diff --git a/2011/CVE-2011-4203.md b/2011/CVE-2011-4203.md
new file mode 100644
index 0000000000..a97feaf6f2
--- /dev/null
+++ b/2011/CVE-2011-4203.md
@@ -0,0 +1,17 @@
+### [CVE-2011-4203](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-4203)
+![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen)
+
+### Description
+
+CRLF injection vulnerability in calendar/set.php in the Calendar component in Moodle 1.9.x before 1.9.15, 2.0.x before 2.0.6, 2.1.x before 2.1.3, and 2.2 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via vectors involving the url variable.
+
+### POC
+
+#### Reference
+- http://tracker.moodle.org/browse/MDL-24808
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2017/CVE-2017-6920.md b/2017/CVE-2017-6920.md
index 9b261ef9e0..e43927ae50 100644
--- a/2017/CVE-2017-6920.md
+++ b/2017/CVE-2017-6920.md
@@ -10,7 +10,7 @@ Drupal core 8 before versions 8.3.4 allows remote attackers to execute arbitrary
 ### POC
 
 #### Reference
-No PoCs from references.
+- https://www.drupal.org/forum/newsletters/security-advisories-for-drupal-core/2017-06-21/drupal-core-multiple
 
 #### Github
 - https://github.com/ARPSyndicate/cvemon
diff --git a/2017/CVE-2017-6921.md b/2017/CVE-2017-6921.md
new file mode 100644
index 0000000000..bcb8e6a875
--- /dev/null
+++ b/2017/CVE-2017-6921.md
@@ -0,0 +1,17 @@
+### [CVE-2017-6921](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-6921)
+![](https://img.shields.io/static/v1?label=Product&message=Drupal%20Core&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=Drupal%208%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=Access%20Bypass&color=brightgreen)
+
+### Description
+
+In Drupal 8 prior to 8.3.4; The file REST resource does not properly validate some fields when manipulating files. A site is only affected by this if the site has the RESTful Web Services (rest) module enabled, the file REST resource is enabled and allows PATCH requests, and an attacker can get or register a user account on the site with permissions to upload files and to modify the file resource.
+
+### POC
+
+#### Reference
+- https://www.drupal.org/forum/newsletters/security-advisories-for-drupal-core/2017-06-21/drupal-core-multiple
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2017/CVE-2017-6922.md b/2017/CVE-2017-6922.md
new file mode 100644
index 0000000000..ca82b8ed60
--- /dev/null
+++ b/2017/CVE-2017-6922.md
@@ -0,0 +1,18 @@
+### [CVE-2017-6922](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-6922)
+![](https://img.shields.io/static/v1?label=Product&message=Drupal%20Core&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=Drupal%207%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Version&message=Drupal%208%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=Access%20Bypass&color=brightgreen)
+
+### Description
+
+In Drupal core 8.x prior to 8.3.4 and Drupal core 7.x prior to 7.56; Private files that have been uploaded by an anonymous user but not permanently attached to content on the site should only be visible to the anonymous user that uploaded them, rather than all anonymous users. Drupal core did not previously provide this protection, allowing an access bypass vulnerability to occur. This issue is mitigated by the fact that in order to be affected, the site must allow anonymous users to upload files into a private file system.
+
+### POC
+
+#### Reference
+- https://www.drupal.org/forum/newsletters/security-advisories-for-drupal-core/2017-06-21/drupal-core-multiple
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2018/CVE-2018-25340.md b/2018/CVE-2018-25340.md
index b05f83ec65..879ff53eda 100644
--- a/2018/CVE-2018-25340.md
+++ b/2018/CVE-2018-25340.md
@@ -10,6 +10,7 @@ Smartshop 1 contains a SQL injection vulnerability that allows unauthenticated a
 ### POC
 
 #### Reference
+- https://github.com/smakosh/Smartshop/archive/master.zip
 - https://www.exploit-db.com/exploits/44823
 
 #### Github
diff --git a/2018/CVE-2018-25341.md b/2018/CVE-2018-25341.md
index feab61056f..a34a02971f 100644
--- a/2018/CVE-2018-25341.md
+++ b/2018/CVE-2018-25341.md
@@ -10,6 +10,7 @@ Smartshop 1 contains a SQL injection vulnerability that allows unauthenticated a
 ### POC
 
 #### Reference
+- https://github.com/smakosh/Smartshop/archive/master.zip
 - https://www.exploit-db.com/exploits/44823
 
 #### Github
diff --git a/2018/CVE-2018-25342.md b/2018/CVE-2018-25342.md
index 1bfef8d100..4e0ddc77d4 100644
--- a/2018/CVE-2018-25342.md
+++ b/2018/CVE-2018-25342.md
@@ -10,6 +10,7 @@ Smartshop 1 contains a time-based blind SQL injection vulnerability that allows
 ### POC
 
 #### Reference
+- https://github.com/smakosh/Smartshop/archive/master.zip
 - https://www.exploit-db.com/exploits/44823
 
 #### Github
diff --git a/2018/CVE-2018-25343.md b/2018/CVE-2018-25343.md
index 0fc66fec25..5b77337eb7 100644
--- a/2018/CVE-2018-25343.md
+++ b/2018/CVE-2018-25343.md
@@ -10,6 +10,7 @@ Smartshop 1 contains a cross-site request forgery vulnerability that allows atta
 ### POC
 
 #### Reference
+- https://github.com/smakosh/Smartshop/archive/master.zip
 - https://www.exploit-db.com/exploits/44824
 
 #### Github
diff --git a/2020/CVE-2020-25900.md b/2020/CVE-2020-25900.md
new file mode 100644
index 0000000000..7092c3832e
--- /dev/null
+++ b/2020/CVE-2020-25900.md
@@ -0,0 +1,17 @@
+### [CVE-2020-25900](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-25900)
+![](https://img.shields.io/static/v1?label=Product&message=HelloTalk&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-359%20Exposure%20of%20Private%20Personal%20Information%20to%20an%20Unauthorized%20Actor&color=brightgreen)
+
+### Description
+
+HelloTalk through 3.4.1 stores full-precision GPS coordinates even when the user had intended to share only a country or city. Furthermore, these coordinates are placed into a database on the client of other users. (The client side was changed in 2019 to encrypt that database.)
+
+### POC
+
+#### Reference
+- https://isopach.dev/CVE-2020-25900/
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2020/CVE-2020-35803.md b/2020/CVE-2020-35803.md
new file mode 100644
index 0000000000..3a14436b7c
--- /dev/null
+++ b/2020/CVE-2020-35803.md
@@ -0,0 +1,17 @@
+### [CVE-2020-35803](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-35803)
+![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen)
+
+### Description
+
+Certain NETGEAR devices are affected by disclosure of sensitive information. This affects D6200 before 1.1.00.40, D7000 before 1.0.1.78, R6020 before 1.0.0.46, R6080 before 1.0.0.46, R6120 before 1.0.0.72, R6220 before 1.1.0.100, R6230 before 1.1.0.100, R6260 before 1.1.0.76, R6700v2 before 1.2.0.74, R6800 before 1.2.0.74, R6900v2 before 1.2.0.74, R7450 before 1.2.0.74, AC2100 before 1.2.0.74, AC2400 before 1.2.0.74, and AC2600 before 1.2.0.74.
+
+### POC
+
+#### Reference
+- https://kb.netgear.com/000062732/Security-Advisory-for-Sensitive-Information-Disclosure-on-Some-Routers-PSV-2019-0110
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2021/CVE-2021-38517.md b/2021/CVE-2021-38517.md
new file mode 100644
index 0000000000..eae3f89033
--- /dev/null
+++ b/2021/CVE-2021-38517.md
@@ -0,0 +1,17 @@
+### [CVE-2021-38517](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-38517)
+![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen)
+
+### Description
+
+Certain NETGEAR devices are affected by out-of-bounds reads and writes. This affects R6400 before 1.0.1.70, RAX75 before 1.0.4.120, RAX80 before 1.0.4.120, and XR300 before 1.0.3.50.
+
+### POC
+
+#### Reference
+- https://kb.netgear.com/000063772/Security-Advisory-for-Out-of-Bounds-Read-and-Write-on-Some-Routers-PSV-2019-0187
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2021/CVE-2021-41617.md b/2021/CVE-2021-41617.md
index 71d760b0f4..270b4145a0 100644
--- a/2021/CVE-2021-41617.md
+++ b/2021/CVE-2021-41617.md
@@ -11,6 +11,7 @@ sshd in OpenSSH 6.2 through 8.x before 8.8, when certain non-default configurati
 ### POC
 
 #### Reference
+- https://cert-portal.siemens.com/productcert/html/ssa-082556.html
 - https://www.oracle.com/security-alerts/cpuapr2022.html
 - https://www.oracle.com/security-alerts/cpujul2022.html
 - https://www.tenable.com/plugins/nessus/154174
diff --git a/2021/CVE-2021-4473.md b/2021/CVE-2021-4473.md
new file mode 100644
index 0000000000..4c0c259e82
--- /dev/null
+++ b/2021/CVE-2021-4473.md
@@ -0,0 +1,17 @@
+### [CVE-2021-4473](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-4473)
+![](https://img.shields.io/static/v1?label=Product&message=Tianxin%20Internet%20Behavior%20Management%20System&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-78%20Improper%20Neutralization%20of%20Special%20Elements%20used%20in%20an%20OS%20Command%20('OS%20Command%20Injection')&color=brightgreen)
+
+### Description
+
+Tianxin Internet Behavior Management System contains a command injection vulnerability in the Reporter component endpoint that allows unauthenticated attackers to execute arbitrary commands by supplying a crafted objClass parameter containing shell metacharacters and output redirection. Attackers can exploit this vulnerability to write malicious PHP files into the web root and achieve remote code execution with the privileges of the web server process. This vulnerability has been fixed in version NACFirmware_4.0.0.7_20210716.180815_topsec_0_basic.bin. Exploitation evidence was first observed by the Shadowserver Foundation on 2024-06-01 (UTC).
+
+### POC
+
+#### Reference
+- https://cn-sec.com/archives/4631959.html
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2022/CVE-2022-36310.md b/2022/CVE-2022-36310.md
index d979e1dc04..ae0973b5b4 100644
--- a/2022/CVE-2022-36310.md
+++ b/2022/CVE-2022-36310.md
@@ -11,6 +11,7 @@ Airspan AirVelocity 1500 software prior to version 15.18.00.2511 had NET-SNMP-EX
 
 #### Reference
 - https://github.com/metaredteam/external-disclosures/security/advisories/GHSA-whc6-2989-42xm
+- https://helpdesk.airspan.com/browse/TRN3-1689
 
 #### Github
 No PoCs found on GitHub currently.
diff --git a/2022/CVE-2022-36312.md b/2022/CVE-2022-36312.md
new file mode 100644
index 0000000000..4dbb9267df
--- /dev/null
+++ b/2022/CVE-2022-36312.md
@@ -0,0 +1,17 @@
+### [CVE-2022-36312](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-36312)
+![](https://img.shields.io/static/v1?label=Product&message=AirVelocity&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=unspecified%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CSRF%20(CWE-352)&color=brightgreen)
+
+### Description
+
+Airspan AirVelocity 1500 software version 15.18.00.2511 lacks CSRF protections in the eNodeB's web management UI. This issue may affect other AirVelocity and AirSpeed models.
+
+### POC
+
+#### Reference
+- https://helpdesk.airspan.com/browse/TRN3-1695
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2022/CVE-2022-42248.md b/2022/CVE-2022-42248.md
index 77bd641c32..35c48e5895 100644
--- a/2022/CVE-2022-42248.md
+++ b/2022/CVE-2022-42248.md
@@ -10,7 +10,7 @@ QlikView 12.60.2 was discovered to contain a stored cross-site scripting (XSS) v
 ### POC
 
 #### Reference
-No PoCs from references.
+- https://github.com/Ozozuz/Qlik-View-Stored-XSS
 
 #### Github
 - https://github.com/ARPSyndicate/cvemon
diff --git a/2023/CVE-2023-28531.md b/2023/CVE-2023-28531.md
index 1805adc623..a50fbbe366 100644
--- a/2023/CVE-2023-28531.md
+++ b/2023/CVE-2023-28531.md
@@ -11,7 +11,7 @@ ssh-add in OpenSSH before 9.3 adds smartcard keys to ssh-agent without the inten
 ### POC
 
 #### Reference
-No PoCs from references.
+- https://cert-portal.siemens.com/productcert/html/ssa-082556.html
 
 #### Github
 - https://github.com/Certifiedhustler-Swaba/VulnerableGPT
diff --git a/2023/CVE-2023-37369.md b/2023/CVE-2023-37369.md
index 021bf1c3f1..05890a4b38 100644
--- a/2023/CVE-2023-37369.md
+++ b/2023/CVE-2023-37369.md
@@ -10,7 +10,7 @@ In Qt before 5.15.15, 6.x before 6.2.9, and 6.3.x through 6.5.x before 6.5.2, th
 ### POC
 
 #### Reference
-No PoCs from references.
+- https://bugreports.qt.io/browse/QTBUG-114829
 
 #### Github
 - https://github.com/fkie-cad/nvd-json-data-feeds
diff --git a/2023/CVE-2023-38545.md b/2023/CVE-2023-38545.md
index 2f69f4879c..a985a73edc 100644
--- a/2023/CVE-2023-38545.md
+++ b/2023/CVE-2023-38545.md
@@ -13,6 +13,7 @@ This flaw makes curl overflow a heap based buffer in the SOCKS5 proxyhandshake.W
 ### POC
 
 #### Reference
+- https://cert-portal.siemens.com/productcert/html/ssa-082556.html
 - https://github.com/UTsweetyfish/CVE-2023-38545
 - https://github.com/bcdannyboy/CVE-2023-38545
 - https://github.com/dbrugman/CVE-2023-38545-POC
diff --git a/2023/CVE-2023-38546.md b/2023/CVE-2023-38546.md
index 7d336b7b4f..5fafad8ad6 100644
--- a/2023/CVE-2023-38546.md
+++ b/2023/CVE-2023-38546.md
@@ -13,7 +13,7 @@ This flaw allows an attacker to insert cookies at will into a running programusi
 ### POC
 
 #### Reference
-No PoCs from references.
+- https://cert-portal.siemens.com/productcert/html/ssa-082556.html
 
 #### Github
 - https://github.com/alex-grandson/docker-python-example
diff --git a/2023/CVE-2023-38890.md b/2023/CVE-2023-38890.md
index bd79dbb729..23f66468cf 100644
--- a/2023/CVE-2023-38890.md
+++ b/2023/CVE-2023-38890.md
@@ -11,6 +11,7 @@ Online Shopping Portal Project 3.1 allows remote attackers to execute arbitrary
 
 #### Reference
 - https://github.com/akshadjoshi/CVE-2023-38890
+- https://tagmachan.com/online-shopping-portal-3-1-sql-injection-to-remote-code-execution-unauthenticated.tagox
 - https://www.exploit-db.com/exploits/50029
 
 #### Github
diff --git a/2023/CVE-2023-44487.md b/2023/CVE-2023-44487.md
index 72c3fcf3e1..4a69c60b7d 100644
--- a/2023/CVE-2023-44487.md
+++ b/2023/CVE-2023-44487.md
@@ -15,6 +15,7 @@ The HTTP/2 protocol allows a denial of service (server resource consumption) bec
 #### Reference
 - https://blog.cloudflare.com/technical-breakdown-http2-rapid-reset-ddos-attack/
 - https://blog.cloudflare.com/zero-day-rapid-reset-http2-record-breaking-ddos-attack/
+- https://cert-portal.siemens.com/productcert/html/ssa-082556.html
 - https://cloud.google.com/blog/products/identity-security/google-cloud-mitigated-largest-ddos-attack-peaking-above-398-million-rps/
 - https://cloud.google.com/blog/products/identity-security/how-it-works-the-novel-http2-rapid-reset-ddos-attack
 - https://github.com/Azure/AKS/issues/3947
diff --git a/2023/CVE-2023-4527.md b/2023/CVE-2023-4527.md
index ee9df41560..d8e10e0b2e 100644
--- a/2023/CVE-2023-4527.md
+++ b/2023/CVE-2023-4527.md
@@ -14,7 +14,7 @@ A flaw was found in glibc. When the getaddrinfo function is called with the AF_U
 ### POC
 
 #### Reference
-No PoCs from references.
+- https://cert-portal.siemens.com/productcert/html/ssa-082556.html
 
 #### Github
 - https://github.com/Dalifo/wik-dvs-tp02
diff --git a/2023/CVE-2023-46218.md b/2023/CVE-2023-46218.md
index 916c677765..dd1095c3ef 100644
--- a/2023/CVE-2023-46218.md
+++ b/2023/CVE-2023-46218.md
@@ -13,7 +13,7 @@ This flaw allows a malicious HTTP server to set "super cookies" in curl thatare
 ### POC
 
 #### Reference
-No PoCs from references.
+- https://cert-portal.siemens.com/productcert/html/ssa-082556.html
 
 #### Github
 - https://github.com/bartvoet/assignment-ehb-security-review-adamlenez
diff --git a/2023/CVE-2023-46219.md b/2023/CVE-2023-46219.md
index 5d01d9e34e..720b0b6c21 100644
--- a/2023/CVE-2023-46219.md
+++ b/2023/CVE-2023-46219.md
@@ -13,7 +13,7 @@ When saving HSTS data to an excessively long file name, curl could end upremovin
 ### POC
 
 #### Reference
-No PoCs from references.
+- https://cert-portal.siemens.com/productcert/html/ssa-082556.html
 
 #### Github
 - https://github.com/bartvoet/assignment-ehb-security-review-adamlenez
diff --git a/2023/CVE-2023-4806.md b/2023/CVE-2023-4806.md
index 1454211832..0272e7d376 100644
--- a/2023/CVE-2023-4806.md
+++ b/2023/CVE-2023-4806.md
@@ -16,7 +16,7 @@ A flaw has been identified in glibc. In an extremely rare situation, the getaddr
 ### POC
 
 #### Reference
-No PoCs from references.
+- https://cert-portal.siemens.com/productcert/html/ssa-082556.html
 
 #### Github
 - https://github.com/Dalifo/wik-dvs-tp02
diff --git a/2023/CVE-2023-48795.md b/2023/CVE-2023-48795.md
index bd790e5929..37060a2737 100644
--- a/2023/CVE-2023-48795.md
+++ b/2023/CVE-2023-48795.md
@@ -13,6 +13,7 @@ The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH bef
 
 #### Reference
 - http://packetstormsecurity.com/files/176280/Terrapin-SSH-Connection-Weakening.html
+- https://cert-portal.siemens.com/productcert/html/ssa-082556.html
 - https://github.com/ronf/asyncssh/blob/develop/docs/changes.rst
 - https://groups.google.com/g/golang-announce/c/-n5WqVC18LQ
 - https://groups.google.com/g/golang-announce/c/qA3XtxvMUyg
diff --git a/2023/CVE-2023-4911.md b/2023/CVE-2023-4911.md
index a553a925cb..82ae197820 100644
--- a/2023/CVE-2023-4911.md
+++ b/2023/CVE-2023-4911.md
@@ -23,6 +23,7 @@ A buffer overflow was discovered in the GNU C Library's dynamic loader ld.so whi
 - http://packetstormsecurity.com/files/176288/Glibc-Tunables-Privilege-Escalation.html
 - http://seclists.org/fulldisclosure/2023/Oct/11
 - http://www.openwall.com/lists/oss-security/2023/10/03/2
+- https://cert-portal.siemens.com/productcert/html/ssa-082556.html
 - https://www.exploit-db.com/exploits/52479
 - https://www.qualys.com/2023/10/03/cve-2023-4911/looney-tunables-local-privilege-escalation-glibc-ld-so.txt
 
diff --git a/2023/CVE-2023-51384.md b/2023/CVE-2023-51384.md
index 27fc562a12..d7a4dc2d58 100644
--- a/2023/CVE-2023-51384.md
+++ b/2023/CVE-2023-51384.md
@@ -11,7 +11,7 @@ In ssh-agent in OpenSSH before 9.6, certain destination constraints can be incom
 ### POC
 
 #### Reference
-No PoCs from references.
+- https://cert-portal.siemens.com/productcert/html/ssa-082556.html
 
 #### Github
 - https://github.com/GitHubForSnap/openssh-server-gael
diff --git a/2023/CVE-2023-51385.md b/2023/CVE-2023-51385.md
index 7df02f9faf..700245aa21 100644
--- a/2023/CVE-2023-51385.md
+++ b/2023/CVE-2023-51385.md
@@ -13,6 +13,7 @@ In ssh in OpenSSH before 9.6, OS command injection might occur if a user name or
 #### Reference
 - http://www.openwall.com/lists/oss-security/2025/10/07/1
 - http://www.openwall.com/lists/oss-security/2025/10/12/1
+- https://cert-portal.siemens.com/productcert/html/ssa-082556.html
 - https://vin01.github.io/piptagole/ssh/security/openssh/libssh/remote-code-execution/2023/12/20/openssh-proxycommand-libssh-rce.html
 
 #### Github
diff --git a/2023/CVE-2023-52927.md b/2023/CVE-2023-52927.md
index adf1ec88c9..c4fad3a489 100644
--- a/2023/CVE-2023-52927.md
+++ b/2023/CVE-2023-52927.md
@@ -13,6 +13,7 @@ In the Linux kernel, the following vulnerability has been resolved:netfilter: al
 ### POC
 
 #### Reference
+- https://cert-portal.siemens.com/productcert/html/ssa-082556.html
 - https://seadragnol.github.io/posts/CVE-2023-52927/
 
 #### Github
diff --git a/2023/CVE-2023-5363.md b/2023/CVE-2023-5363.md
index b24eb9de80..3c9d53b631 100644
--- a/2023/CVE-2023-5363.md
+++ b/2023/CVE-2023-5363.md
@@ -13,7 +13,7 @@ Issue summary: A bug has been identified in the processing of key andinitialisat
 ### POC
 
 #### Reference
-No PoCs from references.
+- https://cert-portal.siemens.com/productcert/html/ssa-082556.html
 
 #### Github
 - https://github.com/Atamik03/API-calc-dz
diff --git a/2023/CVE-2023-6246.md b/2023/CVE-2023-6246.md
index dce4b0fe8b..2dd2d473ce 100644
--- a/2023/CVE-2023-6246.md
+++ b/2023/CVE-2023-6246.md
@@ -19,6 +19,7 @@ A heap-based buffer overflow was found in the __vsyslog_internal function of the
 - http://packetstormsecurity.com/files/176931/glibc-qsort-Out-Of-Bounds-Read-Write.html
 - http://packetstormsecurity.com/files/176932/glibc-syslog-Heap-Based-Buffer-Overflow.html
 - http://seclists.org/fulldisclosure/2024/Feb/3
+- https://cert-portal.siemens.com/productcert/html/ssa-082556.html
 - https://www.openwall.com/lists/oss-security/2024/01/30/6
 - https://www.qualys.com/2024/01/30/cve-2023-6246/syslog.txt
 
diff --git a/2023/CVE-2023-6779.md b/2023/CVE-2023-6779.md
index 754c1f8227..602f52224f 100644
--- a/2023/CVE-2023-6779.md
+++ b/2023/CVE-2023-6779.md
@@ -18,6 +18,7 @@ An off-by-one heap-based buffer overflow was found in the __vsyslog_internal fun
 #### Reference
 - http://packetstormsecurity.com/files/176932/glibc-syslog-Heap-Based-Buffer-Overflow.html
 - http://seclists.org/fulldisclosure/2024/Feb/3
+- https://cert-portal.siemens.com/productcert/html/ssa-082556.html
 - https://www.openwall.com/lists/oss-security/2024/01/30/6
 - https://www.qualys.com/2024/01/30/cve-2023-6246/syslog.txt
 
diff --git a/2023/CVE-2023-6780.md b/2023/CVE-2023-6780.md
index fd1293cdbd..312fa87543 100644
--- a/2023/CVE-2023-6780.md
+++ b/2023/CVE-2023-6780.md
@@ -18,6 +18,7 @@ An integer overflow was found in the __vsyslog_internal function of the glibc li
 #### Reference
 - http://packetstormsecurity.com/files/176932/glibc-syslog-Heap-Based-Buffer-Overflow.html
 - http://seclists.org/fulldisclosure/2024/Feb/3
+- https://cert-portal.siemens.com/productcert/html/ssa-082556.html
 - https://www.openwall.com/lists/oss-security/2024/01/30/6
 - https://www.qualys.com/2024/01/30/cve-2023-6246/syslog.txt
 
diff --git a/2024/CVE-2024-12133.md b/2024/CVE-2024-12133.md
index 0d87f8f842..9c80cc3a42 100644
--- a/2024/CVE-2024-12133.md
+++ b/2024/CVE-2024-12133.md
@@ -27,7 +27,7 @@ A flaw in libtasn1 causes inefficient handling of specific certificate data. Whe
 ### POC
 
 #### Reference
-No PoCs from references.
+- https://cert-portal.siemens.com/productcert/html/ssa-082556.html
 
 #### Github
 - https://github.com/ARPSyndicate/cve-scores
diff --git a/2024/CVE-2024-12243.md b/2024/CVE-2024-12243.md
index 3a508aa09e..e10e198212 100644
--- a/2024/CVE-2024-12243.md
+++ b/2024/CVE-2024-12243.md
@@ -23,7 +23,7 @@ A flaw was found in GnuTLS, which relies on libtasn1 for ASN.1 data processing.
 ### POC
 
 #### Reference
-No PoCs from references.
+- https://cert-portal.siemens.com/productcert/html/ssa-082556.html
 
 #### Github
 - https://github.com/ARPSyndicate/cve-scores
diff --git a/2024/CVE-2024-24855.md b/2024/CVE-2024-24855.md
index 01189692b6..e9734e981a 100644
--- a/2024/CVE-2024-24855.md
+++ b/2024/CVE-2024-24855.md
@@ -11,7 +11,7 @@ A race condition was found in the Linux kernel's scsi device driver in lpfc_unre
 ### POC
 
 #### Reference
-No PoCs from references.
+- https://cert-portal.siemens.com/productcert/html/ssa-082556.html
 
 #### Github
 - https://github.com/fkie-cad/nvd-json-data-feeds
diff --git a/2024/CVE-2024-26596.md b/2024/CVE-2024-26596.md
index 0a75e84ab3..ff7f840385 100644
--- a/2024/CVE-2024-26596.md
+++ b/2024/CVE-2024-26596.md
@@ -13,7 +13,7 @@ In the Linux kernel, the following vulnerability has been resolved:net: dsa: fix
 ### POC
 
 #### Reference
-No PoCs from references.
+- https://cert-portal.siemens.com/productcert/html/ssa-082556.html
 
 #### Github
 - https://github.com/fkie-cad/nvd-json-data-feeds
diff --git a/2024/CVE-2024-28085.md b/2024/CVE-2024-28085.md
index dfb8591083..efffbb619d 100644
--- a/2024/CVE-2024-28085.md
+++ b/2024/CVE-2024-28085.md
@@ -14,6 +14,7 @@ wall in util-linux through 2.40, often installed with setgid tty permissions, al
 #### Reference
 - http://seclists.org/fulldisclosure/2024/Mar/35
 - http://www.openwall.com/lists/oss-security/2024/03/27/5
+- https://cert-portal.siemens.com/productcert/html/ssa-082556.html
 - https://people.rit.edu/sjf5462/6831711781/wall_2_27_2024.txt
 - https://www.openwall.com/lists/oss-security/2024/03/27/5
 
diff --git a/2024/CVE-2024-2961.md b/2024/CVE-2024-2961.md
index 32165137b3..63ea3a69ca 100644
--- a/2024/CVE-2024-2961.md
+++ b/2024/CVE-2024-2961.md
@@ -11,6 +11,7 @@ The iconv() function in the GNU C Library versions 2.39 and older may overflow t
 ### POC
 
 #### Reference
+- https://cert-portal.siemens.com/productcert/html/ssa-082556.html
 - https://www.ambionics.io/blog/iconv-cve-2024-2961-p1
 - https://www.ambionics.io/blog/iconv-cve-2024-2961-p2
 - https://www.ambionics.io/blog/iconv-cve-2024-2961-p3
diff --git a/2024/CVE-2024-33599.md b/2024/CVE-2024-33599.md
index 11a8ba5742..fd6f049bfb 100644
--- a/2024/CVE-2024-33599.md
+++ b/2024/CVE-2024-33599.md
@@ -11,7 +11,7 @@ nscd: Stack-based buffer overflow in netgroup cacheIf the Name Service Cache Dae
 ### POC
 
 #### Reference
-No PoCs from references.
+- https://cert-portal.siemens.com/productcert/html/ssa-082556.html
 
 #### Github
 - https://github.com/ARPSyndicate/cve-scores
diff --git a/2024/CVE-2024-33600.md b/2024/CVE-2024-33600.md
index 92bfba8d79..61c084247c 100644
--- a/2024/CVE-2024-33600.md
+++ b/2024/CVE-2024-33600.md
@@ -11,7 +11,7 @@ nscd: Null pointer crashes after notfound responseIf the Name Service Cache Daem
 ### POC
 
 #### Reference
-No PoCs from references.
+- https://cert-portal.siemens.com/productcert/html/ssa-082556.html
 
 #### Github
 - https://github.com/ARPSyndicate/cve-scores
diff --git a/2024/CVE-2024-33601.md b/2024/CVE-2024-33601.md
index b026b65947..af9858aebb 100644
--- a/2024/CVE-2024-33601.md
+++ b/2024/CVE-2024-33601.md
@@ -11,7 +11,7 @@ nscd: netgroup cache may terminate daemon on memory allocation failureThe Name S
 ### POC
 
 #### Reference
-No PoCs from references.
+- https://cert-portal.siemens.com/productcert/html/ssa-082556.html
 
 #### Github
 - https://github.com/ARPSyndicate/cve-scores
diff --git a/2024/CVE-2024-33602.md b/2024/CVE-2024-33602.md
index abeb09e3b6..ad1aaba259 100644
--- a/2024/CVE-2024-33602.md
+++ b/2024/CVE-2024-33602.md
@@ -11,7 +11,7 @@ nscd: netgroup cache assumes NSS callback uses in-buffer stringsThe Name Service
 ### POC
 
 #### Reference
-No PoCs from references.
+- https://cert-portal.siemens.com/productcert/html/ssa-082556.html
 
 #### Github
 - https://github.com/ARPSyndicate/cve-scores
diff --git a/2024/CVE-2024-34397.md b/2024/CVE-2024-34397.md
index 81f8473665..3713cc4a56 100644
--- a/2024/CVE-2024-34397.md
+++ b/2024/CVE-2024-34397.md
@@ -13,6 +13,7 @@ An issue was discovered in GNOME GLib before 2.78.5, and 2.79.x and 2.80.x befor
 ### POC
 
 #### Reference
+- https://cert-portal.siemens.com/productcert/html/ssa-082556.html
 - https://cert-portal.siemens.com/productcert/html/ssa-613116.html
 - https://gitlab.gnome.org/GNOME/glib/-/issues/3268
 
diff --git a/2024/CVE-2024-37370.md b/2024/CVE-2024-37370.md
index fef9bdc7a4..5f50aca4fd 100644
--- a/2024/CVE-2024-37370.md
+++ b/2024/CVE-2024-37370.md
@@ -11,7 +11,7 @@ In MIT Kerberos 5 (aka krb5) before 1.21.3, an attacker can modify the plaintext
 ### POC
 
 #### Reference
-No PoCs from references.
+- https://cert-portal.siemens.com/productcert/html/ssa-082556.html
 
 #### Github
 - https://github.com/Atamik03/API-calc-dz
diff --git a/2024/CVE-2024-37371.md b/2024/CVE-2024-37371.md
index c82a72cc84..e2e627e1d5 100644
--- a/2024/CVE-2024-37371.md
+++ b/2024/CVE-2024-37371.md
@@ -11,7 +11,7 @@ In MIT Kerberos 5 (aka krb5) before 1.21.3, an attacker can cause invalid memory
 ### POC
 
 #### Reference
-No PoCs from references.
+- https://cert-portal.siemens.com/productcert/html/ssa-082556.html
 
 #### Github
 - https://github.com/Atamik03/API-calc-dz
diff --git a/2024/CVE-2024-45490.md b/2024/CVE-2024-45490.md
index 3eee97125c..8cea83bf4d 100644
--- a/2024/CVE-2024-45490.md
+++ b/2024/CVE-2024-45490.md
@@ -13,6 +13,7 @@ An issue was discovered in libexpat before 2.6.3. xmlparse.c does not reject a n
 ### POC
 
 #### Reference
+- https://cert-portal.siemens.com/productcert/html/ssa-082556.html
 - https://cert-portal.siemens.com/productcert/html/ssa-613116.html
 
 #### Github
diff --git a/2024/CVE-2024-45491.md b/2024/CVE-2024-45491.md
index 6207dc66af..79b8d9f61b 100644
--- a/2024/CVE-2024-45491.md
+++ b/2024/CVE-2024-45491.md
@@ -13,6 +13,7 @@ An issue was discovered in libexpat before 2.6.3. dtdCopy in xmlparse.c can have
 ### POC
 
 #### Reference
+- https://cert-portal.siemens.com/productcert/html/ssa-082556.html
 - https://cert-portal.siemens.com/productcert/html/ssa-613116.html
 
 #### Github
diff --git a/2024/CVE-2024-45492.md b/2024/CVE-2024-45492.md
index 6699f860b8..61bf788c4d 100644
--- a/2024/CVE-2024-45492.md
+++ b/2024/CVE-2024-45492.md
@@ -13,6 +13,7 @@ An issue was discovered in libexpat before 2.6.3. nextScaffoldPart in xmlparse.c
 ### POC
 
 #### Reference
+- https://cert-portal.siemens.com/productcert/html/ssa-082556.html
 - https://cert-portal.siemens.com/productcert/html/ssa-613116.html
 
 #### Github
diff --git a/2024/CVE-2024-50246.md b/2024/CVE-2024-50246.md
index 094934439c..a129c07479 100644
--- a/2024/CVE-2024-50246.md
+++ b/2024/CVE-2024-50246.md
@@ -13,7 +13,7 @@ In the Linux kernel, the following vulnerability has been resolved:fs/ntfs3: Add
 ### POC
 
 #### Reference
-No PoCs from references.
+- https://cert-portal.siemens.com/productcert/html/ssa-082556.html
 
 #### Github
 - https://github.com/bygregonline/devsec-fastapi-report
diff --git a/2024/CVE-2024-53166.md b/2024/CVE-2024-53166.md
index 4ca2e0cedb..e01adc9be1 100644
--- a/2024/CVE-2024-53166.md
+++ b/2024/CVE-2024-53166.md
@@ -13,7 +13,7 @@ In the Linux kernel, the following vulnerability has been resolved:block, bfq: f
 ### POC
 
 #### Reference
-No PoCs from references.
+- https://cert-portal.siemens.com/productcert/html/ssa-082556.html
 
 #### Github
 - https://github.com/bygregonline/devsec-fastapi-report
diff --git a/2024/CVE-2024-57924.md b/2024/CVE-2024-57924.md
index 5c66d3d760..cbe3789bef 100644
--- a/2024/CVE-2024-57924.md
+++ b/2024/CVE-2024-57924.md
@@ -14,7 +14,7 @@ In the Linux kernel, the following vulnerability has been resolved:fs: relax ass
 ### POC
 
 #### Reference
-No PoCs from references.
+- https://cert-portal.siemens.com/productcert/html/ssa-082556.html
 
 #### Github
 - https://github.com/ARPSyndicate/cve-scores
diff --git a/2024/CVE-2024-57977.md b/2024/CVE-2024-57977.md
index 16a025629b..c4ac113466 100644
--- a/2024/CVE-2024-57977.md
+++ b/2024/CVE-2024-57977.md
@@ -14,6 +14,7 @@ In the Linux kernel, the following vulnerability has been resolved:memcg: fix so
 ### POC
 
 #### Reference
+- https://cert-portal.siemens.com/productcert/html/ssa-082556.html
 - https://cert-portal.siemens.com/productcert/html/ssa-265688.html
 
 #### Github
diff --git a/2024/CVE-2024-57996.md b/2024/CVE-2024-57996.md
index 32460160e1..43fd094dd6 100644
--- a/2024/CVE-2024-57996.md
+++ b/2024/CVE-2024-57996.md
@@ -13,7 +13,7 @@ In the Linux kernel, the following vulnerability has been resolved:net_sched: sc
 ### POC
 
 #### Reference
-No PoCs from references.
+- https://cert-portal.siemens.com/productcert/html/ssa-082556.html
 
 #### Github
 - https://github.com/w4zu/Debian_security
diff --git a/2024/CVE-2024-58005.md b/2024/CVE-2024-58005.md
index 443b743207..b745b392c8 100644
--- a/2024/CVE-2024-58005.md
+++ b/2024/CVE-2024-58005.md
@@ -14,6 +14,7 @@ In the Linux kernel, the following vulnerability has been resolved:tpm: Change t
 ### POC
 
 #### Reference
+- https://cert-portal.siemens.com/productcert/html/ssa-082556.html
 - https://cert-portal.siemens.com/productcert/html/ssa-265688.html
 
 #### Github
diff --git a/2024/CVE-2024-6119.md b/2024/CVE-2024-6119.md
index 1eac90fdb2..2e21908fa0 100644
--- a/2024/CVE-2024-6119.md
+++ b/2024/CVE-2024-6119.md
@@ -16,6 +16,7 @@ Issue summary: Applications performing certificate name checks (e.g., TLSclients
 ### POC
 
 #### Reference
+- https://cert-portal.siemens.com/productcert/html/ssa-082556.html
 - https://cert-portal.siemens.com/productcert/html/ssa-613116.html
 
 #### Github
diff --git a/2024/CVE-2024-6387.md b/2024/CVE-2024-6387.md
index 3d7720e94e..0229b8bcd2 100644
--- a/2024/CVE-2024-6387.md
+++ b/2024/CVE-2024-6387.md
@@ -32,6 +32,7 @@ A security regression (CVE-2006-5051) was discovered in OpenSSH's server (sshd).
 - http://www.openwall.com/lists/oss-security/2024/07/03/5
 - http://www.openwall.com/lists/oss-security/2024/07/28/2
 - https://blog.qualys.com/vulnerabilities-threat-research/2024/07/01/regresshion-remote-unauthenticated-code-execution-vulnerability-in-openssh-server
+- https://cert-portal.siemens.com/productcert/html/ssa-082556.html
 - https://github.com/zgzhang/cve-2024-6387-poc
 - https://news.ycombinator.com/item?id=40843778
 - https://santandersecurityresearch.github.io/blog/sshing_the_masses.html
diff --git a/2024/CVE-2024-6963.md b/2024/CVE-2024-6963.md
index 685ce7d079..d7e019fbd0 100644
--- a/2024/CVE-2024-6963.md
+++ b/2024/CVE-2024-6963.md
@@ -12,6 +12,7 @@ Eine Schwachstelle wurde in Tenda O3 1.0.0.10 entdeckt. Sie wurde als kritisch e
 
 #### Reference
 - https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/O3V2.0/formexeCommand.md
+- https://vuldb.com/?ctiid.272117
 - https://vuldb.com/?id.272117
 
 #### Github
diff --git a/2025/CVE-2025-11082.md b/2025/CVE-2025-11082.md
index adcaf71d61..ab293f41b9 100644
--- a/2025/CVE-2025-11082.md
+++ b/2025/CVE-2025-11082.md
@@ -13,7 +13,7 @@ In GNU Binutils 2.45 ist eine Schwachstelle entdeckt worden. Betroffen davon ist
 ### POC
 
 #### Reference
-No PoCs from references.
+- https://cert-portal.siemens.com/productcert/html/ssa-082556.html
 
 #### Github
 - https://github.com/raph-rcn/devsecops-juice-shop
diff --git a/2025/CVE-2025-11083.md b/2025/CVE-2025-11083.md
index 23c2566471..1dd1886fec 100644
--- a/2025/CVE-2025-11083.md
+++ b/2025/CVE-2025-11083.md
@@ -13,7 +13,7 @@ Eine Schwachstelle wurde in GNU Binutils 2.45 gefunden. Es betrifft die Funktion
 ### POC
 
 #### Reference
-No PoCs from references.
+- https://cert-portal.siemens.com/productcert/html/ssa-082556.html
 
 #### Github
 - https://github.com/raph-rcn/devsecops-juice-shop
diff --git a/2025/CVE-2025-11412.md b/2025/CVE-2025-11412.md
new file mode 100644
index 0000000000..bd3baa4acd
--- /dev/null
+++ b/2025/CVE-2025-11412.md
@@ -0,0 +1,19 @@
+### [CVE-2025-11412](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-11412)
+![](https://img.shields.io/static/v1?label=Product&message=Binutils&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=2.45%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Version&message=V3.1.5%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=Memory%20Corruption&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=Out-of-Bounds%20Read&color=brightgreen)
+
+### Description
+
+A vulnerability has been found in GNU Binutils 2.45. This impacts the function bfd_elf_gc_record_vtentry of the file bfd/elflink.c of the component Linker. The manipulation leads to out-of-bounds read. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. The identifier of the patch is 047435dd988a3975d40c6626a8f739a0b2e154bc. To fix this issue, it is recommended to deploy a patch.
+
+### POC
+
+#### Reference
+- https://cert-portal.siemens.com/productcert/html/ssa-082556.html
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2025/CVE-2025-11413.md b/2025/CVE-2025-11413.md
new file mode 100644
index 0000000000..479bbd436e
--- /dev/null
+++ b/2025/CVE-2025-11413.md
@@ -0,0 +1,20 @@
+### [CVE-2025-11413](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-11413)
+![](https://img.shields.io/static/v1?label=Product&message=Binutils&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Version&message=2.45%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Version&message=V3.1.5%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=Memory%20Corruption&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=Out-of-Bounds%20Read&color=brightgreen)
+
+### Description
+
+A vulnerability was found in GNU Binutils 2.45. Affected is the function elf_link_add_object_symbols of the file bfd/elflink.c of the component Linker. The manipulation results in out-of-bounds read. The attack needs to be approached locally. The exploit has been made public and could be used. Upgrading to version 2.46 is able to address this issue. The patch is identified as 72efdf166aa0ed72ecc69fc2349af6591a7a19c0. Upgrading the affected component is advised.
+
+### POC
+
+#### Reference
+- https://cert-portal.siemens.com/productcert/html/ssa-082556.html
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2025/CVE-2025-11414.md b/2025/CVE-2025-11414.md
new file mode 100644
index 0000000000..7b5fa7d218
--- /dev/null
+++ b/2025/CVE-2025-11414.md
@@ -0,0 +1,20 @@
+### [CVE-2025-11414](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-11414)
+![](https://img.shields.io/static/v1?label=Product&message=Binutils&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Version&message=2.45%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Version&message=V3.1.5%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=Memory%20Corruption&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=Out-of-Bounds%20Read&color=brightgreen)
+
+### Description
+
+A vulnerability was determined in GNU Binutils 2.45. Affected by this vulnerability is the function get_link_hash_entry of the file bfd/elflink.c of the component Linker. This manipulation causes out-of-bounds read. The attack can only be executed locally. The exploit has been publicly disclosed and may be utilized. Upgrading to version 2.46 addresses this issue. Patch name: aeaaa9af6359c8e394ce9cf24911fec4f4d23703. It is advisable to upgrade the affected component.
+
+### POC
+
+#### Reference
+- https://cert-portal.siemens.com/productcert/html/ssa-082556.html
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2025/CVE-2025-11494.md b/2025/CVE-2025-11494.md
index 5270611bf5..424c8ae1d0 100644
--- a/2025/CVE-2025-11494.md
+++ b/2025/CVE-2025-11494.md
@@ -12,6 +12,7 @@ A vulnerability was found in GNU Binutils 2.45. Impacted is the function _bfd_x8
 ### POC
 
 #### Reference
+- https://cert-portal.siemens.com/productcert/html/ssa-082556.html
 - https://vuldb.com/?id.327619
 
 #### Github
diff --git a/2025/CVE-2025-11495.md b/2025/CVE-2025-11495.md
new file mode 100644
index 0000000000..87bd6ec0bb
--- /dev/null
+++ b/2025/CVE-2025-11495.md
@@ -0,0 +1,19 @@
+### [CVE-2025-11495](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-11495)
+![](https://img.shields.io/static/v1?label=Product&message=Binutils&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=2.45%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Version&message=V3.1.5%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=Heap-based%20Buffer%20Overflow&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=Memory%20Corruption&color=brightgreen)
+
+### Description
+
+A vulnerability was determined in GNU Binutils 2.45. The affected element is the function elf_x86_64_relocate_section of the file elf64-x86-64.c of the component Linker. This manipulation causes heap-based buffer overflow. The attack can only be executed locally. The exploit has been publicly disclosed and may be utilized. Patch name: 6b21c8b2ecfef5c95142cbc2c32f185cb1c26ab0. To fix this issue, it is recommended to deploy a patch.
+
+### POC
+
+#### Reference
+- https://cert-portal.siemens.com/productcert/html/ssa-082556.html
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2025/CVE-2025-11839.md b/2025/CVE-2025-11839.md
new file mode 100644
index 0000000000..6ef8dc40f5
--- /dev/null
+++ b/2025/CVE-2025-11839.md
@@ -0,0 +1,19 @@
+### [CVE-2025-11839](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-11839)
+![](https://img.shields.io/static/v1?label=Product&message=Binutils&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=2.45%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Version&message=V3.1.5%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=Incorrect%20Check%20of%20Function%20Return%20Value&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=Unchecked%20Return%20Value&color=brightgreen)
+
+### Description
+
+A security flaw has been discovered in GNU Binutils 2.45. Impacted is the function tg_tag_type of the file prdbg.c. Performing a manipulation results in unchecked return value. The attack needs to be approached locally. The exploit has been released to the public and may be used for attacks.
+
+### POC
+
+#### Reference
+- https://cert-portal.siemens.com/productcert/html/ssa-082556.html
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2025/CVE-2025-11840.md b/2025/CVE-2025-11840.md
new file mode 100644
index 0000000000..1d97ecd4cc
--- /dev/null
+++ b/2025/CVE-2025-11840.md
@@ -0,0 +1,19 @@
+### [CVE-2025-11840](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-11840)
+![](https://img.shields.io/static/v1?label=Product&message=Binutils&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=2.45%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Version&message=V3.1.5%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=Memory%20Corruption&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=Out-of-Bounds%20Read&color=brightgreen)
+
+### Description
+
+A weakness has been identified in GNU Binutils 2.45. The affected element is the function vfinfo of the file ldmisc.c. Executing a manipulation can lead to out-of-bounds read. The attack can only be executed locally. The exploit has been made available to the public and could be used for attacks. This patch is called 16357. It is best practice to apply a patch to resolve this issue.
+
+### POC
+
+#### Reference
+- https://cert-portal.siemens.com/productcert/html/ssa-082556.html
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2025/CVE-2025-15665.md b/2025/CVE-2025-15665.md
new file mode 100644
index 0000000000..a5c9a44f23
--- /dev/null
+++ b/2025/CVE-2025-15665.md
@@ -0,0 +1,17 @@
+### [CVE-2025-15665](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-15665)
+![](https://img.shields.io/static/v1?label=Product&message=Ultimate%20Before%20After%20Image%20Slider%20%26%20Gallery&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-79%20Cross-Site%20Scripting%20(XSS)&color=brightgreen)
+
+### Description
+
+The Ultimate Before After Image Slider & Gallery  WordPress plugin before 4.7.1 does not escape the value of the BEAF Slider widget's shortcode field before outputting it on the front end (the value is passed through do_shortcode, which echoes non-shortcode content verbatim), allowing users with administrator-level access to store a script that executes in the browser of any visitor who loads a page displaying the widget.
+
+### POC
+
+#### Reference
+- https://wpscan.com/vulnerability/754f0960-efc8-426f-bb1d-7cceec920910/
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2025/CVE-2025-1840.md b/2025/CVE-2025-1840.md
index ca8e47f211..13e651fe9a 100644
--- a/2025/CVE-2025-1840.md
+++ b/2025/CVE-2025-1840.md
@@ -14,6 +14,7 @@ Eine kritische Schwachstelle wurde in ESAFENET CDG 5.6.3.154.205 ausgemacht. Es
 #### Reference
 - https://github.com/Rain1er/report/blob/main/CDG/dXBkYXRlb3JnLmpzcA%3D%3D.md
 - https://vuldb.com/?id.298106
+- https://vuldb.com/?submit.504384
 
 #### Github
 No PoCs found on GitHub currently.
diff --git a/2025/CVE-2025-21701.md b/2025/CVE-2025-21701.md
index 9ef10ffa1b..77e4e02059 100644
--- a/2025/CVE-2025-21701.md
+++ b/2025/CVE-2025-21701.md
@@ -17,7 +17,7 @@ In the Linux kernel, the following vulnerability has been resolved:net: avoid ra
 ### POC
 
 #### Reference
-No PoCs from references.
+- https://cert-portal.siemens.com/productcert/html/ssa-082556.html
 
 #### Github
 - https://github.com/fkie-cad/nvd-json-data-feeds
diff --git a/2025/CVE-2025-21702.md b/2025/CVE-2025-21702.md
index 358975942f..e9bde4de5b 100644
--- a/2025/CVE-2025-21702.md
+++ b/2025/CVE-2025-21702.md
@@ -13,7 +13,7 @@ In the Linux kernel, the following vulnerability has been resolved:pfifo_tail_en
 ### POC
 
 #### Reference
-No PoCs from references.
+- https://cert-portal.siemens.com/productcert/html/ssa-082556.html
 
 #### Github
 - https://github.com/ARPSyndicate/cve-scores
diff --git a/2025/CVE-2025-21712.md b/2025/CVE-2025-21712.md
index da96e82e47..98d855b5a0 100644
--- a/2025/CVE-2025-21712.md
+++ b/2025/CVE-2025-21712.md
@@ -13,7 +13,7 @@ In the Linux kernel, the following vulnerability has been resolved:md/md-bitmap:
 ### POC
 
 #### Reference
-No PoCs from references.
+- https://cert-portal.siemens.com/productcert/html/ssa-082556.html
 
 #### Github
 - https://github.com/fkie-cad/nvd-json-data-feeds
diff --git a/2025/CVE-2025-21724.md b/2025/CVE-2025-21724.md
index f3b7fb9e08..a5028e4038 100644
--- a/2025/CVE-2025-21724.md
+++ b/2025/CVE-2025-21724.md
@@ -13,7 +13,7 @@ In the Linux kernel, the following vulnerability has been resolved:iommufd/iova_
 ### POC
 
 #### Reference
-No PoCs from references.
+- https://cert-portal.siemens.com/productcert/html/ssa-082556.html
 
 #### Github
 - https://github.com/w4zu/Debian_security
diff --git a/2025/CVE-2025-21728.md b/2025/CVE-2025-21728.md
index 1d18488144..ecd08e0e32 100644
--- a/2025/CVE-2025-21728.md
+++ b/2025/CVE-2025-21728.md
@@ -18,6 +18,7 @@ In the Linux kernel, the following vulnerability has been resolved:bpf: Send sig
 ### POC
 
 #### Reference
+- https://cert-portal.siemens.com/productcert/html/ssa-082556.html
 - https://cert-portal.siemens.com/productcert/html/ssa-265688.html
 
 #### Github
diff --git a/2025/CVE-2025-21745.md b/2025/CVE-2025-21745.md
index d12d1449d3..98e193d194 100644
--- a/2025/CVE-2025-21745.md
+++ b/2025/CVE-2025-21745.md
@@ -14,6 +14,7 @@ In the Linux kernel, the following vulnerability has been resolved:blk-cgroup: F
 ### POC
 
 #### Reference
+- https://cert-portal.siemens.com/productcert/html/ssa-082556.html
 - https://cert-portal.siemens.com/productcert/html/ssa-265688.html
 
 #### Github
diff --git a/2025/CVE-2025-21756.md b/2025/CVE-2025-21756.md
index 684ea69762..fe25517ff1 100644
--- a/2025/CVE-2025-21756.md
+++ b/2025/CVE-2025-21756.md
@@ -14,6 +14,7 @@ In the Linux kernel, the following vulnerability has been resolved:vsock: Keep t
 ### POC
 
 #### Reference
+- https://cert-portal.siemens.com/productcert/html/ssa-082556.html
 - https://cert-portal.siemens.com/productcert/html/ssa-265688.html
 
 #### Github
diff --git a/2025/CVE-2025-21758.md b/2025/CVE-2025-21758.md
index 44758e0215..5ddae9cd90 100644
--- a/2025/CVE-2025-21758.md
+++ b/2025/CVE-2025-21758.md
@@ -13,7 +13,7 @@ In the Linux kernel, the following vulnerability has been resolved:ipv6: mcast:
 ### POC
 
 #### Reference
-No PoCs from references.
+- https://cert-portal.siemens.com/productcert/html/ssa-082556.html
 
 #### Github
 - https://github.com/w4zu/Debian_security
diff --git a/2025/CVE-2025-21765.md b/2025/CVE-2025-21765.md
index 3940672dcf..5f8c24d709 100644
--- a/2025/CVE-2025-21765.md
+++ b/2025/CVE-2025-21765.md
@@ -14,6 +14,7 @@ In the Linux kernel, the following vulnerability has been resolved:ipv6: use RCU
 ### POC
 
 #### Reference
+- https://cert-portal.siemens.com/productcert/html/ssa-082556.html
 - https://cert-portal.siemens.com/productcert/html/ssa-265688.html
 
 #### Github
diff --git a/2025/CVE-2025-21766.md b/2025/CVE-2025-21766.md
index 0f02b31577..903f14bfb5 100644
--- a/2025/CVE-2025-21766.md
+++ b/2025/CVE-2025-21766.md
@@ -21,7 +21,7 @@ In the Linux kernel, the following vulnerability has been resolved:ipv4: use RCU
 ### POC
 
 #### Reference
-No PoCs from references.
+- https://cert-portal.siemens.com/productcert/html/ssa-082556.html
 
 #### Github
 - https://github.com/w4zu/Debian_security
diff --git a/2025/CVE-2025-21767.md b/2025/CVE-2025-21767.md
index 2d250c7ecd..74449875ed 100644
--- a/2025/CVE-2025-21767.md
+++ b/2025/CVE-2025-21767.md
@@ -19,7 +19,7 @@ In the Linux kernel, the following vulnerability has been resolved:clocksource:
 ### POC
 
 #### Reference
-No PoCs from references.
+- https://cert-portal.siemens.com/productcert/html/ssa-082556.html
 
 #### Github
 - https://github.com/w4zu/Debian_security
diff --git a/2025/CVE-2025-21795.md b/2025/CVE-2025-21795.md
index 23ea2de672..80aef9fe04 100644
--- a/2025/CVE-2025-21795.md
+++ b/2025/CVE-2025-21795.md
@@ -18,6 +18,7 @@ In the Linux kernel, the following vulnerability has been resolved:NFSD: fix han
 ### POC
 
 #### Reference
+- https://cert-portal.siemens.com/productcert/html/ssa-082556.html
 - https://cert-portal.siemens.com/productcert/html/ssa-265688.html
 
 #### Github
diff --git a/2025/CVE-2025-21796.md b/2025/CVE-2025-21796.md
index 452c4ebb0e..2e8a8abd1e 100644
--- a/2025/CVE-2025-21796.md
+++ b/2025/CVE-2025-21796.md
@@ -14,6 +14,7 @@ In the Linux kernel, the following vulnerability has been resolved:nfsd: clear a
 ### POC
 
 #### Reference
+- https://cert-portal.siemens.com/productcert/html/ssa-082556.html
 - https://cert-portal.siemens.com/productcert/html/ssa-265688.html
 
 #### Github
diff --git a/2025/CVE-2025-21848.md b/2025/CVE-2025-21848.md
index ea077f096e..d4c0ec0acd 100644
--- a/2025/CVE-2025-21848.md
+++ b/2025/CVE-2025-21848.md
@@ -13,7 +13,7 @@ In the Linux kernel, the following vulnerability has been resolved:nfp: bpf: Add
 ### POC
 
 #### Reference
-No PoCs from references.
+- https://cert-portal.siemens.com/productcert/html/ssa-082556.html
 
 #### Github
 - https://github.com/fkie-cad/nvd-json-data-feeds
diff --git a/2025/CVE-2025-21862.md b/2025/CVE-2025-21862.md
index 84984ec607..d27978a246 100644
--- a/2025/CVE-2025-21862.md
+++ b/2025/CVE-2025-21862.md
@@ -14,6 +14,7 @@ In the Linux kernel, the following vulnerability has been resolved:drop_monitor:
 ### POC
 
 #### Reference
+- https://cert-portal.siemens.com/productcert/html/ssa-082556.html
 - https://cert-portal.siemens.com/productcert/html/ssa-265688.html
 
 #### Github
diff --git a/2025/CVE-2025-21864.md b/2025/CVE-2025-21864.md
index 032ae01546..8f7039932b 100644
--- a/2025/CVE-2025-21864.md
+++ b/2025/CVE-2025-21864.md
@@ -13,7 +13,7 @@ In the Linux kernel, the following vulnerability has been resolved:tcp: drop sec
 ### POC
 
 #### Reference
-No PoCs from references.
+- https://cert-portal.siemens.com/productcert/html/ssa-082556.html
 
 #### Github
 - https://github.com/fkie-cad/nvd-json-data-feeds
diff --git a/2025/CVE-2025-21865.md b/2025/CVE-2025-21865.md
index 981d11b936..9549cfbff8 100644
--- a/2025/CVE-2025-21865.md
+++ b/2025/CVE-2025-21865.md
@@ -26,6 +26,7 @@ In the Linux kernel, the following vulnerability has been resolved:gtp: Suppress
 ### POC
 
 #### Reference
+- https://cert-portal.siemens.com/productcert/html/ssa-082556.html
 - https://cert-portal.siemens.com/productcert/html/ssa-265688.html
 
 #### Github
diff --git a/2025/CVE-2025-26465.md b/2025/CVE-2025-26465.md
index 09e5798d55..8772cccbb0 100644
--- a/2025/CVE-2025-26465.md
+++ b/2025/CVE-2025-26465.md
@@ -22,6 +22,7 @@ A vulnerability was found in OpenSSH when the VerifyHostKeyDNS option is enabled
 #### Reference
 - http://seclists.org/fulldisclosure/2025/Feb/18
 - https://bugzilla.suse.com/show_bug.cgi?id=1237040
+- https://cert-portal.siemens.com/productcert/html/ssa-082556.html
 - https://seclists.org/oss-sec/2025/q1/144
 - https://www.openwall.com/lists/oss-security/2025/02/18/1
 - https://www.theregister.com/2025/02/18/openssh_vulnerabilities_mitm_dos/
diff --git a/2025/CVE-2025-29329.md b/2025/CVE-2025-29329.md
new file mode 100644
index 0000000000..fd1c42a946
--- /dev/null
+++ b/2025/CVE-2025-29329.md
@@ -0,0 +1,17 @@
+### [CVE-2025-29329](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-29329)
+![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen)
+
+### Description
+
+Buffer Overflow in the ippprint (Internet Printing Protocol) service in Sagemcom F@st 3686 MAGYAR_4.121.0 allows remote attacker to execute arbitrary code by sending a crafted HTTP request.
+
+### POC
+
+#### Reference
+- https://github.com/SilverS3c/Sagemcom-fast-3686-ippprint
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2025/CVE-2025-29338.md b/2025/CVE-2025-29338.md
new file mode 100644
index 0000000000..2090916b1d
--- /dev/null
+++ b/2025/CVE-2025-29338.md
@@ -0,0 +1,17 @@
+### [CVE-2025-29338](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-29338)
+![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen)
+
+### Description
+
+NXP moal.ko Wi-Fi driver 5.1.7.10 FW version from v17.92.1.p149.43 To v17.92.1.p149.157 was discovered to contain a buffer overflow via the mod_para parameter in the woal_init_module_param function.
+
+### POC
+
+#### Reference
+- https://github.com/masjadaan/CVE-2025-29338
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2025/CVE-2025-31115.md b/2025/CVE-2025-31115.md
index faf6460e3e..b150d5aa3c 100644
--- a/2025/CVE-2025-31115.md
+++ b/2025/CVE-2025-31115.md
@@ -14,7 +14,7 @@ XZ Utils provide a general-purpose data-compression library plus command-line to
 ### POC
 
 #### Reference
-No PoCs from references.
+- https://cert-portal.siemens.com/productcert/html/ssa-082556.html
 
 #### Github
 - https://github.com/adegoodyer/kubernetes-admin-toolkit
diff --git a/2025/CVE-2025-3198.md b/2025/CVE-2025-3198.md
index fe709dbba6..858f523cd6 100644
--- a/2025/CVE-2025-3198.md
+++ b/2025/CVE-2025-3198.md
@@ -15,6 +15,7 @@ In GNU Binutils 2.43/2.44 wurde eine Schwachstelle gefunden. Sie wurde als probl
 ### POC
 
 #### Reference
+- https://cert-portal.siemens.com/productcert/html/ssa-082556.html
 - https://cert-portal.siemens.com/productcert/html/ssa-265688.html
 
 #### Github
diff --git a/2025/CVE-2025-32988.md b/2025/CVE-2025-32988.md
index 50c35d11a4..72718ed6ee 100644
--- a/2025/CVE-2025-32988.md
+++ b/2025/CVE-2025-32988.md
@@ -24,7 +24,7 @@ A flaw was found in GnuTLS. A double-free vulnerability exists in GnuTLS due to
 ### POC
 
 #### Reference
-No PoCs from references.
+- https://cert-portal.siemens.com/productcert/html/ssa-082556.html
 
 #### Github
 - https://github.com/GitHubForSnap/ssmtp-gael
diff --git a/2025/CVE-2025-32989.md b/2025/CVE-2025-32989.md
index 6c1a982069..8ab84e5bba 100644
--- a/2025/CVE-2025-32989.md
+++ b/2025/CVE-2025-32989.md
@@ -24,7 +24,7 @@ A heap-buffer-overread vulnerability was found in GnuTLS in how it handles the C
 ### POC
 
 #### Reference
-No PoCs from references.
+- https://cert-portal.siemens.com/productcert/html/ssa-082556.html
 
 #### Github
 - https://github.com/GitHubForSnap/ssmtp-gael
diff --git a/2025/CVE-2025-34160.md b/2025/CVE-2025-34160.md
index 29991ac88a..04c53b6224 100644
--- a/2025/CVE-2025-34160.md
+++ b/2025/CVE-2025-34160.md
@@ -10,6 +10,7 @@ AnyShare contains a critical unauthenticated remote code execution vulnerability
 ### POC
 
 #### Reference
+- https://cn-sec.com/archives/4320091.html
 - https://stack.chaitin.com/vuldb/detail/b4640952-9be9-4bfa-9d7f-a0be72b35e18
 - https://www.vulncheck.com/advisories/anyshare-serviceagent-api-unauthenticated-rce
 
diff --git a/2025/CVE-2025-34162.md b/2025/CVE-2025-34162.md
index 0291570899..a0aaac8f3a 100644
--- a/2025/CVE-2025-34162.md
+++ b/2025/CVE-2025-34162.md
@@ -10,6 +10,7 @@ An unauthenticated SQL injection vulnerability exists in the GetLyfsByParams end
 ### POC
 
 #### Reference
+- https://cn-sec.com/archives/4160402.html
 - https://github.com/wooluo/nuclei-templates-2025hw/blob/main/bianque-medical-sql-injection.yaml
 - https://www.vulncheck.com/advisories/bian-que-feiju-intelligent-emergency-and-quality-control-system-sqli
 
diff --git a/2025/CVE-2025-34163.md b/2025/CVE-2025-34163.md
index 0b104639d6..95dbc2bf3e 100644
--- a/2025/CVE-2025-34163.md
+++ b/2025/CVE-2025-34163.md
@@ -10,6 +10,7 @@ Dongsheng Logistics Software exposes an unauthenticated endpoint at /CommMng/Pri
 ### POC
 
 #### Reference
+- https://cn-sec.com/archives/4243708.html
 - https://www.vulncheck.com/advisories/dongsheng-logisitics-software-unauth-arbitrary-file-upload
 
 #### Github
diff --git a/2025/CVE-2025-38058.md b/2025/CVE-2025-38058.md
index 2507ae93cf..dd28d04ac1 100644
--- a/2025/CVE-2025-38058.md
+++ b/2025/CVE-2025-38058.md
@@ -13,7 +13,7 @@ In the Linux kernel, the following vulnerability has been resolved:__legitimize_
 ### POC
 
 #### Reference
-No PoCs from references.
+- https://cert-portal.siemens.com/productcert/html/ssa-082556.html
 
 #### Github
 - https://github.com/w4zu/Debian_security
diff --git a/2025/CVE-2025-38063.md b/2025/CVE-2025-38063.md
index a8ec5d077b..c53102d3b2 100644
--- a/2025/CVE-2025-38063.md
+++ b/2025/CVE-2025-38063.md
@@ -13,7 +13,7 @@ In the Linux kernel, the following vulnerability has been resolved:dm: fix uncon
 ### POC
 
 #### Reference
-No PoCs from references.
+- https://cert-portal.siemens.com/productcert/html/ssa-082556.html
 
 #### Github
 - https://github.com/w4zu/Debian_security
diff --git a/2025/CVE-2025-38067.md b/2025/CVE-2025-38067.md
index 6ec6faddf8..22703f85a2 100644
--- a/2025/CVE-2025-38067.md
+++ b/2025/CVE-2025-38067.md
@@ -13,7 +13,7 @@ In the Linux kernel, the following vulnerability has been resolved:rseq: Fix seg
 ### POC
 
 #### Reference
-No PoCs from references.
+- https://cert-portal.siemens.com/productcert/html/ssa-082556.html
 
 #### Github
 - https://github.com/w4zu/Debian_security
diff --git a/2025/CVE-2025-38071.md b/2025/CVE-2025-38071.md
index 9c6922e929..4b10376c04 100644
--- a/2025/CVE-2025-38071.md
+++ b/2025/CVE-2025-38071.md
@@ -13,7 +13,7 @@ In the Linux kernel, the following vulnerability has been resolved:x86/mm: Check
 ### POC
 
 #### Reference
-No PoCs from references.
+- https://cert-portal.siemens.com/productcert/html/ssa-082556.html
 
 #### Github
 - https://github.com/w4zu/Debian_security
diff --git a/2025/CVE-2025-38079.md b/2025/CVE-2025-38079.md
index 1af7117719..f6107376e7 100644
--- a/2025/CVE-2025-38079.md
+++ b/2025/CVE-2025-38079.md
@@ -13,7 +13,7 @@ In the Linux kernel, the following vulnerability has been resolved:crypto: algif
 ### POC
 
 #### Reference
-No PoCs from references.
+- https://cert-portal.siemens.com/productcert/html/ssa-082556.html
 
 #### Github
 - https://github.com/w4zu/Debian_security
diff --git a/2025/CVE-2025-38083.md b/2025/CVE-2025-38083.md
index dc76b8c2fe..f55484722c 100644
--- a/2025/CVE-2025-38083.md
+++ b/2025/CVE-2025-38083.md
@@ -13,7 +13,7 @@ In the Linux kernel, the following vulnerability has been resolved:net_sched: pr
 ### POC
 
 #### Reference
-No PoCs from references.
+- https://cert-portal.siemens.com/productcert/html/ssa-082556.html
 
 #### Github
 - https://github.com/w4zu/Debian_security
diff --git a/2025/CVE-2025-38100.md b/2025/CVE-2025-38100.md
index cef9388e74..e58129d887 100644
--- a/2025/CVE-2025-38100.md
+++ b/2025/CVE-2025-38100.md
@@ -13,7 +13,7 @@ In the Linux kernel, the following vulnerability has been resolved:x86/iopl: Cur
 ### POC
 
 #### Reference
-No PoCs from references.
+- https://cert-portal.siemens.com/productcert/html/ssa-082556.html
 
 #### Github
 - https://github.com/w4zu/Debian_security
diff --git a/2025/CVE-2025-38111.md b/2025/CVE-2025-38111.md
index 0ad6f86f87..bb7f92a432 100644
--- a/2025/CVE-2025-38111.md
+++ b/2025/CVE-2025-38111.md
@@ -13,7 +13,7 @@ In the Linux kernel, the following vulnerability has been resolved:net/mdiobus:
 ### POC
 
 #### Reference
-No PoCs from references.
+- https://cert-portal.siemens.com/productcert/html/ssa-082556.html
 
 #### Github
 - https://github.com/w4zu/Debian_security
diff --git a/2025/CVE-2025-38124.md b/2025/CVE-2025-38124.md
index 5ee7cebb6f..9d5eadbb8d 100644
--- a/2025/CVE-2025-38124.md
+++ b/2025/CVE-2025-38124.md
@@ -21,7 +21,7 @@ In the Linux kernel, the following vulnerability has been resolved:net: fix udp
 ### POC
 
 #### Reference
-No PoCs from references.
+- https://cert-portal.siemens.com/productcert/html/ssa-082556.html
 
 #### Github
 - https://github.com/w4zu/Debian_security
diff --git a/2025/CVE-2025-38167.md b/2025/CVE-2025-38167.md
index 6feebcaff7..ba06388148 100644
--- a/2025/CVE-2025-38167.md
+++ b/2025/CVE-2025-38167.md
@@ -13,7 +13,7 @@ In the Linux kernel, the following vulnerability has been resolved:fs/ntfs3: han
 ### POC
 
 #### Reference
-No PoCs from references.
+- https://cert-portal.siemens.com/productcert/html/ssa-082556.html
 
 #### Github
 - https://github.com/w4zu/Debian_security
diff --git a/2025/CVE-2025-38198.md b/2025/CVE-2025-38198.md
index 4e649931d1..70723ba803 100644
--- a/2025/CVE-2025-38198.md
+++ b/2025/CVE-2025-38198.md
@@ -13,7 +13,7 @@ In the Linux kernel, the following vulnerability has been resolved:fbcon: Make s
 ### POC
 
 #### Reference
-No PoCs from references.
+- https://cert-portal.siemens.com/productcert/html/ssa-082556.html
 
 #### Github
 - https://github.com/w4zu/Debian_security
diff --git a/2025/CVE-2025-38212.md b/2025/CVE-2025-38212.md
index 787d3161c4..21cdc2bcb5 100644
--- a/2025/CVE-2025-38212.md
+++ b/2025/CVE-2025-38212.md
@@ -13,7 +13,7 @@ In the Linux kernel, the following vulnerability has been resolved:ipc: fix to p
 ### POC
 
 #### Reference
-No PoCs from references.
+- https://cert-portal.siemens.com/productcert/html/ssa-082556.html
 
 #### Github
 - https://github.com/ARPSyndicate/cve-scores
diff --git a/2025/CVE-2025-38214.md b/2025/CVE-2025-38214.md
index 892df46cc9..38f71b7019 100644
--- a/2025/CVE-2025-38214.md
+++ b/2025/CVE-2025-38214.md
@@ -13,7 +13,7 @@ In the Linux kernel, the following vulnerability has been resolved:fbdev: Fix fb
 ### POC
 
 #### Reference
-No PoCs from references.
+- https://cert-portal.siemens.com/productcert/html/ssa-082556.html
 
 #### Github
 - https://github.com/w4zu/Debian_security
diff --git a/2025/CVE-2025-38215.md b/2025/CVE-2025-38215.md
index 75a9397421..43975f90c4 100644
--- a/2025/CVE-2025-38215.md
+++ b/2025/CVE-2025-38215.md
@@ -13,7 +13,7 @@ In the Linux kernel, the following vulnerability has been resolved:fbdev: Fix do
 ### POC
 
 #### Reference
-No PoCs from references.
+- https://cert-portal.siemens.com/productcert/html/ssa-082556.html
 
 #### Github
 - https://github.com/w4zu/Debian_security
diff --git a/2025/CVE-2025-38222.md b/2025/CVE-2025-38222.md
index ae8679e694..ff861a1f53 100644
--- a/2025/CVE-2025-38222.md
+++ b/2025/CVE-2025-38222.md
@@ -13,7 +13,7 @@ In the Linux kernel, the following vulnerability has been resolved:ext4: inline:
 ### POC
 
 #### Reference
-No PoCs from references.
+- https://cert-portal.siemens.com/productcert/html/ssa-082556.html
 
 #### Github
 - https://github.com/w4zu/Debian_security
diff --git a/2025/CVE-2025-38231.md b/2025/CVE-2025-38231.md
index 085653d36d..bbc2595dcb 100644
--- a/2025/CVE-2025-38231.md
+++ b/2025/CVE-2025-38231.md
@@ -15,7 +15,7 @@ In the Linux kernel, the following vulnerability has been resolved:nfsd: Initial
 ### POC
 
 #### Reference
-No PoCs from references.
+- https://cert-portal.siemens.com/productcert/html/ssa-082556.html
 
 #### Github
 - https://github.com/w4zu/Debian_security
diff --git a/2025/CVE-2025-38236.md b/2025/CVE-2025-38236.md
index 8ee6464f0b..1909d53fcb 100644
--- a/2025/CVE-2025-38236.md
+++ b/2025/CVE-2025-38236.md
@@ -13,7 +13,7 @@ In the Linux kernel, the following vulnerability has been resolved:af_unix: Don'
 ### POC
 
 #### Reference
-No PoCs from references.
+- https://cert-portal.siemens.com/productcert/html/ssa-082556.html
 
 #### Github
 - https://github.com/ARPSyndicate/cve-scores
diff --git a/2025/CVE-2025-38280.md b/2025/CVE-2025-38280.md
index d6203c4a0a..ea6af8d304 100644
--- a/2025/CVE-2025-38280.md
+++ b/2025/CVE-2025-38280.md
@@ -17,7 +17,7 @@ In the Linux kernel, the following vulnerability has been resolved:bpf: Avoid __
 ### POC
 
 #### Reference
-No PoCs from references.
+- https://cert-portal.siemens.com/productcert/html/ssa-082556.html
 
 #### Github
 - https://github.com/w4zu/Debian_security
diff --git a/2025/CVE-2025-38285.md b/2025/CVE-2025-38285.md
index 60ed5c5d92..c9eb621c83 100644
--- a/2025/CVE-2025-38285.md
+++ b/2025/CVE-2025-38285.md
@@ -17,7 +17,7 @@ In the Linux kernel, the following vulnerability has been resolved:bpf: Fix WARN
 ### POC
 
 #### Reference
-No PoCs from references.
+- https://cert-portal.siemens.com/productcert/html/ssa-082556.html
 
 #### Github
 - https://github.com/w4zu/Debian_security
diff --git a/2025/CVE-2025-38312.md b/2025/CVE-2025-38312.md
index 49c5249a11..1ed61eb70c 100644
--- a/2025/CVE-2025-38312.md
+++ b/2025/CVE-2025-38312.md
@@ -13,7 +13,7 @@ In the Linux kernel, the following vulnerability has been resolved:fbdev: core:
 ### POC
 
 #### Reference
-No PoCs from references.
+- https://cert-portal.siemens.com/productcert/html/ssa-082556.html
 
 #### Github
 - https://github.com/w4zu/Debian_security
diff --git a/2025/CVE-2025-38342.md b/2025/CVE-2025-38342.md
index 28317acd41..bb2c3b5e07 100644
--- a/2025/CVE-2025-38342.md
+++ b/2025/CVE-2025-38342.md
@@ -13,7 +13,7 @@ In the Linux kernel, the following vulnerability has been resolved:software node
 ### POC
 
 #### Reference
-No PoCs from references.
+- https://cert-portal.siemens.com/productcert/html/ssa-082556.html
 
 #### Github
 - https://github.com/w4zu/Debian_security
diff --git a/2025/CVE-2025-38350.md b/2025/CVE-2025-38350.md
index 689f0ce2a5..33ca31ee6b 100644
--- a/2025/CVE-2025-38350.md
+++ b/2025/CVE-2025-38350.md
@@ -28,7 +28,7 @@ In the Linux kernel, the following vulnerability has been resolved:net/sched: Al
 ### POC
 
 #### Reference
-No PoCs from references.
+- https://cert-portal.siemens.com/productcert/html/ssa-082556.html
 
 #### Github
 - https://github.com/w4zu/Debian_security
diff --git a/2025/CVE-2025-38364.md b/2025/CVE-2025-38364.md
index ae227d6a39..018d519296 100644
--- a/2025/CVE-2025-38364.md
+++ b/2025/CVE-2025-38364.md
@@ -13,7 +13,7 @@ In the Linux kernel, the following vulnerability has been resolved:maple_tree: f
 ### POC
 
 #### Reference
-No PoCs from references.
+- https://cert-portal.siemens.com/productcert/html/ssa-082556.html
 
 #### Github
 - https://github.com/w4zu/Debian_security
diff --git a/2025/CVE-2025-38393.md b/2025/CVE-2025-38393.md
index 4e78b0db5f..bbded84d98 100644
--- a/2025/CVE-2025-38393.md
+++ b/2025/CVE-2025-38393.md
@@ -19,7 +19,7 @@ In the Linux kernel, the following vulnerability has been resolved:NFSv4/pNFS: F
 ### POC
 
 #### Reference
-No PoCs from references.
+- https://cert-portal.siemens.com/productcert/html/ssa-082556.html
 
 #### Github
 - https://github.com/w4zu/Debian_security
diff --git a/2025/CVE-2025-38400.md b/2025/CVE-2025-38400.md
index 3200c91403..a905d57472 100644
--- a/2025/CVE-2025-38400.md
+++ b/2025/CVE-2025-38400.md
@@ -25,7 +25,7 @@ In the Linux kernel, the following vulnerability has been resolved:nfs: Clean up
 ### POC
 
 #### Reference
-No PoCs from references.
+- https://cert-portal.siemens.com/productcert/html/ssa-082556.html
 
 #### Github
 - https://github.com/w4zu/Debian_security
diff --git a/2025/CVE-2025-38430.md b/2025/CVE-2025-38430.md
index 6b216e37c4..eb699d1ad9 100644
--- a/2025/CVE-2025-38430.md
+++ b/2025/CVE-2025-38430.md
@@ -13,7 +13,7 @@ In the Linux kernel, the following vulnerability has been resolved:nfsd: nfsd4_s
 ### POC
 
 #### Reference
-No PoCs from references.
+- https://cert-portal.siemens.com/productcert/html/ssa-082556.html
 
 #### Github
 - https://github.com/w4zu/Debian_security
diff --git a/2025/CVE-2025-38451.md b/2025/CVE-2025-38451.md
index 9dbe483b63..4730632d3a 100644
--- a/2025/CVE-2025-38451.md
+++ b/2025/CVE-2025-38451.md
@@ -21,7 +21,7 @@ In the Linux kernel, the following vulnerability has been resolved:md/md-bitmap:
 ### POC
 
 #### Reference
-No PoCs from references.
+- https://cert-portal.siemens.com/productcert/html/ssa-082556.html
 
 #### Github
 - https://github.com/w4zu/Debian_security
diff --git a/2025/CVE-2025-38457.md b/2025/CVE-2025-38457.md
index 55dd2b4bfb..b02972595a 100644
--- a/2025/CVE-2025-38457.md
+++ b/2025/CVE-2025-38457.md
@@ -13,7 +13,7 @@ In the Linux kernel, the following vulnerability has been resolved:net/sched: Ab
 ### POC
 
 #### Reference
-No PoCs from references.
+- https://cert-portal.siemens.com/productcert/html/ssa-082556.html
 
 #### Github
 - https://github.com/w4zu/Debian_security
diff --git a/2025/CVE-2025-38465.md b/2025/CVE-2025-38465.md
index 92252460c2..ec88247cf2 100644
--- a/2025/CVE-2025-38465.md
+++ b/2025/CVE-2025-38465.md
@@ -13,7 +13,7 @@ In the Linux kernel, the following vulnerability has been resolved:netlink: Fix
 ### POC
 
 #### Reference
-No PoCs from references.
+- https://cert-portal.siemens.com/productcert/html/ssa-082556.html
 
 #### Github
 - https://github.com/w4zu/Debian_security
diff --git a/2025/CVE-2025-38466.md b/2025/CVE-2025-38466.md
index 4e2ccfbf82..716f27c66c 100644
--- a/2025/CVE-2025-38466.md
+++ b/2025/CVE-2025-38466.md
@@ -13,7 +13,7 @@ In the Linux kernel, the following vulnerability has been resolved:perf: Revert
 ### POC
 
 #### Reference
-No PoCs from references.
+- https://cert-portal.siemens.com/productcert/html/ssa-082556.html
 
 #### Github
 - https://github.com/w4zu/Debian_security
diff --git a/2025/CVE-2025-38468.md b/2025/CVE-2025-38468.md
index d0bdfb7a8c..cc7a1990ac 100644
--- a/2025/CVE-2025-38468.md
+++ b/2025/CVE-2025-38468.md
@@ -13,7 +13,7 @@ In the Linux kernel, the following vulnerability has been resolved:net/sched: Re
 ### POC
 
 #### Reference
-No PoCs from references.
+- https://cert-portal.siemens.com/productcert/html/ssa-082556.html
 
 #### Github
 - https://github.com/w4zu/Debian_security
diff --git a/2025/CVE-2025-38470.md b/2025/CVE-2025-38470.md
index 8cd8f37df6..e0519224c1 100644
--- a/2025/CVE-2025-38470.md
+++ b/2025/CVE-2025-38470.md
@@ -13,7 +13,7 @@ In the Linux kernel, the following vulnerability has been resolved:net: vlan: fi
 ### POC
 
 #### Reference
-No PoCs from references.
+- https://cert-portal.siemens.com/productcert/html/ssa-082556.html
 
 #### Github
 - https://github.com/w4zu/Debian_security
diff --git a/2025/CVE-2025-38471.md b/2025/CVE-2025-38471.md
index ab032fa17c..bb40fba96d 100644
--- a/2025/CVE-2025-38471.md
+++ b/2025/CVE-2025-38471.md
@@ -15,7 +15,7 @@ In the Linux kernel, the following vulnerability has been resolved:tls: always r
 ### POC
 
 #### Reference
-No PoCs from references.
+- https://cert-portal.siemens.com/productcert/html/ssa-082556.html
 
 #### Github
 - https://github.com/w4zu/Debian_security
diff --git a/2025/CVE-2025-38477.md b/2025/CVE-2025-38477.md
index 46d1a26fdb..b1407473e1 100644
--- a/2025/CVE-2025-38477.md
+++ b/2025/CVE-2025-38477.md
@@ -13,7 +13,7 @@ In the Linux kernel, the following vulnerability has been resolved:net/sched: sc
 ### POC
 
 #### Reference
-No PoCs from references.
+- https://cert-portal.siemens.com/productcert/html/ssa-082556.html
 
 #### Github
 - https://github.com/w4zu/Debian_security
diff --git a/2025/CVE-2025-38498.md b/2025/CVE-2025-38498.md
index 374543f5e3..c06f600b85 100644
--- a/2025/CVE-2025-38498.md
+++ b/2025/CVE-2025-38498.md
@@ -14,7 +14,7 @@ In the Linux kernel, the following vulnerability has been resolved:do_change_typ
 ### POC
 
 #### Reference
-No PoCs from references.
+- https://cert-portal.siemens.com/productcert/html/ssa-082556.html
 
 #### Github
 - https://github.com/w4zu/Debian_security
diff --git a/2025/CVE-2025-38499.md b/2025/CVE-2025-38499.md
index 520accab0d..1d574d8a33 100644
--- a/2025/CVE-2025-38499.md
+++ b/2025/CVE-2025-38499.md
@@ -27,7 +27,7 @@ In the Linux kernel, the following vulnerability has been resolved:clone_private
 ### POC
 
 #### Reference
-No PoCs from references.
+- https://cert-portal.siemens.com/productcert/html/ssa-082556.html
 
 #### Github
 - https://github.com/w4zu/Debian_security
diff --git a/2025/CVE-2025-38614.md b/2025/CVE-2025-38614.md
index 84aea64717..68b87523d0 100644
--- a/2025/CVE-2025-38614.md
+++ b/2025/CVE-2025-38614.md
@@ -24,7 +24,7 @@ In the Linux kernel, the following vulnerability has been resolved:eventpoll: Fi
 ### POC
 
 #### Reference
-No PoCs from references.
+- https://cert-portal.siemens.com/productcert/html/ssa-082556.html
 
 #### Github
 - https://github.com/fkie-cad/nvd-json-data-feeds
diff --git a/2025/CVE-2025-38685.md b/2025/CVE-2025-38685.md
index 87fef796e2..bfdbeff927 100644
--- a/2025/CVE-2025-38685.md
+++ b/2025/CVE-2025-38685.md
@@ -14,7 +14,7 @@ In the Linux kernel, the following vulnerability has been resolved:fbdev: Fix vm
 ### POC
 
 #### Reference
-No PoCs from references.
+- https://cert-portal.siemens.com/productcert/html/ssa-082556.html
 
 #### Github
 - https://github.com/w4zu/Debian_security
diff --git a/2025/CVE-2025-38691.md b/2025/CVE-2025-38691.md
index d68f17f7ff..fed49efd1c 100644
--- a/2025/CVE-2025-38691.md
+++ b/2025/CVE-2025-38691.md
@@ -14,7 +14,7 @@ In the Linux kernel, the following vulnerability has been resolved:pNFS: Fix uni
 ### POC
 
 #### Reference
-No PoCs from references.
+- https://cert-portal.siemens.com/productcert/html/ssa-082556.html
 
 #### Github
 - https://github.com/w4zu/Debian_security
diff --git a/2025/CVE-2025-38701.md b/2025/CVE-2025-38701.md
index 0e86aa0ec1..97b17a02f3 100644
--- a/2025/CVE-2025-38701.md
+++ b/2025/CVE-2025-38701.md
@@ -14,7 +14,7 @@ In the Linux kernel, the following vulnerability has been resolved:ext4: do not
 ### POC
 
 #### Reference
-No PoCs from references.
+- https://cert-portal.siemens.com/productcert/html/ssa-082556.html
 
 #### Github
 - https://github.com/w4zu/Debian_security
diff --git a/2025/CVE-2025-38702.md b/2025/CVE-2025-38702.md
index 0bf675cb07..1cebf73aba 100644
--- a/2025/CVE-2025-38702.md
+++ b/2025/CVE-2025-38702.md
@@ -14,7 +14,7 @@ In the Linux kernel, the following vulnerability has been resolved:fbdev: fix po
 ### POC
 
 #### Reference
-No PoCs from references.
+- https://cert-portal.siemens.com/productcert/html/ssa-082556.html
 
 #### Github
 - https://github.com/w4zu/Debian_security
diff --git a/2025/CVE-2025-38708.md b/2025/CVE-2025-38708.md
index bfb4e912a0..77dd508950 100644
--- a/2025/CVE-2025-38708.md
+++ b/2025/CVE-2025-38708.md
@@ -14,7 +14,7 @@ In the Linux kernel, the following vulnerability has been resolved:drbd: add mis
 ### POC
 
 #### Reference
-No PoCs from references.
+- https://cert-portal.siemens.com/productcert/html/ssa-082556.html
 
 #### Github
 - https://github.com/w4zu/Debian_security
diff --git a/2025/CVE-2025-38721.md b/2025/CVE-2025-38721.md
index 652ab322e4..e14d5bd9c1 100644
--- a/2025/CVE-2025-38721.md
+++ b/2025/CVE-2025-38721.md
@@ -14,7 +14,7 @@ In the Linux kernel, the following vulnerability has been resolved:netfilter: ct
 ### POC
 
 #### Reference
-No PoCs from references.
+- https://cert-portal.siemens.com/productcert/html/ssa-082556.html
 
 #### Github
 - https://github.com/w4zu/Debian_security
diff --git a/2025/CVE-2025-38724.md b/2025/CVE-2025-38724.md
index 5355643fef..27dbdba5a4 100644
--- a/2025/CVE-2025-38724.md
+++ b/2025/CVE-2025-38724.md
@@ -14,7 +14,7 @@ In the Linux kernel, the following vulnerability has been resolved:nfsd: handle
 ### POC
 
 #### Reference
-No PoCs from references.
+- https://cert-portal.siemens.com/productcert/html/ssa-082556.html
 
 #### Github
 - https://github.com/w4zu/Debian_security
diff --git a/2025/CVE-2025-38727.md b/2025/CVE-2025-38727.md
index cce58cb2e8..e5c0194288 100644
--- a/2025/CVE-2025-38727.md
+++ b/2025/CVE-2025-38727.md
@@ -28,7 +28,7 @@ In the Linux kernel, the following vulnerability has been resolved:netlink: avoi
 ### POC
 
 #### Reference
-No PoCs from references.
+- https://cert-portal.siemens.com/productcert/html/ssa-082556.html
 
 #### Github
 - https://github.com/w4zu/Debian_security
diff --git a/2025/CVE-2025-39683.md b/2025/CVE-2025-39683.md
index 3c02d4ad91..347cab4113 100644
--- a/2025/CVE-2025-39683.md
+++ b/2025/CVE-2025-39683.md
@@ -30,7 +30,7 @@ In the Linux kernel, the following vulnerability has been resolved:tracing: Limi
 ### POC
 
 #### Reference
-No PoCs from references.
+- https://cert-portal.siemens.com/productcert/html/ssa-082556.html
 
 #### Github
 - https://github.com/w4zu/Debian_security
diff --git a/2025/CVE-2025-39689.md b/2025/CVE-2025-39689.md
index 6730eb50f8..e61cdf85a5 100644
--- a/2025/CVE-2025-39689.md
+++ b/2025/CVE-2025-39689.md
@@ -14,7 +14,7 @@ In the Linux kernel, the following vulnerability has been resolved:ftrace: Also
 ### POC
 
 #### Reference
-No PoCs from references.
+- https://cert-portal.siemens.com/productcert/html/ssa-082556.html
 
 #### Github
 - https://github.com/w4zu/Debian_security
diff --git a/2025/CVE-2025-39697.md b/2025/CVE-2025-39697.md
index 09e707fe35..d2f5f023d1 100644
--- a/2025/CVE-2025-39697.md
+++ b/2025/CVE-2025-39697.md
@@ -14,7 +14,7 @@ In the Linux kernel, the following vulnerability has been resolved:NFS: Fix a ra
 ### POC
 
 #### Reference
-No PoCs from references.
+- https://cert-portal.siemens.com/productcert/html/ssa-082556.html
 
 #### Github
 - https://github.com/w4zu/Debian_security
diff --git a/2025/CVE-2025-39724.md b/2025/CVE-2025-39724.md
index 4d7282c2b3..46fc26438a 100644
--- a/2025/CVE-2025-39724.md
+++ b/2025/CVE-2025-39724.md
@@ -18,7 +18,7 @@ In the Linux kernel, the following vulnerability has been resolved:serial: 8250:
 ### POC
 
 #### Reference
-No PoCs from references.
+- https://cert-portal.siemens.com/productcert/html/ssa-082556.html
 
 #### Github
 - https://github.com/fkie-cad/nvd-json-data-feeds
diff --git a/2025/CVE-2025-39756.md b/2025/CVE-2025-39756.md
index e8b4faf172..8f37f86a0f 100644
--- a/2025/CVE-2025-39756.md
+++ b/2025/CVE-2025-39756.md
@@ -14,7 +14,7 @@ In the Linux kernel, the following vulnerability has been resolved:fs: Prevent f
 ### POC
 
 #### Reference
-No PoCs from references.
+- https://cert-portal.siemens.com/productcert/html/ssa-082556.html
 
 #### Github
 - https://github.com/w4zu/Debian_security
diff --git a/2025/CVE-2025-39770.md b/2025/CVE-2025-39770.md
index 48005e9d97..dd091b866f 100644
--- a/2025/CVE-2025-39770.md
+++ b/2025/CVE-2025-39770.md
@@ -28,7 +28,7 @@ In the Linux kernel, the following vulnerability has been resolved:net: gso: For
 ### POC
 
 #### Reference
-No PoCs from references.
+- https://cert-portal.siemens.com/productcert/html/ssa-082556.html
 
 #### Github
 - https://github.com/w4zu/Debian_security
diff --git a/2025/CVE-2025-39773.md b/2025/CVE-2025-39773.md
index 027a998266..be4a71cdde 100644
--- a/2025/CVE-2025-39773.md
+++ b/2025/CVE-2025-39773.md
@@ -14,7 +14,7 @@ In the Linux kernel, the following vulnerability has been resolved:net: bridge:
 ### POC
 
 #### Reference
-No PoCs from references.
+- https://cert-portal.siemens.com/productcert/html/ssa-082556.html
 
 #### Github
 - https://github.com/w4zu/Debian_security
diff --git a/2025/CVE-2025-39783.md b/2025/CVE-2025-39783.md
index 30f92a08e4..2c56b69976 100644
--- a/2025/CVE-2025-39783.md
+++ b/2025/CVE-2025-39783.md
@@ -14,7 +14,7 @@ In the Linux kernel, the following vulnerability has been resolved:PCI: endpoint
 ### POC
 
 #### Reference
-No PoCs from references.
+- https://cert-portal.siemens.com/productcert/html/ssa-082556.html
 
 #### Github
 - https://github.com/w4zu/Debian_security
diff --git a/2025/CVE-2025-39787.md b/2025/CVE-2025-39787.md
index 95a6799aac..f297fa2b65 100644
--- a/2025/CVE-2025-39787.md
+++ b/2025/CVE-2025-39787.md
@@ -14,7 +14,7 @@ In the Linux kernel, the following vulnerability has been resolved:soc: qcom: md
 ### POC
 
 #### Reference
-No PoCs from references.
+- https://cert-portal.siemens.com/productcert/html/ssa-082556.html
 
 #### Github
 - https://github.com/w4zu/Debian_security
diff --git a/2025/CVE-2025-39795.md b/2025/CVE-2025-39795.md
index d2635ab8cf..0625f84573 100644
--- a/2025/CVE-2025-39795.md
+++ b/2025/CVE-2025-39795.md
@@ -14,7 +14,7 @@ In the Linux kernel, the following vulnerability has been resolved:block: avoid
 ### POC
 
 #### Reference
-No PoCs from references.
+- https://cert-portal.siemens.com/productcert/html/ssa-082556.html
 
 #### Github
 - https://github.com/w4zu/Debian_security
diff --git a/2025/CVE-2025-39798.md b/2025/CVE-2025-39798.md
index ae83534321..15412a1706 100644
--- a/2025/CVE-2025-39798.md
+++ b/2025/CVE-2025-39798.md
@@ -14,7 +14,7 @@ In the Linux kernel, the following vulnerability has been resolved:NFS: Fix the
 ### POC
 
 #### Reference
-No PoCs from references.
+- https://cert-portal.siemens.com/productcert/html/ssa-082556.html
 
 #### Github
 - https://github.com/w4zu/Debian_security
diff --git a/2025/CVE-2025-39866.md b/2025/CVE-2025-39866.md
index db231fc3a0..e763bbf2c4 100644
--- a/2025/CVE-2025-39866.md
+++ b/2025/CVE-2025-39866.md
@@ -14,7 +14,7 @@ In the Linux kernel, the following vulnerability has been resolved:fs: writeback
 ### POC
 
 #### Reference
-No PoCs from references.
+- https://cert-portal.siemens.com/productcert/html/ssa-082556.html
 
 #### Github
 - https://github.com/byteReaper77/CVE-2025-39866
diff --git a/2025/CVE-2025-39929.md b/2025/CVE-2025-39929.md
index a7070ff67a..c75ae56cc9 100644
--- a/2025/CVE-2025-39929.md
+++ b/2025/CVE-2025-39929.md
@@ -13,7 +13,7 @@ In the Linux kernel, the following vulnerability has been resolved:smb: client:
 ### POC
 
 #### Reference
-No PoCs from references.
+- https://cert-portal.siemens.com/productcert/html/ssa-082556.html
 
 #### Github
 - https://github.com/fkie-cad/nvd-json-data-feeds
diff --git a/2025/CVE-2025-39931.md b/2025/CVE-2025-39931.md
index 2f23bf2ff1..b567fa0063 100644
--- a/2025/CVE-2025-39931.md
+++ b/2025/CVE-2025-39931.md
@@ -13,7 +13,7 @@ In the Linux kernel, the following vulnerability has been resolved:crypto: af_al
 ### POC
 
 #### Reference
-No PoCs from references.
+- https://cert-portal.siemens.com/productcert/html/ssa-082556.html
 
 #### Github
 - https://github.com/fkie-cad/nvd-json-data-feeds
diff --git a/2025/CVE-2025-39977.md b/2025/CVE-2025-39977.md
new file mode 100644
index 0000000000..5d60d3702d
--- /dev/null
+++ b/2025/CVE-2025-39977.md
@@ -0,0 +1,20 @@
+### [CVE-2025-39977](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-39977)
+![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Version&message=07d91ef510fb16a2e0ca7453222105835b7ba3b8%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Version&message=5.15%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Version&message=V3.1.5%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue)
+
+### Description
+
+In the Linux kernel, the following vulnerability has been resolved:futex: Prevent use-after-free during requeue-PIsyzbot managed to trigger the following race:   T1                               T2 futex_wait_requeue_pi()   futex_do_wait()     schedule()                               futex_requeue()                                 futex_proxy_trylock_atomic()                                   futex_requeue_pi_prepare()                                   requeue_pi_wake_futex()                                     futex_requeue_pi_complete()                                      /* preempt */         * timeout/ signal wakes T1 *   futex_requeue_pi_wakeup_sync() // Q_REQUEUE_PI_LOCKED   futex_hash_put()  // back to userland, on stack futex_q is garbage                                      /* back */                                     wake_up_state(q->task, TASK_NORMAL);In this scenario futex_wait_requeue_pi() is able to leave without usingfutex_q::lock_ptr for synchronization.This can be prevented by reading futex_q::task before updating thefutex_q::requeue_state. A reference on the task_struct is not neededbecause requeue_pi_wake_futex() is invoked with a spinlock_t held whichimplies a RCU read section.Even if T1 terminates immediately after, the task_struct will remain validduring T2's wake_up_state().  A READ_ONCE on futex_q::task beforefutex_requeue_pi_complete() is enough because it ensures that the variableis read before the state is updated.Read futex_q::task before updating the requeue state, use it for thefollowing wakeup.
+
+### POC
+
+#### Reference
+- https://cert-portal.siemens.com/productcert/html/ssa-082556.html
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2025/CVE-2025-40022.md b/2025/CVE-2025-40022.md
new file mode 100644
index 0000000000..4dc83626f7
--- /dev/null
+++ b/2025/CVE-2025-40022.md
@@ -0,0 +1,28 @@
+### [CVE-2025-40022](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-40022)
+![](https://img.shields.io/static/v1?label=Product&message=Linux&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=0f28c4adbc4a97437874c9b669fd7958a8c6d6ce%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Version&message=1b34cbbf4f011a121ef7b2d7d6e6920a036d5285%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Version&message=1f323a48e9b5ebfe6dc7d130fdf5c3c0e92a07c8%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Version&message=45bcf60fe49b37daab1acee57b27211ad1574042%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Version&message=6.1.154%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Version&message=6.12.49%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Version&message=6.16.9%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Version&message=6.6.108%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Version&message=7c4491b5644e3a3708f3dbd7591be0a570135b84%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Version&message=9aee87da5572b3a14075f501752e209801160d3d%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Version&message=V3.1.5%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Version&message=e4c1ec11132ec466f7362a95f36a506ce4dc08c9%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=blue)
+
+### Description
+
+In the Linux kernel, the following vulnerability has been resolved:crypto: af_alg - Fix incorrect boolean values in af_alg_ctxCommit 1b34cbbf4f01 ("crypto: af_alg - Disallow concurrent writes inaf_alg_sendmsg") changed some fields from bool to 1-bit bitfields oftype u32.However, some assignments to these fields, specifically 'more' and'merge', assign values greater than 1.  These relied on C's implicitconversion to bool, such that zero becomes false and nonzero becomestrue.With a 1-bit bitfields of type u32 instead, mod 2 of the value is takeninstead, resulting in 0 being assigned in some cases when 1 was intended.Fix this by restoring the bool type.
+
+### POC
+
+#### Reference
+- https://cert-portal.siemens.com/productcert/html/ssa-082556.html
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2025/CVE-2025-4373.md b/2025/CVE-2025-4373.md
index 1b30d3c0fb..d83c5114f5 100644
--- a/2025/CVE-2025-4373.md
+++ b/2025/CVE-2025-4373.md
@@ -30,7 +30,7 @@ A flaw was found in GLib, which is vulnerable to an integer overflow in the g_st
 ### POC
 
 #### Reference
-No PoCs from references.
+- https://cert-portal.siemens.com/productcert/html/ssa-082556.html
 
 #### Github
 - https://github.com/adegoodyer/kubernetes-admin-toolkit
diff --git a/2025/CVE-2025-4598.md b/2025/CVE-2025-4598.md
index d4d1440125..db4d5eec1c 100644
--- a/2025/CVE-2025-4598.md
+++ b/2025/CVE-2025-4598.md
@@ -30,6 +30,7 @@ A vulnerability was found in systemd-coredump. This flaw allows an attacker to f
 - http://www.openwall.com/lists/oss-security/2025/06/05/1
 - http://www.openwall.com/lists/oss-security/2025/06/05/3
 - http://www.openwall.com/lists/oss-security/2025/08/18/3
+- https://cert-portal.siemens.com/productcert/html/ssa-082556.html
 - https://ciq.com/blog/the-real-danger-of-systemd-coredump-cve-2025-4598/
 - https://www.openwall.com/lists/oss-security/2025/05/29/3
 - https://www.openwall.com/lists/oss-security/2025/08/18/3
diff --git a/2025/CVE-2025-46836.md b/2025/CVE-2025-46836.md
index f333155daa..75613fa0d3 100644
--- a/2025/CVE-2025-46836.md
+++ b/2025/CVE-2025-46836.md
@@ -13,6 +13,7 @@ net-tools is a collection of programs that form the base set of the NET-3 networ
 ### POC
 
 #### Reference
+- https://cert-portal.siemens.com/productcert/html/ssa-082556.html
 - https://github.com/ecki/net-tools/security/advisories/GHSA-pfwf-h6m3-63wf
 
 #### Github
diff --git a/2025/CVE-2025-5244.md b/2025/CVE-2025-5244.md
index e70dfe3d56..5b2940e7cb 100644
--- a/2025/CVE-2025-5244.md
+++ b/2025/CVE-2025-5244.md
@@ -57,6 +57,7 @@ Eine kritische Schwachstelle wurde in GNU Binutils bis 2.44 ausgemacht. Es geht
 ### POC
 
 #### Reference
+- https://cert-portal.siemens.com/productcert/html/ssa-082556.html
 - https://cert-portal.siemens.com/productcert/html/ssa-265688.html
 
 #### Github
diff --git a/2025/CVE-2025-5245.md b/2025/CVE-2025-5245.md
index b9779732b2..2a30e5906c 100644
--- a/2025/CVE-2025-5245.md
+++ b/2025/CVE-2025-5245.md
@@ -57,6 +57,7 @@ Es wurde eine Schwachstelle in GNU Binutils bis 2.44 entdeckt. Sie wurde als kri
 ### POC
 
 #### Reference
+- https://cert-portal.siemens.com/productcert/html/ssa-082556.html
 - https://cert-portal.siemens.com/productcert/html/ssa-265688.html
 
 #### Github
diff --git a/2025/CVE-2025-59375.md b/2025/CVE-2025-59375.md
index 404b6bf30d..8dab3f278a 100644
--- a/2025/CVE-2025-59375.md
+++ b/2025/CVE-2025-59375.md
@@ -12,6 +12,7 @@ libexpat in Expat before 2.7.2 allows attackers to trigger large dynamic memory
 
 #### Reference
 - http://www.openwall.com/lists/oss-security/2026/05/01/5
+- https://cert-portal.siemens.com/productcert/html/ssa-082556.html
 
 #### Github
 - https://github.com/CKA-codespace/cg-compare
diff --git a/2025/CVE-2025-6395.md b/2025/CVE-2025-6395.md
index c41d96946a..85cc00994e 100644
--- a/2025/CVE-2025-6395.md
+++ b/2025/CVE-2025-6395.md
@@ -23,7 +23,7 @@ A NULL pointer dereference flaw was found in the GnuTLS software in _gnutls_figu
 ### POC
 
 #### Reference
-No PoCs from references.
+- https://cert-portal.siemens.com/productcert/html/ssa-082556.html
 
 #### Github
 - https://github.com/GitHubForSnap/ssmtp-gael
diff --git a/2025/CVE-2025-64056.md b/2025/CVE-2025-64056.md
new file mode 100644
index 0000000000..a7a8439854
--- /dev/null
+++ b/2025/CVE-2025-64056.md
@@ -0,0 +1,17 @@
+### [CVE-2025-64056](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-64056)
+![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen)
+
+### Description
+
+File upload vulnerability in Fanvil x210 V2 2.12.20 allows unauthenticated attackers on the local network to store arbitrary files on the filesystem.
+
+### POC
+
+#### Reference
+- https://github.com/SpikeReply/advisories/blob/main/cve/fanvil/cve-2025-64056.md
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2025/CVE-2025-64744.md b/2025/CVE-2025-64744.md
new file mode 100644
index 0000000000..7471bc71ca
--- /dev/null
+++ b/2025/CVE-2025-64744.md
@@ -0,0 +1,17 @@
+### [CVE-2025-64744](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-64744)
+![](https://img.shields.io/static/v1?label=Product&message=openobserve&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=%3C%3D%200.16.1%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-79%3A%20Improper%20Neutralization%20of%20Input%20During%20Web%20Page%20Generation%20('Cross-site%20Scripting')&color=brightgreen)
+
+### Description
+
+OpenObserve is a cloud-native observability platform. In versions up to and including 0.16.1, when creating or renaming an organization with HTML in the name, the markup is rendered inside the invitation email. This indicates that user-controlled input is inserted into the email template without proper HTML escaping. As of time of publication, no patched versions are available.
+
+### POC
+
+#### Reference
+- https://github.com/openobserve/openobserve/security/advisories/GHSA-3jpx-57gj-w458
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2025/CVE-2025-66382.md b/2025/CVE-2025-66382.md
index 1cf683709e..4609008778 100644
--- a/2025/CVE-2025-66382.md
+++ b/2025/CVE-2025-66382.md
@@ -11,6 +11,7 @@ In libexpat through 2.7.3, a crafted file with an approximate size of 2 MiB can
 ### POC
 
 #### Reference
+- https://cert-portal.siemens.com/productcert/html/ssa-082556.html
 - https://cert-portal.siemens.com/productcert/html/ssa-253495.html
 
 #### Github
diff --git a/2025/CVE-2025-67089.md b/2025/CVE-2025-67089.md
new file mode 100644
index 0000000000..579dce5818
--- /dev/null
+++ b/2025/CVE-2025-67089.md
@@ -0,0 +1,17 @@
+### [CVE-2025-67089](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-67089)
+![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen)
+
+### Description
+
+A command injection vulnerability exists in the GL-iNet GL-AXT1800 router firmware v4.6.8. The vulnerability is present in the `plugins.install_package` RPC method, which fails to properly sanitize user input in package names. Authenticated attackers can exploit this to execute arbitrary commands with root privileges
+
+### POC
+
+#### Reference
+- https://aleksazatezalo.medium.com/critical-command-injection-vulnerability-in-gl-inet-gl-axt1800-router-firmware-e6d67d81ee51?postPublishedType=repub
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2025/CVE-2025-67090.md b/2025/CVE-2025-67090.md
new file mode 100644
index 0000000000..137bd1df7f
--- /dev/null
+++ b/2025/CVE-2025-67090.md
@@ -0,0 +1,17 @@
+### [CVE-2025-67090](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-67090)
+![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen)
+
+### Description
+
+The LuCI web interface on Gl Inet GL.Inet AX1800 Version 4.6.4 & 4.6.8 are vulnerable. Fix available in version 4.8.2 GL.Inet AX1800 Version 4.6.4 & 4.6.8 lacks rate limiting or account lockout mechanisms on the authentication endpoint (`/cgi-bin/luci`). An unauthenticated attacker on the local network can perform unlimited password attempts against the admin interface.
+
+### POC
+
+#### Reference
+- https://aleksazatezalo.medium.com/critical-command-injection-vulnerability-in-gl-inet-gl-axt1800-router-firmware-e6d67d81ee51?postPublishedType=repub
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2025/CVE-2025-67091.md b/2025/CVE-2025-67091.md
new file mode 100644
index 0000000000..4a7fa89d8b
--- /dev/null
+++ b/2025/CVE-2025-67091.md
@@ -0,0 +1,17 @@
+### [CVE-2025-67091](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-67091)
+![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen)
+
+### Description
+
+An issue in GL Inet GL.Inet AX1800 Version 4.6.4 & 4.6.8 are vulnerable. GL.Inet AX1800 Version 4.6.4 & 4.6.8 in the GL.iNet custom opkg wrapper script located at /usr/libexec/opkg-call. The script is executed with root privileges when triggered via the LuCI web interface or authenticated API calls to manage packages. The vulnerable code uses shell redirection to create a lock file in the world-writable /tmp directory.
+
+### POC
+
+#### Reference
+- https://aleksazatezalo.medium.com/critical-command-injection-vulnerability-in-gl-inet-gl-axt1800-router-firmware-e6d67d81ee51?postPublishedType=repub
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2025/CVE-2025-67886.md b/2025/CVE-2025-67886.md
index 6cb9c72a6b..36a4e48c0c 100644
--- a/2025/CVE-2025-67886.md
+++ b/2025/CVE-2025-67886.md
@@ -11,6 +11,7 @@ Bitrix24 through 25.100.300 allows Remote Code Execution because an actor with S
 
 #### Reference
 - https://karmainsecurity.com/pocs/CVE-2025-67886.php
+- https://seclists.org/fulldisclosure/2025/Dec/21
 
 #### Github
 No PoCs found on GitHub currently.
diff --git a/2025/CVE-2025-67887.md b/2025/CVE-2025-67887.md
index c30a2bbaad..3a3986d256 100644
--- a/2025/CVE-2025-67887.md
+++ b/2025/CVE-2025-67887.md
@@ -11,6 +11,7 @@
 
 #### Reference
 - https://karmainsecurity.com/pocs/CVE-2025-67887.php
+- https://seclists.org/fulldisclosure/2025/Dec/22
 
 #### Github
 No PoCs found on GitHub currently.
diff --git a/2025/CVE-2025-7425.md b/2025/CVE-2025-7425.md
index 46508d4392..7c7fcb8b96 100644
--- a/2025/CVE-2025-7425.md
+++ b/2025/CVE-2025-7425.md
@@ -46,6 +46,7 @@ A flaw was found in libxslt where the attribute type, atype, flags are modified
 ### POC
 
 #### Reference
+- https://cert-portal.siemens.com/productcert/html/ssa-082556.html
 - https://cert-portal.siemens.com/productcert/html/ssa-265688.html
 
 #### Github
diff --git a/2025/CVE-2025-7545.md b/2025/CVE-2025-7545.md
index 2f3e69ce92..893bb8c758 100644
--- a/2025/CVE-2025-7545.md
+++ b/2025/CVE-2025-7545.md
@@ -14,6 +14,7 @@ In GNU Binutils 2.45 wurde eine problematische Schwachstelle entdeckt. Dabei geh
 ### POC
 
 #### Reference
+- https://cert-portal.siemens.com/productcert/html/ssa-082556.html
 - https://cert-portal.siemens.com/productcert/html/ssa-265688.html
 
 #### Github
diff --git a/2025/CVE-2025-7546.md b/2025/CVE-2025-7546.md
index ffd29c38ff..08651fbbfe 100644
--- a/2025/CVE-2025-7546.md
+++ b/2025/CVE-2025-7546.md
@@ -14,6 +14,7 @@ Eine problematische Schwachstelle wurde in GNU Binutils 2.45 entdeckt. Hierbei g
 ### POC
 
 #### Reference
+- https://cert-portal.siemens.com/productcert/html/ssa-082556.html
 - https://cert-portal.siemens.com/productcert/html/ssa-265688.html
 - https://vuldb.com/?submit.614375
 
diff --git a/2025/CVE-2025-8224.md b/2025/CVE-2025-8224.md
index ac4599010e..a5a2acd787 100644
--- a/2025/CVE-2025-8224.md
+++ b/2025/CVE-2025-8224.md
@@ -14,6 +14,7 @@ In GNU Binutils 2.44 wurde eine problematische Schwachstelle gefunden. Betroffen
 ### POC
 
 #### Reference
+- https://cert-portal.siemens.com/productcert/html/ssa-082556.html
 - https://cert-portal.siemens.com/productcert/html/ssa-265688.html
 
 #### Github
diff --git a/2025/CVE-2025-9230.md b/2025/CVE-2025-9230.md
index c85e53d4b5..49e4b6d671 100644
--- a/2025/CVE-2025-9230.md
+++ b/2025/CVE-2025-9230.md
@@ -19,6 +19,7 @@ Issue summary: An application trying to decrypt CMS messages encrypted usingpass
 ### POC
 
 #### Reference
+- https://cert-portal.siemens.com/productcert/html/ssa-082556.html
 - https://cert-portal.siemens.com/productcert/html/ssa-253495.html
 - https://cert-portal.siemens.com/productcert/html/ssa-265688.html
 
diff --git a/2025/CVE-2025-9232.md b/2025/CVE-2025-9232.md
index 764d3478f9..20417ebe6b 100644
--- a/2025/CVE-2025-9232.md
+++ b/2025/CVE-2025-9232.md
@@ -16,6 +16,7 @@ Issue summary: An application using the OpenSSL HTTP client API functions maytri
 ### POC
 
 #### Reference
+- https://cert-portal.siemens.com/productcert/html/ssa-082556.html
 - https://cert-portal.siemens.com/productcert/html/ssa-253495.html
 
 #### Github
diff --git a/2026/CVE-2026-11563.md b/2026/CVE-2026-11563.md
new file mode 100644
index 0000000000..460b72ad82
--- /dev/null
+++ b/2026/CVE-2026-11563.md
@@ -0,0 +1,18 @@
+### [CVE-2026-11563](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-11563)
+![](https://img.shields.io/static/v1?label=Product&message=Word%20Count%20and%20Social%20Shares&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-352%20Cross-Site%20Request%20Forgery%20(CSRF)&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-73%20External%20Control%20of%20File%20Name%20or%20Path&color=brightgreen)
+
+### Description
+
+The Word Count and Social Shares WordPress plugin through 1.0 does not validate a user-supplied file path before deletion, nor does it have proper authorization or CSRF checks, allowing any authenticated user, such as a Subscriber, to delete arbitrary files on the server, which can lead to a full site takeover (e.g. by deleting wp-config.php).
+
+### POC
+
+#### Reference
+- https://wpscan.com/vulnerability/7f4b5f16-6c31-4dcc-94a4-120cb45631bb/
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2026/CVE-2026-11567.md b/2026/CVE-2026-11567.md
new file mode 100644
index 0000000000..0b6ff5e04a
--- /dev/null
+++ b/2026/CVE-2026-11567.md
@@ -0,0 +1,17 @@
+### [CVE-2026-11567](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-11567)
+![](https://img.shields.io/static/v1?label=Product&message=SureForms&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-284%20Improper%20Access%20Control&color=brightgreen)
+
+### Description
+
+The SureForms  WordPress plugin before 2.11.1 does not properly validate the payment amount on forms that use a dynamically-sourced (variable/hidden) payment amount, allowing unauthenticated users to underpay for the configured product or subscription. Forms using a fixed configured price are not affected.
+
+### POC
+
+#### Reference
+- https://wpscan.com/vulnerability/bd738da7-f950-4da9-bcc1-c1fe845d7faa/
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2026/CVE-2026-12511.md b/2026/CVE-2026-12511.md
new file mode 100644
index 0000000000..9ca06bdce0
--- /dev/null
+++ b/2026/CVE-2026-12511.md
@@ -0,0 +1,17 @@
+### [CVE-2026-12511](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-12511)
+![](https://img.shields.io/static/v1?label=Product&message=AI%20Engine&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-22%20Improper%20Limitation%20of%20a%20Pathname%20to%20a%20Restricted%20Directory%20('Path%20Traversal')&color=brightgreen)
+
+### Description
+
+The AI Engine  WordPress plugin before 3.5.5 does not sanitize a user-supplied filename before using it to write a downloaded file, allowing authenticated users with editor-level access to write attacker-controlled bytes to an arbitrary location on the server via path traversal.
+
+### POC
+
+#### Reference
+- https://wpscan.com/vulnerability/cf3cf59e-da36-429b-8794-5a46587e8462/
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2026/CVE-2026-12583.md b/2026/CVE-2026-12583.md
new file mode 100644
index 0000000000..f349805782
--- /dev/null
+++ b/2026/CVE-2026-12583.md
@@ -0,0 +1,17 @@
+### [CVE-2026-12583](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-12583)
+![](https://img.shields.io/static/v1?label=Product&message=Newsletters&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-502%20Deserialization%20of%20Untrusted%20Data&color=brightgreen)
+
+### Description
+
+The Newsletters WordPress plugin before 4.15 does not prevent deserialization of untrusted input that is stored through a public form, allowing unauthenticated attackers to inject a PHP object and, via a property-oriented gadget chain bundled with the Newsletters WordPress plugin before 4.15, write arbitrary files and execute code on the server.
+
+### POC
+
+#### Reference
+- https://wpscan.com/vulnerability/e4c44105-f43d-4dff-8487-7d8ae2691c4e/
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2026/CVE-2026-12988.md b/2026/CVE-2026-12988.md
new file mode 100644
index 0000000000..da619a15f9
--- /dev/null
+++ b/2026/CVE-2026-12988.md
@@ -0,0 +1,17 @@
+### [CVE-2026-12988](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-12988)
+![](https://img.shields.io/static/v1?label=Product&message=WP%202FA&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-862%20Missing%20Authorization&color=brightgreen)
+
+### Description
+
+The WP 2FA  WordPress plugin before 3.1.1.2 does not verify that the email address supplied during two-factor authentication setup belongs to the user, allowing an attacker who has obtained a user's credentials to redirect the setup verification code to an attacker-controlled email address and take over the account.
+
+### POC
+
+#### Reference
+- https://wpscan.com/vulnerability/8aa6bf91-54ee-4326-a477-31f42284be22/
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2026/CVE-2026-14940.md b/2026/CVE-2026-14940.md
new file mode 100644
index 0000000000..d2cdd5335e
--- /dev/null
+++ b/2026/CVE-2026-14940.md
@@ -0,0 +1,24 @@
+### [CVE-2026-14940](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-14940)
+![](https://img.shields.io/static/v1?label=Product&message=Red%20Hat%20Directory%20Server%2011&color=blue)
+![](https://img.shields.io/static/v1?label=Product&message=Red%20Hat%20Directory%20Server%2012&color=blue)
+![](https://img.shields.io/static/v1?label=Product&message=Red%20Hat%20Directory%20Server%2013&color=blue)
+![](https://img.shields.io/static/v1?label=Product&message=Red%20Hat%20Enterprise%20Linux%2010&color=blue)
+![](https://img.shields.io/static/v1?label=Product&message=Red%20Hat%20Enterprise%20Linux%206&color=blue)
+![](https://img.shields.io/static/v1?label=Product&message=Red%20Hat%20Enterprise%20Linux%207&color=blue)
+![](https://img.shields.io/static/v1?label=Product&message=Red%20Hat%20Enterprise%20Linux%208&color=blue)
+![](https://img.shields.io/static/v1?label=Product&message=Red%20Hat%20Enterprise%20Linux%209&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=n%2Fa&color=blue)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=Heap-based%20Buffer%20Overflow&color=brightgreen)
+
+### Description
+
+A heap-buffer-overflow flaw was found in 389 Directory Server (389-ds-base). Whennormalizing a Distinguished Name (DN) that contains a legacy-quoted value encoding amultivalued nested Relative Distinguished Name (RDN), the server can write past theend of a heap allocation while sorting RDN attribute-value pairs. An unauthenticatedremote attacker can trigger this condition by sending an LDAP operation whose DNreaches the DN normalization routine, such as a search with a crafted base DN. Thiscan corrupt heap memory and may cause denial of service.
+
+### POC
+
+#### Reference
+- https://bugzilla.redhat.com/show_bug.cgi?id=2497697
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2026/CVE-2026-15416.md b/2026/CVE-2026-15416.md
new file mode 100644
index 0000000000..7b703639dc
--- /dev/null
+++ b/2026/CVE-2026-15416.md
@@ -0,0 +1,20 @@
+### [CVE-2026-15416](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-15416)
+![](https://img.shields.io/static/v1?label=Product&message=Red%20Hat%20OpenShift%20GitOps&color=blue)
+![](https://img.shields.io/static/v1?label=Product&message=Red%20Hat%20Openshift%20Data%20Foundation%204&color=blue)
+![](https://img.shields.io/static/v1?label=Product&message=Self-service%20automation%20portal%202&color=blue)
+![](https://img.shields.io/static/v1?label=Product&message=argo-helm&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=Missing%20Authentication%20for%20Critical%20Function&color=brightgreen)
+
+### Description
+
+A flaw was identified in Argo CD, the GitOps engine used by Red Hat OpenShift GitOps, that could allow an unauthenticated attacker with network access to the Argo CD repo-server to achieve remote code execution. Under certain conditions, the attacker may then manipulate cached data to deploy malicious Kubernetes resources to managed clusters, potentially resulting in complete cluster compromise.
+
+### POC
+
+#### Reference
+- https://www.synacktiv.com/en/publications/caught-in-the-octopus-trap-unauthenticated-rce-in-argo-cd-with-codeql
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2026/CVE-2026-2054.md b/2026/CVE-2026-2054.md
index f9fb2f559c..38d61337f3 100644
--- a/2026/CVE-2026-2054.md
+++ b/2026/CVE-2026-2054.md
@@ -13,6 +13,7 @@ A security flaw has been discovered in D-Link DIR-605L and DIR-619L 2.06B01/2.13
 ### POC
 
 #### Reference
+- https://github.com/wudipjq/my_vuln/blob/main/D-Link7/vuln_81/81.md
 - https://github.com/wudipjq/my_vuln/blob/main/D-Link7/vuln_81/81.md#poc--result
 
 #### Github
diff --git a/2026/CVE-2026-28737.md b/2026/CVE-2026-28737.md
new file mode 100644
index 0000000000..aa561cced2
--- /dev/null
+++ b/2026/CVE-2026-28737.md
@@ -0,0 +1,17 @@
+### [CVE-2026-28737](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-28737)
+![](https://img.shields.io/static/v1?label=Product&message=Gitea%20Open%20Source%20Git%20Server&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=1.25.0%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=Improper%20Neutralization%20of%20Input%20During%20Web%20Page%20Generation%20('Cross-site%20Scripting')&color=brightgreen)
+
+### Description
+
+Gitea versions from 1.25.0 before 1.26.0 allow stored cross-site scripting through the extensionsRequired field in glTF files rendered by the 3D file viewer.
+
+### POC
+
+#### Reference
+- https://github.com/go-gitea/gitea/security/advisories/GHSA-9cpj-qc93-vw8v
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2026/CVE-2026-29007.md b/2026/CVE-2026-29007.md
new file mode 100644
index 0000000000..fd01556571
--- /dev/null
+++ b/2026/CVE-2026-29007.md
@@ -0,0 +1,17 @@
+### [CVE-2026-29007](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-29007)
+![](https://img.shields.io/static/v1?label=Product&message=u-boot&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=Out-of-bounds%20Read&color=brightgreen)
+
+### Description
+
+U-Boot through 2026.04-rc3 contains an out-of-bounds read vulnerability in tcp_rx_state_machine() (net/tcp.c) when CONFIG_PROT_TCP is enabled, allowing remote attackers to read beyond TCP segment boundaries by crafting a malicious packet with a mismatched IP total length and TCP data offset field. Attackers can send a packet with an IP total length of 40 bytes and a TCP data offset claiming 60 bytes of header to cause tcp_parse_options() to read 40 bytes past the end of the TCP segment, potentially corrupting connection state variables such as rmt_win_scale and rmt_timestamp to disrupt TCP window calculations.
+
+### POC
+
+#### Reference
+- https://y637f9qq2x.com/posts/u-boot-tcp-nfs-vulns/
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2026/CVE-2026-29008.md b/2026/CVE-2026-29008.md
new file mode 100644
index 0000000000..df2e89fda0
--- /dev/null
+++ b/2026/CVE-2026-29008.md
@@ -0,0 +1,17 @@
+### [CVE-2026-29008](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-29008)
+![](https://img.shields.io/static/v1?label=Product&message=u-boot&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=Integer%20Underflow%20(Wrap%20or%20Wraparound)&color=brightgreen)
+
+### Description
+
+U-Boot through 2026.04-rc3 contains an integer underflow vulnerability in the tcp_rx_state_machine() function (net/tcp.c) that allows a network-adjacent attacker to crash the bootloader by sending a malformed TCP SYN+ACK packet with a manipulated data offset field causing payload_len to become negative. When the TCP_SYN_SENT handler calls tcp_rx_user_data() without invoking tcp_seg_in_wnd() validation, the negative payload_len is implicitly converted to a large unsigned integer (e.g., 0xFFFFFFD8) and passed to memcpy() in store_block(), causing an immediate crash that prevents device boot and may enable memory corruption when CONFIG_LMB is disabled.
+
+### POC
+
+#### Reference
+- https://y637f9qq2x.com/posts/u-boot-tcp-nfs-vulns/
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2026/CVE-2026-29009.md b/2026/CVE-2026-29009.md
new file mode 100644
index 0000000000..3838b0aae7
--- /dev/null
+++ b/2026/CVE-2026-29009.md
@@ -0,0 +1,17 @@
+### [CVE-2026-29009](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-29009)
+![](https://img.shields.io/static/v1?label=Product&message=u-boot&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=Buffer%20Copy%20without%20Checking%20Size%20of%20Input%20('Classic%20Buffer%20Overflow')&color=brightgreen)
+
+### Description
+
+U-Boot through 2026.04-rc3 contains a buffer overflow vulnerability in nfs_readlink_reply() (net/nfs-common.c) when CONFIG_CMD_NFS is enabled, allowing a malicious or compromised NFS server to overflow the 2048-byte nfs_path_buff buffer by returning multiple relative symlink targets that are appended without cumulative length validation. Attackers can send two or more READLINK responses containing relative symlink targets of approximately 1100 bytes each to corrupt adjacent BSS variables including nfs_server_ip, nfs_server_mount_port, nfs_server_port, nfs_our_port, nfs_state, and rpc_id, potentially achieving memory corruption and control over the NFS client state machine.
+
+### POC
+
+#### Reference
+- https://y637f9qq2x.com/posts/u-boot-tcp-nfs-vulns/
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2026/CVE-2026-31431.md b/2026/CVE-2026-31431.md
index a2855a913f..0be72d0e25 100644
--- a/2026/CVE-2026-31431.md
+++ b/2026/CVE-2026-31431.md
@@ -32,6 +32,7 @@ In the Linux kernel, the following vulnerability has been resolved:crypto: algif
 - http://www.openwall.com/lists/oss-security/2026/05/07/12
 - http://www.openwall.com/lists/oss-security/2026/05/08/13
 - http://www.openwall.com/lists/oss-security/2026/05/18/3
+- https://cert-portal.siemens.com/productcert/html/ssa-082556.html
 - https://cert-portal.siemens.com/productcert/html/ssa-265688.html
 - https://copy.fail
 - https://websec.net/blog/cve-2026-31431-linux-algifaead-page-cache-write-to-root-69f38a4ccddd2db1f520f170
diff --git a/2026/CVE-2026-36908.md b/2026/CVE-2026-36908.md
new file mode 100644
index 0000000000..caa849f54e
--- /dev/null
+++ b/2026/CVE-2026-36908.md
@@ -0,0 +1,17 @@
+### [CVE-2026-36908](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-36908)
+![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen)
+
+### Description
+
+A stack overflow in the AP4_Array<AP4_TrunAtom::Entry>::EnsureCapacity component of axiomatic-systems Bento4 before v1.8.9allows attackers to cause a Denial of Service (DoS) via a crafted MP4 file.
+
+### POC
+
+#### Reference
+- https://github.com/axiomatic-systems/Bento4/issues/842
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2026/CVE-2026-38329.md b/2026/CVE-2026-38329.md
new file mode 100644
index 0000000000..dc25d3e8a7
--- /dev/null
+++ b/2026/CVE-2026-38329.md
@@ -0,0 +1,17 @@
+### [CVE-2026-38329](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-38329)
+![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen)
+
+### Description
+
+Bludit CMS before version 3.18.4 allows Remote Code Execution (RCE) via the API Plugin. The POST /api/files/{key} endpoint in bl-plugins/api/plugin.php fails to perform authorization checks and lacks file extension validation. An attacker with a valid API token can upload a malicious PHP script and execute arbitrary code on the server.
+
+### POC
+
+#### Reference
+- https://gist.github.com/Ki1ro0133/8bd14bd4fc6fab81c907d838a7aeee55
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2026/CVE-2026-38969.md b/2026/CVE-2026-38969.md
new file mode 100644
index 0000000000..4c984c5210
--- /dev/null
+++ b/2026/CVE-2026-38969.md
@@ -0,0 +1,17 @@
+### [CVE-2026-38969](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-38969)
+![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen)
+
+### Description
+
+ruby webrick through v1.9.2 WEBrick reparses trailer Content-Length into canonical request state, enabling request smuggling. NOTE: the Supplier reports that "The project README states that it is suitable for testing and development, and that its developers do not encourage its use to serve production web applications that may be subject to hostile input. It is not a production web server and is not intended to receive traffic from untrusted sources. Request smuggling is only reachable when WEBrick sits behind a proxy and receives hostile traffic in a production deployment, which is the configuration the project documents as discouraged."
+
+### POC
+
+#### Reference
+- https://github.com/ruby/webrick/issues/198
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2026/CVE-2026-38971.md b/2026/CVE-2026-38971.md
new file mode 100644
index 0000000000..94d06f9ad1
--- /dev/null
+++ b/2026/CVE-2026-38971.md
@@ -0,0 +1,17 @@
+### [CVE-2026-38971](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-38971)
+![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen)
+
+### Description
+
+ardupilot through Plane-4.6.3 was found to contain an out-of-bounds read issue in libraries/GCS_MAVLink/GCS_serial_control.cpp in GCS_MAVLINK::handle_serial_control().
+
+### POC
+
+#### Reference
+- https://github.com/ArduPilot/ardupilot/issues/32524
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2026/CVE-2026-39007.md b/2026/CVE-2026-39007.md
new file mode 100644
index 0000000000..41f3a21d38
--- /dev/null
+++ b/2026/CVE-2026-39007.md
@@ -0,0 +1,17 @@
+### [CVE-2026-39007](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39007)
+![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen)
+
+### Description
+
+An issue in Observeinc's Observe v.2026-01-28 and before allows a remote attacker to obtain sensitive information via the CSV Log export component.
+
+### POC
+
+#### Reference
+- https://github.com/Kettn/Vulnerability_Publications/tree/main/CVE-2026-39007
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2026/CVE-2026-39031.md b/2026/CVE-2026-39031.md
new file mode 100644
index 0000000000..092298648f
--- /dev/null
+++ b/2026/CVE-2026-39031.md
@@ -0,0 +1,17 @@
+### [CVE-2026-39031](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39031)
+![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen)
+
+### Description
+
+Lansweeper lsrunase 2.0 and lsencrypt 2.0 use RC4 encryption with a hardcoded 142-byte static key array to encrypt credentials. An 8-character prefix is stored in cleartext alongside the ciphertext. This allows an attacker with local access to recover any encrypted password to plaintext using a single SHA-1 hash and RC4 decryption operation, with no brute force required.
+
+### POC
+
+#### Reference
+- https://github.com/user6400/cve-2026-39031-lansweeper-lsrunase2-lsencrypt2
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2026/CVE-2026-39103.md b/2026/CVE-2026-39103.md
new file mode 100644
index 0000000000..95bc5de161
--- /dev/null
+++ b/2026/CVE-2026-39103.md
@@ -0,0 +1,17 @@
+### [CVE-2026-39103](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39103)
+![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen)
+
+### Description
+
+Buffer Overflow vulnerability in GPAC before commit v391dc7f4d234988ea0bc3cc294eb725eddf8f702 allows an attacker to cause a denial of service via the src/scenegraph/svg_attributes.c, svg_parse_strings(), gf_svg_parse_attribute()
+
+### POC
+
+#### Reference
+- https://github.com/gpac/gpac/issues/3506
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2026/CVE-2026-39107.md b/2026/CVE-2026-39107.md
new file mode 100644
index 0000000000..43a9b81a2f
--- /dev/null
+++ b/2026/CVE-2026-39107.md
@@ -0,0 +1,17 @@
+### [CVE-2026-39107](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39107)
+![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen)
+
+### Description
+
+A Cross Site Scripting vulnerability exists in the Kimi AI v1.0 web interface's 'Preview' feature. The application fails to properly sanitize or encode HTML/JavaScript payloads generated by the AI model. When a user switches to the 'Preview' tab to view AI-generated code, the malicious payload is rendered directly into the DOM, leading to arbitrary JavaScript execution in the victim's browser session.
+
+### POC
+
+#### Reference
+- https://github.com/MGTx2/CVE-2026-39107
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2026/CVE-2026-39170.md b/2026/CVE-2026-39170.md
new file mode 100644
index 0000000000..1db9f58aa5
--- /dev/null
+++ b/2026/CVE-2026-39170.md
@@ -0,0 +1,17 @@
+### [CVE-2026-39170](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39170)
+![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen)
+
+### Description
+
+SemCms 5.0 is vulnerable to Cross Site Request Forgery (CSRF) via crafted POST request to /admin/semcms_user.php.
+
+### POC
+
+#### Reference
+- https://gist.github.com/ql288470-pixel/41e01787357416458212dbbfd06c6d73
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2026/CVE-2026-39196.md b/2026/CVE-2026-39196.md
new file mode 100644
index 0000000000..5508243028
--- /dev/null
+++ b/2026/CVE-2026-39196.md
@@ -0,0 +1,17 @@
+### [CVE-2026-39196](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39196)
+![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen)
+
+### Description
+
+Datadog, Inc Vector v0.54.0 was discovered to contain a SQL injection vulnerability in the set_uri_query parameter in the KeyPartitioner::partition function. This vulnerability allows attackers to access sensitive database information via crafted SQL statements.
+
+### POC
+
+#### Reference
+- https://gist.github.com/pyuysig/423b15c69e3cd851c1e24c1312a0551a
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2026/CVE-2026-39197.md b/2026/CVE-2026-39197.md
new file mode 100644
index 0000000000..98cf671dff
--- /dev/null
+++ b/2026/CVE-2026-39197.md
@@ -0,0 +1,17 @@
+### [CVE-2026-39197](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39197)
+![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen)
+
+### Description
+
+An issue in the /util/http/prelude.rs endpoint of Datadog, Inc Vector v0.54.0 allows attackers to cause a Denial of Service (DoS) via a crafted request or payload.
+
+### POC
+
+#### Reference
+- https://gist.github.com/pyuysig/221e90dd598ab3f3c3100ae59db8e8d4
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2026/CVE-2026-39199.md b/2026/CVE-2026-39199.md
index 53e3fc203d..e371b594a5 100644
--- a/2026/CVE-2026-39199.md
+++ b/2026/CVE-2026-39199.md
@@ -10,6 +10,7 @@ snes9x 1.63 allows an out-of-bounds write and denial of service via a crafted .u
 ### POC
 
 #### Reference
+- https://github.com/snes9xgit/snes9x/issues/1035
 - https://karansaini.com/snes9x-oob-write/
 
 #### Github
diff --git a/2026/CVE-2026-39243.md b/2026/CVE-2026-39243.md
new file mode 100644
index 0000000000..5ee4e4d7b8
--- /dev/null
+++ b/2026/CVE-2026-39243.md
@@ -0,0 +1,17 @@
+### [CVE-2026-39243](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39243)
+![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen)
+
+### Description
+
+decompress before 4.2.2 allows arbitrary hardlink creation during archive extraction, enabling file read disclosure and file corruption. When processing hardlink entries (type === 'link'), the x.linkname field from the archive is passed directly to fs.link() without validation (index.js line 113). An attacker can craft an archive with a hardlink entry whose linkname is an absolute path to any file on the same filesystem. This creates a hardlink inside the extraction directory that shares the same inode as the target file, enabling both reading and overwriting the original file's content. Hardlinks are limited to files on the same filesystem and cannot target directories.
+
+### POC
+
+#### Reference
+- https://github.com/kevva/decompress/issues/113
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2026/CVE-2026-39244.md b/2026/CVE-2026-39244.md
new file mode 100644
index 0000000000..d8ccaa331f
--- /dev/null
+++ b/2026/CVE-2026-39244.md
@@ -0,0 +1,17 @@
+### [CVE-2026-39244](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39244)
+![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen)
+
+### Description
+
+adm-zip before 0.5.18 is vulnerable to denial of service via a crafted ZIP file with a manipulated uncompressed size header field. In zipEntry.js line 103, Buffer.alloc(_centralHeader.size) allocates memory based on the declared uncompressed size from the ZIP central directory header without validating it against the actual compressed data size or imposing any upper bound. The size value is read directly from the binary header at entryHeader.js line 266 with no bounds check. An attacker can craft a ~120-byte ZIP file that declares ~4GB uncompressed size, causing a memory allocation amplification ratio of over 33 million to 1. The allocation occurs before CRC validation, so the malicious payload cannot be rejected early. All extraction and read methods are affected: readFile(), readAsText(), extractEntryTo(), extractAllTo(), extractAllToAsync(), test(), and entry.getData(). Any application accepting untrusted ZIP files via adm-zip is vulnerable to immediate process crash.
+
+### POC
+
+#### Reference
+- https://github.com/cthackers/adm-zip/issues/568
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2026/CVE-2026-39245.md b/2026/CVE-2026-39245.md
new file mode 100644
index 0000000000..1736cdaf8a
--- /dev/null
+++ b/2026/CVE-2026-39245.md
@@ -0,0 +1,17 @@
+### [CVE-2026-39245](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39245)
+![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen)
+
+### Description
+
+decompress before 4.2.2 contains an improper path containment check that enables directory traversal and arbitrary file write. The safeMakeDir function (index.js line 29) and the extraction path validation (index.js line 106) use String.indexOf() to verify the resolved path is within the output directory: realDestinationDir.indexOf(realOutputPath) !== 0. This check is flawed because it does not enforce a path separator boundary. For example, "/tmp/app_config".indexOf("/tmp/app") returns 0, incorrectly passing the check even though /tmp/app_config is outside /tmp/app. Combined with the unvalidated symlink creation in the same package, an attacker can write arbitrary files to directories adjacent to the extraction target. This is a bypass of the fix for CVE-2020-12265. The correct check requires appending a path separator: realParentPath.indexOf(realOutputPath + path.sep) !== 0.
+
+### POC
+
+#### Reference
+- https://github.com/kevva/decompress/issues/115
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2026/CVE-2026-39246.md b/2026/CVE-2026-39246.md
new file mode 100644
index 0000000000..99f4d506e3
--- /dev/null
+++ b/2026/CVE-2026-39246.md
@@ -0,0 +1,17 @@
+### [CVE-2026-39246](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39246)
+![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen)
+
+### Description
+
+decompress before 4.2.2 allows arbitrary symlink creation during archive extraction. When processing symlink entries (type === 'symlink'), the x.linkname field from the archive is passed directly to fs.symlink() without validation (index.js line 121). The preventWritingThroughSymlink check on line 98 only applies to file entries, not symlink creation. An attacker can craft an archive with symlink entries pointing to sensitive files outside the extraction directory (e.g., /etc/passwd), enabling information disclosure when the application reads the extracted contents.
+
+### POC
+
+#### Reference
+- https://github.com/kevva/decompress/issues/114
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2026/CVE-2026-39276.md b/2026/CVE-2026-39276.md
new file mode 100644
index 0000000000..1f0dea4b6e
--- /dev/null
+++ b/2026/CVE-2026-39276.md
@@ -0,0 +1,17 @@
+### [CVE-2026-39276](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39276)
+![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen)
+
+### Description
+
+The template upload feature in Emlog Pro v2.6.9 has a path traversal vulnerability, allowing authenticated administrators to execute arbitrary PHP code. By uploading a malicious ZIP archive containing directory traversal sequences in filenames, an attacker can overwrite default template files or directly include malicious code files in the current template.
+
+### POC
+
+#### Reference
+- https://github.com/LING12138-sg/Emlog-v2.6.9-Vulnerability-Report
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2026/CVE-2026-39305.md b/2026/CVE-2026-39305.md
new file mode 100644
index 0000000000..20595d7a40
--- /dev/null
+++ b/2026/CVE-2026-39305.md
@@ -0,0 +1,17 @@
+### [CVE-2026-39305](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39305)
+![](https://img.shields.io/static/v1?label=Product&message=PraisonAI&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=%3C%204.5.113%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-22%3A%20Improper%20Limitation%20of%20a%20Pathname%20to%20a%20Restricted%20Directory%20('Path%20Traversal')&color=brightgreen)
+
+### Description
+
+PraisonAI is a multi-agent teams system. Prior to 1.5.113, the Action Orchestrator feature contains a Path Traversal vulnerability that allows an attacker (or compromised agent) to write to arbitrary files outside of the configured workspace directory. By supplying relative path segments (../) in the target path, malicious actions can overwrite sensitive system files or drop executable payloads on the host. This vulnerability is fixed in 1.5.113.
+
+### POC
+
+#### Reference
+- https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-jfxc-v5g9-38xr
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2026/CVE-2026-39308.md b/2026/CVE-2026-39308.md
new file mode 100644
index 0000000000..105f633e20
--- /dev/null
+++ b/2026/CVE-2026-39308.md
@@ -0,0 +1,17 @@
+### [CVE-2026-39308](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39308)
+![](https://img.shields.io/static/v1?label=Product&message=PraisonAI&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=%3C%204.5.113%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-22%3A%20Improper%20Limitation%20of%20a%20Pathname%20to%20a%20Restricted%20Directory%20('Path%20Traversal')&color=brightgreen)
+
+### Description
+
+PraisonAI is a multi-agent teams system. Prior to 1.5.113, PraisonAI's recipe registry publish endpoint writes uploaded recipe bundles to a filesystem path derived from the bundle's internal manifest.json before it verifies that the manifest name and version match the HTTP route. A malicious publisher can place ../ traversal sequences in the bundle manifest and cause the registry server to create files outside the configured registry root even though the request is ultimately rejected with HTTP 400. This is an arbitrary file write / path traversal issue on the registry host. It affects deployments that expose the recipe registry publish flow. If the registry is intentionally run without a token, any network client that can reach the service can trigger it. If a token is configured, any user with publish access can still exploit it. This vulnerability is fixed in 1.5.113.
+
+### POC
+
+#### Reference
+- https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-r9x3-wx45-2v7f
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2026/CVE-2026-39309.md b/2026/CVE-2026-39309.md
new file mode 100644
index 0000000000..ff0ea37887
--- /dev/null
+++ b/2026/CVE-2026-39309.md
@@ -0,0 +1,18 @@
+### [CVE-2026-39309](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39309)
+![](https://img.shields.io/static/v1?label=Product&message=Trilium&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=%3C%200.102.2%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-290%3A%20Authentication%20Bypass%20by%20Spoofing&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-451%3A%20User%20Interface%20(UI)%20Misrepresentation%20of%20Critical%20Information&color=brightgreen)
+
+### Description
+
+Trilium Notes is a cross-platform, hierarchical note taking application focused on building large personal knowledge bases. In versions 0.102.1 and prior, the Electron configuration is vulnerable to TCC Bypass via Prompt Spoofing, allowing local attackers to trigger misleading macOS permission prompts by running malicious code under the identity of the trusted app. The root cause is that the RunAsNode fuse allows launching the app in a special Node.js mode using -e to execute arbitrary system commands with Trilium Notes's permissions and identity. An attacker can leverage this through a subprocess to request any sensitive permissions, such as access to hardware (camera, microphone) and TCC-protected files, causing the TCC system prompt to appear as if the request came from Trilium rather than the attacker's code, because macOS treats the subprocess as part of the parent application. Exploitation allows access to TCC-protected resources like the screen, camera, microphone, and folders such as ~/Documents and ~/Downloads, undermining macOS's security model and UI integrity through social engineering. This issue has been fixed in version 0.102.2.
+
+### POC
+
+#### Reference
+- https://github.com/TriliumNext/Trilium/security/advisories/GHSA-66pm-8hvq-2wwx
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2026/CVE-2026-39310.md b/2026/CVE-2026-39310.md
new file mode 100644
index 0000000000..b2a1eff4e4
--- /dev/null
+++ b/2026/CVE-2026-39310.md
@@ -0,0 +1,18 @@
+### [CVE-2026-39310](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39310)
+![](https://img.shields.io/static/v1?label=Product&message=Trilium&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=%3C%200.102.2%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-284%3A%20Improper%20Access%20Control&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-306%3A%20Missing%20Authentication%20for%20Critical%20Function&color=brightgreen)
+
+### Description
+
+Trilium Notes is a cross-platform, hierarchical note taking application focused on building large personal knowledge bases. In versions 0.102.1 and prior, the Clipper API in Trilium Desktop (v0.101.3) allows full authentication bypass when running in an Electron environment. When Trilium detects an Electron environment, it explicitly disables authentication middleware for the Clipper API, exposing endpoints such as /api/clipper/notes to the network with no password, API token, or CSRF protection. An attacker on a shared network (for example, a corporate LAN or public Wi-Fi) can scan for open high-range ports using a tool like nmap, since Trilium often binds to ports such as 37840. Once a candidate port is found, an unauthenticated request to the Clipper handshake endpoint, which also bypasses authentication, confirms a Trilium instance by returning the application name and protocol version. This facilitates unauthorized data access, phishing, and local system compromise. The issue has been fixed in version 0.102.2.
+
+### POC
+
+#### Reference
+- https://github.com/TriliumNext/Trilium/security/advisories/GHSA-jcvx-vc83-cppw
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2026/CVE-2026-39311.md b/2026/CVE-2026-39311.md
new file mode 100644
index 0000000000..ecb801ce82
--- /dev/null
+++ b/2026/CVE-2026-39311.md
@@ -0,0 +1,18 @@
+### [CVE-2026-39311](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39311)
+![](https://img.shields.io/static/v1?label=Product&message=Trilium&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=%3C%200.102.2%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-79%3A%20Improper%20Neutralization%20of%20Input%20During%20Web%20Page%20Generation%20('Cross-site%20Scripting')&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-94%3A%20Improper%20Control%20of%20Generation%20of%20Code%20('Code%20Injection')&color=brightgreen)
+
+### Description
+
+Trilium Notes is a cross-platform, hierarchical note taking application focused on building large personal knowledge bases. Versions 0.102.1 and prior contain a critical security flaw where lack of SVG sanitization combined with a disabled Content Security Policy (CSP) and a publicly reachable backend execution API results in an unauthenticated Remote Code Execution (RCE). The vulnerability arises from an insecure-by-design architecture: Trilium serves SVG attachments with the image/svg+xml MIME type without any sanitization, and it explicitly disables Helmet's Content Security Policy middleware, removing the primary defense against script execution in served assets. Because the malicious SVG runs under the Same-Origin Policy, it can issue a fetch('/') to extract the csrfToken from the document body. With that token, it can send a signed request to /api/script/exec to execute arbitrary Node.js code on the server. An attacker can compromise the entire server instance simply by tricking an authenticated user into viewing a shared SVG attachment. The issue has been fixed in version 0.102.2.
+
+### POC
+
+#### Reference
+- https://github.com/TriliumNext/Trilium/security/advisories/GHSA-p837-cxw3-m964
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2026/CVE-2026-39314.md b/2026/CVE-2026-39314.md
new file mode 100644
index 0000000000..da69f092fe
--- /dev/null
+++ b/2026/CVE-2026-39314.md
@@ -0,0 +1,17 @@
+### [CVE-2026-39314](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39314)
+![](https://img.shields.io/static/v1?label=Product&message=cups&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=%3C%3D%202.4.16%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-191%3A%20Integer%20Underflow%20(Wrap%20or%20Wraparound)&color=brightgreen)
+
+### Description
+
+OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. In versions 2.4.16 and prior, an integer underflow vulnerability in _ppdCreateFromIPP() (cups/ppd-cache.c) allows any unprivileged local user to crash the cupsd root process by supplying a negative job-password-supported IPP attribute. The bounds check only caps the upper bound, so a negative value passes validation, is cast to size_t (wrapping to ~2^64), and is used as the length argument to memset() on a 33-byte stack buffer. This causes an immediate SIGSEGV in the cupsd root process. Combined with systemd's Restart=on-failure, an attacker can repeat the crash for sustained denial of service.
+
+### POC
+
+#### Reference
+- https://github.com/OpenPrinting/cups/security/advisories/GHSA-pp8w-2g52-7vj7
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2026/CVE-2026-39316.md b/2026/CVE-2026-39316.md
new file mode 100644
index 0000000000..eea5e48cf2
--- /dev/null
+++ b/2026/CVE-2026-39316.md
@@ -0,0 +1,17 @@
+### [CVE-2026-39316](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39316)
+![](https://img.shields.io/static/v1?label=Product&message=cups&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=%3C%3D%202.4.16%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-416%3A%20Use%20After%20Free&color=brightgreen)
+
+### Description
+
+OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. In versions 2.4.16 and prior, a use-after-free vulnerability exists in the CUPS scheduler (cupsd) when temporary printers are automatically deleted. cupsdDeleteTemporaryPrinters() in scheduler/printers.c calls cupsdDeletePrinter() without first expiring subscriptions that reference the printer, leaving cupsd_subscription_t.dest as a dangling pointer to freed heap memory. The dangling pointer is subsequently dereferenced at multiple code sites, causing a crash (denial of service) of the cupsd daemon. With heap grooming, this can be leveraged for code execution.
+
+### POC
+
+#### Reference
+- https://github.com/OpenPrinting/cups/security/advisories/GHSA-pjv5-prqp-46rg
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2026/CVE-2026-39326.md b/2026/CVE-2026-39326.md
new file mode 100644
index 0000000000..c5ad88b331
--- /dev/null
+++ b/2026/CVE-2026-39326.md
@@ -0,0 +1,17 @@
+### [CVE-2026-39326](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39326)
+![](https://img.shields.io/static/v1?label=Product&message=CRM&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=%3C%207.1.0%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-89%3A%20Improper%20Neutralization%20of%20Special%20Elements%20used%20in%20an%20SQL%20Command%20('SQL%20Injection')&color=brightgreen)
+
+### Description
+
+ChurchCRM is an open-source church management system. Prior to 7.1.0, an SQL injection vulnerability was found in the endpoint /PropertyTypeEditor.php in ChurchCRM. Authenticated users with the role isMenuOptionsEnabled can inject arbitrary SQL statements through the Name and Description parameters and thus extract and modify information from the database. This vulnerability is fixed in 7.1.0.
+
+### POC
+
+#### Reference
+- https://github.com/ChurchCRM/CRM/security/advisories/GHSA-mch7-6v8f-c4j5
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2026/CVE-2026-39327.md b/2026/CVE-2026-39327.md
new file mode 100644
index 0000000000..dfb369dcfe
--- /dev/null
+++ b/2026/CVE-2026-39327.md
@@ -0,0 +1,17 @@
+### [CVE-2026-39327](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39327)
+![](https://img.shields.io/static/v1?label=Product&message=CRM&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=%3C%207.1.0%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-89%3A%20Improper%20Neutralization%20of%20Special%20Elements%20used%20in%20an%20SQL%20Command%20('SQL%20Injection')&color=brightgreen)
+
+### Description
+
+ChurchCRM is an open-source church management system. Prior to 7.1.0, an SQL injection vulnerability was found in the endpoint /MemberRoleChange.php in ChurchCRM 7.0.5. Authenticated users with the role Manage Groups & Roles (ManageGroups) can inject arbitrary SQL statements through the NewRole parameter and thus extract and modify information from the database. This vulnerability is fixed in 7.1.0.
+
+### POC
+
+#### Reference
+- https://github.com/ChurchCRM/CRM/security/advisories/GHSA-66fc-v5xj-x859
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2026/CVE-2026-39329.md b/2026/CVE-2026-39329.md
new file mode 100644
index 0000000000..f5caf343db
--- /dev/null
+++ b/2026/CVE-2026-39329.md
@@ -0,0 +1,17 @@
+### [CVE-2026-39329](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39329)
+![](https://img.shields.io/static/v1?label=Product&message=CRM&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=%3C%207.1.0%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-89%3A%20Improper%20Neutralization%20of%20Special%20Elements%20used%20in%20an%20SQL%20Command%20('SQL%20Injection')&color=brightgreen)
+
+### Description
+
+ChurchCRM is an open-source church management system. Prior to 7.1.0, an SQL injection vulnerability was identified in /EventNames.php in ChurchCRM. Authenticated users with AddEvent privileges can inject SQL via the newEvtTypeCntLst parameter during event type creation. The vulnerable flow reaches an ON DUPLICATE KEY UPDATE clause where unescaped user input is interpolated directly. This vulnerability is fixed in 7.1.0.
+
+### POC
+
+#### Reference
+- https://github.com/ChurchCRM/CRM/security/advisories/GHSA-ggfm-5q4w-p93g
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2026/CVE-2026-39332.md b/2026/CVE-2026-39332.md
new file mode 100644
index 0000000000..484e2fa5c5
--- /dev/null
+++ b/2026/CVE-2026-39332.md
@@ -0,0 +1,17 @@
+### [CVE-2026-39332](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39332)
+![](https://img.shields.io/static/v1?label=Product&message=CRM&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=%3C%207.1.0%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-79%3A%20Improper%20Neutralization%20of%20Input%20During%20Web%20Page%20Generation%20('Cross-site%20Scripting')&color=brightgreen)
+
+### Description
+
+ChurchCRM is an open-source church management system. Prior to 7.1.0, a reflected Cross-Site Scripting (XSS) vulnerability in GeoPage.php allows any authenticated user to inject arbitrary JavaScript into the browser of another authenticated user. Because the payload fires automatically via autofocus with no user interaction required, an attacker can steal session cookies and fully take over any victim account, including administrator accounts, by tricking them into submitting a crafted form. This vulnerability is fixed in 7.1.0.
+
+### POC
+
+#### Reference
+- https://github.com/ChurchCRM/CRM/security/advisories/GHSA-hc6g-h48v-wqvq
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2026/CVE-2026-39333.md b/2026/CVE-2026-39333.md
new file mode 100644
index 0000000000..58ba9165d5
--- /dev/null
+++ b/2026/CVE-2026-39333.md
@@ -0,0 +1,17 @@
+### [CVE-2026-39333](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39333)
+![](https://img.shields.io/static/v1?label=Product&message=CRM&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=%3C%207.1.0%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-79%3A%20Improper%20Neutralization%20of%20Input%20During%20Web%20Page%20Generation%20('Cross-site%20Scripting')&color=brightgreen)
+
+### Description
+
+ChurchCRM is an open-source church management system. Prior to 7.1.0, he FindFundRaiser.php endpoint reflects user-supplied input (DateStart and DateEnd) into HTML input field attributes without proper output encoding for the HTML attribute context. An authenticated attacker can craft a malicious URL that executes arbitrary JavaScript when visited by another authenticated user. This constitutes a reflected XSS vulnerability. This vulnerability is fixed in 7.1.0.
+
+### POC
+
+#### Reference
+- https://github.com/ChurchCRM/CRM/security/advisories/GHSA-fqq6-qrcf-h7h5
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2026/CVE-2026-39339.md b/2026/CVE-2026-39339.md
new file mode 100644
index 0000000000..c1f6bbfd00
--- /dev/null
+++ b/2026/CVE-2026-39339.md
@@ -0,0 +1,17 @@
+### [CVE-2026-39339](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39339)
+![](https://img.shields.io/static/v1?label=Product&message=CRM&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=%3C%207.1.0%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-284%3A%20Improper%20Access%20Control&color=brightgreen)
+
+### Description
+
+ChurchCRM is an open-source church management system. Prior to 7.1.0, a  critical authentication bypass vulnerability in ChurchCRM's API middleware (ChurchCRM/Slim/Middleware/AuthMiddleware.php) allows unauthenticated attackers to access all protected API endpoints by including "api/public" anywhere in the request URL, leading to complete exposure of church member data and system information. This vulnerability is fixed in 7.1.0.
+
+### POC
+
+#### Reference
+- https://github.com/ChurchCRM/CRM/security/advisories/GHSA-v3p2-mx78-pxhc
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2026/CVE-2026-39358.md b/2026/CVE-2026-39358.md
new file mode 100644
index 0000000000..77019847aa
--- /dev/null
+++ b/2026/CVE-2026-39358.md
@@ -0,0 +1,17 @@
+### [CVE-2026-39358](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39358)
+![](https://img.shields.io/static/v1?label=Product&message=v6&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=%3C%206.6.0%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-89%3A%20Improper%20Neutralization%20of%20Special%20Elements%20used%20in%20an%20SQL%20Command%20('SQL%20Injection')&color=brightgreen)
+
+### Description
+
+CubeCart is an ecommerce software solution. Prior to 6.6.0, Authenticated Time-Based Blind SQL Injection vulnerabilities were identified in the sorting parameters (sort[price], sort_activity, sort_admin, and sort_customer) of the Products and Logs endpoints in CubeCart v6.x. This allows an attacker to execute arbitrary SQL commands, compromising the confidentiality and integrity of the database. This vulnerability is fixed in 6.6.0.
+
+### POC
+
+#### Reference
+- https://github.com/cubecart/v6/security/advisories/GHSA-8gj6-9fwc-h4gh
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2026/CVE-2026-39363.md b/2026/CVE-2026-39363.md
new file mode 100644
index 0000000000..2511983727
--- /dev/null
+++ b/2026/CVE-2026-39363.md
@@ -0,0 +1,22 @@
+### [CVE-2026-39363](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39363)
+![](https://img.shields.io/static/v1?label=Product&message=vite&color=blue)
+![](https://img.shields.io/static/v1?label=Product&message=vite-plus&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=%3C%200.1.16%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Version&message=%3E%3D%206.0.0%2C%20%3C%206.4.2%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Version&message=%3E%3D%207.0.0%2C%20%3C%207.3.2%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Version&message=%3E%3D%208.0.0%2C%20%3C%208.0.5%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-200%3A%20Exposure%20of%20Sensitive%20Information%20to%20an%20Unauthorized%20Actor&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-306%3A%20Missing%20Authentication%20for%20Critical%20Function&color=brightgreen)
+
+### Description
+
+Vite is a frontend tooling framework for JavaScript. From 6.0.0 to before 6.4.2, 7.3.2, and 8.0.5, if it is possible to connect to the Vite dev server’s WebSocket without an Origin header, an attacker can invoke fetchModule via the custom WebSocket event vite:invoke and combine file://... with ?raw (or ?inline) to retrieve the contents of arbitrary files on the server as a JavaScript string (e.g., export default "..."). The access control enforced in the HTTP request path (such as server.fs.allow) is not applied to this WebSocket-based execution path. This vulnerability is fixed in 6.4.2, 7.3.2, and 8.0.5.
+
+### POC
+
+#### Reference
+- https://github.com/vitejs/vite/security/advisories/GHSA-p9ff-h696-f583
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2026/CVE-2026-39364.md b/2026/CVE-2026-39364.md
new file mode 100644
index 0000000000..1ae34cd5d2
--- /dev/null
+++ b/2026/CVE-2026-39364.md
@@ -0,0 +1,21 @@
+### [CVE-2026-39364](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39364)
+![](https://img.shields.io/static/v1?label=Product&message=vite&color=blue)
+![](https://img.shields.io/static/v1?label=Product&message=vite-plus&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=%3C%200.1.16%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Version&message=%3E%3D%207.1.0%2C%20%3C%207.3.2%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Version&message=%3E%3D%208.0.0%2C%20%3C%208.0.5%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-180%3A%20Incorrect%20Behavior%20Order%3A%20Validate%20Before%20Canonicalize&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-284%3A%20Improper%20Access%20Control&color=brightgreen)
+
+### Description
+
+Vite is a frontend tooling framework for JavaScript. From 7.1.0 to before 7.3.2 and 8.0.5, on the Vite dev server, files that should be blocked by server.fs.deny (e.g., .env, *.crt) can be retrieved with HTTP 200 responses when query parameters such as ?raw, ?import&raw, or ?import&url&inline are appended. This vulnerability is fixed in 7.3.2 and 8.0.5.
+
+### POC
+
+#### Reference
+- https://github.com/vitejs/vite/security/advisories/GHSA-v2wj-q39q-566r
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2026/CVE-2026-39367.md b/2026/CVE-2026-39367.md
new file mode 100644
index 0000000000..20df29986e
--- /dev/null
+++ b/2026/CVE-2026-39367.md
@@ -0,0 +1,17 @@
+### [CVE-2026-39367](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39367)
+![](https://img.shields.io/static/v1?label=Product&message=AVideo&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=%3C%3D%2026.0%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-79%3A%20Improper%20Neutralization%20of%20Input%20During%20Web%20Page%20Generation%20('Cross-site%20Scripting')&color=brightgreen)
+
+### Description
+
+WWBN AVideo is an open source video platform. In versions 26.0 and prior, AVideo's EPG (Electronic Program Guide) feature parses XML from user-controlled URLs and renders programme titles directly into HTML without any sanitization or escaping. A user with upload permission can set a video's epg_link to a malicious XML file whose <title> elements contain JavaScript. This payload executes in the browser of any unauthenticated visitor to the public EPG page, enabling session hijacking and account takeover.
+
+### POC
+
+#### Reference
+- https://github.com/WWBN/AVideo/security/advisories/GHSA-rqp3-gf5h-mrqx
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2026/CVE-2026-39374.md b/2026/CVE-2026-39374.md
new file mode 100644
index 0000000000..4d20aed86d
--- /dev/null
+++ b/2026/CVE-2026-39374.md
@@ -0,0 +1,17 @@
+### [CVE-2026-39374](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39374)
+![](https://img.shields.io/static/v1?label=Product&message=plane&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=%3C%201.3.0%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-639%3A%20Authorization%20Bypass%20Through%20User-Controlled%20Key&color=brightgreen)
+
+### Description
+
+Plane is an an open-source project management tool. Prior to 1.3.0, the IssueBulkUpdateDateEndpoint allows a project member (ADMIN or MEMBER) to modify the start_date and target_date of ANY issue across the entire Plane instance, regardless of workspace or project membership. The endpoint fetches issues by ID without filtering by workspace or project, enabling cross-boundary data modification. This vulnerability is fixed in 1.3.0.
+
+### POC
+
+#### Reference
+- https://github.com/makeplane/plane/security/advisories/GHSA-4q54-h4x9-m329
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2026/CVE-2026-39383.md b/2026/CVE-2026-39383.md
new file mode 100644
index 0000000000..ea80651902
--- /dev/null
+++ b/2026/CVE-2026-39383.md
@@ -0,0 +1,17 @@
+### [CVE-2026-39383](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39383)
+![](https://img.shields.io/static/v1?label=Product&message=gotenberg&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=%3C%208.31.0%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-918%3A%20Server-Side%20Request%20Forgery%20(SSRF)&color=brightgreen)
+
+### Description
+
+Gotenberg is an API-based document conversion tool. In version 8.29.1, an unauthenticated attacker with network access can force the server to make outbound HTTP POST requests to arbitrary internal or external destinations by supplying a crafted URL in the Gotenberg-Webhook-Url request header. The FilterDeadline function in filter.go is intended to gate outbound URLs, but when both the allow-list and deny-list are empty (the default configuration), it returns nil unconditionally and permits any URL. This is a blind SSRF: Gotenberg POSTs the converted document to the webhook URL and only checks whether the response status code is an error, but never returns the target's response body to the attacker. An attacker can use this to probe internal network infrastructure by observing whether the error callback is invoked, force POST requests against internal services that perform side effects, and confirm reachability of cloud metadata endpoints. The retryable HTTP client issues up to 4 automatic retries per request, amplifying each probe.This issue has been fixed in version 8.31.0. As a workaround, configure the GOTENBERG_API_WEBHOOK_ALLOW_LIST environment variable to restrict webhook URLs to known receivers, or set GOTENBERG_API_WEBHOOK_DENY_LIST to block RFC-1918 and link-local address ranges.
+
+### POC
+
+#### Reference
+- https://github.com/gotenberg/gotenberg/security/advisories/GHSA-5vh4-rgv7-p9g4
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2026/CVE-2026-39387.md b/2026/CVE-2026-39387.md
new file mode 100644
index 0000000000..33285f11b2
--- /dev/null
+++ b/2026/CVE-2026-39387.md
@@ -0,0 +1,17 @@
+### [CVE-2026-39387](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39387)
+![](https://img.shields.io/static/v1?label=Product&message=BoidCMS&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=%3C%202.1.3%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-98%3A%20Improper%20Control%20of%20Filename%20for%20Include%2FRequire%20Statement%20in%20PHP%20Program%20('PHP%20Remote%20File%20Inclusion')&color=brightgreen)
+
+### Description
+
+BoidCMS is an open-source, PHP-based flat-file CMS for building simple websites and blogs, using JSON as its database. Versions prior to 2.1.3 are vulnerable to a critical Local File Inclusion (LFI) attack via the tpl parameter, which can lead to Remote Code Execution (RCE).The application fails to sanitize the tpl (template) parameter during page creation and updates. This parameter is passed directly to a require_once() statement without path validation. An authenticated administrator can exploit this by injecting path traversal sequences (../) into the tpl value to escape the intended theme directory and include arbitrary files — specifically, files from the server's media/ directory. When combined with the file upload functionality, this becomes a full RCE chain: an attacker can first upload a file with embedded PHP code (e.g., disguised as image data), then use the path traversal vulnerability to include that file via require_once(), executing the embedded code with web server privileges. This issue has been fixed in version 2.1.3.
+
+### POC
+
+#### Reference
+- https://github.com/BoidCMS/BoidCMS/security/advisories/GHSA-45xp-xw54-6cv6
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2026/CVE-2026-39390.md b/2026/CVE-2026-39390.md
new file mode 100644
index 0000000000..2967e6d602
--- /dev/null
+++ b/2026/CVE-2026-39390.md
@@ -0,0 +1,17 @@
+### [CVE-2026-39390](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39390)
+![](https://img.shields.io/static/v1?label=Product&message=ci4ms&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=%3C%200.31.4.0%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-79%3A%20Improper%20Neutralization%20of%20Input%20During%20Web%20Page%20Generation%20('Cross-site%20Scripting')&color=brightgreen)
+
+### Description
+
+CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to 0.31.4.0, the Google Maps iframe setting (cMap field) in compInfosPost() sanitizes input using strip_tags() with an <iframe> allowlist and regex-based removal of on\w+ event handlers. However, the srcdoc attribute is not an event handler and passes all filters. An attacker with admin settings access can inject an <iframe srcdoc="..."> payload with HTML-entity-encoded JavaScript that executes in the context of the parent page when rendered to unauthenticated frontend visitors. This vulnerability is fixed in 0.31.4.0.
+
+### POC
+
+#### Reference
+- https://github.com/ci4-cms-erp/ci4ms/security/advisories/GHSA-x3hr-cp7x-44r2
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2026/CVE-2026-39391.md b/2026/CVE-2026-39391.md
new file mode 100644
index 0000000000..8d7f3d20e6
--- /dev/null
+++ b/2026/CVE-2026-39391.md
@@ -0,0 +1,17 @@
+### [CVE-2026-39391](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39391)
+![](https://img.shields.io/static/v1?label=Product&message=ci4ms&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=%3C%200.31.4.0%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-79%3A%20Improper%20Neutralization%20of%20Input%20During%20Web%20Page%20Generation%20('Cross-site%20Scripting')&color=brightgreen)
+
+### Description
+
+CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to 0.31.4.0, the blacklist (ban) note parameter in UserController::ajax_blackList_post() is stored in the database without sanitization and rendered into an HTML data-note attribute without escaping. An admin with blacklist privileges can inject arbitrary JavaScript that executes in the browser of any other admin who views the user management page. This vulnerability is fixed in 0.31.4.0.
+
+### POC
+
+#### Reference
+- https://github.com/ci4-cms-erp/ci4ms/security/advisories/GHSA-7cm9-v848-cfh2
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2026/CVE-2026-39393.md b/2026/CVE-2026-39393.md
new file mode 100644
index 0000000000..36e2ffa4bc
--- /dev/null
+++ b/2026/CVE-2026-39393.md
@@ -0,0 +1,17 @@
+### [CVE-2026-39393](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39393)
+![](https://img.shields.io/static/v1?label=Product&message=ci4ms&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=%3C%200.31.4.0%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-306%3A%20Missing%20Authentication%20for%20Critical%20Function&color=brightgreen)
+
+### Description
+
+CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to 0.31.4.0, the install route guard in ci4ms relies solely on a volatile cache check (cache('settings')) combined with .env file existence to block post-installation access to the setup wizard. When the database is temporarily unreachable during a cache miss (TTL expiry or admin-triggered cache clear), the guard fails open, allowing an unauthenticated attacker to overwrite the .env file with attacker-controlled database credentials, achieving full application takeover. This vulnerability is fixed in 0.31.4.0.
+
+### POC
+
+#### Reference
+- https://github.com/ci4-cms-erp/ci4ms/security/advisories/GHSA-8rh5-4mvx-xj7j
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2026/CVE-2026-39396.md b/2026/CVE-2026-39396.md
new file mode 100644
index 0000000000..5ab3bada56
--- /dev/null
+++ b/2026/CVE-2026-39396.md
@@ -0,0 +1,19 @@
+### [CVE-2026-39396](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39396)
+![](https://img.shields.io/static/v1?label=Product&message=openbao&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=%3C%202.5.3%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-400%3A%20Uncontrolled%20Resource%20Consumption&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-674%3A%20Uncontrolled%20Recursion&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-770%3A%20Allocation%20of%20Resources%20Without%20Limits%20or%20Throttling&color=brightgreen)
+
+### Description
+
+OpenBao is an open source identity-based secrets management system. Prior to version 2.5.3, `ExtractPluginFromImage()` in OpenBao's OCI plugin downloader extracts a plugin binary from a container image by streaming decompressed tar data via `io.Copy` with no upper bound on the number of bytes written. An attacker who controls or compromises the OCI registry referenced in the victim's configuration can serve a crafted image containing a decompression bomb that decompresses to an arbitrarily large file. The SHA256 integrity check occurs after the full file is written to disk, meaning the hash mismatch is detected only after the damage (disk exhaustion) has already occurred. This allow the attacker to replace **legit plugin image** with no need to change its signature. Version 2.5.3 contains a patch.
+
+### POC
+
+#### Reference
+- https://github.com/openbao/openbao/security/advisories/GHSA-r65v-xgwc-g56j
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2026/CVE-2026-39402.md b/2026/CVE-2026-39402.md
new file mode 100644
index 0000000000..c6f65146bf
--- /dev/null
+++ b/2026/CVE-2026-39402.md
@@ -0,0 +1,17 @@
+### [CVE-2026-39402](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39402)
+![](https://img.shields.io/static/v1?label=Product&message=lxc&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=%3C%207.0.0%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-863%3A%20Incorrect%20Authorization&color=brightgreen)
+
+### Description
+
+lxc is a Linux container runtime. In the setuid helper lxc-user-nic, the delete path contains a logic flaw in the find_line() function that allows an unprivileged user to delete OVS-attached network interfaces belonging to other users. When lxc-user-nic delete scans its NIC database to authorize a deletion request, the interface name comparison can set the authorization flag based on a name match alone, even when the ownership, type, and link fields in that database entry belong to a different user. The vulnerable check sits after the goto next label handling, meaning it is reachable on lines where earlier ownership checks failed or were skipped. Because nothing downstream of this authorization signal re-verifies that the matched database line actually belongs to the caller, an unprivileged attacker with a valid lxc-usernet policy entry can trigger deletion of another user's OVS port on the same bridge. This is limited to multi-tenant environments using lxc-user-nic with OpenVSwitch bridges. The impact is denial of service - one tenant can repeatedly disconnect networking from containers run by another tenant on shared infrastructure. This is patched in version 7.0.0.
+
+### POC
+
+#### Reference
+- https://github.com/lxc/lxc/security/advisories/GHSA-3m9j-g9gc-vcvq
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2026/CVE-2026-39412.md b/2026/CVE-2026-39412.md
new file mode 100644
index 0000000000..cb1f9c1045
--- /dev/null
+++ b/2026/CVE-2026-39412.md
@@ -0,0 +1,17 @@
+### [CVE-2026-39412](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39412)
+![](https://img.shields.io/static/v1?label=Product&message=liquidjs&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=%3C%2010.25.4%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-200%3A%20Exposure%20of%20Sensitive%20Information%20to%20an%20Unauthorized%20Actor&color=brightgreen)
+
+### Description
+
+LiquidJS is a Shopify / GitHub Pages compatible template engine in pure JavaScript. Prior to 10.25.4, the sort_natural filter bypasses the ownPropertyOnly security option, allowing template authors to extract values of prototype-inherited properties through a sorting side-channel attack. Applications relying on ownPropertyOnly: true as a security boundary (e.g., multi-tenant template systems) are exposed to information disclosure of sensitive prototype properties such as API keys and tokens. This vulnerability is fixed in 10.25.4.
+
+### POC
+
+#### Reference
+- https://github.com/harttle/liquidjs/security/advisories/GHSA-rv5g-f82m-qrvv
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2026/CVE-2026-39422.md b/2026/CVE-2026-39422.md
new file mode 100644
index 0000000000..27900bf26a
--- /dev/null
+++ b/2026/CVE-2026-39422.md
@@ -0,0 +1,17 @@
+### [CVE-2026-39422](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39422)
+![](https://img.shields.io/static/v1?label=Product&message=MaxKB&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=%3C%202.8.0%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-79%3A%20Improper%20Neutralization%20of%20Input%20During%20Web%20Page%20Generation%20('Cross-site%20Scripting')&color=brightgreen)
+
+### Description
+
+MaxKB is an open-source AI assistant for enterprise. Versions 2.7.1 and below contain a Stored Cross-Site Scripting (XSS) vulnerability through the application name or icon fields when creating an application. When a victim visits the public chat interface (/ui/chat/{access_token}), the ChatHeadersMiddleware retrieves the application data and directly inserts the unescaped application name and icon into the HTML response via string replacement. This allows an attacker to execute arbitrary JavaScript in the victim's browser context. This issue has been fixed in version 2.8.0.
+
+### POC
+
+#### Reference
+- https://github.com/1Panel-dev/MaxKB/security/advisories/GHSA-wf7p-3jq5-q52w
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2026/CVE-2026-39803.md b/2026/CVE-2026-39803.md
index 321baafab6..0c36021896 100644
--- a/2026/CVE-2026-39803.md
+++ b/2026/CVE-2026-39803.md
@@ -12,6 +12,7 @@ Allocation of Resources Without Limits or Throttling vulnerability in mtrudel ba
 
 #### Reference
 - https://cna.erlef.org/cves/CVE-2026-39803.html
+- https://github.com/mtrudel/bandit/security/advisories/GHSA-9q9q-324x-93r2
 
 #### Github
 No PoCs found on GitHub currently.
diff --git a/2026/CVE-2026-39804.md b/2026/CVE-2026-39804.md
index 6ae942496e..63d983d64f 100644
--- a/2026/CVE-2026-39804.md
+++ b/2026/CVE-2026-39804.md
@@ -12,6 +12,7 @@ Allocation of Resources Without Limits or Throttling vulnerability in mtrudel ba
 
 #### Reference
 - https://cna.erlef.org/cves/CVE-2026-39804.html
+- https://github.com/mtrudel/bandit/security/advisories/GHSA-frh3-6pv6-rc8j
 
 #### Github
 No PoCs found on GitHub currently.
diff --git a/2026/CVE-2026-39805.md b/2026/CVE-2026-39805.md
index 41cef64ca6..45aa9191ce 100644
--- a/2026/CVE-2026-39805.md
+++ b/2026/CVE-2026-39805.md
@@ -11,6 +11,7 @@ Inconsistent Interpretation of HTTP Requests vulnerability in mtrudel bandit all
 
 #### Reference
 - https://cna.erlef.org/cves/CVE-2026-39805.html
+- https://github.com/mtrudel/bandit/security/advisories/GHSA-c67r-gc9j-2qf7
 
 #### Github
 No PoCs found on GitHub currently.
diff --git a/2026/CVE-2026-39806.md b/2026/CVE-2026-39806.md
index 6cfd7b6f71..d6b2502b30 100644
--- a/2026/CVE-2026-39806.md
+++ b/2026/CVE-2026-39806.md
@@ -12,6 +12,7 @@ Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in mtrudel
 
 #### Reference
 - https://cna.erlef.org/cves/CVE-2026-39806.html
+- https://github.com/mtrudel/bandit/security/advisories/GHSA-rf5q-vwxw-gmrf
 
 #### Github
 No PoCs found on GitHub currently.
diff --git a/2026/CVE-2026-39808.md b/2026/CVE-2026-39808.md
new file mode 100644
index 0000000000..7434158c99
--- /dev/null
+++ b/2026/CVE-2026-39808.md
@@ -0,0 +1,27 @@
+### [CVE-2026-39808](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39808)
+![](https://img.shields.io/static/v1?label=Product&message=FortiSandbox%20PaaS&color=blue)
+![](https://img.shields.io/static/v1?label=Product&message=FortiSandbox&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=21.3.4055%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Version&message=21.4.4072%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Version&message=22.1.4113%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Version&message=22.2.4134%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Version&message=22.2.4151%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Version&message=23.1.4245%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Version&message=23.3.4329%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Version&message=23.4.4350%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Version&message=23.4.4374%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Version&message=4.4.0%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=Execute%20unauthorized%20code%20or%20commands&color=brightgreen)
+
+### Description
+
+A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiSandbox 4.4.0 through 4.4.8 may allow attacker to execute unauthorized code or commands via <insert attack vector here>
+
+### POC
+
+#### Reference
+- https://github.com/samu-delucas/CVE-2026-39808
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2026/CVE-2026-39856.md b/2026/CVE-2026-39856.md
new file mode 100644
index 0000000000..a86cc1c37a
--- /dev/null
+++ b/2026/CVE-2026-39856.md
@@ -0,0 +1,17 @@
+### [CVE-2026-39856](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39856)
+![](https://img.shields.io/static/v1?label=Product&message=osslsigncode&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=%3C%202.13%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-125%3A%20Out-of-bounds%20Read&color=brightgreen)
+
+### Description
+
+osslsigncode is a tool that implements Authenticode signing and timestamping. Prior to 2.13, an out-of-bounds read vulnerability exists in osslsigncode version 2.12 and earlier in the PE page-hash computation code (pe_page_hash_calc()). When processing PE sections for page hashing, the function uses PointerToRawData and SizeOfRawData values from section headers without validating that the referenced region lies within the mapped file. An attacker can craft a PE file with section headers that point beyond the end of the file. When osslsigncode computes page hashes for such a file, it may attempt to hash data from an invalid memory region, causing an out-of-bounds read and potentially crashing the process. The vulnerability can be triggered while signing a malicious PE file with page hashing enabled (-ph), or while verifying a malicious signed PE file that already contains page hashes. Verification of an already signed file does not require the verifier to pass -ph. This vulnerability is fixed in 2.13.
+
+### POC
+
+#### Reference
+- https://github.com/mtrojnar/osslsigncode/security/advisories/GHSA-rjrx-chvw-8jw8
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2026/CVE-2026-39858.md b/2026/CVE-2026-39858.md
new file mode 100644
index 0000000000..df48ae86f7
--- /dev/null
+++ b/2026/CVE-2026-39858.md
@@ -0,0 +1,20 @@
+### [CVE-2026-39858](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39858)
+![](https://img.shields.io/static/v1?label=Product&message=traefik&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=%3C%202.11.43%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Version&message=%3E%3D%203.0.0-beta1%2C%20%3C%203.6.14%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Version&message=%3E%3D%203.7.0-ea.1%2C%20%3C%203.7.0-rc.2%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-290%3A%20Authentication%20Bypass%20by%20Spoofing&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-306%3A%20Missing%20Authentication%20for%20Critical%20Function&color=brightgreen)
+
+### Description
+
+Traefik is an HTTP reverse proxy and load balancer. Prior to versions 2.11.43, 3.6.14, and 3.7.0-rc.2, there is a high severity authentication bypass vulnerability in Traefik's ForwardAuth and snippet-based authentication middleware. Traefik's forwarded-header sanitization logic targets only canonical header names (e.g., X-Forwarded-Proto) and does not strip or normalize alias variants that use underscores instead of dashes (e.g., X_Forwarded_Proto). These unsanitized alias headers are forwarded intact to the authentication backend. When the backend normalizes underscore and dash header forms equivalently, an attacker can inject spoofed trust context — such as a trusted scheme or host — through the alias headers and bypass authentication on protected routes without valid credentials. This issue has been patched in versions 2.11.43, 3.6.14, and 3.7.0-rc.2.
+
+### POC
+
+#### Reference
+- https://github.com/traefik/traefik/security/advisories/GHSA-5m6w-wvh7-57vm
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2026/CVE-2026-39866.md b/2026/CVE-2026-39866.md
new file mode 100644
index 0000000000..4d06a79e50
--- /dev/null
+++ b/2026/CVE-2026-39866.md
@@ -0,0 +1,17 @@
+### [CVE-2026-39866](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39866)
+![](https://img.shields.io/static/v1?label=Product&message=lawnchair&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=%3C%20fcba413f55dd47f8a3921445252849126c6266b2%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-77%3A%20Improper%20Neutralization%20of%20Special%20Elements%20used%20in%20a%20Command%20('Command%20Injection')&color=brightgreen)
+
+### Description
+
+Lawnchair is a free, open-source home app for Android. Prior to commit fcba413f55dd47f8a3921445252849126c6266b2, command injection in release_update.yml workflow dispatch input allows arbitrary code execution. Commit fcba413f55dd47f8a3921445252849126c6266b2 patches the issue.
+
+### POC
+
+#### Reference
+- https://github.com/LawnchairLauncher/lawnchair/security/advisories/GHSA-9prc-pp2c-3427
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2026/CVE-2026-39906.md b/2026/CVE-2026-39906.md
new file mode 100644
index 0000000000..6fe0e732cc
--- /dev/null
+++ b/2026/CVE-2026-39906.md
@@ -0,0 +1,18 @@
+### [CVE-2026-39906](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39906)
+![](https://img.shields.io/static/v1?label=Product&message=WebPerfect%20Image%20Suite&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=3.0.3960.22604%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Version&message=3.0.3960.22810%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=Unintended%20Proxy%20or%20Intermediary%20('Confused%20Deputy')&color=brightgreen)
+
+### Description
+
+Unisys WebPerfect Image Suite versions 3.0.3960.22810 and 3.0.3960.22604 expose a deprecated .NET Remoting TCP channel that allows remote unauthenticated attackers to leak NTLMv2 machine-account hashes by supplying a Windows UNC path as a target file argument through object-unmarshalling techniques. Attackers can capture the leaked NTLMv2 hash and relay it to other hosts to achieve privilege escalation or lateral movement depending on network configuration and patch level.
+
+### POC
+
+#### Reference
+- https://gist.github.com/VAMorales/be3e4ed472c51794493c1256cce16129
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2026/CVE-2026-39907.md b/2026/CVE-2026-39907.md
new file mode 100644
index 0000000000..35a0c5eeec
--- /dev/null
+++ b/2026/CVE-2026-39907.md
@@ -0,0 +1,18 @@
+### [CVE-2026-39907](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39907)
+![](https://img.shields.io/static/v1?label=Product&message=WebPerfect%20Image%20Suite&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=3.0.3960.22604%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Version&message=3.0.3960.22810%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=External%20Control%20of%20File%20Name%20or%20Path&color=brightgreen)
+
+### Description
+
+Unisys WebPerfect Image Suite versions 3.0.3960.22810 and 3.0.3960.22604 expose an unauthenticated WCF SOAP endpoint on TCP port 1208 that accepts unsanitized file paths in the ReadLicense action's LFName parameter, allowing remote attackers to trigger SMB connections and leak NTLMv2 machine-account hashes. Attackers can submit crafted SOAP requests with UNC paths to force the server to initiate outbound SMB connections, exposing authentication credentials that may be relayed for privilege escalation or lateral movement within the network.
+
+### POC
+
+#### Reference
+- https://gist.github.com/VAMorales/be3e4ed472c51794493c1256cce16129
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2026/CVE-2026-39920.md b/2026/CVE-2026-39920.md
new file mode 100644
index 0000000000..d999a819e0
--- /dev/null
+++ b/2026/CVE-2026-39920.md
@@ -0,0 +1,18 @@
+### [CVE-2026-39920](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39920)
+![](https://img.shields.io/static/v1?label=Product&message=FileStore&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-1188%20Initialization%20of%20a%20Resource%20with%20an%20Insecure%20Default&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-1391%20Use%20of%20Weak%20Credentials&color=brightgreen)
+
+### Description
+
+BridgeHead FileStore versions prior to 24A (released in early 2024) expose the Apache Axis2 administration module on network-accessible endpoints with default credentials that allows unauthenticated remote attackers to execute arbitrary OS commands. Attackers can authenticate to the admin console using default credentials, upload a malicious Java archive as a web service, and execute arbitrary commands on the host via SOAP requests to the deployed service.
+
+### POC
+
+#### Reference
+- https://gist.github.com/VAMorales/9e6a13d7529c079a363930dff48be3ba
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2026/CVE-2026-39941.md b/2026/CVE-2026-39941.md
new file mode 100644
index 0000000000..a087228617
--- /dev/null
+++ b/2026/CVE-2026-39941.md
@@ -0,0 +1,18 @@
+### [CVE-2026-39941](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39941)
+![](https://img.shields.io/static/v1?label=Product&message=CRM&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=%3C%207.1.0%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-79%3A%20Improper%20Neutralization%20of%20Input%20During%20Web%20Page%20Generation%20('Cross-site%20Scripting')&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-80%3A%20Improper%20Neutralization%20of%20Script-Related%20HTML%20Tags%20in%20a%20Web%20Page%20(Basic%20XSS)&color=brightgreen)
+
+### Description
+
+ChurchCRM is an open-source church management system. Prior to 7.1.0, an XSS vulnerability allows attacker-supplied input sent via a the EName and EDesc parameters in EditEventAttendees.php to be rendered in a page without proper output encoding, enabling arbitrary JavaScript execution in victims' browsers. This vulnerability is fixed in 7.1.0.
+
+### POC
+
+#### Reference
+- https://github.com/ChurchCRM/CRM/security/advisories/GHSA-4mqw-9jww-2c58
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2026/CVE-2026-39957.md b/2026/CVE-2026-39957.md
new file mode 100644
index 0000000000..6b733f0acf
--- /dev/null
+++ b/2026/CVE-2026-39957.md
@@ -0,0 +1,17 @@
+### [CVE-2026-39957](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39957)
+![](https://img.shields.io/static/v1?label=Product&message=Lychee&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=%3C%207.5.4%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-863%3A%20Incorrect%20Authorization&color=brightgreen)
+
+### Description
+
+Lychee is a free, open-source photo-management tool. Prior to 7.5.4, a SQL operator-precedence bug in SharingController::listAll() causes the orWhereNotNull('user_group_id') clause to escape the ownership filter applied by the when() block. Any authenticated non-admin user with upload permission who owns at least one album can retrieve all user-group-based sharing permissions across the entire instance, including private albums owned by other users. This vulnerability is fixed in 7.5.4.
+
+### POC
+
+#### Reference
+- https://github.com/LycheeOrg/Lychee/security/advisories/GHSA-4v4c-g2jv-4g25
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2026/CVE-2026-39958.md b/2026/CVE-2026-39958.md
new file mode 100644
index 0000000000..737c2fc64e
--- /dev/null
+++ b/2026/CVE-2026-39958.md
@@ -0,0 +1,17 @@
+### [CVE-2026-39958](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39958)
+![](https://img.shields.io/static/v1?label=Product&message=oma&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=%3C%201.25.1%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-93%3A%20Improper%20Neutralization%20of%20CRLF%20Sequences%20('CRLF%20Injection')&color=brightgreen)
+
+### Description
+
+oma is a package manager for AOSC OS. Prior to 1.25.2, oma-topics is responsible for fetching metadata for testing repositories (topics) named "Topic Manifests" ({mirror}/debs/manifest/topics.json) from remote repository servers, registering them as APT source entries. However, the name field in said metadata were not checked for transliteration. In this case, a malicious party may supply a malformed Topic Manifest, which may cause malicious APT source entries to be added to /etc/apt/sources.list.d/atm.list as oma-topics finishes fetching and registering metadata. This vulnerability is fixed in 1.25.2.
+
+### POC
+
+#### Reference
+- https://github.com/AOSC-Dev/oma/security/advisories/GHSA-86jc-7r6q-cr3f
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2026/CVE-2026-39967.md b/2026/CVE-2026-39967.md
new file mode 100644
index 0000000000..94a050b9a6
--- /dev/null
+++ b/2026/CVE-2026-39967.md
@@ -0,0 +1,18 @@
+### [CVE-2026-39967](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39967)
+![](https://img.shields.io/static/v1?label=Product&message=typebot.io&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=%3C%203.16.0%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-639%3A%20Authorization%20Bypass%20Through%20User-Controlled%20Key&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-862%3A%20Missing%20Authorization&color=brightgreen)
+
+### Description
+
+TypeBot is a chatbot builder tool. In versions 3.15.2 and prior, the bot engine's the findResult query does not filter results by typebotId, allowing an authenticated user to load result data (user answers, variable values) from a different typebot by supplying a foreign resultId to the startChat endpoint. Exploitation is constrained by CUID2's cryptographically random 24-character IDs (making brute-force infeasible), the requirement that rememberUser be enabled, and the need for matching variable names in the current typebot. If successfully exploited, an attacker can access the original user's previous answers, session variable values, and hasStarted flag, potentially exposing PII like names, emails, and phone numbers. This issue has been fixed in version 3.16.0.
+
+### POC
+
+#### Reference
+- https://github.com/baptisteArno/typebot.io/security/advisories/GHSA-f475-7m4x-m6mx
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2026/CVE-2026-39968.md b/2026/CVE-2026-39968.md
new file mode 100644
index 0000000000..b78c5ca8a3
--- /dev/null
+++ b/2026/CVE-2026-39968.md
@@ -0,0 +1,19 @@
+### [CVE-2026-39968](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39968)
+![](https://img.shields.io/static/v1?label=Product&message=typebot.io&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=%3C%203.16.0%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-284%3A%20Improper%20Access%20Control&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-522%3A%20Insufficiently%20Protected%20Credentials&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-639%3A%20Authorization%20Bypass%20Through%20User-Controlled%20Key&color=brightgreen)
+
+### Description
+
+TypeBot is a chatbot builder tool. In versions 3.15.2 and prior, the fix for GHSA-4xc5-wfwc-jw47 ("Credential Theft via Client-Side Script Execution and API Authorization Bypass") is incomplete. While the builder's getCredentials tRPC endpoint was patched with workspace membership checks, the bot-engine runtime still allows any authenticated user to use credentials from any workspace via the preview chat endpoint. The bot-engine's getCredentials() utility function uses a falsy check (if (workspaceId && ...)) for workspace ownership validation. Since the preview endpoint accepts a client-controlled workspaceId field and the Zod schema allows empty strings, an attacker can supply workspaceId: "" to bypass credential ownership verification entirely. Exploitation can result in credential exfiltration, external service abuse, financial damage and a data breach.
+
+### POC
+
+#### Reference
+- https://github.com/baptisteArno/typebot.io/security/advisories/GHSA-cq66-9cwr-x8jr
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2026/CVE-2026-39970.md b/2026/CVE-2026-39970.md
new file mode 100644
index 0000000000..fce22e9135
--- /dev/null
+++ b/2026/CVE-2026-39970.md
@@ -0,0 +1,17 @@
+### [CVE-2026-39970](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39970)
+![](https://img.shields.io/static/v1?label=Product&message=typebot.io&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=%3C%203.16.0%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-79%3A%20Improper%20Neutralization%20of%20Input%20During%20Web%20Page%20Generation%20('Cross-site%20Scripting')&color=brightgreen)
+
+### Description
+
+TypeBot is a chatbot builder tool. Versions 3.15.2 and prior contain a critical stored XSS vulnerability in the app.typebot.io profile picture upload form. The application fails to sanitize or restrict SVG/XML-based uploads and directly renders them when accessed through the domain. By uploading a crafted malicious SVG file containing embedded JavaScript, an attacker will execute arbitrary JavaScript code. This vulnerability directly enables stored XSS exploitation because the payload is persistently stored on your infrastructure (app.typebot.io) and accessible from a public-facing, permanent link. Stored XSS via malicious SVG uploads to app.typebot.io allows attackers to execute arbitrary JavaScript in victims' browsers, enabling session/token theft, account takeover, and exfiltration of sensitive user data. This issue has been fixed in version 3.16.0.
+
+### POC
+
+#### Reference
+- https://github.com/baptisteArno/typebot.io/security/advisories/GHSA-jj87-c343-26vp
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2026/CVE-2026-39979.md b/2026/CVE-2026-39979.md
new file mode 100644
index 0000000000..fcc2aa2dde
--- /dev/null
+++ b/2026/CVE-2026-39979.md
@@ -0,0 +1,17 @@
+### [CVE-2026-39979](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39979)
+![](https://img.shields.io/static/v1?label=Product&message=jq&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=%3C%202f09060afab23fe9390cce7cb860b10416e1bf5f%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-125%3A%20Out-of-bounds%20Read&color=brightgreen)
+
+### Description
+
+jq is a command-line JSON processor. In commits before 2f09060afab23fe9390cce7cb860b10416e1bf5f, the jv_parse_sized() API in libjq accepts a counted buffer with an explicit length parameter, but its error-handling path formats the input buffer using %s in jv_string_fmt(), which reads until a NUL terminator is found rather than respecting the caller-supplied length. This means that when malformed JSON is passed in a non-NUL-terminated buffer, the error construction logic performs an out-of-bounds read past the end of the buffer. The vulnerability is reachable by any libjq consumer calling jv_parse_sized() with untrusted input, and depending on memory layout, can result in memory disclosure or process termination. The issue has been patched in commit 2f09060afab23fe9390cce7cb860b10416e1bf5f.
+
+### POC
+
+#### Reference
+- https://github.com/jqlang/jq/security/advisories/GHSA-2hhh-px8h-355p
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2026/CVE-2026-39983.md b/2026/CVE-2026-39983.md
new file mode 100644
index 0000000000..416533e0f5
--- /dev/null
+++ b/2026/CVE-2026-39983.md
@@ -0,0 +1,17 @@
+### [CVE-2026-39983](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39983)
+![](https://img.shields.io/static/v1?label=Product&message=basic-ftp&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=%3C%205.2.1%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-93%3A%20Improper%20Neutralization%20of%20CRLF%20Sequences%20('CRLF%20Injection')&color=brightgreen)
+
+### Description
+
+basic-ftp is an FTP client for Node.js. Prior to 5.2.1, basic-ftp allows FTP command injection via CRLF sequences (\r\n) in file path parameters passed to high-level path APIs such as cd(), remove(), rename(), uploadFrom(), downloadTo(), list(), and removeDir(). The library's protectWhitespace() helper only handles leading spaces and returns other paths unchanged, while FtpContext.send() writes the resulting command string directly to the control socket with \r\n appended. This lets attacker-controlled path strings split one intended FTP command into multiple commands. This vulnerability is fixed in 5.2.1.
+
+### POC
+
+#### Reference
+- https://github.com/patrickjuchli/basic-ftp/security/advisories/GHSA-chqc-8p9q-pq6q
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2026/CVE-2026-44967.md b/2026/CVE-2026-44967.md
new file mode 100644
index 0000000000..ac919b3e41
--- /dev/null
+++ b/2026/CVE-2026-44967.md
@@ -0,0 +1,17 @@
+### [CVE-2026-44967](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-44967)
+![](https://img.shields.io/static/v1?label=Product&message=opentelemetry-cpp&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=%3C%201.27.0%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-789%3A%20Memory%20Allocation%20with%20Excessive%20Size%20Value&color=brightgreen)
+
+### Description
+
+OpenTelemetry-cpp is the C++ implementation of OpenTelemetry. Prior to release 1.27.0, the OTLP HTTP exporters (traces/metrics/logs) read the full HTTP response into an in-memory vector of bytes without a size cap. This is exploitable for memory exhaustion when the configured collector endpoint is attacker-controlled (or a network attacker can MITM the exporter connection). This vulnerability is fixed in opentelemetry-cpp release 1.27.0.
+
+### POC
+
+#### Reference
+- https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-w8rr-5gcm-pp58
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2026/CVE-2026-46360.md b/2026/CVE-2026-46360.md
new file mode 100644
index 0000000000..46e2b3ab93
--- /dev/null
+++ b/2026/CVE-2026-46360.md
@@ -0,0 +1,18 @@
+### [CVE-2026-46360](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46360)
+![](https://img.shields.io/static/v1?label=Product&message=phpmyfaq&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=Improper%20Neutralization%20of%20Input%20During%20Web%20Page%20Generation%20('Cross-site%20Scripting')&color=brightgreen)
+
+### Description
+
+phpMyFAQ before 4.1.2 contains a stored cross-site scripting vulnerability in SvgSanitizer::decodeAllEntities() that limits recursive entity decoding to 5 iterations, allowing attackers to bypass sanitization. Authenticated users with FAQ_EDIT permission can upload malicious SVG files with deeply nested ampersand encoding around numeric HTML entities to reconstruct javascript: URLs, which execute arbitrary JavaScript when clicked by other users viewing the uploaded SVG.
+
+### POC
+
+#### Reference
+- https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-whqh-9pq5-c7r3
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2026/CVE-2026-46366.md b/2026/CVE-2026-46366.md
new file mode 100644
index 0000000000..465dc2134c
--- /dev/null
+++ b/2026/CVE-2026-46366.md
@@ -0,0 +1,18 @@
+### [CVE-2026-46366](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46366)
+![](https://img.shields.io/static/v1?label=Product&message=phpmyfaq&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=Incorrect%20Authorization&color=brightgreen)
+
+### Description
+
+phpMyFAQ before 4.1.2 contains an information disclosure vulnerability in the getIdFromSolutionId() method that lacks permission filtering, allowing unauthenticated attackers to enumerate restricted FAQ entries and read their titles via the /solution_id_{id}.html endpoint. Attackers can sequentially iterate solution IDs to discover all FAQs including those restricted to specific users or groups, leaking sensitive metadata through redirect Location headers and page canonical links.
+
+### POC
+
+#### Reference
+- https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-99qv-g4x9-mgc3
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2026/CVE-2026-46372.md b/2026/CVE-2026-46372.md
new file mode 100644
index 0000000000..81612386d2
--- /dev/null
+++ b/2026/CVE-2026-46372.md
@@ -0,0 +1,17 @@
+### [CVE-2026-46372](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46372)
+![](https://img.shields.io/static/v1?label=Product&message=SillyTavern&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=%3C%201.18.0%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-918%3A%20Server-Side%20Request%20Forgery%20(SSRF)&color=brightgreen)
+
+### Description
+
+SillyTavern is a locally installed user interface that allows users to interact with text generation large language models, image generation engines, and text-to-speech voice models. Prior to 1.18.0, SillyTavern exposes /api/search/searxng, which accepts attacker-controlled baseUrl and uses it directly to build outbound server-side fetches. An authenticated low-privilege user can point baseUrl at an internal or loopback HTTP service and receive the /search response body. This vulnerability is fixed in 1.18.0.
+
+### POC
+
+#### Reference
+- https://github.com/SillyTavern/SillyTavern/security/advisories/GHSA-qg89-qwwh-5f3j
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2026/CVE-2026-46390.md b/2026/CVE-2026-46390.md
new file mode 100644
index 0000000000..f29b6d53f5
--- /dev/null
+++ b/2026/CVE-2026-46390.md
@@ -0,0 +1,17 @@
+### [CVE-2026-46390](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46390)
+![](https://img.shields.io/static/v1?label=Product&message=haxcms-php&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=%3E%3D%202.0.0%2C%20%3C%2026.0.0%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-639%3A%20Authorization%20Bypass%20Through%20User-Controlled%20Key&color=brightgreen)
+
+### Description
+
+HAX CMS helps manage microsite universe with PHP or NodeJs backends. Starting in version 2.0.0 and prior to version 26.0.0, the gitlist plugin is exposed to unauthenticated users, allowing unauthenticated browsing of git repositories and git history. Version 26.0.0 patches the issue.
+
+### POC
+
+#### Reference
+- https://github.com/haxtheweb/issues/security/advisories/GHSA-6434-8rch-w65c
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2026/CVE-2026-46392.md b/2026/CVE-2026-46392.md
new file mode 100644
index 0000000000..67d6a5c977
--- /dev/null
+++ b/2026/CVE-2026-46392.md
@@ -0,0 +1,18 @@
+### [CVE-2026-46392](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46392)
+![](https://img.shields.io/static/v1?label=Product&message=haxcms-php&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=%3C%2026.0.0%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-178%3A%20Improper%20Handling%20of%20Case%20Sensitivity&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-434%3A%20Unrestricted%20Upload%20of%20File%20with%20Dangerous%20Type&color=brightgreen)
+
+### Description
+
+HAX CMS helps manage microsite universe with PHP or NodeJs backends. Prior to version 26.0.0 of HAX CMS PHP, the `saveFile` endpoint validates upload extensions case-insensitively and writes the filename to disk verbatim, but the `.htaccess` rule that forces `Content-Disposition: attachment` on HTML files is case-sensitive. An HTML file uploaded with an uppercase extension (`.HTML`, `.Html`, `.HTM`) is still served as `text/html` but the forced-download header never applies, so the browser renders it inline and executes any embedded JavaScript in the HAXcms origin. This bypasses the mitigation shipped for CVE-2026-22704. Version 26.0.0 contains a fix.
+
+### POC
+
+#### Reference
+- https://github.com/haxtheweb/issues/security/advisories/GHSA-hg33-w4j2-95qp
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2026/CVE-2026-46395.md b/2026/CVE-2026-46395.md
new file mode 100644
index 0000000000..804ab8df72
--- /dev/null
+++ b/2026/CVE-2026-46395.md
@@ -0,0 +1,19 @@
+### [CVE-2026-46395](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46395)
+![](https://img.shields.io/static/v1?label=Product&message=haxcms-nodejs&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=%3C%2026.0.0%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-200%3A%20Exposure%20of%20Sensitive%20Information%20to%20an%20Unauthorized%20Actor&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-321%3A%20Use%20of%20Hard-coded%20Cryptographic%20Key&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-327%3A%20Use%20of%20a%20Broken%20or%20Risky%20Cryptographic%20Algorithm&color=brightgreen)
+
+### Description
+
+HAX CMS helps manage microsite universe with PHP or NodeJs backends. Prior to version 26.0.0, the `hmacBase64()` function in the HAXcms Node.js backend contains two critical cryptographic implementation errors that together allow any unauthenticated attacker to extract the system’s private signing key and forge arbitrary admin-level JSON Web Tokens (JWTs) allowing them to get full admin access with a single HTTP request. First, the function passes the literal string "0" as the HMAC signing key instead of the key parameter, making every HAXcms instance compute identical HMACs for the same input. Then, after computing the HMAC, the function concatenates the real key parameter which is "this.privateKey + this.salt", the system’s master signing secret is directly onto the output. The combined buffer is base64-encoded and returned as the token. Every base64url token produced has the same structure: 32 bytes HMAC keyed with "0" and N bytes of `privateKey+salt`. An attacker base64-decodes any token, discards the first 32 bytes, and reads the private key directly. The `/system/api/connectionSettings` endpoint is unauthenticated and returns multiple tokens generated by this function. A single GET request to this endpoint exposes the private key. The PHP backend implements this function correctly with the actual key and returns only the hash. The PHP version produces 44-character tokens whereas the broken Node.js version produces 139+ character tokens. Version 26.0.0 fixes the issue.
+
+### POC
+
+#### Reference
+- https://github.com/haxtheweb/issues/security/advisories/GHSA-6c8g-9hfh-pq5h
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2026/CVE-2026-46408.md b/2026/CVE-2026-46408.md
new file mode 100644
index 0000000000..f7aeb815d6
--- /dev/null
+++ b/2026/CVE-2026-46408.md
@@ -0,0 +1,17 @@
+### [CVE-2026-46408](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46408)
+![](https://img.shields.io/static/v1?label=Product&message=Vvveb&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=%3C%201.0.8.3%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-639%3A%20Authorization%20Bypass%20Through%20User-Controlled%20Key&color=brightgreen)
+
+### Description
+
+Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.3, the checkout endpoint accepts a user-controlled cart_id and uses it to enter the payment flow without verifying cart ownership. A logged-in attacker can therefore reuse another user's cart data in their own checkout session. This vulnerability is fixed in 1.0.8.3.
+
+### POC
+
+#### Reference
+- https://github.com/givanz/Vvveb/security/advisories/GHSA-rmh2-wv73-xpqh
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2026/CVE-2026-46529.md b/2026/CVE-2026-46529.md
new file mode 100644
index 0000000000..f35195b10e
--- /dev/null
+++ b/2026/CVE-2026-46529.md
@@ -0,0 +1,20 @@
+### [CVE-2026-46529](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46529)
+![](https://img.shields.io/static/v1?label=Product&message=atril&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=%3C%201.26.3%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Version&message=%3E%3D%201.27.0%2C%20%3C%201.28.4%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-77%3A%20Improper%20Neutralization%20of%20Special%20Elements%20used%20in%20a%20Command%20('Command%20Injection')&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-829%3A%20Inclusion%20of%20Functionality%20from%20Untrusted%20Control%20Sphere&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-88%3A%20Improper%20Neutralization%20of%20Argument%20Delimiters%20in%20a%20Command%20('Argument%20Injection')&color=brightgreen)
+
+### Description
+
+Atril Document Viewer is the default document reader of the MATE desktop environment for Linux. A single-click remote code execution vulnerability in versions prior to 1.26.3 and 1.28.4 allows an attacker to achieve arbitrary code execution as the user by tricking them into clicking a link inside a malicious PDF document. The PDF can be packaged as a polyglot file that is simultaneously a valid PDF and a valid ELF shared library, making the attack a single-file, single-click, configuration-independent RCE on stock atril installations. The root cause is `shell/ev-application.c:ev_spawn`, which builds a command line from attacker-controlled PDF link-destination fields without applying `g_shell_quote`. The cmdline is then handed to `g_app_info_create_from_commandline`, which shell-parses it back into argv — splitting any embedded `--gtk-module=PATH` into a separate argv element. GTK then `dlopen()`s the path during init, running any `__attribute__((constructor))` it finds. Versions 1.26.3 and 1.28.4 contain a patch for the issue. This is the same defect class as CVE-2023-51698 (CBT `--checkpoint-action` injection in `comics-document.c`, fixed in 1.6.2) but in a different code path (`shell/ev-application.c`) that the original patch did not touch.
+
+### POC
+
+#### Reference
+- https://github.com/mate-desktop/atril/security/advisories/GHSA-vgv2-m826-8f6f
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2026/CVE-2026-46611.md b/2026/CVE-2026-46611.md
new file mode 100644
index 0000000000..3501dcca2e
--- /dev/null
+++ b/2026/CVE-2026-46611.md
@@ -0,0 +1,18 @@
+### [CVE-2026-46611](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46611)
+![](https://img.shields.io/static/v1?label=Product&message=glances&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=%3C%204.5.5%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-346%3A%20Origin%20Validation%20Error&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-350%3A%20Reliance%20on%20Reverse%20DNS%20Resolution%20for%20a%20Security-Critical%20Action&color=brightgreen)
+
+### Description
+
+Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.5, the Glances XML-RPC server (glances -s, implemented in glances/server.py) does not validate the HTTP Host header, leaving it vulnerable to DNS rebinding attacks. An attacker can exploit DNS rebinding to exfiltrate the full system monitoring dataset from a victim's browser. This vulnerability is fixed in 4.5.5.
+
+### POC
+
+#### Reference
+- https://github.com/nicolargo/glances/security/advisories/GHSA-w856-8p3r-p338
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2026/CVE-2026-46657.md b/2026/CVE-2026-46657.md
new file mode 100644
index 0000000000..fbcc436c9a
--- /dev/null
+++ b/2026/CVE-2026-46657.md
@@ -0,0 +1,18 @@
+### [CVE-2026-46657](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46657)
+![](https://img.shields.io/static/v1?label=Product&message=bludit&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=%3C%203.22.0%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-212%3A%20Improper%20Removal%20of%20Sensitive%20Information%20Before%20Storage%20or%20Transfer&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-613%3A%20Insufficient%20Session%20Expiration&color=brightgreen)
+
+### Description
+
+Bludit is a content management system. Versions prior to 3.22.0 have a vulnerability in the user management logic that allows deactivated accounts to maintain access via persistent authentication tokens. When an administrator disables a user account, the application fails to invalidate or clear the associated tokenAuth and tokenRemember fields in the JSON database. Consequently, any user with a pre-existing "Remember Me" cookie can bypass the account disablement and maintain a valid authenticated state. Version 3.22.0 patches the issue.
+
+### POC
+
+#### Reference
+- https://github.com/bludit/bludit/security/advisories/GHSA-ggqg-xvx6-hgwh
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2026/CVE-2026-46673.md b/2026/CVE-2026-46673.md
new file mode 100644
index 0000000000..f9463e663e
--- /dev/null
+++ b/2026/CVE-2026-46673.md
@@ -0,0 +1,17 @@
+### [CVE-2026-46673](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46673)
+![](https://img.shields.io/static/v1?label=Product&message=russh&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=%3C%200.60.3%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-770%3A%20Allocation%20of%20Resources%20Without%20Limits%20or%20Throttling&color=brightgreen)
+
+### Description
+
+Russh is a Rust SSH client & server library. Prior to version 0.60.3, CryptoVec used unchecked capacity growth, unchecked length arithmetic, and unsafe allocation/locking paths. In current russh releases, local SSH agent peers could still feed attacker-controlled frame lengths into buffer growth before validation. In older russh releases before 0.58.0, remote SSH traffic also reached CryptoVec through transport and compression buffers. This issue has been patched in version 0.60.3.
+
+### POC
+
+#### Reference
+- https://github.com/Eugeny/russh/security/advisories/GHSA-g9f8-wqj9-fjw5
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2026/CVE-2026-46689.md b/2026/CVE-2026-46689.md
new file mode 100644
index 0000000000..de62b12b3f
--- /dev/null
+++ b/2026/CVE-2026-46689.md
@@ -0,0 +1,19 @@
+### [CVE-2026-46689](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46689)
+![](https://img.shields.io/static/v1?label=Product&message=kanidm&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=%3C%201.9.3%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-248%3A%20Uncaught%20Exception&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-400%3A%20Uncontrolled%20Resource%20Consumption&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-674%3A%20Uncontrolled%20Recursion&color=brightgreen)
+
+### Description
+
+Kanidm is an identity management platform. Prior to version 1.9.3, a single unauthenticated GET to any /scim/v1/... endpoint with a ?filter= query string of a few thousand nested parentheses (≈ 4–12 KB) drives the recursive-descent PEG parser past the worker thread's stack guard page. Rust responds to stack overflow with std::process::abort() — the entire kanidmd process exits. The parse runs inside axum's Query<ScimEntryGetQuery> extractor, before any handler body and therefore before any ACL check. This issue has been patched in version 1.9.3.
+
+### POC
+
+#### Reference
+- https://github.com/kanidm/kanidm/security/advisories/GHSA-r5fr-9gmv-jggh
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2026/CVE-2026-46695.md b/2026/CVE-2026-46695.md
new file mode 100644
index 0000000000..92afeef7ac
--- /dev/null
+++ b/2026/CVE-2026-46695.md
@@ -0,0 +1,17 @@
+### [CVE-2026-46695](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46695)
+![](https://img.shields.io/static/v1?label=Product&message=boxlite&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=%3C%200.9.0%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-284%3A%20Improper%20Access%20Control&color=brightgreen)
+
+### Description
+
+Boxlite is a sandbox service that allows users to create lightweight virtual machines (Boxes) and launch OCI containers within them to run untrusted code. Prior to version 0.9.0, Boxlite does not restrict the kernel capabilities available inside the container, malicious code can remount the directory in rw mode, thereby gaining write access to that directory. This allows malicious code to perform arbitrary write operations on directories that should be read-only. This issue has been patched in version 0.9.0.
+
+### POC
+
+#### Reference
+- https://github.com/boxlite-ai/boxlite/security/advisories/GHSA-g6ww-w5j2-r7x3
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2026/CVE-2026-46697.md b/2026/CVE-2026-46697.md
new file mode 100644
index 0000000000..11c030b33b
--- /dev/null
+++ b/2026/CVE-2026-46697.md
@@ -0,0 +1,17 @@
+### [CVE-2026-46697](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46697)
+![](https://img.shields.io/static/v1?label=Product&message=fediverse-embeds-wordpress-plugin&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=%3C%201.5.8%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-918%3A%20Server-Side%20Request%20Forgery%20(SSRF)&color=brightgreen)
+
+### Description
+
+Fediverse Embeds embeds fediverse posts on WordPress sites. Prior to version 1.5.8, Fediverse Embeds registered an unauthenticated REST route ftf/media-proxy (includes/Media_Proxy.php) with permission_callback => __return_true that accepted a base64-encoded URL and forwarded it to wp_remote_get($url) without enforcing any allowlist. The plugin's source contained a comment block explicitly acknowledging that the request should be validated against allowed fediverse domains, but in 1.5.7 the validation only set a local $can_download_media flag that was never read. The full response body was echoed back to the caller, so this was a full-read SSRF / open proxy reachable by any anonymous visitor. This issue has been patched in version 1.5.8.
+
+### POC
+
+#### Reference
+- https://github.com/stefanbohacek/fediverse-embeds-wordpress-plugin/security/advisories/GHSA-mpq6-hjh3-m543
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2026/CVE-2026-4878.md b/2026/CVE-2026-4878.md
index 8e98f4da0d..982b4ec9bb 100644
--- a/2026/CVE-2026-4878.md
+++ b/2026/CVE-2026-4878.md
@@ -18,6 +18,7 @@
 ![](https://img.shields.io/static/v1?label=Product&message=Red%20Hat%20Enterprise%20Linux%209.6%20Extended%20Update%20Support&color=blue)
 ![](https://img.shields.io/static/v1?label=Product&message=Red%20Hat%20Hardened%20Images&color=blue)
 ![](https://img.shields.io/static/v1?label=Product&message=Red%20Hat%20Insights%20proxy%201.5&color=blue)
+![](https://img.shields.io/static/v1?label=Product&message=Red%20Hat%20OpenShift%20Container%20Platform%204&color=blue)
 ![](https://img.shields.io/static/v1?label=Product&message=Red%20Hat%20OpenShift%20Container%20Platform%204.13&color=blue)
 ![](https://img.shields.io/static/v1?label=Product&message=Red%20Hat%20OpenShift%20Container%20Platform%204.14&color=blue)
 ![](https://img.shields.io/static/v1?label=Product&message=Red%20Hat%20OpenShift%20Container%20Platform%204.15&color=blue)
diff --git a/2026/CVE-2026-51218.md b/2026/CVE-2026-51218.md
new file mode 100644
index 0000000000..0d285d702e
--- /dev/null
+++ b/2026/CVE-2026-51218.md
@@ -0,0 +1,17 @@
+### [CVE-2026-51218](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-51218)
+![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen)
+
+### Description
+
+A heap buffer overflow in the TS7Worker::PerformFunctionWrite() function (/core/s7_server.cpp) of snap7 v1.4.3 allows attackers to cause a Denial of Service (DoS) via a crafted packet.
+
+### POC
+
+#### Reference
+- https://github.com/davenardella/snap7/issues/14
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2026/CVE-2026-51219.md b/2026/CVE-2026-51219.md
new file mode 100644
index 0000000000..47172fbe7d
--- /dev/null
+++ b/2026/CVE-2026-51219.md
@@ -0,0 +1,17 @@
+### [CVE-2026-51219](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-51219)
+![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen)
+
+### Description
+
+A heap buffer overflow in the HighPriorityASDUQueue_hasUnconfirmedIMessages function of lib60870 v2.3.3 to v2.3.6 allows attackers to cause a Denial of Service (DoS) via a crafted payload.
+
+### POC
+
+#### Reference
+- https://github.com/mz-automation/lib60870/issues/196
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2026/CVE-2026-51221.md b/2026/CVE-2026-51221.md
new file mode 100644
index 0000000000..8c21c54e3a
--- /dev/null
+++ b/2026/CVE-2026-51221.md
@@ -0,0 +1,17 @@
+### [CVE-2026-51221](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-51221)
+![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen)
+
+### Description
+
+A buffer overflow in the Get_Attribute_List function of EIPStackGroup OpENer commit 76b95c allows attackers to cause a Denial of Service (DoS) via supplying a crafted Common Packet Format (CPF) packet.
+
+### POC
+
+#### Reference
+- https://github.com/EIPStackGroup/OpENer/issues/567
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2026/CVE-2026-51535.md b/2026/CVE-2026-51535.md
new file mode 100644
index 0000000000..6dec6fbd4d
--- /dev/null
+++ b/2026/CVE-2026-51535.md
@@ -0,0 +1,17 @@
+### [CVE-2026-51535](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-51535)
+![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen)
+
+### Description
+
+In OpENer 2.3.0 (commit 76b95cf), a resource exhaustion (Denial of Service) vulnerability exists in its network processing loop.
+
+### POC
+
+#### Reference
+- https://github.com/EIPStackGroup/OpENer/issues/562
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2026/CVE-2026-51536.md b/2026/CVE-2026-51536.md
new file mode 100644
index 0000000000..d9a4d721af
--- /dev/null
+++ b/2026/CVE-2026-51536.md
@@ -0,0 +1,17 @@
+### [CVE-2026-51536](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-51536)
+![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen)
+
+### Description
+
+In OpENer 2.3.0 (commit 76b95cf) when parsing incoming CIP (Common Industrial Protocol) network packets, the length parameter is inconsistently typed across the call stack. Specifically, an upstream length calculated as an int is passed to a downstream function that expects an EipInt16 (a 16-bit signed integer). If a maliciously crafted packet with specific length fields is processed, the length parameter can overflow or be truncated into a negative value. This negative length bypasses subsequent bounds checking (due to signed/unsigned comparison issues) and is ultimately used in memory operations, leading to a Stack Buffer Overflow when reading data in DecodePaddedEPath.
+
+### POC
+
+#### Reference
+- https://github.com/EIPStackGroup/OpENer/issues/563
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2026/CVE-2026-51537.md b/2026/CVE-2026-51537.md
new file mode 100644
index 0000000000..72b06653fd
--- /dev/null
+++ b/2026/CVE-2026-51537.md
@@ -0,0 +1,17 @@
+### [CVE-2026-51537](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-51537)
+![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen)
+
+### Description
+
+EIPStackGroup OpENer 2.3.0 (commit 76b95cf) has an out-of-bounds read issue in Connection Manager handling of ForwardOpen requests when processing short malformed packets. An attacker can send a valid ENIP outer frame carrying a malformed CIP ForwardOpen/LargeForwardOpen request, causing the parser to continue reading fields even when request data is insufficient. This issue is remotely triggerable via network traffic and does not require authentication.
+
+### POC
+
+#### Reference
+- https://github.com/EIPStackGroup/OpENer/issues/564
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2026/CVE-2026-51538.md b/2026/CVE-2026-51538.md
new file mode 100644
index 0000000000..367402a2ec
--- /dev/null
+++ b/2026/CVE-2026-51538.md
@@ -0,0 +1,17 @@
+### [CVE-2026-51538](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-51538)
+![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen)
+
+### Description
+
+EIPStackGroup OpENer 2.3.0 (commit 76b95cf) suffers from an Incorrect Access Control vulnerability in its handling of encapsulation sessions. When the server processes critical encapsulation commands, it verifies whether the provided session_handle exists in the global session list, but it fails to verify whether that handle belongs to the specific TCP connection issuing the request. Because there is no strong binding between a session handle and its originating socket, any attacker on the network can use a valid session handle created by another legitimate client to bypass access controls.
+
+### POC
+
+#### Reference
+- https://github.com/EIPStackGroup/OpENer/issues/565
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2026/CVE-2026-51539.md b/2026/CVE-2026-51539.md
new file mode 100644
index 0000000000..1efa8ac456
--- /dev/null
+++ b/2026/CVE-2026-51539.md
@@ -0,0 +1,17 @@
+### [CVE-2026-51539](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-51539)
+![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen)
+
+### Description
+
+A Denial of Service (DoS) vulnerability exists in the receive loop of libmodbus 3.1.12 when running on Windows. The issue stems from improper timeout management during network read operations.
+
+### POC
+
+#### Reference
+- https://github.com/stephane/libmodbus/issues/843
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2026/CVE-2026-51540.md b/2026/CVE-2026-51540.md
new file mode 100644
index 0000000000..6f26efe218
--- /dev/null
+++ b/2026/CVE-2026-51540.md
@@ -0,0 +1,17 @@
+### [CVE-2026-51540](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-51540)
+![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen)
+
+### Description
+
+OpENer 2.3.0 (master branch up to commit 76b95cf) is vulnerable to a severe memory corruption issue caused by an integer underflow in the processing of connected explicit messages (SendUnitData).
+
+### POC
+
+#### Reference
+- https://github.com/EIPStackGroup/OpENer/issues/568
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2026/CVE-2026-51541.md b/2026/CVE-2026-51541.md
new file mode 100644
index 0000000000..fa7b4360bb
--- /dev/null
+++ b/2026/CVE-2026-51541.md
@@ -0,0 +1,17 @@
+### [CVE-2026-51541](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-51541)
+![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen)
+
+### Description
+
+OpENer 2.3.0 (commit 76b95cf) has an out-of-bounds read issue in CIP message parsing when handling malformed explicit requests with a forged EPath size. An attacker can send a valid ENIP SendRRData frame carrying a very short CIP payload whose path_size field claims that many more path words are present than are actually available. Because the parser trusts the attacker-controlled path_size and continues decoding path segments without a remaining-length boundary, it reads beyond the end of the stack receive buffer.
+
+### POC
+
+#### Reference
+- https://github.com/EIPStackGroup/OpENer/issues/582
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2026/CVE-2026-51597.md b/2026/CVE-2026-51597.md
new file mode 100644
index 0000000000..595a55310e
--- /dev/null
+++ b/2026/CVE-2026-51597.md
@@ -0,0 +1,17 @@
+### [CVE-2026-51597](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-51597)
+![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen)
+
+### Description
+
+MERCURY MIPC252W IP camera v1.0.5 Build 230306 Rel.79931n does not implement nonce expiration in RTSP Digest authentication. An adjacent network attacker can capture a legitimate authentication exchange and replay the nonce and response values in a new connection to bypass authentication without knowledge of the device credentials, gaining unauthorized access to the live video stream.
+
+### POC
+
+#### Reference
+- https://github.com/kkkk2222874/cve_ID_report/blob/main/MERCURY_MIPC252W/MERCURY_MIPC252W_5th/README.md
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2026/CVE-2026-51598.md b/2026/CVE-2026-51598.md
new file mode 100644
index 0000000000..fa104d6441
--- /dev/null
+++ b/2026/CVE-2026-51598.md
@@ -0,0 +1,17 @@
+### [CVE-2026-51598](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-51598)
+![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen)
+
+### Description
+
+An input validation vulnerability in the RTSP service of MERCURY MIPC252W IP Camera v1.0.5 Build 230306 Rel.79931n) allows an unauthenticated, network-adjacent attacker to cause a denial of service via a crafted DESCRIBE request with a malformed URL in the request line.
+
+### POC
+
+#### Reference
+- https://github.com/kkkk2222874/cve_ID_report/blob/main/MERCURY_MIPC252W/MERCURY_MIPC252W_6th/README.md
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2026/CVE-2026-51599.md b/2026/CVE-2026-51599.md
new file mode 100644
index 0000000000..cc1e5fabb5
--- /dev/null
+++ b/2026/CVE-2026-51599.md
@@ -0,0 +1,17 @@
+### [CVE-2026-51599](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-51599)
+![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen)
+
+### Description
+
+An insufficient input validation vulnerability in the RTSP service of MERCURY MIPC252W v1.0.5 Build 230306 Rel.79931n allows an unauthenticated remote attacker to render an individual TCP connection temporarily unusable via sending an RTSP request with a Content-Length header but no corresponding message body. The affected RTSP parser enters a body-waiting state instead of rejecting the malformed request, causing all subsequent data on the connection to be silently consumed as body content until a server-side timeout closes the connection.
+
+### POC
+
+#### Reference
+- https://github.com/kkkk2222874/cve_ID_report/blob/main/MERCURY_MIPC252W/MERCURY_MIPC252W_7th/README.md
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2026/CVE-2026-51600.md b/2026/CVE-2026-51600.md
new file mode 100644
index 0000000000..e5288fe5e7
--- /dev/null
+++ b/2026/CVE-2026-51600.md
@@ -0,0 +1,17 @@
+### [CVE-2026-51600](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-51600)
+![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen)
+
+### Description
+
+Tenda CP3 V3.0 firmware V31.1.9.91 does not validate the Content-Length header field in RTSP requests (including DESCRIBE, SETUP, and PLAY methods). When a request carrying a Content-Length header is received without a corresponding message body, the RTSP parser enters a persistent body-awaiting state, causing the affected TCP connection to become permanently non-functional. The device does not actively close the connection, resulting in a TCP resource leak. This issue can be exploited by an unauthenticated remote attacker to cause a denial-of-service condition.
+
+### POC
+
+#### Reference
+- https://github.com/kkkk2222874/cve_ID_report/blob/main/Tenda_CP3_V3.0/Tenda_CP3_V3.0/Tenda_CP3_V3.0_1th/README.md
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2026/CVE-2026-51601.md b/2026/CVE-2026-51601.md
new file mode 100644
index 0000000000..1f4c1dd61b
--- /dev/null
+++ b/2026/CVE-2026-51601.md
@@ -0,0 +1,17 @@
+### [CVE-2026-51601](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-51601)
+![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen)
+
+### Description
+
+Tenda CP3 V3.0 firmware V31.1.9.91 contains a stack-based buffer overflow in the RTSP service. The device fails to validate the length of the clock= value in the Range header field when processing a PLAY request. An unauthenticated remote attacker who has completed a standard RTSP session handshake can send a PLAY request with an excessively long clock= value to cause the RTSP service to crash.
+
+### POC
+
+#### Reference
+- https://github.com/kkkk2222874/cve_ID_report/blob/main/Tenda_CP3_V3.0/Tenda_CP3_V3.0_2th/README.md
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2026/CVE-2026-51602.md b/2026/CVE-2026-51602.md
new file mode 100644
index 0000000000..f543163fb7
--- /dev/null
+++ b/2026/CVE-2026-51602.md
@@ -0,0 +1,17 @@
+### [CVE-2026-51602](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-51602)
+![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen)
+
+### Description
+
+A stack-based buffer overflow vulnerability in the RTSP service of Tenda CP3 V3.0 (firmware V31.1.9.91) allows an unauthenticated remote attacker to cause a denial of service via a crafted SETUP request. The RTSP service's second-stage URL routing parser fails to validate the length of the URL field in the first SETUP request. By supplying a URL consisting of exactly four consecutive repetitions of a valid RTSP URL, an attacker can bypass first-stage format validation and trigger a stack buffer overflow, causing an immediate crash of the RTSP service process and rendering the device inaccessible to all clients on the local network.
+
+### POC
+
+#### Reference
+- https://github.com/kkkk2222874/cve_ID_report/blob/main/Tenda_CP3_V3.0/Tenda_CP3_V3.0_3th/README.md
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2026/CVE-2026-51603.md b/2026/CVE-2026-51603.md
new file mode 100644
index 0000000000..9255b24404
--- /dev/null
+++ b/2026/CVE-2026-51603.md
@@ -0,0 +1,17 @@
+### [CVE-2026-51603](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-51603)
+![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen)
+
+### Description
+
+A stack-based buffer overflow vulnerability in the RTSP service of Tenda CP3 V3.0 (firmware V31.1.9.91) allows an unauthenticated remote attacker to cause a denial of service via a crafted second SETUP request. After completing the OPTIONS, DESCRIBE, and a legitimate first SETUP request to obtain a valid session ID, the RTSP service's second-stage URL routing parser fails to validate the length of the URL field in the subsequent SETUP request. By supplying a URL consisting of exactly four consecutive repetitions of a valid RTSP URL, an attacker can bypass first-stage format validation and trigger a stack buffer overflow, causing an immediate crash of the RTSP service process and rendering the device inaccessible to all clients on the local network.
+
+### POC
+
+#### Reference
+- https://github.com/kkkk2222874/cve_ID_report/blob/main/Tenda_CP3_V3.0/Tenda_CP3_V3.0_4th/README.md
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2026/CVE-2026-51604.md b/2026/CVE-2026-51604.md
new file mode 100644
index 0000000000..51f6572ddb
--- /dev/null
+++ b/2026/CVE-2026-51604.md
@@ -0,0 +1,17 @@
+### [CVE-2026-51604](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-51604)
+![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen)
+
+### Description
+
+A stack-based buffer overflow vulnerability in the RTSP service of Tenda CP3 V3.0 (firmware V31.1.9.91) allows an unauthenticated remote attacker to cause a denial of service via a crafted PLAY request.
+
+### POC
+
+#### Reference
+- https://github.com/kkkk2222874/cve_ID_report/blob/main/Tenda_CP3_V3.0/Tenda_CP3_V3.0_6th/README.md
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2026/CVE-2026-51605.md b/2026/CVE-2026-51605.md
new file mode 100644
index 0000000000..a753e6714e
--- /dev/null
+++ b/2026/CVE-2026-51605.md
@@ -0,0 +1,17 @@
+### [CVE-2026-51605](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-51605)
+![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen)
+
+### Description
+
+A stack-based buffer overflow vulnerability in the RTSP service of Tenda CP3 V3.0 (firmware V31.1.9.991) allows an unauthenticated remote attacker to cause a denial of service via a crafted TEARDOWN request.
+
+### POC
+
+#### Reference
+- https://github.com/kkkk2222874/cve_ID_report/blob/main/Tenda_CP3_V3.0/Tenda_CP3_V3.0_7th/README.md
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2026/CVE-2026-51606.md b/2026/CVE-2026-51606.md
new file mode 100644
index 0000000000..35fc24c799
--- /dev/null
+++ b/2026/CVE-2026-51606.md
@@ -0,0 +1,17 @@
+### [CVE-2026-51606](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-51606)
+![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen)
+
+### Description
+
+An improper input handling vulnerability in the RTSP service of Tenda CP3 V3.0 (firmware V31.1.9.91) causes the device to abruptly terminate the TCP connection with a RST packet when a request containing an oversized field value is received, without returning any RFC 2326-compliant error response. This behavior affects the request-line URL field and header field values across multiple RTSP request types.
+
+### POC
+
+#### Reference
+- https://github.com/kkkk2222874/cve_ID_report/blob/main/Tenda_CP3_V3.0/Tenda_CP3_V3.0_5th/README.md
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2026/CVE-2026-51821.md b/2026/CVE-2026-51821.md
new file mode 100644
index 0000000000..9cea5179df
--- /dev/null
+++ b/2026/CVE-2026-51821.md
@@ -0,0 +1,17 @@
+### [CVE-2026-51821](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-51821)
+![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen)
+
+### Description
+
+SQL Injection vulnerability in Shenzhou Shihan Video Conference System v.1.0 allows a remote attacker to execute arbitrary code via the /user/getUserLogin endpoint
+
+### POC
+
+#### Reference
+- https://github.com/sign9981/CVE/issues/2
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2026/CVE-2026-51937.md b/2026/CVE-2026-51937.md
new file mode 100644
index 0000000000..79c6ffbfe3
--- /dev/null
+++ b/2026/CVE-2026-51937.md
@@ -0,0 +1,18 @@
+### [CVE-2026-51937](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-51937)
+![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen)
+
+### Description
+
+An issue in Oneblog V2.3.9 allows a remote attacker to obtain sensitive information via the RestApiController.java, JsApiTicketComponent.java, and the GetAccessTokenComponent.java component
+
+### POC
+
+#### Reference
+- https://gist.github.com/Passwords404/2599df955cdb36b36b9551b5b7809114
+- https://github.com/zhangyd-c/OneBlog/issues/43
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2026/CVE-2026-52533.md b/2026/CVE-2026-52533.md
new file mode 100644
index 0000000000..8ed83aaed9
--- /dev/null
+++ b/2026/CVE-2026-52533.md
@@ -0,0 +1,17 @@
+### [CVE-2026-52533](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-52533)
+![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen)
+
+### Description
+
+An issue in D-Link DIR-1253 v.1.0.1.250923.142435 allows an attacker to escalate privileges via the etc/shadow component file
+
+### POC
+
+#### Reference
+- https://zuh.re/cve/2026-52533/
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2026/CVE-2026-58228.md b/2026/CVE-2026-58228.md
new file mode 100644
index 0000000000..f0f5a55fdf
--- /dev/null
+++ b/2026/CVE-2026-58228.md
@@ -0,0 +1,18 @@
+### [CVE-2026-58228](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-58228)
+![](https://img.shields.io/static/v1?label=Product&message=phoenix_live_view&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=1.2.2%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Version&message=4b63216ae68886db99cf7772af23372d76c40e7e%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-79%20Improper%20Neutralization%20of%20Input%20During%20Web%20Page%20Generation%20('Cross-site%20Scripting')&color=brightgreen)
+
+### Description
+
+Cross-site scripting vulnerability in phoenixframework phoenix_live_view allows an attacker to bypass URL scheme validation and execute JavaScript in a victim's browser session.The Phoenix.LiveView.Utils.valid_destination!/2 and Phoenix.LiveView.Utils.valid_live_navigation_destination!/2 functions in lib/phoenix_live_view/utils.ex rely on an internal uri_scheme/1 helper that only detects a scheme when the input's first byte is an ASCII letter. Inputs beginning with an ASCII control character or space fall through to a nil-returning clause, causing the URL to be treated as a safe relative path.Standard browsers implement the WHATWG URL parser, which strips leading C0 control and space characters before parsing. As a result, an input such as " javascript:alert(1)" is passed unchanged into <.link href={...}> and, when clicked, is parsed by the browser as a javascript: URL that executes attacker-controlled script in the victim's session.Applications that render user-supplied URLs (for example profile links, redirect targets, or external references) via <.link href={...}> are affected.This issue affects phoenix_live_view: from 1.2.2 before 1.2.7.
+
+### POC
+
+#### Reference
+- https://cna.erlef.org/cves/CVE-2026-58228.html
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2026/CVE-2026-58229.md b/2026/CVE-2026-58229.md
new file mode 100644
index 0000000000..2eae921a53
--- /dev/null
+++ b/2026/CVE-2026-58229.md
@@ -0,0 +1,18 @@
+### [CVE-2026-58229](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-58229)
+![](https://img.shields.io/static/v1?label=Product&message=mint&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=0.1.0%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Version&message=3e6de4bac4821b0eb4d6109e8b1f3fb6458792c8%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-770%20Allocation%20of%20Resources%20Without%20Limits%20or%20Throttling&color=brightgreen)
+
+### Description
+
+Allocation of resources without limits vulnerability in elixir-mint mint allows a remote HTTP server to exhaust memory on the client host and cause a denial of service.The Mint.HTTP1.decode_headers/5 and Mint.HTTP1.decode_trailer_headers/4 functions in lib/mint/http1.ex accumulate every parsed response header and chunked-trailer field into a per-request list that persists across incoming TCP segments as request.headers_buffer, and only clear it when the terminating blank line is received. The section has no cap on the number of headers or on total bytes, and the underlying :erlang.decode_packet(:httph_bin, binary, []) parser is invoked with an empty option list so its per-line and per-packet size limits also default to unlimited.A malicious HTTP server (reachable directly, via an attacker-controlled redirect, via SSRF, or via a man-in-the-middle) can stream complete header lines (or, after a chunked body, complete trailer lines) indefinitely without ever emitting the terminating blank line. The connection state grows without bound until the BEAM node is killed by the operating system's out-of-memory handler, taking down the entire application that uses Mint as an HTTP client.This issue affects mint: from 0.1.0 before 1.9.2.
+
+### POC
+
+#### Reference
+- https://cna.erlef.org/cves/CVE-2026-58229.html
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2026/CVE-2026-5892.md b/2026/CVE-2026-5892.md
new file mode 100644
index 0000000000..6f17b645bc
--- /dev/null
+++ b/2026/CVE-2026-5892.md
@@ -0,0 +1,17 @@
+### [CVE-2026-5892](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-5892)
+![](https://img.shields.io/static/v1?label=Product&message=Chrome&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=147.0.7727.55%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=Insufficient%20policy%20enforcement&color=brightgreen)
+
+### Description
+
+Insufficient policy enforcement in PWAs in Google Chrome prior to 147.0.7727.55 allowed a remote attacker who had compromised the renderer process to install a PWA without user consent via a crafted HTML page. (Chromium security severity: Medium)
+
+### POC
+
+#### Reference
+- https://issues.chromium.org/issues/487568011
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2026/CVE-2026-59246.md b/2026/CVE-2026-59246.md
new file mode 100644
index 0000000000..585e7f3fe1
--- /dev/null
+++ b/2026/CVE-2026-59246.md
@@ -0,0 +1,18 @@
+### [CVE-2026-59246](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-59246)
+![](https://img.shields.io/static/v1?label=Product&message=mint&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=0.1.0%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Version&message=596ca4304504be68939c4929e0831557097962b8%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-770%20Allocation%20of%20Resources%20Without%20Limits%20or%20Throttling&color=brightgreen)
+
+### Description
+
+Allocation of resources without limits vulnerability in elixir-mint mint allows a remote HTTP/2 server to exhaust memory on the client host and cause a denial of service.The Mint.HTTP2.handle_continuation/3 function in lib/mint/http2.ex accumulates the header-block fragment carried by each HTTP/2 CONTINUATION frame into a growing conn.headers_being_processed nesting, one level deeper per frame, and only releases it when a frame with the END_HEADERS flag arrives. The only guard on this accumulator is Mint.HTTP2.assert_header_block_within_max_size/2, which sums the byte size of the fragments received so far. Because a CONTINUATION frame is permitted by the protocol to carry a zero-length payload, an unbounded chain of zero-length CONTINUATION frames adds no bytes to the running total, never trips the size cap, and never emits END_HEADERS, yet each frame still nests the accumulator one level deeper.A malicious HTTP/2 server (reachable directly, via an attacker-controlled redirect, via SSRF, or via a man-in-the-middle) can open a stream by sending a HEADERS frame without END_HEADERS and then stream zero-length CONTINUATION frames indefinitely. Client memory grows one cons cell per frame received; sustained bandwidth from the peer drives the BEAM node running the Mint client to memory exhaustion and eventual out-of-memory termination.This issue affects mint: from 0.1.0 before 1.9.2.
+
+### POC
+
+#### Reference
+- https://cna.erlef.org/cves/CVE-2026-59246.html
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2026/CVE-2026-60121.md b/2026/CVE-2026-60121.md
new file mode 100644
index 0000000000..4718988ecb
--- /dev/null
+++ b/2026/CVE-2026-60121.md
@@ -0,0 +1,17 @@
+### [CVE-2026-60121](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-60121)
+![](https://img.shields.io/static/v1?label=Product&message=Flamingo&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=4.12.2%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=Improper%20Neutralization%20of%20Special%20Elements%20used%20in%20an%20OS%20Command%20('OS%20Command%20Injection')&color=brightgreen)
+
+### Description
+
+Vitec Flamingo 4.12.2 contains an unauthenticated OS command injection vulnerability in the admin/ajax/ping.php endpoint that allows remote attackers to execute arbitrary commands by exploiting a double-evaluation flaw in shell argument handling. The endpoint applies escapeshellarg() to the user-supplied host POST parameter before passing it to a system wrapper, but the wrapper retrieves the decoded value from argv and incorporates it into a second shell_exec() call without escaping, allowing injected commands to execute with root privileges via passwordless sudo.
+
+### POC
+
+#### Reference
+- https://damiri.fr/en/cve/CVE-2026-60121
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2026/CVE-2026-61343.md b/2026/CVE-2026-61343.md
new file mode 100644
index 0000000000..537f026bbe
--- /dev/null
+++ b/2026/CVE-2026-61343.md
@@ -0,0 +1,18 @@
+### [CVE-2026-61343](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-61343)
+![](https://img.shields.io/static/v1?label=Product&message=LibreBooking&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-23%20Relative%20Path%20Traversal&color=brightgreen)
+
+### Description
+
+LibreBooking's email template editor save action passes the submitted template name directly into the destination file path, allowing a remote attacker with administrator credentials to write an arbitrary file outside the template directory and execute code. Fixed in 5.1.0.
+
+### POC
+
+#### Reference
+- https://github.com/LibreBooking/librebooking/commit/cb9b7ad9da0243bd105809f6a4a8a6b9147c71ea
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2026/CVE-2026-61426.md b/2026/CVE-2026-61426.md
new file mode 100644
index 0000000000..9272beaa9a
--- /dev/null
+++ b/2026/CVE-2026-61426.md
@@ -0,0 +1,18 @@
+### [CVE-2026-61426](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-61426)
+![](https://img.shields.io/static/v1?label=Product&message=PraisonAI&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=Exposure%20of%20Sensitive%20Information%20to%20an%20Unauthorized%20Actor&color=brightgreen)
+
+### Description
+
+PraisonAI before 1.7.3 contains an insecure default configuration that binds to all interfaces with no API key requirement and wildcard CORS. Unauthenticated attackers can call GET /api/agents to read agent instructions and system prompts, or POST /api/chat to invoke agents without authentication.
+
+### POC
+
+#### Reference
+- https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-6wjp-v33h-5cvq
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2026/CVE-2026-61428.md b/2026/CVE-2026-61428.md
new file mode 100644
index 0000000000..7d9fe27c9b
--- /dev/null
+++ b/2026/CVE-2026-61428.md
@@ -0,0 +1,18 @@
+### [CVE-2026-61428](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-61428)
+![](https://img.shields.io/static/v1?label=Product&message=PraisonAI&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=Authentication%20Bypass%20by%20Spoofing&color=brightgreen)
+
+### Description
+
+PraisonAI AgentMail versions before 4.6.78 lack signature verification in webhook mode, allowing unauthenticated attackers to inject messages with spoofed sender addresses. Attackers can POST crafted message.received events to the webhook endpoint to inject arbitrary content into the agent and trigger replies to attacker-controlled addresses, bypassing sender allow/block lists.
+
+### POC
+
+#### Reference
+- https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-qj9c-59p6-8cgx
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2026/CVE-2026-61429.md b/2026/CVE-2026-61429.md
new file mode 100644
index 0000000000..ac00514690
--- /dev/null
+++ b/2026/CVE-2026-61429.md
@@ -0,0 +1,18 @@
+### [CVE-2026-61429](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-61429)
+![](https://img.shields.io/static/v1?label=Product&message=PraisonAI&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=Server-Side%20Request%20Forgery%20(SSRF)&color=brightgreen)
+
+### Description
+
+PraisonAI versions before 1.6.78 contain a server-side request forgery vulnerability in the Crawl4AI/Chromium backend that allows attackers to bypass SSRF validation by exploiting DNS rebinding and HTTP redirects. Attackers can craft URLs that resolve to internal services after the initial validation check, enabling the headless browser to follow redirects and read internal responses including sensitive canary values.
+
+### POC
+
+#### Reference
+- https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-6g59-gm2v-qhvq
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2026/CVE-2026-61431.md b/2026/CVE-2026-61431.md
new file mode 100644
index 0000000000..c01ae20e43
--- /dev/null
+++ b/2026/CVE-2026-61431.md
@@ -0,0 +1,18 @@
+### [CVE-2026-61431](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-61431)
+![](https://img.shields.io/static/v1?label=Product&message=PraisonAI&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=Improper%20Limitation%20of%20a%20Pathname%20to%20a%20Restricted%20Directory%20('Path%20Traversal')&color=brightgreen)
+
+### Description
+
+PraisonAI before 4.6.78 contains a path traversal vulnerability in ContextGatherer that fails to validate include paths in .praisoncontext and .praisoninclude files. Attackers can supply absolute paths or parent directory traversal sequences to read arbitrary files outside the workspace and include their contents in the generated context bundle.
+
+### POC
+
+#### Reference
+- https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-q7m5-3jmv-vm48
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2026/CVE-2026-61432.md b/2026/CVE-2026-61432.md
new file mode 100644
index 0000000000..0424c1ae25
--- /dev/null
+++ b/2026/CVE-2026-61432.md
@@ -0,0 +1,18 @@
+### [CVE-2026-61432](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-61432)
+![](https://img.shields.io/static/v1?label=Product&message=PraisonAI&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=Improper%20Limitation%20of%20a%20Pathname%20to%20a%20Restricted%20Directory%20('Path%20Traversal')&color=brightgreen)
+
+### Description
+
+PraisonAI (praisonaiagents) before 1.6.78 contains a path traversal vulnerability in the FastContext feature (praisonaiagents.context.fast). FastContextAgent.execute_tool() prepends the configured workspace_path only for relative paths and neither rejects absolute paths nor canonicalizes joined paths before enforcing workspace containment. As a result, tool arguments or model-generated function calls to grep_search, glob_search, read_file, or list_directory can supply absolute paths or '../' traversal sequences to read, search, and enumerate files outside the intended workspace directory, with file contents returned to the caller or injected into the model's tool-result context.
+
+### POC
+
+#### Reference
+- https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-4xxv-6wmf-xf45
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2026/CVE-2026-61434.md b/2026/CVE-2026-61434.md
new file mode 100644
index 0000000000..538c9a3034
--- /dev/null
+++ b/2026/CVE-2026-61434.md
@@ -0,0 +1,18 @@
+### [CVE-2026-61434](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-61434)
+![](https://img.shields.io/static/v1?label=Product&message=PraisonAI&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=Improper%20Neutralization%20of%20Special%20Elements%20used%20in%20an%20OS%20Command%20('OS%20Command%20Injection')&color=brightgreen)
+
+### Description
+
+PraisonAI versions before 4.6.78 contain an allowlist bypass vulnerability in shell command execution that allows attackers to execute restricted commands via find's built-in -exec, -execdir, and -delete actions. Attackers can craft find commands with these built-in actions to read blocked files, delete files, or execute non-allowlisted binaries without triggering shell metacharacter filters.
+
+### POC
+
+#### Reference
+- https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-cv3g-hj65-pcfh
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2026/CVE-2026-61437.md b/2026/CVE-2026-61437.md
new file mode 100644
index 0000000000..cab40f294a
--- /dev/null
+++ b/2026/CVE-2026-61437.md
@@ -0,0 +1,18 @@
+### [CVE-2026-61437](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-61437)
+![](https://img.shields.io/static/v1?label=Product&message=PraisonAI&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=Protection%20Mechanism%20Failure&color=brightgreen)
+
+### Description
+
+PraisonAI (pip package praisonaiagents) before 1.6.78 contains an unsafe dynamic module loading vulnerability in AgentFlow._resolve_pydantic_class (src/praisonai-agents/praisonaiagents/workflows/workflows.py). When a workflow step uses a string output_pydantic reference, the framework locates and imports a sibling tools.py from the workflow file's directory via importlib exec_module without sandboxing, ignoring the PRAISONAI_ALLOW_*_TOOLS environment variables. An attacker who controls a workflow file and its sibling tools.py can execute arbitrary Python code with the workflow runner's privileges when the workflow is executed via WorkflowManager or after load_yaml.
+
+### POC
+
+#### Reference
+- https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-4gfv-wg42-7jw5
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2026/CVE-2026-61439.md b/2026/CVE-2026-61439.md
new file mode 100644
index 0000000000..e1ded1d50d
--- /dev/null
+++ b/2026/CVE-2026-61439.md
@@ -0,0 +1,18 @@
+### [CVE-2026-61439](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-61439)
+![](https://img.shields.io/static/v1?label=Product&message=PraisonAI&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=Initialization%20of%20a%20Resource%20with%20an%20Insecure%20Default&color=brightgreen)
+
+### Description
+
+PraisonAI versions before 4.6.78 contain a prompt injection defense misconfiguration where the block threshold defaults to CRITICAL severity, allowing HIGH-level threats to pass through unblocked. Attackers can submit single-vector prompt injection attacks such as instruction overrides or financial manipulation that trigger HIGH severity detection but are logged without blocking, enabling system prompt extraction and unauthorized tool invocations.
+
+### POC
+
+#### Reference
+- https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-fj8f-m44g-c479
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2026/CVE-2026-61441.md b/2026/CVE-2026-61441.md
new file mode 100644
index 0000000000..36fd56f1b0
--- /dev/null
+++ b/2026/CVE-2026-61441.md
@@ -0,0 +1,18 @@
+### [CVE-2026-61441](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-61441)
+![](https://img.shields.io/static/v1?label=Product&message=PraisonAI&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=Missing%20Authorization&color=brightgreen)
+
+### Description
+
+PraisonAI Platform (praisonai-platform) before 0.1.9 improperly authorizes deletion of issue dependencies. The DELETE dependency route accepts either endpoint of a dependency edge and checks delete permission only against the caller-selected URL issue. A workspace member who cannot delete a dependency through an owner-created issue endpoint (which returns 403) can delete the same dependency edge by targeting a related member-owned issue endpoint, because permission is validated against the member-owned issue's owner. This allows members to bypass owner/admin authorization and remove owner-created issue dependencies.
+
+### POC
+
+#### Reference
+- https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-mxmx-rh57-jx58
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2026/CVE-2026-61442.md b/2026/CVE-2026-61442.md
new file mode 100644
index 0000000000..cb385379e7
--- /dev/null
+++ b/2026/CVE-2026-61442.md
@@ -0,0 +1,18 @@
+### [CVE-2026-61442](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-61442)
+![](https://img.shields.io/static/v1?label=Product&message=PraisonAI&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=Missing%20Authorization&color=brightgreen)
+
+### Description
+
+PraisonAI Platform (praisonai-platform) before 0.1.9 fails to enforce owner/admin authorization on the PATCH routes for projects, issues, and agents, which only require workspace-member role. A workspace member can modify owner-created records; for projects, a member can reassign lead_id to their own user id and then delete the owner-created project, bypassing the delete route's owner/admin permission check.
+
+### POC
+
+#### Reference
+- https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-c78w-2q4r-68r7
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2026/CVE-2026-61444.md b/2026/CVE-2026-61444.md
new file mode 100644
index 0000000000..8871662173
--- /dev/null
+++ b/2026/CVE-2026-61444.md
@@ -0,0 +1,18 @@
+### [CVE-2026-61444](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-61444)
+![](https://img.shields.io/static/v1?label=Product&message=PraisonAI&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=Improper%20Control%20of%20Generation%20of%20Code%20('Code%20Injection')&color=brightgreen)
+
+### Description
+
+PraisonAI versions before 4.6.78 contain a code injection vulnerability in deploy/api.py where the agents_file parameter is directly interpolated into an f-string without sanitization. Attackers can inject arbitrary Python code that executes when the generated server code runs via subprocess.Popen().
+
+### POC
+
+#### Reference
+- https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-g6j7-pffp-8whg
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2026/CVE-2026-61445.md b/2026/CVE-2026-61445.md
new file mode 100644
index 0000000000..49b8fef23c
--- /dev/null
+++ b/2026/CVE-2026-61445.md
@@ -0,0 +1,18 @@
+### [CVE-2026-61445](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-61445)
+![](https://img.shields.io/static/v1?label=Product&message=PraisonAI&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=Improper%20Limitation%20of%20a%20Pathname%20to%20a%20Restricted%20Directory%20('Path%20Traversal')&color=brightgreen)
+
+### Description
+
+PraisonAI before 4.6.78 contains arbitrary file write and command execution vulnerabilities in the AICoder component due to missing path validation and command sanitization in LLM tool calls. Attackers can inject malicious prompts through the chat interface to write files to arbitrary filesystem locations and execute arbitrary shell commands with root privileges.
+
+### POC
+
+#### Reference
+- https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-9mp3-24cc-77mg
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2026/CVE-2026-61447.md b/2026/CVE-2026-61447.md
new file mode 100644
index 0000000000..55585d9a5e
--- /dev/null
+++ b/2026/CVE-2026-61447.md
@@ -0,0 +1,18 @@
+### [CVE-2026-61447](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-61447)
+![](https://img.shields.io/static/v1?label=Product&message=PraisonAI&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=Improper%20Control%20of%20Generation%20of%20Code%20('Code%20Injection')&color=brightgreen)
+
+### Description
+
+PraisonAI before 1.6.78 contains a remote code execution vulnerability in CodeAgent._execute_python() that executes LLM-generated Python code without AST validation, import restrictions, or sandbox enforcement. Attackers can influence LLM output through prompt injection to exfiltrate all environment secrets and execute arbitrary code on the host system.
+
+### POC
+
+#### Reference
+- https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-2xv2-w8cq-5gxw
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2026/CVE-2026-61450.md b/2026/CVE-2026-61450.md
new file mode 100644
index 0000000000..29383e0f83
--- /dev/null
+++ b/2026/CVE-2026-61450.md
@@ -0,0 +1,18 @@
+### [CVE-2026-61450](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-61450)
+![](https://img.shields.io/static/v1?label=Product&message=grav&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=Improper%20Control%20of%20Generation%20of%20Code%20('Code%20Injection')&color=brightgreen)
+
+### Description
+
+Grav before 2.0.2 contains a Twig sandbox bypass that allows a page author (any admin.pages user, or anyone able to write to user/pages) to exfiltrate configuration secrets. Although the sandbox replaces the 'config' variable with a redacted facade and strips Config::get/toArray from the method allowlist, the raw container remains accessible via the allow-listed grav.offsetGet('config'), which returns the real Config object. Allow-listed object-dumping filters (json_encode, print_r, yaml_encode) then serialize that object at the PHP level without invoking the sandbox method gate, exposing the full config tree including plugin secrets such as SMTP credentials, API keys, and plugin DB credentials. This is an incomplete fix for GHSA-j274-39qw-32c9.
+
+### POC
+
+#### Reference
+- https://github.com/getgrav/grav/security/advisories/GHSA-mc5q-6hpj-rp7j
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2026/CVE-2026-61454.md b/2026/CVE-2026-61454.md
new file mode 100644
index 0000000000..1aaf64dcd4
--- /dev/null
+++ b/2026/CVE-2026-61454.md
@@ -0,0 +1,18 @@
+### [CVE-2026-61454](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-61454)
+![](https://img.shields.io/static/v1?label=Product&message=grav&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=Exposure%20of%20Sensitive%20Information%20to%20an%20Unauthorized%20Actor&color=brightgreen)
+
+### Description
+
+The Grav Admin2 plugin (getgrav/grav-plugin-admin2) before 2.0.4 embeds a global JavaScript variable window.__GRAV_CONFIG__ in the Admin2 SPA bootstrap page at /grav/admin (and its subroutes). This object is returned in every unauthenticated response and discloses the server URL, API prefix, admin base path, runtime environment type, and exact Grav and Admin2 version numbers, allowing an unauthenticated attacker to fingerprint the deployment and select version-specific exploits without reconnaissance.
+
+### POC
+
+#### Reference
+- https://github.com/getgrav/grav/security/advisories/GHSA-pfjq-chp8-3vgh
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2026/CVE-2026-61455.md b/2026/CVE-2026-61455.md
new file mode 100644
index 0000000000..851dc9a913
--- /dev/null
+++ b/2026/CVE-2026-61455.md
@@ -0,0 +1,18 @@
+### [CVE-2026-61455](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-61455)
+![](https://img.shields.io/static/v1?label=Product&message=grav&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=Improper%20Handling%20of%20Highly%20Compressed%20Data%20(Data%20Amplification)&color=brightgreen)
+
+### Description
+
+Grav before 2.0.1 contains a decompression bomb vulnerability in ZipArchiver::extract() that lacks limits on uncompressed size, file count, and nesting depth. Attackers can supply a crafted ZIP archive that expands to fill available disk space, causing denial of service by exhausting storage resources.
+
+### POC
+
+#### Reference
+- https://github.com/getgrav/grav/security/advisories/GHSA-928x-9mpw-8h56
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2026/CVE-2026-61456.md b/2026/CVE-2026-61456.md
new file mode 100644
index 0000000000..be288e5654
--- /dev/null
+++ b/2026/CVE-2026-61456.md
@@ -0,0 +1,18 @@
+### [CVE-2026-61456](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-61456)
+![](https://img.shields.io/static/v1?label=Product&message=grav&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=Improper%20Neutralization%20of%20Input%20During%20Web%20Page%20Generation%20('Cross-site%20Scripting')&color=brightgreen)
+
+### Description
+
+The Grav API plugin (getgrav/grav-plugin-api) before 1.0.3 fails to sanitize SVG files uploaded through the POST /api/v1/media endpoint. The HandlesMediaUploads::processUploadedFile() method validates only the file extension and never invokes Security::sanitizeSVG(), so an authenticated attacker with the api.media.write permission can upload an SVG containing arbitrary JavaScript. The file is stored unmodified and served with Content-Type: image/svg+xml; when an administrator opens it in a browser (directly or via <object>/<iframe>), the embedded script executes in their session context, enabling cookie theft and session hijacking.
+
+### POC
+
+#### Reference
+- https://github.com/getgrav/grav/security/advisories/GHSA-7vhm-8x52-2r5p
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2026/CVE-2026-61458.md b/2026/CVE-2026-61458.md
new file mode 100644
index 0000000000..a2ad0a43c8
--- /dev/null
+++ b/2026/CVE-2026-61458.md
@@ -0,0 +1,18 @@
+### [CVE-2026-61458](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-61458)
+![](https://img.shields.io/static/v1?label=Product&message=PasswordPusher&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=Improper%20Restriction%20of%20Excessive%20Authentication%20Attempts&color=brightgreen)
+
+### Description
+
+PasswordPusher before 2.9.2 contains a brute-force vulnerability in the POST /p/:token/access endpoint that lacks route-specific rate limiting and per-push lockout mechanisms. Attackers who know a push token can systematically guess passphrases at 120 attempts per minute without triggering any push-level defense, making short or dictionary-derived passphrases practically recoverable within hours or days.
+
+### POC
+
+#### Reference
+- https://github.com/pglombardo/PasswordPusher/security/advisories/GHSA-59w3-h5v2-c4xw
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2026/CVE-2026-61459.md b/2026/CVE-2026-61459.md
new file mode 100644
index 0000000000..d0b5f1669f
--- /dev/null
+++ b/2026/CVE-2026-61459.md
@@ -0,0 +1,19 @@
+### [CVE-2026-61459](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-61459)
+![](https://img.shields.io/static/v1?label=Product&message=mcp-server-kubernetes&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=Improper%20Neutralization%20of%20Argument%20Delimiters%20in%20a%20Command%20('Argument%20Injection')&color=brightgreen)
+
+### Description
+
+MCP Server Kubernetes before 3.9.0 contains an argument injection vulnerability in structured tools (kubectl_get, kubectl_describe, kubectl_delete) that allows attackers to bypass the assertNoDangerousFlags security check by supplying resourceType and name parameters with leading dashes. Attackers can inject the --server flag to redirect kubectl commands to an attacker-controlled API server, causing the operator's bearer token to be transmitted externally and enabling full cluster compromise.
+
+### POC
+
+#### Reference
+- https://github.com/Flux159/mcp-server-kubernetes/commit/d7890f50a4567bf5d9842541ba6f41e180227f9a
+- https://github.com/Flux159/mcp-server-kubernetes/issues/328
+- https://github.com/Flux159/mcp-server-kubernetes/pull/329
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2026/CVE-2026-61460.md b/2026/CVE-2026-61460.md
new file mode 100644
index 0000000000..bb758ba8a7
--- /dev/null
+++ b/2026/CVE-2026-61460.md
@@ -0,0 +1,17 @@
+### [CVE-2026-61460](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-61460)
+![](https://img.shields.io/static/v1?label=Product&message=laravel-crm&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=Authorization%20Bypass%20Through%20User-Controlled%20Key&color=brightgreen)
+
+### Description
+
+Krayin CRM through 2.2.3 contains an insecure direct object reference vulnerability in LeadController, PersonController, OrganizationController, QuoteController, and ActivityController that allows authenticated users to edit, update, or delete records owned by other users. Attackers can modify CRM records and reassign ownership by exploiting missing record-level ownership validation in edit, update, and destroy methods.
+
+### POC
+
+#### Reference
+- https://github.com/krayin/laravel-crm/issues/2559
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2026/CVE-2026-61461.md b/2026/CVE-2026-61461.md
new file mode 100644
index 0000000000..bfadf902a8
--- /dev/null
+++ b/2026/CVE-2026-61461.md
@@ -0,0 +1,17 @@
+### [CVE-2026-61461](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-61461)
+![](https://img.shields.io/static/v1?label=Product&message=dify&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=Improper%20Neutralization%20of%20Special%20Elements%20used%20in%20an%20SQL%20Command%20('SQL%20Injection')&color=brightgreen)
+
+### Description
+
+Dify before 1.16.0-rc1 contains a SQL injection vulnerability in the MyScale vector store backend that allows attackers to execute arbitrary SQL by supplying unsanitized search parameters to the search_by_full_text method without escaping or parameterization. Attackers can inject malicious SQL through the search parameters to read, modify, or delete data in the underlying ClickHouse database.
+
+### POC
+
+#### Reference
+- https://github.com/langgenius/dify/issues/38281
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2026/CVE-2026-61462.md b/2026/CVE-2026-61462.md
new file mode 100644
index 0000000000..8cafcda6b4
--- /dev/null
+++ b/2026/CVE-2026-61462.md
@@ -0,0 +1,17 @@
+### [CVE-2026-61462](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-61462)
+![](https://img.shields.io/static/v1?label=Product&message=mcp-gitlab&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=External%20Control%20of%20File%20Name%20or%20Path&color=brightgreen)
+
+### Description
+
+mcp-gitlab contains a path traversal vulnerability in the job_id parameter of build/index.js that allows attackers to redirect GitLab API requests to arbitrary endpoints. Attackers can supply crafted job_id values like ../../../user to escape the intended path prefix and access arbitrary GitLab API resources using the operator's personal access token.
+
+### POC
+
+#### Reference
+- https://github.com/zereight/gitlab-mcp/issues/587
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2026/CVE-2026-61463.md b/2026/CVE-2026-61463.md
new file mode 100644
index 0000000000..c909712bd9
--- /dev/null
+++ b/2026/CVE-2026-61463.md
@@ -0,0 +1,17 @@
+### [CVE-2026-61463](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-61463)
+![](https://img.shields.io/static/v1?label=Product&message=shiori&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=Improper%20Privilege%20Management&color=brightgreen)
+
+### Description
+
+Shiori contains a privilege escalation vulnerability in the account update endpoint that allows authenticated users to modify the owner field without authorization checks. Attackers can escalate to administrator by submitting a crafted PATCH request with owner: true, then re-authenticate to obtain an admin JWT token granting full system access.
+
+### POC
+
+#### Reference
+- https://github.com/go-shiori/shiori/issues/1196
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2026/CVE-2026-61498.md b/2026/CVE-2026-61498.md
new file mode 100644
index 0000000000..865e1f780e
--- /dev/null
+++ b/2026/CVE-2026-61498.md
@@ -0,0 +1,17 @@
+### [CVE-2026-61498](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-61498)
+![](https://img.shields.io/static/v1?label=Product&message=Flamingo&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=4.12.2%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=Improper%20Neutralization%20of%20Special%20Elements%20used%20in%20an%20OS%20Command%20('OS%20Command%20Injection')&color=brightgreen)
+
+### Description
+
+Vitec Flamingo 4.12.2 contains an unauthenticated OS command injection vulnerability in the admin/ajax/gen_graphs.php endpoint that allows remote unauthenticated attackers to execute arbitrary commands by supplying shell metacharacters in the start, end, key, or format HTTP GET parameters. Attackers can exploit the lack of input sanitization in the graph generation script, which passes user-supplied values directly to shell commands via passthru(), to execute arbitrary OS commands with root privileges due to the web server context having passwordless sudo access.
+
+### POC
+
+#### Reference
+- https://damiri.fr/en/cve/CVE-2026-61498
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2026/CVE-2026-61875.md b/2026/CVE-2026-61875.md
new file mode 100644
index 0000000000..3f7065fc6c
--- /dev/null
+++ b/2026/CVE-2026-61875.md
@@ -0,0 +1,17 @@
+### [CVE-2026-61875](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-61875)
+![](https://img.shields.io/static/v1?label=Product&message=luci&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=n%2Fa&color=blue)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=Improper%20Neutralization%20of%20Input%20During%20Web%20Page%20Generation%20('Cross-site%20Scripting')&color=brightgreen)
+
+### Description
+
+luci-app-upnp contains a stored cross-site scripting vulnerability that allows unauthenticated LAN clients to inject JavaScript via UPnP IGD AddPortMapping SOAP requests. Attackers can send malicious HTML in the NewPortMappingDescription field, which miniupnpd stores and luci-app-upnp renders without output encoding, executing the payload when administrators view the UPnP or Status pages.
+
+### POC
+
+#### Reference
+- https://github.com/openwrt/luci/security/advisories/GHSA-8v49-6387-7f89
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2026/CVE-2026-61876.md b/2026/CVE-2026-61876.md
new file mode 100644
index 0000000000..2295e7e409
--- /dev/null
+++ b/2026/CVE-2026-61876.md
@@ -0,0 +1,17 @@
+### [CVE-2026-61876](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-61876)
+![](https://img.shields.io/static/v1?label=Product&message=luci&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=n%2Fa&color=blue)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=Improper%20Neutralization%20of%20Input%20During%20Web%20Page%20Generation%20('Cross-site%20Scripting')&color=brightgreen)
+
+### Description
+
+LuCI versions fail to properly encode DHCPv6 lease hostnames before rendering in status tables, allowing adjacent network attackers to inject HTML markup. Attackers can send a DHCPv6 Client FQDN containing script tags that execute in the administrator's browser when viewing DHCP lease pages.
+
+### POC
+
+#### Reference
+- https://github.com/openwrt/luci/security/advisories/GHSA-686p-p8p9-x6fh
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2026/CVE-2026-7907.md b/2026/CVE-2026-7907.md
new file mode 100644
index 0000000000..24692bff01
--- /dev/null
+++ b/2026/CVE-2026-7907.md
@@ -0,0 +1,17 @@
+### [CVE-2026-7907](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-7907)
+![](https://img.shields.io/static/v1?label=Product&message=Chrome&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=148.0.7778.96%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=Use%20after%20free&color=brightgreen)
+
+### Description
+
+Use after free in DOM in Google Chrome prior to 148.0.7778.96 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
+
+### POC
+
+#### Reference
+- https://issues.chromium.org/issues/496292089
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2026/CVE-2026-7976.md b/2026/CVE-2026-7976.md
new file mode 100644
index 0000000000..3084811dc1
--- /dev/null
+++ b/2026/CVE-2026-7976.md
@@ -0,0 +1,17 @@
+### [CVE-2026-7976](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-7976)
+![](https://img.shields.io/static/v1?label=Product&message=Chrome&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=148.0.7778.96%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=Use%20after%20free&color=brightgreen)
+
+### Description
+
+Use after free in Views in Google Chrome prior to 148.0.7778.96 allowed an attacker who convinced a user to install a malicious extension to execute arbitrary code via a crafted Chrome Extension. (Chromium security severity: Medium)
+
+### POC
+
+#### Reference
+- https://issues.chromium.org/issues/497736679
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2026/CVE-2026-7985.md b/2026/CVE-2026-7985.md
new file mode 100644
index 0000000000..bf285cdcf0
--- /dev/null
+++ b/2026/CVE-2026-7985.md
@@ -0,0 +1,17 @@
+### [CVE-2026-7985](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-7985)
+![](https://img.shields.io/static/v1?label=Product&message=Chrome&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=148.0.7778.96%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=Use%20after%20free&color=brightgreen)
+
+### Description
+
+Use after free in GPU in Google Chrome prior to 148.0.7778.96 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)
+
+### POC
+
+#### Reference
+- https://issues.chromium.org/issues/498352423
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2026/CVE-2026-8001.md b/2026/CVE-2026-8001.md
new file mode 100644
index 0000000000..80bbea1ac5
--- /dev/null
+++ b/2026/CVE-2026-8001.md
@@ -0,0 +1,17 @@
+### [CVE-2026-8001](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-8001)
+![](https://img.shields.io/static/v1?label=Product&message=Chrome&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=148.0.7778.96%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=Use%20after%20free&color=brightgreen)
+
+### Description
+
+Use After Free in Printing in Google Chrome on Linux, Mac, ChromeOS prior to 148.0.7778.96 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Low)
+
+### POC
+
+#### Reference
+- https://issues.chromium.org/issues/494764371
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/2026/CVE-2026-8533.md b/2026/CVE-2026-8533.md
new file mode 100644
index 0000000000..975e7acbf3
--- /dev/null
+++ b/2026/CVE-2026-8533.md
@@ -0,0 +1,17 @@
+### [CVE-2026-8533](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-8533)
+![](https://img.shields.io/static/v1?label=Product&message=Chrome&color=blue)
+![](https://img.shields.io/static/v1?label=Version&message=148.0.7778.168%20&color=brightgreen)
+![](https://img.shields.io/static/v1?label=Vulnerability&message=Use%20after%20free&color=brightgreen)
+
+### Description
+
+Use after free in Accessibility in Google Chrome prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
+
+### POC
+
+#### Reference
+- https://issues.chromium.org/issues/495247950
+
+#### Github
+No PoCs found on GitHub currently.
+
diff --git a/references.txt b/references.txt
index e9b21b41d3..f5dd8e3510 100644
--- a/references.txt
+++ b/references.txt
@@ -23861,6 +23861,7 @@ CVE-2011-4151 - http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2011-006.txt
 CVE-2011-4153 - http://cxsecurity.com/research/103
 CVE-2011-4153 - http://www.exploit-db.com/exploits/18370/
 CVE-2011-4161 - http://isc.sans.org/diary/Hacking+HP+Printers+for+Fun+and+Profit/12112
+CVE-2011-4203 - http://tracker.moodle.org/browse/MDL-24808
 CVE-2011-4216 - http://www.kb.cert.org/vuls/id/275036
 CVE-2011-4217 - http://www.kb.cert.org/vuls/id/275036
 CVE-2011-4218 - http://www.kb.cert.org/vuls/id/275036
@@ -54744,6 +54745,9 @@ CVE-2017-6917 - https://github.com/bigtreecms/BigTree-CMS/files/843734/BigTree.-
 CVE-2017-6917 - https://github.com/bigtreecms/BigTree-CMS/issues/275
 CVE-2017-6918 - https://github.com/bigtreecms/BigTree-CMS/files/843734/BigTree.-.Multiple.Issue.of.CSRF.that.could.Illegally.Few.Data.Changes.v02.pdf
 CVE-2017-6918 - https://github.com/bigtreecms/BigTree-CMS/issues/275
+CVE-2017-6920 - https://www.drupal.org/forum/newsletters/security-advisories-for-drupal-core/2017-06-21/drupal-core-multiple
+CVE-2017-6921 - https://www.drupal.org/forum/newsletters/security-advisories-for-drupal-core/2017-06-21/drupal-core-multiple
+CVE-2017-6922 - https://www.drupal.org/forum/newsletters/security-advisories-for-drupal-core/2017-06-21/drupal-core-multiple
 CVE-2017-6950 - https://erpscan.io/advisories/erpscan-17-011-sap-gui-versions-remote-code-execution-bypass-security-policy/
 CVE-2017-6953 - https://www.exploit-db.com/exploits/41972/
 CVE-2017-6956 - https://googleprojectzero.blogspot.com/2017/04/over-air-exploiting-broadcoms-wi-fi_4.html
@@ -62475,9 +62479,13 @@ CVE-2018-25336 - https://www.exploit-db.com/exploits/44788
 CVE-2018-25337 - https://www.exploit-db.com/exploits/44789
 CVE-2018-25338 - https://www.exploit-db.com/exploits/44685
 CVE-2018-25339 - https://www.exploit-db.com/exploits/44685
+CVE-2018-25340 - https://github.com/smakosh/Smartshop/archive/master.zip
 CVE-2018-25340 - https://www.exploit-db.com/exploits/44823
+CVE-2018-25341 - https://github.com/smakosh/Smartshop/archive/master.zip
 CVE-2018-25341 - https://www.exploit-db.com/exploits/44823
+CVE-2018-25342 - https://github.com/smakosh/Smartshop/archive/master.zip
 CVE-2018-25342 - https://www.exploit-db.com/exploits/44823
+CVE-2018-25343 - https://github.com/smakosh/Smartshop/archive/master.zip
 CVE-2018-25343 - https://www.exploit-db.com/exploits/44824
 CVE-2018-25344 - https://www.exploit-db.com/exploits/44840
 CVE-2018-25345 - https://www.exploit-db.com/exploits/44841
@@ -79794,6 +79802,7 @@ CVE-2020-2589 - https://www.oracle.com/security-alerts/cpujan2020.html
 CVE-2020-25890 - https://vitor-santos.medium.com/xss-in-kyocera-printer-ecosys-m2640idw-cf6d3bc525e3
 CVE-2020-2590 - https://kc.mcafee.com/corporate/index?page=content&id=SB10315
 CVE-2020-2590 - https://www.oracle.com/security-alerts/cpujan2020.html
+CVE-2020-25900 - https://isopach.dev/CVE-2020-25900/
 CVE-2020-25901 - http://packetstormsecurity.com/files/160631/Spiceworks-7.5-HTTP-Header-Injection.html
 CVE-2020-25901 - https://frontend.spiceworks.com/topic/2309457-desktop-host-header-injection-vulnerability
 CVE-2020-25905 - https://packetstormsecurity.com/files/159132/Mobile-Shop-System-1.0-SQL-Injection.html
@@ -81750,6 +81759,7 @@ CVE-2020-35798 - https://kb.netgear.com/000062715/Security-Advisory-for-Pre-Auth
 CVE-2020-35799 - https://kb.netgear.com/000062709/Security-Advisory-for-Pre-Authentication-Stack-Overflow-on-Some-Routers-Range-Extenders-and-WiFi-Systems-PSV-2018-0296
 CVE-2020-35800 - https://kb.netgear.com/000062733/Security-Advisory-for-Security-Misconfiguration-on-Some-Routers-Range-Extenders-and-Orbi-WiFi-Systems-PSV-2020-0112
 CVE-2020-35801 - https://research.nccgroup.com/2021/03/08/technical-advisory-multiple-vulnerabilities-in-netgear-prosafe-plus-jgs516pe-gs116ev2-switches/
+CVE-2020-35803 - https://kb.netgear.com/000062732/Security-Advisory-for-Sensitive-Information-Disclosure-on-Some-Routers-PSV-2019-0110
 CVE-2020-35804 - https://kb.netgear.com/000062716/Security-Advisory-for-Sensitive-Information-Disclosure-on-Some-Routers-PSV-2019-0254
 CVE-2020-35805 - https://kb.netgear.com/000062670/Security-Advisory-for-Stored-Cross-Site-Scripting-on-Some-Routers-and-Orbi-WiFi-Systems-PSV-2018-0485
 CVE-2020-35806 - https://kb.netgear.com/000062729/Security-Advisory-for-Stored-Cross-Site-Scripting-on-Some-Routers-and-Orbi-WiFi-Systems-PSV-2018-0539
@@ -91803,6 +91813,7 @@ CVE-2021-38509 - https://bugzilla.mozilla.org/show_bug.cgi?id=1718571
 CVE-2021-38514 - https://kb.netgear.com/000063757/Security-Advisory-for-Authentication-Bypass-on-Some-Routers-Extenders-and-WiFi-Systems-PSV-2017-2449
 CVE-2021-38515 - https://kb.netgear.com/000063768/Security-Advisory-for-Denial-of-Service-on-Some-Routers-PSV-2019-0082
 CVE-2021-38516 - https://kb.netgear.com/000063780/Security-Advisory-for-Missing-Function-Level-Access-Control-on-Some-Routers-Gateways-and-WiFi-Systems-PSV-2020-0273
+CVE-2021-38517 - https://kb.netgear.com/000063772/Security-Advisory-for-Out-of-Bounds-Read-and-Write-on-Some-Routers-PSV-2019-0187
 CVE-2021-38519 - https://kb.netgear.com/000063762/Security-Advisory-for-Post-Authentication-Command-Injection-on-Some-Routers-PSV-2018-0564
 CVE-2021-38520 - https://kb.netgear.com/000063763/Security-Advisory-for-Post-Authentication-Command-Injection-on-Some-Routers-PSV-2018-0565
 CVE-2021-38522 - https://kb.netgear.com/000063767/Security-Advisory-for-Post-Authentication-Stack-Overflow-on-R6400-PSV-2019-0058
@@ -92679,6 +92690,7 @@ CVE-2021-41612 - https://seth.engr.tamu.edu/software-releases/thehuzz/
 CVE-2021-41613 - https://seth.engr.tamu.edu/software-releases/thehuzz/
 CVE-2021-41614 - https://seth.engr.tamu.edu/software-releases/thehuzz/
 CVE-2021-41615 - https://github.com/trenta3/goahead-versions/blob/master/2.1.8/230165webs218.tar.gz?raw=true
+CVE-2021-41617 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html
 CVE-2021-41617 - https://www.oracle.com/security-alerts/cpuapr2022.html
 CVE-2021-41617 - https://www.oracle.com/security-alerts/cpujul2022.html
 CVE-2021-41617 - https://www.tenable.com/plugins/nessus/154174
@@ -94067,6 +94079,7 @@ CVE-2021-4469 - https://www.exploit-db.com/exploits/50162
 CVE-2021-44692 - https://www.cygenta.co.uk/post/buddyboss
 CVE-2021-4472 - https://bugs.launchpad.net/horizon/+bug/1931558
 CVE-2021-44720 - https://kb.pulsesecure.net/?atype=sa
+CVE-2021-4473 - https://cn-sec.com/archives/4631959.html
 CVE-2021-44730 - http://www.openwall.com/lists/oss-security/2022/02/23/1
 CVE-2021-44731 - http://packetstormsecurity.com/files/170176/snap-confine-must_mkdir_and_open_with_perms-Race-Condition.html
 CVE-2021-44731 - http://www.openwall.com/lists/oss-security/2022/02/23/1
@@ -102071,7 +102084,9 @@ CVE-2022-36309 - https://github.com/metaredteam/external-disclosures/security/ad
 CVE-2022-36309 - https://helpdesk.airspan.com/browse/TRN3-1690
 CVE-2022-3631 - https://wpscan.com/vulnerability/13966b61-7e65-4493-8bd8-828d6d4441d5
 CVE-2022-36310 - https://github.com/metaredteam/external-disclosures/security/advisories/GHSA-whc6-2989-42xm
+CVE-2022-36310 - https://helpdesk.airspan.com/browse/TRN3-1689
 CVE-2022-36311 - https://helpdesk.airspan.com/browse/TRN3-1694
+CVE-2022-36312 - https://helpdesk.airspan.com/browse/TRN3-1695
 CVE-2022-36314 - https://www.mozilla.org/security/advisories/mfsa2022-28/
 CVE-2022-36315 - https://www.mozilla.org/security/advisories/mfsa2022-28/
 CVE-2022-36316 - https://www.mozilla.org/security/advisories/mfsa2022-28/
@@ -104005,6 +104020,7 @@ CVE-2022-42237 - https://github.com/draco1725/sqlinj/blob/main/poc
 CVE-2022-42238 - https://github.com/draco1725/localpriv/blob/main/poc
 CVE-2022-42245 - https://packetstormsecurity.com/files/171585/Dreamer-CMS-4.0.0-SQL-Injection.html
 CVE-2022-42246 - https://github.com/farliy-hacker/Doufoxcms/issues/1
+CVE-2022-42248 - https://github.com/Ozozuz/Qlik-View-Stored-XSS
 CVE-2022-42254 - https://nvidia.custhelp.com/app/answers/detail/a_id/5415
 CVE-2022-42255 - https://nvidia.custhelp.com/app/answers/detail/a_id/5415
 CVE-2022-42256 - https://nvidia.custhelp.com/app/answers/detail/a_id/5415
@@ -109591,6 +109607,7 @@ CVE-2023-28508 - https://www.rapid7.com/blog/post/2023/03/29/multiple-vulnerabil
 CVE-2023-28509 - https://www.rapid7.com/blog/post/2023/03/29/multiple-vulnerabilities-in-rocket-software-unirpc-server-fixed/
 CVE-2023-28528 - http://packetstormsecurity.com/files/172458/IBM-AIX-7.2-inscout-Privilege-Escalation.html
 CVE-2023-28528 - https://www.talosintelligence.com/vulnerability_reports/TALOS-2023-1691
+CVE-2023-28531 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html
 CVE-2023-28536 - https://patchstack.com/database/wordpress/plugin/branded-social-images/vulnerability/wordpress-branded-social-images-plugin-1-1-0-broken-access-control-vulnerability?_s_id=cve
 CVE-2023-2859 - https://huntr.dev/bounties/d7b8ea75-c74a-4721-89bb-12e5c80fb0ba
 CVE-2023-28596 - https://explore.zoom.us/en/trust/security/security-bulletin/
@@ -111817,6 +111834,7 @@ CVE-2023-3732 - http://packetstormsecurity.com/files/174223/Chrome-IPCZ-Fragment
 CVE-2023-37361 - https://www.trustwave.com/en-us/resources/security-resources/security-advisories/?fid=32305
 CVE-2023-37367 - https://semiconductor.samsung.com/support/quality-support/product-security-updates/
 CVE-2023-37368 - https://semiconductor.samsung.com/support/quality-support/product-security-updates/
+CVE-2023-37369 - https://bugreports.qt.io/browse/QTBUG-114829
 CVE-2023-37377 - https://semiconductor.samsung.com/support/quality-support/product-security-updates/
 CVE-2023-37416 - https://talosintelligence.com/vulnerability_reports/TALOS-2023-1804
 CVE-2023-37417 - https://talosintelligence.com/vulnerability_reports/TALOS-2023-1804
@@ -112131,9 +112149,11 @@ CVE-2023-38506 - https://github.com/laurent22/joplin/security/advisories/GHSA-m5
 CVE-2023-38507 - https://github.com/strapi/strapi/security/advisories/GHSA-24q2-59hm-rh9r
 CVE-2023-3853 - https://vuldb.com/?id.235205
 CVE-2023-38543 - https://northwave-cybersecurity.com/vulnerability-notice/denial-of-service-in-ivanti-secure-access-client-driver
+CVE-2023-38545 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html
 CVE-2023-38545 - https://github.com/UTsweetyfish/CVE-2023-38545
 CVE-2023-38545 - https://github.com/bcdannyboy/CVE-2023-38545
 CVE-2023-38545 - https://github.com/dbrugman/CVE-2023-38545-POC
+CVE-2023-38546 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html
 CVE-2023-38573 - https://talosintelligence.com/vulnerability_reports/TALOS-2023-1839
 CVE-2023-38573 - https://www.talosintelligence.com/vulnerability_reports/TALOS-2023-1839
 CVE-2023-38591 - https://www.netgear.com/about/security/
@@ -112208,6 +112228,7 @@ CVE-2023-38886 - https://akerva.com/wp-content/uploads/2023/09/AKERVA_Security-A
 CVE-2023-38888 - https://akerva.com/wp-content/uploads/2023/09/AKERVA_Security-Advisory_CVE-2023-38888_Dolibarr_XSS.pdf
 CVE-2023-3889 - https://developer.arm.com/Arm%20Security%20Center/Mali%20GPU%20Driver%20Vulnerabilities
 CVE-2023-38890 - https://github.com/akshadjoshi/CVE-2023-38890
+CVE-2023-38890 - https://tagmachan.com/online-shopping-portal-3-1-sql-injection-to-remote-code-execution-unauthenticated.tagox
 CVE-2023-38890 - https://www.exploit-db.com/exploits/50029
 CVE-2023-38891 - https://github.com/jselliott/CVE-2023-38891
 CVE-2023-3890 - https://vuldb.com/?id.235251
@@ -113513,6 +113534,7 @@ CVE-2023-44469 - https://security.lauritz-holtmann.de/post/sso-security-ssrf/
 CVE-2023-4448 - https://vuldb.com/?id.237569
 CVE-2023-44487 - https://blog.cloudflare.com/technical-breakdown-http2-rapid-reset-ddos-attack/
 CVE-2023-44487 - https://blog.cloudflare.com/zero-day-rapid-reset-http2-record-breaking-ddos-attack/
+CVE-2023-44487 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html
 CVE-2023-44487 - https://cloud.google.com/blog/products/identity-security/google-cloud-mitigated-largest-ddos-attack-peaking-above-398-million-rps/
 CVE-2023-44487 - https://cloud.google.com/blog/products/identity-security/how-it-works-the-novel-http2-rapid-reset-ddos-attack
 CVE-2023-44487 - https://github.com/Azure/AKS/issues/3947
@@ -113670,6 +113692,7 @@ CVE-2023-45235 - http://packetstormsecurity.com/files/176574/PixieFail-Proof-Of-
 CVE-2023-45249 - https://www.securityweek.com/acronis-product-vulnerability-exploited-in-the-wild/
 CVE-2023-45252 - https://www.xlent.no/aktuelt/security-disclosure-of-vulnerabilities-cve-2023-45252-and-cve-2023-45253/
 CVE-2023-45253 - https://www.xlent.no/aktuelt/security-disclosure-of-vulnerabilities-cve-2023-45252-and-cve-2023-45253/
+CVE-2023-4527 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html
 CVE-2023-45277 - https://www.linkedin.com/pulse/yamcs-vulnerability-assessment-visionspace-technologies
 CVE-2023-45278 - https://www.linkedin.com/pulse/yamcs-vulnerability-assessment-visionspace-technologies
 CVE-2023-45279 - https://www.linkedin.com/pulse/yamcs-vulnerability-assessment-visionspace-technologies
@@ -113860,6 +113883,8 @@ CVE-2023-46157 - https://www.cloudpanel.io/docs/v2/changelog/
 CVE-2023-46157 - https://www.mgt-commerce.com/docs/mgt-cloudpanel/dashboard
 CVE-2023-46183 - https://www.ibm.com/support/pages/node/7114982
 CVE-2023-4620 - https://wpscan.com/vulnerability/084e9494-2f9e-4420-9bf7-78a1a41433d7
+CVE-2023-46218 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html
+CVE-2023-46219 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html
 CVE-2023-4622 - http://packetstormsecurity.com/files/175963/Kernel-Live-Patch-Security-Notice-LSN-0099-1.html
 CVE-2023-4623 - http://packetstormsecurity.com/files/175963/Kernel-Live-Patch-Security-Notice-LSN-0099-1.html
 CVE-2023-4624 - https://huntr.dev/bounties/9ce5cef6-e546-44e7-addf-a2726fa4e60c
@@ -114244,6 +114269,7 @@ CVE-2023-48049 - https://github.com/luvsn/OdZoo/tree/main/exploits/website_searc
 CVE-2023-4805 - https://wpscan.com/vulnerability/1049e940-49b1-4236-bea2-c636f35c5647
 CVE-2023-48050 - https://github.com/luvsn/OdZoo/tree/main/exploits/odoo-biometric-attendance
 CVE-2023-48058 - https://github.com/CP1379767017/cms/blob/main/CSRF%20exists%20at%20the%20task%20management%20execution%20task%20location.md
+CVE-2023-4806 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html
 CVE-2023-48060 - https://github.com/CP1379767017/cms/blob/main/CSRF%20exists%20at%20the%20location%20where%20task%20management%20adds%20tasks.md
 CVE-2023-48063 - https://github.com/CP1379767017/cms/blob/dreamcms_vul/There%20is%20a%20CSRF%20vulnerability%20at%20th%20menu%20management%20location.md
 CVE-2023-48068 - https://github.com/CP1379767017/cms/blob/dreamcms_vul/dedevCMS/dedeCMS_XSS.md
@@ -114364,6 +114390,7 @@ CVE-2023-4878 - https://huntr.dev/bounties/655c4f77-04b2-4220-bfaf-a4d99fe86703
 CVE-2023-48780 - https://patchstack.com/database/vulnerability/wp-catalogue/wordpress-wp-catalogue-plugin-1-7-6-cross-site-scripting-xss-vulnerability?_s_id=cve
 CVE-2023-4879 - https://huntr.dev/bounties/7df6b167-3c39-4563-9b8a-33613e25cf27
 CVE-2023-48795 - http://packetstormsecurity.com/files/176280/Terrapin-SSH-Connection-Weakening.html
+CVE-2023-48795 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html
 CVE-2023-48795 - https://github.com/ronf/asyncssh/blob/develop/docs/changes.rst
 CVE-2023-48795 - https://groups.google.com/g/golang-announce/c/-n5WqVC18LQ
 CVE-2023-48795 - https://groups.google.com/g/golang-announce/c/qA3XtxvMUyg
@@ -114487,6 +114514,7 @@ CVE-2023-4911 - http://packetstormsecurity.com/files/174986/glibc-ld.so-Local-Pr
 CVE-2023-4911 - http://packetstormsecurity.com/files/176288/Glibc-Tunables-Privilege-Escalation.html
 CVE-2023-4911 - http://seclists.org/fulldisclosure/2023/Oct/11
 CVE-2023-4911 - http://www.openwall.com/lists/oss-security/2023/10/03/2
+CVE-2023-4911 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html
 CVE-2023-4911 - https://www.exploit-db.com/exploits/52479
 CVE-2023-4911 - https://www.qualys.com/2023/10/03/cve-2023-4911/looney-tunables-local-privilege-escalation-glibc-ld-so.txt
 CVE-2023-49110 - http://seclists.org/fulldisclosure/2024/Jun/3
@@ -115000,8 +115028,10 @@ CVE-2023-51277 - https://www.youtube.com/watch?v=c0nawqA_bdI
 CVE-2023-51281 - https://www.sourcecodester.com/php/14587/customer-support-system-using-phpmysqli-source-code.html
 CVE-2023-5133 - https://wpscan.com/vulnerability/36c30e54-75e4-4df1-b01a-60c51c0e76a3
 CVE-2023-5137 - https://wpscan.com/vulnerability/79b79e9c-ea4f-4188-a1b5-61dda0b5d434
+CVE-2023-51384 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html
 CVE-2023-51385 - http://www.openwall.com/lists/oss-security/2025/10/07/1
 CVE-2023-51385 - http://www.openwall.com/lists/oss-security/2025/10/12/1
+CVE-2023-51385 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html
 CVE-2023-51385 - https://vin01.github.io/piptagole/ssh/security/openssh/libssh/remote-code-execution/2023/12/20/openssh-proxycommand-libssh-rce.html
 CVE-2023-51387 - https://github.com/dromara/hertzbeat/security/advisories/GHSA-4576-m8px-w9qj
 CVE-2023-5139 - http://packetstormsecurity.com/files/175657/Zephyr-RTOS-3.x.0-Buffer-Overflows.html
@@ -115278,6 +115308,7 @@ CVE-2023-5286 - https://vuldb.com/?id.240914
 CVE-2023-5287 - https://vuldb.com/?id.240915
 CVE-2023-5289 - https://huntr.dev/bounties/8d0e0804-d3fd-49fe-bfa4-7a91135767ce
 CVE-2023-52922 - https://allelesecurity.com/use-after-free-vulnerability-in-can-bcm-subsystem-leading-to-information-disclosure-cve-2023-52922/
+CVE-2023-52927 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html
 CVE-2023-52927 - https://seadragnol.github.io/posts/CVE-2023-52927/
 CVE-2023-5294 - https://vuldb.com/?id.240925
 CVE-2023-5297 - https://vuldb.com/?id.240927
@@ -115327,6 +115358,7 @@ CVE-2023-5355 - https://wpscan.com/vulnerability/d6f7faca-dacf-4455-a837-0404803
 CVE-2023-5358 - https://devolutions.net/security/advisories/DEVO-2023-0019/
 CVE-2023-5360 - http://packetstormsecurity.com/files/175992/WordPress-Royal-Elementor-Addons-And-Templates-Remote-Shell-Upload.html
 CVE-2023-5360 - https://wpscan.com/vulnerability/281518ff-7816-4007-b712-63aed7828b34
+CVE-2023-5363 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html
 CVE-2023-53734 - https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/mayuri_k/2022/dawa-pharma-1.0-2022
 CVE-2023-53734 - https://www.exploit-db.com/exploits/51818
 CVE-2023-53734 - https://www.nu11secur1ty.com/
@@ -115907,6 +115939,7 @@ CVE-2023-6245 - https://internetcomputer.org/docs/current/references/candid-ref
 CVE-2023-6246 - http://packetstormsecurity.com/files/176931/glibc-qsort-Out-Of-Bounds-Read-Write.html
 CVE-2023-6246 - http://packetstormsecurity.com/files/176932/glibc-syslog-Heap-Based-Buffer-Overflow.html
 CVE-2023-6246 - http://seclists.org/fulldisclosure/2024/Feb/3
+CVE-2023-6246 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html
 CVE-2023-6246 - https://www.openwall.com/lists/oss-security/2024/01/30/6
 CVE-2023-6246 - https://www.qualys.com/2024/01/30/cve-2023-6246/syslog.txt
 CVE-2023-6250 - https://wpscan.com/vulnerability/6cad602b-7414-4867-8ae2-f0b846c4c8f0
@@ -116098,10 +116131,12 @@ CVE-2023-6775 - https://vuldb.com/?id.247911
 CVE-2023-6778 - https://huntr.com/bounties/5f3fffac-0358-48e6-a500-81bac13e0e2b
 CVE-2023-6779 - http://packetstormsecurity.com/files/176932/glibc-syslog-Heap-Based-Buffer-Overflow.html
 CVE-2023-6779 - http://seclists.org/fulldisclosure/2024/Feb/3
+CVE-2023-6779 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html
 CVE-2023-6779 - https://www.openwall.com/lists/oss-security/2024/01/30/6
 CVE-2023-6779 - https://www.qualys.com/2024/01/30/cve-2023-6246/syslog.txt
 CVE-2023-6780 - http://packetstormsecurity.com/files/176932/glibc-syslog-Heap-Based-Buffer-Overflow.html
 CVE-2023-6780 - http://seclists.org/fulldisclosure/2024/Feb/3
+CVE-2023-6780 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html
 CVE-2023-6780 - https://www.openwall.com/lists/oss-security/2024/01/30/6
 CVE-2023-6780 - https://www.qualys.com/2024/01/30/cve-2023-6246/syslog.txt
 CVE-2023-6783 - https://wpscan.com/vulnerability/5acd231b-4072-4ee1-9497-023465318608/
@@ -117367,6 +117402,7 @@ CVE-2024-12096 - https://wpscan.com/vulnerability/aff431fa-d984-40de-8a15-21f18d
 CVE-2024-12105 - https://www.talosintelligence.com/vulnerability_reports/TALOS-2024-2089
 CVE-2024-12109 - https://wpscan.com/vulnerability/2eca2f88-c843-4794-8cd9-46f17c92753a/
 CVE-2024-1212 - https://support.kemptechnologies.com/hc/en-us/articles/23878931058445-LoadMaster-Security-Vulnerability-CVE-2024-1212
+CVE-2024-12133 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html
 CVE-2024-12147 - https://github.com/upload000/Hub/blob/main/IOT/Netgear_R6900.md
 CVE-2024-12148 - https://devolutions.net/security/advisories/DEVO-2024-0017
 CVE-2024-12149 - https://devolutions.net/security/advisories/DEVO-2024-0017
@@ -117411,6 +117447,7 @@ CVE-2024-12234 - https://1000projects.org/
 CVE-2024-12234 - https://github.com/Hacker0xone/CVE/issues/17
 CVE-2024-12234 - https://vuldb.com/?submit.456519
 CVE-2024-12235 - https://github.com/sweatxi/rce/blob/main/AgileBPM_vertical_overreach.md
+CVE-2024-12243 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html
 CVE-2024-12244 - https://gitlab.com/gitlab-org/gitlab/-/issues/508046
 CVE-2024-12245 - https://www.blackduck.com/blog/cyrc-advisory-logicaldoc.html
 CVE-2024-12247 - https://mattermost.com/security-updates
@@ -119296,6 +119333,7 @@ CVE-2024-24830 - https://github.com/openobserve/openobserve/security/advisories/
 CVE-2024-2485 - https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/AC18/SetSpeedWan.md
 CVE-2024-2485 - https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/AC18/setUsbUnload.md
 CVE-2024-2485 - https://vuldb.com/?id.256892
+CVE-2024-24855 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html
 CVE-2024-24857 - https://cert-portal.siemens.com/productcert/html/ssa-265688.html
 CVE-2024-24858 - https://cert-portal.siemens.com/productcert/html/ssa-265688.html
 CVE-2024-24859 - https://cert-portal.siemens.com/productcert/html/ssa-265688.html
@@ -119737,6 +119775,7 @@ CVE-2024-26557 - https://github.com/Hebing123/cve/issues/18
 CVE-2024-26559 - https://syst1m.cn/2024/01/22/U%E9%AA%8C%E8%AF%81%E7%BD%91%E7%BB%9C%E7%94%A8%E6%88%B7%E7%AE%A1%E7%90%86%E7%B3%BB%E7%BB%9F_%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6%E8%AF%BB%E5%8F%96%E6%BC%8F%E6%B4%9E/
 CVE-2024-26577 - https://github.com/guusec/VSeeDoS
 CVE-2024-26593 - https://git.kernel.org/stable/c/491528935c9c48bf341d8b40eabc6c4fc5df6f2c
+CVE-2024-26596 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html
 CVE-2024-26629 - https://cert-portal.siemens.com/productcert/html/ssa-265688.html
 CVE-2024-26631 - https://git.kernel.org/stable/c/380540bb06bb1d1b12bdc947d1b8f56cda6b5663
 CVE-2024-26633 - https://git.kernel.org/stable/c/d375b98e0248980681e5e56b712026174d617198
@@ -120152,6 +120191,7 @@ CVE-2024-2807 - https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/AC
 CVE-2024-2808 - https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/AC15/V1.0%20V15.03.20_multi/formQuickIndex.md
 CVE-2024-28085 - http://seclists.org/fulldisclosure/2024/Mar/35
 CVE-2024-28085 - http://www.openwall.com/lists/oss-security/2024/03/27/5
+CVE-2024-28085 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html
 CVE-2024-28085 - https://people.rit.edu/sjf5462/6831711781/wall_2_27_2024.txt
 CVE-2024-28085 - https://www.openwall.com/lists/oss-security/2024/03/27/5
 CVE-2024-28088 - https://github.com/PinkDraconian/PoC-Langchain-RCE/blob/main/README.md
@@ -120547,6 +120587,7 @@ CVE-2024-29513 - https://github.com/dru1d-foofus/briscKernelDriver
 CVE-2024-29514 - https://github.com/zzq66/cve6/
 CVE-2024-29515 - https://github.com/zzq66/cve7/
 CVE-2024-2954 - https://blog.sth.sh/wordpress-action-network-1-4-3-authenticated-sql-injection-0-day-01fcd6e89e96
+CVE-2024-2961 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html
 CVE-2024-2961 - https://www.ambionics.io/blog/iconv-cve-2024-2961-p1
 CVE-2024-2961 - https://www.ambionics.io/blog/iconv-cve-2024-2961-p2
 CVE-2024-2961 - https://www.ambionics.io/blog/iconv-cve-2024-2961-p3
@@ -121296,6 +121337,10 @@ CVE-2024-33528 - https://insinuator.net/2024/05/security-advisory-achieving-php-
 CVE-2024-33529 - https://insinuator.net/2024/05/security-advisory-achieving-php-code-execution-in-ilias-elearning-lms-before-v7-30-v8-11-v9-1/
 CVE-2024-33530 - https://insinuator.net/2024/05/vulnerability-in-jitsi-meet-meeting-password-disclosure-affecting-meetings-with-lobbies/
 CVE-2024-3358 - https://vuldb.com/?id.259462
+CVE-2024-33599 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html
+CVE-2024-33600 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html
+CVE-2024-33601 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html
+CVE-2024-33602 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html
 CVE-2024-33605 - http://seclists.org/fulldisclosure/2024/Jul/0
 CVE-2024-33605 - https://jvn.jp/en/vu/JVNVU93051062/
 CVE-2024-33605 - https://pierrekim.github.io/blog/2024-06-27-sharp-mfp-17-vulnerabilities.html
@@ -121487,6 +121532,7 @@ CVE-2024-34393 - https://github.com/marudor/libxmljs2/issues/204
 CVE-2024-34393 - https://research.jfrog.com/vulnerabilities/libxmljs2-attrs-type-confusion-rce-jfsa-2024-001034097/
 CVE-2024-34394 - https://github.com/marudor/libxmljs2/issues/205
 CVE-2024-34394 - https://research.jfrog.com/vulnerabilities/libxmljs2-namespaces-type-confusion-rce-jfsa-2024-001034098/
+CVE-2024-34397 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html
 CVE-2024-34397 - https://cert-portal.siemens.com/productcert/html/ssa-613116.html
 CVE-2024-34397 - https://gitlab.gnome.org/GNOME/glib/-/issues/3268
 CVE-2024-34398 - https://www.gruppotim.it/it/footer/red-team.html
@@ -122197,6 +122243,8 @@ CVE-2024-37361 - https://support.pentaho.com/hc/en-us/articles/34299135441805--R
 CVE-2024-37362 - https://support.pentaho.com/hc/en-us/articles/34296552220941--Resolved-Hitachi-Vantara-Pentaho-Data-Integration-Analytics-Insufficiently-Protected-Credentials-Versions-before-10-2-0-0-and-9-3-0-8-including-8-3-x-Impacted-CVE-2024-37362
 CVE-2024-37363 - https://support.pentaho.com/hc/en-us/articles/34296230504589--Resolved-Hitachi-Vantara-Pentaho-Business-Analytics-Server-Incorrect-Authorization-Versions-before-10-2-0-0-and-9-3-0-8-including-8-3-x-Impacted-CVE-2024-37363
 CVE-2024-3737 - https://vuldb.com/?id.260576
+CVE-2024-37370 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html
+CVE-2024-37371 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html
 CVE-2024-37382 - https://www.abinitio.com/en/security-advisories/ab-2024-003/
 CVE-2024-37386 - https://advisories.stormshield.eu/2024-017
 CVE-2024-37393 - https://www.optistream.io/blogs/tech/securenvoy-cve-2024-37393
@@ -123953,8 +124001,11 @@ CVE-2024-4548 - https://www.tenable.com/security/research/tra-2024-13
 CVE-2024-45489 - https://kibty.town/blog/arc/
 CVE-2024-45489 - https://news.ycombinator.com/item?id=41597250
 CVE-2024-4549 - https://www.tenable.com/security/research/tra-2024-13
+CVE-2024-45490 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html
 CVE-2024-45490 - https://cert-portal.siemens.com/productcert/html/ssa-613116.html
+CVE-2024-45491 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html
 CVE-2024-45491 - https://cert-portal.siemens.com/productcert/html/ssa-613116.html
+CVE-2024-45492 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html
 CVE-2024-45492 - https://cert-portal.siemens.com/productcert/html/ssa-613116.html
 CVE-2024-45508 - https://github.com/michaelrsweet/htmldoc/issues/528
 CVE-2024-45519 - https://blog.projectdiscovery.io/zimbra-remote-code-execution/
@@ -124835,6 +124886,7 @@ CVE-2024-5017 - https://www.talosintelligence.com/vulnerability_reports/TALOS-20
 CVE-2024-50188 - https://cert-portal.siemens.com/productcert/html/ssa-265688.html
 CVE-2024-50205 - https://cert-portal.siemens.com/productcert/html/ssa-265688.html
 CVE-2024-50210 - https://cert-portal.siemens.com/productcert/html/ssa-265688.html
+CVE-2024-50246 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html
 CVE-2024-50251 - https://cert-portal.siemens.com/productcert/html/ssa-265688.html
 CVE-2024-50251 - https://github.com/slavin-ayu/CVE-2024-50251-PoC
 CVE-2024-5026 - https://wpscan.com/vulnerability/a86584f6-119b-45c3-bc6e-dc18e3501db7/
@@ -125310,6 +125362,7 @@ CVE-2024-5310 - https://vuldb.com/?id.266121
 CVE-2024-53101 - https://cert-portal.siemens.com/productcert/html/ssa-265688.html
 CVE-2024-53124 - https://cert-portal.siemens.com/productcert/html/ssa-265688.html
 CVE-2024-53150 - https://git.kernel.org/stable/c/45a92cbc88e4013bfed7fd2ccab3ade45f8e896b
+CVE-2024-53166 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html
 CVE-2024-53171 - https://git.kernel.org/stable/c/4d9807048b851d7a58d5bd089c16254af896e4df
 CVE-2024-5318 - https://gitlab.com/gitlab-org/gitlab/-/issues/427526
 CVE-2024-53255 - https://github.com/BoidCMS/BoidCMS/security/advisories/GHSA-7q7m-cgw8-px4r
@@ -126082,6 +126135,7 @@ CVE-2024-57901 - https://cert-portal.siemens.com/productcert/html/ssa-265688.htm
 CVE-2024-57902 - https://cert-portal.siemens.com/productcert/html/ssa-265688.html
 CVE-2024-57913 - https://cert-portal.siemens.com/productcert/html/ssa-265688.html
 CVE-2024-5792 - https://favethemes.zendesk.com/hc/en-us/articles/360041639432-Changelog
+CVE-2024-57924 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html
 CVE-2024-57929 - https://cert-portal.siemens.com/productcert/html/ssa-265688.html
 CVE-2024-5793 - https://favethemes.zendesk.com/hc/en-us/articles/360041639432-Changelog
 CVE-2024-57940 - https://cert-portal.siemens.com/productcert/html/ssa-265688.html
@@ -126089,11 +126143,14 @@ CVE-2024-57948 - https://cert-portal.siemens.com/productcert/html/ssa-265688.htm
 CVE-2024-57951 - https://cert-portal.siemens.com/productcert/html/ssa-265688.html
 CVE-2024-57965 - https://github.com/axios/axios/issues/6351
 CVE-2024-57971 - https://github.com/darumaseye/CVEs/blob/ec2de9f7ecffde466e687745bfdfc672e86241d7/CVE-2024-57971.md
+CVE-2024-57977 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html
 CVE-2024-57977 - https://cert-portal.siemens.com/productcert/html/ssa-265688.html
 CVE-2024-57979 - https://cert-portal.siemens.com/productcert/html/ssa-265688.html
 CVE-2024-57981 - https://cert-portal.siemens.com/productcert/html/ssa-265688.html
 CVE-2024-57986 - https://cert-portal.siemens.com/productcert/html/ssa-265688.html
 CVE-2024-5799 - https://wpscan.com/vulnerability/3ee3023a-541c-40e6-8d62-24b4b110633c/
+CVE-2024-57996 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html
+CVE-2024-58005 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html
 CVE-2024-58005 - https://cert-portal.siemens.com/productcert/html/ssa-265688.html
 CVE-2024-58009 - https://cert-portal.siemens.com/productcert/html/ssa-265688.html
 CVE-2024-58014 - https://cert-portal.siemens.com/productcert/html/ssa-265688.html
@@ -126273,6 +126330,7 @@ CVE-2024-6114 - https://github.com/wangyuan-ui/CVE/issues/4
 CVE-2024-6115 - https://github.com/wangyuan-ui/CVE/issues/5
 CVE-2024-6116 - https://github.com/wangyuan-ui/CVE/issues/6
 CVE-2024-6116 - https://vuldb.com/?id.268868
+CVE-2024-6119 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html
 CVE-2024-6119 - https://cert-portal.siemens.com/productcert/html/ssa-613116.html
 CVE-2024-6127 - https://aceresponder.com/blog/exploiting-empire-c2-framework
 CVE-2024-6127 - https://github.com/ACE-Responder/Empire-C2-RCE-PoC
@@ -126367,6 +126425,7 @@ CVE-2024-6387 - http://seclists.org/fulldisclosure/2024/Jul/19
 CVE-2024-6387 - http://www.openwall.com/lists/oss-security/2024/07/03/5
 CVE-2024-6387 - http://www.openwall.com/lists/oss-security/2024/07/28/2
 CVE-2024-6387 - https://blog.qualys.com/vulnerabilities-threat-research/2024/07/01/regresshion-remote-unauthenticated-code-execution-vulnerability-in-openssh-server
+CVE-2024-6387 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html
 CVE-2024-6387 - https://github.com/zgzhang/cve-2024-6387-poc
 CVE-2024-6387 - https://news.ycombinator.com/item?id=40843778
 CVE-2024-6387 - https://santandersecurityresearch.github.io/blog/sshing_the_masses.html
@@ -126616,6 +126675,7 @@ CVE-2024-6960 - https://research.jfrog.com/vulnerabilities/h2o-model-deserializa
 CVE-2024-6961 - https://research.jfrog.com/vulnerabilities/guardrails-rail-xxe-jfsa-2024-001035519/
 CVE-2024-6962 - https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/O3V2.0/formQosSet.md
 CVE-2024-6963 - https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/O3V2.0/formexeCommand.md
+CVE-2024-6963 - https://vuldb.com/?ctiid.272117
 CVE-2024-6963 - https://vuldb.com/?id.272117
 CVE-2024-6964 - https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/O3V2.0/fromDhcpSetSer.md
 CVE-2024-6964 - https://vuldb.com/?id.272118
@@ -128732,6 +128792,8 @@ CVE-2025-11078 - https://github.com/fengbenjianmo/CVE/issues/1
 CVE-2025-11079 - https://github.com/unicorn33355/cve/issues/1
 CVE-2025-11080 - https://github.com/xkalami-Tta0/CVE/blob/main/wisdom-education/%E6%B0%B4%E5%B9%B3%E8%B6%8A%E6%9D%83.md
 CVE-2025-11080 - https://github.com/xkalami-Tta0/CVE/blob/main/wisdom-education/%E6%B0%B4%E5%B9%B3%E8%B6%8A%E6%9D%83.md#vulnerability-reproduction
+CVE-2025-11082 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html
+CVE-2025-11083 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html
 CVE-2025-11088 - https://github.com/yihaofuweng/cve/issues/35
 CVE-2025-11089 - https://github.com/evilthan9/cve/issues/2
 CVE-2025-11090 - https://github.com/friendddy/cve/issues/1
@@ -128922,6 +128984,9 @@ CVE-2025-11408 - https://github.com/DavCloudz/cve/issues/5
 CVE-2025-11408 - https://vuldb.com/?id.327345
 CVE-2025-11409 - https://github.com/hbesljx/vul/issues/2
 CVE-2025-11410 - https://github.com/hbesljx/vul/issues/3
+CVE-2025-11412 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html
+CVE-2025-11413 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html
+CVE-2025-11414 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html
 CVE-2025-11415 - https://github.com/f000x0/cve/issues/3
 CVE-2025-11415 - https://vuldb.com/?submit.665594
 CVE-2025-11416 - https://github.com/f000x0/cve/issues/4
@@ -129001,7 +129066,9 @@ CVE-2025-11490 - https://github.com/wonderwhy-er/DesktopCommanderMCP/issues/218#
 CVE-2025-11490 - https://github.com/wonderwhy-er/DesktopCommanderMCP/issues/218#issuecomment-3214135034
 CVE-2025-11491 - https://github.com/wonderwhy-er/DesktopCommanderMCP/issues/217
 CVE-2025-11491 - https://github.com/wonderwhy-er/DesktopCommanderMCP/issues/217#issue-3343853704
+CVE-2025-11494 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html
 CVE-2025-11494 - https://vuldb.com/?id.327619
+CVE-2025-11495 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html
 CVE-2025-11503 - https://github.com/f000x0/cve/issues/9
 CVE-2025-11505 - https://github.com/f000x0/cve/issues/10
 CVE-2025-11506 - https://github.com/f000x0/cve/issues/11
@@ -129133,7 +129200,9 @@ CVE-2025-1182 - https://sourceware.org/bugzilla/attachment.cgi?id=15919
 CVE-2025-1182 - https://vuldb.com/?ctiid.295086
 CVE-2025-1182 - https://vuldb.com/?id.295086
 CVE-2025-11820 - https://gist.github.com/webber-naut/3c26ce96cc18d3b8387edb8482653bc3
+CVE-2025-11839 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html
 CVE-2025-1184 - https://github.com/janssensjelle/published-pocs/blob/main/pihome_sqli_ajax.md
+CVE-2025-11840 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html
 CVE-2025-11842 - https://github.com/asust9/smidge-vuln?tab=readme-ov-file
 CVE-2025-11849 - https://gist.github.com/AudunWA/4d690d9ae5efdafe7cf71d9c2ee90a10
 CVE-2025-11849 - https://security.snyk.io/vuln/SNYK-DOTNET-MAMMOTH-13561968
@@ -130517,6 +130586,7 @@ CVE-2025-15615 - https://github.com/wazuh/wazuh/security/advisories/GHSA-rr83-v9
 CVE-2025-15616 - https://github.com/wazuh/wazuh/security/advisories/GHSA-522v-p59v-58gm
 CVE-2025-15617 - https://github.com/wazuh/wazuh/security/advisories/GHSA-6xqr-4q5g-xc7x
 CVE-2025-15632 - https://github.com/AnalogyC0de/public_exp/issues/28
+CVE-2025-15665 - https://wpscan.com/vulnerability/754f0960-efc8-426f-bb1d-7cceec920910/
 CVE-2025-15666 - https://github.com/assimp/assimp/issues/6079
 CVE-2025-15668 - https://github.com/gpac/gpac/issues/3398
 CVE-2025-1568 - https://issuetracker.google.com/issues/374279912
@@ -130665,6 +130735,7 @@ CVE-2025-1834 - https://github.com/caigo8/CVE-md/blob/main/zz/zz_resolve%E6%8E%A
 CVE-2025-1835 - https://github.com/sheratan4/cve/issues/1
 CVE-2025-1840 - https://github.com/Rain1er/report/blob/main/CDG/dXBkYXRlb3JnLmpzcA%3D%3D.md
 CVE-2025-1840 - https://vuldb.com/?id.298106
+CVE-2025-1840 - https://vuldb.com/?submit.504384
 CVE-2025-1841 - https://github.com/Rain1er/report/blob/main/CDG/Q2xpZW50U29ydExvZy5qc3A%3D.md
 CVE-2025-1844 - https://github.com/666lail/report/blob/main/tmp/1.md
 CVE-2025-1845 - https://github.com/666lail/report/blob/main/tmp/2.md
@@ -131064,30 +131135,43 @@ CVE-2025-21692 - https://git.kernel.org/stable/c/d62b04fca4340a0d468d7853bd66e51
 CVE-2025-21692 - https://git.kernel.org/stable/c/f4168299e553f17aa2ba4016e77a9c38da40eb1d
 CVE-2025-21692 - https://git.kernel.org/stable/c/f6b0f05fbfa4044f890e8a348288c0d9a20bd1d0
 CVE-2025-21694 - https://cert-portal.siemens.com/productcert/html/ssa-265688.html
+CVE-2025-21701 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html
+CVE-2025-21702 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html
 CVE-2025-21704 - https://cert-portal.siemens.com/productcert/html/ssa-265688.html
 CVE-2025-21711 - https://cert-portal.siemens.com/productcert/html/ssa-265688.html
+CVE-2025-21712 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html
 CVE-2025-21719 - https://cert-portal.siemens.com/productcert/html/ssa-265688.html
+CVE-2025-21724 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html
 CVE-2025-21726 - https://cert-portal.siemens.com/productcert/html/ssa-265688.html
 CVE-2025-21727 - https://cert-portal.siemens.com/productcert/html/ssa-265688.html
+CVE-2025-21728 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html
 CVE-2025-21728 - https://cert-portal.siemens.com/productcert/html/ssa-265688.html
 CVE-2025-2173 - https://vuldb.com/?id.299202
 CVE-2025-21735 - https://cert-portal.siemens.com/productcert/html/ssa-265688.html
 CVE-2025-21742 - https://git.kernel.org/stable/c/86586dcb75cb8fd062a518aca8ee667938b91efb
 CVE-2025-21744 - https://cert-portal.siemens.com/productcert/html/ssa-265688.html
+CVE-2025-21745 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html
 CVE-2025-21745 - https://cert-portal.siemens.com/productcert/html/ssa-265688.html
 CVE-2025-21753 - https://cert-portal.siemens.com/productcert/html/ssa-265688.html
+CVE-2025-21756 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html
 CVE-2025-21756 - https://cert-portal.siemens.com/productcert/html/ssa-265688.html
+CVE-2025-21758 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html
 CVE-2025-21760 - https://cert-portal.siemens.com/productcert/html/ssa-265688.html
 CVE-2025-21761 - https://cert-portal.siemens.com/productcert/html/ssa-265688.html
 CVE-2025-21762 - https://cert-portal.siemens.com/productcert/html/ssa-265688.html
 CVE-2025-21763 - https://cert-portal.siemens.com/productcert/html/ssa-265688.html
 CVE-2025-21764 - https://cert-portal.siemens.com/productcert/html/ssa-265688.html
+CVE-2025-21765 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html
 CVE-2025-21765 - https://cert-portal.siemens.com/productcert/html/ssa-265688.html
+CVE-2025-21766 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html
+CVE-2025-21767 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html
 CVE-2025-2177 - https://vuldb.com/?id.299206
 CVE-2025-21772 - https://cert-portal.siemens.com/productcert/html/ssa-265688.html
 CVE-2025-21776 - https://cert-portal.siemens.com/productcert/html/ssa-265688.html
 CVE-2025-21787 - https://cert-portal.siemens.com/productcert/html/ssa-265688.html
+CVE-2025-21795 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html
 CVE-2025-21795 - https://cert-portal.siemens.com/productcert/html/ssa-265688.html
+CVE-2025-21796 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html
 CVE-2025-21796 - https://cert-portal.siemens.com/productcert/html/ssa-265688.html
 CVE-2025-21806 - https://cert-portal.siemens.com/productcert/html/ssa-265688.html
 CVE-2025-21814 - https://cert-portal.siemens.com/productcert/html/ssa-265688.html
@@ -131095,9 +131179,13 @@ CVE-2025-21826 - https://cert-portal.siemens.com/productcert/html/ssa-265688.htm
 CVE-2025-21835 - https://cert-portal.siemens.com/productcert/html/ssa-265688.html
 CVE-2025-21844 - https://cert-portal.siemens.com/productcert/html/ssa-265688.html
 CVE-2025-21846 - https://cert-portal.siemens.com/productcert/html/ssa-265688.html
+CVE-2025-21848 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html
 CVE-2025-21858 - https://cert-portal.siemens.com/productcert/html/ssa-265688.html
 CVE-2025-21859 - https://cert-portal.siemens.com/productcert/html/ssa-265688.html
+CVE-2025-21862 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html
 CVE-2025-21862 - https://cert-portal.siemens.com/productcert/html/ssa-265688.html
+CVE-2025-21864 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html
+CVE-2025-21865 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html
 CVE-2025-21865 - https://cert-portal.siemens.com/productcert/html/ssa-265688.html
 CVE-2025-21876 - https://git.kernel.org/stable/c/4117c72938493a77ab53cc4b8284be8fb6ec8065
 CVE-2025-2203 - https://wpscan.com/vulnerability/d553cff4-074a-44e7-aebe-e61c86ab8042/
@@ -131903,6 +131991,7 @@ CVE-2025-2644 - https://vuldb.com/?id.300659
 CVE-2025-2646 - https://github.com/liuhao2638/cve/issues/9
 CVE-2025-26465 - http://seclists.org/fulldisclosure/2025/Feb/18
 CVE-2025-26465 - https://bugzilla.suse.com/show_bug.cgi?id=1237040
+CVE-2025-26465 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html
 CVE-2025-26465 - https://seclists.org/oss-sec/2025/q1/144
 CVE-2025-26465 - https://www.openwall.com/lists/oss-security/2025/02/18/1
 CVE-2025-26465 - https://www.theregister.com/2025/02/18/openssh_vulnerabilities_mitm_dos/
@@ -132441,6 +132530,8 @@ CVE-2025-29306 - https://github.com/somatrasss/CVE-2025-29306
 CVE-2025-29312 - https://gist.github.com/Saber-Berserker/4e54c2aa70abab2b133ce2c2b7e91249
 CVE-2025-29314 - https://blog.csdn.net/weixin_43959580/article/details/146018166
 CVE-2025-29322 - https://github.com/simalamuel/Research/tree/main/CVE-2025-29322
+CVE-2025-29329 - https://github.com/SilverS3c/Sagemcom-fast-3686-ippprint
+CVE-2025-29338 - https://github.com/masjadaan/CVE-2025-29338
 CVE-2025-29364 - https://github.com/Giles-one/spimsimulatorEscape?tab=readme-ov-file#bug2-bypass-check-in-read_syscall-and-write_syscall-leading-to-out-of-bounds-readwrite
 CVE-2025-29365 - https://github.com/Giles-one/spimsimulatorEscape?tab=readme-ov-file#bug1-out-of-bounds-write-in-read_input-function
 CVE-2025-29366 - https://github.com/Giles-one/mupen64plusEscape/tree/main/BUG1
@@ -132751,6 +132842,7 @@ CVE-2025-30761 - https://www.oracle.com/security-alerts/cpujul2025.html
 CVE-2025-30762 - https://www.oracle.com/security-alerts/cpujul2025.html
 CVE-2025-3096 - https://www.sourcecodester.com/php-clinics-patient-management-system-source-code
 CVE-2025-3111 - https://gitlab.com/gitlab-org/gitlab/-/issues/533313
+CVE-2025-31115 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html
 CVE-2025-31116 - https://github.com/MobSF/Mobile-Security-Framework-MobSF/security/advisories/GHSA-fcfq-m8p6-gw56
 CVE-2025-31117 - https://github.com/openemr/openemr/security/advisories/GHSA-2pvv-ph3x-2f9h
 CVE-2025-31118 - https://github.com/NamelessMC/Nameless/security/advisories/GHSA-jhvp-mwj4-922m
@@ -132864,6 +132956,7 @@ CVE-2025-3196 - https://github.com/assimp/assimp/issues/6069
 CVE-2025-3196 - https://github.com/assimp/assimp/issues/6069#issuecomment-2763273425
 CVE-2025-3197 - https://gist.github.com/miguelafmonteiro/d8f66af61d14e06338b688f90c4dfa7c
 CVE-2025-3197 - https://security.snyk.io/vuln/SNYK-JS-EXPANDOBJECT-5821390
+CVE-2025-3198 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html
 CVE-2025-3198 - https://cert-portal.siemens.com/productcert/html/ssa-265688.html
 CVE-2025-3199 - https://github.com/Tr0e/CVE_Hunter/blob/main/ruoyi-ai/ruoyi-ai_UnauthorizedAccess_01.md
 CVE-2025-3199 - https://github.com/ageerle/ruoyi-ai/issues/43
@@ -133053,6 +133146,8 @@ CVE-2025-32978 - https://seclists.org/fulldisclosure/2025/Jun/25
 CVE-2025-32978 - https://seralys.com/research/CVE-2025-32978.txt
 CVE-2025-3298 - https://github.com/foreverfeifei/cve/blob/main/user.md
 CVE-2025-3298 - https://www.sourcecodester.com/
+CVE-2025-32988 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html
+CVE-2025-32989 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html
 CVE-2025-3299 - https://github.com/LaneyYu/cve/issues/1
 CVE-2025-32993 - https://nav1n.medium.com/sql-injection-in-vision-helpdesk-tools-a83dfc27f3ab
 CVE-2025-32997 - https://github.com/chimurai/http-proxy-middleware/pull/1096
@@ -133313,10 +133408,13 @@ CVE-2025-34158 - https://github.com/lufinkey/vulnerability-research/blob/main/CV
 CVE-2025-34158 - https://www.bleepingcomputer.com/news/security/plex-warns-users-to-patch-security-vulnerability-immediately/
 CVE-2025-34158 - https://www.vulncheck.com/advisories/plex-media-server-unspecified
 CVE-2025-34159 - https://github.com/Eyodav/CVE-2025-34159
+CVE-2025-34160 - https://cn-sec.com/archives/4320091.html
 CVE-2025-34160 - https://stack.chaitin.com/vuldb/detail/b4640952-9be9-4bfa-9d7f-a0be72b35e18
 CVE-2025-34160 - https://www.vulncheck.com/advisories/anyshare-serviceagent-api-unauthenticated-rce
+CVE-2025-34162 - https://cn-sec.com/archives/4160402.html
 CVE-2025-34162 - https://github.com/wooluo/nuclei-templates-2025hw/blob/main/bianque-medical-sql-injection.yaml
 CVE-2025-34162 - https://www.vulncheck.com/advisories/bian-que-feiju-intelligent-emergency-and-quality-control-system-sqli
+CVE-2025-34163 - https://cn-sec.com/archives/4243708.html
 CVE-2025-34163 - https://www.vulncheck.com/advisories/dongsheng-logisitics-software-unauth-arbitrary-file-upload
 CVE-2025-34164 - https://www.vulncheck.com/advisories/netsupport-client-manager-buffer-overflows
 CVE-2025-34165 - https://www.vulncheck.com/advisories/netsupport-client-manager-buffer-overflows
@@ -133613,22 +133711,39 @@ CVE-2025-37899 - https://news.ycombinator.com/item?id=44081338
 CVE-2025-37947 - https://github.com/doyensec/KSMBD-CVE-2025-37947/blob/main/CVE-2025-37947.c
 CVE-2025-3800 - https://vuldb.com/?id.305653
 CVE-2025-3801 - https://github.com/yaowenxiao721/Poc/blob/main/One-API/One-API-poc.md
+CVE-2025-38058 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html
+CVE-2025-38063 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html
+CVE-2025-38067 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html
+CVE-2025-38071 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html
+CVE-2025-38079 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html
 CVE-2025-3808 - https://github.com/caigo8/CVE-md/blob/main/My-bbs/CSRF.md
 CVE-2025-3808 - https://vuldb.com/?id.305662
+CVE-2025-38083 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html
 CVE-2025-38089 - http://www.openwall.com/lists/oss-security/2025/07/02/2
 CVE-2025-38089 - https://github.com/keymaker-arch/NFSundown
 CVE-2025-38089 - https://www.openwall.com/lists/oss-security/2025/07/02/2
+CVE-2025-38100 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html
+CVE-2025-38111 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html
+CVE-2025-38124 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html
+CVE-2025-38167 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html
 CVE-2025-3817 - https://github.com/88hsb88/cve/blob/main/sql.md
 CVE-2025-3817 - https://www.sourcecodester.com/
 CVE-2025-3819 - https://github.com/wcndy13/cve/issues/1
 CVE-2025-3819 - https://vuldb.com/?id.305725
+CVE-2025-38198 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html
 CVE-2025-3821 - https://github.com/yaklang/IRifyScanResult/blob/main/Web-based%20Pharmacy%20Product%20Management%20System/xss_from_input_with_post.md
 CVE-2025-3821 - https://www.sourcecodester.com/
+CVE-2025-38212 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html
+CVE-2025-38214 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html
+CVE-2025-38215 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html
 CVE-2025-3822 - https://github.com/yaklang/IRifyScanResult/blob/main/Web-based%20Pharmacy%20Product%20Management%20System/xss_from_input_with_post.md
 CVE-2025-3822 - https://www.sourcecodester.com/
+CVE-2025-38222 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html
 CVE-2025-3823 - https://github.com/yaklang/IRifyScanResult/blob/main/Web-based%20Pharmacy%20Product%20Management%20System/xss_from_input_with_post.md
 CVE-2025-3823 - https://vuldb.com/?id.305730
 CVE-2025-3823 - https://www.sourcecodester.com/
+CVE-2025-38231 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html
+CVE-2025-38236 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html
 CVE-2025-3824 - https://github.com/yaklang/IRifyScanResult/blob/main/Web-based%20Pharmacy%20Product%20Management%20System/xss_from_input_with_post.md
 CVE-2025-3824 - https://www.sourcecodester.com/
 CVE-2025-3825 - https://github.com/yaklang/IRifyScanResult/blob/main/Web-based%20Pharmacy%20Product%20Management%20System/xss_from_input_with_post.md
@@ -133637,16 +133752,44 @@ CVE-2025-3826 - https://github.com/yaklang/IRifyScanResult/blob/main/Web-based%2
 CVE-2025-3826 - https://www.sourcecodester.com/
 CVE-2025-3827 - https://github.com/NuoNuo-L/cve/issues/1
 CVE-2025-3828 - https://github.com/NuoNuo-L/cve/issues/2
+CVE-2025-38280 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html
+CVE-2025-38285 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html
 CVE-2025-3829 - https://github.com/NuoNuo-L/cve/issues/3
+CVE-2025-38312 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html
+CVE-2025-38342 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html
+CVE-2025-38350 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html
 CVE-2025-38352 - https://github.com/farazsth98/chronomaly
+CVE-2025-38364 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html
+CVE-2025-38393 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html
+CVE-2025-38400 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html
 CVE-2025-3843 - https://github.com/caigo8/CVE-md/blob/main/DS-Java/CSRF.md
+CVE-2025-38430 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html
 CVE-2025-3845 - https://magnificent-dill-351.notion.site/Arbitrary-Memory-Writing-in-WebServer-1-0-1d1c693918ed80889711ebd44f7f9a31
+CVE-2025-38451 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html
+CVE-2025-38457 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html
 CVE-2025-3846 - https://magnificent-dill-351.notion.site/SQL-Injection-of-Login-in-WebServer-1-0-1d1c693918ed800b847bcc28bd691b7c
 CVE-2025-3846 - https://magnificent-dill-351.notion.site/SQL-Injection-of-Register-in-WebServer-1-0-1d1c693918ed80b69a0bfcd9b685de46
+CVE-2025-38465 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html
+CVE-2025-38466 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html
+CVE-2025-38468 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html
 CVE-2025-3847 - https://magnificent-dill-351.notion.site/SQL-Injection-of-Login-in-WebServer-1-0-1d1c693918ed800b847bcc28bd691b7c
+CVE-2025-38470 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html
+CVE-2025-38471 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html
+CVE-2025-38477 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html
+CVE-2025-38498 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html
+CVE-2025-38499 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html
 CVE-2025-38501 - http://www.openwall.com/lists/oss-security/2025/09/15/2
 CVE-2025-38501 - https://github.com/keymaker-arch/KSMBDrain
 CVE-2025-3854 - https://github.com/CH13hh/tmp_store_cc/blob/main/H3C%20GR-3000AX/1.md
+CVE-2025-38614 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html
+CVE-2025-38685 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html
+CVE-2025-38691 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html
+CVE-2025-38701 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html
+CVE-2025-38702 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html
+CVE-2025-38708 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html
+CVE-2025-38721 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html
+CVE-2025-38724 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html
+CVE-2025-38727 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html
 CVE-2025-3886 - https://support.catonetworks.com/hc/en-us/articles/26903049677597-Security-Vulnerability-CVE-2025-3886-that-Impacts-macOS-Client-Versions-Lower-than-5-8
 CVE-2025-3913 - https://mattermost.com/security-updates
 CVE-2025-3928 - https://www.bleepingcomputer.com/news/security/commvault-says-recent-breach-didnt-impact-customer-backup-data/
@@ -133682,19 +133825,35 @@ CVE-2025-39664 - https://github.com/sbaresearch/advisories/tree/public/2025/SBA-
 CVE-2025-3967 - https://github.com/uglory-gll/javasec/blob/main/paicoding.md
 CVE-2025-3967 - https://github.com/uglory-gll/javasec/blob/main/paicoding.md#22articleapipost-horizontal-overstepping-of-authority
 CVE-2025-3968 - https://github.com/zzZxby/Vulnerability-Exploration/blob/main/%E4%BB%A3%E7%A0%81%E5%AE%A1%E8%AE%A11.md
+CVE-2025-39683 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html
+CVE-2025-39689 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html
 CVE-2025-3969 - https://github.com/zzZxby/Vulnerability-Exploration/blob/main/%E4%BB%A3%E7%A0%81%E5%AE%A1%E8%AE%A12.md
+CVE-2025-39697 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html
+CVE-2025-39724 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html
 CVE-2025-3973 - https://github.com/skyrainoh/CVE/issues/3
 CVE-2025-3974 - https://github.com/skyrainoh/CVE/issues/4
+CVE-2025-39756 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html
 CVE-2025-3976 - https://github.com/skyrainoh/CVE/issues/6
+CVE-2025-39770 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html
+CVE-2025-39773 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html
+CVE-2025-39783 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html
+CVE-2025-39787 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html
 CVE-2025-3979 - https://github.com/dtwin88/cve-md/blob/main/lecms%20V3.0.3/lecms_3.md
+CVE-2025-39795 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html
+CVE-2025-39798 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html
 CVE-2025-3980 - https://github.com/38279/3/issues/1
 CVE-2025-3981 - https://github.com/38279/3/issues/1
 CVE-2025-3982 - https://gist.github.com/superboy-zjc/a31b8ea7466f91b437598297bf5cbce8
 CVE-2025-3983 - https://github.com/MichaelZhuang521/cve/blob/main/rce.md
+CVE-2025-39866 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html
 CVE-2025-39913 - https://cert-portal.siemens.com/productcert/html/ssa-253495.html
+CVE-2025-39929 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html
+CVE-2025-39931 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html
 CVE-2025-3995 - https://vuldb.com/?id.306331
 CVE-2025-3997 - https://github.com/dtwin88/cve-md/blob/main/lecms%20V3.0.3/lecms_4.md
+CVE-2025-39977 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html
 CVE-2025-3998 - https://github.com/lyg986443/cve/issues/4
+CVE-2025-40022 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html
 CVE-2025-4003 - https://github.com/RefindPlusRepo/RefindPlus/issues/206
 CVE-2025-4003 - https://github.com/RefindPlusRepo/RefindPlus/issues/206#event-16595888967
 CVE-2025-4004 - https://github.com/wyl091256/CVE/issues/1
@@ -133930,6 +134089,7 @@ CVE-2025-4372 - https://issues.chromium.org/issues/412057896
 CVE-2025-43720 - https://www.periculo.co.uk/cyber-security-blog/how-our-pen-tester-found-a-critical-vulnerability-cve-2025-43720
 CVE-2025-43728 - https://www.dell.com/support/kbdoc/en-us/000359619/dsa-2025-331
 CVE-2025-43729 - https://www.dell.com/support/kbdoc/en-us/000359619/dsa-2025-331
+CVE-2025-4373 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html
 CVE-2025-43730 - https://www.dell.com/support/kbdoc/en-us/000359619/dsa-2025-331
 CVE-2025-43853 - https://github.com/bytecodealliance/wasm-micro-runtime/security/advisories/GHSA-8fc8-4g25-c8m7
 CVE-2025-43854 - https://github.com/langgenius/dify/security/advisories/GHSA-jhgq-cx3f-vj5p
@@ -134221,6 +134381,7 @@ CVE-2025-4598 - http://seclists.org/fulldisclosure/2025/Jun/9
 CVE-2025-4598 - http://www.openwall.com/lists/oss-security/2025/06/05/1
 CVE-2025-4598 - http://www.openwall.com/lists/oss-security/2025/06/05/3
 CVE-2025-4598 - http://www.openwall.com/lists/oss-security/2025/08/18/3
+CVE-2025-4598 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html
 CVE-2025-4598 - https://ciq.com/blog/the-real-danger-of-systemd-coredump-cve-2025-4598/
 CVE-2025-4598 - https://www.openwall.com/lists/oss-security/2025/05/29/3
 CVE-2025-4598 - https://www.openwall.com/lists/oss-security/2025/08/18/3
@@ -134367,6 +134528,7 @@ CVE-2025-46824 - https://www.vicarius.io/vsociety/posts/cve-2025-46824-detect-di
 CVE-2025-46824 - https://www.vicarius.io/vsociety/posts/cve-2025-46824-mitigate-discourse-plugin-vulnerability
 CVE-2025-46825 - https://github.com/kanboard/kanboard/security/advisories/GHSA-5wj3-c9v4-pj9v
 CVE-2025-46828 - https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-5qw5-q55h-6qg7
+CVE-2025-46836 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html
 CVE-2025-46836 - https://github.com/ecki/net-tools/security/advisories/GHSA-pfwf-h6m3-63wf
 CVE-2025-4687 - https://jowin922.medium.com/cve-2025-4687-pre-account-takeover-through-invite-on-teletonika-rms-website-972335378829
 CVE-2025-4690 - https://www.herodevs.com/vulnerability-directory/cve-2025-4690
@@ -135300,7 +135462,9 @@ CVE-2025-52390 - https://github.com/theharshkothari/vulnerability-research/blob/
 CVE-2025-52392 - https://beafn28.gitbook.io/beafn28/cve/brute-force-login-vulnerability-in-soosyze-cms-2.0-cve-2025-52392
 CVE-2025-52392 - https://www.exploit-db.com/exploits/52416
 CVE-2025-52410 - https://github.com/mathurvishal/Institute-of-Current-Students---PHP-Project/issues/2
+CVE-2025-5244 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html
 CVE-2025-5244 - https://cert-portal.siemens.com/productcert/html/ssa-265688.html
+CVE-2025-5245 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html
 CVE-2025-5245 - https://cert-portal.siemens.com/productcert/html/ssa-265688.html
 CVE-2025-52456 - https://talosintelligence.com/vulnerability_reports/TALOS-2025-2224
 CVE-2025-52456 - https://www.talosintelligence.com/vulnerability_reports/TALOS-2025-2224
@@ -136765,6 +136929,7 @@ CVE-2025-59370 - https://www.asus.com/security-advisory/
 CVE-2025-59371 - https://www.asus.com/security-advisory/
 CVE-2025-59372 - https://www.asus.com/security-advisory/
 CVE-2025-59375 - http://www.openwall.com/lists/oss-security/2026/05/01/5
+CVE-2025-59375 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html
 CVE-2025-59376 - https://github.com/william31212/CVE-Requests-1896609
 CVE-2025-59377 - https://github.com/william31212/CVE-Requests-1896609
 CVE-2025-59397 - https://seclists.org/fulldisclosure/2025/Oct/5
@@ -137689,6 +137854,7 @@ CVE-2025-63947 - https://github.com/solonbarroso/vulnerability-research/blob/mai
 CVE-2025-63947 - https://github.com/solonbarroso/vulnerability-research/blob/main/advisories/phpMsAdmin/CVE-pending-phpMsAdmin.md
 CVE-2025-63948 - https://github.com/solonbarroso/vulnerability-research/blob/main/advisories/phpMsAdmin/CVE-2025-63948.md
 CVE-2025-63948 - https://github.com/solonbarroso/vulnerability-research/blob/main/advisories/phpMsAdmin/CVE-pending-phpMsAdmin.md
+CVE-2025-6395 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html
 CVE-2025-63950 - https://github.com/solonbarroso/vulnerability-research/blob/main/advisories/Twittodon/CVE-2025-63950.md
 CVE-2025-63950 - https://github.com/solonbarroso/vulnerability-research/blob/main/advisories/Twittodon/CVE-pending-Deserialization.md
 CVE-2025-63951 - https://github.com/solonbarroso/vulnerability-research/blob/main/advisories/RPi-Jukebox-RFID/CVE-2025-63951.md
@@ -137717,6 +137883,7 @@ CVE-2025-64052 - https://github.com/SpikeReply/advisories/blob/main/cve/fanvil/c
 CVE-2025-64053 - https://github.com/SpikeReply/advisories/blob/main/cve/fanvil/cve-2025-64053.md
 CVE-2025-64054 - https://github.com/SpikeReply/advisories/blob/main/cve/fanvil/cve-2025-64054.md
 CVE-2025-64055 - https://github.com/SpikeReply/advisories/blob/main/cve/fanvil/cve-2025-64055.md
+CVE-2025-64056 - https://github.com/SpikeReply/advisories/blob/main/cve/fanvil/cve-2025-64056.md
 CVE-2025-64057 - https://github.com/SpikeReply/advisories/blob/main/cve/fanvil/cve-2025-64057.md
 CVE-2025-6406 - https://github.com/ASantsSec/CVE/issues/11
 CVE-2025-6407 - https://github.com/ASantsSec/CVE/issues/12
@@ -137837,6 +138004,7 @@ CVE-2025-6473 - https://github.com/tuooo/CVE/issues/17
 CVE-2025-64736 - https://talosintelligence.com/vulnerability_reports/TALOS-2025-2323
 CVE-2025-64736 - https://www.talosintelligence.com/vulnerability_reports/TALOS-2025-2323
 CVE-2025-6474 - https://github.com/1609624781/cve/issues/1
+CVE-2025-64744 - https://github.com/openobserve/openobserve/security/advisories/GHSA-3jpx-57gj-w458
 CVE-2025-64745 - https://github.com/withastro/astro/security/advisories/GHSA-w2vj-39qv-7vh7
 CVE-2025-6475 - https://github.com/RaulPazemecxas/PoCVulDb/blob/main/README8.md
 CVE-2025-6475 - https://www.sourcecodester.com/
@@ -138180,6 +138348,7 @@ CVE-2025-66313 - https://github.com/ChurchCRM/CRM/security/advisories/GHSA-47q3-
 CVE-2025-66359 - https://servicedesk.logpoint.com/hc/en-us/articles/29158899698333-XSS-Vulnerability-due-to-insufficient-input-validation
 CVE-2025-66360 - https://servicedesk.logpoint.com/hc/en-us/articles/29160917867549-Redis-communication-exposed-for-internal-communication
 CVE-2025-66361 - https://servicedesk.logpoint.com/hc/en-us/articles/29160993806749-Process-Data-Exposure-Under-High-Load
+CVE-2025-66382 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html
 CVE-2025-66382 - https://cert-portal.siemens.com/productcert/html/ssa-253495.html
 CVE-2025-66389 - https://blindcyber.com/2025/10/28/copilot-fun/
 CVE-2025-66391 - https://github.com/mandeepsohal/CVE-2025-66391/blob/main/Exploit.md
@@ -138320,6 +138489,9 @@ CVE-2025-67013 - https://github.com/shiky8/my--cve-vulnerability-research/tree/m
 CVE-2025-67014 - https://dev-systemtechnik.com
 CVE-2025-67015 - https://github.com/shiky8/my--cve-vulnerability-research/tree/main/CVE-2025-67015%20_%20Comtech%20EF%20Data%20CDM-625%20_%20CDM-625A%20Advanced%20_%20Broken%20Access%20Control
 CVE-2025-67074 - https://github.com/johnathanhuutri/CVEReport/tree/master/CVE-2025-67074
+CVE-2025-67089 - https://aleksazatezalo.medium.com/critical-command-injection-vulnerability-in-gl-inet-gl-axt1800-router-firmware-e6d67d81ee51?postPublishedType=repub
+CVE-2025-67090 - https://aleksazatezalo.medium.com/critical-command-injection-vulnerability-in-gl-inet-gl-axt1800-router-firmware-e6d67d81ee51?postPublishedType=repub
+CVE-2025-67091 - https://aleksazatezalo.medium.com/critical-command-injection-vulnerability-in-gl-inet-gl-axt1800-router-firmware-e6d67d81ee51?postPublishedType=repub
 CVE-2025-67108 - https://gist.github.com/lkloliver/81b5d5a8328d712dbfd497bf11dbe913
 CVE-2025-67109 - https://gist.github.com/lkloliver/669e15bc7e6194133e4ee1026ce157e6
 CVE-2025-67111 - https://gist.github.com/lkloliver/fcc5da83b4cba137ce95177a9afc4126
@@ -138413,7 +138585,9 @@ CVE-2025-67874 - https://github.com/ChurchCRM/CRM/security/advisories/GHSA-p98h-
 CVE-2025-67875 - https://github.com/ChurchCRM/CRM/security/advisories/GHSA-fcw7-mmfh-7vjm
 CVE-2025-67876 - https://github.com/ChurchCRM/CRM/security/advisories/GHSA-j9gv-26c7-3qrh
 CVE-2025-67886 - https://karmainsecurity.com/pocs/CVE-2025-67886.php
+CVE-2025-67886 - https://seclists.org/fulldisclosure/2025/Dec/21
 CVE-2025-67887 - https://karmainsecurity.com/pocs/CVE-2025-67887.php
+CVE-2025-67887 - https://seclists.org/fulldisclosure/2025/Dec/22
 CVE-2025-67888 - https://karmainsecurity.com/KIS-2025-09
 CVE-2025-67896 - https://exim.org/static/doc/security/EXIM-Security-2025-12-09.1/report.txt
 CVE-2025-6790 - https://wpscan.com/vulnerability/af337f9f-c955-49eb-9675-2f85da96fcfe/
@@ -139021,6 +139195,7 @@ CVE-2025-7422 - https://github.com/wudipjq/my_vuln/blob/main/Tenda3/vuln_55/55.m
 CVE-2025-7422 - https://github.com/wudipjq/my_vuln/blob/main/Tenda3/vuln_55/55.md#poc
 CVE-2025-7423 - https://github.com/wudipjq/my_vuln/blob/main/Tenda3/vuln_56/56.md
 CVE-2025-7423 - https://github.com/wudipjq/my_vuln/blob/main/Tenda3/vuln_56/56.md#poc
+CVE-2025-7425 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html
 CVE-2025-7425 - https://cert-portal.siemens.com/productcert/html/ssa-265688.html
 CVE-2025-7426 - https://www.cryptron.ch/en/blog-detail/security-advisory-CVE-2025-7426-en.html
 CVE-2025-7435 - https://github.com/CodeBrics/lhc-php-resque-exploit/
@@ -139097,7 +139272,9 @@ CVE-2025-7542 - https://github.com/4m3rr0r/PoCVulDb/blob/main/CVE-2025-7542.md
 CVE-2025-7543 - https://github.com/4m3rr0r/PoCVulDb/blob/main/CVE-2025-7543.md
 CVE-2025-7544 - https://github.com/panda666-888/vuls/blob/main/tenda/ac1206/formSetMacFilterCfg.md
 CVE-2025-7544 - https://github.com/panda666-888/vuls/blob/main/tenda/ac1206/formSetMacFilterCfg.md#poc
+CVE-2025-7545 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html
 CVE-2025-7545 - https://cert-portal.siemens.com/productcert/html/ssa-265688.html
+CVE-2025-7546 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html
 CVE-2025-7546 - https://cert-portal.siemens.com/productcert/html/ssa-265688.html
 CVE-2025-7546 - https://vuldb.com/?submit.614375
 CVE-2025-7548 - https://github.com/panda666-888/vuls/blob/main/tenda/fh1201/formSafeEmailFilter.md
@@ -139439,6 +139616,7 @@ CVE-2025-8220 - https://github.com/m3m0o/engeman-web-language-combobox-sqli
 CVE-2025-8221 - https://github.com/Bemcliu/cve-reports/blob/main/cve-04-%E8%9B%8B%E7%B3%95%E5%95%86%E5%9F%8EJPA%E7%89%88-Reflected%20XSS/readme.md
 CVE-2025-8222 - https://github.com/Bemcliu/cve-reports/blob/main/cve-05-%E8%9B%8B%E7%B3%95%E5%95%86%E5%9F%8EJPA%E7%89%88-Stored%20XSS/readme.md
 CVE-2025-8223 - https://github.com/Bemcliu/cve-reports/blob/main/cve-06-%E8%9B%8B%E7%B3%95%E5%95%86%E5%9F%8EJPA%E7%89%88-CSRF/readme.md
+CVE-2025-8224 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html
 CVE-2025-8224 - https://cert-portal.siemens.com/productcert/html/ssa-265688.html
 CVE-2025-8229 - https://vuldb.com/?submit.622322
 CVE-2025-8232 - https://github.com/xiajian-qx/cve-xiajian/issues/7
@@ -140062,10 +140240,12 @@ CVE-2025-9215 - https://github.com/d0n601/CVE-2025-9215
 CVE-2025-9215 - https://ryankozak.com/posts/cve-2025-9215/
 CVE-2025-9216 - https://github.com/d0n601/CVE-2025-9216
 CVE-2025-9216 - https://ryankozak.com/posts/cve-2025-9216/
+CVE-2025-9230 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html
 CVE-2025-9230 - https://cert-portal.siemens.com/productcert/html/ssa-253495.html
 CVE-2025-9230 - https://cert-portal.siemens.com/productcert/html/ssa-265688.html
 CVE-2025-9231 - http://www.openwall.com/lists/oss-security/2026/05/11/11
 CVE-2025-9231 - https://cert-portal.siemens.com/productcert/html/ssa-253495.html
+CVE-2025-9232 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html
 CVE-2025-9232 - https://cert-portal.siemens.com/productcert/html/ssa-253495.html
 CVE-2025-9233 - https://github.com/marcelomulder/CVE/blob/main/Scada-LTS/CVE-2025-9233.md
 CVE-2025-9233 - https://github.com/marcelomulder/CVE/blob/main/Scada-LTS/Stored%20XSS%20endpoint%20view_edit.shtm%20parameter%20name.md#poc
@@ -141095,6 +141275,8 @@ CVE-2026-11558 - https://github.com/sl1der-fr0g/Findings/issues/1
 CVE-2026-11559 - https://github.com/Andelstander/cve/issues/1
 CVE-2026-1156 - https://vuldb.com/?id.341750
 CVE-2026-11562 - https://wpscan.com/vulnerability/e0283d75-0622-490c-9442-cf1aa0a1d167/
+CVE-2026-11563 - https://wpscan.com/vulnerability/7f4b5f16-6c31-4dcc-94a4-120cb45631bb/
+CVE-2026-11567 - https://wpscan.com/vulnerability/bd738da7-f950-4da9-bcc1-c1fe845d7faa/
 CVE-2026-11568 - https://wpscan.com/vulnerability/e208fee5-dad5-4aeb-b9b5-fbd72a5633e4/
 CVE-2026-11570 - https://wpscan.com/vulnerability/35c33c56-5b12-4be5-9d45-68f47cd854ec/
 CVE-2026-11571 - https://wpscan.com/vulnerability/4bd381e9-2f4e-4e61-99af-88f50aed71f5/
@@ -141242,10 +141424,12 @@ CVE-2026-12396 - https://wpscan.com/vulnerability/13d574ea-84fe-421b-b1e4-23f94e
 CVE-2026-12397 - https://wpscan.com/vulnerability/8e797251-2351-4979-a6c1-c05c78622327/
 CVE-2026-12411 - https://github.com/canonical/lxd/security/advisories/GHSA-hhf9-qw4v-72xp
 CVE-2026-1248 - https://www.ibm.com/support/pages/node/7271445
+CVE-2026-12511 - https://wpscan.com/vulnerability/cf3cf59e-da36-429b-8794-5a46587e8462/
 CVE-2026-12516 - https://wpscan.com/vulnerability/2ac80164-03b7-4966-b022-833b4194de80/
 CVE-2026-12517 - https://wpscan.com/vulnerability/460a996f-e27d-47e8-9d68-9e6be93100c0/
 CVE-2026-12527 - https://github.com/AounShAh/Research-on-v380-cctv-ip-camera#broken-access-control-leading-to-critical-live-video-exposure
 CVE-2026-12582 - https://wpscan.com/vulnerability/762dd8c3-8972-46ef-90c2-9f3f5dce4370/
+CVE-2026-12583 - https://wpscan.com/vulnerability/e4c44105-f43d-4dff-8487-7d8ae2691c4e/
 CVE-2026-12644 - https://security.snyk.io/vuln/SNYK-JS-TSDEEPMERGE-17339141
 CVE-2026-1267 - https://www.ibm.com/support/pages/node/7263581
 CVE-2026-12685 - https://wpscan.com/vulnerability/0e5f5730-167d-4853-a764-bb9e3d62fdc4/
@@ -141284,6 +141468,7 @@ CVE-2026-12866 - https://security.snyk.io/vuln/SNYK-JS-EXPREVAL-15054690
 CVE-2026-1291 - https://wordpress.org/plugins/meow-gallery/
 CVE-2026-12912 - https://bugzilla.redhat.com/show_bug.cgi?id=2492871
 CVE-2026-12912 - https://gitlab.com/libtiff/libtiff/-/work_items/824
+CVE-2026-12988 - https://wpscan.com/vulnerability/8aa6bf91-54ee-4326-a477-31f42284be22/
 CVE-2026-13211 - https://github.com/sbaresearch/advisories/tree/public/2026/SBA-ADV-20260424-01_Genucenter_Disclosure_of_SNMP_Credentials
 CVE-2026-1324 - https://github.com/LX-LX88/cve/issues/20
 CVE-2026-1325 - https://github.com/LX-LX88/cve/issues/21
@@ -141408,6 +141593,7 @@ CVE-2026-14764 - https://raw.githubusercontent.com/anubhavv106/Security-Advisori
 CVE-2026-14798 - https://github.com/lilukun337/cve/issues/10
 CVE-2026-1484 - https://cert-portal.siemens.com/productcert/html/ssa-253495.html
 CVE-2026-1489 - https://cert-portal.siemens.com/productcert/html/ssa-253495.html
+CVE-2026-14940 - https://bugzilla.redhat.com/show_bug.cgi?id=2497697
 CVE-2026-1504 - https://issues.chromium.org/issues/474435504
 CVE-2026-1505 - https://vuldb.com/?id.343117
 CVE-2026-1508 - https://wpscan.com/vulnerability/fc1d577b-abf9-4c15-a96d-14ebd894debc/
@@ -141433,6 +141619,7 @@ CVE-2026-15375 - https://drive.google.com/file/d/14q47WM7nqXuUJbN-3xTXzCIbMUwD1k
 CVE-2026-15376 - https://drive.google.com/file/d/18l6-Lpvqq1B-ureww1zR5d_nyhZl312q/view?usp=sharing
 CVE-2026-15377 - https://drive.google.com/file/d/1qnAoRYVrMeB4fhtLV4XFZOVrzVM3UeHx/view?usp=sharing
 CVE-2026-1540 - https://wpscan.com/vulnerability/ad00d1bb-ea8d-44a3-9064-6412804d9e95/
+CVE-2026-15416 - https://www.synacktiv.com/en/publications/caught-in-the-octopus-trap-unauthenticated-rce-in-argo-cd-with-codeql
 CVE-2026-1542 - https://wpscan.com/vulnerability/d6e3041f-62e8-49ba-8806-59a1c07ec43d/
 CVE-2026-1544 - https://github.com/master-abc/cve/issues/16
 CVE-2026-1545 - https://github.com/ltranquility/CVE/issues/33
@@ -141611,6 +141798,7 @@ CVE-2026-2018 - https://vuldb.com/?submit.744075
 CVE-2026-20230 - https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cucm-ssrf-cXPnHcW
 CVE-2026-2025 - https://wpscan.com/vulnerability/1b815cde-cd9d-46fa-a6ab-3d2851705e7b/
 CVE-2026-20253 - https://labs.watchtowr.com/why-use-app-level-auth-when-every-database-has-auth-splunk-enterprise-cve-2026-20253-pre-auth-rce/
+CVE-2026-2054 - https://github.com/wudipjq/my_vuln/blob/main/D-Link7/vuln_81/81.md
 CVE-2026-2054 - https://github.com/wudipjq/my_vuln/blob/main/D-Link7/vuln_81/81.md#poc--result
 CVE-2026-2055 - https://github.com/wudipjq/my_vuln/blob/main/D-Link7/vuln_82/82.md
 CVE-2026-2055 - https://github.com/wudipjq/my_vuln/blob/main/D-Link7/vuln_82/82.md#poc--result
@@ -143050,6 +143238,7 @@ CVE-2026-2872 - https://github.com/QIU-DIE/cve-nneeww/issues/3
 CVE-2026-2873 - https://github.com/QIU-DIE/cve-nneeww/issues/4
 CVE-2026-28732 - https://mattermost.com/security-updates
 CVE-2026-28735 - https://mattermost.com/security-updates
+CVE-2026-28737 - https://github.com/go-gitea/gitea/security/advisories/GHSA-9cpj-qc93-vw8v
 CVE-2026-2874 - https://github.com/QIU-DIE/cve-nneeww/issues/5
 CVE-2026-28741 - https://mattermost.com/security-updates
 CVE-2026-28759 - https://mattermost.com/security-updates
@@ -143092,6 +143281,9 @@ CVE-2026-28950 - http://seclists.org/fulldisclosure/2026/Apr/15
 CVE-2026-29000 - https://www.codeant.ai/security-research/pac4j-jwt-authentication-bypass-public-key
 CVE-2026-29004 - https://www.vulncheck.com/advisories/busybox-dhcpv6-client-heap-buffer-overflow-via-dns-servers
 CVE-2026-29004 - https://y637f9qq2x.com/posts/busybox-dhcpv6-heap-overflow/
+CVE-2026-29007 - https://y637f9qq2x.com/posts/u-boot-tcp-nfs-vulns/
+CVE-2026-29008 - https://y637f9qq2x.com/posts/u-boot-tcp-nfs-vulns/
+CVE-2026-29009 - https://y637f9qq2x.com/posts/u-boot-tcp-nfs-vulns/
 CVE-2026-29014 - http://seclists.org/fulldisclosure/2026/Apr/1
 CVE-2026-29014 - https://karmainsecurity.com/KIS-2026-06
 CVE-2026-29014 - https://websec.net/blog/cve-2026-29014-metinfo-cms-unauthenticated-php-code-injection-69cdc290c14a8a99e1f91b7a
@@ -143543,6 +143735,7 @@ CVE-2026-31431 - http://www.openwall.com/lists/oss-security/2026/05/04/29
 CVE-2026-31431 - http://www.openwall.com/lists/oss-security/2026/05/07/12
 CVE-2026-31431 - http://www.openwall.com/lists/oss-security/2026/05/08/13
 CVE-2026-31431 - http://www.openwall.com/lists/oss-security/2026/05/18/3
+CVE-2026-31431 - https://cert-portal.siemens.com/productcert/html/ssa-082556.html
 CVE-2026-31431 - https://cert-portal.siemens.com/productcert/html/ssa-265688.html
 CVE-2026-31431 - https://copy.fail
 CVE-2026-31431 - https://websec.net/blog/cve-2026-31431-linux-algifaead-page-cache-write-to-root-69f38a4ccddd2db1f520f170
@@ -144094,6 +144287,7 @@ CVE-2026-3682 - https://github.com/CC-T-454455/Vulnerabilities/tree/master/ffmat
 CVE-2026-3683 - https://github.com/CC-T-454455/Vulnerabilities/tree/master/hotgo/vulnerability-1
 CVE-2026-3689 - https://github.com/openclaw/openclaw/security/advisories/GHSA-jq4x-98m3-ggq6
 CVE-2026-3690 - https://github.com/openclaw/openclaw/security/advisories/GHSA-vvjh-f6p9-5vcf
+CVE-2026-36908 - https://github.com/axiomatic-systems/Bento4/issues/842
 CVE-2026-36910 - https://github.com/axiomatic-systems/Bento4/issues/873
 CVE-2026-3693 - https://github.com/CC-T-454455/Vulnerabilities/tree/master/agent-chat/vulnerability-1
 CVE-2026-3693 - https://github.com/CC-T-454455/Vulnerabilities/tree/master/agent-chat/vulnerability-2
@@ -144215,6 +144409,7 @@ CVE-2026-3816 - https://github.com/henrrrychau/cve-bug-bounty/blob/main/dfdj_zip
 CVE-2026-3817 - https://gist.github.com/HxH404/c4c8e7ce7fe5cde98aca176fba9d7207
 CVE-2026-3830 - https://wpscan.com/vulnerability/768014fd-0403-4182-b19e-3d46c92d8755/
 CVE-2026-3832 - https://gitlab.com/gnutls/gnutls/-/issues/1801
+CVE-2026-38329 - https://gist.github.com/Ki1ro0133/8bd14bd4fc6fab81c907d838a7aeee55
 CVE-2026-3833 - https://gitlab.com/gnutls/gnutls/-/issues/1803
 CVE-2026-38360 - https://github.com/github/advisory-database/pull/7635
 CVE-2026-38361 - https://github.com/github/advisory-database/pull/7636
@@ -144269,10 +144464,16 @@ CVE-2026-38948 - https://www.youtube.com/watch?v=lLCF0xbjecQ
 CVE-2026-38949 - https://github.com/Chittu13/cve-research/blob/main/CVE-2026-38949/README.md
 CVE-2026-38949 - https://youtu.be/3e-tzUMCox8
 CVE-2026-38967 - https://github.com/CrowCpp/Crow/pull/1167
+CVE-2026-38969 - https://github.com/ruby/webrick/issues/198
+CVE-2026-38971 - https://github.com/ArduPilot/ardupilot/issues/32524
 CVE-2026-38991 - https://felsec.com/posts/cockpit-cms-2.13.5-multi-vulns/
 CVE-2026-38992 - https://felsec.com/posts/cockpit-cms-2.13.5-multi-vulns/
 CVE-2026-38993 - https://felsec.com/posts/cockpit-cms-2.13.5-multi-vulns/
+CVE-2026-39007 - https://github.com/Kettn/Vulnerability_Publications/tree/main/CVE-2026-39007
+CVE-2026-39031 - https://github.com/user6400/cve-2026-39031-lansweeper-lsrunase2-lsencrypt2
 CVE-2026-39079 - https://labs.esokia.com/cve/cve-2026-39079/
+CVE-2026-39103 - https://github.com/gpac/gpac/issues/3506
+CVE-2026-39107 - https://github.com/MGTx2/CVE-2026-39107
 CVE-2026-39109 - https://github.com/efekaanakkar/Apartment-Visitors-Management-System-CVEs/
 CVE-2026-39110 - https://github.com/efekaanakkar/Apartment-Visitors-Management-System-CVEs/
 CVE-2026-39111 - https://github.com/efekaanakkar/Apartment-Visitors-Management-System-CVEs/
@@ -144281,29 +144482,51 @@ CVE-2026-3913 - https://issues.chromium.org/issues/483445078
 CVE-2026-3914 - https://issues.chromium.org/issues/481776048
 CVE-2026-3915 - https://issues.chromium.org/issues/483971526
 CVE-2026-3916 - https://issues.chromium.org/issues/482828615
+CVE-2026-39170 - https://gist.github.com/ql288470-pixel/41e01787357416458212dbbfd06c6d73
 CVE-2026-3918 - https://issues.chromium.org/issues/483853103
 CVE-2026-3919 - https://issues.chromium.org/issues/444176961
+CVE-2026-39196 - https://gist.github.com/pyuysig/423b15c69e3cd851c1e24c1312a0551a
+CVE-2026-39197 - https://gist.github.com/pyuysig/221e90dd598ab3f3c3100ae59db8e8d4
+CVE-2026-39199 - https://github.com/snes9xgit/snes9x/issues/1035
 CVE-2026-39199 - https://karansaini.com/snes9x-oob-write/
 CVE-2026-3921 - https://issues.chromium.org/issues/484946544
 CVE-2026-3922 - https://issues.chromium.org/issues/485397139
 CVE-2026-3923 - https://issues.chromium.org/issues/485935314
 CVE-2026-3924 - https://issues.chromium.org/issues/487338366
+CVE-2026-39243 - https://github.com/kevva/decompress/issues/113
+CVE-2026-39244 - https://github.com/cthackers/adm-zip/issues/568
+CVE-2026-39245 - https://github.com/kevva/decompress/issues/115
+CVE-2026-39246 - https://github.com/kevva/decompress/issues/114
 CVE-2026-3925 - https://issues.chromium.org/issues/418214610
 CVE-2026-3927 - https://issues.chromium.org/issues/474948986
+CVE-2026-39276 - https://github.com/LING12138-sg/Emlog-v2.6.9-Vulnerability-Report
 CVE-2026-3930 - https://issues.chromium.org/issues/476898368
+CVE-2026-39305 - https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-jfxc-v5g9-38xr
 CVE-2026-39306 - https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-4rx4-4r3x-6534
+CVE-2026-39308 - https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-r9x3-wx45-2v7f
+CVE-2026-39309 - https://github.com/TriliumNext/Trilium/security/advisories/GHSA-66pm-8hvq-2wwx
+CVE-2026-39310 - https://github.com/TriliumNext/Trilium/security/advisories/GHSA-jcvx-vc83-cppw
+CVE-2026-39311 - https://github.com/TriliumNext/Trilium/security/advisories/GHSA-p837-cxw3-m964
 CVE-2026-39312 - https://github.com/SoftEtherVPN/SoftEtherVPN/security/advisories/GHSA-q5g3-qhc6-pr3h
+CVE-2026-39314 - https://github.com/OpenPrinting/cups/security/advisories/GHSA-pp8w-2g52-7vj7
 CVE-2026-39315 - https://github.com/unjs/unhead/security/advisories/GHSA-95h2-gj7x-gx9w
+CVE-2026-39316 - https://github.com/OpenPrinting/cups/security/advisories/GHSA-pjv5-prqp-46rg
 CVE-2026-39318 - https://github.com/ChurchCRM/CRM/security/advisories/GHSA-8r53-w4r6-w62c
 CVE-2026-39318 - https://github.com/ChurchCRM/CRM/security/advisories/GHSA-j3vj-59vv-h4rc
 CVE-2026-39320 - https://github.com/SignalK/signalk-server/security/advisories/GHSA-7gcj-phff-2884
 CVE-2026-39325 - https://github.com/ChurchCRM/CRM/security/advisories/GHSA-cf68-g7vf-9xrq
+CVE-2026-39326 - https://github.com/ChurchCRM/CRM/security/advisories/GHSA-mch7-6v8f-c4j5
+CVE-2026-39327 - https://github.com/ChurchCRM/CRM/security/advisories/GHSA-66fc-v5xj-x859
 CVE-2026-39328 - https://github.com/ChurchCRM/CRM/security/advisories/GHSA-fcp5-pwvj-v7xm
+CVE-2026-39329 - https://github.com/ChurchCRM/CRM/security/advisories/GHSA-ggfm-5q4w-p93g
 CVE-2026-39331 - https://github.com/ChurchCRM/CRM/security/advisories/GHSA-vwh8-x823-wjc5
+CVE-2026-39332 - https://github.com/ChurchCRM/CRM/security/advisories/GHSA-hc6g-h48v-wqvq
+CVE-2026-39333 - https://github.com/ChurchCRM/CRM/security/advisories/GHSA-fqq6-qrcf-h7h5
 CVE-2026-39334 - https://github.com/ChurchCRM/CRM/security/advisories/GHSA-8g53-72jr-39w6
 CVE-2026-39335 - https://github.com/ChurchCRM/CRM/security/advisories/GHSA-44j4-jjw2-wcr6
 CVE-2026-39336 - https://github.com/ChurchCRM/CRM/security/advisories/GHSA-r8cp-gg58-2r2r
 CVE-2026-39337 - https://github.com/ChurchCRM/CRM/security/advisories/GHSA-pm2v-ggh4-mp7p
+CVE-2026-39339 - https://github.com/ChurchCRM/CRM/security/advisories/GHSA-v3p2-mx78-pxhc
 CVE-2026-3934 - https://issues.chromium.org/issues/478783560
 CVE-2026-39340 - https://github.com/ChurchCRM/CRM/security/advisories/GHSA-66f7-4p96-mww9
 CVE-2026-39341 - https://github.com/ChurchCRM/CRM/security/advisories/GHSA-3h69-vjff-jj5c
@@ -144313,24 +144536,38 @@ CVE-2026-39344 - https://github.com/ChurchCRM/CRM/security/advisories/GHSA-rx8c-
 CVE-2026-3935 - https://issues.chromium.org/issues/479326680
 CVE-2026-39354 - https://github.com/Erudika/scoold/security/advisories/GHSA-768r-cv9p-wrcm
 CVE-2026-39355 - https://github.com/MGeurts/genealogy/security/advisories/GHSA-2rq7-jqm7-w8x4
+CVE-2026-39358 - https://github.com/cubecart/v6/security/advisories/GHSA-8gj6-9fwc-h4gh
 CVE-2026-39360 - https://github.com/rustfs/rustfs/security/advisories/GHSA-mx42-j6wv-px98
 CVE-2026-39361 - https://github.com/openobserve/openobserve/security/advisories/GHSA-gcwf-3p7h-wm79
+CVE-2026-39363 - https://github.com/vitejs/vite/security/advisories/GHSA-p9ff-h696-f583
+CVE-2026-39364 - https://github.com/vitejs/vite/security/advisories/GHSA-v2wj-q39q-566r
 CVE-2026-39365 - https://github.com/vitejs/vite/security/advisories/GHSA-4w7w-66w2-5vf9
+CVE-2026-39367 - https://github.com/WWBN/AVideo/security/advisories/GHSA-rqp3-gf5h-mrqx
 CVE-2026-39368 - https://github.com/WWBN/AVideo/security/advisories/GHSA-q4x6-6mm2-crg9
 CVE-2026-39369 - https://github.com/WWBN/AVideo/security/advisories/GHSA-f4f9-627c-jh33
 CVE-2026-3937 - https://issues.chromium.org/issues/473118648
 CVE-2026-39370 - https://github.com/WWBN/AVideo/security/advisories/GHSA-cmcr-q4jf-p6q9
 CVE-2026-39373 - https://github.com/latchset/jwcrypto/security/advisories/GHSA-fjrm-76x2-c4q4
+CVE-2026-39374 - https://github.com/makeplane/plane/security/advisories/GHSA-4q54-h4x9-m329
 CVE-2026-39376 - https://github.com/kagisearch/fastfeedparser/security/advisories/GHSA-4gx2-pc4f-wq37
 CVE-2026-3938 - https://issues.chromium.org/issues/474763968
 CVE-2026-39380 - https://github.com/opensourcepos/opensourcepos/security/advisories/GHSA-7hg5-68rx-xpmg
+CVE-2026-39383 - https://github.com/gotenberg/gotenberg/security/advisories/GHSA-5vh4-rgv7-p9g4
+CVE-2026-39387 - https://github.com/BoidCMS/BoidCMS/security/advisories/GHSA-45xp-xw54-6cv6
 CVE-2026-39389 - https://github.com/ci4-cms-erp/ci4ms/security/advisories/GHSA-9rxp-f27p-wv3h
+CVE-2026-39390 - https://github.com/ci4-cms-erp/ci4ms/security/advisories/GHSA-x3hr-cp7x-44r2
+CVE-2026-39391 - https://github.com/ci4-cms-erp/ci4ms/security/advisories/GHSA-7cm9-v848-cfh2
 CVE-2026-39392 - https://github.com/ci4-cms-erp/ci4ms/security/advisories/GHSA-fjpj-6qcq-6pw2
+CVE-2026-39393 - https://github.com/ci4-cms-erp/ci4ms/security/advisories/GHSA-8rh5-4mvx-xj7j
 CVE-2026-39394 - https://github.com/ci4-cms-erp/ci4ms/security/advisories/GHSA-vfhx-5459-qhqh
+CVE-2026-39396 - https://github.com/openbao/openbao/security/advisories/GHSA-r65v-xgwc-g56j
 CVE-2026-39400 - https://github.com/jhuckaby/Cronicle/security/advisories/GHSA-36q6-pwxv-j545
+CVE-2026-39402 - https://github.com/lxc/lxc/security/advisories/GHSA-3m9j-g9gc-vcvq
 CVE-2026-39411 - https://github.com/lobehub/lobehub/security/advisories/GHSA-5mwj-v5jw-5c97
+CVE-2026-39412 - https://github.com/harttle/liquidjs/security/advisories/GHSA-rv5g-f82m-qrvv
 CVE-2026-39416 - https://vulnerability.circl.lu/vuln/gcve-1-2026-0023
 CVE-2026-3942 - https://issues.chromium.org/issues/475238879
+CVE-2026-39422 - https://github.com/1Panel-dev/MaxKB/security/advisories/GHSA-wf7p-3jq5-q52w
 CVE-2026-3943 - https://github.com/leeyper/CVE/issues/1
 CVE-2026-3944 - https://github.com/kongjie284/my_CVE/issues/1
 CVE-2026-3949 - https://github.com/biniamf/pocs/tree/main/libheif_vvdec
@@ -144373,10 +144610,15 @@ CVE-2026-3979 - https://github.com/quickjs-ng/quickjs/issues/1368
 CVE-2026-3979 - https://github.com/quickjs-ng/quickjs/issues/1368#issue-4004680962
 CVE-2026-3980 - https://github.com/vasable/automatic-parakeet/issues/2
 CVE-2026-39803 - https://cna.erlef.org/cves/CVE-2026-39803.html
+CVE-2026-39803 - https://github.com/mtrudel/bandit/security/advisories/GHSA-9q9q-324x-93r2
 CVE-2026-39804 - https://cna.erlef.org/cves/CVE-2026-39804.html
+CVE-2026-39804 - https://github.com/mtrudel/bandit/security/advisories/GHSA-frh3-6pv6-rc8j
 CVE-2026-39805 - https://cna.erlef.org/cves/CVE-2026-39805.html
+CVE-2026-39805 - https://github.com/mtrudel/bandit/security/advisories/GHSA-c67r-gc9j-2qf7
 CVE-2026-39806 - https://cna.erlef.org/cves/CVE-2026-39806.html
+CVE-2026-39806 - https://github.com/mtrudel/bandit/security/advisories/GHSA-rf5q-vwxw-gmrf
 CVE-2026-39807 - https://cna.erlef.org/cves/CVE-2026-39807.html
+CVE-2026-39808 - https://github.com/samu-delucas/CVE-2026-39808
 CVE-2026-3981 - https://github.com/vasable/automatic-parakeet/issues/1
 CVE-2026-39816 - https://zeropath.com/blog/nifi-cve-2026-39816-privesc-rce
 CVE-2026-3982 - https://github.com/PIPIzzz1/aaa/issues/1
@@ -144386,8 +144628,11 @@ CVE-2026-39843 - https://github.com/makeplane/plane/security/advisories/GHSA-9fr
 CVE-2026-39846 - https://github.com/siyuan-note/siyuan/security/advisories/GHSA-phhp-9rm9-6gr2
 CVE-2026-39853 - https://github.com/mtrojnar/osslsigncode/security/advisories/GHSA-hx87-8754-xvh4
 CVE-2026-39855 - https://github.com/mtrojnar/osslsigncode/security/advisories/GHSA-76vv-x5rr-q3mr
+CVE-2026-39856 - https://github.com/mtrojnar/osslsigncode/security/advisories/GHSA-rjrx-chvw-8jw8
 CVE-2026-39857 - https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-c276-fj82-f2pq
+CVE-2026-39858 - https://github.com/traefik/traefik/security/advisories/GHSA-5m6w-wvh7-57vm
 CVE-2026-39859 - https://github.com/harttle/liquidjs/security/advisories/GHSA-v273-448j-v4qj
+CVE-2026-39866 - https://github.com/LawnchairLauncher/lawnchair/security/advisories/GHSA-9prc-pp2c-3427
 CVE-2026-39880 - https://github.com/remnawave/backend/security/advisories/GHSA-985p-44h5-v3pq
 CVE-2026-39882 - https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-w8rr-5gcm-pp58
 CVE-2026-39885 - https://github.com/agentfront/frontmcp/security/advisories/GHSA-v6ph-xcq9-qxxj
@@ -144398,16 +144643,27 @@ CVE-2026-39891 - https://github.com/MervinPraison/PraisonAI/security/advisories/
 CVE-2026-39892 - http://www.openwall.com/lists/oss-security/2026/04/08/12
 CVE-2026-3990 - https://github.com/AnalogyC0de/public_exp/issues/18
 CVE-2026-39901 - https://github.com/monetr/monetr/security/advisories/GHSA-hqxq-hwqf-wg83
+CVE-2026-39906 - https://gist.github.com/VAMorales/be3e4ed472c51794493c1256cce16129
+CVE-2026-39907 - https://gist.github.com/VAMorales/be3e4ed472c51794493c1256cce16129
 CVE-2026-39908 - https://hackernoon.com/one-empty-header-to-admin-how-an-auth-bypass-breaks-openbullet2
 CVE-2026-39912 - https://chocapikk.com/posts/2026/xboard-v2board-account-takeover/
 CVE-2026-3992 - https://github.com/AnalogyC0de/public_exp/issues/19
+CVE-2026-39920 - https://gist.github.com/VAMorales/9e6a13d7529c079a363930dff48be3ba
 CVE-2026-3993 - https://github.com/ltranquility/cve_submit/issues/11
 CVE-2026-39940 - https://github.com/ChurchCRM/CRM/security/advisories/GHSA-v3hj-33xf-qx47
+CVE-2026-39941 - https://github.com/ChurchCRM/CRM/security/advisories/GHSA-4mqw-9jww-2c58
 CVE-2026-39956 - https://github.com/jqlang/jq/security/advisories/GHSA-6gc3-3g9p-xx28
+CVE-2026-39957 - https://github.com/LycheeOrg/Lychee/security/advisories/GHSA-4v4c-g2jv-4g25
+CVE-2026-39958 - https://github.com/AOSC-Dev/oma/security/advisories/GHSA-86jc-7r6q-cr3f
 CVE-2026-39963 - https://github.com/s9y/Serendipity/security/advisories/GHSA-4m6c-649p-f6gf
+CVE-2026-39967 - https://github.com/baptisteArno/typebot.io/security/advisories/GHSA-f475-7m4x-m6mx
+CVE-2026-39968 - https://github.com/baptisteArno/typebot.io/security/advisories/GHSA-cq66-9cwr-x8jr
+CVE-2026-39970 - https://github.com/baptisteArno/typebot.io/security/advisories/GHSA-jj87-c343-26vp
 CVE-2026-39971 - https://github.com/s9y/Serendipity/security/advisories/GHSA-458g-q4fh-mj6r
 CVE-2026-39977 - https://github.com/flatpak/flatpak-builder/security/advisories/GHSA-6gm9-3g7m-3965
+CVE-2026-39979 - https://github.com/jqlang/jq/security/advisories/GHSA-2hhh-px8h-355p
 CVE-2026-39981 - https://github.com/Josh-XT/AGiXT/security/advisories/GHSA-5gfj-64gh-mgmw
+CVE-2026-39983 - https://github.com/patrickjuchli/basic-ftp/security/advisories/GHSA-chqc-8p9q-pq6q
 CVE-2026-39987 - https://github.com/marimo-team/marimo/security/advisories/GHSA-2679-6mx9-h9xc
 CVE-2026-39987 - https://www.sysdig.com/blog/marimo-oss-python-notebook-rce-from-disclosure-to-exploitation-in-under-10-hours
 CVE-2026-40027 - https://github.com/abrignoni/aleapp/pull/669
@@ -145224,6 +145480,7 @@ CVE-2026-4493 - https://github.com/lilukun337/cve/issues/5
 CVE-2026-44941 - https://bugzilla.suse.com/show_bug.cgi?id=1267426
 CVE-2026-4496 - https://github.com/sigmade/Git-MCP-Server/issues/1
 CVE-2026-44966 - https://github.com/shepherdwind/velocity.js/security/advisories/GHSA-j658-c2gf-x6pq
+CVE-2026-44967 - https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-w8rr-5gcm-pp58
 CVE-2026-44988 - https://github.com/LibVNC/libvncserver/security/advisories/GHSA-jcc5-8wj4-7c58
 CVE-2026-4500 - https://github.com/bagofwords1/bagofwords/issues/60
 CVE-2026-45007 - https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-rm98-82fr-mcfx
@@ -145441,14 +145698,28 @@ CVE-2026-4632 - https://github.com/chuxina7-aiguo/CVE1/issues/1
 CVE-2026-46323 - https://bugzilla.redhat.com/show_bug.cgi?id=2479832
 CVE-2026-46333 - http://www.openwall.com/lists/oss-security/2026/05/20/16
 CVE-2026-4635 - https://mattermost.com/security-updates
+CVE-2026-46360 - https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-whqh-9pq5-c7r3
+CVE-2026-46366 - https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-99qv-g4x9-mgc3
 CVE-2026-46368 - https://www.exploit-db.com/exploits/52521
+CVE-2026-46372 - https://github.com/SillyTavern/SillyTavern/security/advisories/GHSA-qg89-qwwh-5f3j
 CVE-2026-46385 - https://github.com/iskorotkov/avro/security/advisories/GHSA-w8j3-pq8g-8m7w
+CVE-2026-46390 - https://github.com/haxtheweb/issues/security/advisories/GHSA-6434-8rch-w65c
+CVE-2026-46392 - https://github.com/haxtheweb/issues/security/advisories/GHSA-hg33-w4j2-95qp
+CVE-2026-46395 - https://github.com/haxtheweb/issues/security/advisories/GHSA-6c8g-9hfh-pq5h
 CVE-2026-46397 - https://github.com/haxtheweb/issues/security/advisories/GHSA-7fr7-h4p3-jjr8
+CVE-2026-46408 - https://github.com/givanz/Vvveb/security/advisories/GHSA-rmh2-wv73-xpqh
 CVE-2026-4643 - https://mattermost.com/security-updates
 CVE-2026-46448 - https://bugs.launchpad.net/nova/+bug/2151252
 CVE-2026-4646 - https://mattermost.com/security-updates
+CVE-2026-46529 - https://github.com/mate-desktop/atril/security/advisories/GHSA-vgv2-m826-8f6f
 CVE-2026-46606 - https://github.com/nicolargo/glances/security/advisories/GHSA-v5r2-qh84-fjx5
+CVE-2026-46611 - https://github.com/nicolargo/glances/security/advisories/GHSA-w856-8p3r-p338
 CVE-2026-46643 - https://github.com/KnpLabs/snappy/security/advisories/GHSA-vpr4-p6fq-85jc
+CVE-2026-46657 - https://github.com/bludit/bludit/security/advisories/GHSA-ggqg-xvx6-hgwh
+CVE-2026-46673 - https://github.com/Eugeny/russh/security/advisories/GHSA-g9f8-wqj9-fjw5
+CVE-2026-46689 - https://github.com/kanidm/kanidm/security/advisories/GHSA-r5fr-9gmv-jggh
+CVE-2026-46695 - https://github.com/boxlite-ai/boxlite/security/advisories/GHSA-g6ww-w5j2-r7x3
+CVE-2026-46697 - https://github.com/stefanbohacek/fediverse-embeds-wordpress-plugin/security/advisories/GHSA-mpq6-hjh3-m543
 CVE-2026-4673 - https://issues.chromium.org/issues/485397284
 CVE-2026-4674 - https://issues.chromium.org/issues/488188166
 CVE-2026-4675 - https://issues.chromium.org/issues/488270257
@@ -145827,17 +146098,40 @@ CVE-2026-50889 - https://gist.github.com/pyuysig/41937c47514ff63d66a3be98ab8e8a7
 CVE-2026-50890 - https://gist.github.com/pyuysig/92e631298ec28d3e6967ad1f2038e75d
 CVE-2026-50891 - https://gist.github.com/pyuysig/50dc365f54f95396bb67532f02b34bb0
 CVE-2026-50892 - https://gist.github.com/pyuysig/2a581564816d0f9240a03bc2d5ce7356
+CVE-2026-51218 - https://github.com/davenardella/snap7/issues/14
+CVE-2026-51219 - https://github.com/mz-automation/lib60870/issues/196
+CVE-2026-51221 - https://github.com/EIPStackGroup/OpENer/issues/567
 CVE-2026-5146 - https://devolutions.net/security/advisories/DEVO-2026-0012
 CVE-2026-5147 - https://vuldb.com/submit/780191
+CVE-2026-51535 - https://github.com/EIPStackGroup/OpENer/issues/562
+CVE-2026-51536 - https://github.com/EIPStackGroup/OpENer/issues/563
+CVE-2026-51537 - https://github.com/EIPStackGroup/OpENer/issues/564
+CVE-2026-51538 - https://github.com/EIPStackGroup/OpENer/issues/565
+CVE-2026-51539 - https://github.com/stephane/libmodbus/issues/843
+CVE-2026-51540 - https://github.com/EIPStackGroup/OpENer/issues/568
+CVE-2026-51541 - https://github.com/EIPStackGroup/OpENer/issues/582
 CVE-2026-5157 - https://vuldb.com/vuln/354189
 CVE-2026-5157 - https://vuldb.com/vuln/354189/cti
+CVE-2026-51597 - https://github.com/kkkk2222874/cve_ID_report/blob/main/MERCURY_MIPC252W/MERCURY_MIPC252W_5th/README.md
+CVE-2026-51598 - https://github.com/kkkk2222874/cve_ID_report/blob/main/MERCURY_MIPC252W/MERCURY_MIPC252W_6th/README.md
+CVE-2026-51599 - https://github.com/kkkk2222874/cve_ID_report/blob/main/MERCURY_MIPC252W/MERCURY_MIPC252W_7th/README.md
+CVE-2026-51600 - https://github.com/kkkk2222874/cve_ID_report/blob/main/Tenda_CP3_V3.0/Tenda_CP3_V3.0/Tenda_CP3_V3.0_1th/README.md
+CVE-2026-51601 - https://github.com/kkkk2222874/cve_ID_report/blob/main/Tenda_CP3_V3.0/Tenda_CP3_V3.0_2th/README.md
+CVE-2026-51602 - https://github.com/kkkk2222874/cve_ID_report/blob/main/Tenda_CP3_V3.0/Tenda_CP3_V3.0_3th/README.md
+CVE-2026-51603 - https://github.com/kkkk2222874/cve_ID_report/blob/main/Tenda_CP3_V3.0/Tenda_CP3_V3.0_4th/README.md
+CVE-2026-51604 - https://github.com/kkkk2222874/cve_ID_report/blob/main/Tenda_CP3_V3.0/Tenda_CP3_V3.0_6th/README.md
+CVE-2026-51605 - https://github.com/kkkk2222874/cve_ID_report/blob/main/Tenda_CP3_V3.0/Tenda_CP3_V3.0_7th/README.md
+CVE-2026-51606 - https://github.com/kkkk2222874/cve_ID_report/blob/main/Tenda_CP3_V3.0/Tenda_CP3_V3.0_5th/README.md
 CVE-2026-5163 - https://mattermost.com/security-updates
 CVE-2026-5171 - https://devolutions.net/security/advisories/DEVO-2026-0013/
 CVE-2026-5175 - https://devolutions.net/security/advisories/DEVO-2026-0010
 CVE-2026-5178 - https://vuldb.com/submit/779147
+CVE-2026-51821 - https://github.com/sign9981/CVE/issues/2
 CVE-2026-51843 - https://www.kdev.site/cve-request_008/
 CVE-2026-51844 - https://www.kdev.site/cve-request_006/
 CVE-2026-51846 - https://www.kdev.site/cve-request_005/
+CVE-2026-51937 - https://gist.github.com/Passwords404/2599df955cdb36b36b9551b5b7809114
+CVE-2026-51937 - https://github.com/zhangyd-c/OneBlog/issues/43
 CVE-2026-51946 - https://blog.silentgrid.com/ai-assisted-penetration-testing-in-practice/
 CVE-2026-5248 - https://thinhneee.github.io/posts/gougu-mass-assign/
 CVE-2026-5249 - https://thinhneee.github.io/posts/gougu-blind-xss/
@@ -145845,6 +146139,7 @@ CVE-2026-5251 - https://github.com/CC-T-454455/Vulnerabilities/tree/master/z9527
 CVE-2026-5251 - https://vuldb.com/vuln/354441
 CVE-2026-5251 - https://vuldb.com/vuln/354441/cti
 CVE-2026-5252 - https://github.com/CC-T-454455/Vulnerabilities/tree/master/z9527-admin/vulnerability-10
+CVE-2026-52533 - https://zuh.re/cve/2026-52533/
 CVE-2026-5272 - https://issues.chromium.org/issues/491732188
 CVE-2026-52726 - https://github.com/jelmer/dulwich/security/advisories/GHSA-gfhv-vqv2-4544
 CVE-2026-5273 - https://issues.chromium.org/issues/493952652
@@ -145993,6 +146288,8 @@ CVE-2026-58057 - https://www.vulncheck.com/advisories/flowise-custom-mcp-environ
 CVE-2026-58058 - https://www.vulncheck.com/advisories/nmap-integer-underflow-in-ipv6-extension-header-parsing
 CVE-2026-58225 - https://cna.erlef.org/cves/CVE-2026-58225.html
 CVE-2026-58226 - https://cna.erlef.org/cves/CVE-2026-58226.html
+CVE-2026-58228 - https://cna.erlef.org/cves/CVE-2026-58228.html
+CVE-2026-58229 - https://cna.erlef.org/cves/CVE-2026-58229.html
 CVE-2026-5823 - https://github.com/ltranquility/cve_submit/issues/14
 CVE-2026-5844 - https://files.catbox.moe/ei31k1.zip
 CVE-2026-58459 - https://gitlab.com/gpsd/gpsd/-/work_items/404#note_3534119267
@@ -146023,6 +146320,7 @@ CVE-2026-5886 - https://issues.chromium.org/issues/485397283
 CVE-2026-5887 - https://issues.chromium.org/issues/486079015
 CVE-2026-5888 - https://issues.chromium.org/issues/486506202
 CVE-2026-5891 - https://issues.chromium.org/issues/487471101
+CVE-2026-5892 - https://issues.chromium.org/issues/487568011
 CVE-2026-5893 - https://issues.chromium.org/issues/487768771
 CVE-2026-5894 - https://issues.chromium.org/issues/481882038
 CVE-2026-5896 - https://issues.chromium.org/issues/40064543
@@ -146053,6 +146351,7 @@ CVE-2026-59216 - https://github.com/open-webui/open-webui/security/advisories/GH
 CVE-2026-59219 - https://github.com/open-webui/open-webui/security/advisories/GHSA-855v-hq7w-jmjw
 CVE-2026-59220 - https://github.com/open-webui/open-webui/security/advisories/GHSA-ffpj-xv5c-p3gw
 CVE-2026-59227 - https://github.com/open-webui/open-webui/security/advisories/GHSA-rqj7-6wrp-6g2g
+CVE-2026-59246 - https://cna.erlef.org/cves/CVE-2026-59246.html
 CVE-2026-5936 - https://www.foxit.com/support/security-bulletins.html
 CVE-2026-5937 - https://www.foxit.com/support/security-bulletins.html
 CVE-2026-5938 - https://www.foxit.com/support/security-bulletins.html
@@ -146088,6 +146387,7 @@ CVE-2026-6007 - https://github.com/ltranquility/submit/issues/8
 CVE-2026-6007 - https://vuldb.com/submit/794604
 CVE-2026-6010 - https://github.com/xue-p123/vuldb-research/issues/2
 CVE-2026-6011 - https://github.com/zast-ai/vulnerability-reports/blob/main/openclaw/ssrf.md
+CVE-2026-60121 - https://damiri.fr/en/cve/CVE-2026-60121
 CVE-2026-6026 - https://github.com/Litengzheng/vuldb_new/blob/main/A7100RU/vul_171/README.md
 CVE-2026-6027 - https://github.com/Litengzheng/vuldb_new/blob/main/A7100RU/vul_172/README.md
 CVE-2026-6029 - https://github.com/Litengzheng/vuldb_new/blob/main/A7100RU/vul_174/README.md
@@ -146115,14 +146415,41 @@ CVE-2026-6124 - https://vuldb.com/vuln/356987/cti
 CVE-2026-6125 - https://vuldb.com/vuln/356989/cti
 CVE-2026-6130 - https://github.com/chatboxai/chatbox/issues/3627
 CVE-2026-6130 - https://github.com/chatboxai/chatbox/issues/3627#issue-4193060116
+CVE-2026-61343 - https://github.com/LibreBooking/librebooking/commit/cb9b7ad9da0243bd105809f6a4a8a6b9147c71ea
 CVE-2026-6135 - https://vuldb.com/submit/792877
 CVE-2026-6139 - https://github.com/Litengzheng/vuldb_new/blob/main/A7100RU/vul_192/README.md
 CVE-2026-6140 - https://github.com/Litengzheng/vuldb_new/blob/main/A7100RU/vul_193/README.md
 CVE-2026-6142 - https://gist.github.com/freeloader9527/a9ab20c922c6aa2b3eabf93e01a40f6b
 CVE-2026-6142 - https://github.com/tushar-2223/Hotel-Management-System/issues/15
+CVE-2026-61426 - https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-6wjp-v33h-5cvq
+CVE-2026-61428 - https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-qj9c-59p6-8cgx
+CVE-2026-61429 - https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-6g59-gm2v-qhvq
 CVE-2026-6143 - https://github.com/farion1231/cc-switch/issues/1841
 CVE-2026-6143 - https://github.com/farion1231/cc-switch/issues/1841#issue-4191294952
 CVE-2026-6143 - https://vuldb.com/vuln/357007/cti
+CVE-2026-61431 - https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-q7m5-3jmv-vm48
+CVE-2026-61432 - https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-4xxv-6wmf-xf45
+CVE-2026-61434 - https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-cv3g-hj65-pcfh
+CVE-2026-61437 - https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-4gfv-wg42-7jw5
+CVE-2026-61439 - https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-fj8f-m44g-c479
+CVE-2026-61441 - https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-mxmx-rh57-jx58
+CVE-2026-61442 - https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-c78w-2q4r-68r7
+CVE-2026-61444 - https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-g6j7-pffp-8whg
+CVE-2026-61445 - https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-9mp3-24cc-77mg
+CVE-2026-61447 - https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-2xv2-w8cq-5gxw
+CVE-2026-61450 - https://github.com/getgrav/grav/security/advisories/GHSA-mc5q-6hpj-rp7j
+CVE-2026-61454 - https://github.com/getgrav/grav/security/advisories/GHSA-pfjq-chp8-3vgh
+CVE-2026-61455 - https://github.com/getgrav/grav/security/advisories/GHSA-928x-9mpw-8h56
+CVE-2026-61456 - https://github.com/getgrav/grav/security/advisories/GHSA-7vhm-8x52-2r5p
+CVE-2026-61458 - https://github.com/pglombardo/PasswordPusher/security/advisories/GHSA-59w3-h5v2-c4xw
+CVE-2026-61459 - https://github.com/Flux159/mcp-server-kubernetes/commit/d7890f50a4567bf5d9842541ba6f41e180227f9a
+CVE-2026-61459 - https://github.com/Flux159/mcp-server-kubernetes/issues/328
+CVE-2026-61459 - https://github.com/Flux159/mcp-server-kubernetes/pull/329
+CVE-2026-61460 - https://github.com/krayin/laravel-crm/issues/2559
+CVE-2026-61461 - https://github.com/langgenius/dify/issues/38281
+CVE-2026-61462 - https://github.com/zereight/gitlab-mcp/issues/587
+CVE-2026-61463 - https://github.com/go-shiori/shiori/issues/1196
+CVE-2026-61498 - https://damiri.fr/en/cve/CVE-2026-61498
 CVE-2026-6150 - https://github.com/zheng-lv/CVE-/issues/1
 CVE-2026-6153 - https://github.com/zheng-lv/CVE-/issues/4
 CVE-2026-6157 - https://github.com/xyh4ck/iot_poc/blob/main/TOTOLINK/A800R/01_Buffer_Overflow_setAppEasyWizardConfig.md
@@ -146132,6 +146459,8 @@ CVE-2026-6165 - https://github.com/realnotjoking/cve/issues/2
 CVE-2026-6167 - https://github.com/wfcht-sy/src/issues/1
 CVE-2026-6182 - https://github.com/Xmyronn/simple-cms-sqli-login-bypass-CVE-HUNT-
 CVE-2026-6187 - https://github.com/lingzezzz/lingze/issues/3
+CVE-2026-61875 - https://github.com/openwrt/luci/security/advisories/GHSA-8v49-6387-7f89
+CVE-2026-61876 - https://github.com/openwrt/luci/security/advisories/GHSA-686p-p8p9-x6fh
 CVE-2026-6188 - https://github.com/lingzezzz/lingze/issues/2
 CVE-2026-6190 - https://github.com/ltranquility/cve_submit/issues/15
 CVE-2026-6191 - https://github.com/ltranquility/cve_submit/issues/16
@@ -146532,6 +146861,7 @@ CVE-2026-7900 - https://issues.chromium.org/issues/496503799
 CVE-2026-7901 - https://issues.chromium.org/issues/497724490
 CVE-2026-7903 - https://issues.chromium.org/issues/491760376
 CVE-2026-7904 - https://issues.chromium.org/issues/492350406
+CVE-2026-7907 - https://issues.chromium.org/issues/496292089
 CVE-2026-7909 - https://issues.chromium.org/issues/497437113
 CVE-2026-7914 - https://issues.chromium.org/issues/498401609
 CVE-2026-7916 - https://issues.chromium.org/issues/498720754
@@ -146558,13 +146888,16 @@ CVE-2026-7967 - https://issues.chromium.org/issues/497365545
 CVE-2026-7969 - https://issues.chromium.org/issues/497450574
 CVE-2026-7971 - https://issues.chromium.org/issues/497529290
 CVE-2026-7974 - https://issues.chromium.org/issues/497649372
+CVE-2026-7976 - https://issues.chromium.org/issues/497736679
 CVE-2026-7977 - https://issues.chromium.org/issues/497821223
 CVE-2026-7980 - https://issues.chromium.org/issues/497859275
 CVE-2026-7982 - https://issues.chromium.org/issues/497952533
+CVE-2026-7985 - https://issues.chromium.org/issues/498352423
 CVE-2026-7986 - https://issues.chromium.org/issues/498396238
 CVE-2026-7988 - https://issues.chromium.org/issues/498753456
 CVE-2026-7992 - https://issues.chromium.org/issues/499067529
 CVE-2026-8000 - https://issues.chromium.org/issues/494464734
+CVE-2026-8001 - https://issues.chromium.org/issues/494764371
 CVE-2026-8007 - https://issues.chromium.org/issues/496399759
 CVE-2026-8008 - https://issues.chromium.org/issues/496426191
 CVE-2026-8011 - https://issues.chromium.org/issues/496626029
@@ -146625,6 +146958,7 @@ CVE-2026-8509 - https://issues.chromium.org/issues/493310462
 CVE-2026-8523 - https://issues.chromium.org/issues/483956252
 CVE-2026-8529 - https://issues.chromium.org/issues/490222151
 CVE-2026-8531 - https://issues.chromium.org/issues/492350403
+CVE-2026-8533 - https://issues.chromium.org/issues/495247950
 CVE-2026-8547 - https://issues.chromium.org/issues/497632199
 CVE-2026-8548 - https://issues.chromium.org/issues/497821764
 CVE-2026-8553 - https://issues.chromium.org/issues/498715368