008-5230.md | 1 + 2009/CVE-2009-0836.md | 1 + 2009/CVE-2009-4484.md | 1 + 2009/CVE-2009-4764.md | 18 ++++ 2016/CVE-2016-10701.md | 1 + 2020/CVE-2020-15874.md | 1 + 2020/CVE-2020-15876.md | 1 + 2020/CVE-2020-15878.md | 1 + 2021/CVE-2021-22182.md | 18 ++++ 2021/CVE-2021-37253.md | 1 + 2023/CVE-2023-0957.md | 17 ++++ 2024/CVE-2024-25735.md | 1 + 2024/CVE-2024-48955.md | 2 +- 2024/CVE-2024-55040.md | 1 + 2024/CVE-2024-58315.md | 2 +- 2024/CVE-2024-7705.md | 1 + 2025/CVE-2025-6123.md | 1 + 2026/CVE-2026-13780.md | 17 ++++ 2026/CVE-2026-14307.md | 17 ++++ 2026/CVE-2026-14835.md | 17 ++++ 2026/CVE-2026-15034.md | 20 ++++ 2026/CVE-2026-15035.md | 18 ++++ 2026/CVE-2026-15105.md | 22 +++++ 2026/CVE-2026-15135.md | 1 + 2026/CVE-2026-15138.md | 19 ++++ 2026/CVE-2026-15184.md | 1 + 2026/CVE-2026-15192.md | 19 ++++ 2026/CVE-2026-15194.md | 18 ++++ 2026/CVE-2026-15195.md | 24 +++++ 2026/CVE-2026-15204.md | 18 ++++ 2026/CVE-2026-15274.md | 25 +++++ 2026/CVE-2026-15311.md | 21 +++++ 2026/CVE-2026-15317.md | 26 ++++++ 2026/CVE-2026-15318.md | 27 ++++++ 2026/CVE-2026-15320.md | 27 ++++++ 2026/CVE-2026-15332.md | 19 ++++ 2026/CVE-2026-15373.md | 1 + 2026/CVE-2026-15374.md | 1 + 2026/CVE-2026-15376.md | 1 + 2026/CVE-2026-15392.md | 1 + 2026/CVE-2026-15473.md | 1 + 2026/CVE-2026-15474.md | 1 + 2026/CVE-2026-15478.md | 19 ++++ 2026/CVE-2026-15480.md | 18 ++++ 2026/CVE-2026-15481.md | 18 ++++ 2026/CVE-2026-15495.md | 20 ++++ 2026/CVE-2026-15496.md | 20 ++++ 2026/CVE-2026-15499.md | 20 ++++ 2026/CVE-2026-15501.md | 19 ++++ 2026/CVE-2026-15506.md | 22 +++++ 2026/CVE-2026-15508.md | 47 ++++++++++ 2026/CVE-2026-15515.md | 18 ++++ 2026/CVE-2026-15517.md | 18 ++++ 2026/CVE-2026-15522.md | 18 ++++ 2026/CVE-2026-15524.md | 20 ++++ 2026/CVE-2026-15527.md | 22 +++++ 2026/CVE-2026-15528.md | 18 ++++ 2026/CVE-2026-15530.md | 19 ++++ 2026/CVE-2026-15535.md | 18 ++++ 2026/CVE-2026-15558.md | 18 ++++ 2026/CVE-2026-15605.md | 18 ++++ 2026/CVE-2026-15621.md | 27 ++++++ 2026/CVE-2026-15622.md | 22 +++++ 2026/CVE-2026-15624.md | 17 ++++ 2026/CVE-2026-15627.md | 22 +++++ 2026/CVE-2026-15669.md | 20 ++++ 2026/CVE-2026-15686.md | 17 ++++ 2026/CVE-2026-15691.md | 18 ++++ 2026/CVE-2026-15694.md | 18 ++++ 2026/CVE-2026-15696.md | 18 ++++ 2026/CVE-2026-15701.md | 18 ++++ 2026/CVE-2026-15732.md | 17 ++++ 2026/CVE-2026-15749.md | 18 ++++ 2026/CVE-2026-16206.md | 18 ++++ 2026/CVE-2026-19722.md | 17 ++++ 2026/CVE-2026-2860.md | 19 ++++ 2026/CVE-2026-48169.md | 1 + 2026/CVE-2026-4845.md | 1 + 2026/CVE-2026-5350.md | 18 ++++ 2026/CVE-2026-76583.md | 19 ++++ 2026/CVE-2026-76585.md | 17 ++++ 2026/CVE-2026-78049.md | 1 + 2026/CVE-2026-78050.md | 18 ++++ 2026/CVE-2026-78051.md | 29 ++++++ 2026/CVE-2026-78062.md | 20 ++++ 2026/CVE-2026-78112.md | 18 ++++ 2026/CVE-2026-78122.md | 18 ++++ 2026/CVE-2026-78136.md | 17 ++++ 2026/CVE-2026-78142.md | 18 ++++ 2026/CVE-2026-78143.md | 18 ++++ 2026/CVE-2026-78144.md | 18 ++++ 2026/CVE-2026-78147.md | 18 ++++ 2026/CVE-2026-78158.md | 18 ++++ 2026/CVE-2026-78161.md | 19 ++++ 2026/CVE-2026-78166.md | 20 ++++ 2026/CVE-2026-78167.md | 18 ++++ 2026/CVE-2026-78168.md | 37 ++++++++ 2026/CVE-2026-78169.md | 18 ++++ 2026/CVE-2026-78170.md | 18 ++++ 2026/CVE-2026-78171.md | 18 ++++ 2026/CVE-2026-78177.md | 18 ++++ 2026/CVE-2026-78185.md | 18 ++++ 2026/CVE-2026-78187.md | 19 ++++ 2026/CVE-2026-78196.md | 21 +++++ 2026/CVE-2026-78197.md | 18 ++++ 2026/CVE-2026-78198.md | 18 ++++ 2026/CVE-2026-78199.md | 18 ++++ 2026/CVE-2026-78200.md | 18 ++++ 2026/CVE-2026-78201.md | 18 ++++ 2026/CVE-2026-78202.md | 18 ++++ 2026/CVE-2026-78203.md | 18 ++++ 2026/CVE-2026-78204.md | 17 ++++ 2026/CVE-2026-78205.md | 17 ++++ 2026/CVE-2026-78244.md | 18 ++++ 2026/CVE-2026-78245.md | 18 ++++ 2026/CVE-2026-78246.md | 18 ++++ 2026/CVE-2026-78247.md | 18 ++++ 2026/CVE-2026-78248.md | 18 ++++ 2026/CVE-2026-78250.md | 18 ++++ 2026/CVE-2026-78364.md | 17 ++++ 2026/CVE-2026-78367.md | 23 +++++ 2026/CVE-2026-78430.md | 20 ++++ 2026/CVE-2026-78434.md | 21 +++++ 2026/CVE-2026-78435.md | 20 ++++ 2026/CVE-2026-78637.md | 22 +++++ 2026/CVE-2026-78638.md | 19 ++++ 2026/CVE-2026-78654.md | 24 +++++ 2026/CVE-2026-78656.md | 18 ++++ 2026/CVE-2026-78675.md | 18 ++++ 2026/CVE-2026-78676.md | 18 ++++ 2026/CVE-2026-78677.md | 18 ++++ 2026/CVE-2026-78678.md | 18 ++++ 2026/CVE-2026-78679.md | 18 ++++ 2026/CVE-2026-78681.md | 18 ++++ 2026/CVE-2026-78682.md | 18 ++++ 2026/CVE-2026-78683.md | 18 ++++ 2026/CVE-2026-81660.md | 17 ++++ 2026/CVE-2026-81766.md | 17 ++++ 2026/CVE-2026-82417.md | 18 ++++ 2026/CVE-2026-82421.md | 18 ++++ 2026/CVE-2026-82422.md | 18 ++++ 2026/CVE-2026-82424.md | 18 ++++ 2026/CVE-2026-82455.md | 17 ++++ 2026/CVE-2026-82456.md | 17 ++++ 2026/CVE-2026-82457.md | 17 ++++ 2026/CVE-2026-82460.md | 17 ++++ 2026/CVE-2026-82475.md | 17 ++++ 2026/CVE-2026-82483.md | 47 ++++++++++ 2026/CVE-2026-82484.md | 18 ++++ 2026/CVE-2026-82485.md | 18 ++++ 2026/CVE-2026-82562.md | 18 ++++ 2026/CVE-2026-8952.md | 18 ++++ references.txt | 207 +++++++++++++++++++++++++++++++++++++++++ 187 files changed, 3135 insertions(+), 4 deletions(-) create mode 100644 2003/CVE-2003-1448.md create mode 100644 2004/CVE-2004-0368.md create mode 100644 2004/CVE-2004-0478.md create mode 100644 2004/CVE-2004-1812.md create mode 100644 2004/CVE-2004-2686.md create mode 100644 2005/CVE-2005-3912.md create mode 100644 2006/CVE-2006-0106.md create mode 100644 2006/CVE-2006-0580.md create mode 100644 2006/CVE-2006-0647.md create mode 100644 2006/CVE-2006-0696.md create mode 100644 2006/CVE-2006-0697.md create mode 100644 2006/CVE-2006-0698.md create mode 100644 2006/CVE-2006-0710.md create mode 100644 2006/CVE-2006-0717.md create mode 100644 2006/CVE-2006-0790.md create mode 100644 2006/CVE-2006-2183.md create mode 100644 2006/CVE-2006-6931.md create mode 100644 2007/CVE-2007-0675.md create mode 100644 2007/CVE-2007-1222.md create mode 100644 2007/CVE-2007-3634.md create mode 100644 2007/CVE-2007-3636.md create mode 100644 2007/CVE-2007-3637.md create mode 100644 2008/CVE-2008-0098.md create mode 100644 2008/CVE-2008-4434.md create mode 100644 2009/CVE-2009-4764.md create mode 100644 2021/CVE-2021-22182.md create mode 100644 2023/CVE-2023-0957.md create mode 100644 2026/CVE-2026-13780.md create mode 100644 2026/CVE-2026-14307.md create mode 100644 2026/CVE-2026-14835.md create mode 100644 2026/CVE-2026-15034.md create mode 100644 2026/CVE-2026-15035.md create mode 100644 2026/CVE-2026-15105.md create mode 100644 2026/CVE-2026-15138.md create mode 100644 2026/CVE-2026-15192.md create mode 100644 2026/CVE-2026-15194.md create mode 100644 2026/CVE-2026-15195.md create mode 100644 2026/CVE-2026-15204.md create mode 100644 2026/CVE-2026-15274.md create mode 100644 2026/CVE-2026-15311.md create mode 100644 2026/CVE-2026-15317.md create mode 100644 2026/CVE-2026-15318.md create mode 100644 2026/CVE-2026-15320.md create mode 100644 2026/CVE-2026-15332.md create mode 100644 2026/CVE-2026-15478.md create mode 100644 2026/CVE-2026-15480.md create mode 100644 2026/CVE-2026-15481.md create mode 100644 2026/CVE-2026-15495.md create mode 100644 2026/CVE-2026-15496.md create mode 100644 2026/CVE-2026-15499.md create mode 100644 2026/CVE-2026-15501.md create mode 100644 2026/CVE-2026-15506.md create mode 100644 2026/CVE-2026-15508.md create mode 100644 2026/CVE-2026-15515.md create mode 100644 2026/CVE-2026-15517.md create mode 100644 2026/CVE-2026-15522.md create mode 100644 2026/CVE-2026-15524.md create mode 100644 2026/CVE-2026-15527.md create mode 100644 2026/CVE-2026-15528.md create mode 100644 2026/CVE-2026-15530.md create mode 100644 2026/CVE-2026-15535.md create mode 100644 2026/CVE-2026-15558.md create mode 100644 2026/CVE-2026-15605.md create mode 100644 2026/CVE-2026-15621.md create mode 100644 2026/CVE-2026-15622.md create mode 100644 2026/CVE-2026-15624.md create mode 100644 2026/CVE-2026-15627.md create mode 100644 2026/CVE-2026-15669.md create mode 100644 2026/CVE-2026-15686.md create mode 100644 2026/CVE-2026-15691.md create mode 100644 2026/CVE-2026-15694.md create mode 100644 2026/CVE-2026-15696.md create mode 100644 2026/CVE-2026-15701.md create mode 100644 2026/CVE-2026-15732.md create mode 100644 2026/CVE-2026-15749.md create mode 100644 2026/CVE-2026-16206.md create mode 100644 2026/CVE-2026-19722.md create mode 100644 2026/CVE-2026-2860.md create mode 100644 2026/CVE-2026-5350.md create mode 100644 2026/CVE-2026-76583.md create mode 100644 2026/CVE-2026-76585.md create mode 100644 2026/CVE-2026-78050.md create mode 100644 2026/CVE-2026-78051.md create mode 100644 2026/CVE-2026-78062.md create mode 100644 2026/CVE-2026-78112.md create mode 100644 2026/CVE-2026-78122.md create mode 100644 2026/CVE-2026-78136.md create mode 100644 2026/CVE-2026-78142.md create mode 100644 2026/CVE-2026-78143.md create mode 100644 2026/CVE-2026-78144.md create mode 100644 2026/CVE-2026-78147.md create mode 100644 2026/CVE-2026-78158.md create mode 100644 2026/CVE-2026-78161.md create mode 100644 2026/CVE-2026-78166.md create mode 100644 2026/CVE-2026-78167.md create mode 100644 2026/CVE-2026-78168.md create mode 100644 2026/CVE-2026-78169.md create mode 100644 2026/CVE-2026-78170.md create mode 100644 2026/CVE-2026-78171.md create mode 100644 2026/CVE-2026-78177.md create mode 100644 2026/CVE-2026-78185.md create mode 100644 2026/CVE-2026-78187.md create mode 100644 2026/CVE-2026-78196.md create mode 100644 2026/CVE-2026-78197.md create mode 100644 2026/CVE-2026-78198.md create mode 100644 2026/CVE-2026-78199.md create mode 100644 2026/CVE-2026-78200.md create mode 100644 2026/CVE-2026-78201.md create mode 100644 2026/CVE-2026-78202.md create mode 100644 2026/CVE-2026-78203.md create mode 100644 2026/CVE-2026-78204.md create mode 100644 2026/CVE-2026-78205.md create mode 100644 2026/CVE-2026-78244.md create mode 100644 2026/CVE-2026-78245.md create mode 100644 2026/CVE-2026-78246.md create mode 100644 2026/CVE-2026-78247.md create mode 100644 2026/CVE-2026-78248.md create mode 100644 2026/CVE-2026-78250.md create mode 100644 2026/CVE-2026-78364.md create mode 100644 2026/CVE-2026-78367.md create mode 100644 2026/CVE-2026-78430.md create mode 100644 2026/CVE-2026-78434.md create mode 100644 2026/CVE-2026-78435.md create mode 100644 2026/CVE-2026-78637.md create mode 100644 2026/CVE-2026-78638.md create mode 100644 2026/CVE-2026-78654.md create mode 100644 2026/CVE-2026-78656.md create mode 100644 2026/CVE-2026-78675.md create mode 100644 2026/CVE-2026-78676.md create mode 100644 2026/CVE-2026-78677.md create mode 100644 2026/CVE-2026-78678.md create mode 100644 2026/CVE-2026-78679.md create mode 100644 2026/CVE-2026-78681.md create mode 100644 2026/CVE-2026-78682.md create mode 100644 2026/CVE-2026-78683.md create mode 100644 2026/CVE-2026-81660.md create mode 100644 2026/CVE-2026-81766.md create mode 100644 2026/CVE-2026-82417.md create mode 100644 2026/CVE-2026-82421.md create mode 100644 2026/CVE-2026-82422.md create mode 100644 2026/CVE-2026-82424.md create mode 100644 2026/CVE-2026-82455.md create mode 100644 2026/CVE-2026-82456.md create mode 100644 2026/CVE-2026-82457.md create mode 100644 2026/CVE-2026-82460.md create mode 100644 2026/CVE-2026-82475.md create mode 100644 2026/CVE-2026-82483.md create mode 100644 2026/CVE-2026-82484.md create mode 100644 2026/CVE-2026-82485.md create mode 100644 2026/CVE-2026-82562.md create mode 100644 2026/CVE-2026-8952.md diff --git a/2003/CVE-2003-1448.md b/2003/CVE-2003-1448.md new file mode 100644 index 0000000000..9ffdfa76ce --- /dev/null +++ b/2003/CVE-2003-1448.md @@ -0,0 +1,17 @@ +### [CVE-2003-1448](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2003-1448) +![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen) + +### Description + +Memory leak in the Windows 2000 kernel allows remote attackers to cause a denial of service (SMB request hang) via a NetBIOS continuation packet. + +### POC + +#### Reference +- http://www.immunitysec.com/downloads/advantages_of_block_based_analysis.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2004/CVE-2004-0368.md b/2004/CVE-2004-0368.md new file mode 100644 index 0000000000..dcd819a9b1 --- /dev/null +++ b/2004/CVE-2004-0368.md @@ -0,0 +1,18 @@ +### [CVE-2004-0368](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-0368) +![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen) + +### Description + +Double free vulnerability in dtlogin in CDE on Solaris, HP-UX, and other operating systems allows remote attackers to execute arbitrary code via a crafted XDMCP packet. + +### POC + +#### Reference +- http://lists.immunitysec.com/pipermail/dailydave/2004-March/000402.html +- http://www.immunitysec.com/downloads/dtlogin.sxw.pdf + +#### Github +No PoCs found on GitHub currently. + diff --git a/2004/CVE-2004-0478.md b/2004/CVE-2004-0478.md new file mode 100644 index 0000000000..fb8a1ba1c9 --- /dev/null +++ b/2004/CVE-2004-0478.md @@ -0,0 +1,17 @@ +### [CVE-2004-0478](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-0478) +![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen) + +### Description + +Unknown versions of Mozilla allow remote attackers to cause a denial of service (high CPU/RAM consumption) using Javascript with an infinite loop that continues to add input to a form, possibly as the result of inserting control characters, as demonstrated using an embedded ctrl-U. + +### POC + +#### Reference +- http://lists.immunitysec.com/pipermail/dailydave/2004-May/000587.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2004/CVE-2004-1080.md b/2004/CVE-2004-1080.md index 4afa88795a..eab8ff42ef 100644 --- a/2004/CVE-2004-1080.md +++ b/2004/CVE-2004-1080.md @@ -10,6 +10,7 @@ The WINS service (wins.exe) on Microsoft Windows NT Server 4.0, Windows 2000 Ser ### POC #### Reference +- http://www.immunitysec.com/downloads/instantanea.pdf - https://docs.microsoft.com/en-us/security-updates/securitybulletins/2004/ms04-045 #### Github diff --git a/2004/CVE-2004-1812.md b/2004/CVE-2004-1812.md new file mode 100644 index 0000000000..a15f237b59 --- /dev/null +++ b/2004/CVE-2004-1812.md @@ -0,0 +1,17 @@ +### [CVE-2004-1812](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-1812) +![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen) + +### Description + +Multiple stack-based buffer overflows in Agent Common Services (1) cam.exe and (2) awservices.exe in Unicenter TNG 2.4 allow remote attackers to execute arbitrary code. + +### POC + +#### Reference +- http://www.immunitysec.com/downloads/awservices.sxw.pdf + +#### Github +No PoCs found on GitHub currently. + diff --git a/2004/CVE-2004-2686.md b/2004/CVE-2004-2686.md new file mode 100644 index 0000000000..7bf6ff007c --- /dev/null +++ b/2004/CVE-2004-2686.md @@ -0,0 +1,17 @@ +### [CVE-2004-2686](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-2686) +![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen) + +### Description + +Directory traversal vulnerability in the vfs_getvfssw function in Solaris 2.6, 7, 8, and 9 allows local users to load arbitrary kernel modules via crafted (1) mount or (2) sysfs system calls. NOTE: this might be the same issue as CVE-2004-1767, but there are insufficient details to be sure. + +### POC + +#### Reference +- http://www.immunitysec.com/downloads/solaris_kernel_vfs.sxw.pdf + +#### Github +No PoCs found on GitHub currently. + diff --git a/2005/CVE-2005-0575.md b/2005/CVE-2005-0575.md index 7334cd27e7..46ceb332b3 100644 --- a/2005/CVE-2005-0575.md +++ b/2005/CVE-2005-0575.md @@ -11,6 +11,7 @@ Buffer overflow in Stormy Studios Knet 1.04c and earlier allows remote attackers #### Reference - http://marc.info/?l=bugtraq&m=110943766505666&w=2 +- http://www.exploit-db.com/exploits/24897 - http://www.exploit-db.com/exploits/24950 #### Github diff --git a/2005/CVE-2005-3294.md b/2005/CVE-2005-3294.md index 21a6d2381e..7115e47412 100644 --- a/2005/CVE-2005-3294.md +++ b/2005/CVE-2005-3294.md @@ -10,6 +10,7 @@ Typsoft FTP Server 1.11, with "Sub Directory Include" enabled, allows remote att ### POC #### Reference +- http://www.exploit-db.com/exploits/15860 - http://www.exploitlabs.com/files/advisories/EXPL-A-2005-016-typsoft-ftpd.txt #### Github diff --git a/2005/CVE-2005-3912.md b/2005/CVE-2005-3912.md new file mode 100644 index 0000000000..46730b1f2c --- /dev/null +++ b/2005/CVE-2005-3912.md @@ -0,0 +1,17 @@ +### [CVE-2005-3912](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3912) +![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen) + +### Description + +Format string vulnerability in miniserv.pl Perl web server in Webmin before 1.250 and Usermin before 1.180, with syslog logging enabled, allows remote attackers to cause a denial of service (crash or memory consumption) and possibly execute arbitrary code via format string specifiers in the username parameter to the login form, which is ultimately used in a syslog call. NOTE: the code execution might be associated with an issue in Perl. + +### POC + +#### Reference +- http://lists.immunitysec.com/pipermail/dailydave/2005-November/002685.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2006/CVE-2006-0106.md b/2006/CVE-2006-0106.md new file mode 100644 index 0000000000..5ce96aa14f --- /dev/null +++ b/2006/CVE-2006-0106.md @@ -0,0 +1,17 @@ +### [CVE-2006-0106](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-0106) +![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen) + +### Description + +gdi/driver.c and gdi/printdrv.c in Wine 20050930, and other versions, implement the SETABORTPROC GDI Escape function call for Windows Metafile (WMF) files, which allows attackers to execute arbitrary code, the same vulnerability as CVE-2005-4560 but in a different codebase. + +### POC + +#### Reference +- http://lists.immunitysec.com/pipermail/dailydave/2006-January/002806.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2006/CVE-2006-0454.md b/2006/CVE-2006-0454.md index 886f75b150..e6433630b6 100644 --- a/2006/CVE-2006-0454.md +++ b/2006/CVE-2006-0454.md @@ -10,6 +10,7 @@ Linux kernel before 2.6.15.3 down to 2.6.12, while constructing an ICMP response ### POC #### Reference +- http://lists.immunitysec.com/pipermail/dailydave/2006-February/002909.html - http://www.securityfocus.com/archive/1/427981/100/0/threaded #### Github diff --git a/2006/CVE-2006-0580.md b/2006/CVE-2006-0580.md new file mode 100644 index 0000000000..4673cec984 --- /dev/null +++ b/2006/CVE-2006-0580.md @@ -0,0 +1,17 @@ +### [CVE-2006-0580](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-0580) +![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen) + +### Description + +IBM Lotus Domino Server 7.0 allows remote attackers to cause a denial of service (segmentation fault) via a crafted packet to the LDAP port (389/TCP). + +### POC + +#### Reference +- http://lists.immunitysec.com/pipermail/dailydave/2006-February/002896.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2006/CVE-2006-0647.md b/2006/CVE-2006-0647.md new file mode 100644 index 0000000000..b5f7c53248 --- /dev/null +++ b/2006/CVE-2006-0647.md @@ -0,0 +1,18 @@ +### [CVE-2006-0647](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-0647) +![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen) + +### Description + +LDAP service in Sun Java System Directory Server 5.2, running on Linux and possibly other platforms, allows remote attackers to cause a denial of service (memory allocation error) via an LDAP packet with a crafted subtree search request, as demonstrated using the ProtoVer LDAP test suite. + +### POC + +#### Reference +- http://lists.immunitysec.com/pipermail/dailydave/2006-February/002914.html +- http://lists.immunitysec.com/pipermail/dailydave/2006-February/002916.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2006/CVE-2006-0696.md b/2006/CVE-2006-0696.md new file mode 100644 index 0000000000..a02e066a37 --- /dev/null +++ b/2006/CVE-2006-0696.md @@ -0,0 +1,17 @@ +### [CVE-2006-0696](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-0696) +![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen) + +### Description + +SQL injection vulnerability in Zen Cart before 1.2.7 allows remote attackers to execute arbitrary SQL commands via unspecified vectors. + +### POC + +#### Reference +- http://www.vupen.com/english/advisories/2006/0546 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2006/CVE-2006-0697.md b/2006/CVE-2006-0697.md new file mode 100644 index 0000000000..fc23f8cdce --- /dev/null +++ b/2006/CVE-2006-0697.md @@ -0,0 +1,17 @@ +### [CVE-2006-0697](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-0697) +![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen) + +### Description + +Zen Cart before 1.2.7 does not protect the admin/includes directory, which allows remote attackers to cause unknown impact via unspecified vectors, probably direct requests. + +### POC + +#### Reference +- http://www.vupen.com/english/advisories/2006/0546 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2006/CVE-2006-0698.md b/2006/CVE-2006-0698.md new file mode 100644 index 0000000000..48614cdcbb --- /dev/null +++ b/2006/CVE-2006-0698.md @@ -0,0 +1,17 @@ +### [CVE-2006-0698](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-0698) +![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen) + +### Description + +Unspecified vulnerabilities in Zen Cart before 1.2.7 allow remote attackers to cause unknown impact via unspecified vectors related to "other attempted exploits" other than SQL injection. + +### POC + +#### Reference +- http://www.vupen.com/english/advisories/2006/0546 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2006/CVE-2006-0710.md b/2006/CVE-2006-0710.md new file mode 100644 index 0000000000..75f48f60cc --- /dev/null +++ b/2006/CVE-2006-0710.md @@ -0,0 +1,17 @@ +### [CVE-2006-0710](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-0710) +![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen) + +### Description + +Double free vulnerability in isode.eddy in Isode M-Vault Server 11.3 allows remote attackers to execute arbitrary code via a crafted LDAP request, as demonstrated by ProtoVer Sample LDAP. + +### POC + +#### Reference +- http://lists.immunitysec.com/pipermail/dailydave/2006-February/002925.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2006/CVE-2006-0717.md b/2006/CVE-2006-0717.md new file mode 100644 index 0000000000..a7d940b393 --- /dev/null +++ b/2006/CVE-2006-0717.md @@ -0,0 +1,17 @@ +### [CVE-2006-0717](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-0717) +![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen) + +### Description + +IBM Tivoli Directory Server 6.0 allows remote attackers to cause a denial of service (crash) via a crafted LDAP request, as demonstrated by test 2532 in the ProtoVer Sample LDAP test suite. + +### POC + +#### Reference +- http://lists.immunitysec.com/pipermail/dailydave/2006-February/002921.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2006/CVE-2006-0790.md b/2006/CVE-2006-0790.md new file mode 100644 index 0000000000..69a309aff4 --- /dev/null +++ b/2006/CVE-2006-0790.md @@ -0,0 +1,17 @@ +### [CVE-2006-0790](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-0790) +![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen) + +### Description + +Rockliffe MailSite 7.0 and earlier allows remote attackers to cause a denial of service by sending crafted LDAP packets to port 389/TCP, as demonstrated by the ProtoVer LDAP testsuite. + +### POC + +#### Reference +- http://lists.immunitysec.com/pipermail/dailydave/2006-February/002926.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2006/CVE-2006-0900.md b/2006/CVE-2006-0900.md index e6acb8087b..0ec389a98c 100644 --- a/2006/CVE-2006-0900.md +++ b/2006/CVE-2006-0900.md @@ -10,6 +10,7 @@ nfsd in FreeBSD 6.0 kernel allows remote attackers to cause a denial of service ### POC #### Reference +- http://lists.immunitysec.com/pipermail/dailydave/2006-February/002982.html - http://securityreason.com/securityalert/521 #### Github diff --git a/2006/CVE-2006-2183.md b/2006/CVE-2006-2183.md new file mode 100644 index 0000000000..cd35bb3d9d --- /dev/null +++ b/2006/CVE-2006-2183.md @@ -0,0 +1,17 @@ +### [CVE-2006-2183](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2183) +![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen) + +### Description + +Untrusted search path vulnerability in Truecrypt 4.1, when running suid root on Linux, allows local users to execute arbitrary commands and gain privileges via a modified PATH environment variable that references a malicious mount command. + +### POC + +#### Reference +- http://lists.immunitysec.com/pipermail/dailydave/2006-April/003152.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2006/CVE-2006-3746.md b/2006/CVE-2006-3746.md index 737b86d3c7..9e7b652fc3 100644 --- a/2006/CVE-2006-3746.md +++ b/2006/CVE-2006-3746.md @@ -10,7 +10,7 @@ Integer overflow in parse_comment in GnuPG (gpg) 1.4.4 allows remote attackers t ### POC #### Reference -No PoCs from references. +- http://lists.immunitysec.com/pipermail/dailydave/2006-July/003354.html #### Github - https://github.com/mudongliang/LinuxFlaw diff --git a/2006/CVE-2006-6332.md b/2006/CVE-2006-6332.md index 1d994558fa..2a8c10c32e 100644 --- a/2006/CVE-2006-6332.md +++ b/2006/CVE-2006-6332.md @@ -10,7 +10,7 @@ Stack-based buffer overflow in net80211/ieee80211_wireless.c in MadWifi before 0 ### POC #### Reference -No PoCs from references. +- http://lists.immunitysec.com/pipermail/dailydave/2006-December/003888.html #### Github - https://github.com/0xd012/wifuzzit diff --git a/2006/CVE-2006-6931.md b/2006/CVE-2006-6931.md new file mode 100644 index 0000000000..456be02b1c --- /dev/null +++ b/2006/CVE-2006-6931.md @@ -0,0 +1,17 @@ +### [CVE-2006-6931](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-6931) +![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen) + +### Description + +Algorithmic complexity vulnerability in Snort before 2.6.1, during predicate evaluation in rule matching for certain rules, allows remote attackers to cause a denial of service (CPU consumption and detection outage) via crafted network traffic, aka a "backtracking attack." + +### POC + +#### Reference +- http://lists.immunitysec.com/pipermail/dailydave/2007-January/003954.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2007/CVE-2007-0675.md b/2007/CVE-2007-0675.md new file mode 100644 index 0000000000..a672beaf90 --- /dev/null +++ b/2007/CVE-2007-0675.md @@ -0,0 +1,20 @@ +### [CVE-2007-0675](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0675) +![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen) + +### Description + +A certain ActiveX control in sapi.dll (aka the Speech API) in Speech Components in Microsoft Windows Vista, when the Speech Recognition feature is enabled, allows user-assisted remote attackers to delete arbitrary files, and conduct other unauthorized activities, via a web page with an embedded sound object that contains voice commands to an enabled microphone, allowing for interaction with Windows Explorer. + +### POC + +#### Reference +- http://lists.immunitysec.com/pipermail/dailydave/2007-January/004003.html +- http://lists.immunitysec.com/pipermail/dailydave/2007-January/004005.html +- http://lists.immunitysec.com/pipermail/dailydave/2007-January/004007.html +- http://lists.immunitysec.com/pipermail/dailydave/2007-January/004012.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2007/CVE-2007-1189.md b/2007/CVE-2007-1189.md index e60e87090f..2daf850452 100644 --- a/2007/CVE-2007-1189.md +++ b/2007/CVE-2007-1189.md @@ -10,6 +10,7 @@ Integer overflow in the envwrite function in the Alcatel-Lucent Bell Labs Plan 9 ### POC #### Reference +- http://lists.immunitysec.com/pipermail/dailydave/2007-February/004118.html - https://www.exploit-db.com/exploits/3383 #### Github diff --git a/2007/CVE-2007-1222.md b/2007/CVE-2007-1222.md new file mode 100644 index 0000000000..a6f852d2fd --- /dev/null +++ b/2007/CVE-2007-1222.md @@ -0,0 +1,17 @@ +### [CVE-2007-1222](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1222) +![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen) + +### Description + +Parallels Desktop for Mac before 20070216 implements Drag and Drop by sharing the entire host filesystem as the .psf share, which allows local users of the guest operating system to write arbitrary files to the host filesystem, and execute arbitrary code via launchd by writing a plist file to a LaunchAgents directory. + +### POC + +#### Reference +- http://lists.immunitysec.com/pipermail/dailydave/2007-February/004091.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2007/CVE-2007-3634.md b/2007/CVE-2007-3634.md new file mode 100644 index 0000000000..59a189aa62 --- /dev/null +++ b/2007/CVE-2007-3634.md @@ -0,0 +1,19 @@ +### [CVE-2007-3634](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3634) +![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen) + +### Description + +Unspecified vulnerability in the G/PGP (GPG) Plugin 2.0 for Squirrelmail 1.4.10a allows remote authenticated users to execute arbitrary commands via unspecified vectors, possibly related to the passphrase variable in the gpg_sign_attachment function, aka ZD-00000004. this information is based upon a vague advisory by a vulnerability information sales organization that does not coordinate with vendors or release actionable advisories. A CVE has been assigned for tracking purposes, but duplicates with other CVEs are difficult to determine. + +### POC + +#### Reference +- http://lists.immunitysec.com/pipermail/dailydave/2007-July/004448.html +- http://lists.immunitysec.com/pipermail/dailydave/2007-July/004452.html +- http://lists.immunitysec.com/pipermail/dailydave/2007-July/004453.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2007/CVE-2007-3636.md b/2007/CVE-2007-3636.md new file mode 100644 index 0000000000..d0f3ce58db --- /dev/null +++ b/2007/CVE-2007-3636.md @@ -0,0 +1,17 @@ +### [CVE-2007-3636](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3636) +![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen) + +### Description + +Multiple unspecified vulnerabilities in the G/PGP (GPG) Plugin 2.1 for Squirrelmail allow remote attackers to execute arbitrary commands via unspecified vectors. NOTE: this information is based upon a vague pre-advisory from a reliable researcher. + +### POC + +#### Reference +- http://lists.immunitysec.com/pipermail/dailydave/2007-July/004453.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2007/CVE-2007-3637.md b/2007/CVE-2007-3637.md new file mode 100644 index 0000000000..7989f0be4f --- /dev/null +++ b/2007/CVE-2007-3637.md @@ -0,0 +1,17 @@ +### [CVE-2007-3637](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3637) +![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen) + +### Description + +SQL injection vulnerability in MKPortal 1.1.1 allows remote attackers to execute arbitrary SQL commands via unspecified vectors, aka ZD-00000008. this information is based upon a vague advisory by a vulnerability information sales organization that does not coordinate with vendors or release actionable advisories. A CVE has been assigned for tracking purposes, but duplicates with other CVEs are difficult to determine. + +### POC + +#### Reference +- http://lists.immunitysec.com/pipermail/dailydave/2007-July/004448.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2007/CVE-2007-3778.md b/2007/CVE-2007-3778.md index c65041f66d..8aa165bff4 100644 --- a/2007/CVE-2007-3778.md +++ b/2007/CVE-2007-3778.md @@ -10,6 +10,8 @@ The G/PGP (GPG) Plugin 2.0, and 2.1dev before 20060912, for Squirrelmail allows ### POC #### Reference +- http://lists.immunitysec.com/pipermail/dailydave/2007-July/004452.html +- http://lists.immunitysec.com/pipermail/dailydave/2007-July/004456.html - http://www.attrition.org/pipermail/vim/2007-July/001704.html - http://www.attrition.org/pipermail/vim/2007-July/001710.html - https://exchange.xforce.ibmcloud.com/vulnerabilities/35363 diff --git a/2008/CVE-2008-0098.md b/2008/CVE-2008-0098.md new file mode 100644 index 0000000000..8a87596599 --- /dev/null +++ b/2008/CVE-2008-0098.md @@ -0,0 +1,17 @@ +### [CVE-2008-0098](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0098) +![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen) + +### Description + +Buffer overflow in RealPlayer 11 build 6.0.14.748 allows remote attackers to execute arbitrary code via unspecified vectors. NOTE: As of 20080103, this disclosure has no actionable information. However, because the VulnDisco Pack author is a reliable researcher, the issue is being assigned a CVE identifier for tracking purposes. + +### POC + +#### Reference +- http://lists.immunitysec.com/pipermail/dailydave/2008-January/004811.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2008/CVE-2008-4434.md b/2008/CVE-2008-4434.md new file mode 100644 index 0000000000..7cd1078fc0 --- /dev/null +++ b/2008/CVE-2008-4434.md @@ -0,0 +1,17 @@ +### [CVE-2008-4434](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4434) +![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen) + +### Description + +Stack-based buffer overflow in (1) uTorrent 1.7.7 build 8179 and earlier and (2) BitTorrent 6.0.3 build 8642 and earlier allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long Created By field in a .torrent file. + +### POC + +#### Reference +- http://lists.immunitysec.com/pipermail/dailydave/attachments/20080811/35d6194b/attachment-0001.pdf + +#### Github +No PoCs found on GitHub currently. + diff --git a/2008/CVE-2008-4609.md b/2008/CVE-2008-4609.md index cd9422c517..e21d86627b 100644 --- a/2008/CVE-2008-4609.md +++ b/2008/CVE-2008-4609.md @@ -10,6 +10,7 @@ The TCP implementation in (1) Linux, (2) platforms based on BSD Unix, (3) Micros ### POC #### Reference +- http://lists.immunitysec.com/pipermail/dailydave/2008-October/005360.html - http://searchsecurity.techtarget.com.au/articles/27154-TCP-is-fundamentally-borked - http://www.mandriva.com/security/advisories?name=MDVSA-2013:150 - http://www.oracle.com/technetwork/topics/security/cpujul2012-392727.html diff --git a/2008/CVE-2008-5230.md b/2008/CVE-2008-5230.md index 46a4ffe82d..e4131907bf 100644 --- a/2008/CVE-2008-5230.md +++ b/2008/CVE-2008-5230.md @@ -10,6 +10,7 @@ The Temporal Key Integrity Protocol (TKIP) implementation in unspecified Cisco p ### POC #### Reference +- http://lists.immunitysec.com/pipermail/dailydave/2008-November/005413.html - http://radajo.blogspot.com/2008/11/wpatkip-chopchop-attack.html - http://www.aircrack-ng.org/doku.php?id=tkiptun-ng diff --git a/2009/CVE-2009-0836.md b/2009/CVE-2009-0836.md index fdd750089a..7c1a7de6b9 100644 --- a/2009/CVE-2009-0836.md +++ b/2009/CVE-2009-0836.md @@ -11,6 +11,7 @@ Foxit Reader 2.3 before Build 3902 and 3.0 before Build 1506, including 1120 and #### Reference - http://blog.zoller.lu/2009/03/remote-code-execution-in-pdf-still.html +- http://lists.immunitysec.com/pipermail/dailydave/2010-April/006079.html - http://www.coresecurity.com/content/foxit-reader-vulnerabilities #### Github diff --git a/2009/CVE-2009-4484.md b/2009/CVE-2009-4484.md index 733d38a9a4..423c347d8f 100644 --- a/2009/CVE-2009-4484.md +++ b/2009/CVE-2009-4484.md @@ -12,6 +12,7 @@ Multiple stack-based buffer overflows in the CertDecoder::GetName function in sr #### Reference - http://bugs.mysql.com/bug.php?id=50227 - http://isc.sans.org/diary.html?storyid=7900 +- http://lists.immunitysec.com/pipermail/dailydave/2010-January/006020.html - http://yassl.cvs.sourceforge.net/viewvc/yassl/yassl/taocrypt/src/asn.cpp?r1=1.13&r2=1.14 - https://bugzilla.redhat.com/show_bug.cgi?id=555313 diff --git a/2009/CVE-2009-4764.md b/2009/CVE-2009-4764.md new file mode 100644 index 0000000000..ffdc257c69 --- /dev/null +++ b/2009/CVE-2009-4764.md @@ -0,0 +1,18 @@ +### [CVE-2009-4764](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-4764) +![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen) + +### Description + +Adobe Reader 8.x and 9.x on Windows is able to execute EXE files that are embedded in a PDF document, which makes it easier for remote attackers to trick users into executing arbitrary code via a crafted document. + +### POC + +#### Reference +- http://lists.immunitysec.com/pipermail/dailydave/2010-April/006072.html +- http://lists.immunitysec.com/pipermail/dailydave/2010-April/006074.html + +#### Github +No PoCs found on GitHub currently. + diff --git a/2016/CVE-2016-10701.md b/2016/CVE-2016-10701.md index 8bf63fd41b..a69671dad8 100644 --- a/2016/CVE-2016-10701.md +++ b/2016/CVE-2016-10701.md @@ -12,6 +12,7 @@ In Hitachi Vantara Pentaho BA Platform through 8.0, a CSRF issue exists in the B #### Reference - http://jira.pentaho.com/browse/BISERVER-13207 - http://jira.pentaho.com/browse/BISERVER-3562 +- http://jira.pentaho.com/browse/BISERVER-6599 #### Github No PoCs found on GitHub currently. diff --git a/2020/CVE-2020-15874.md b/2020/CVE-2020-15874.md index 515602f2e5..d6dd2d9505 100644 --- a/2020/CVE-2020-15874.md +++ b/2020/CVE-2020-15874.md @@ -10,6 +10,7 @@ An issue was discovered in LibreNMS 1.65. A remote authenticated attacker with n ### POC #### Reference +- https://shielder.it/blog - https://www.shielder.com/advisories/librenms-graph-authenticated-command-injection/ #### Github diff --git a/2020/CVE-2020-15876.md b/2020/CVE-2020-15876.md index 3e45270a20..a667069bab 100644 --- a/2020/CVE-2020-15876.md +++ b/2020/CVE-2020-15876.md @@ -10,6 +10,7 @@ An issue was discovered in LibreNMS 1.65. A remote authenticated attacker with n ### POC #### Reference +- https://shielder.it/blog - https://www.shielder.com/advisories/librenms-searchphrase-authenticated-sql-injection/ #### Github diff --git a/2020/CVE-2020-15878.md b/2020/CVE-2020-15878.md index f390adff6d..79ce2c0976 100644 --- a/2020/CVE-2020-15878.md +++ b/2020/CVE-2020-15878.md @@ -10,6 +10,7 @@ An issue was discovered in LibreNMS 1.65. A remote authenticated attacker with n ### POC #### Reference +- https://shielder.it/blog - https://www.shielder.com/advisories/librenms-address-authenticated-sql-injection/ #### Github diff --git a/2021/CVE-2021-22182.md b/2021/CVE-2021-22182.md new file mode 100644 index 0000000000..f39d8007e9 --- /dev/null +++ b/2021/CVE-2021-22182.md @@ -0,0 +1,18 @@ +### [CVE-2021-22182](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-22182) +![](https://img.shields.io/static/v1?label=Product&message=GitLab&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=%3E%3D13.7%2C%20%3C13.7.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=%3E%3D13.8%2C%20%3C13.8.2%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Improper%20neutralization%20of%20input%20during%20web%20page%20generation%20('cross-site%20scripting')%20in%20GitLab&color=brightgreen) + +### Description + +An issue has been discovered in GitLab affecting all versions starting with 13.7. GitLab was vulnerable to a stored XSS in merge request. + +### POC + +#### Reference +- https://gitlab.com/gitlab-org/gitlab/-/issues/280779 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2021/CVE-2021-37253.md b/2021/CVE-2021-37253.md index c1a5897fcc..4c226fe524 100644 --- a/2021/CVE-2021-37253.md +++ b/2021/CVE-2021-37253.md @@ -12,6 +12,7 @@ M-Files Web before 20.10.9524.1 allows a denial of service via overlapping range #### Reference - http://packetstormsecurity.com/files/165139/M-Files-Web-Denial-Of-Service.html - http://seclists.org/fulldisclosure/2021/Dec/1 +- https://vulmon.com/vulnerabilitydetails?qid=CVE-2021-37253 - https://www.tenable.com/cve/CVE-2021-37253 #### Github diff --git a/2023/CVE-2023-0957.md b/2023/CVE-2023-0957.md new file mode 100644 index 0000000000..c3141c190a --- /dev/null +++ b/2023/CVE-2023-0957.md @@ -0,0 +1,17 @@ +### [CVE-2023-0957](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-0957) +![](https://img.shields.io/static/v1?label=Product&message=Gitpod&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-1385%20Missing%20Origin%20Validation%20in%20WebSockets&color=brightgreen) + +### Description + +An issue was discovered in Gitpod versions prior to release-2022.11.2.16. There is a Cross-Site WebSocket Hijacking (CSWSH) vulnerability that allows attackers to make WebSocket connections to the Gitpod JSONRPC server using a victim’s credentials, because the Origin header is not restricted. This can lead to the extraction of data from workspaces, to a full takeover of the workspace. + +### POC + +#### Reference +- https://snyk.io/blog/gitpod-remote-code-execution-vulnerability-websockets/ + +#### Github +No PoCs found on GitHub currently. + diff --git a/2024/CVE-2024-25735.md b/2024/CVE-2024-25735.md index daa1e0b097..83b5d6a14e 100644 --- a/2024/CVE-2024-25735.md +++ b/2024/CVE-2024-25735.md @@ -12,6 +12,7 @@ An issue was discovered on WyreStorm Apollo VX20 devices before 1.3.58. Remote a #### Reference - http://packetstormsecurity.com/files/177082 +- http://seclists.org/fulldisclosure/2024/Feb/11 #### Github - https://github.com/codeb0ss/CVE-2024-25735-PoC diff --git a/2024/CVE-2024-48955.md b/2024/CVE-2024-48955.md index 5fe071f4fd..758f460415 100644 --- a/2024/CVE-2024-48955.md +++ b/2024/CVE-2024-48955.md @@ -11,7 +11,7 @@ Broken access control in NetAdmin 4.030319 returns data with functionalities on ### POC #### Reference -No PoCs from references. +- https://vulmon.com/vulnerabilitydetails?qid=CVE-2024-48955&sortby=bydate #### Github - https://github.com/BrotherOfJhonny/CVE-2024-48955_Overview diff --git a/2024/CVE-2024-55040.md b/2024/CVE-2024-55040.md index f1f5193431..3d052a943d 100644 --- a/2024/CVE-2024-55040.md +++ b/2024/CVE-2024-55040.md @@ -11,6 +11,7 @@ Cross Site Scripting vulnerability in Sensaphone WEB600 Monitoring System v.1.6. #### Reference - https://github.com/tcbutler320/Sensaphone-WEB600-XSS +- https://vulmon.com/vulnerabilitydetails?qid=CVE-2024-55040 #### Github - https://github.com/tcbutler320/CVE-2024-55040-Sensaphone-XSS diff --git a/2024/CVE-2024-58315.md b/2024/CVE-2024-58315.md index c2501fe98d..e8b68e920e 100644 --- a/2024/CVE-2024-58315.md +++ b/2024/CVE-2024-58315.md @@ -1,6 +1,6 @@ ### [CVE-2024-58315](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-58315) ![](https://img.shields.io/static/v1?label=Product&message=Tosibox%20Key%20Service&color=blue) -![](https://img.shields.io/static/v1?label=Version&message=Unknown%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) ![](https://img.shields.io/static/v1?label=Vulnerability&message=Unquoted%20Search%20Path%20or%20Element&color=brightgreen) ### Description diff --git a/2024/CVE-2024-7705.md b/2024/CVE-2024-7705.md index 1f0e241912..bbe3d52b49 100644 --- a/2024/CVE-2024-7705.md +++ b/2024/CVE-2024-7705.md @@ -12,6 +12,7 @@ In Fujian mwcms 1.0.0 wurde eine kritische Schwachstelle ausgemacht. Dabei geht #### Reference - https://github.com/DeepMountains/Mirage/blob/main/CVE12-1.md +- https://vuldb.com/?ctiid.274183 #### Github - https://github.com/fkie-cad/nvd-json-data-feeds diff --git a/2025/CVE-2025-6123.md b/2025/CVE-2025-6123.md index f08bc80e26..833ee49064 100644 --- a/2025/CVE-2025-6123.md +++ b/2025/CVE-2025-6123.md @@ -13,6 +13,7 @@ In code-projects Restaurant Order System 1.0 wurde eine kritische Schwachstelle #### Reference - https://github.com/ez-lbz/poc/issues/1 +- https://vuldb.com/?ctiid.312592 #### Github No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-13780.md b/2026/CVE-2026-13780.md new file mode 100644 index 0000000000..c33c2b5f21 --- /dev/null +++ b/2026/CVE-2026-13780.md @@ -0,0 +1,17 @@ +### [CVE-2026-13780](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13780) +![](https://img.shields.io/static/v1?label=Product&message=Chrome&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=150.0.7871.47%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Insufficient%20validation%20of%20untrusted%20input&color=brightgreen) + +### Description + +Insufficient validation of untrusted input in ANGLE in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical) + +### POC + +#### Reference +- https://issues.chromium.org/issues/514769383 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-14307.md b/2026/CVE-2026-14307.md new file mode 100644 index 0000000000..0514895414 --- /dev/null +++ b/2026/CVE-2026-14307.md @@ -0,0 +1,17 @@ +### [CVE-2026-14307](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-14307) +![](https://img.shields.io/static/v1?label=Product&message=geotargetingwp&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-79%20Cross-Site%20Scripting%20(XSS)&color=brightgreen) + +### Description + +The geotargetingwp WordPress plugin before 3.5.6.2 does not sanitise or escape several parameters before reflecting them back in AJAX responses that are served with an HTML content type, allowing unauthenticated attackers to inject arbitrary web scripts that execute when a victim is tricked into submitting a crafted request. + +### POC + +#### Reference +- https://wpscan.com/vulnerability/5f55b592-9113-47d1-8b48-6ba785c0834a/ + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-14835.md b/2026/CVE-2026-14835.md new file mode 100644 index 0000000000..9efca0b614 --- /dev/null +++ b/2026/CVE-2026-14835.md @@ -0,0 +1,17 @@ +### [CVE-2026-14835](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-14835) +![](https://img.shields.io/static/v1?label=Product&message=SOGO%20Add%20Script%20to%20Individual%20Pages%20Header%20Footer&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-79%20Cross-Site%20Scripting%20(XSS)&color=brightgreen) + +### Description + +The SOGO Add Script to Individual Pages Header Footer WordPress plugin through 3.9 does not sanitise or escape the custom header/footer script values saved from its post metabox, and does not restrict them to users with the unfiltered_html capability, allowing users with contributor-level access and above to store JavaScript that executes in the browser of any administrator who reviews the post and of any visitor once the post is published. + +### POC + +#### Reference +- https://wpscan.com/vulnerability/f0b869b1-ef43-4540-9ca5-4440e763d307/ + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-15034.md b/2026/CVE-2026-15034.md new file mode 100644 index 0000000000..eb93e3b264 --- /dev/null +++ b/2026/CVE-2026-15034.md @@ -0,0 +1,20 @@ +### [CVE-2026-15034](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-15034) +![](https://img.shields.io/static/v1?label=Product&message=Flask-MonitoringDashboard&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=5.0.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=5.0.1%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=5.0.2%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Cross-Site%20Request%20Forgery&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Missing%20Authorization&color=brightgreen) + +### Description + +A vulnerability has been found in flask-dashboard Flask-MonitoringDashboard up to 5.0.2. Affected by this issue is some unknown functionality. Such manipulation leads to cross-site request forgery. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through an issue report but has not responded yet. + +### POC + +#### Reference +- https://github.com/flask-dashboard/Flask-MonitoringDashboard/issues/557 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-15035.md b/2026/CVE-2026-15035.md new file mode 100644 index 0000000000..773ae19a53 --- /dev/null +++ b/2026/CVE-2026-15035.md @@ -0,0 +1,18 @@ +### [CVE-2026-15035](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-15035) +![](https://img.shields.io/static/v1?label=Product&message=OpenLLM&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0.6.30%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Command%20Injection&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Injection&color=brightgreen) + +### Description + +A vulnerability was found in bentoml OpenLLM 0.6.30. This affects the function async_run_command of the file src/openllm/common.py of the component Model Repository Directory Name Handler. Performing a manipulation of the argument cmd results in command injection. Attacking locally is a requirement. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet. + +### POC + +#### Reference +- https://github.com/bentoml/OpenLLM/issues/1229 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-15105.md b/2026/CVE-2026-15105.md new file mode 100644 index 0000000000..ac758db190 --- /dev/null +++ b/2026/CVE-2026-15105.md @@ -0,0 +1,22 @@ +### [CVE-2026-15105](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-15105) +![](https://img.shields.io/static/v1?label=Product&message=snap7&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=1.4.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=1.4.1%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=1.4.2%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=1.4.3%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Memory%20Corruption&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Out-of-bounds%20Write&color=brightgreen) + +### Description + +A flaw has been found in davenardella snap7 up to 1.4.3. This affects the function TS7Worker::PerformFunctionRead of the file src/core/s7_server.cpp of the component ReadVar Request Handler. This manipulation causes out-of-bounds write. The attack requires access to the local network. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet. + +### POC + +#### Reference +- https://github.com/davenardella/snap7/issues/16 +- https://github.com/user-attachments/files/28681740/poc.zip + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-15135.md b/2026/CVE-2026-15135.md index d86347a770..708f010e80 100644 --- a/2026/CVE-2026-15135.md +++ b/2026/CVE-2026-15135.md @@ -11,6 +11,7 @@ A security flaw has been discovered in code-projects Online Food Order System 1. ### POC #### Reference +- https://github.com/susususua-AI/CVE/issues/1 - https://vuldb.com/submit/851065 #### Github diff --git a/2026/CVE-2026-15138.md b/2026/CVE-2026-15138.md new file mode 100644 index 0000000000..4e77b3d374 --- /dev/null +++ b/2026/CVE-2026-15138.md @@ -0,0 +1,19 @@ +### [CVE-2026-15138](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-15138) +![](https://img.shields.io/static/v1?label=Product&message=mcp-text-editor&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=1.0.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=1.0.1%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=1.0.2%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Path%20Traversal&color=brightgreen) + +### Description + +A security vulnerability has been detected in tumf mcp-text-editor up to 1.0.2. This issue affects the function _validate_file_path of the file mcp_text_editor/text_editor.py. Such manipulation of the argument file_path leads to path traversal. The attack can be launched remotely. The exploit has been disclosed publicly and may be used. The vendor closed the GitHub issue for this vulnerability without any explanation. + +### POC + +#### Reference +- https://github.com/tumf/mcp-text-editor/issues/22 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-15184.md b/2026/CVE-2026-15184.md index 1f7cd2df7e..08b92df254 100644 --- a/2026/CVE-2026-15184.md +++ b/2026/CVE-2026-15184.md @@ -16,6 +16,7 @@ A vulnerability was found in GNU LibreDWG up to 0.13.4. The impacted element is ### POC #### Reference +- https://github.com/LibreDWG/libredwg/issues/1253 - https://vuldb.com/submit/851192 #### Github diff --git a/2026/CVE-2026-15192.md b/2026/CVE-2026-15192.md new file mode 100644 index 0000000000..3ea3d41242 --- /dev/null +++ b/2026/CVE-2026-15192.md @@ -0,0 +1,19 @@ +### [CVE-2026-15192](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-15192) +![](https://img.shields.io/static/v1?label=Product&message=sendportal&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=3.0.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=3.0.1%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Improper%20Authentication&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Missing%20Authentication&color=brightgreen) + +### Description + +A vulnerability has been found in mettle sendportal up to 3.0.1. This issue affects the function sendgrid/postmark/postal/mailjet of the component APIv1 Webhooks. The manipulation leads to missing authentication. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through an issue report but has not responded yet. + +### POC + +#### Reference +- https://github.com/mettle/sendportal/issues/340 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-15194.md b/2026/CVE-2026-15194.md new file mode 100644 index 0000000000..589814dd79 --- /dev/null +++ b/2026/CVE-2026-15194.md @@ -0,0 +1,18 @@ +### [CVE-2026-15194](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-15194) +![](https://img.shields.io/static/v1?label=Product&message=Open5GS&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=2.7.7%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Memory%20Corruption&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Use%20After%20Free&color=brightgreen) + +### Description + +A security flaw has been discovered in Open5GS 2.7.7. This affects the function amf_context_final of the file src/amf/context.c of the component AMF. Performing a manipulation results in use after free. The attack is only possible with local access. The exploit has been released to the public and may be used for attacks. + +### POC + +#### Reference +- https://github.com/open5gs/open5gs/security/advisories/GHSA-88pq-hpwv-2vjw + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-15195.md b/2026/CVE-2026-15195.md new file mode 100644 index 0000000000..9c363dea18 --- /dev/null +++ b/2026/CVE-2026-15195.md @@ -0,0 +1,24 @@ +### [CVE-2026-15195](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-15195) +![](https://img.shields.io/static/v1?label=Product&message=json-schema-ref-parser&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=15.3.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=15.3.1%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=15.3.2%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=15.3.3%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=15.3.4%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=15.3.5%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Code%20Injection&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Improperly%20Controlled%20Modification%20of%20Object%20Prototype%20Attributes&color=brightgreen) + +### Description + +A weakness has been identified in apidevtools json-schema-ref-parser up to 15.3.5. This impacts the function Refs.set/Pointer.set in the library lib/pointer.ts. Executing a manipulation can lead to improperly controlled modification of object prototype attributes. The attack can be launched remotely. Upgrading to version 15.3.6 will fix this issue. This patch is called a786bc6afc3674f650496472ee93d5cf74c4bd84. It is suggested to upgrade the affected component. + +### POC + +#### Reference +- https://github.com/APIDevTools/json-schema-ref-parser/issues/421 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-15204.md b/2026/CVE-2026-15204.md new file mode 100644 index 0000000000..71d9a53f30 --- /dev/null +++ b/2026/CVE-2026-15204.md @@ -0,0 +1,18 @@ +### [CVE-2026-15204](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-15204) +![](https://img.shields.io/static/v1?label=Product&message=X5000R&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=9.1.0cu.2350_B20230313%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=9.1.0cu.2415_B20250515%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Path%20Traversal&color=brightgreen) + +### Description + +A vulnerability was detected in TOTOLINK X5000R 9.1.0cu.2415_B20250515/9.1.0cu.2350_B20230313. Affected by this vulnerability is the function exportOvpn of the file /web/cgi-bin/cstecgi.cgi of the component OpenVPN Export. The manipulation results in path traversal. The attack may be launched remotely. + +### POC + +#### Reference +- https://github.com/meishigana/CVE/tree/main/totolink_x5000r_exportovpn_file_disclosure_2026-06-09 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-15274.md b/2026/CVE-2026-15274.md new file mode 100644 index 0000000000..b0bdfa7bd9 --- /dev/null +++ b/2026/CVE-2026-15274.md @@ -0,0 +1,25 @@ +### [CVE-2026-15274](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-15274) +![](https://img.shields.io/static/v1?label=Product&message=fbxcel&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0.1%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0.2%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0.3%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0.4%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0.5%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0.7%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0.8%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0.9.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Denial%20of%20Service&color=brightgreen) + +### Description + +A vulnerability was detected in lo48576 fbxcel up to 0.9.0. This affects an unknown part of the file src/pull_parser/v7400/parser.rs of the component Node Header Handler. The manipulation results in denial of service. The attack must be initiated from a local position. The exploit is now public and may be used. The pull request to fix this issue awaits acceptance. + +### POC + +#### Reference +- https://github.com/lo48576/fbxcel/issues/14 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-15311.md b/2026/CVE-2026-15311.md new file mode 100644 index 0000000000..79cc324cf1 --- /dev/null +++ b/2026/CVE-2026-15311.md @@ -0,0 +1,21 @@ +### [CVE-2026-15311](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-15311) +![](https://img.shields.io/static/v1?label=Product&message=hermes-agent&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=2026.5.29.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=2026.5.29.1%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=2026.5.29.2%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Code%20Injection&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Cross%20Site%20Scripting&color=brightgreen) + +### Description + +A vulnerability was identified in NousResearch hermes-agent up to 2026.5.29.2. Affected by this issue is the function MatrixAdapter._markdown_to_html of the file gateway/platforms/matrix.py of the component Matrix Adapter. Such manipulation leads to cross site scripting. The attack can be executed remotely. The exploit is publicly available and might be used. The pull request to fix this issue awaits acceptance. + +### POC + +#### Reference +- https://github.com/NousResearch/hermes-agent/issues/42667 +- https://github.com/NousResearch/hermes-agent/pull/42759 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-15317.md b/2026/CVE-2026-15317.md new file mode 100644 index 0000000000..cddeda0ce6 --- /dev/null +++ b/2026/CVE-2026-15317.md @@ -0,0 +1,26 @@ +### [CVE-2026-15317](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-15317) +![](https://img.shields.io/static/v1?label=Product&message=PicoClaw&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0.2.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0.2.1%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0.2.2%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0.2.3%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0.2.4%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0.2.5%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0.2.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0.2.7%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0.2.8%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0.2.9%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Server-Side%20Request%20Forgery&color=brightgreen) + +### Description + +A security flaw has been discovered in Sipeed PicoClaw up to 0.2.9. Affected by this vulnerability is the function WebFetchTool.Execute of the file pkg/tools/integration/web.go of the component Guarded Web Fetch Flow. The manipulation results in server-side request forgery. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks. The reported GitHub issue was closed automatically due to inactivity. + +### POC + +#### Reference +- https://github.com/sipeed/picoclaw/issues/3078 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-15318.md b/2026/CVE-2026-15318.md new file mode 100644 index 0000000000..91ce887ebd --- /dev/null +++ b/2026/CVE-2026-15318.md @@ -0,0 +1,27 @@ +### [CVE-2026-15318](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-15318) +![](https://img.shields.io/static/v1?label=Product&message=PicoClaw&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0.2.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0.2.1%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0.2.2%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0.2.3%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0.2.4%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0.2.5%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0.2.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0.2.7%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0.2.8%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0.2.9%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Improper%20Authorization&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Incorrect%20Authorization&color=brightgreen) + +### Description + +A weakness has been identified in Sipeed PicoClaw up to 0.2.9. Affected by this issue is some unknown functionality of the file pkg/channels/mqtt/mqtt.go of the component MQTT Channel Handler. This manipulation of the argument client_id causes incorrect authorization. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks. The reported GitHub issue was closed automatically due to inactivity. + +### POC + +#### Reference +- https://github.com/sipeed/picoclaw/issues/3068 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-15320.md b/2026/CVE-2026-15320.md new file mode 100644 index 0000000000..dd13b893f9 --- /dev/null +++ b/2026/CVE-2026-15320.md @@ -0,0 +1,27 @@ +### [CVE-2026-15320](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-15320) +![](https://img.shields.io/static/v1?label=Product&message=PicoClaw&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0.2.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0.2.1%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0.2.2%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0.2.3%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0.2.4%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0.2.5%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0.2.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0.2.7%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0.2.8%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0.2.9%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Incorrect%20Authorization&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Missing%20Authorization&color=brightgreen) + +### Description + +A vulnerability was detected in Sipeed PicoClaw up to 0.2.9. This vulnerability affects the function rt.ReloadConfig of the file pkg/channels/pico/pico.go. Performing a manipulation of the argument message.send results in missing authorization. It is possible to initiate the attack remotely. The exploit is now public and may be used. The reported GitHub issue was closed automatically due to inactivity. + +### POC + +#### Reference +- https://github.com/sipeed/picoclaw/issues/3071 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-15332.md b/2026/CVE-2026-15332.md new file mode 100644 index 0000000000..a9a8b9feb0 --- /dev/null +++ b/2026/CVE-2026-15332.md @@ -0,0 +1,19 @@ +### [CVE-2026-15332](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-15332) +![](https://img.shields.io/static/v1?label=Product&message=CowAgent&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=2.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=2.1.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Incorrect%20Authorization&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Missing%20Authorization&color=brightgreen) + +### Description + +A security flaw has been discovered in zhayujie CowAgent up to 2.1.0. The impacted element is an unknown function of the file channel/channel.py of the component Message Endpoint. The manipulation results in missing authorization. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet. + +### POC + +#### Reference +- https://github.com/zhayujie/CowAgent/issues/2874 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-15373.md b/2026/CVE-2026-15373.md index 2b41464a98..bef4bfb09a 100644 --- a/2026/CVE-2026-15373.md +++ b/2026/CVE-2026-15373.md @@ -12,6 +12,7 @@ A vulnerability was detected in Eleveo Call Recording Software 9.7.0. The impact #### Reference - https://drive.google.com/file/d/1QqpeH0qWsSnSiMvPeRJvRSylwLGK3hsN/view?usp=sharing +- https://github.com/omarelshopky/cves/tree/main/eleveo/call-recording-software/CVE-2026-15373 #### Github No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-15374.md b/2026/CVE-2026-15374.md index 3c9b3e34c0..3cebd16cc6 100644 --- a/2026/CVE-2026-15374.md +++ b/2026/CVE-2026-15374.md @@ -12,6 +12,7 @@ A flaw has been found in Eleveo Call Recording Software 9.7.0. This affects an u #### Reference - https://drive.google.com/file/d/1GtIZC_PrOJPfQAfjcBckEbf8uDzGjt9B/view?usp=sharing +- https://github.com/omarelshopky/cves/tree/main/eleveo/call-recording-software/CVE-2026-15374 #### Github No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-15376.md b/2026/CVE-2026-15376.md index 36c2833e2e..16bc53a39a 100644 --- a/2026/CVE-2026-15376.md +++ b/2026/CVE-2026-15376.md @@ -12,6 +12,7 @@ A vulnerability was found in Eleveo Call Recording Software 9.7.0. Affected is a #### Reference - https://drive.google.com/file/d/18l6-Lpvqq1B-ureww1zR5d_nyhZl312q/view?usp=sharing +- https://github.com/omarelshopky/cves/tree/main/eleveo/call-recording-software/CVE-2026-15376 #### Github No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-15392.md b/2026/CVE-2026-15392.md index f863c6e65c..f7d4e86ba6 100644 --- a/2026/CVE-2026-15392.md +++ b/2026/CVE-2026-15392.md @@ -11,6 +11,7 @@ DBD::File versions before 1.651 for Perl do not ensure the table file is not a s ### POC #### Reference +- https://github.com/perl5-dbi/dbi/security/advisories/GHSA-mh3j-xwf4-jrqw - https://metacpan.org/release/HMBRAND/DBI-1.651/changes #### Github diff --git a/2026/CVE-2026-15473.md b/2026/CVE-2026-15473.md index 8e1d79be3d..ffc5697684 100644 --- a/2026/CVE-2026-15473.md +++ b/2026/CVE-2026-15473.md @@ -12,6 +12,7 @@ A vulnerability was identified in Eleveo Call Recording Software 9.7.0. This iss #### Reference - https://drive.google.com/file/d/1YhkazmU_1YQj9lzvwIBDzA-41fe2eayc/view?usp=sharing +- https://github.com/omarelshopky/cves/tree/main/eleveo/call-recording-software/CVE-2026-15473 #### Github No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-15474.md b/2026/CVE-2026-15474.md index ab31ee2521..f4cb600c37 100644 --- a/2026/CVE-2026-15474.md +++ b/2026/CVE-2026-15474.md @@ -12,6 +12,7 @@ A security flaw has been discovered in Eleveo Call Recording Software 9.7.0. Imp #### Reference - https://drive.google.com/file/d/14r-7V9dJHuoBPpuSj-puFzujq149Mbry/view?usp=sharing +- https://github.com/omarelshopky/cves/tree/main/eleveo/call-recording-software/CVE-2026-15474 #### Github No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-15478.md b/2026/CVE-2026-15478.md new file mode 100644 index 0000000000..ab6e302ad6 --- /dev/null +++ b/2026/CVE-2026-15478.md @@ -0,0 +1,19 @@ +### [CVE-2026-15478](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-15478) +![](https://img.shields.io/static/v1?label=Product&message=IceHRM&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=35.0.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=35.0.1%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Injection&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=SQL%20Injection&color=brightgreen) + +### Description + +A flaw has been found in IceHRM up to 35.0.1. This impacts an unknown function of the file core/src/Reports/User/Reports/EmployeeAttendanceReport.php of the component UserReport Endpoint. Executing a manipulation of the argument employeeList can lead to sql injection. The attack can be launched remotely. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet. + +### POC + +#### Reference +- https://github.com/gamonoid/icehrm/issues/376 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-15480.md b/2026/CVE-2026-15480.md new file mode 100644 index 0000000000..fd0ea34df2 --- /dev/null +++ b/2026/CVE-2026-15480.md @@ -0,0 +1,18 @@ +### [CVE-2026-15480](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-15480) +![](https://img.shields.io/static/v1?label=Product&message=TEW-635BRM&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=1.00.03%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Memory%20Corruption&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Stack-based%20Buffer%20Overflow&color=brightgreen) + +### Description + +A vulnerability was identified in Trendnet TEW-635BRM up to 1.00.03. This affects the function start_httpd of the file /sbin/rc of the component Web Service. Such manipulation of the argument device_name leads to stack-based buffer overflow. The attack can be executed remotely. The exploit is publicly available and might be used. The vendor explains: "We are unable to confirm if the vulnerability exists. This item has been EOL since 2011. We will make an official announcement of possible vulnerabilities, and recommend users to switch devices." This vulnerability only affects products that are no longer supported by the maintainer. + +### POC + +#### Reference +- https://github.com/glkfc/IoT-Vulnerability/blob/main/TRENDnet/TRENDnet_TEW635BRM_device_name_BOF_EN.md + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-15481.md b/2026/CVE-2026-15481.md new file mode 100644 index 0000000000..071a293575 --- /dev/null +++ b/2026/CVE-2026-15481.md @@ -0,0 +1,18 @@ +### [CVE-2026-15481](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-15481) +![](https://img.shields.io/static/v1?label=Product&message=TEW-635BRM&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=1.00.03%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Command%20Injection&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Injection&color=brightgreen) + +### Description + +A security flaw has been discovered in Trendnet TEW-635BRM up to 1.00.03. This vulnerability affects the function ipoa_test of the file /sbin/rc of the component IPoA WAN Connection Setup. Performing a manipulation of the argument ipoa_ipaddr results in command injection. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks. The vendor explains: "We are unable to confirm if the vulnerability exists. This item has been EOL since 2011. We will make an official announcement of possible vulnerabilities, and recommend users to switch devices." This vulnerability only affects products that are no longer supported by the maintainer. + +### POC + +#### Reference +- https://github.com/glkfc/IoT-Vulnerability/blob/main/TRENDnet/TRENDnet_TEW635BRM_ipoa_cmdinj_EN.md + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-15495.md b/2026/CVE-2026-15495.md new file mode 100644 index 0000000000..bc04a44999 --- /dev/null +++ b/2026/CVE-2026-15495.md @@ -0,0 +1,20 @@ +### [CVE-2026-15495](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-15495) +![](https://img.shields.io/static/v1?label=Product&message=sonic-agent&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=2.7.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=2.7.1%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=2.7.2%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Command%20Injection&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=OS%20Command%20Injection&color=brightgreen) + +### Description + +A vulnerability has been found in SonicCloudOrg sonic-agent up to 2.7.2. The affected element is an unknown function of the file AndroidWSServer.java of the component Android WebSocket Server. The manipulation of the argument path leads to os command injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. This vulnerability only affects products that are no longer supported by the maintainer. + +### POC + +#### Reference +- https://github.com/xpp3901/CVE_APPLY/tree/main/V-S003_SonicAgent_pullFile_CmdInjection_RCE + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-15496.md b/2026/CVE-2026-15496.md new file mode 100644 index 0000000000..3765ef03da --- /dev/null +++ b/2026/CVE-2026-15496.md @@ -0,0 +1,20 @@ +### [CVE-2026-15496](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-15496) +![](https://img.shields.io/static/v1?label=Product&message=sonic-agent&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=2.7.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=2.7.1%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=2.7.2%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Command%20Injection&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=OS%20Command%20Injection&color=brightgreen) + +### Description + +A vulnerability was found in SonicCloudOrg sonic-agent up to 2.7.2. The impacted element is the function evalIsFailed of the file sonic-agent/src/main/java/org/cloud/sonic/agent/tests/script/GroovyScriptImpl.java of the component Groovy Script Handler. The manipulation results in os command injection. The attack can be launched remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way. This vulnerability only affects products that are no longer supported by the maintainer. + +### POC + +#### Reference +- https://github.com/xpp3901/CVE_APPLY/tree/main/V-S002_SonicCloudPlatform_Groovy_Unsandboxed_RCE + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-15499.md b/2026/CVE-2026-15499.md new file mode 100644 index 0000000000..a130523cbf --- /dev/null +++ b/2026/CVE-2026-15499.md @@ -0,0 +1,20 @@ +### [CVE-2026-15499](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-15499) +![](https://img.shields.io/static/v1?label=Product&message=AstrBot&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=4.25.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4.25.1%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4.25.2%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Improper%20Authorization&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Incorrect%20Privilege%20Assignment&color=brightgreen) + +### Description + +A security flaw has been discovered in AstrBotDevs AstrBot up to 4.25.2. Affected is the function FutureTaskTool.call of the file astrbot/core/tools/cron_tools.py of the component Scheduled Task Handler. Performing a manipulation of the argument payload["note"] results in improper authorization. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way. + +### POC + +#### Reference +- https://gist.github.com/YLChen-007/2bab96d5bedef784f90c97009fff8a19 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-15501.md b/2026/CVE-2026-15501.md new file mode 100644 index 0000000000..db0a978d22 --- /dev/null +++ b/2026/CVE-2026-15501.md @@ -0,0 +1,19 @@ +### [CVE-2026-15501](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-15501) +![](https://img.shields.io/static/v1?label=Product&message=AstrBot&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=4.25.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4.25.1%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4.25.2%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Server-Side%20Request%20Forgery&color=brightgreen) + +### Description + +A security vulnerability has been detected in AstrBotDevs AstrBot up to 4.25.2. Affected by this issue is the function ToolsRoute.test_mcp_connection of the file astrbot/dashboard/routes/tools.py of the component MCP Test Endpoint. The manipulation of the argument mcp_server_config.url leads to server-side request forgery. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way. + +### POC + +#### Reference +- https://gist.github.com/YLChen-007/b68732c140fb11d844b214cf2db50a5a + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-15506.md b/2026/CVE-2026-15506.md new file mode 100644 index 0000000000..4e466ce036 --- /dev/null +++ b/2026/CVE-2026-15506.md @@ -0,0 +1,22 @@ +### [CVE-2026-15506](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-15506) +![](https://img.shields.io/static/v1?label=Product&message=CatchPulse&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=10.9.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=10.9.1%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=10.9.2%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=10.9.3%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Heap-based%20Buffer%20Overflow&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Memory%20Corruption&color=brightgreen) + +### Description + +A security vulnerability has been detected in SecureAge CatchPulse up to 10.9.3. The affected element is an unknown function in the library saappctl.sys of the component Driver. Such manipulation leads to heap-based buffer overflow. An attack has to be approached locally. The exploit has been disclosed publicly and may be used. Upgrading to version 10.10.0 is sufficient to fix this issue. You should upgrade the affected component. The vendor was contacted early about this disclosure. + +### POC + +#### Reference +- https://github.com/Kalagious/SecureAgeExploit + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-15508.md b/2026/CVE-2026-15508.md new file mode 100644 index 0000000000..c2caea99ea --- /dev/null +++ b/2026/CVE-2026-15508.md @@ -0,0 +1,47 @@ +### [CVE-2026-15508](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-15508) +![](https://img.shields.io/static/v1?label=Product&message=ai-gateway&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0.2.0-beta.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0.2.0-beta.1%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0.2.0-beta.10%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0.2.0-beta.11%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0.2.0-beta.12%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0.2.0-beta.13%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0.2.0-beta.14%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0.2.0-beta.15%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0.2.0-beta.16%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0.2.0-beta.17%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0.2.0-beta.18%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0.2.0-beta.19%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0.2.0-beta.2%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0.2.0-beta.20%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0.2.0-beta.21%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0.2.0-beta.22%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0.2.0-beta.23%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0.2.0-beta.24%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0.2.0-beta.25%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0.2.0-beta.26%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0.2.0-beta.27%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0.2.0-beta.28%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0.2.0-beta.29%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0.2.0-beta.3%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0.2.0-beta.30%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0.2.0-beta.4%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0.2.0-beta.5%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0.2.0-beta.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0.2.0-beta.7%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0.2.0-beta.8%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0.2.0-beta.9%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Server-Side%20Request%20Forgery&color=brightgreen) + +### Description + +A flaw has been found in Helicone ai-gateway up to 0.2.0-beta.30. This affects the function build_target_url of the file ai-gateway/src/dispatcher/service.rs of the component AWS Metadata Service. Executing a manipulation of the argument extracted_path_and_query can lead to server-side request forgery. The attack can be executed remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way. + +### POC + +#### Reference +- https://github.com/oscar2744/CVE-Submit/issues/1 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-15515.md b/2026/CVE-2026-15515.md new file mode 100644 index 0000000000..7324938609 --- /dev/null +++ b/2026/CVE-2026-15515.md @@ -0,0 +1,18 @@ +### [CVE-2026-15515](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-15515) +![](https://img.shields.io/static/v1?label=Product&message=PC%20Manager&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=18.1.30242.301%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Uncontrolled%20Search%20Path&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Untrusted%20Search%20Path&color=brightgreen) + +### Description + +A security vulnerability has been detected in Tencent PC Manager 18.1.30242.301. This issue affects some unknown processing in the library qmudisk64.sys of the component QMUDisk Driver. The manipulation leads to uncontrolled search path. The attack must be carried out locally. The attack is considered to have high complexity. The exploitability is assessed as difficult. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way. + +### POC + +#### Reference +- https://github.com/subsubsub1231/qmukiller + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-15517.md b/2026/CVE-2026-15517.md new file mode 100644 index 0000000000..57103a6d9b --- /dev/null +++ b/2026/CVE-2026-15517.md @@ -0,0 +1,18 @@ +### [CVE-2026-15517](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-15517) +![](https://img.shields.io/static/v1?label=Product&message=OA&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=1.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Injection&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=SQL%20Injection&color=brightgreen) + +### Description + +A flaw has been found in Jinher OA 1.0. The affected element is an unknown function of the file /C6/JHSoft.Web.PlanSummarize/PlanGiveOut.aspx. This manipulation of the argument httpOID causes sql injection. Remote exploitation of the attack is possible. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way. + +### POC + +#### Reference +- https://github.com/weini587/CVE/issues/1 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-15522.md b/2026/CVE-2026-15522.md new file mode 100644 index 0000000000..a6651d85bb --- /dev/null +++ b/2026/CVE-2026-15522.md @@ -0,0 +1,18 @@ +### [CVE-2026-15522](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-15522) +![](https://img.shields.io/static/v1?label=Product&message=godot-mcp&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=2.0.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Path%20Traversal&color=brightgreen) + +### Description + +A security flaw has been discovered in tugcantopaloglu godot-mcp 2.0.0. Affected by this vulnerability is the function validatePath of the file build/index.js of the component run_project. The manipulation of the argument projectPath results in path traversal. Attacking locally is a requirement. The exploit has been released to the public and may be used for attacks. Upgrading to version 3.0.0 addresses this issue. The patch is identified as eb63add552aa4bd9205395cf91b40654654a3cf2. It is suggested to upgrade the affected component. + +### POC + +#### Reference +- https://github.com/tugcantopaloglu/godot-mcp/issues/9 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-15524.md b/2026/CVE-2026-15524.md new file mode 100644 index 0000000000..e234f4bd2f --- /dev/null +++ b/2026/CVE-2026-15524.md @@ -0,0 +1,20 @@ +### [CVE-2026-15524](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-15524) +![](https://img.shields.io/static/v1?label=Product&message=memory-bank-mcp&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0.2.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0.2.1%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=3.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=3.1%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Path%20Traversal&color=brightgreen) + +### Description + +A security vulnerability has been detected in alioshr memory-bank-mcp up to 0.2.1/3.1. This affects an unknown part of the file list-project-files-validation-factory.ts. Such manipulation of the argument projectName leads to path traversal. Local access is required to approach this attack. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet. + +### POC + +#### Reference +- https://github.com/alioshr/memory-bank-mcp/issues/36 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-15527.md b/2026/CVE-2026-15527.md new file mode 100644 index 0000000000..3f35cef8d0 --- /dev/null +++ b/2026/CVE-2026-15527.md @@ -0,0 +1,22 @@ +### [CVE-2026-15527](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-15527) +![](https://img.shields.io/static/v1?label=Product&message=better-icons&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=1.0.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=1.0.1%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=1.0.2%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=1.0.3%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=1.0.4%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=1.0.5%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Path%20Traversal&color=brightgreen) + +### Description + +A vulnerability has been found in better-auth better-icons up to 1.0.5. This vulnerability affects unknown code of the component scan_project_icons/sync_icon. Such manipulation of the argument icons_file leads to path traversal. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through an issue report but has not responded yet. + +### POC + +#### Reference +- https://github.com/better-auth/better-icons/issues/18 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-15528.md b/2026/CVE-2026-15528.md new file mode 100644 index 0000000000..75ac2ed3b5 --- /dev/null +++ b/2026/CVE-2026-15528.md @@ -0,0 +1,18 @@ +### [CVE-2026-15528](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-15528) +![](https://img.shields.io/static/v1?label=Product&message=kicad-mcp&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=3.3.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=3.3.1%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Protection%20Mechanism%20Failure&color=brightgreen) + +### Description + +A vulnerability was found in lamaalrajih kicad-mcp up to 3.3.1. This issue affects some unknown processing of the file kicad_mcp/utils/path_validator.py. Performing a manipulation of the argument project_path/schematic_path results in protection mechanism failure. Attacking locally is a requirement. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet. + +### POC + +#### Reference +- https://github.com/lamaalrajih/kicad-mcp/issues/57 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-15530.md b/2026/CVE-2026-15530.md new file mode 100644 index 0000000000..241206656e --- /dev/null +++ b/2026/CVE-2026-15530.md @@ -0,0 +1,19 @@ +### [CVE-2026-15530](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-15530) +![](https://img.shields.io/static/v1?label=Product&message=WuzhiCMS&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=4.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4.1.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Improper%20Access%20Controls&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Information%20Disclosure&color=brightgreen) + +### Description + +A flaw has been found in WuzhiCMS up to 4.1.0. Affected by this vulnerability is the function config/listimage of the file /index.php?m=attachment&f=index&v=upload of the component Attachment API. Executing a manipulation can lead to information disclosure. The attack can be launched remotely. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet. + +### POC + +#### Reference +- https://github.com/wuzhicms/wuzhicms/issues/217 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-15535.md b/2026/CVE-2026-15535.md new file mode 100644 index 0000000000..26227d2672 --- /dev/null +++ b/2026/CVE-2026-15535.md @@ -0,0 +1,18 @@ +### [CVE-2026-15535](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-15535) +![](https://img.shields.io/static/v1?label=Product&message=self-rag&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=1fcdc420e48f50a7d7ab1ece5494221b93252e99%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Deserialization&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Improper%20Input%20Validation&color=brightgreen) + +### Description + +A vulnerability was determined in AkariAsai self-rag up to 1fcdc420e48f50a7d7ab1ece5494221b93252e99. Affected by this issue is the function Indexer.deserialize_from of the file retrieval_lm/src/index.py of the component retrieval_lm. Executing a manipulation of the argument index_meta.faiss can lead to deserialization. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version details for either affected or updated releases. The project was informed of the problem early through an issue report but has not responded yet. + +### POC + +#### Reference +- https://github.com/AkariAsai/self-rag/issues/105 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-15558.md b/2026/CVE-2026-15558.md new file mode 100644 index 0000000000..ccba48894a --- /dev/null +++ b/2026/CVE-2026-15558.md @@ -0,0 +1,18 @@ +### [CVE-2026-15558](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-15558) +![](https://img.shields.io/static/v1?label=Product&message=Simple%20Online%20Leave%20Management%20System&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=1.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Injection&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=SQL%20Injection&color=brightgreen) + +### Description + +A security vulnerability has been detected in CodeAstro Simple Online Leave Management System 1.0. Affected by this issue is some unknown functionality of the file /SimpleOnlineLeave/admin/deletemp.php. Such manipulation of the argument ID leads to sql injection. The attack can be executed remotely. The exploit has been disclosed publicly and may be used. + +### POC + +#### Reference +- https://github.com/sl1der-fr0g/Findings/issues/2 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-15605.md b/2026/CVE-2026-15605.md new file mode 100644 index 0000000000..ce246d102e --- /dev/null +++ b/2026/CVE-2026-15605.md @@ -0,0 +1,18 @@ +### [CVE-2026-15605](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-15605) +![](https://img.shields.io/static/v1?label=Product&message=wandb&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0.25.2.dev1%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Risky%20Cryptographic%20Algorithm&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Use%20of%20Weak%20Hash&color=brightgreen) + +### Description + +A security vulnerability has been detected in wandb 0.25.2.dev1. Affected is the function ArtifactManifestEntry.download in the library wandb/sdk/lib/hashutil.py of the component Artifact Integrity Validation. The manipulation leads to use of weak hash. The attack may be initiated remotely. A high degree of complexity is needed for the attack. The exploitability is told to be difficult. The pull request to fix this issue awaits acceptance. + +### POC + +#### Reference +- https://github.com/wandb/wandb/issues/12030 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-15621.md b/2026/CVE-2026-15621.md new file mode 100644 index 0000000000..e6a3ff2353 --- /dev/null +++ b/2026/CVE-2026-15621.md @@ -0,0 +1,27 @@ +### [CVE-2026-15621](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-15621) +![](https://img.shields.io/static/v1?label=Product&message=clawlet&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0.2.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0.2.1%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0.2.10%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0.2.2%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0.2.3%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0.2.4%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0.2.5%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0.2.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0.2.7%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0.2.8%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0.2.9%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Link%20Following&color=brightgreen) + +### Description + +A vulnerability was detected in mosaxiv clawlet up to 0.2.10. This impacts the function read_file/write_file/edit_file of the file tools/fs_ops.go of the component File Tools. Performing a manipulation results in link following. The attack needs to be approached locally. The reported GitHub issue was closed with the label "not planned". + +### POC + +#### Reference +- https://github.com/mosaxiv/clawlet/issues/15 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-15622.md b/2026/CVE-2026-15622.md new file mode 100644 index 0000000000..c2c91ef0ba --- /dev/null +++ b/2026/CVE-2026-15622.md @@ -0,0 +1,22 @@ +### [CVE-2026-15622](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-15622) +![](https://img.shields.io/static/v1?label=Product&message=poco-claw&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0.5.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0.5.1%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0.5.2%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0.5.3%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0.5.4%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Authorization%20Bypass&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Improper%20Authorization&color=brightgreen) + +### Description + +A flaw has been found in poco-ai poco-claw up to 0.5.4. Affected is the function get_workspace_file of the file executor_manager/app/api/v1/workspace.py of the component Workspace API. Executing a manipulation of the argument user_id can lead to authorization bypass. The attack may be launched remotely. The exploit has been published and may be used. This patch is called 67fcc88505c57f77d3fcf04eb5b89425b10cbf48. Upgrading the affected component is recommended. + +### POC + +#### Reference +- https://github.com/poco-ai/poco-claw/issues/133 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-15624.md b/2026/CVE-2026-15624.md new file mode 100644 index 0000000000..476533b23a --- /dev/null +++ b/2026/CVE-2026-15624.md @@ -0,0 +1,17 @@ +### [CVE-2026-15624](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-15624) +![](https://img.shields.io/static/v1?label=Product&message=GoClaw&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=3.13.3-beta.3%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Server-Side%20Request%20Forgery&color=brightgreen) + +### Description + +A vulnerability has been found in nextlevelbuilder GoClaw 3.13.3-beta.3. Affected by this vulnerability is the function bytePlusDownloadVideo of the file internal/tools/create_video_byteplus.go of the component invoke Endpoint. The manipulation of the argument output.video_url leads to server-side request forgery. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used. + +### POC + +#### Reference +- https://github.com/nextlevelbuilder/goclaw/issues/1199 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-15627.md b/2026/CVE-2026-15627.md new file mode 100644 index 0000000000..a6a9c83217 --- /dev/null +++ b/2026/CVE-2026-15627.md @@ -0,0 +1,22 @@ +### [CVE-2026-15627](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-15627) +![](https://img.shields.io/static/v1?label=Product&message=GoClaw&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=3.13.3-beta.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=3.13.3-beta.1%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=3.13.3-beta.2%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=3.13.3-beta.3%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Improper%20Access%20Controls&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Information%20Disclosure&color=brightgreen) + +### Description + +A vulnerability was identified in nextlevelbuilder GoClaw up to 3.13.3-beta.3. This vulnerability affects the function handleNavigate of the file pkg/browser/tool.go. Such manipulation of the argument args.targetUrl leads to information disclosure. The attack may be performed from remote. The exploit is publicly available and might be used. + +### POC + +#### Reference +- https://github.com/nextlevelbuilder/goclaw/issues/1207 +- https://github.com/nextlevelbuilder/goclaw/issues/1207#issuecomment-4760370546 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-15669.md b/2026/CVE-2026-15669.md new file mode 100644 index 0000000000..5e94b96135 --- /dev/null +++ b/2026/CVE-2026-15669.md @@ -0,0 +1,20 @@ +### [CVE-2026-15669](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-15669) +![](https://img.shields.io/static/v1?label=Product&message=picobot&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0.1%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0.2.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Command%20Injection&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=OS%20Command%20Injection&color=brightgreen) + +### Description + +A vulnerability was found in louisho5 picobot up to 0.2.0. This issue affects the function ExecTool.Execute of the file internal/agent/tools/exec.go of the component exec Tool. The manipulation results in os command injection. The attack requires a local approach. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet. + +### POC + +#### Reference +- https://github.com/louisho5/picobot/issues/42 +- https://github.com/louisho5/picobot/issues/43 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-15686.md b/2026/CVE-2026-15686.md new file mode 100644 index 0000000000..cb18951b1e --- /dev/null +++ b/2026/CVE-2026-15686.md @@ -0,0 +1,17 @@ +### [CVE-2026-15686](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-15686) +![](https://img.shields.io/static/v1?label=Product&message=Adminer&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=5.4.2%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-253%3A%20Incorrect%20Check%20of%20Function%20Return%20Value&color=brightgreen) + +### Description + +Adminer multi_query Incorrect Check of Function Return Value Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Adminer. Authentication is required to exploit this vulnerability.The specific flaw exists within the multi_query method. The issue results from an incorrect check of a function return value. An attacker can leverage this vulnerability to execute code in the context of the web server. Was ZDI-CAN-28201. + +### POC + +#### Reference +- https://github.com/vrana/adminer/security/advisories/GHSA-3582-q6xq-5vf7#event-826206 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-15691.md b/2026/CVE-2026-15691.md new file mode 100644 index 0000000000..14867bf73a --- /dev/null +++ b/2026/CVE-2026-15691.md @@ -0,0 +1,18 @@ +### [CVE-2026-15691](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-15691) +![](https://img.shields.io/static/v1?label=Product&message=BE12%20Pro&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=16.03.66.23%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Memory%20Corruption&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Stack-based%20Buffer%20Overflow&color=brightgreen) + +### Description + +A security flaw has been discovered in Tenda BE12 Pro 16.03.66.23. This affects the function fromSafeClientFilter of the file /goform/SafeClientFilter. Performing a manipulation of the argument page results in stack-based buffer overflow. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks. + +### POC + +#### Reference +- https://github.com/cve-a/dexingzhiqing/issues/1 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-15694.md b/2026/CVE-2026-15694.md new file mode 100644 index 0000000000..d48d8260fd --- /dev/null +++ b/2026/CVE-2026-15694.md @@ -0,0 +1,18 @@ +### [CVE-2026-15694](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-15694) +![](https://img.shields.io/static/v1?label=Product&message=BE12%20Pro&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=16.03.66.23%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Memory%20Corruption&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Stack-based%20Buffer%20Overflow&color=brightgreen) + +### Description + +A vulnerability was detected in Tenda BE12 Pro 16.03.66.23. Impacted is the function fromSetIpBind of the file /goform/SetIpBind. The manipulation of the argument page results in stack-based buffer overflow. It is possible to launch the attack remotely. The exploit is now public and may be used. + +### POC + +#### Reference +- https://github.com/cve-a/dexingzhiqing/issues/4 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-15696.md b/2026/CVE-2026-15696.md new file mode 100644 index 0000000000..c7fe25efe3 --- /dev/null +++ b/2026/CVE-2026-15696.md @@ -0,0 +1,18 @@ +### [CVE-2026-15696](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-15696) +![](https://img.shields.io/static/v1?label=Product&message=BE12%20Pro&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=16.03.66.23%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Memory%20Corruption&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Stack-based%20Buffer%20Overflow&color=brightgreen) + +### Description + +A vulnerability has been found in Tenda BE12 Pro 16.03.66.23. The impacted element is the function fromVirtualSer of the file /goform/VirtualSer. Such manipulation of the argument page leads to stack-based buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. + +### POC + +#### Reference +- https://github.com/cve-a/dexingzhiqing/issues/6 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-15701.md b/2026/CVE-2026-15701.md new file mode 100644 index 0000000000..d1e5b73f13 --- /dev/null +++ b/2026/CVE-2026-15701.md @@ -0,0 +1,18 @@ +### [CVE-2026-15701](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-15701) +![](https://img.shields.io/static/v1?label=Product&message=NR1800X&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=9.1.0u.6279_B20210910%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Memory%20Corruption&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Stack-based%20Buffer%20Overflow&color=brightgreen) + +### Description + +A weakness has been identified in Totolink NR1800X 9.1.0u.6279_B20210910. Affected by this issue is the function Form_Logout of the file /formLogout.htm of the component lighttpd. This manipulation of the argument Host causes stack-based buffer overflow. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks. + +### POC + +#### Reference +- https://github.com/fu9-dotom/cve/issues/1 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-15732.md b/2026/CVE-2026-15732.md new file mode 100644 index 0000000000..96e711cb2d --- /dev/null +++ b/2026/CVE-2026-15732.md @@ -0,0 +1,17 @@ +### [CVE-2026-15732](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-15732) +![](https://img.shields.io/static/v1?label=Product&message=WGDashboard&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-918%20Server-Side%20Request%20Forgery%20(SSRF)&color=brightgreen) + +### Description + +A Server-Side Request Forgery (SSFR) vulnerability exist in WGDashboard version 4.2.3 and earlier. The webhook functionality allows authenticated attackers to make arbitrary HTTP requests and retrieve responses. + +### POC + +#### Reference +- https://github.com/Stuub/WGDashboard-v4.3.2-Full-Read-SSRF-via-Webhooks-PoC + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-15749.md b/2026/CVE-2026-15749.md new file mode 100644 index 0000000000..57af739fcf --- /dev/null +++ b/2026/CVE-2026-15749.md @@ -0,0 +1,18 @@ +### [CVE-2026-15749](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-15749) +![](https://img.shields.io/static/v1?label=Product&message=mastergo-magic-mcp&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0.1%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0.2.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Path%20Traversal&color=brightgreen) + +### Description + +A security flaw has been discovered in mastergo-design mastergo-magic-mcp up to 0.2.0. This issue affects the function execute of the file src/tools/get-c2d.ts of the component mcp__C2d. Performing a manipulation of the argument filePath results in path traversal. The attack requires a local approach. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet. + +### POC + +#### Reference +- https://github.com/mastergo-design/mastergo-magic-mcp/issues/88 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-16206.md b/2026/CVE-2026-16206.md new file mode 100644 index 0000000000..76aedefc8f --- /dev/null +++ b/2026/CVE-2026-16206.md @@ -0,0 +1,18 @@ +### [CVE-2026-16206](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-16206) +![](https://img.shields.io/static/v1?label=Product&message=django-oauth-toolkit&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=3.3.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Session%20Expiration&color=brightgreen) + +### Description + +A security vulnerability has been detected in django-oauth django-oauth-toolkit 3.3.0. This issue affects the function _load_id_token of the file oauth2_provider/oauth2_validators.py. The manipulation leads to session expiration. The attack can be initiated remotely. The project was informed of the problem early through an issue report but has not responded yet. + +### POC + +#### Reference +- https://vuldb.com/vuln/380022 +- https://vuldb.com/vuln/380022/cti + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-19722.md b/2026/CVE-2026-19722.md new file mode 100644 index 0000000000..08953ecdb1 --- /dev/null +++ b/2026/CVE-2026-19722.md @@ -0,0 +1,17 @@ +### [CVE-2026-19722](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-19722) +![](https://img.shields.io/static/v1?label=Product&message=WPvivid%20%E2%80%94%20Backup%2C%20Migration%20%26%20Staging&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-22%20Improper%20Limitation%20of%20a%20Pathname%20to%20a%20Restricted%20Directory%20('Path%20Traversal')&color=brightgreen) + +### Description + +The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.133 does not validate the destination of files extracted from a backup package during restoration, allowing high privilege users such as administrators to write arbitrary files outside the intended restore directory, which can lead to code execution. + +### POC + +#### Reference +- https://wpscan.com/vulnerability/a61974fc-d9d6-4aee-a624-fc0a6e7b940b/ + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-2860.md b/2026/CVE-2026-2860.md new file mode 100644 index 0000000000..4c77ad1cd5 --- /dev/null +++ b/2026/CVE-2026-2860.md @@ -0,0 +1,19 @@ +### [CVE-2026-2860](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2860) +![](https://img.shields.io/static/v1?label=Product&message=production_ssm&color=blue) +![](https://img.shields.io/static/v1?label=Product&message=ssm-erp&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=4288d53bd35757b27f2d070057aefb2c07bdd097%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Improper%20Authorization&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Incorrect%20Privilege%20Assignment&color=brightgreen) + +### Description + +A security vulnerability has been detected in feng_ha_ha/megagao ssm-erp and production_ssm up to 4288d53bd35757b27f2d070057aefb2c07bdd097. Impacted is an unknown function of the file EmployeeController.java. The manipulation leads to improper authorization. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. This product is distributed under two entirely different names. The project was informed of the problem early through an issue report but has not responded yet. + +### POC + +#### Reference +- https://vuldb.com/?ctiid.347100 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-48169.md b/2026/CVE-2026-48169.md index c4697b1d34..2c9e6a779f 100644 --- a/2026/CVE-2026-48169.md +++ b/2026/CVE-2026-48169.md @@ -12,6 +12,7 @@ PraisonAI is a multi-agent teams system. Versions prior to 0.1.4 of the PraisonA #### Reference - https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-gv23-xrm3-8c62 +- https://github.com/pypa/advisory-database/tree/main/vulns/praisonai-platform/PYSEC-2026-2935.yaml #### Github No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-4845.md b/2026/CVE-2026-4845.md index c94d17f513..3603571a59 100644 --- a/2026/CVE-2026-4845.md +++ b/2026/CVE-2026-4845.md @@ -12,6 +12,7 @@ A flaw has been found in dameng100 muucmf 1.9.5.20260309. Impacted is an unknown #### Reference - https://thinhneee.github.io/posts/muucmf-xss/ +- https://vuldb.com/?submit.776174 #### Github No PoCs found on GitHub currently. diff --git a/2026/CVE-2026-5350.md b/2026/CVE-2026-5350.md new file mode 100644 index 0000000000..11d7c7d50e --- /dev/null +++ b/2026/CVE-2026-5350.md @@ -0,0 +1,18 @@ +### [CVE-2026-5350](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-5350) +![](https://img.shields.io/static/v1?label=Product&message=TEW-657BRM&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=1.00.1%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Memory%20Corruption&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Stack-based%20Buffer%20Overflow&color=brightgreen) + +### Description + +A security flaw has been discovered in Trendnet TEW-657BRM 1.00.1. The impacted element is the function update_pcdb of the file /setup.cgi. The manipulation of the argument mac_pc_dba results in stack-based buffer overflow. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks. The vendor confirms, that "[t]he product in question (...) has been discontinued and end of life since June 23, 2011, that is more than 14 years ago. We no longer provide support for this product, so we are not able to confirm the vulnerabilities. We will make an announcement on our website's product support page and notify customers who registered their products with us." This vulnerability only affects products that are no longer supported by the maintainer. + +### POC + +#### Reference +- https://github.com/panda666-888/vuls/blob/main/trendnet/tew-657brm/update_pcdb.md + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-76583.md b/2026/CVE-2026-76583.md new file mode 100644 index 0000000000..2bc44a529c --- /dev/null +++ b/2026/CVE-2026-76583.md @@ -0,0 +1,19 @@ +### [CVE-2026-76583](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-76583) +![](https://img.shields.io/static/v1?label=Product&message=TV-IP751WIC&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=11.03.03%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Command%20Injection&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Injection&color=brightgreen) + +### Description + +A vulnerability was identified in TRENDnet TV-IP751WIC 11.03.03. Affected by this vulnerability is an unknown functionality of the file /cgi-bin/admin/set_time.cgi of the component alphapd. The manipulation leads to command injection. The attack can be initiated remotely. The exploit is publicly available and might be used. + +### POC + +#### Reference +- https://vuldb.com/vuln/393042 +- https://vuldb.com/vuln/393042/cti + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-76585.md b/2026/CVE-2026-76585.md new file mode 100644 index 0000000000..6efd5df3b5 --- /dev/null +++ b/2026/CVE-2026-76585.md @@ -0,0 +1,17 @@ +### [CVE-2026-76585](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-76585) +![](https://img.shields.io/static/v1?label=Product&message=Customer%20Reviews%20for%20WooCommerce&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-79%20Cross-Site%20Scripting%20(XSS)&color=brightgreen) + +### Description + +The Customer Reviews for WooCommerce WordPress plugin before 5.118.0 does not sanitise and escape the content of customer reviews received via one of its endpoints, which could allow unauthenticated users to perform Stored Cross-Site Scripting attacks. + +### POC + +#### Reference +- https://wpscan.com/vulnerability/7d539fba-d47e-461d-b40f-1aa8f535d506/ + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-78049.md b/2026/CVE-2026-78049.md index 0f2240206b..72a12436db 100644 --- a/2026/CVE-2026-78049.md +++ b/2026/CVE-2026-78049.md @@ -14,6 +14,7 @@ A vulnerability has been found in Systerel S2OPC up to 1.7.3. Impacted is the fu ### POC #### Reference +- https://github.com/user-attachments/files/29702766/PoC.zip - https://gitlab.com/systerel/S2OPC/-/work_items/1787 #### Github diff --git a/2026/CVE-2026-78050.md b/2026/CVE-2026-78050.md new file mode 100644 index 0000000000..05f907d5cc --- /dev/null +++ b/2026/CVE-2026-78050.md @@ -0,0 +1,18 @@ +### [CVE-2026-78050](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78050) +![](https://img.shields.io/static/v1?label=Product&message=CF-N1-S&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=2.6.0.1%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Memory%20Corruption&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Stack-based%20Buffer%20Overflow&color=brightgreen) + +### Description + +A vulnerability was found in Comfast CF-N1-S 2.6.0.1. The affected element is the function sub_41AD7C of the file /cgi-bin/mbox-config?method=SET§ion=ntp_timezone of the component Web Management. The manipulation of the argument timestr/ntp_client_enabled results in stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been made public and could be used. + +### POC + +#### Reference +- https://github.com/AdminSafe/CVE/issues/9 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-78051.md b/2026/CVE-2026-78051.md new file mode 100644 index 0000000000..b2290588ea --- /dev/null +++ b/2026/CVE-2026-78051.md @@ -0,0 +1,29 @@ +### [CVE-2026-78051](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78051) +![](https://img.shields.io/static/v1?label=Product&message=MeTube&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=2026.06.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=2026.06.1%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=2026.06.10%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=2026.06.2%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=2026.06.3%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=2026.06.4%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=2026.06.5%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=2026.06.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=2026.06.7%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=2026.06.8%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=2026.06.9%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Direct%20Request&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Files%20or%20Directories%20Accessible&color=brightgreen) + +### Description + +A vulnerability was determined in alexta69 MeTube up to 2026.06.10. The impacted element is an unknown function of the file /download/.metube/cookies.txt of the component Cookie File Handler. This manipulation causes files or directories accessible. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. Upgrading to version 2026.06.20 is sufficient to resolve this issue. Patch name: ce897ee00903bf7ded406f0d7852d95dd4164add. You should upgrade the affected component. + +### POC + +#### Reference +- https://github.com/alexta69/metube/security/advisories/GHSA-hj5g-p3v4-3cw5 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-78062.md b/2026/CVE-2026-78062.md new file mode 100644 index 0000000000..a134c57a0e --- /dev/null +++ b/2026/CVE-2026-78062.md @@ -0,0 +1,20 @@ +### [CVE-2026-78062](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78062) +![](https://img.shields.io/static/v1?label=Product&message=TaxHacker&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0.8.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0.8.1%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0.8.2%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Hard-coded%20Credentials&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Use%20of%20Hard-coded%20Password&color=brightgreen) + +### Description + +A vulnerability was identified in vas3k TaxHacker up to 0.8.2. The affected element is the function envSchema.parse of the file lib/config.ts of the component JWT Secret Handler. The manipulation of the argument BETTER_AUTH_SECRET leads to hard-coded credentials. The attack can be initiated remotely. The project was informed of the problem early through an issue report but has not responded yet. + +### POC + +#### Reference +- https://github.com/vas3k/TaxHacker/issues/147 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-78112.md b/2026/CVE-2026-78112.md new file mode 100644 index 0000000000..9c5891ed2a --- /dev/null +++ b/2026/CVE-2026-78112.md @@ -0,0 +1,18 @@ +### [CVE-2026-78112](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78112) +![](https://img.shields.io/static/v1?label=Product&message=Hospital%20Management%20System%20Project%20in%20PHP&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=1.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Injection&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=SQL%20Injection&color=brightgreen) + +### Description + +A flaw has been found in itsourcecode Hospital Management System Project in PHP 1.0. This impacts an unknown function of the file /viewservicetype.php. This manipulation of the argument delid causes sql injection. The attack may be initiated remotely. The exploit has been published and may be used. + +### POC + +#### Reference +- https://github.com/ltranquility/vuln_submit/issues/25 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-78122.md b/2026/CVE-2026-78122.md new file mode 100644 index 0000000000..67427c66de --- /dev/null +++ b/2026/CVE-2026-78122.md @@ -0,0 +1,18 @@ +### [CVE-2026-78122](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78122) +![](https://img.shields.io/static/v1?label=Product&message=docker-socket-proxy&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Insufficient%20Granularity%20of%20Access%20Control&color=brightgreen) + +### Description + +docker-socket-proxy fails to properly gate read endpoints in the /containers Docker API namespace when the CONTAINERS environment variable is set. Attackers can use GET requests to /containers/{id}/archive, /containers/{id}/export, /containers/{id}/logs, and /containers/{id}/top to read arbitrary files and download entire container filesystems as tar archives. + +### POC + +#### Reference +- https://gist.github.com/nedlir/e4f52f88a757f02c67db1fd5dd70d732 +- https://github.com/Tecnativa/docker-socket-proxy/issues/182 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-78136.md b/2026/CVE-2026-78136.md new file mode 100644 index 0000000000..63518b31b8 --- /dev/null +++ b/2026/CVE-2026-78136.md @@ -0,0 +1,17 @@ +### [CVE-2026-78136](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78136) +![](https://img.shields.io/static/v1?label=Product&message=CHIRP&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-95%20Improper%20Neutralization%20of%20Directives%20in%20Dynamically%20Evaluated%20Code%20('Eval%20Injection')&color=brightgreen) + +### Description + +chirpmyradio CHIRP before 39178db allows eval injection via crafted CSV data. This occurs in _clean_tmode in drivers/kenwood_itm.py. + +### POC + +#### Reference +- https://github.com/cduram/CHIRP-CodeExecution_via_Malicious_ImageFile + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-78142.md b/2026/CVE-2026-78142.md new file mode 100644 index 0000000000..df32ba54e6 --- /dev/null +++ b/2026/CVE-2026-78142.md @@ -0,0 +1,18 @@ +### [CVE-2026-78142](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78142) +![](https://img.shields.io/static/v1?label=Product&message=Barangay%20Resident%20Profiling%20Management%20System&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=1.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Authorization%20Bypass&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Improper%20Authorization&color=brightgreen) + +### Description + +A vulnerability was found in code-projects Barangay Resident Profiling Management System 1.0. This impacts an unknown function of the file /archived_records.php of the component Restore/Delete. The manipulation of the argument resident_id results in authorization bypass. The attack may be launched remotely. The exploit has been made public and could be used. + +### POC + +#### Reference +- https://gist.github.com/c4ttr4ck/190b532b4b239fdc8f6fb72d89bde2c8 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-78143.md b/2026/CVE-2026-78143.md new file mode 100644 index 0000000000..50f2ccbe05 --- /dev/null +++ b/2026/CVE-2026-78143.md @@ -0,0 +1,18 @@ +### [CVE-2026-78143](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78143) +![](https://img.shields.io/static/v1?label=Product&message=Barangay%20Resident%20Profiling%20Management%20System&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=1.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Injection&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=SQL%20Injection&color=brightgreen) + +### Description + +A vulnerability was determined in code-projects Barangay Resident Profiling Management System 1.0. Affected is an unknown function of the file residents.php of the component Resident Search Functionality. This manipulation of the argument Search causes sql injection. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized. + +### POC + +#### Reference +- https://gist.github.com/c4ttr4ck/504e89cacf12c7d6a87490f3859dfded + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-78144.md b/2026/CVE-2026-78144.md new file mode 100644 index 0000000000..20a08dfa1a --- /dev/null +++ b/2026/CVE-2026-78144.md @@ -0,0 +1,18 @@ +### [CVE-2026-78144](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78144) +![](https://img.shields.io/static/v1?label=Product&message=Barangay%20Resident%20Profiling%20Management%20System&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=1.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Authorization%20Bypass&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Improper%20Authorization&color=brightgreen) + +### Description + +A vulnerability was identified in code-projects Barangay Resident Profiling Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /boarders.php of the component Boarder Management Module. Such manipulation of the argument ID leads to authorization bypass. The attack can be executed remotely. The exploit is publicly available and might be used. + +### POC + +#### Reference +- https://gist.github.com/c4ttr4ck/3601aa0ba9e567705823b6d425e84237 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-78147.md b/2026/CVE-2026-78147.md new file mode 100644 index 0000000000..41cb5dc7e0 --- /dev/null +++ b/2026/CVE-2026-78147.md @@ -0,0 +1,18 @@ +### [CVE-2026-78147](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78147) +![](https://img.shields.io/static/v1?label=Product&message=llama.cpp&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=bec4772f6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Deserialization&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Improper%20Input%20Validation&color=brightgreen) + +### Description + +A vulnerability was found in ggml-org llama.cpp bec4772f6. The impacted element is the function deserialize_tensor of the file ggml/src/ggml-rpc/ggml-rpc.cpp of the component ggml-RPC Server. Performing a manipulation of the argument op/op_params results in deserialization. The attack may be initiated remotely. This vulnerability is distinct from CVE-2026-34159 (GHSA-j8rj-fmpv-wcxw, PR #20908), which only added a buffer==nullptr rejection in create_node() and does not validate op or op_params. The reported GitHub issue was closed automatically due to inactivity. + +### POC + +#### Reference +- https://github.com/ggml-org/llama.cpp/issues/25289 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-78158.md b/2026/CVE-2026-78158.md new file mode 100644 index 0000000000..cb83f170a2 --- /dev/null +++ b/2026/CVE-2026-78158.md @@ -0,0 +1,18 @@ +### [CVE-2026-78158](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78158) +![](https://img.shields.io/static/v1?label=Product&message=Open5GS&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=2.8.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Improper%20Authorization&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Incorrect%20Privilege%20Assignment&color=brightgreen) + +### Description + +A flaw has been found in Open5GS 2.8.0. This vulnerability affects unknown code of the component AMF UEContextReleaseRequest Path Handler. Executing a manipulation can lead to improper authorization. It is possible to launch the attack remotely. + +### POC + +#### Reference +- https://github.com/open5gs/open5gs/security/advisories/GHSA-mg8r-2cvv-xq9j + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-78161.md b/2026/CVE-2026-78161.md new file mode 100644 index 0000000000..59e4855fc2 --- /dev/null +++ b/2026/CVE-2026-78161.md @@ -0,0 +1,19 @@ +### [CVE-2026-78161](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78161) +![](https://img.shields.io/static/v1?label=Product&message=libwebsockets&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=4.5.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Memory%20Corruption&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Out-of-bounds%20Write&color=brightgreen) + +### Description + +A vulnerability was found in warmcat libwebsockets 4.5.0. Impacted is the function report_raw_cbor of the file lib/misc/lecp.c of the component LECP CBOR Recording. The manipulation results in out-of-bounds write. The attack can be launched remotely. The exploit has been made public and could be used. The patch is identified as 1d44554a1bb262db63ff4e240152a9deecd99054. It is best practice to apply a patch to resolve this issue. + +### POC + +#### Reference +- https://github.com/biniamf/pocs/blob/main/libwebsockets-lecp-lecp_parse-cbor_pos_oob_write/poc_lecp_cbor_pos_oob.c +- https://github.com/biniamf/pocs/tree/main/libwebsockets-lecp-lecp_parse-cbor_pos_oob_write + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-78166.md b/2026/CVE-2026-78166.md new file mode 100644 index 0000000000..13dab69806 --- /dev/null +++ b/2026/CVE-2026-78166.md @@ -0,0 +1,20 @@ +### [CVE-2026-78166](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78166) +![](https://img.shields.io/static/v1?label=Product&message=kafka-ui&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0.7.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0.7.1%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0.7.2%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Code%20Injection&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Injection&color=brightgreen) + +### Description + +A security flaw has been discovered in provectus kafka-ui up to 0.7.2. The affected element is the function executeSmartFilterTest of the file kafka-ui-api/src/main/java/com/provectus/kafka/ui/controller/MessagesController.java of the component Groovy Code Handler. The manipulation results in code injection. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet. + +### POC + +#### Reference +- https://github.com/provectus/kafka-ui/issues/4567 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-78167.md b/2026/CVE-2026-78167.md new file mode 100644 index 0000000000..db1a152b88 --- /dev/null +++ b/2026/CVE-2026-78167.md @@ -0,0 +1,18 @@ +### [CVE-2026-78167](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78167) +![](https://img.shields.io/static/v1?label=Product&message=ipTIME%20T16000M&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=14.20.2%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Improper%20Authentication&color=brightgreen) + +### Description + +A weakness has been identified in EFM ipTIME T16000M 14.20.2. The impacted element is the function httpcon_check_session_url of the component Session Validation Handler. This manipulation causes improper authentication. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way. + +### POC + +#### Reference +- https://github.com/AdminSafe/CVE/issues/2 +- https://github.com/AdminSafe/CVE/issues/3 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-78168.md b/2026/CVE-2026-78168.md new file mode 100644 index 0000000000..7c71f99fdf --- /dev/null +++ b/2026/CVE-2026-78168.md @@ -0,0 +1,37 @@ +### [CVE-2026-78168](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78168) +![](https://img.shields.io/static/v1?label=Product&message=ipTIME%20T24000M&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=14.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=14.1%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=14.10%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=14.11%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=14.12%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=14.13%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=14.14%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=14.15%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=14.16%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=14.17%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=14.18%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=14.19%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=14.2%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=14.20.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=14.3%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=14.4%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=14.5%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=14.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=14.7%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=14.8%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=14.9%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Improper%20Authentication&color=brightgreen) + +### Description + +A security vulnerability has been detected in EFM ipTIME T24000M up to 14.20.0. This affects the function httpcon_check_session_url of the component Session Validation Handler. Such manipulation leads to improper authentication. The attack can be executed remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way. + +### POC + +#### Reference +- https://github.com/AdminSafe/CVE/issues/10 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-78169.md b/2026/CVE-2026-78169.md new file mode 100644 index 0000000000..61b6ff8d46 --- /dev/null +++ b/2026/CVE-2026-78169.md @@ -0,0 +1,18 @@ +### [CVE-2026-78169](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78169) +![](https://img.shields.io/static/v1?label=Product&message=HiPER%201250GW&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=3.2.7-210907-180535%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Memory%20Corruption&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Stack-based%20Buffer%20Overflow&color=brightgreen) + +### Description + +A vulnerability was detected in UTT HiPER 1250GW up to 3.2.7-210907-180535. This impacts the function strcpy of the file /goform/aspRemoteApConfTempSend of the component HTTP Request Handler. Performing a manipulation of the argument Profile results in stack-based buffer overflow. The attack is possible to be carried out remotely. The exploit is now public and may be used. + +### POC + +#### Reference +- https://github.com/7wkajk/CVE-VUL/blob/main/107.md + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-78170.md b/2026/CVE-2026-78170.md new file mode 100644 index 0000000000..368f7843ed --- /dev/null +++ b/2026/CVE-2026-78170.md @@ -0,0 +1,18 @@ +### [CVE-2026-78170](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78170) +![](https://img.shields.io/static/v1?label=Product&message=HiPER%201200GW&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=2.5.3-170306%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Buffer%20Overflow&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Memory%20Corruption&color=brightgreen) + +### Description + +A flaw has been found in UTT HiPER 1200GW up to 2.5.3-170306. Affected is the function strcpy of the file /goform/formConfigFastDirectionW. Executing a manipulation of the argument ssid can lead to buffer overflow. The attack may be performed from remote. The exploit has been published and may be used. + +### POC + +#### Reference +- https://github.com/7wkajk/CVE-VUL/blob/main/108.md + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-78171.md b/2026/CVE-2026-78171.md new file mode 100644 index 0000000000..979c282dc0 --- /dev/null +++ b/2026/CVE-2026-78171.md @@ -0,0 +1,18 @@ +### [CVE-2026-78171](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78171) +![](https://img.shields.io/static/v1?label=Product&message=Sales%20and%20Inventory%20System&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=1.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Injection&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=SQL%20Injection&color=brightgreen) + +### Description + +A vulnerability has been found in itsourcecode Sales and Inventory System 1.0. Affected by this vulnerability is an unknown functionality of the file /pages/processlogin.php. The manipulation of the argument User leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. + +### POC + +#### Reference +- https://github.com/MounT1veR/new/issues/1 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-78177.md b/2026/CVE-2026-78177.md new file mode 100644 index 0000000000..88b29f9afd --- /dev/null +++ b/2026/CVE-2026-78177.md @@ -0,0 +1,18 @@ +### [CVE-2026-78177](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78177) +![](https://img.shields.io/static/v1?label=Product&message=devtools-vite&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0.7.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Command%20Injection&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=OS%20Command%20Injection&color=brightgreen) + +### Description + +A vulnerability was found in TanStack devtools-vite 0.7.0. Affected by this issue is the function installPackage of the file packages/devtools-bundler-core/src/package-manager.ts of the component Development Devtools Event Bus. The manipulation of the argument packageName results in os command injection. Attacking locally is a requirement. A high complexity level is associated with this attack. The exploitation is known to be difficult. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet. + +### POC + +#### Reference +- https://github.com/TanStack/devtools/issues/464 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-78185.md b/2026/CVE-2026-78185.md new file mode 100644 index 0000000000..74742333c9 --- /dev/null +++ b/2026/CVE-2026-78185.md @@ -0,0 +1,18 @@ +### [CVE-2026-78185](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78185) +![](https://img.shields.io/static/v1?label=Product&message=Sales%20and%20Inventory%20System&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=1.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Injection&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=SQL%20Injection&color=brightgreen) + +### Description + +A vulnerability was detected in itsourcecode Sales and Inventory System 1.0. The impacted element is an unknown function of the file /pages/cust_edit.php. The manipulation of the argument ID results in sql injection. The attack can be executed remotely. The exploit is now public and may be used. + +### POC + +#### Reference +- https://github.com/ltranquility/vuln_submit/issues/27 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-78187.md b/2026/CVE-2026-78187.md new file mode 100644 index 0000000000..a05adb2dfb --- /dev/null +++ b/2026/CVE-2026-78187.md @@ -0,0 +1,19 @@ +### [CVE-2026-78187](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78187) +![](https://img.shields.io/static/v1?label=Product&message=Piwigo&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=16.3.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Code%20Injection&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Cross%20Site%20Scripting&color=brightgreen) + +### Description + +A vulnerability has been found in Piwigo 16.3.0. This impacts an unknown function of the component Public Authentication Page. Such manipulation of the argument lang leads to cross site scripting. The attack may be performed from remote. A high complexity level is associated with this attack. The exploitability is said to be difficult. The exploit has been disclosed to the public and may be used. Upgrading to version 16.4.0 will fix this issue. The name of the patch is 5277a7dee4b8f1a174f1d69e1e2a4e1c82a3fc9e. It is recommended to upgrade the affected component. + +### POC + +#### Reference +- https://github.com/Piwigo/Piwigo/security/advisories/GHSA-rr39-mf4j-6594 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-78196.md b/2026/CVE-2026-78196.md new file mode 100644 index 0000000000..c7680f8ff9 --- /dev/null +++ b/2026/CVE-2026-78196.md @@ -0,0 +1,21 @@ +### [CVE-2026-78196](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78196) +![](https://img.shields.io/static/v1?label=Product&message=expo-share-intent&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=8.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Path%20Traversal&color=brightgreen) + +### Description + +A security flaw has been discovered in achorein expo-share-intent up to 8.0.0. This affects the function getDataColumn of the file ExpoShareIntentModule.kt of the component Android File Copy Routine. The manipulation of the argument _display_name results in path traversal. The attack requires a local approach. Upgrading to version 8.0.1 is able to mitigate this issue. The patch is identified as c6900b1ed06fcc3ca4b09651348974ac5b95e4e6. The affected component should be upgraded. + +### POC + +#### Reference +- https://github.com/achorein/expo-share-intent/ +- https://github.com/achorein/expo-share-intent/commit/c6900b1ed06fcc3ca4b09651348974ac5b95e4e6 +- https://github.com/achorein/expo-share-intent/pull/221 +- https://github.com/achorein/expo-share-intent/releases/tag/v8.0.1 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-78197.md b/2026/CVE-2026-78197.md new file mode 100644 index 0000000000..c4dc67c1d5 --- /dev/null +++ b/2026/CVE-2026-78197.md @@ -0,0 +1,18 @@ +### [CVE-2026-78197](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78197) +![](https://img.shields.io/static/v1?label=Product&message=Simple%20Online%20Food%20Ordering%20System&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=1.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Injection&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=SQL%20Injection&color=brightgreen) + +### Description + +A weakness has been identified in SourceCodester Simple Online Food Ordering System 1.0. This vulnerability affects unknown code of the file /fos/admin/ajax.php?action=save_user. This manipulation of the argument Username causes sql injection. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks. + +### POC + +#### Reference +- https://github.com/wsx138/cve/issues/3 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-78198.md b/2026/CVE-2026-78198.md new file mode 100644 index 0000000000..c59f0e2cb2 --- /dev/null +++ b/2026/CVE-2026-78198.md @@ -0,0 +1,18 @@ +### [CVE-2026-78198](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78198) +![](https://img.shields.io/static/v1?label=Product&message=Simple%20Online%20Food%20Ordering%20System&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=1.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Injection&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=SQL%20Injection&color=brightgreen) + +### Description + +A security vulnerability has been detected in SourceCodester Simple Online Food Ordering System 1.0. This issue affects some unknown processing of the file /fos/admin/ajax.php?action=add_to_cart. Such manipulation of the argument pid leads to sql injection. The attack may be launched remotely. The exploit has been disclosed publicly and may be used. + +### POC + +#### Reference +- https://github.com/wsx138/cve/issues/4 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-78199.md b/2026/CVE-2026-78199.md new file mode 100644 index 0000000000..cd2737f020 --- /dev/null +++ b/2026/CVE-2026-78199.md @@ -0,0 +1,18 @@ +### [CVE-2026-78199](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78199) +![](https://img.shields.io/static/v1?label=Product&message=Simple%20Online%20Food%20Ordering%20System&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=1.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Injection&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=SQL%20Injection&color=brightgreen) + +### Description + +A vulnerability was detected in SourceCodester Simple Online Food Ordering System 1.0. Impacted is an unknown function of the file /fos/view_prod.php. Performing a manipulation of the argument ID results in sql injection. Remote exploitation of the attack is possible. The exploit is now public and may be used. + +### POC + +#### Reference +- https://github.com/wsx138/cve/issues/5 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-78200.md b/2026/CVE-2026-78200.md new file mode 100644 index 0000000000..d68969de57 --- /dev/null +++ b/2026/CVE-2026-78200.md @@ -0,0 +1,18 @@ +### [CVE-2026-78200](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78200) +![](https://img.shields.io/static/v1?label=Product&message=Library%20Management%20System&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=1.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Injection&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=SQL%20Injection&color=brightgreen) + +### Description + +A flaw has been found in itsourcecode Library Management System 1.0. The affected element is an unknown function of the file editbooks.php. Executing a manipulation of the argument ID can lead to sql injection. The attack can be executed remotely. The exploit has been published and may be used. + +### POC + +#### Reference +- https://github.com/microwaveabi/vul/issues/89 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-78201.md b/2026/CVE-2026-78201.md new file mode 100644 index 0000000000..bc1775b5d5 --- /dev/null +++ b/2026/CVE-2026-78201.md @@ -0,0 +1,18 @@ +### [CVE-2026-78201](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78201) +![](https://img.shields.io/static/v1?label=Product&message=Payroll%20System&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=1.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Injection&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=SQL%20Injection&color=brightgreen) + +### Description + +A vulnerability has been found in itsourcecode Payroll System 1.0. The impacted element is the function Login of the file admin_class.php. The manipulation of the argument Username leads to sql injection. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used. + +### POC + +#### Reference +- https://github.com/microwaveabi/vul/issues/8 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-78202.md b/2026/CVE-2026-78202.md new file mode 100644 index 0000000000..e4138f991d --- /dev/null +++ b/2026/CVE-2026-78202.md @@ -0,0 +1,18 @@ +### [CVE-2026-78202](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78202) +![](https://img.shields.io/static/v1?label=Product&message=Payroll%20System&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=1.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Improper%20Access%20Controls&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Unrestricted%20Upload&color=brightgreen) + +### Description + +A vulnerability was found in itsourcecode Payroll System 1.0. This affects the function save_settings of the file admin_class.php. The manipulation of the argument img results in unrestricted upload. The attack may be performed from remote. The exploit has been made public and could be used. + +### POC + +#### Reference +- https://github.com/microwaveabi/vul/issues/12 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-78203.md b/2026/CVE-2026-78203.md new file mode 100644 index 0000000000..339c784962 --- /dev/null +++ b/2026/CVE-2026-78203.md @@ -0,0 +1,18 @@ +### [CVE-2026-78203](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78203) +![](https://img.shields.io/static/v1?label=Product&message=Ghostwriter&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Authorization%20Bypass%20Through%20User-Controlled%20Key&color=brightgreen) + +### Description + +Ghostwriter before 7.1.2 fails to validate template ownership in the report template swap endpoint, allowing attackers to attach client-scoped templates from other clients to their own reports. Attackers can exploit sequential template primary keys to enumerate and attach foreign templates, then generate reports to disclose template contents including letterhead, boilerplate, and methodology text. + +### POC + +#### Reference +- https://github.com/geo-chen/oss/blob/main/Ghostwriter.md + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-78204.md b/2026/CVE-2026-78204.md new file mode 100644 index 0000000000..3175c4a9db --- /dev/null +++ b/2026/CVE-2026-78204.md @@ -0,0 +1,17 @@ +### [CVE-2026-78204](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78204) +![](https://img.shields.io/static/v1?label=Product&message=Ghostwriter&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Missing%20Authorization&color=brightgreen) + +### Description + +Ghostwriter through 7.2.6 does not apply per-object authorization on its report template lint endpoints. RoleBasedAccessControlMixin.test_func returns only request.user.is_active unless a view overrides it, and neither the endpoint that lints a report template nor the endpoint that returns stored lint results provides an override, so each resolves a ReportTemplate from a caller-supplied primary key with no ownership or client-scope check. Any authenticated account can therefore lint an arbitrary template, which overwrites that template's stored lint result, and can read the returned findings, which enumerate the template's variable names and template-engine errors and so disclose its structure. This is distinct from the template swap path: that endpoint authorizes the report but omits the per-template check, whereas these endpoints omit authorization entirely and remain unfixed. + +### POC + +#### Reference +- https://github.com/geo-chen/oss/blob/main/Ghostwriter.md + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-78205.md b/2026/CVE-2026-78205.md new file mode 100644 index 0000000000..f357c6ef66 --- /dev/null +++ b/2026/CVE-2026-78205.md @@ -0,0 +1,17 @@ +### [CVE-2026-78205](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78205) +![](https://img.shields.io/static/v1?label=Product&message=BentoML&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=1.4.19%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Server-Side%20Request%20Forgery%20(SSRF)&color=brightgreen) + +### Description + +BentoML's outbound connection safeguard (make_safe_connect in _internal/utils/uri.py) blocks private, loopback, and link-local IP addresses but fails to reject the RFC 6598 shared address space (100.64.0.0/10, CGNAT). In versions 1.4.19 through 1.4.39, an unauthenticated attacker can supply URLs pointing to that range via multipart file handling (MultipartSerde.ensure_file) or JSON request parsing (JSONSerde.parse_request), causing the server to make outbound requests to internal hosts on CGNAT networks (Server-Side Request Forgery). This is an incomplete fix for CVE-2025-54381. + +### POC + +#### Reference +- https://github.com/bentoml/BentoML/issues/5644 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-78244.md b/2026/CVE-2026-78244.md new file mode 100644 index 0000000000..cdb65eb5b4 --- /dev/null +++ b/2026/CVE-2026-78244.md @@ -0,0 +1,18 @@ +### [CVE-2026-78244](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78244) +![](https://img.shields.io/static/v1?label=Product&message=Real%20Estate%20Management%20System&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=1.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Injection&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=SQL%20Injection&color=brightgreen) + +### Description + +A vulnerability was detected in itsourcecode Real Estate Management System 1.0. Affected by this issue is some unknown functionality of the file search.php. Performing a manipulation of the argument search/delivery_type/search_price/property_type results in sql injection. The attack may be initiated remotely. The exploit is now public and may be used. + +### POC + +#### Reference +- https://github.com/microwaveabi/vul/issues/5 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-78245.md b/2026/CVE-2026-78245.md new file mode 100644 index 0000000000..dd328858d0 --- /dev/null +++ b/2026/CVE-2026-78245.md @@ -0,0 +1,18 @@ +### [CVE-2026-78245](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78245) +![](https://img.shields.io/static/v1?label=Product&message=Online%20Pharmacy%20System&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=1.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Improper%20Access%20Controls&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Unrestricted%20Upload&color=brightgreen) + +### Description + +A flaw has been found in itsourcecode Online Pharmacy System 1.0. This affects the function move_uploaded_file of the file all_users/register.php of the component User Registration. Executing a manipulation of the argument photo can lead to unrestricted upload. The attack may be launched remotely. The exploit has been published and may be used. + +### POC + +#### Reference +- https://github.com/microwaveabi/vul/issues/47 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-78246.md b/2026/CVE-2026-78246.md new file mode 100644 index 0000000000..4a92d504de --- /dev/null +++ b/2026/CVE-2026-78246.md @@ -0,0 +1,18 @@ +### [CVE-2026-78246](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78246) +![](https://img.shields.io/static/v1?label=Product&message=Online%20Clinic%20Management%20System&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=1.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Injection&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=SQL%20Injection&color=brightgreen) + +### Description + +A vulnerability has been found in itsourcecode Online Clinic Management System 1.0. This vulnerability affects unknown code of the file success/login.php of the component Admin Login. The manipulation of the argument Username leads to sql injection. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used. + +### POC + +#### Reference +- https://github.com/microwaveabi/vul/issues/63 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-78247.md b/2026/CVE-2026-78247.md new file mode 100644 index 0000000000..f8ddf8b14a --- /dev/null +++ b/2026/CVE-2026-78247.md @@ -0,0 +1,18 @@ +### [CVE-2026-78247](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78247) +![](https://img.shields.io/static/v1?label=Product&message=Simple%20Online%20Food%20Ordering%20System&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=1.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Injection&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=SQL%20Injection&color=brightgreen) + +### Description + +A vulnerability was found in SourceCodester Simple Online Food Ordering System 1.0. This issue affects some unknown processing of the file /fos/admin/ajax.php?action=confirm_order. The manipulation of the argument ID results in sql injection. The attack can be executed remotely. The exploit has been made public and could be used. + +### POC + +#### Reference +- https://github.com/huliangjia/cve/issues/1 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-78248.md b/2026/CVE-2026-78248.md new file mode 100644 index 0000000000..d4bb1d67e8 --- /dev/null +++ b/2026/CVE-2026-78248.md @@ -0,0 +1,18 @@ +### [CVE-2026-78248](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78248) +![](https://img.shields.io/static/v1?label=Product&message=Simple%20Online%20Food%20Ordering%20System&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=1.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Injection&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=SQL%20Injection&color=brightgreen) + +### Description + +A vulnerability was determined in SourceCodester Simple Online Food Ordering System 1.0. Impacted is an unknown function of the file /fos/admin/ajax.php?action=save_settings. This manipulation of the argument Name causes sql injection. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized. + +### POC + +#### Reference +- https://github.com/huliangjia/cve/issues/3 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-78250.md b/2026/CVE-2026-78250.md new file mode 100644 index 0000000000..cfdb1567a1 --- /dev/null +++ b/2026/CVE-2026-78250.md @@ -0,0 +1,18 @@ +### [CVE-2026-78250](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78250) +![](https://img.shields.io/static/v1?label=Product&message=bytebot&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0.0.1%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Denial%20of%20Service&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Infinite%20Loop&color=brightgreen) + +### Description + +A vulnerability was identified in bytebot-ai bytebot 0.0.1. The affected element is an unknown function of the component Agent Execution Workflow. Such manipulation leads to infinite loop. The attack may be performed from remote. The exploit is publicly available and might be used. This vulnerability only affects products that are no longer supported by the maintainer. + +### POC + +#### Reference +- https://github.com/outlookgp/CVE/tree/main/Bytebot_Agent_Loop_Budget_DoS_Report + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-78364.md b/2026/CVE-2026-78364.md new file mode 100644 index 0000000000..eb7b615512 --- /dev/null +++ b/2026/CVE-2026-78364.md @@ -0,0 +1,17 @@ +### [CVE-2026-78364](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78364) +![](https://img.shields.io/static/v1?label=Product&message=MW%20WP%20Form&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-79%20Cross-Site%20Scripting%20(XSS)&color=brightgreen) + +### Description + +The MW WP Form WordPress plugin before 5.1.6 does not sanitise and escape some of its form settings before outputting them back in an admin dashboard page, which could allow users with a role as low as Editor to perform Stored Cross-Site Scripting attacks against high privilege users such as admin. + +### POC + +#### Reference +- https://wpscan.com/vulnerability/285b87e1-110f-4192-a098-e64e2eb447a8/ + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-78367.md b/2026/CVE-2026-78367.md new file mode 100644 index 0000000000..6e575506b4 --- /dev/null +++ b/2026/CVE-2026-78367.md @@ -0,0 +1,23 @@ +### [CVE-2026-78367](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78367) +![](https://img.shields.io/static/v1?label=Product&message=Red%20Hat%20Enterprise%20Linux%2010&color=blue) +![](https://img.shields.io/static/v1?label=Product&message=Red%20Hat%20Enterprise%20Linux%206&color=blue) +![](https://img.shields.io/static/v1?label=Product&message=Red%20Hat%20Enterprise%20Linux%207&color=blue) +![](https://img.shields.io/static/v1?label=Product&message=Red%20Hat%20Enterprise%20Linux%208&color=blue) +![](https://img.shields.io/static/v1?label=Product&message=Red%20Hat%20Enterprise%20Linux%209&color=blue) +![](https://img.shields.io/static/v1?label=Product&message=Red%20Hat%20Hardened%20Images&color=blue) +![](https://img.shields.io/static/v1?label=Product&message=Red%20Hat%20OpenShift%20Container%20Platform%204&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=n%2Fa&color=blue) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Improper%20Control%20of%20Generation%20of%20Code%20('Code%20Injection')&color=brightgreen) + +### Description + +A vulnerability was found in RPM's rpmbuild tarball processing. When processing a crafted source archive, the getTarSpec() function in tools/rpmbuild.cc passes an attacker-controlled tar archive member name to rpmExpand() as part of a %{basename:...} macro expression. A specially crafted .spec member name can therefore inject RPM macros, including Lua expressions, resulting in arbitrary code execution with the privileges of the user running rpmbuild. This can be exploited when a victim or automated build system processes an attacker-controlled source tarball using rpmbuild tarball mode (such as -ts, -ta, or -tb). + +### POC + +#### Reference +- https://github.com/rpm-software-management/rpm/issues/4314 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-78430.md b/2026/CVE-2026-78430.md new file mode 100644 index 0000000000..09606963ff --- /dev/null +++ b/2026/CVE-2026-78430.md @@ -0,0 +1,20 @@ +### [CVE-2026-78430](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78430) +![](https://img.shields.io/static/v1?label=Product&message=mcp-ffmpeg-helper&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0.1.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0.1.1%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0.2.1%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Command%20Injection&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=OS%20Command%20Injection&color=brightgreen) + +### Description + +A vulnerability was detected in sworddut mcp-ffmpeg-helper 0.1.0/0.1.1/0.2.1. This affects the function handleToolCall of the file src/tools/handlers.ts of the component Tool Handler. The manipulation of the argument format results in os command injection. Attacking locally is a requirement. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet. + +### POC + +#### Reference +- https://github.com/sworddut/mcp-ffmpeg-helper/issues/6 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-78434.md b/2026/CVE-2026-78434.md new file mode 100644 index 0000000000..ddc7c367c0 --- /dev/null +++ b/2026/CVE-2026-78434.md @@ -0,0 +1,21 @@ +### [CVE-2026-78434](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78434) +![](https://img.shields.io/static/v1?label=Product&message=Helpdesk&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=2.0.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=2.0.1%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=2.0.2%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=2.0.3%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Improper%20Authentication&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Missing%20Authentication&color=brightgreen) + +### Description + +A flaw has been found in Faveo Helpdesk up to 2.0.3. This impacts the function FormController::post_ticket_reply of the file app/Http/Controllers/Client/helpdesk/FormController.php of the component post-ticket-reply Endpoint. This manipulation causes missing authentication. The attack can be initiated remotely. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet. + +### POC + +#### Reference +- https://github.com/faveosuite/faveo-helpdesk/issues/8346 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-78435.md b/2026/CVE-2026-78435.md new file mode 100644 index 0000000000..8d6e690eb5 --- /dev/null +++ b/2026/CVE-2026-78435.md @@ -0,0 +1,20 @@ +### [CVE-2026-78435](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78435) +![](https://img.shields.io/static/v1?label=Product&message=Helpdesk&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=2.0.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=2.0.1%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=2.0.2%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=2.0.3%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Path%20Traversal&color=brightgreen) + +### Description + +A vulnerability has been found in Faveo Helpdesk up to 2.0.3. Affected is the function unlink of the file app/Http/Controllers/Admin/helpdesk/SettingsController.php of the component Logo Handler. Such manipulation of the argument data1 leads to path traversal. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through an issue report but has not responded yet. + +### POC + +#### Reference +- https://github.com/faveosuite/faveo-helpdesk/issues/8343 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-78637.md b/2026/CVE-2026-78637.md new file mode 100644 index 0000000000..57a3f7944d --- /dev/null +++ b/2026/CVE-2026-78637.md @@ -0,0 +1,22 @@ +### [CVE-2026-78637](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78637) +![](https://img.shields.io/static/v1?label=Product&message=node-poppler&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=10.0.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=10.0.1%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=9.1.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=9.1.1%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=9.1.2%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Argument%20Injection&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Injection&color=brightgreen) + +### Description + +A vulnerability was detected in Fdawgs node-poppler up to 9.1.2/10.0.1. The impacted element is the function pdfInfo/pdfToText/pdfToCairo/pdfToPpm/pdfImages/pdfToHtml/pdfToPs/pdfFonts/pdfDetach/pdfAttach/pdfSeparate/pdfUnite of the file src/index.js of the component Argument Injection Handler. Performing a manipulation of the argument file_path results in argument injection. The attack may be initiated remotely. The patch is named db6e3f79d3beb20601be7e59669c39811ae3c330. It is recommended to apply a patch to fix this issue. + +### POC + +#### Reference +- https://github.com/Fdawgs/node-poppler/issues/822 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-78638.md b/2026/CVE-2026-78638.md new file mode 100644 index 0000000000..8d416e247a --- /dev/null +++ b/2026/CVE-2026-78638.md @@ -0,0 +1,19 @@ +### [CVE-2026-78638](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78638) +![](https://img.shields.io/static/v1?label=Product&message=unzip-crx&color=blue) +![](https://img.shields.io/static/v1?label=Product&message=unzip-crx-3&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0.1%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0.2.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Path%20Traversal&color=brightgreen) + +### Description + +A flaw has been found in peerigon unzip-crx and unzip-crx-3 up to 0.2.0. This affects the function unzip of the file dist/index.js of the component Archive Extraction. Executing a manipulation of the argument destination can lead to path traversal. The attack can only be executed locally. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet. + +### POC + +#### Reference +- https://github.com/peerigon/unzip-crx/issues/19 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-78654.md b/2026/CVE-2026-78654.md new file mode 100644 index 0000000000..45aeb6522b --- /dev/null +++ b/2026/CVE-2026-78654.md @@ -0,0 +1,24 @@ +### [CVE-2026-78654](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78654) +![](https://img.shields.io/static/v1?label=Product&message=deep&color=blue) +![](https://img.shields.io/static/v1?label=Product&message=framework&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4.1%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4.2%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4.3%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=4.4.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Code%20Injection&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Improperly%20Controlled%20Modification%20of%20Object%20Prototype%20Attributes&color=brightgreen) + +### Description + +A vulnerability has been found in cleverbrush framework and deep up to 4.4.0. This impacts the function deepExtend of the file libs/deep/src/deepExtend.ts. The manipulation leads to improperly controlled modification of object prototype attributes. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used. Upgrading to version 4.4.1 will fix this issue. The identifier of the patch is 810398c1308c500c3b8b6af380b5a89371389327. You should upgrade the affected component. + +### POC + +#### Reference +- https://github.com/cleverbrush/framework/issues/213 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-78656.md b/2026/CVE-2026-78656.md new file mode 100644 index 0000000000..7aaf4ba5ef --- /dev/null +++ b/2026/CVE-2026-78656.md @@ -0,0 +1,18 @@ +### [CVE-2026-78656](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78656) +![](https://img.shields.io/static/v1?label=Product&message=Sales%20and%20Inventory%20System&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=1.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Injection&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=SQL%20Injection&color=brightgreen) + +### Description + +A vulnerability was found in itsourcecode Sales and Inventory System 1.0. Affected is an unknown function of the file /pages/cust_del.php. The manipulation of the argument ID results in sql injection. The attack can be executed remotely. The exploit has been made public and could be used. + +### POC + +#### Reference +- https://github.com/ltranquility/vuln_submit/issues/28 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-78675.md b/2026/CVE-2026-78675.md new file mode 100644 index 0000000000..cc969e19ca --- /dev/null +++ b/2026/CVE-2026-78675.md @@ -0,0 +1,18 @@ +### [CVE-2026-78675](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78675) +![](https://img.shields.io/static/v1?label=Product&message=GitPython&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=External%20Control%20of%20File%20Name%20or%20Path&color=brightgreen) + +### Description + +GitPython before 3.1.59 fails to disable merge_includes when parsing .gitmodules, allowing attackers to disclose local file content by including arbitrary file paths via [include] directives. Attackers can craft a malicious .gitmodules file with include directives pointing to sensitive files; when repo.submodules is accessed, GitConfigParser raises MissingSectionHeaderError embedding the target file's first line verbatim in the exception message. + +### POC + +#### Reference +- https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-7833-fr7j-v32q + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-78676.md b/2026/CVE-2026-78676.md new file mode 100644 index 0000000000..4c2085b70b --- /dev/null +++ b/2026/CVE-2026-78676.md @@ -0,0 +1,18 @@ +### [CVE-2026-78676](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78676) +![](https://img.shields.io/static/v1?label=Product&message=GitPython&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Improper%20Neutralization%20of%20Argument%20Delimiters%20in%20a%20Command%20('Argument%20Injection')&color=brightgreen) + +### Description + +GitPython before 3.1.59 fails to safely re-serialize multi-line git-config values during write operations, corrupting dormant quoted values into injected directives like core.hooksPath. Attackers can craft config files with embedded newlines that become live git directives after any unrelated GitPython config write, enabling arbitrary code execution via hook invocation. + +### POC + +#### Reference +- https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-284h-m62q-gf8w + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-78677.md b/2026/CVE-2026-78677.md new file mode 100644 index 0000000000..91be6edaef --- /dev/null +++ b/2026/CVE-2026-78677.md @@ -0,0 +1,18 @@ +### [CVE-2026-78677](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78677) +![](https://img.shields.io/static/v1?label=Product&message=GitPython&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Improper%20Limitation%20of%20a%20Pathname%20to%20a%20Restricted%20Directory%20('Path%20Traversal')&color=brightgreen) + +### Description + +GitPython before 3.1.59 omits --separate-git-dir from unsafe_git_clone_options, allowing attackers to create arbitrary git directories outside the intended clone destination. Attackers can pass a separate_git_dir parameter to Repo.clone_from() or Repo.clone() to redirect repository metadata to an attacker-controlled filesystem path, enabling arbitrary directory creation and potential hook execution. + +### POC + +#### Reference +- https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-8mcc-hrx5-hvxc + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-78678.md b/2026/CVE-2026-78678.md new file mode 100644 index 0000000000..16a40ed145 --- /dev/null +++ b/2026/CVE-2026-78678.md @@ -0,0 +1,18 @@ +### [CVE-2026-78678](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78678) +![](https://img.shields.io/static/v1?label=Product&message=GitPython&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Improper%20Neutralization%20of%20Argument%20Delimiters%20in%20a%20Command%20('Argument%20Injection')&color=brightgreen) + +### Description + +GitPython versions before 3.1.59 contain an incomplete denylist in the unsafe_git_revision_options guard that omits --contents and -S options, allowing attackers to read arbitrary files by passing these options to Repo.blame(). Attackers can supply revision values like --contents=/etc/passwd to leak file contents through the blame result returned to the caller. + +### POC + +#### Reference +- https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-5xxx-qhh7-9287 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-78679.md b/2026/CVE-2026-78679.md new file mode 100644 index 0000000000..44ccb11985 --- /dev/null +++ b/2026/CVE-2026-78679.md @@ -0,0 +1,18 @@ +### [CVE-2026-78679](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78679) +![](https://img.shields.io/static/v1?label=Product&message=GitPython&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=External%20Control%20of%20File%20Name%20or%20Path&color=brightgreen) + +### Description + +GitPython before 3.1.59 contains an arbitrary file read vulnerability in TagReference.create() where a positional reference parameter bypasses the unsafe option guard. Attackers can supply a reference value like --file= to read arbitrary files, with contents returned in the annotated tag message. + +### POC + +#### Reference +- https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-3wxw-xv34-2frg + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-78681.md b/2026/CVE-2026-78681.md new file mode 100644 index 0000000000..e6a71e9881 --- /dev/null +++ b/2026/CVE-2026-78681.md @@ -0,0 +1,18 @@ +### [CVE-2026-78681](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78681) +![](https://img.shields.io/static/v1?label=Product&message=nltk&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Improper%20Restriction%20of%20Recursive%20Entity%20References%20in%20DTDs%20('XML%20Entity%20Expansion')&color=brightgreen) + +### Description + +NLTK versions before 3.10.3 use xml.etree.ElementTree to parse XML in multiple modules, which honors entity declarations in document DTDs. Attackers can craft XML payloads with nested entity declarations that expand from hundreds of bytes to megabytes in memory, causing denial of service. + +### POC + +#### Reference +- https://github.com/nltk/nltk/security/advisories/GHSA-97qj-x29f-37w7 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-78682.md b/2026/CVE-2026-78682.md new file mode 100644 index 0000000000..075b8855b3 --- /dev/null +++ b/2026/CVE-2026-78682.md @@ -0,0 +1,18 @@ +### [CVE-2026-78682](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78682) +![](https://img.shields.io/static/v1?label=Product&message=nltk&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Server-Side%20Request%20Forgery%20(SSRF)&color=brightgreen) + +### Description + +NLTK before 3.10.3 contains a server-side request forgery vulnerability in nltk.pathsec.urlopen (and callers nltk.data.load, nltk.downloader.Downloader.index/download) when an HTTP proxy is configured. pathsec.urlopen validates the requested hostname locally, but proxy-handler inheritance disables the safe HTTP/HTTPS handlers so the actual fetch is performed by the proxy against a destination that is never re-validated. An attacker can supply a validated public URL that the proxy forwards to an internal loopback-only service, allowing disclosure of internal HTTP resources, loading of forged downloader indexes, and installation of attacker-chosen package content. + +### POC + +#### Reference +- https://github.com/nltk/nltk/security/advisories/GHSA-6ww7-3frv-cqxh + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-78683.md b/2026/CVE-2026-78683.md new file mode 100644 index 0000000000..600e85d030 --- /dev/null +++ b/2026/CVE-2026-78683.md @@ -0,0 +1,18 @@ +### [CVE-2026-78683](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78683) +![](https://img.shields.io/static/v1?label=Product&message=nltk&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Deserialization%20of%20Untrusted%20Data&color=brightgreen) + +### Description + +NLTK before 3.10.0 (affected versions <=3.9.4) contains an unsafe pickle deserialization vulnerability in the TransitionParser.parse() method (nltk/parse/transitionparser.py). The method calls pickle_load() with the default restricted=False, routing deserialization through WarningUnpickler, which does not override find_class() and therefore permits arbitrary class resolution. When an application loads an attacker-crafted model file, embedded pickle gadget chains execute arbitrary Python code with the privileges of the user running the application. NLTK provides a RestrictedUnpickler for safe deserialization, but it is not used by production code paths. Fixed in 3.10.0. + +### POC + +#### Reference +- https://github.com/nltk/nltk/security/advisories/GHSA-rhp5-r9x4-f5g2 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-81660.md b/2026/CVE-2026-81660.md new file mode 100644 index 0000000000..5167b0e9a5 --- /dev/null +++ b/2026/CVE-2026-81660.md @@ -0,0 +1,17 @@ +### [CVE-2026-81660](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-81660) +![](https://img.shields.io/static/v1?label=Product&message=Groundhogg%20%E2%80%94%20CRM%2C%20Newsletters%2C%20and%20Marketing%20Automation&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-79%20Cross-Site%20Scripting%20(XSS)&color=brightgreen) + +### Description + +The Groundhogg — CRM, Newsletters, and Marketing Automation WordPress plugin before 4.5.13 does not validate or escape values submitted to some optional web form fields before storing them and outputting them back in an administrative area, allowing unauthenticated users to perform Stored Cross-Site Scripting attacks against high privilege users. + +### POC + +#### Reference +- https://wpscan.com/vulnerability/cfdb4107-6010-4c29-baf3-3111765f48c2/ + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-81766.md b/2026/CVE-2026-81766.md new file mode 100644 index 0000000000..07d3176bc0 --- /dev/null +++ b/2026/CVE-2026-81766.md @@ -0,0 +1,17 @@ +### [CVE-2026-81766](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-81766) +![](https://img.shields.io/static/v1?label=Product&message=Really%20Simple%20Security&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-269%20Improper%20Privilege%20Management&color=brightgreen) + +### Description + +The Really Simple Security WordPress plugin before 9.8.0 does not check that the user is allowed to install Really Simple Security WordPress plugin before 9.8.0 before installing one from a user-supplied URL, allowing an administrator of a subsite on a multisite network to install and execute arbitrary code in the network-shared Really Simple Security WordPress plugin before 9.8.0 directory, which WordPress otherwise reserves to the network administrator. Exploitation requires the network administrator to have enabled the Really Simple Security WordPress plugin before 9.8.0 administration menu for subsites, which is not the default. + +### POC + +#### Reference +- https://wpscan.com/vulnerability/948d70a2-605e-4a83-8feb-eca4dbb5f948/ + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-82417.md b/2026/CVE-2026-82417.md new file mode 100644 index 0000000000..3ee155f85f --- /dev/null +++ b/2026/CVE-2026-82417.md @@ -0,0 +1,18 @@ +### [CVE-2026-82417](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-82417) +![](https://img.shields.io/static/v1?label=Product&message=qs&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=2.2.5%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-248%20Uncaught%20Exception&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-703%20Improper%20Check%20or%20Handling%20of%20Exceptional%20Conditions&color=brightgreen) + +### Description + +### Summary`qs.stringify` throws a `TypeError` when it serializes an object whose own `constructor` property has a truthy, non-callable `isBuffer` member. `utils.isBuffer` duck-types buffers by calling `obj.constructor.isBuffer(obj)` after checking only that the property is truthy, so a value such as `{ constructor: { isBuffer: "x" } }` makes the call throw `TypeError: obj.constructor.isBuffer is not a function`.### Details`lib/stringify.js:127` calls `utils.isBuffer` on every non-primitive value it serializes. `utils.isBuffer` (`lib/utils.js:332`) reads `obj.constructor.isBuffer` and invokes it without verifying that it is a function. `constructor` and `isBuffer` are ordinary property names, so any object carrying them as own properties reaches the unchecked call.Such an object can be built from untrusted input. `qs.parse("x[constructor][isBuffer]=y", { plainObjects: true })` or `{ allowPrototypes: true }` keeps the `constructor` key as an own property (the default parse options drop it), and `JSON.parse("{\"a\":{\"constructor\":{\"isBuffer\":\"x\"}}}")` produces the same shape with no qs option involved. Express 4 with its default `query parser` setting and body-parser with `extended: true` both call `qs.parse` with `allowPrototypes: true`, so on those stacks `req.query` and `req.body` can carry the shape directly.#### PoC```jsvar qs = require("qs");qs.stringify(qs.parse("x[constructor][isBuffer]=y", { plainObjects: true }));qs.stringify(JSON.parse("{\"a\":{\"constructor\":{\"isBuffer\":\"x\"}}}"));// TypeError: obj.constructor.isBuffer is not a function// at Object.isBuffer (lib/utils.js:332:78)// at stringify (lib/stringify.js:127:45)```#### Fix`lib/utils.js`, applied in e83d321 on `main` and released as v6.16.0:```diff- return !!(obj.constructor && obj.constructor.isBuffer && obj.constructor.isBuffer(obj));+ return !!(obj.constructor && typeof obj.constructor.isBuffer === "function" && obj.constructor.isBuffer(obj));```Real `Buffer`, `safer-buffer`, and browserify `buffer` polyfill instances serialize exactly as before; only the throw is removed.### Affected versions`>=2.2.5 <6.16.0`, fixed in v6.16.0.The unguarded duck-type was introduced in 3768a75 and first shipped in v2.2.5 (September 2014). v2.2.4 and earlier used `Buffer.isBuffer` and are not affected. Every release from v2.2.5 through v6.15.3 contains the unguarded call.### ImpactAn unauthenticated request can make any code path that re-serializes attacker-influenced data with `qs.stringify` (for example, rebuilding a query string from `req.query` for a redirect or an upstream request, or serializing a parsed JSON body) throw synchronously. In a typical Node.js HTTP framework the throw is caught by the framework error boundary and the affected request returns a 500; the process survives and other requests are unaffected. Where the call runs outside an error boundary, such as an `async` Express 4 handler (where the throw becomes an unhandled promise rejection) or a background job, the process exits, so the impact in that case depends on the application error handling rather than on qs. + +### POC + +#### Reference +- https://github.com/ljharb/qs/security/advisories/GHSA-4mjr-xmp4-gh2g + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-82421.md b/2026/CVE-2026-82421.md new file mode 100644 index 0000000000..a018f15b22 --- /dev/null +++ b/2026/CVE-2026-82421.md @@ -0,0 +1,18 @@ +### [CVE-2026-82421](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-82421) +![](https://img.shields.io/static/v1?label=Product&message=Sales%20and%20Inventory%20System&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=1.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Injection&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=SQL%20Injection&color=brightgreen) + +### Description + +A vulnerability was identified in itsourcecode Sales and Inventory System 1.0. This issue affects some unknown processing of the file /pages/emp_edit.php. The manipulation of the argument ID leads to sql injection. The attack may be initiated remotely. The exploit is publicly available and might be used. + +### POC + +#### Reference +- https://github.com/ltranquility/cve_submit/issues/23 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-82422.md b/2026/CVE-2026-82422.md new file mode 100644 index 0000000000..71a787047e --- /dev/null +++ b/2026/CVE-2026-82422.md @@ -0,0 +1,18 @@ +### [CVE-2026-82422](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-82422) +![](https://img.shields.io/static/v1?label=Product&message=Sales%20and%20Inventory%20System&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=1.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Injection&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=SQL%20Injection&color=brightgreen) + +### Description + +A security flaw has been discovered in itsourcecode Sales and Inventory System 1.0. Impacted is an unknown function of the file /pages/emp_del.php. The manipulation of the argument ID results in sql injection. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks. + +### POC + +#### Reference +- https://github.com/ltranquility/cve_submit/issues/24 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-82424.md b/2026/CVE-2026-82424.md new file mode 100644 index 0000000000..b06235815c --- /dev/null +++ b/2026/CVE-2026-82424.md @@ -0,0 +1,18 @@ +### [CVE-2026-82424](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-82424) +![](https://img.shields.io/static/v1?label=Product&message=Student%20Information%20System&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=1.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Injection&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=SQL%20Injection&color=brightgreen) + +### Description + +A weakness has been identified in PHPGurukul Student Information System 1.0. Affected by this vulnerability is an unknown functionality of the file /student_edit1.php. Executing a manipulation of the argument ID can lead to sql injection. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks. + +### POC + +#### Reference +- https://github.com/Bai-public/CVE/issues/8 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-82455.md b/2026/CVE-2026-82455.md new file mode 100644 index 0000000000..e01f35b1fc --- /dev/null +++ b/2026/CVE-2026-82455.md @@ -0,0 +1,17 @@ +### [CVE-2026-82455](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-82455) +![](https://img.shields.io/static/v1?label=Product&message=rubygems&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=3.2.30%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Improper%20Link%20Resolution%20Before%20File%20Access%20('Link%20Following')&color=brightgreen) + +### Description + +RubyGems fails to re-validate path containment after filesystem symlink resolution during gem extraction. When a pre-existing symlink inside the destination directory points outside the extraction root, extracted files that appear to be written under the destination directory can instead be written outside of it, breaking the extraction safety boundary. The fix resolves the real path of the parent directory before writing and raises Gem::Package::PathError if it escapes the destination directory. + +### POC + +#### Reference +- https://github.com/ruby/rubygems/commit/103ca4230deacb31b9fcd813de109e83b5fc71ac + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-82456.md b/2026/CVE-2026-82456.md new file mode 100644 index 0000000000..001cd0d636 --- /dev/null +++ b/2026/CVE-2026-82456.md @@ -0,0 +1,17 @@ +### [CVE-2026-82456](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-82456) +![](https://img.shields.io/static/v1?label=Product&message=argocd-mcp&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0.8.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Binding%20to%20an%20Unrestricted%20IP%20Address&color=brightgreen) + +### Description + +argocd-mcp 0.8.0 binds its HTTP transport to every network interface and accepts MCP sessions without requiring caller credentials when ARGOCD_API_TOKEN is configured. Attackers who can reach the listener can invoke the full tool surface using the operator's stored token to create applications, request syncs, and modify Argo CD resources. + +### POC + +#### Reference +- https://github.com/argoproj-labs/mcp-for-argocd/security/advisories/GHSA-rp45-5x3v-48mr + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-82457.md b/2026/CVE-2026-82457.md new file mode 100644 index 0000000000..06fab54527 --- /dev/null +++ b/2026/CVE-2026-82457.md @@ -0,0 +1,17 @@ +### [CVE-2026-82457](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-82457) +![](https://img.shields.io/static/v1?label=Product&message=su-exec&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Incorrect%20Conversion%20between%20Numeric%20Types&color=brightgreen) + +### Description + +su-exec through 0.3 fails to validate numeric user and group identifiers parsed with strtol before assigning to uid_t and gid_t, allowing truncation of out-of-range values to zero. Attackers can supply large numeric identifiers that truncate to root's identifier, causing su-exec to execute target programs with root privileges instead of intended unprivileged accounts. + +### POC + +#### Reference +- https://gist.github.com/thesmartshadow/ed96e2a88643c34a247c9b7cf9e311be + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-82460.md b/2026/CVE-2026-82460.md new file mode 100644 index 0000000000..e868ceadd7 --- /dev/null +++ b/2026/CVE-2026-82460.md @@ -0,0 +1,17 @@ +### [CVE-2026-82460](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-82460) +![](https://img.shields.io/static/v1?label=Product&message=cloudcmd&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Improper%20Limitation%20of%20a%20Pathname%20to%20a%20Restricted%20Directory%20('Path%20Traversal')&color=brightgreen) + +### Description + +Cloud Commander before 19.20.2 contains a directory traversal vulnerability in REST file-operation and markdown endpoints that fails to properly validate path normalization. Attackers can use path traversal sequences to read, write, move, or copy files outside the configured root directory. + +### POC + +#### Reference +- https://github.com/coderaiser/cloudcmd/issues/474 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-82475.md b/2026/CVE-2026-82475.md new file mode 100644 index 0000000000..c4966ae6f9 --- /dev/null +++ b/2026/CVE-2026-82475.md @@ -0,0 +1,17 @@ +### [CVE-2026-82475](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-82475) +![](https://img.shields.io/static/v1?label=Product&message=astron-agent&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Missing%20Authorization&color=brightgreen) + +### Description + +iFlytek astron-agent through 1.1.1 contains an authorization bypass vulnerability in the copyFlow endpoint that fails to validate workflow ownership. Authenticated attackers can enumerate workflow identifiers and overwrite other tenants' workflows or copy private workflows to read their definitions. + +### POC + +#### Reference +- https://github.com/iflytek/astron-agent/issues/1590 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-82483.md b/2026/CVE-2026-82483.md new file mode 100644 index 0000000000..ac24600503 --- /dev/null +++ b/2026/CVE-2026-82483.md @@ -0,0 +1,47 @@ +### [CVE-2026-82483](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-82483) +![](https://img.shields.io/static/v1?label=Product&message=Coppermine%20Photo%20Gallery&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=1.6.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=1.6.1%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=1.6.10%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=1.6.11%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=1.6.12%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=1.6.13%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=1.6.14%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=1.6.15%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=1.6.16%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=1.6.17%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=1.6.18%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=1.6.19%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=1.6.2%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=1.6.20%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=1.6.21%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=1.6.22%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=1.6.23%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=1.6.24%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=1.6.25%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=1.6.26%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=1.6.27%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=1.6.28%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=1.6.3%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=1.6.4%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=1.6.5%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=1.6.6%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=1.6.7%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=1.6.8%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Version&message=1.6.9%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Code%20Injection&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Cross%20Site%20Scripting&color=brightgreen) + +### Description + +A vulnerability was detected in coppermine-gallery Coppermine Photo Gallery up to 1.6.28. This impacts an unknown function of the file db_input.php of the component Hidden Album Update Endpoint. The manipulation results in cross site scripting. The attack can be launched remotely. The exploit is now public and may be used. Upgrading to version 1.6.29 will fix this issue. It is recommended to upgrade the affected component. + +### POC + +#### Reference +- https://github.com/Leousum/VulnPoC/blob/main/CPG1.6.x/stored_xss_album_desc.md + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-82484.md b/2026/CVE-2026-82484.md new file mode 100644 index 0000000000..4256437b9f --- /dev/null +++ b/2026/CVE-2026-82484.md @@ -0,0 +1,18 @@ +### [CVE-2026-82484](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-82484) +![](https://img.shields.io/static/v1?label=Product&message=Sales%20and%20Inventory%20System&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=1.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Injection&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=SQL%20Injection&color=brightgreen) + +### Description + +A flaw has been found in itsourcecode Sales and Inventory System 1.0. Affected is an unknown function of the file /pages/emp_searchfrm.php. This manipulation of the argument ID causes sql injection. The attack may be initiated remotely. The exploit has been published and may be used. + +### POC + +#### Reference +- https://github.com/ltranquility/submit_vuln/issues/20 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-82485.md b/2026/CVE-2026-82485.md new file mode 100644 index 0000000000..7b2f3a41ed --- /dev/null +++ b/2026/CVE-2026-82485.md @@ -0,0 +1,18 @@ +### [CVE-2026-82485](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-82485) +![](https://img.shields.io/static/v1?label=Product&message=Sales%20and%20Inventory%20System&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=1.0%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=Injection&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=SQL%20Injection&color=brightgreen) + +### Description + +A vulnerability has been found in itsourcecode Sales and Inventory System 1.0. Affected by this vulnerability is an unknown functionality of the file /pages/pro_edit.php. Such manipulation of the argument ID leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. + +### POC + +#### Reference +- https://github.com/ltranquility/submit_vuln/issues/21 + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-82562.md b/2026/CVE-2026-82562.md new file mode 100644 index 0000000000..208e7248a2 --- /dev/null +++ b/2026/CVE-2026-82562.md @@ -0,0 +1,18 @@ +### [CVE-2026-82562](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-82562) +![](https://img.shields.io/static/v1?label=Product&message=qs&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=6.14.2%20&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-770%20Allocation%20of%20Resources%20Without%20Limits%20or%20Throttling&color=brightgreen) + +### Description + +### SummaryWhen `qs.parse` is called with `comma: true` and `throwOnLimitExceeded: true`, a comma-separated value under a bracket-push key (`a[]=1,2,3,4`) is split into an array without being compared against `arrayLimit`, while the same value under a flat key (`a=1,2,3,4`), an indexed key (`a[0]=`), a nested key (`a[b]=`), or a dotted key (`a.b=` with `allowDots`) throws the documented `RangeError`. A single parameter such as `a[]=1,2,2,...` therefore produces an inner array of arbitrary length even though the caller opted into the hard limit. This is the `[]=` key form that the fix for CVE-2026-2391 (qs 6.14.2) did not cover.### DetailsIn `lib/parse.js`, a comma-separated value under a `[]=` key is split and then wrapped as a single nested element (`val = [val]`, so that each `a[]=x,y` group counts as one element of the outer array). The `arrayLimit` check that 6.14.2 added for comma values runs after that wrap, so for `[]=` parts it only ever saw the wrapper of length 1. 6.15.3 added a pre-split comma count so that an oversized value throws before it is allocated, but gated it on an `isFlatArrayValue` flag that `parseValues` set to `false` for any part containing `[]=`, and did not pass it for object-valued input, so the gap remained.#### PoC```jsvar qs = require('qs');var options = { comma: true, arrayLimit: 3, throwOnLimitExceeded: true };qs.parse('a=1,2,3,4', options); // RangeError: Array limit exceeded. Only 3 elements allowed in an array.qs.parse('a[]=1,2,3,4', options); // { a: [ [ '1', '2', '3', '4' ] ] } (no throw)qs.parse('a[]=' + '1,'.repeat(1000000) + '1', { comma: true, arrayLimit: 20, throwOnLimitExceeded: true });// no throw; a 1,000,001-element inner array is allocated```#### Fix`lib/parse.js`, applied in 8859c37 on `main` and released as v6.16.0: the `isFlatArrayValue` gate is removed, so every comma-split value is counted against `arrayLimit` before splitting regardless of key form. An in-limit group under `a[]=` still counts as one element of the outer array, and the default (`throwOnLimitExceeded: false`) path is unchanged.### Affected versions`>=6.14.2 <6.16.0`, fixed in v6.16.0.v6.14.2 introduced `arrayLimit` enforcement for comma values (the fix for CVE-2026-2391) but only for values not under a `[]=` key, and every release from v6.14.2 through v6.15.3 has the same gap. v6.14.0 and v6.14.1, where `throwOnLimitExceeded` exists but does not apply to any comma form, are covered by CVE-2026-2391 rather than this record. Earlier lines (6.7.x through 6.13.x) have `comma` but no `throwOnLimitExceeded`, so there is no hard cap on any comma path to bypass; releases before 6.7.0 have no `comma` option.### ImpactAn unauthenticated attacker who can reach an application that parses untrusted query strings or urlencoded bodies with both `comma: true` and `throwOnLimitExceeded: true` (both non-default) can bypass the configured limit with a single `a[]=` parameter and force the parser to allocate an array proportional to the request size. The cost is strictly linear in the attacker-supplied bytes (about 0.1 microseconds and 6 to 7 retained bytes per input byte; the same out-of-memory threshold as the documented default `throwOnLimitExceeded: false` path), so a transport-layer request or body size limit bounds it completely (and node's default maximum HTTP header size of 16 KB already bounds the request line, so multi-megabyte payloads need a body parser). The impact is that an opt-in hard limit fails open on one key spelling, not unbounded allocation from a small input. + +### POC + +#### Reference +- https://github.com/ljharb/qs/security/advisories/GHSA-w7fw-mjwx-w883 +- https://github.com/ljharb/qs/security/advisories/GHSA-x5fp-wj9c-mxmx + +#### Github +No PoCs found on GitHub currently. + diff --git a/2026/CVE-2026-8952.md b/2026/CVE-2026-8952.md new file mode 100644 index 0000000000..1868f07b7e --- /dev/null +++ b/2026/CVE-2026-8952.md @@ -0,0 +1,18 @@ +### [CVE-2026-8952](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-8952) +![](https://img.shields.io/static/v1?label=Product&message=Firefox&color=blue) +![](https://img.shields.io/static/v1?label=Product&message=Thunderbird&color=blue) +![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen) +![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue) + +### Description + +Privilege escalation in the Application Update component. This vulnerability was fixed in Firefox 151 and Thunderbird 151. + +### POC + +#### Reference +- https://bugzilla.mozilla.org/show_bug.cgi?id=2021727 + +#### Github +No PoCs found on GitHub currently. + diff --git a/references.txt b/references.txt index 870d47edb5..7ae96f8d76 100644 --- a/references.txt +++ b/references.txt @@ -862,6 +862,7 @@ CVE-2003-1376 - http://securityreason.com/securityalert/3265 CVE-2003-1381 - http://securityreason.com/securityalert/3258 CVE-2003-1397 - http://securityreason.com/securityalert/3255 CVE-2003-1418 - http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html +CVE-2003-1448 - http://www.immunitysec.com/downloads/advantages_of_block_based_analysis.html CVE-2003-1450 - http://www.linuxsecurity.com/content/view/104622/104/ CVE-2003-1495 - http://www-1.ibm.com/services/continuity/recover1.nsf/MSS/MSS-OAR-E01-2003.1357.1 CVE-2003-1497 - http://securityreason.com/securityalert/3298 @@ -1059,6 +1060,8 @@ CVE-2004-0365 - http://www.redhat.com/support/errata/RHSA-2004-136.html CVE-2004-0365 - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9196 CVE-2004-0367 - http://www.redhat.com/support/errata/RHSA-2004-136.html CVE-2004-0367 - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A905 +CVE-2004-0368 - http://lists.immunitysec.com/pipermail/dailydave/2004-March/000402.html +CVE-2004-0368 - http://www.immunitysec.com/downloads/dtlogin.sxw.pdf CVE-2004-0380 - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A990 CVE-2004-0385 - http://www.kb.cert.org/vuls/id/413006 CVE-2004-0391 - http://www.cisco.com/warp/public/707/cisco-sa-20040407-username.shtml @@ -1093,6 +1096,7 @@ CVE-2004-0444 - http://securityresponse.symantec.com/avcenter/security/Content/2 CVE-2004-0445 - http://securityresponse.symantec.com/avcenter/security/Content/2004.05.12.html CVE-2004-0452 - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9938 CVE-2004-0453 - http://marc.info/?l=bugtraq&m=108723630730487&w=2 +CVE-2004-0478 - http://lists.immunitysec.com/pipermail/dailydave/2004-May/000587.html CVE-2004-0485 - http://lists.seifried.org/pipermail/security/2004-May/003743.html CVE-2004-0494 - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9854 CVE-2004-0495 - http://www.redhat.com/support/errata/RHSA-2004-260.html @@ -1302,6 +1306,7 @@ CVE-2004-1073 - http://www.isec.pl/vulnerabilities/isec-0017-binfmt_elf.txt CVE-2004-1074 - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9751 CVE-2004-1075 - http://marc.info/?l=bugtraq&m=110138568212036&w=2 CVE-2004-1075 - http://marc.info/?l=bugtraq&m=110149122529761&w=2 +CVE-2004-1080 - http://www.immunitysec.com/downloads/instantanea.pdf CVE-2004-1080 - https://docs.microsoft.com/en-us/security-updates/securitybulletins/2004/ms04-045 CVE-2004-1081 - http://www.securityfocus.com/bid/11802 CVE-2004-1083 - http://www.securityfocus.com/bid/11802 @@ -1549,6 +1554,7 @@ CVE-2004-1802 - http://aluigi.altervista.org/adv/chatany-ghost-adv.txt CVE-2004-1802 - http://marc.info/?l=bugtraq&m=107885946220895&w=2 CVE-2004-1805 - http://aluigi.altervista.org/adv/unrfs-adv.txt CVE-2004-1805 - http://marc.info/?l=bugtraq&m=107893764406905&w=2 +CVE-2004-1812 - http://www.immunitysec.com/downloads/awservices.sxw.pdf CVE-2004-1831 - http://aluigi.altervista.org/adv/chrome-boom-adv.txt CVE-2004-1831 - http://marc.info/?l=bugtraq&m=107964719614657&w=2 CVE-2004-1837 - http://marc.info/?l=bugtraq&m=107997967421972&w=2 @@ -1725,6 +1731,7 @@ CVE-2004-2670 - http://echo.or.id/adv/adv02-y3dips-2004.txt CVE-2004-2671 - http://echo.or.id/adv/adv02-y3dips-2004.txt CVE-2004-2685 - https://www.exploit-db.com/exploits/4360 CVE-2004-2685 - https://www.exploit-db.com/exploits/621 +CVE-2004-2686 - http://www.immunitysec.com/downloads/solaris_kernel_vfs.sxw.pdf CVE-2004-2695 - http://www.vbulletin.com/forum/bugs.php?do=view&bugid=3379 CVE-2004-2704 - http://hastymail.sourceforge.net/security.php CVE-2004-2719 - https://www.exploit-db.com/exploits/164 @@ -1985,6 +1992,7 @@ CVE-2005-0569 - http://marc.info/?l=bugtraq&m=110927754230666&w=2 CVE-2005-0570 - http://marc.info/?l=bugtraq&m=110927754230666&w=2 CVE-2005-0571 - http://marc.info/?l=bugtraq&m=110927754230666&w=2 CVE-2005-0575 - http://marc.info/?l=bugtraq&m=110943766505666&w=2 +CVE-2005-0575 - http://www.exploit-db.com/exploits/24897 CVE-2005-0575 - http://www.exploit-db.com/exploits/24950 CVE-2005-0578 - http://www.redhat.com/support/errata/RHSA-2005-384.html CVE-2005-0584 - http://www.redhat.com/support/errata/RHSA-2005-384.html @@ -2980,6 +2988,7 @@ CVE-2005-3284 - http://securityreason.com/securityalert/80 CVE-2005-3286 - http://pb.specialised.info/all/adv/kerio-fwdrv-dos-adv.txt CVE-2005-3286 - http://seclists.org/bugtraq/2005/Oct/166 CVE-2005-3286 - http://securityreason.com/securityalert/78 +CVE-2005-3294 - http://www.exploit-db.com/exploits/15860 CVE-2005-3294 - http://www.exploitlabs.com/files/advisories/EXPL-A-2005-016-typsoft-ftpd.txt CVE-2005-3295 - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A992 CVE-2005-3299 - http://securityreason.com/securityalert/69 @@ -3190,6 +3199,7 @@ CVE-2005-3890 - http://marc.info/?l=bugtraq&m=113261573023912&w=2 CVE-2005-3891 - http://marc.info/?l=bugtraq&m=113261573023912&w=2 CVE-2005-3892 - http://marc.info/?l=bugtraq&m=113261573023912&w=2 CVE-2005-3903 - http://securityreason.com/securityalert/251 +CVE-2005-3912 - http://lists.immunitysec.com/pipermail/dailydave/2005-November/002685.html CVE-2005-3915 - http://www.clavister.com/support/support_update_ISAKMP.html CVE-2005-3919 - http://securityreason.com/securityalert/211 CVE-2005-3921 - http://securityreason.com/securityalert/227 @@ -3491,6 +3501,7 @@ CVE-2006-0103 - http://securityreason.com/securityalert/320 CVE-2006-0104 - http://evuln.com/vulns/14/exploit.html CVE-2006-0104 - http://evuln.com/vulns/14/summary.html CVE-2006-0104 - http://securityreason.com/securityalert/320 +CVE-2006-0106 - http://lists.immunitysec.com/pipermail/dailydave/2006-January/002806.html CVE-2006-0110 - http://evuln.com/vulns/16/summary.html CVE-2006-0123 - http://evuln.com/vulns/15/summary.html CVE-2006-0124 - http://evuln.com/vulns/15/summary.html @@ -3684,6 +3695,7 @@ CVE-2006-0440 - http://evuln.com/vulns/46/summary.html CVE-2006-0441 - https://www.exploit-db.com/exploits/40675/ CVE-2006-0443 - http://evuln.com/vulns/49/summary.html CVE-2006-0450 - http://securityreason.com/securityalert/368 +CVE-2006-0454 - http://lists.immunitysec.com/pipermail/dailydave/2006-February/002909.html CVE-2006-0454 - http://www.securityfocus.com/archive/1/427981/100/0/threaded CVE-2006-0456 - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9909 CVE-2006-0457 - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9566 @@ -3751,6 +3763,7 @@ CVE-2006-0572 - http://evuln.com/vulns/61/summary.html CVE-2006-0572 - http://securityreason.com/securityalert/427 CVE-2006-0573 - http://marc.info/?l=bugtraq&m=113898556313924&w=2 CVE-2006-0575 - http://marc.info/?l=full-disclosure&m=113890734603201&w=2 +CVE-2006-0580 - http://lists.immunitysec.com/pipermail/dailydave/2006-February/002896.html CVE-2006-0581 - http://www.vupen.com/english/advisories/2006/0460 CVE-2006-0583 - http://retrogod.altervista.org/Clever_Copy_V3_sql_xpl.html CVE-2006-0588 - http://securityreason.com/securityalert/413 @@ -3777,6 +3790,8 @@ CVE-2006-0643 - http://securityreason.com/securityalert/421 CVE-2006-0644 - http://dragonflycms.org/Forums/viewtopic/p=98034.html CVE-2006-0644 - http://dragonflycms.org/Forums/viewtopic/p=98034.html#98034 CVE-2006-0645 - http://securityreason.com/securityalert/446 +CVE-2006-0647 - http://lists.immunitysec.com/pipermail/dailydave/2006-February/002914.html +CVE-2006-0647 - http://lists.immunitysec.com/pipermail/dailydave/2006-February/002916.html CVE-2006-0648 - http://evuln.com/vulns/70/summary.html CVE-2006-0648 - http://securityreason.com/securityalert/420 CVE-2006-0653 - http://evuln.com/vulns/59/summary.html @@ -3818,14 +3833,19 @@ CVE-2006-0693 - http://securityreason.com/securityalert/453 CVE-2006-0693 - http://www.evuln.com/vulns/68/summary.html CVE-2006-0694 - http://sourceforge.net/project/shownotes.php?release_id=392826 CVE-2006-0695 - http://sourceforge.net/project/shownotes.php?release_id=392826 +CVE-2006-0696 - http://www.vupen.com/english/advisories/2006/0546 +CVE-2006-0697 - http://www.vupen.com/english/advisories/2006/0546 +CVE-2006-0698 - http://www.vupen.com/english/advisories/2006/0546 CVE-2006-0703 - http://securityreason.com/securityalert/429 CVE-2006-0707 - http://sourceforge.net/project/shownotes.php?release_id=391800 CVE-2006-0708 - http://forums.winamp.com/showthread.php?s=&threadid=238648 CVE-2006-0708 - http://securityreason.com/securityalert/444 CVE-2006-0708 - http://securityreason.com/securityalert/492 +CVE-2006-0710 - http://lists.immunitysec.com/pipermail/dailydave/2006-February/002925.html CVE-2006-0713 - http://securityreason.com/securityalert/426 CVE-2006-0714 - http://securityreason.com/securityalert/432 CVE-2006-0716 - http://securityreason.com/securityalert/431 +CVE-2006-0717 - http://lists.immunitysec.com/pipermail/dailydave/2006-February/002921.html CVE-2006-0719 - http://securityreason.com/securityalert/424 CVE-2006-0720 - http://securityreason.com/securityalert/476 CVE-2006-0722 - http://evuln.com/vulns/73/summary.html @@ -3874,6 +3894,7 @@ CVE-2006-0782 - http://securityreason.com/securityalert/508 CVE-2006-0783 - http://securityreason.com/securityalert/443 CVE-2006-0784 - http://securityreason.com/securityalert/441 CVE-2006-0786 - http://securityreason.com/securityalert/445 +CVE-2006-0790 - http://lists.immunitysec.com/pipermail/dailydave/2006-February/002926.html CVE-2006-0795 - http://evuln.com/vulns/78/summary.html CVE-2006-0797 - http://www.secuobs.com/news/15022006-nokia_n70.shtml#english CVE-2006-0800 - http://securityreason.com/securityalert/454 @@ -3929,6 +3950,7 @@ CVE-2006-0896 - http://securityreason.com/securityalert/545 CVE-2006-0898 - http://securityreason.com/securityalert/488 CVE-2006-0899 - http://securityreason.com/securityalert/518 CVE-2006-0899 - https://www.exploit-db.com/exploits/1533 +CVE-2006-0900 - http://lists.immunitysec.com/pipermail/dailydave/2006-February/002982.html CVE-2006-0900 - http://securityreason.com/securityalert/521 CVE-2006-0903 - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9915 CVE-2006-0907 - http://www.waraxe.us/advisory-47.html @@ -4547,6 +4569,7 @@ CVE-2006-2175 - https://www.exploit-db.com/exploits/1740 CVE-2006-2177 - http://securityreason.com/securityalert/833 CVE-2006-2181 - http://pridels0.blogspot.com/2006/05/albinator-208-remote-file-inclusion.html CVE-2006-2182 - http://pridels0.blogspot.com/2006/05/albinator-208-remote-file-inclusion.html +CVE-2006-2183 - http://lists.immunitysec.com/pipermail/dailydave/2006-April/003152.html CVE-2006-2186 - http://securityreason.com/securityalert/834 CVE-2006-2189 - http://securityreason.com/securityalert/836 CVE-2006-2193 - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9788 @@ -5208,6 +5231,7 @@ CVE-2006-3740 - http://www.vmware.com/support/esx25/doc/esx-254-200702-patch.htm CVE-2006-3740 - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9454 CVE-2006-3743 - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9895 CVE-2006-3745 - http://www.redhat.com/support/errata/RHSA-2006-0617.html +CVE-2006-3746 - http://lists.immunitysec.com/pipermail/dailydave/2006-July/003354.html CVE-2006-3747 - http://securityreason.com/securityalert/1312 CVE-2006-3747 - http://www.vupen.com/english/advisories/2008/1697 CVE-2006-3748 - https://www.exploit-db.com/exploits/2023 @@ -6851,6 +6875,7 @@ CVE-2006-6318 - http://www.vupen.com/english/advisories/2006/4423 CVE-2006-6328 - https://www.exploit-db.com/exploits/2786 CVE-2006-6329 - https://www.exploit-db.com/exploits/2786 CVE-2006-6330 - https://www.exploit-db.com/exploits/2786 +CVE-2006-6332 - http://lists.immunitysec.com/pipermail/dailydave/2006-December/003888.html CVE-2006-6334 - https://www.exploit-db.com/exploits/5106 CVE-2006-6341 - https://www.exploit-db.com/exploits/2794 CVE-2006-6349 - https://www.exploit-db.com/exploits/3015 @@ -7159,6 +7184,7 @@ CVE-2006-6927 - http://securityreason.com/securityalert/2143 CVE-2006-6928 - http://securityreason.com/securityalert/2143 CVE-2006-6929 - http://securityreason.com/securityalert/2142 CVE-2006-6930 - http://securityreason.com/securityalert/2142 +CVE-2006-6931 - http://lists.immunitysec.com/pipermail/dailydave/2007-January/003954.html CVE-2006-6932 - http://securityreason.com/securityalert/2147 CVE-2006-6934 - http://securityreason.com/securityalert/2150 CVE-2006-6935 - http://securityreason.com/securityalert/2150 @@ -7673,6 +7699,10 @@ CVE-2007-0671 - https://learn.microsoft.com/en-us/security-updates/securitybulle CVE-2007-0671 - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A301 CVE-2007-0673 - http://securityreason.com/securityalert/2218 CVE-2007-0674 - http://blog.trendmicro.com/trend-micro-finds-more-windows-mobile-flaws/ +CVE-2007-0675 - http://lists.immunitysec.com/pipermail/dailydave/2007-January/004003.html +CVE-2007-0675 - http://lists.immunitysec.com/pipermail/dailydave/2007-January/004005.html +CVE-2007-0675 - http://lists.immunitysec.com/pipermail/dailydave/2007-January/004007.html +CVE-2007-0675 - http://lists.immunitysec.com/pipermail/dailydave/2007-January/004012.html CVE-2007-0676 - https://www.exploit-db.com/exploits/3234 CVE-2007-0677 - http://echo.or.id/adv/adv63-y3dips-2007.txt CVE-2007-0677 - http://securityreason.com/securityalert/2215 @@ -7947,6 +7977,7 @@ CVE-2007-1167 - https://www.exploit-db.com/exploits/3357 CVE-2007-1171 - http://www.waraxe.us/advisory-53.html CVE-2007-1171 - https://www.exploit-db.com/exploits/3337 CVE-2007-1172 - https://www.exploit-db.com/exploits/3338 +CVE-2007-1189 - http://lists.immunitysec.com/pipermail/dailydave/2007-February/004118.html CVE-2007-1189 - https://www.exploit-db.com/exploits/3383 CVE-2007-1195 - https://www.exploit-db.com/exploits/3385 CVE-2007-1201 - https://docs.microsoft.com/en-us/security-updates/securitybulletins/2008/ms08-017 @@ -7967,6 +7998,7 @@ CVE-2007-1218 - https://oval.cisecurity.org/repository/search/definition/oval%3A CVE-2007-1219 - https://www.exploit-db.com/exploits/3382 CVE-2007-1220 - http://securityreason.com/securityalert/2367 CVE-2007-1221 - http://securityreason.com/securityalert/2367 +CVE-2007-1222 - http://lists.immunitysec.com/pipermail/dailydave/2007-February/004091.html CVE-2007-1224 - https://www.exploit-db.com/exploits/3381 CVE-2007-1225 - https://www.exploit-db.com/exploits/3381 CVE-2007-1226 - http://securityreason.com/securityalert/2342 @@ -9406,6 +9438,11 @@ CVE-2007-3630 - https://www.exploit-db.com/exploits/4163 CVE-2007-3631 - https://www.exploit-db.com/exploits/4159 CVE-2007-3632 - https://www.exploit-db.com/exploits/4156 CVE-2007-3633 - https://www.exploit-db.com/exploits/4160 +CVE-2007-3634 - http://lists.immunitysec.com/pipermail/dailydave/2007-July/004448.html +CVE-2007-3634 - http://lists.immunitysec.com/pipermail/dailydave/2007-July/004452.html +CVE-2007-3634 - http://lists.immunitysec.com/pipermail/dailydave/2007-July/004453.html +CVE-2007-3636 - http://lists.immunitysec.com/pipermail/dailydave/2007-July/004453.html +CVE-2007-3637 - http://lists.immunitysec.com/pipermail/dailydave/2007-July/004448.html CVE-2007-3639 - http://securityreason.com/securityalert/2869 CVE-2007-3640 - http://securityreason.com/securityalert/2882 CVE-2007-3641 - http://www.novell.com/linux/security/advisories/2007_15_sr.html @@ -9459,6 +9496,8 @@ CVE-2007-3774 - http://securityreason.com/securityalert/2886 CVE-2007-3775 - http://www.cisco.com/warp/public/707/cisco-sa-20070711-voip.shtml CVE-2007-3776 - http://www.cisco.com/warp/public/707/cisco-sa-20070711-voip.shtml CVE-2007-3777 - http://securityreason.com/securityalert/2887 +CVE-2007-3778 - http://lists.immunitysec.com/pipermail/dailydave/2007-July/004452.html +CVE-2007-3778 - http://lists.immunitysec.com/pipermail/dailydave/2007-July/004456.html CVE-2007-3778 - http://www.attrition.org/pipermail/vim/2007-July/001704.html CVE-2007-3778 - http://www.attrition.org/pipermail/vim/2007-July/001710.html CVE-2007-3778 - https://exchange.xforce.ibmcloud.com/vulnerabilities/35363 @@ -11247,6 +11286,7 @@ CVE-2008-0096 - http://aluigi.altervista.org/adv/gswsshit-adv.txt CVE-2008-0096 - http://securityreason.com/securityalert/3517 CVE-2008-0097 - http://aluigi.altervista.org/adv/gswsshit-adv.txt CVE-2008-0097 - http://securityreason.com/securityalert/3517 +CVE-2008-0098 - http://lists.immunitysec.com/pipermail/dailydave/2008-January/004811.html CVE-2008-0099 - https://www.exploit-db.com/exploits/4831 CVE-2008-0100 - http://aluigi.altervista.org/adv/whitedunboffs-adv.txt CVE-2008-0100 - http://securityreason.com/securityalert/3516 @@ -14630,6 +14670,7 @@ CVE-2008-4428 - http://securityreason.com/securityalert/4349 CVE-2008-4428 - https://www.exploit-db.com/exploits/6231 CVE-2008-4432 - http://lostmon.blogspot.com/2008/08/rmsoft-minishop-module-multiple.html CVE-2008-4433 - http://lostmon.blogspot.com/2008/08/rmsoft-minishop-module-multiple.html +CVE-2008-4434 - http://lists.immunitysec.com/pipermail/dailydave/attachments/20080811/35d6194b/attachment-0001.pdf CVE-2008-4436 - http://securityreason.com/securityalert/4351 CVE-2008-4436 - https://www.exploit-db.com/exploits/6233 CVE-2008-4440 - https://bugs.gentoo.org/show_bug.cgi?id=235770 @@ -14815,6 +14856,7 @@ CVE-2008-4605 - http://securityreason.com/securityalert/4434 CVE-2008-4605 - https://www.exploit-db.com/exploits/6762 CVE-2008-4606 - http://securityreason.com/securityalert/4435 CVE-2008-4606 - https://www.exploit-db.com/exploits/6765 +CVE-2008-4609 - http://lists.immunitysec.com/pipermail/dailydave/2008-October/005360.html CVE-2008-4609 - http://searchsecurity.techtarget.com.au/articles/27154-TCP-is-fundamentally-borked CVE-2008-4609 - http://www.mandriva.com/security/advisories?name=MDVSA-2013:150 CVE-2008-4609 - http://www.oracle.com/technetwork/topics/security/cpujul2012-392727.html @@ -15429,6 +15471,7 @@ CVE-2008-5225 - http://securityreason.com/securityalert/4638 CVE-2008-5226 - http://securityreason.com/securityalert/4630 CVE-2008-5226 - https://www.exploit-db.com/exploits/5692 CVE-2008-5229 - http://securityreason.com/securityalert/4646 +CVE-2008-5230 - http://lists.immunitysec.com/pipermail/dailydave/2008-November/005413.html CVE-2008-5230 - http://radajo.blogspot.com/2008/11/wpatkip-chopchop-attack.html CVE-2008-5230 - http://www.aircrack-ng.org/doku.php?id=tkiptun-ng CVE-2008-5232 - http://packetstormsecurity.org/0808-exploits/wms-overflow.txt @@ -17601,6 +17644,7 @@ CVE-2009-0834 - http://www.vmware.com/security/advisories/VMSA-2009-0016.html CVE-2009-0834 - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9600 CVE-2009-0835 - http://www.ubuntu.com/usn/usn-751-1 CVE-2009-0836 - http://blog.zoller.lu/2009/03/remote-code-execution-in-pdf-still.html +CVE-2009-0836 - http://lists.immunitysec.com/pipermail/dailydave/2010-April/006079.html CVE-2009-0836 - http://www.coresecurity.com/content/foxit-reader-vulnerabilities CVE-2009-0837 - http://www.coresecurity.com/content/foxit-reader-vulnerabilities CVE-2009-0844 - http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2009-001.txt @@ -19723,6 +19767,7 @@ CVE-2009-4477 - http://www.exploit-db.com/exploits/9565 CVE-2009-4478 - http://www.exploit-db.com/exploits/9565 CVE-2009-4484 - http://bugs.mysql.com/bug.php?id=50227 CVE-2009-4484 - http://isc.sans.org/diary.html?storyid=7900 +CVE-2009-4484 - http://lists.immunitysec.com/pipermail/dailydave/2010-January/006020.html CVE-2009-4484 - http://yassl.cvs.sourceforge.net/viewvc/yassl/yassl/taocrypt/src/asn.cpp?r1=1.13&r2=1.14 CVE-2009-4484 - https://bugzilla.redhat.com/show_bug.cgi?id=555313 CVE-2009-4487 - http://www.ush.it/team/ush/hack_httpd_escape/adv.txt @@ -19928,6 +19973,8 @@ CVE-2009-4759 - http://www.exploit-db.com/exploits/8607 CVE-2009-4760 - http://www.exploit-db.com/exploits/8596 CVE-2009-4761 - http://www.exploit-db.com/exploits/8589 CVE-2009-4761 - http://www.exploit-db.com/exploits/8594 +CVE-2009-4764 - http://lists.immunitysec.com/pipermail/dailydave/2010-April/006072.html +CVE-2009-4764 - http://lists.immunitysec.com/pipermail/dailydave/2010-April/006074.html CVE-2009-4765 - http://packetstormsecurity.org/1001-exploits/aspcnrhikaye-disclose.txt CVE-2009-4766 - http://packetstormsecurity.org/1001-exploits/ypportal-disclose.txt CVE-2009-4767 - http://www.exploit-db.com/exploits/10168 @@ -46321,6 +46368,7 @@ CVE-2016-10548 - https://gist.github.com/ChALkeR/415a41b561ebea9b341efbb40b802fc CVE-2016-10554 - https://github.com/sequelize/sequelize/commit/c876192aa6ce1f67e22b26a4d175b8478615f42d CVE-2016-10701 - http://jira.pentaho.com/browse/BISERVER-13207 CVE-2016-10701 - http://jira.pentaho.com/browse/BISERVER-3562 +CVE-2016-10701 - http://jira.pentaho.com/browse/BISERVER-6599 CVE-2016-10702 - https://blog.fletchto99.com/2016/november/pebble-app-sandbox-escape/ CVE-2016-10705 - https://wpvulndb.com/vulnerabilities/8517 CVE-2016-10706 - https://www.wordfence.com/blog/2016/05/jetpack-vulnerability/ @@ -80479,10 +80527,13 @@ CVE-2020-15871 - https://hackerone.com/reports/917843 CVE-2020-15871 - https://support.sonatype.com CVE-2020-15871 - https://support.sonatype.com/hc/en-us/articles/360052192693 CVE-2020-15873 - https://research.loginsoft.com/bugs/blind-sql-injection-in-librenms/ +CVE-2020-15874 - https://shielder.it/blog CVE-2020-15874 - https://www.shielder.com/advisories/librenms-graph-authenticated-command-injection/ +CVE-2020-15876 - https://shielder.it/blog CVE-2020-15876 - https://www.shielder.com/advisories/librenms-searchphrase-authenticated-sql-injection/ CVE-2020-15877 - https://github.com/librenms/librenms/pull/11915 CVE-2020-15877 - https://shielder.it/blog +CVE-2020-15878 - https://shielder.it/blog CVE-2020-15878 - https://www.shielder.com/advisories/librenms-address-authenticated-sql-injection/ CVE-2020-15881 - https://github.com/munkireport/munkireport-php/releases/tag/v5.6.3 CVE-2020-15882 - https://github.com/munkireport/munkireport-php/releases @@ -88496,6 +88547,7 @@ CVE-2021-22174 - https://www.oracle.com/security-alerts/cpuApr2021.html CVE-2021-22175 - https://gitlab.com/gitlab-org/gitlab/-/issues/294178 CVE-2021-22176 - https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22176.json CVE-2021-2218 - https://www.oracle.com/security-alerts/cpuapr2021.html +CVE-2021-22182 - https://gitlab.com/gitlab-org/gitlab/-/issues/280779 CVE-2021-2219 - https://www.oracle.com/security-alerts/cpuapr2021.html CVE-2021-22191 - https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22191.json CVE-2021-22191 - https://gitlab.com/wireshark/wireshark/-/issues/17232 @@ -94145,6 +94197,7 @@ CVE-2021-37220 - https://bugs.ghostscript.com/show_bug.cgi?id=703791 CVE-2021-37221 - https://www.exploit-db.com/exploits/50046 CVE-2021-37253 - http://packetstormsecurity.com/files/165139/M-Files-Web-Denial-Of-Service.html CVE-2021-37253 - http://seclists.org/fulldisclosure/2021/Dec/1 +CVE-2021-37253 - https://vulmon.com/vulnerabilitydetails?qid=CVE-2021-37253 CVE-2021-37253 - https://www.tenable.com/cve/CVE-2021-37253 CVE-2021-3728 - https://huntr.dev/bounties/dd54c5a1-0d4a-4f02-a111-7ce4ddc67a4d CVE-2021-3729 - https://huntr.dev/bounties/d32f3d5a-0738-41ba-89de-34f2a772de76 @@ -109583,6 +109636,7 @@ CVE-2023-0952 - https://devolutions.net/security/advisories/DEVO-2023-0003 CVE-2023-0953 - https://devolutions.net/security/advisories/DEVO-2023-0003 CVE-2023-0954 - https://www.johnsoncontrols.com/cyber-solutions/security-advisories CVE-2023-0955 - https://wpscan.com/vulnerability/18b7e93f-b038-4f28-918b-4015d62f0eb8 +CVE-2023-0957 - https://snyk.io/blog/gitpod-remote-code-execution-vulnerability-websockets/ CVE-2023-0961 - https://github.com/navaidzansari/CVE_Demo/blob/main/2023/Music%20Gallery%20Site%20-%20SQL%20Injection%202.md CVE-2023-0961 - https://vuldb.com/?id.221631 CVE-2023-0962 - https://github.com/navaidzansari/CVE_Demo/blob/main/2023/Music%20Gallery%20Site%20-%20SQL%20Injection%203.md @@ -122632,6 +122686,7 @@ CVE-2024-25730 - https://github.com/actuator/cve/blob/main/Hitron/CVE-2024-25730 CVE-2024-25734 - http://packetstormsecurity.com/files/177081 CVE-2024-25734 - http://seclists.org/fulldisclosure/2024/Feb/9 CVE-2024-25735 - http://packetstormsecurity.com/files/177082 +CVE-2024-25735 - http://seclists.org/fulldisclosure/2024/Feb/11 CVE-2024-25736 - http://packetstormsecurity.com/files/177083 CVE-2024-25736 - http://seclists.org/fulldisclosure/2024/Feb/8 CVE-2024-25739 - https://cert-portal.siemens.com/productcert/html/ssa-265688.html @@ -127823,6 +127878,7 @@ CVE-2024-48953 - https://servicedesk.logpoint.com/hc/en-us/articles/219688991282 CVE-2024-48953 - https://servicedesk.logpoint.com/hc/en-us/sections/7201103730845-Product-Security CVE-2024-48954 - https://servicedesk.logpoint.com/hc/en-us/articles/21968851138461-Remote-Code-Execution-RCE-in-EventHub-Collector CVE-2024-48954 - https://servicedesk.logpoint.com/hc/en-us/sections/7201103730845-Product-Security +CVE-2024-48955 - https://vulmon.com/vulnerabilitydetails?qid=CVE-2024-48955&sortby=bydate CVE-2024-48956 - https://security.serviceware-se.com/CVE-2024-48956/ CVE-2024-48957 - https://github.com/terrynini/CVE-Reports/blob/main/CVE-2024-48957/README.md CVE-2024-48958 - http://seclists.org/fulldisclosure/2025/Apr/11 @@ -128805,6 +128861,7 @@ CVE-2024-55009 - https://youtu.be/1mSgChs-a8Q CVE-2024-55009 - https://youtu.be/SHk3mdsd2mI CVE-2024-55016 - https://github.com/leexsoyoung/CVEs/blob/main/CVE-2024-55016.md CVE-2024-55040 - https://github.com/tcbutler320/Sensaphone-WEB600-XSS +CVE-2024-55040 - https://vulmon.com/vulnerabilitydetails?qid=CVE-2024-55040 CVE-2024-55056 - https://github.com/SCR-athif/CVE/tree/main/CVE-2024-55056 CVE-2024-55057 - https://github.com/SCR-athif/CVE/tree/main/CVE-2024-55057 CVE-2024-55058 - https://github.com/SCR-athif/CVE/tree/main/CVE-2024-55058 @@ -130246,6 +130303,7 @@ CVE-2024-7700 - https://access.redhat.com/security/cve/CVE-2024-7700 CVE-2024-7704 - https://github.com/Dreamy-elfland/240731 CVE-2024-7704 - https://vuldb.com/?ctiid.274182 CVE-2024-7705 - https://github.com/DeepMountains/Mirage/blob/main/CVE12-1.md +CVE-2024-7705 - https://vuldb.com/?ctiid.274183 CVE-2024-7706 - https://github.com/DeepMountains/Mirage/blob/main/CVE12-2.md CVE-2024-7706 - https://vuldb.com/?id.274184 CVE-2024-7707 - https://github.com/VodkaVortex/IoT/blob/main/formSafeEmailFilter.md @@ -140938,6 +140996,7 @@ CVE-2025-6121 - https://github.com/xiaobor123/vul-finds/tree/main/vul-find-dir63 CVE-2025-6122 - https://github.com/ez-lbz/poc/issues/3 CVE-2025-61224 - https://github.com/MarioTesoro/vulnerability-research/tree/main/CVE-2025-61224 CVE-2025-6123 - https://github.com/ez-lbz/poc/issues/1 +CVE-2025-6123 - https://vuldb.com/?ctiid.312592 CVE-2025-61234 - https://github.com/stuxve/expose-service-8888-dataphone CVE-2025-61235 - https://github.com/stuxve/poc-dataphone-crafted-packet CVE-2025-6124 - https://github.com/ez-lbz/poc/issues/4 @@ -145933,6 +145992,7 @@ CVE-2026-13766 - https://github.com/exodist/DBIx-QuickORM/commit/43d768468205078 CVE-2026-13775 - https://issues.chromium.org/issues/511766407 CVE-2026-13778 - https://issues.chromium.org/issues/513167952 CVE-2026-13779 - https://issues.chromium.org/issues/513222854 +CVE-2026-13780 - https://issues.chromium.org/issues/514769383 CVE-2026-13790 - https://issues.chromium.org/issues/457771782 CVE-2026-13800 - https://issues.chromium.org/issues/500108770 CVE-2026-13802 - https://issues.chromium.org/issues/501623322 @@ -146069,6 +146129,7 @@ CVE-2026-14300 - https://wpscan.com/vulnerability/7ecf657b-b059-4420-8c36-f38d58 CVE-2026-14304 - https://github.com/eclipse-actf/org.eclipse.actf CVE-2026-14305 - https://wpscan.com/vulnerability/6a2aecc7-3fbb-4d63-b1ac-4f8243ca872b/ CVE-2026-14306 - https://wpscan.com/vulnerability/0da44ad7-a5a7-4559-b2ae-3b7f0b0ce1bf/ +CVE-2026-14307 - https://wpscan.com/vulnerability/5f55b592-9113-47d1-8b48-6ba785c0834a/ CVE-2026-14309 - https://wpscan.com/vulnerability/82f14006-c05f-421d-9ba5-bc745e0b2ab8/ CVE-2026-14310 - https://wpscan.com/vulnerability/8fa51eaf-5205-492c-bcf7-81136dbf12d4/ CVE-2026-14313 - https://wpscan.com/vulnerability/61d6aab4-7753-4a86-8b7e-81daa61654e8/ @@ -146254,6 +146315,7 @@ CVE-2026-14831 - https://wpscan.com/vulnerability/1a64d797-7807-42e3-aca7-d93ecb CVE-2026-14832 - https://wpscan.com/vulnerability/3b651e19-37f5-468e-8d0b-a82bbe04eaf2/ CVE-2026-14833 - https://wpscan.com/vulnerability/aae59cb8-b259-464e-a86b-164d89f61342/ CVE-2026-14834 - https://wpscan.com/vulnerability/84135fff-e602-4773-8e79-a831284de0d2/ +CVE-2026-14835 - https://wpscan.com/vulnerability/f0b869b1-ef43-4540-9ca5-4440e763d307/ CVE-2026-14836 - https://wpscan.com/vulnerability/9bdb7959-dbe7-4f48-892b-b9ee4c8eb060/ CVE-2026-14839 - https://wpscan.com/vulnerability/1994e67d-5fdc-445f-a09d-2b25d2b2f445/ CVE-2026-1484 - https://cert-portal.siemens.com/productcert/html/ssa-253495.html @@ -146300,6 +146362,8 @@ CVE-2026-15013 - http://seclists.org/fulldisclosure/2026/Aug/33 CVE-2026-15028 - https://github.com/libarchive/libarchive/issues/3251 CVE-2026-15032 - https://wpscan.com/vulnerability/e77ea3fb-4d38-4fa7-a50b-1a0078f34474/ CVE-2026-15033 - https://github.com/christopherthielen/check-peer-dependencies/issues/74 +CVE-2026-15034 - https://github.com/flask-dashboard/Flask-MonitoringDashboard/issues/557 +CVE-2026-15035 - https://github.com/bentoml/OpenLLM/issues/1229 CVE-2026-15036 - https://github.com/harness/harness/issues/3689 CVE-2026-15038 - https://wpscan.com/vulnerability/629d655f-cdb8-4733-81d5-12fa88c32bb6/ CVE-2026-15039 - https://wpscan.com/vulnerability/b7b3308c-430e-4bc3-a3df-da20d47cf314/ @@ -146316,9 +146380,13 @@ CVE-2026-15058 - https://devolutions.net/security/advisories/DEVO-2026-0024/ CVE-2026-15059 - https://github.com/systemd/systemd/security/advisories/GHSA-652q-wxr6-h5j6 CVE-2026-15060 - https://github.com/systemd/systemd/security/advisories/GHSA-qwv4-3gwc-w5g8 CVE-2026-1508 - https://wpscan.com/vulnerability/fc1d577b-abf9-4c15-a96d-14ebd894debc/ +CVE-2026-15105 - https://github.com/davenardella/snap7/issues/16 +CVE-2026-15105 - https://github.com/user-attachments/files/28681740/poc.zip CVE-2026-15134 - https://github.com/yihaofuweng/cve/issues/71 +CVE-2026-15135 - https://github.com/susususua-AI/CVE/issues/1 CVE-2026-15135 - https://vuldb.com/submit/851065 CVE-2026-15137 - https://github.com/susususua-AI/CVE/issues/2 +CVE-2026-15138 - https://github.com/tumf/mcp-text-editor/issues/22 CVE-2026-15147 - https://wpscan.com/vulnerability/9cfa5856-3c30-451d-895e-3d68208d834d/ CVE-2026-15148 - https://wpscan.com/vulnerability/08d4761f-ddc6-48f4-909e-db38438e385e/ CVE-2026-15149 - https://wpscan.com/vulnerability/9c1df017-dfa5-43c4-b31e-43c9315edab1/ @@ -146336,6 +146404,7 @@ CVE-2026-15170 - https://gitlab.com/wireshark/wireshark/-/work_items/21397 CVE-2026-15171 - https://gitlab.com/wireshark/wireshark/-/work_items/21378 CVE-2026-15182 - https://github.com/LibreDWG/libredwg/issues/1249 CVE-2026-15182 - https://github.com/LibreDWG/libredwg/issues/1252 +CVE-2026-15184 - https://github.com/LibreDWG/libredwg/issues/1253 CVE-2026-15184 - https://vuldb.com/submit/851192 CVE-2026-15185 - https://github.com/gpac/gpac/issues/3611 CVE-2026-15187 - https://github.com/enquirer/enquirer/issues/487 @@ -146343,9 +146412,13 @@ CVE-2026-15187 - https://github.com/enquirer/enquirer/issues/487#issuecomment-46 CVE-2026-15188 - https://github.com/manjurulhoque/django-job-portal/issues/91 CVE-2026-15190 - https://github.com/zainaakinyi45-boop/cve/issues/1 CVE-2026-15191 - https://github.com/mettle/sendportal/issues/339 +CVE-2026-15192 - https://github.com/mettle/sendportal/issues/340 CVE-2026-15193 - https://github.com/AidanPark/openclaw-android/issues/136 +CVE-2026-15194 - https://github.com/open5gs/open5gs/security/advisories/GHSA-88pq-hpwv-2vjw +CVE-2026-15195 - https://github.com/APIDevTools/json-schema-ref-parser/issues/421 CVE-2026-1520 - https://github.com/59lab/dbdb/blob/main/There%20is%20a%20cross-site%20scripting(XSS)%20vulnerability%20in%20the%20rethinkdb%20database.md CVE-2026-1520 - https://github.com/59lab/dbdb/blob/main/There%20is%20a%20cross-site%20scripting(XSS)%20vulnerability%20in%20the%20rethinkdb%20database.md#poc +CVE-2026-15204 - https://github.com/meishigana/CVE/tree/main/totolink_x5000r_exportovpn_file_disclosure_2026-06-09 CVE-2026-15205 - https://wpscan.com/vulnerability/cbde48bb-5aa4-4f69-8101-095132239923/ CVE-2026-15206 - https://wpscan.com/vulnerability/d0bb4c41-392a-4209-9e44-93dbf3898417/ CVE-2026-15208 - https://wpscan.com/vulnerability/b8c75098-41a9-4b24-9f6b-c3144f230cd8/ @@ -146388,9 +146461,15 @@ CVE-2026-15257 - https://wpscan.com/vulnerability/fe6d0f6a-c2b4-4cd1-a7d2-e3afec CVE-2026-15258 - https://wpscan.com/vulnerability/9e20442b-047b-46fe-be72-89c637deb6bc/ CVE-2026-15260 - https://wpscan.com/vulnerability/6ba28169-0746-44a4-b622-1cd6b9a65608/ CVE-2026-15262 - https://wpscan.com/vulnerability/dea1f3a9-2681-47a6-9e36-9d6ea799decb/ +CVE-2026-15274 - https://github.com/lo48576/fbxcel/issues/14 CVE-2026-15276 - https://github.com/pdeljanov/Symphonia/issues/508 CVE-2026-15276 - https://github.com/pdeljanov/Symphonia/pull/514 +CVE-2026-15311 - https://github.com/NousResearch/hermes-agent/issues/42667 +CVE-2026-15311 - https://github.com/NousResearch/hermes-agent/pull/42759 +CVE-2026-15317 - https://github.com/sipeed/picoclaw/issues/3078 +CVE-2026-15318 - https://github.com/sipeed/picoclaw/issues/3068 CVE-2026-15319 - https://github.com/sipeed/picoclaw/issues/3069 +CVE-2026-15320 - https://github.com/sipeed/picoclaw/issues/3071 CVE-2026-15321 - https://github.com/MyEMS/myems/issues/412 CVE-2026-15326 - https://github.com/halo-dev/halo/issues/10062 CVE-2026-15329 - https://github.com/zhayujie/CowAgent/issues/2871 @@ -146398,6 +146477,7 @@ CVE-2026-15329 - https://github.com/zhayujie/CowAgent/issues/2871#issuecomment-4 CVE-2026-1533 - https://github.com/yuji0903/silver-guide/issues/2 CVE-2026-15330 - https://github.com/zhayujie/CowAgent/issues/2872 CVE-2026-15331 - https://github.com/zhayujie/CowAgent/issues/2873 +CVE-2026-15332 - https://github.com/zhayujie/CowAgent/issues/2874 CVE-2026-1534 - https://github.com/yuji0903/silver-guide/issues/3 CVE-2026-1535 - https://github.com/yuji0903/silver-guide/issues/4 CVE-2026-15359 - https://wpscan.com/vulnerability/d4749a25-f3fa-4908-9532-3ae7c1c38a58/ @@ -146406,11 +146486,14 @@ CVE-2026-15361 - https://wpscan.com/vulnerability/3fa62b23-a0a7-4b42-b8dd-0eb6e0 CVE-2026-15368 - https://wpscan.com/vulnerability/df1eb738-15bf-4f8b-aa06-e0a42f1e9c2e/ CVE-2026-15372 - https://wpscan.com/vulnerability/a8d697c9-6de4-4a28-be9e-7d42abcb6c7e/ CVE-2026-15373 - https://drive.google.com/file/d/1QqpeH0qWsSnSiMvPeRJvRSylwLGK3hsN/view?usp=sharing +CVE-2026-15373 - https://github.com/omarelshopky/cves/tree/main/eleveo/call-recording-software/CVE-2026-15373 CVE-2026-15374 - https://drive.google.com/file/d/1GtIZC_PrOJPfQAfjcBckEbf8uDzGjt9B/view?usp=sharing +CVE-2026-15374 - https://github.com/omarelshopky/cves/tree/main/eleveo/call-recording-software/CVE-2026-15374 CVE-2026-15375 - https://drive.google.com/file/d/14q47WM7nqXuUJbN-3xTXzCIbMUwD1kL8/view?usp=sharing CVE-2026-15375 - https://github.com/omarelshopky/cves/blob/main/eleveo/call-recording-software/CVE-2026-15375 CVE-2026-15375 - https://github.com/omarelshopky/cves/tree/main/eleveo/call-recording-software/CVE-2026-15375 CVE-2026-15376 - https://drive.google.com/file/d/18l6-Lpvqq1B-ureww1zR5d_nyhZl312q/view?usp=sharing +CVE-2026-15376 - https://github.com/omarelshopky/cves/tree/main/eleveo/call-recording-software/CVE-2026-15376 CVE-2026-15377 - https://drive.google.com/file/d/1qnAoRYVrMeB4fhtLV4XFZOVrzVM3UeHx/view?usp=sharing CVE-2026-15377 - https://github.com/omarelshopky/cves/tree/main/eleveo/call-recording-software/CVE-2026-15377 CVE-2026-15381 - https://wpscan.com/vulnerability/9676af2f-8871-4715-b420-082b1afeb7b4/ @@ -146420,6 +146503,7 @@ CVE-2026-15384 - https://wpscan.com/vulnerability/706d0b6a-d136-4317-a767-33bcab CVE-2026-15385 - https://wpscan.com/vulnerability/b13b19c6-b6e1-45eb-95f3-ac334bda8b84/ CVE-2026-15386 - https://wpscan.com/vulnerability/f76518ec-3abb-4b3c-b592-f5e24059304b/ CVE-2026-15388 - https://wpscan.com/vulnerability/e322dfb6-66b3-4deb-98ba-a19707e5a7e1/ +CVE-2026-15392 - https://github.com/perl5-dbi/dbi/security/advisories/GHSA-mh3j-xwf4-jrqw CVE-2026-15392 - https://metacpan.org/release/HMBRAND/DBI-1.651/changes CVE-2026-1540 - https://wpscan.com/vulnerability/ad00d1bb-ea8d-44a3-9064-6412804d9e95/ CVE-2026-15413 - https://wpscan.com/vulnerability/4cad269d-0146-4ca9-a1ae-55f02c8e5433/ @@ -146440,66 +146524,101 @@ CVE-2026-15471 - https://github.com/omarelshopky/cves/tree/main/eleveo/call-reco CVE-2026-15472 - https://drive.google.com/file/d/1Cyt_9wlVx8n_9Hu6Ygo4Goy2aBCUgNs0/view?usp=sharing CVE-2026-15472 - https://github.com/omarelshopky/cves/tree/main/eleveo/call-recording-software/CVE-2026-15472 CVE-2026-15473 - https://drive.google.com/file/d/1YhkazmU_1YQj9lzvwIBDzA-41fe2eayc/view?usp=sharing +CVE-2026-15473 - https://github.com/omarelshopky/cves/tree/main/eleveo/call-recording-software/CVE-2026-15473 CVE-2026-15474 - https://drive.google.com/file/d/14r-7V9dJHuoBPpuSj-puFzujq149Mbry/view?usp=sharing +CVE-2026-15474 - https://github.com/omarelshopky/cves/tree/main/eleveo/call-recording-software/CVE-2026-15474 CVE-2026-15475 - https://winslow1984.com/books/cve-collection/page/minitool-partition-wizard-kernel-driver-pwdrviosys-local-privilege-escalation CVE-2026-15476 - https://winslow1984.com/books/cve-collection/page/qiling-disk-master-kernel-driver-diskbckpsys-6-0-0-0-local-privilege-escalation CVE-2026-15477 - https://bahmni.atlassian.net/wiki/spaces/BAH/pages/5519474693/Bahmni+Security+Patch+July+02+2026+Release+Notes +CVE-2026-15478 - https://github.com/gamonoid/icehrm/issues/376 CVE-2026-1548 - https://github.com/xyh4ck/iot_poc/blob/main/TOTOLINK/A7000R/02_RCE_CloudACMunualUpdateUserdata_RCE.md CVE-2026-1548 - https://github.com/xyh4ck/iot_poc/blob/main/TOTOLINK/A7000R/02_RCE_CloudACMunualUpdateUserdata_RCE.md#poc CVE-2026-1548 - https://vuldb.com/?submit.739715 +CVE-2026-15480 - https://github.com/glkfc/IoT-Vulnerability/blob/main/TRENDnet/TRENDnet_TEW635BRM_device_name_BOF_EN.md +CVE-2026-15481 - https://github.com/glkfc/IoT-Vulnerability/blob/main/TRENDnet/TRENDnet_TEW635BRM_ipoa_cmdinj_EN.md CVE-2026-1549 - https://github.com/jishenghua/jshERP/issues/146 CVE-2026-1549 - https://github.com/jishenghua/jshERP/issues/146#issue-3817997461 CVE-2026-15494 - https://github.com/MichaelZhuang521/cve/issues/4 +CVE-2026-15495 - https://github.com/xpp3901/CVE_APPLY/tree/main/V-S003_SonicAgent_pullFile_CmdInjection_RCE +CVE-2026-15496 - https://github.com/xpp3901/CVE_APPLY/tree/main/V-S002_SonicCloudPlatform_Groovy_Unsandboxed_RCE CVE-2026-15497 - https://github.com/xpp3901/CVE_APPLY/blob/main/V-S001_SonicCloudPlatform_Unauth_ExchangeSend +CVE-2026-15499 - https://gist.github.com/YLChen-007/2bab96d5bedef784f90c97009fff8a19 CVE-2026-15500 - https://gist.github.com/YLChen-007/cd162554554c273a3a7c0330aa02f3f0 +CVE-2026-15501 - https://gist.github.com/YLChen-007/b68732c140fb11d844b214cf2db50a5a +CVE-2026-15506 - https://github.com/Kalagious/SecureAgeExploit +CVE-2026-15508 - https://github.com/oscar2744/CVE-Submit/issues/1 CVE-2026-15509 - https://bytium.com/insights/leantime-priv-escalation-vulnerability-low-priv-to-owner CVE-2026-15513 - https://github.com/0xcc12138/wavlink-nu516u1-csrf-command-injection- +CVE-2026-15515 - https://github.com/subsubsub1231/qmukiller CVE-2026-15516 - https://github.com/trustbigcat/CVE/ +CVE-2026-15517 - https://github.com/weini587/CVE/issues/1 CVE-2026-15518 - https://bytium.com/insights/authenticated-arbitrary-file-upload-to-rce-in-twill-cms CVE-2026-15519 - https://github.com/ez-lbz/strix-vul-report CVE-2026-1552 - https://github.com/Sqli22/Sqli/issues/4 CVE-2026-15520 - https://github.com/LibreDWG/libredwg/issues/1251 CVE-2026-15521 - https://github.com/makafeli/n8n-workflow-builder/issues/28 +CVE-2026-15522 - https://github.com/tugcantopaloglu/godot-mcp/issues/9 CVE-2026-15523 - https://github.com/wsx138/cve/issues/2 +CVE-2026-15524 - https://github.com/alioshr/memory-bank-mcp/issues/36 CVE-2026-15525 - https://github.com/kLOsk/adloop/issues/41 CVE-2026-15525 - https://github.com/kLOsk/adloop/releases/tag/v0.10.0 CVE-2026-15526 - https://github.com/augmnt/augments-mcp-server/issues/8 +CVE-2026-15527 - https://github.com/better-auth/better-icons/issues/18 +CVE-2026-15528 - https://github.com/lamaalrajih/kicad-mcp/issues/57 CVE-2026-15529 - https://github.com/yzhao062/pyod/issues/697 +CVE-2026-15530 - https://github.com/wuzhicms/wuzhicms/issues/217 CVE-2026-15533 - https://vuldb.com/submit/854988 +CVE-2026-15535 - https://github.com/AkariAsai/self-rag/issues/105 CVE-2026-15536 - https://github.com/ltranquility/submit_vuln/issues/7 +CVE-2026-15558 - https://github.com/sl1der-fr0g/Findings/issues/2 CVE-2026-15559 - https://github.com/sl1der-fr0g/Findings/issues/3 CVE-2026-15595 - https://github.com/AlbaDove/cve/issues/6 CVE-2026-15596 - https://github.com/AlbaDove/cve/issues/5 CVE-2026-15597 - https://github.com/asdasddqwdq29-a11y/new-cve/issues/1 CVE-2026-15598 - https://github.com/antvis/layout/issues/292 +CVE-2026-15605 - https://github.com/wandb/wandb/issues/12030 CVE-2026-15607 - https://github.com/TanStack/db/issues/1584 CVE-2026-15618 - https://github.com/mosaxiv/clawlet/issues/12 CVE-2026-15619 - https://github.com/mosaxiv/clawlet/issues/13 CVE-2026-15620 - https://github.com/mosaxiv/clawlet/issues/14 +CVE-2026-15621 - https://github.com/mosaxiv/clawlet/issues/15 +CVE-2026-15622 - https://github.com/poco-ai/poco-claw/issues/133 +CVE-2026-15624 - https://github.com/nextlevelbuilder/goclaw/issues/1199 CVE-2026-15625 - https://github.com/nextlevelbuilder/goclaw/issues/1200 CVE-2026-15625 - https://github.com/nextlevelbuilder/goclaw/issues/1200#issuecomment-4760771866 CVE-2026-15626 - https://github.com/nextlevelbuilder/goclaw/issues/1201 CVE-2026-15626 - https://github.com/nextlevelbuilder/goclaw/issues/1201#issuecomment-4760748680 +CVE-2026-15627 - https://github.com/nextlevelbuilder/goclaw/issues/1207 +CVE-2026-15627 - https://github.com/nextlevelbuilder/goclaw/issues/1207#issuecomment-4760370546 CVE-2026-15628 - https://github.com/zhayujie/CowAgent/issues/2878 CVE-2026-15629 - https://github.com/louisho5/picobot/issues/40 CVE-2026-15637 - https://devolutions.net/security/advisories/DEVO-2026-0024/ CVE-2026-15641 - https://devolutions.net/security/advisories/DEVO-2026-0024/ CVE-2026-15642 - https://devolutions.net/security/advisories/DEVO-2026-0024/ CVE-2026-15668 - https://github.com/louisho5/picobot/issues/41 +CVE-2026-15669 - https://github.com/louisho5/picobot/issues/42 +CVE-2026-15669 - https://github.com/louisho5/picobot/issues/43 CVE-2026-15672 - https://github.com/sjmycz/cve/issues/1 CVE-2026-15675 - https://github.com/shihuizhang-dazhi/MY-CVE/issues/3 CVE-2026-15676 - https://github.com/shihuizhang-dazhi/MY-CVE/issues/4 CVE-2026-15677 - https://github.com/shihuizhang-dazhi/MY-CVE/issues/6 CVE-2026-15678 - https://github.com/shihuizhang-dazhi/MY-CVE/issues/7 +CVE-2026-15686 - https://github.com/vrana/adminer/security/advisories/GHSA-3582-q6xq-5vf7#event-826206 +CVE-2026-15691 - https://github.com/cve-a/dexingzhiqing/issues/1 CVE-2026-15692 - https://github.com/cve-a/dexingzhiqing/issues/2 CVE-2026-15693 - https://github.com/cve-a/dexingzhiqing/issues/3 +CVE-2026-15694 - https://github.com/cve-a/dexingzhiqing/issues/4 CVE-2026-15695 - https://github.com/cve-a/dexingzhiqing/issues/5 +CVE-2026-15696 - https://github.com/cve-a/dexingzhiqing/issues/6 CVE-2026-15698 - https://github.com/kofrasa/mingo/issues/606 CVE-2026-15699 - https://github.com/spencermountain/compromise/issues/1208 +CVE-2026-15701 - https://github.com/fu9-dotom/cve/issues/1 CVE-2026-15703 - https://github.com/Wut-sys/cve/issues/1 CVE-2026-15715 - https://github.com/AlbaDove/cve/issues/7 +CVE-2026-15732 - https://github.com/Stuub/WGDashboard-v4.3.2-Full-Read-SSRF-via-Webhooks-PoC CVE-2026-15733 - https://github.com/Stuub/WGDashboard-v4.3.2-OS-Command-Injection-to-Root-RCE-PoC CVE-2026-15734 - https://github.com/Stuub/WGDashboard-v4.3.2-SSTI-to-Root-RCE-PoC +CVE-2026-15749 - https://github.com/mastergo-design/mastergo-magic-mcp/issues/88 CVE-2026-15750 - https://github.com/mastergo-design/mastergo-magic-mcp/issues/89 CVE-2026-15751 - https://github.com/mastergo-design/mastergo-magic-mcp/issues/90 CVE-2026-15752 - https://github.com/zhinianboke/xianyu-auto-reply/issues/192 @@ -146627,6 +146746,8 @@ CVE-2026-16201 - https://github.com/zevorn/rt-claw/issues/136 CVE-2026-16202 - https://github.com/AlbaDove/cve/issues/9 CVE-2026-16203 - https://github.com/AlbaDove/cve/issues/8 CVE-2026-16204 - https://github.com/zevorn/rt-claw/issues/138 +CVE-2026-16206 - https://vuldb.com/vuln/380022 +CVE-2026-16206 - https://vuldb.com/vuln/380022/cti CVE-2026-16208 - https://vuldb.com/vuln/380024/cti CVE-2026-16209 - https://github.com/Gerapy/Gerapy/issues/317 CVE-2026-16212 - https://github.com/awesto/django-shop/issues/888 @@ -147135,6 +147256,7 @@ CVE-2026-19715 - https://wpscan.com/vulnerability/94987bd9-7ac2-44fd-93df-52892c CVE-2026-19716 - https://secur0.com/en/cna/cve-list/cve-2026-19716-stored-xss-in-pentestify-user-account-deletion-via-unescaped-username CVE-2026-19717 - https://wpscan.com/vulnerability/79a4bae6-96e2-44b4-a56b-42198f8b3d32/ CVE-2026-19718 - https://wpscan.com/vulnerability/68892d43-912d-421f-9376-8dc6e2e906bc/ +CVE-2026-19722 - https://wpscan.com/vulnerability/a61974fc-d9d6-4aee-a624-fc0a6e7b940b/ CVE-2026-19725 - https://wpscan.com/vulnerability/999889f4-f8be-4b44-b665-1a94df8d050d/ CVE-2026-19726 - https://wpscan.com/vulnerability/61a1577e-077f-4a00-96b4-860eda48e03b/ CVE-2026-19728 - https://wpscan.com/vulnerability/fd10aaab-d358-4d2f-aafa-dbfba09b7fff/ @@ -148894,6 +149016,7 @@ CVE-2026-2855 - https://github.com/LX-66-LX/cve-new/issues/12 CVE-2026-2856 - https://github.com/LX-66-LX/cve-new/issues/13 CVE-2026-2857 - https://github.com/LX-66-LX/cve-new/issues/14 CVE-2026-2858 - https://github.com/wren-lang/wren/issues/1217 +CVE-2026-2860 - https://vuldb.com/?ctiid.347100 CVE-2026-2865 - https://github.com/wan1yan/cve/issues/3 CVE-2026-2867 - https://github.com/wan1yan/cve/issues/4 CVE-2026-28675 - https://github.com/OpenSift/OpenSift/commit/1126e0a503876056a68a434e19f64158a5a4840b @@ -152675,6 +152798,7 @@ CVE-2026-48154 - https://github.com/pilinux/gorest/security/advisories/GHSA-cpwg CVE-2026-48162 - https://github.com/wazuh/wazuh/security/advisories/GHSA-r6f5-h662-8ffc CVE-2026-48168 - https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-xp85-6wwf-r67c CVE-2026-48169 - https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-gv23-xrm3-8c62 +CVE-2026-48169 - https://github.com/pypa/advisory-database/tree/main/vulns/praisonai-platform/PYSEC-2026-2935.yaml CVE-2026-48170 - https://github.com/thomaspoignant/scim-patch/security/advisories/GHSA-9m6g-wc8r-q59c CVE-2026-4822 - https://github.com/0truust/iperius-backup-security-advisories/blob/main/advisories/arbitrary-file-disclosure.md CVE-2026-4823 - https://github.com/0truust/iperius-backup-security-advisories/blob/main/advisories/ntlm-relay-credential-exposure.md @@ -152692,6 +152816,7 @@ CVE-2026-4841 - https://gist.github.com/HxH404/ed090db972001ba535202fd4f5b6a0b5 CVE-2026-4842 - https://github.com/dsdsadawada/CVE1/issues/4 CVE-2026-4844 - https://gist.github.com/HxH404/8e5bd42c0f968a92a23edc5e7b879955 CVE-2026-4845 - https://thinhneee.github.io/posts/muucmf-xss/ +CVE-2026-4845 - https://vuldb.com/?submit.776174 CVE-2026-4846 - https://thinhneee.github.io/posts/muucmf-xss-channel/ CVE-2026-4847 - https://thinhneee.github.io/posts/muucmf-xss-config/ CVE-2026-4848 - https://thinhneee.github.io/posts/muucmf-xss-extend/ @@ -153304,6 +153429,7 @@ CVE-2026-53448 - https://github.com/coturn/coturn/security/advisories/GHSA-v8hj- CVE-2026-5346 - https://github.com/wing3e/public_exp/issues/11 CVE-2026-53487 - https://github.com/kite-org/kite/security/advisories/GHSA-gvhc-wv3v-7pf8 CVE-2026-5349 - https://github.com/panda666-888/vuls/blob/main/trendnet/tew-657brm/add_apcdb.md +CVE-2026-5350 - https://github.com/panda666-888/vuls/blob/main/trendnet/tew-657brm/update_pcdb.md CVE-2026-53500 - https://github.com/thumbor/thumbor/security/advisories/GHSA-6x26-6r6f-m537 CVE-2026-53503 - https://github.com/thumbor/thumbor/security/advisories/GHSA-cqjp-jf4r-h5q9 CVE-2026-53504 - https://github.com/thumbor/thumbor/commit/3f38fe1610d20168e91f76d432212de30727eb2e @@ -155389,6 +155515,9 @@ CVE-2026-76547 - https://wpscan.com/vulnerability/b80151f4-e910-4263-9ecc-470fb3 CVE-2026-76548 - https://wpscan.com/vulnerability/75e0611d-e11d-44f8-8fc1-7c40bb113f64/ CVE-2026-76549 - https://wpscan.com/vulnerability/59c01fb9-d651-40ec-b2c1-4b8fe386eb75/ CVE-2026-7656 - https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-cpjw-rvwx-ph9f +CVE-2026-76583 - https://vuldb.com/vuln/393042 +CVE-2026-76583 - https://vuldb.com/vuln/393042/cti +CVE-2026-76585 - https://wpscan.com/vulnerability/7d539fba-d47e-461d-b40f-1aa8f535d506/ CVE-2026-76586 - https://wpscan.com/vulnerability/bc74bc9b-92ce-434e-a21d-34d7525c8600/ CVE-2026-7663 - https://www.ibm.com/support/pages/node/7277570 CVE-2026-76639 - https://boschko.ca/g1-ble-rce/ @@ -155513,33 +155642,82 @@ CVE-2026-7790 - https://cna.erlef.org/cves/CVE-2026-7790.html CVE-2026-77945 - https://github.com/dxz0069/WAVLINK-WN530H4-Command-Injection-in-set_add_routing/blob/main/TEW-821DAP_ssi_Arbitrary_File_Command_Injection.md CVE-2026-77946 - https://github.com/dxz0069/WAVLINK-WN530H4-Command-Injection-in-set_add_routing/blob/main/TEW-821DAP_ssi_NTP_Timezone_Config_Stack_Overflow.md CVE-2026-78011 - https://psirt.watchguard.com/CVE-2026-78011 +CVE-2026-78049 - https://github.com/user-attachments/files/29702766/PoC.zip CVE-2026-78049 - https://gitlab.com/systerel/S2OPC/-/work_items/1787 +CVE-2026-78050 - https://github.com/AdminSafe/CVE/issues/9 +CVE-2026-78051 - https://github.com/alexta69/metube/security/advisories/GHSA-hj5g-p3v4-3cw5 CVE-2026-78054 - https://github.com/i-QvQ-i/first-OvO/issues/10 CVE-2026-78055 - https://github.com/i-QvQ-i/first-OvO/issues/11 CVE-2026-78059 - https://github.com/i-QvQ-i/first-OvO/issues/12 CVE-2026-78060 - https://github.com/i-QvQ-i/first-OvO/issues/13 CVE-2026-78061 - https://github.com/vas3k/TaxHacker/issues/148 +CVE-2026-78062 - https://github.com/vas3k/TaxHacker/issues/147 CVE-2026-7810 - https://github.com/UsamaK98/python-notebook-mcp/issues/5 CVE-2026-7811 - https://github.com/54yyyu/code-mcp/issues/4 +CVE-2026-78112 - https://github.com/ltranquility/vuln_submit/issues/25 CVE-2026-7812 - https://github.com/54yyyu/code-mcp/issues/5 +CVE-2026-78122 - https://gist.github.com/nedlir/e4f52f88a757f02c67db1fd5dd70d732 +CVE-2026-78122 - https://github.com/Tecnativa/docker-socket-proxy/issues/182 CVE-2026-78125 - https://wpscan.com/vulnerability/ffadc07d-b7b9-42a5-ab1a-35116019df17/ +CVE-2026-78136 - https://github.com/cduram/CHIRP-CodeExecution_via_Malicious_ImageFile CVE-2026-78137 - https://wpscan.com/vulnerability/15d1a53b-c5f3-4509-9889-ddc48507df35/ CVE-2026-78138 - https://wpscan.com/vulnerability/734d6d4c-4155-4bd9-ae08-b0f34cebde2e/ CVE-2026-78139 - https://wpscan.com/vulnerability/b1a0e23b-35f7-4282-83f6-1917c89f7b4c/ +CVE-2026-78142 - https://gist.github.com/c4ttr4ck/190b532b4b239fdc8f6fb72d89bde2c8 +CVE-2026-78143 - https://gist.github.com/c4ttr4ck/504e89cacf12c7d6a87490f3859dfded +CVE-2026-78144 - https://gist.github.com/c4ttr4ck/3601aa0ba9e567705823b6d425e84237 CVE-2026-78146 - https://wpscan.com/vulnerability/dd6e7f9c-b986-4bb7-afb4-530a8b149605/ +CVE-2026-78147 - https://github.com/ggml-org/llama.cpp/issues/25289 +CVE-2026-78158 - https://github.com/open5gs/open5gs/security/advisories/GHSA-mg8r-2cvv-xq9j +CVE-2026-78161 - https://github.com/biniamf/pocs/blob/main/libwebsockets-lecp-lecp_parse-cbor_pos_oob_write/poc_lecp_cbor_pos_oob.c +CVE-2026-78161 - https://github.com/biniamf/pocs/tree/main/libwebsockets-lecp-lecp_parse-cbor_pos_oob_write +CVE-2026-78166 - https://github.com/provectus/kafka-ui/issues/4567 +CVE-2026-78167 - https://github.com/AdminSafe/CVE/issues/2 +CVE-2026-78167 - https://github.com/AdminSafe/CVE/issues/3 +CVE-2026-78168 - https://github.com/AdminSafe/CVE/issues/10 +CVE-2026-78169 - https://github.com/7wkajk/CVE-VUL/blob/main/107.md +CVE-2026-78170 - https://github.com/7wkajk/CVE-VUL/blob/main/108.md +CVE-2026-78171 - https://github.com/MounT1veR/new/issues/1 +CVE-2026-78177 - https://github.com/TanStack/devtools/issues/464 +CVE-2026-78185 - https://github.com/ltranquility/vuln_submit/issues/27 +CVE-2026-78187 - https://github.com/Piwigo/Piwigo/security/advisories/GHSA-rr39-mf4j-6594 +CVE-2026-78196 - https://github.com/achorein/expo-share-intent/ +CVE-2026-78196 - https://github.com/achorein/expo-share-intent/commit/c6900b1ed06fcc3ca4b09651348974ac5b95e4e6 +CVE-2026-78196 - https://github.com/achorein/expo-share-intent/pull/221 +CVE-2026-78196 - https://github.com/achorein/expo-share-intent/releases/tag/v8.0.1 +CVE-2026-78197 - https://github.com/wsx138/cve/issues/3 +CVE-2026-78198 - https://github.com/wsx138/cve/issues/4 +CVE-2026-78199 - https://github.com/wsx138/cve/issues/5 +CVE-2026-78200 - https://github.com/microwaveabi/vul/issues/89 +CVE-2026-78201 - https://github.com/microwaveabi/vul/issues/8 +CVE-2026-78202 - https://github.com/microwaveabi/vul/issues/12 +CVE-2026-78203 - https://github.com/geo-chen/oss/blob/main/Ghostwriter.md +CVE-2026-78204 - https://github.com/geo-chen/oss/blob/main/Ghostwriter.md +CVE-2026-78205 - https://github.com/bentoml/BentoML/issues/5644 CVE-2026-7822 - https://github.com/ltranquility/submit/issues/14 CVE-2026-7823 - https://github.com/Litengzheng/vuldb_new2/blob/main/A8000RU/vul_330/README.md +CVE-2026-78244 - https://github.com/microwaveabi/vul/issues/5 +CVE-2026-78245 - https://github.com/microwaveabi/vul/issues/47 +CVE-2026-78246 - https://github.com/microwaveabi/vul/issues/63 +CVE-2026-78247 - https://github.com/huliangjia/cve/issues/1 +CVE-2026-78248 - https://github.com/huliangjia/cve/issues/3 +CVE-2026-78250 - https://github.com/outlookgp/CVE/tree/main/Bytebot_Agent_Loop_Budget_DoS_Report CVE-2026-7828 - https://www.securin.io/zero-days/cve-2026-7828-integer-overflow-win-log-malloc-ultravnc-repeater CVE-2026-7829 - https://www.securin.io/zero-days/cve-2026-7829-post-auth-oob-nul-write-repeater-rule-parser-ultravnc CVE-2026-7830 - https://www.securin.io/zero-days/cve-2026-7830-31-bit-dh-weak-rng-ms-logon-credential-interception-ultravnc CVE-2026-7831 - https://www.securin.io/zero-days/cve-2026-7831-off-by-one-stack-overflow-viewer-namelength-ultravnc CVE-2026-7833 - https://github.com/glkfc/IoT-Vulnerability/blob/main/iptime/c200/sub_409054_vulnerability_report_EN.md CVE-2026-78333 - https://wpscan.com/vulnerability/27de9242-d60e-42e8-a3a5-e355bfc00393/ +CVE-2026-78364 - https://wpscan.com/vulnerability/285b87e1-110f-4192-a098-e64e2eb447a8/ +CVE-2026-78367 - https://github.com/rpm-software-management/rpm/issues/4314 CVE-2026-7838 - https://www.securin.io/zero-days/cve-2026-7838-heap-overflow-viewer-reasonlen-integer-overflow-ultravnc CVE-2026-7839 - https://www.securin.io/zero-days/cve-2026-7839-hardcoded-default-admin-password-adminadmi2-ultravnc-repeater CVE-2026-7840 - https://www.securin.io/zero-days/cve-2026-7840-pre-auth-global-buffer-overflow-repeater-http-admin-ultravnc CVE-2026-78417 - https://devolutions.net/security/advisories/DEVO-2026-0029/ CVE-2026-7842 - https://wpscan.com/vulnerability/210303c4-0964-4a01-ac8e-13d7c7f424a2/ +CVE-2026-78430 - https://github.com/sworddut/mcp-ffmpeg-helper/issues/6 +CVE-2026-78434 - https://github.com/faveosuite/faveo-helpdesk/issues/8346 +CVE-2026-78435 - https://github.com/faveosuite/faveo-helpdesk/issues/8343 CVE-2026-7844 - https://github.com/3em0/cve_repo/blob/main/Langchain-Chatchat/Vuln-4-Missing-Auth-File-Endpoints.md CVE-2026-7845 - https://github.com/3em0/cve_repo/blob/main/Langchain-Chatchat/Vuln-1-tobytes-Hash-Collision.md CVE-2026-7845 - https://github.com/chatchat-space/Langchain-Chatchat/issues/5462 @@ -155555,7 +155733,19 @@ CVE-2026-7856 - https://github.com/draw-ctf/report/blob/main/DI-8100/url_member_ CVE-2026-7857 - https://github.com/draw-ctf/report/blob/main/DI-8100/user_group_asp_overflow.md CVE-2026-7859 - https://wpscan.com/vulnerability/3c11e490-92d8-46e1-a0ae-7c4c703ac411/ CVE-2026-7862 - https://wpscan.com/vulnerability/b4ce2a06-b435-4b77-851f-4406f2a91ca6/ +CVE-2026-78637 - https://github.com/Fdawgs/node-poppler/issues/822 +CVE-2026-78638 - https://github.com/peerigon/unzip-crx/issues/19 CVE-2026-7864 - https://labs.infoguard.ch/posts/seppmail_secure_e-mail_gateway_rce_vulnerabilities_cve-2026-2743_cve-2026-7864_cve-2026-44127_cve-2026-44128/ +CVE-2026-78654 - https://github.com/cleverbrush/framework/issues/213 +CVE-2026-78656 - https://github.com/ltranquility/vuln_submit/issues/28 +CVE-2026-78675 - https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-7833-fr7j-v32q +CVE-2026-78676 - https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-284h-m62q-gf8w +CVE-2026-78677 - https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-8mcc-hrx5-hvxc +CVE-2026-78678 - https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-5xxx-qhh7-9287 +CVE-2026-78679 - https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-3wxw-xv34-2frg +CVE-2026-78681 - https://github.com/nltk/nltk/security/advisories/GHSA-97qj-x29f-37w7 +CVE-2026-78682 - https://github.com/nltk/nltk/security/advisories/GHSA-6ww7-3frv-cqxh +CVE-2026-78683 - https://github.com/nltk/nltk/security/advisories/GHSA-rhp5-r9x4-f5g2 CVE-2026-7875 - https://github.com/qwibitai/nanoclaw/pull/2001 CVE-2026-7896 - https://issues.chromium.org/issues/493747582 CVE-2026-7898 - https://issues.chromium.org/issues/504587882 @@ -155680,7 +155870,9 @@ CVE-2026-8155 - https://wpscan.com/vulnerability/b7dd9cbf-b46b-49ee-84a0-6b05467 CVE-2026-8157 - https://wpscan.com/vulnerability/6680cc6a-9758-4040-bb39-7b9545041dc3/ CVE-2026-81572 - https://shelltrail.com/research/local-privilege-escalation-to-system-in-wibu-systems-codemeter-application CVE-2026-8163 - https://wpscan.com/vulnerability/e471516a-6f43-4a89-8486-7a638845e197/ +CVE-2026-81660 - https://wpscan.com/vulnerability/cfdb4107-6010-4c29-baf3-3111765f48c2/ CVE-2026-8172 - https://wpscan.com/vulnerability/535ec1a1-b822-43c9-8264-6442199493d3/ +CVE-2026-81766 - https://wpscan.com/vulnerability/948d70a2-605e-4a83-8feb-eca4dbb5f948/ CVE-2026-8207 - https://projectblack.io/blog/gibbon-v30-authenticated-sql-injection-and-rce/#sql-injectiongetting-warmed-up CVE-2026-8208 - https://projectblack.io/blog/gibbon-v30-authenticated-sql-injection-and-rce/#local-file-inclusionthe-next-shiny-new-thing CVE-2026-82081 - https://github.com/FUNFACTOR1/WALLABAG-FULL-DISCLOSURE-Stored-XSS-SSRF-CVSS-8.5-GHSA-q2g2- @@ -155743,9 +155935,23 @@ CVE-2026-82290 - https://github.com/Chainlit/chainlit/issues/2975 CVE-2026-82291 - https://github.com/heyform/heyform/security/advisories/GHSA-fg7j-rmgr-rc9g CVE-2026-82306 - https://github.com/StarRocks/starrocks/issues/75747 CVE-2026-8241 - https://hawktrace.com/blog/caniaserp +CVE-2026-82417 - https://github.com/ljharb/qs/security/advisories/GHSA-4mjr-xmp4-gh2g CVE-2026-8242 - https://hawktrace.com/blog/caniaserp +CVE-2026-82421 - https://github.com/ltranquility/cve_submit/issues/23 +CVE-2026-82422 - https://github.com/ltranquility/cve_submit/issues/24 +CVE-2026-82424 - https://github.com/Bai-public/CVE/issues/8 CVE-2026-8243 - https://hawktrace.com/blog/caniaserp CVE-2026-8244 - https://hawktrace.com/blog/caniaserp +CVE-2026-82455 - https://github.com/ruby/rubygems/commit/103ca4230deacb31b9fcd813de109e83b5fc71ac +CVE-2026-82456 - https://github.com/argoproj-labs/mcp-for-argocd/security/advisories/GHSA-rp45-5x3v-48mr +CVE-2026-82457 - https://gist.github.com/thesmartshadow/ed96e2a88643c34a247c9b7cf9e311be +CVE-2026-82460 - https://github.com/coderaiser/cloudcmd/issues/474 +CVE-2026-82475 - https://github.com/iflytek/astron-agent/issues/1590 +CVE-2026-82483 - https://github.com/Leousum/VulnPoC/blob/main/CPG1.6.x/stored_xss_album_desc.md +CVE-2026-82484 - https://github.com/ltranquility/submit_vuln/issues/20 +CVE-2026-82485 - https://github.com/ltranquility/submit_vuln/issues/21 +CVE-2026-82562 - https://github.com/ljharb/qs/security/advisories/GHSA-w7fw-mjwx-w883 +CVE-2026-82562 - https://github.com/ljharb/qs/security/advisories/GHSA-x5fp-wj9c-mxmx CVE-2026-8257 - https://github.com/WebAssembly/binaryen/issues/8633 CVE-2026-8261 - https://github.com/albertodemichelis/squirrel/issues/326 CVE-2026-8261 - https://github.com/biniamf/pocs/tree/main/squirrel-sqobject-functionproto-load-intovf-lineinfos @@ -155846,6 +156052,7 @@ CVE-2026-8861 - https://www.ibm.com/support/pages/node/7279510 CVE-2026-8935 - https://wpscan.com/vulnerability/9bad9fc1-5032-45dc-983f-ba2dd7092385/ CVE-2026-8949 - https://bugzilla.mozilla.org/show_bug.cgi?id=1355639 CVE-2026-8950 - https://bugzilla.mozilla.org/show_bug.cgi?id=1965430 +CVE-2026-8952 - https://bugzilla.mozilla.org/show_bug.cgi?id=2021727 CVE-2026-8953 - https://bugzilla.mozilla.org/show_bug.cgi?id=2029511 CVE-2026-8954 - https://bugzilla.mozilla.org/show_bug.cgi?id=2030747 CVE-2026-8956 - https://bugzilla.mozilla.org/show_bug.cgi?id=2032427