CVE-2026-6574
(7.3 HIGH)

EPSS: 0.00%

updated 2026-04-19T14:16:11.593000

2 posts

A vulnerability has been found in osuuu LightPicture up to 1.2.2. This issue affects some unknown processing of the file /public/install/lp.sql of the component API Upload Endpoint. Such manipulation of the argument key leads to hard-coded credentials. The attack may be performed from remote. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this di

CVE-2026-6573
(6.3 MEDIUM)

EPSS: 0.00%

updated 2026-04-19T13:16:46.187000

2 posts

A vulnerability was detected in PHPEMS 11.0. This affects the function temppage of the file /app/exam/controller/exams.master.php of the component Instant Exam Creation Handler. The manipulation of the argument uploadfile results in server-side request forgery. The attack can be executed remotely. The exploit is now public and may be used.

CVE-2026-6572
(5.6 MEDIUM)

EPSS: 0.00%

updated 2026-04-19T13:16:45.650000

2 posts

A security vulnerability has been detected in Collabora KodExplorer up to 4.52. Affected by this issue is some unknown functionality of the file /app/controller/share.class.php of the component fileUpload Endpoint. The manipulation of the argument fileUpload leads to improper authorization. Remote exploitation of the attack is possible. The attack's complexity is rated as high. The exploitation is

CVE-2026-6570
(2.7 LOW)

EPSS: 0.02%

updated 2026-04-19T12:31:16

2 posts

A security flaw has been discovered in kodcloud KodExplorer up to 4.52. Affected is the function initInstall of the file /app/controller/systemMember.class.php. Performing a manipulation of the argument path results in authorization bypass. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclo

CVE-2026-6568
(7.3 HIGH)

EPSS: 0.09%

updated 2026-04-19T12:31:16

2 posts

A vulnerability was determined in kodcloud KodExplorer up to 4.52. This affects the function share.class.php::initShareOld of the file /app/controller/share.class.php of the component Public Share Handler. This manipulation of the argument path causes path traversal. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early ab

CVE-2026-6563
(8.8 HIGH)

EPSS: 0.04%

updated 2026-04-19T09:30:21

4 posts

A vulnerability has been found in H3C Magic B1 up to 100R004. The affected element is the function SetAPWifiorLedInfoById of the file /goform/aspForm. The manipulation of the argument param leads to buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond i

CVE-2026-6560
(8.8 HIGH)

EPSS: 0.04%

updated 2026-04-19T09:30:21

4 posts

A security vulnerability has been detected in H3C Magic B0 up to 100R002. This vulnerability affects the function Edit_BasicSSID of the file /goform/aspForm. Such manipulation of the argument param leads to buffer overflow. The attack can be executed remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any wa

CVE-2026-0868
(6.4 MEDIUM)

EPSS: 0.01%

updated 2026-04-19T06:31:30

2 posts

The EMC – Easily Embed Calendly Scheduling Features plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's calendly shortcode in all versions up to, and including, 4.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web

CVE-2026-41113
(8.1 HIGH)

EPSS: 0.10%

updated 2026-04-18T21:16:09.427000

1 posts

sagredo qmail before 2026.04.07 allows tls_quit remote code execution because of popen in notlshosts_auto in qmail-remote.c.

CVE-2026-41242(CVSS UNKNOWN)

EPSS: 0.05%

updated 2026-04-18T16:18:24

4 posts

### Summary protobufjs compiles protobuf definitions into JS functions. Attackers can manipulate these definitions to execute arbitrary JS code. ### Details Attackers can inject arbitrary code in the "type" fields of protobuf definitions, which will then execute during object decoding using that definition. ### PoC ```js const protobuf = require('protobufjs'); maliciousDescriptor = JSON.parse(`{

CVE-2026-2986
(6.4 MEDIUM)

EPSS: 0.01%

updated 2026-04-18T12:30:17

2 posts

The Contextual Related Posts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'other_attributes' parameter in versions up to, and including, 4.2.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user

1 repos

https://github.com/amanyadav78/CVE-2026-29861

CVE-2026-2505
(5.4 MEDIUM)

EPSS: 0.03%

updated 2026-04-18T10:16:12.823000

2 posts

The Categories Images plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 3.3.1, via the 'z_taxonomy_image' shortcode. This is due to the shortcode rendering path passing attacker-controlled class input into a fallback image builder that concatenates HTML attributes without proper escaping. This makes it possible for authenticated attackers, with Con

2 repos

https://github.com/yadhukrishnam/CVE-2026-25053

https://github.com/Christbowel/CVE-2026-25050

CVE-2026-5426
(7.5 HIGH)

EPSS: 0.05%

updated 2026-04-18T06:31:20

2 posts

Hard-coded ASP.NET/IIS machineKey value in Digital Knowledge KnowledgeDeliver deployments prior to February 24, 2026 allows adversaries to circumvent ViewState validation mechanisms and achieve remote code execution via malicious ViewState deserialization attacks

CVE-2026-6518
(8.8 HIGH)

EPSS: 0.07%

updated 2026-04-18T06:30:19

3 posts

The CMP – Coming Soon & Maintenance Plugin by NiteoThemes plugin for WordPress is vulnerable to arbitrary file upload and remote code execution in all versions up to, and including, 4.1.16 via the `cmp_theme_update_install` AJAX action. This is due to the function only checking for the `publish_pages` capability (available to Editors and above) instead of `manage_options` (Administrators only), co

CVE-2026-31987
(7.5 HIGH)

EPSS: 0.03%

updated 2026-04-18T04:16:15.517000

1 posts

JWT Tokens used by tasks were exposed in logs. This could allow UI users to act as Dag Authors. Users are advised to upgrade to Airflow version that contains fix. Users are recommended to upgrade to version 3.2.0, which fixes this issue.

CVE-2026-40493
(9.8 CRITICAL)

EPSS: 0.04%

updated 2026-04-18T03:16:13.440000

2 posts

SAIL is a cross-platform library for loading and saving images with support for animation, metadata, and ICC profiles. Prior to commit c930284445ea3ff94451ccd7a57c999eca3bc979, the PSD codec computes bytes-per-pixel (`bpp`) from raw header fields `channels * depth`, but the pixel buffer is allocated based on the resolved pixel format. For LAB mode with `channels=3, depth=16`, `bpp = (3*16+7)/8 = 6

CVE-2026-40487
(8.9 HIGH)

EPSS: 0.02%

updated 2026-04-18T02:16:11.670000

2 posts

Postiz is an AI social media scheduling tool. Prior to version 2.21.6, a file upload validation bypass allows any authenticated user to upload arbitrary HTML, SVG, or other executable file types to the server by spoofing the `Content-Type` header. The uploaded files are then served by nginx with a Content-Type derived from their original extension (`text/html`, `image/svg+xml`), enabling Stored Cr

1 repos

https://github.com/Astaruf/CVE-2026-40487

CVE-2026-40350
(8.8 HIGH)

EPSS: 0.04%

updated 2026-04-18T01:16:19.527000

1 posts

Movary is a self hosted web app to track and rate a user's watched movies. Prior to version 0.71.1, an ordinary authenticated user can access the user-management endpoints `/settings/users` and use them to enumerate all users and create a new administrator account. This happens because the route definitions do not enforce admin-only middleware, and the controller-level authorization check uses a b

CVE-2026-5807
(7.5 HIGH)

EPSS: 0.01%

updated 2026-04-18T00:53:52

1 posts

Vault is vulnerable to a denial-of-service condition where an unauthenticated attacker can repeatedly initiate or cancel root token generation or rekey operations, occupying the single in-progress operation slot. This prevents legitimate operators from completing these workflows. This vulnerability, CVE-2026-5807, is fixed in Vault Community Edition 2.0.0 and Vault Enterprise 2.0.0.

CVE-2026-3605
(8.1 HIGH)

EPSS: 0.01%

updated 2026-04-18T00:51:52

1 posts

An authenticated user with access to a kvv2 path through a policy containing a glob may be able to delete secrets they were not authorized to read or write, resulting in denial-of-service. This vulnerability did not allow a malicious user to delete secrets across namespaces, nor read any secret data. Fixed in Vault Community Edition 2.0.0 and Vault Enterprise 2.0.0, 1.21.5, 1.20.10, and 1.19.16.

CVE-2026-2262
(7.5 HIGH)

EPSS: 0.04%

updated 2026-04-18T00:31:10

1 posts

The Easy Appointments plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.12.21 via the `/wp-json/wp/v2/eablocks/ea_appointments/` REST API endpoint. This is due to the endpoint being registered with `'permission_callback' => '__return_true'`, which allows access without any authentication or authorization checks. This makes it possible for

CVE-2026-40581
(8.1 HIGH)

EPSS: 0.01%

updated 2026-04-18T00:16:39.683000

1 posts

ChurchCRM is an open-source church management system. In versions prior to 7.2.0, the family record deletion endpoint (SelectDelete.php) performs permanent, irreversible deletion of family records and all associated data via a plain GET request with no CSRF token validation. An attacker can craft a malicious page that, when visited by an authenticated administrator, silently triggers deletion of t

CVE-2026-40474
(7.6 HIGH)

EPSS: 0.03%

updated 2026-04-17T22:16:33.213000

1 posts

wger is a free, open-source workout and fitness manager. In versions 2.5 and below, the GymConfigUpdateView declares permission_required = 'config.change_gymconfig' but inherits WgerFormMixin instead of WgerPermissionMixin, so the permission is never enforced at runtime. Since GymConfig is an ownerless singleton, any authenticated user can modify the global gym configuration, triggering save() sid

CVE-2026-40352
(8.8 HIGH)

EPSS: 0.03%

updated 2026-04-17T22:16:32.940000

2 posts

FastGPT is an AI Agent building platform. In versions prior to 4.14.9.5, the password change endpoint is vulnerable to NoSQL injection. An authenticated attacker can bypass the "old password" verification by injecting MongoDB query operators. This allows an attacker who has gained a low-privileged session to change the password of their account (or others if combined with ID manipulation) without

CVE-2026-40321
(8.0 HIGH)

EPSS: 0.04%

updated 2026-04-17T22:16:32.653000

1 posts

DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Prior to version 10.2.2, a user could upload a specially crafted SVG file that could include scripts that can target both authenticated and unauthenticated DNN users. The impact is increased if the scripts are run by a power user. Version 10.2.2 patches the issue.

CVE-2026-32324
(7.7 HIGH)

EPSS: 0.01%

updated 2026-04-17T21:31:53

1 posts

Anviz CX7 Firmware is  vulnerable because the application embeds reusable certificate/key material, enabling decryption of MQTT traffic and potential interaction with device messaging channels at scale.

CVE-2026-32650
(7.5 HIGH)

EPSS: 0.02%

updated 2026-04-17T21:31:53

1 posts

Anviz CrossChex Standard is vulnerable when an attacker manipulates the TDS7 PreLogin to disable encryption, causing database credentials to be sent in plaintext and enabling unauthorized database access.

CVE-2026-40066
(8.8 HIGH)

EPSS: 0.03%

updated 2026-04-17T21:31:53

1 posts

Anviz CX2 Lite and CX7 are vulnerable to unverified update packages that can be uploaded. The device unpacks and executes a script resulting in unauthenticated remote code execution.

CVE-2026-35546
(9.8 CRITICAL)

EPSS: 0.06%

updated 2026-04-17T21:31:53

2 posts

Anviz CX2 Lite and CX7 are vulnerable to unauthenticated firmware uploads. This causes crafted archives to be accepted, enabling attackers to plant and execute code and obtain a reverse shell.

CVE-2026-40461
(7.5 HIGH)

EPSS: 0.03%

updated 2026-04-17T21:31:53

1 posts

Anviz CX2 Lite and CX7 are vulnerable to unauthenticated POST requests that modify debug settings (e.g., enabling SSH), allowing unauthorized state changes that can facilitate later compromise.

CVE-2026-40525
(9.1 CRITICAL)

EPSS: 0.11%

updated 2026-04-17T21:31:53

1 posts

OpenViking prior to commit c7bb167 contains an authentication bypass vulnerability in the VikingBot OpenAPI HTTP route surface where the authentication check fails open when the api_key configuration value is unset or empty. Remote attackers with network access to the exposed service can invoke privileged bot-control functionality without providing a valid X-API-Key header, including submitting at

CVE-2026-40527
(7.8 HIGH)

EPSS: 0.03%

updated 2026-04-17T21:16:35.373000

1 posts

radare2 prior to commit bc5a890 contains a command injection vulnerability in the afsv/afsvj command path where crafted ELF binaries can embed malicious r2 command sequences as DWARF DW_TAG_formal_parameter names. Attackers can craft a binary with shell commands in DWARF parameter names that execute when radare2 analyzes the binary with aaa and subsequently runs afsvj, allowing arbitrary shell com

CVE-2026-40434
(8.1 HIGH)

EPSS: 0.02%

updated 2026-04-17T20:16:36.083000

1 posts

Anviz CrossChex Standard lacks source verification in the client/server channel, enabling TCP packet injection by an attacker on the same network to alter or disrupt application traffic.

CVE-2026-40342
(9.9 CRITICAL)

EPSS: 0.08%

updated 2026-04-17T20:16:35.930000

2 posts

Firebird is an open-source relational database management system. In versions prior to 5.0.4, 4.0.7 and 3.0.14, the external engine plugin loader concatenates a user-supplied engine name into a filesystem path without filtering path separators or .. components. An authenticated user with CREATE FUNCTION privileges can use a crafted ENGINE name to load an arbitrary shared library from anywhere on t

CVE-2026-35682
(8.8 HIGH)

EPSS: 0.26%

updated 2026-04-17T20:16:35.510000

1 posts

Anviz CX2 Lite is vulnerable to an authenticated command injection via a filename parameter that enables arbitrary command execution (e.g., starting telnetd), resulting in root‑level access.

CVE-2026-34232
(7.5 HIGH)

EPSS: 0.04%

updated 2026-04-17T20:16:34.977000

1 posts

Firebird is an open-source relational database management system. In versions prior to 5.0.4, 4.0.7 and 3.0.14, the xdr_status_vector() function does not handle the isc_arg_cstring type when decoding an op_response packet, causing a server crash when one is encountered in the status vector. An unauthenticated attacker can exploit this by sending a crafted op_response packet to the server. This iss

CVE-2026-33337
(7.5 HIGH)

EPSS: 0.04%

updated 2026-04-17T19:16:36.223000

1 posts

Firebird is an open-source relational database management system. In versions prior to 5.0.4, 4.0.7 and 3.0.14, when deserializing a slice packet, the xdr_datum() function does not validate that a cstring length conforms to the slice descriptor bounds, allowing a cstring longer than the allocated buffer to overflow it. An unauthenticated attacker can exploit this by sending a crafted packet to the

CVE-2025-65104
(7.9 HIGH)

EPSS: 0.01%

updated 2026-04-17T19:01:56.030000

1 posts

Firebird is an open-source relational database management system. In versions FB3 of the client library placed incorrect data length values into XSQLDA fields when communicating with FB4 or higher servers, resulting in an information leak. This issue is fixed by upgrading to the FB4 client or higher.

CVE-2026-40516
(8.3 HIGH)

EPSS: 0.04%

updated 2026-04-17T19:01:56.030000

1 posts

OpenHarness before commit bd4df81 contains a server-side request forgery vulnerability in the web_fetch and web_search tools that allows attackers to access private and localhost HTTP services by manipulating tool parameters without proper validation of target addresses. Attackers can influence an agent session to invoke these tools against loopback, RFC1918, link-local, or other non-public addres

CVE-2026-37749
(9.8 CRITICAL)

EPSS: 0.11%

updated 2026-04-17T18:32:56

2 posts

A SQL injection vulnerability in CodeAstro Simple Attendance Management System v1.0 allows remote unauthenticated attackers to bypass authentication via the username parameter in index.php.

1 repos

https://github.com/menevarad007/CVE-2026-37749

CVE-2026-6305
(8.8 HIGH)

EPSS: 0.03%

updated 2026-04-17T18:32:55

1 posts

Heap buffer overflow in PDFium in Google Chrome prior to 147.0.7727.101 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted PDF file. (Chromium security severity: High)

CVE-2026-5718
(8.1 HIGH)

EPSS: 0.12%

updated 2026-04-17T18:32:05

1 posts

The Drag and Drop Multiple File Upload for Contact Form 7 plugin for WordPress is vulnerable to arbitrary file upload in versions up to, and including, 1.3.9.6. This is due to insufficient file type validation that occurs when custom blacklist types are configured, which replaces the default dangerous extension denylist instead of merging with it, and the wpcf7_antiscript_file_name() sanitization

CVE-2026-5710
(7.5 HIGH)

EPSS: 0.11%

updated 2026-04-17T18:31:54

1 posts

The Drag and Drop Multiple File Upload for Contact Form 7 plugin for WordPress is vulnerable to Path Traversal leading to Arbitrary File Read in versions up to and including 1.3.9.6. This is due to the plugin using client-supplied mfile[] POST values as the source of truth for email attachment selection without performing any server-side upload provenance check, path canonicalization, or directory

CVE-2026-3464
(8.8 HIGH)

EPSS: 0.34%

updated 2026-04-17T18:31:53

1 posts

The WP Customer Area plugin for WordPress is vulnerable to arbitrary file read and deletion due to insufficient file path validation in the 'ajax_attach_file' function in all versions up to, and including, 8.3.4. This makes it possible for authenticated attackers with a role that an administrator grants access to (e.g., Subscriber) to to read the contents of arbitrary files on the server, which ca

CVE-2026-40515
(7.5 HIGH)

EPSS: 0.03%

updated 2026-04-17T18:31:53

1 posts

OpenHarness before commit bd4df81 contains a permission bypass vulnerability that allows attackers to read sensitive files by exploiting incomplete path normalization in the permission checker. Attackers can invoke the built-in grep and glob tools with sensitive root directories that are not properly evaluated against configured path rules, allowing disclosure of sensitive local file content, key

CVE-2026-6284
(9.1 CRITICAL)

EPSS: 0.03%

updated 2026-04-17T18:31:52

3 posts

An attacker with network access to the PLC is able to brute force discover passwords to gain unauthorized access to systems and services. The limited password complexity and no password input limiters makes brute force password enumeration possible.

CVE-2026-6307
(8.8 HIGH)

EPSS: 0.03%

updated 2026-04-17T17:27:07.873000

1 posts

Type Confusion in Turbofan in Google Chrome prior to 147.0.7727.101 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

CVE-2026-33435
(8.0 HIGH)

EPSS: 0.33%

updated 2026-04-17T15:38:09.243000

1 posts

Weblate is a web based localization tool. In versions prior to 5.17, the project backup didn't filter Git and Mercurial configuration files which could lead to remote code execution under certain circumstances. This issue has been fixed in version 5.17. If developers are unable to update immediately, they can limit the scope of the vulnerability by restricting access to the project backup, as it i

CVE-2026-34393
(8.8 HIGH)

EPSS: 0.04%

updated 2026-04-17T15:38:09.243000

1 posts

Weblate is a web based localization tool. In versions prior to 5.17, the user patching API endpoint didn't properly limit the scope of edits. This issue has been fixed in version 5.17.

CVE-2026-40318
(8.5 HIGH)

EPSS: 0.06%

updated 2026-04-17T15:38:09.243000

1 posts

SiYuan is an open-source personal knowledge management system. In versions 3.6.3 and prior, the /api/av/removeUnusedAttributeView endpoint constructs a filesystem path using the user-controlled id parameter without validation or path boundary enforcement. An attacker can inject path traversal sequences such as ../ into the id value to escape the intended directory and delete arbitrary .json files

CVE-2026-6442
(8.3 HIGH)

EPSS: 0.07%

updated 2026-04-17T15:38:09.243000

1 posts

Improper validation of bash commands in Snowflake Cortex Code CLI versions prior to 1.0.25 allowed subsequent commands to execute outside the sandbox. An attacker could exploit this by embedding specially crafted commands in untrusted content, such as a malicious repository, causing the CLI agent to execute arbitrary code on the local device without user consent. Exploitation is non-deterministic

CVE-2026-30656
(7.5 HIGH)

EPSS: 0.06%

updated 2026-04-17T15:38:09.243000

1 posts

A NULL pointer dereference vulnerability exists in fio (Flexible I/O Tester) v3.41 when parsing job files containing the fdp_pli option. The callback function str_fdp_pli_cb() does not validate the input pointer and calls strdup() on a NULL value when the option is specified without an argument. This results in a segmentation fault and process crash.

CVE-2026-6507
(7.5 HIGH)

EPSS: 0.11%

updated 2026-04-17T15:31:27

1 posts

A flaw was found in dnsmasq. A remote attacker could exploit an out-of-bounds write vulnerability by sending a specially crafted BOOTREPLY (Bootstrap Protocol Reply) packet to a dnsmasq server configured with the `--dhcp-split-relay` option. This can lead to memory corruption, causing the dnsmasq daemon to crash and resulting in a denial of service (DoS).

CVE-2026-40262
(8.7 HIGH)

EPSS: 0.03%

updated 2026-04-17T15:29:25.583000

2 posts

Note Mark is an open-source note-taking application. In versions 0.19.1 and prior, the asset delivery handler serves uploaded files inline and relies on magic-byte detection for content type, which does not identify text-based formats such as HTML, SVG, or XHTML. These files are served with an empty Content-Type, no X-Content-Type-Options: nosniff header, and inline disposition, allowing browsers

CVE-2026-30625
(9.8 CRITICAL)

EPSS: 0.24%

updated 2026-04-17T15:09:46.880000

1 posts

Upsonic 0.71.6 contains a remote code execution vulnerability in its MCP server/task creation functionality. The application allows users to define MCP tasks with arbitrary command and args values. Although an allowlist exists, certain allowed commands (npm, npx) accept argument flags that enable execution of arbitrary OS commands. Maliciously crafted MCP tasks may lead to remote code execution wi

CVE-2026-30461
(8.3 HIGH)

EPSS: 0.23%

updated 2026-04-17T15:09:46.880000

1 posts

Daylight Studio FuelCMS v1.5.2 was discovered to contain an authenticated remote code execution (RCE) vulnerability via the /controllers/Installer.php and the function add_git_submodule.

CVE-2026-20180
(9.9 CRITICAL)

EPSS: 0.21%

updated 2026-04-17T15:09:46.880000

1 posts

A vulnerability in Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to execute arbitrary commands on the underlying operating system of an affected device. To exploit this vulnerability, the attacker must have at least Read Only Admin credentials. This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnera

CVE-2026-4525
(7.5 HIGH)

EPSS: 0.01%

updated 2026-04-17T15:08:25.183000

1 posts

If a Vault auth mount is configured to pass through the "Authorization" header, and the "Authorization" header is used to authenticate to Vault, Vault forwarded the Vault token to the auth plugin backend. Fixed in 2.0.0, 1.21.5, 1.20.10, and 1.19.16.

CVE-2026-35569
(8.7 HIGH)

EPSS: 0.03%

updated 2026-04-17T15:08:01.337000

1 posts

ApostropheCMS is an open-source Node.js content management system. Versions 4.28.0 and prior contain a stored cross-site scripting vulnerability in SEO-related fields (SEO Title and Meta Description), where user-controlled input is rendered without proper output encoding into HTML contexts including <title> tags, <meta> attributes, and JSON-LD structured data. An attacker can inject a payload such

CVE-2026-23775
(7.6 HIGH)

EPSS: 0.01%

updated 2026-04-17T15:07:18.050000

1 posts

Dell PowerProtect Data Domain appliances with Data Domain Operating System (DD OS) of Feature Release versions 8.0 through 8.5, LTS2025 release version 8.3.1.0 through 8.3.1.10 contain an insertion of sensitive information into log file vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to credential exposures. Authentication attempts

CVE-2026-23853
(8.4 HIGH)

EPSS: 0.01%

updated 2026-04-17T09:31:26

1 posts

Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 7.7.1.0 through 8.5, LTS2025 release version 8.3.1.0 through 8.3.1.20, LTS2024 release versions 7.13.1.0 through 7.13.1.50, contain a use of weak credentials vulnerability. An unauthenticated attacker with local access could potentially exploit this vulnerability, leading to unauthorized access to t

CVE-2025-36568
(7.9 HIGH)

EPSS: 0.01%

updated 2026-04-17T09:31:25

1 posts

Dell PowerProtect Data Domain BoostFS for client of Feature Release versions 7.7.1.0 through 8.5, LTS2025 release version 8.3.1.0 through 8.3.1.20, LTS2024 release versions 7.13.1.0 through 7.13.1.50, contain an insufficiently protected credentials vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to credential exposure. The attacker m

CVE-2026-33392
(7.2 HIGH)

EPSS: 0.00%

updated 2026-04-17T09:31:19

1 posts

In JetBrains YouTrack before 2025.3.131383 high privileged user can achieve RCE via sandbox bypass

CVE-2026-6443
(9.8 CRITICAL)

EPSS: 0.04%

updated 2026-04-17T09:31:18

3 posts

The Accordion and Accordion Slider plugin for WordPress is vulnerable to an injected backdoor in version 1.4.6. This is due to the plugin being sold to a malicious threat actor that embedded a backdoor in all of the plugin's they acquired. This makes it possible for the threat actor to maintain a persistent backdoor and inject spam into the affected sites.

CVE-2026-4659
(7.5 HIGH)

EPSS: 0.03%

updated 2026-04-17T09:31:18

1 posts

The Unlimited Elements for Elementor plugin for WordPress is vulnerable to Arbitrary File Read via the Repeater JSON/CSV URL parameter in versions up to, and including, 2.0.6. This is due to insufficient path traversal sanitization in the URLtoRelative() and urlToPath() functions, combined with the ability to enable debug output in widget settings. The URLtoRelative() function only performs a simp

CVE-2026-21719
(7.2 HIGH)

EPSS: 0.18%

updated 2026-04-17T06:31:14

1 posts

An OS command injection vulnerability exists in CubeCart prior to 6.6.0, which may allow a user with an administrative privilege to execute an arbitrary OS command.

CVE-2026-40324
(9.1 CRITICAL)

EPSS: 0.09%

updated 2026-04-17T06:23:30

2 posts

### Impact Hot Chocolate's `Utf8GraphQLParser` is a recursive descent parser with no recursion depth limit. A crafted GraphQL document with deeply nested selection sets, object values, list values, or list types can trigger a `StackOverflowException` on payloads as small as **40 KB**. Because `StackOverflowException` is **uncatchable in .NET** (since .NET 2.0), the entire worker process is termi

CVE-2026-22734
(8.6 HIGH)

EPSS: 0.01%

updated 2026-04-17T03:30:52

1 posts

Cloud Foundry UUA is vulnerable to a bypass that allows an attacker to obtain a token for any user and gain access to UAA-protected systems. This vulnerability exists when SAML 2.0 bearer assertions are enabled for a client, as the UAA accepts SAML 2.0 bearer assertions that are neither signed nor encrypted. This issue affects UUA from v77.30.0 to v78.7.0 (inclusive) and it affects CF Deployment f

CVE-2026-31843
(9.8 CRITICAL)

EPSS: 0.89%

updated 2026-04-16T22:58:59

1 posts

The goodoneuz/pay-uz Laravel package (<= 2.2.24) contains a critical vulnerability in the /payment/api/editable/update endpoint that allows unauthenticated attackers to overwrite existing PHP payment hook files. The endpoint is exposed via Route::any() without authentication middleware, enabling remote access without credentials. User-controlled input is directly written into executable PHP files

CVE-2026-30778
(7.5 HIGH)

EPSS: 0.03%

updated 2026-04-16T22:57:33

2 posts

The SkyWalking OAP /debugging/config/dump endpoint may leak sensitive configuration information of MySQL/PostgreSQL. This issue affects Apache SkyWalking: from 9.7.0 through 10.3.0. Users are recommended to upgrade to version 10.4.0, which fixes the issue.

CVE-2026-33032
(9.8 CRITICAL)

EPSS: 4.97%

updated 2026-04-16T22:16:37.433000

3 posts

Nginx UI is a web user interface for the Nginx web server. In versions 2.3.5 and prior, the nginx-ui MCP (Model Context Protocol) integration exposes two HTTP endpoints: /mcp and /mcp_message. While /mcp requires both IP whitelisting and authentication (AuthRequired() middleware), the /mcp_message endpoint only applies IP whitelisting - and the default IP whitelist is empty, which the middleware t

Nuclei template

3 repos

https://github.com/Shreda/CVE-2026-33032-nginx-ui-vuln-lab

https://github.com/keraattin/CVE-2026-33032

https://github.com/Twinson333/cve-2026-33032-scanner

CVE-2026-34197
(8.8 HIGH)

EPSS: 46.64%

updated 2026-04-16T21:49:17

8 posts

Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ. Apache ActiveMQ Classic exposes the Jolokia JMX-HTTP bridge at /api/jolokia/ on the web console. The default Jolokia access policy permits exec operations on all ActiveMQ MBeans (org.apache.activemq:*), including BrokerService.addNetworkConnector(String) a

Nuclei template

7 repos

https://github.com/dinosn/CVE-2026-34197

https://github.com/0xBlackash/CVE-2026-34197

https://github.com/hg0434hongzh0/CVE-2026-34197

https://github.com/DEVSECURITYSPRO/CVE-2026-34197

https://github.com/KONDORDEVSECURITYCORP/CVE-2026-34197

https://github.com/AtoposX-J/CVE-2026-34197-Apache-ActiveMQ-RCE

https://github.com/keraattin/CVE-2026-34197

CVE-2025-41118
(9.1 CRITICAL)

EPSS: 0.03%

updated 2026-04-16T21:41:16

1 posts

Pyroscope is an open-source continuous profiling database. The database supports various storage backends, including Tencent Cloud Object Storage (COS). If the database is configured to use Tencent COS as the storage backend, an attacker could extract the secret_key configuration value from the Pyroscope API. To exploit this vulnerability, an attacker needs direct access to the Pyroscope API. We

CVE-2026-6290
(8.1 HIGH)

EPSS: 0.03%

updated 2026-04-16T21:33:30

1 posts

Velociraptor versions prior to 0.76.3 contain a vulnerability in the query() plugin which allows access to all orgs with the user's current ACL token. This allows an authenticated GUI user with access in one org, to use the query() plugin, in a notebook cell, to run VQL queries on other orgs which they may not have access to. The user's permissions in the other org are the same as the permissions

CVE-2026-40303
(7.5 HIGH)

EPSS: 0.06%

updated 2026-04-16T21:09:11

1 posts

**Summary** endpoints.GetSessionCookie parses an attacker-supplied cookie chunk count and calls make([]string, count) with no upper bound before any token validation occurs. The function is reached on every request to an OAuth-protected proxy share, allowing an unauthenticated remote attacker to trigger gigabyte-scale heap allocations per request, leading to process-level OOM termination or repeat

CVE-2026-34242
(7.7 HIGH)

EPSS: 0.01%

updated 2026-04-16T20:43:12

1 posts

### Impact The ZIP download feature didn't verify downloaded file and it could follow symlinks outside the repository. ### Patches * https://github.com/WeblateOrg/weblate/pull/18683 ### References Thanks to @DavidCarliez for reporting this vulnerability via GitHub.

CVE-2026-4424
(7.5 HIGH)

EPSS: 0.20%

updated 2026-04-16T20:16:39.123000

1 posts

A flaw was found in libarchive. This heap out-of-bounds read vulnerability exists in the RAR archive processing logic due to improper validation of the LZSS sliding window size after transitions between compression methods. A remote attacker can exploit this by providing a specially crafted RAR archive, leading to the disclosure of sensitive heap memory information without requiring authentication

CVE-2025-67841
(7.5 HIGH)

EPSS: 0.04%

updated 2026-04-16T15:32:35

1 posts

Nordic Semiconductor IronSide SE for nRF54H20 before 23.0.2+17 has an Algorithmic complexity issue.

CVE-2026-30993
(9.8 CRITICAL)

EPSS: 0.29%

updated 2026-04-16T15:32:35

1 posts

Slah CMS v1.5.0 and below was discovered to contain a remote code execution (RCE) vulnerability in the session() function at config.php. This vulnerability is exploitable via a crafted input.

CVE-2026-40744
(8.5 HIGH)

EPSS: 0.03%

updated 2026-04-16T15:17:39.990000

2 posts

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Beaver Builder Beaver Builder beaver-builder-lite-version allows Blind SQL Injection.This issue affects Beaver Builder: from n/a through <= 2.10.1.2.

CVE-2026-6306
(8.8 HIGH)

EPSS: 0.08%

updated 2026-04-16T12:31:40

1 posts

Heap buffer overflow in PDFium in Google Chrome prior to 147.0.7727.101 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted PDF file. (Chromium security severity: High)

CVE-2026-33807
(9.1 CRITICAL)

EPSS: 0.05%

updated 2026-04-16T01:03:26

2 posts

### Summary `@fastify/express` v4.0.4 contains a path handling bug in the `onRegister` function that causes middleware paths to be doubled when inherited by child plugins. This results in complete bypass of Express middleware security controls for all routes defined within child plugin scopes that share a prefix with parent-scoped middleware. No special configuration is required — this affects th

CVE-2026-30624
(8.6 HIGH)

EPSS: 0.22%

updated 2026-04-15T21:31:21

1 posts

Agent Zero 0.9.8 contains a remote code execution vulnerability in its External MCP Servers configuration feature. The application allows users to define MCP servers using a JSON configuration containing arbitrary command and args values. These values are executed by the application when the configuration is applied without sufficient validation or restriction. An attacker may supply a malicious M

CVE-2026-30617
(8.6 HIGH)

EPSS: 0.14%

updated 2026-04-15T21:31:21

1 posts

LangChain-ChatChat 0.3.1 contains a remote code execution vulnerability in its MCP STDIO server configuration and execution handling. A remote attacker can access the publicly exposed MCP management interface and configure an MCP STDIO server with attacker-controlled commands and arguments. When the MCP server is started and MCP is enabled for agent execution, subsequent agent activity triggers ex

CVE-2026-30996
(7.5 HIGH)

EPSS: 0.29%

updated 2026-04-15T21:31:21

1 posts

An issue in the file handling logic of the component download.php of SAC-NFe v2.0.02 allows attackers to execute a directory traversal and read arbitrary files from the system via a crafted GET request.

CVE-2026-30994
(7.5 HIGH)

EPSS: 0.04%

updated 2026-04-15T21:31:21

1 posts

Incorrect access control in the config.php component of Slah v1.5.0 and below allows unauthenticated attackers to access sensitive information, including active session credentials.

CVE-2026-4857
(8.5 HIGH)

EPSS: 0.03%

updated 2026-04-15T21:30:26

1 posts

IdentityIQ 8.5, all IdentityIQ 8.5 patch levels prior to 8.5p2, IdentityIQ 8.4, and all IdentityIQ 8.4 patch levels prior to 8.4p4 allow authenticated users assigned the Debug Pages Read Only capability or any custom capability with the ViewAccessDebugPage SPRight to incorrectly create new IdentityIQ objects.  Until a remediating security fix or patches containing this security fix are installed,

CVE-2026-34632
(8.3 HIGH)

EPSS: 0.01%

updated 2026-04-15T21:30:25

1 posts

Adobe Photoshop Installer was affected by an Uncontrolled Search Path Element vulnerability that could have resulted in arbitrary code execution in the context of the current user. A low-privileged local attacker could have exploited this vulnerability by manipulating the search path used by the application to locate critical resources, potentially causing unauthorized code execution. Exploitation

CVE-2026-6300
(8.8 HIGH)

EPSS: 0.04%

updated 2026-04-15T21:30:25

1 posts

Use after free in CSS in Google Chrome prior to 147.0.7727.101 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

CVE-2026-6299
(8.8 HIGH)

EPSS: 0.04%

updated 2026-04-15T21:30:25

1 posts

Use after free in Prerender in Google Chrome prior to 147.0.7727.101 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: Critical)

CVE-2026-6297
(8.4 HIGH)

EPSS: 0.01%

updated 2026-04-15T21:30:25

1 posts

Use after free in Proxy in Google Chrome prior to 147.0.7727.101 allowed an attacker in a privileged network position to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)

CVE-2026-6296
(9.7 CRITICAL)

EPSS: 0.03%

updated 2026-04-15T21:30:25

1 posts

Heap buffer overflow in ANGLE in Google Chrome prior to 147.0.7727.101 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)

CVE-2026-6304
(8.4 HIGH)

EPSS: 0.04%

updated 2026-04-15T21:30:19

1 posts

Use after free in Graphite in Google Chrome prior to 147.0.7727.101 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

CVE-2026-40478
(9.1 CRITICAL)

EPSS: 0.13%

updated 2026-04-15T19:46:25

1 posts

### Impact A security bypass vulnerability exists in the expression execution mechanisms of Thymeleaf up to and including 3.1.3.RELEASE. Although the library provides mechanisms to prevent expression injection, it fails to properly neutralize specific syntax patterns that allow for the execution of unauthorized expressions. If an application developer passes unvalidated user input directly to the

CVE-2026-40477
(9.1 CRITICAL)

EPSS: 0.13%

updated 2026-04-15T19:46:06

2 posts

### Impact A security bypass vulnerability exists in the expression execution mechanisms of Thymeleaf up to and including 3.1.3.RELEASE. Although the library provides mechanisms to prevent expression injection, it fails to properly restrict the scope of accessible objects, allowing specific potentially sensitive objects to be reached from within a template. If an application developer passes unval

CVE-2026-30364
(7.5 HIGH)

EPSS: 0.04%

updated 2026-04-15T18:33:00

1 posts

CentSDR commit e40795 was discovered to contain a stack overflow in the "Thread1" function.

CVE-2026-30615
(8.0 HIGH)

EPSS: 0.04%

updated 2026-04-15T18:32:04

1 posts

A prompt injection vulnerability in Windsurf 1.9544.26 allows remote attackers to execute arbitrary commands on a victim system. When Windsurf processes attacker-controlled HTML content, malicious instructions can cause unauthorized modification of the local MCP configuration and automatic registration of a malicious MCP STDIO server, resulting in execution of arbitrary commands without further us

CVE-2026-20147
(10.0 CRITICAL)

EPSS: 0.23%

updated 2026-04-15T18:32:04

1 posts

A vulnerability in Cisco ISE and Cisco ISE-PIC could allow an authenticated, remote attacker to execute arbitrary commands on the underlying operating system of an affected device. To exploit this vulnerability, the attacker must have valid administrative credentials. This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by sendi

CVE-2026-20186
(10.0 CRITICAL)

EPSS: 0.23%

updated 2026-04-15T18:32:04

1 posts

A vulnerability in Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to execute arbitrary commands on the underlying operating system of an affected device. To exploit this vulnerability, the attacker must have at least Read Only Admin credentials. This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerabi

CVE-2026-20184
(9.8 CRITICAL)

EPSS: 0.05%

updated 2026-04-15T18:32:04

1 posts

A vulnerability in the integration of single sign-on (SSO) with Control Hub in Cisco Webex Services could have allowed an unauthenticated, remote attacker to impersonate any user within the service. This vulnerability existed because of improper certificate validation. Prior to this vulnerability being addressed, an attacker could have exploited this vulnerability by connecting to a service endpo

CVE-2026-30995
(8.6 HIGH)

EPSS: 0.03%

updated 2026-04-15T18:32:04

1 posts

Slah CMS v1.5.0 and below was discovered to contain a SQL injection vulnerability via the id parameter in the vereador_ver.php endpoint.

CVE-2025-63029
(7.6 HIGH)

EPSS: 0.03%

updated 2026-04-15T18:32:03

1 posts

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WC Lovers WCFM Marketplace allows SQL Injection.This issue affects WCFM Marketplace: from n/a through 3.7.1.

CVE-2026-40784
(8.1 HIGH)

EPSS: 0.04%

updated 2026-04-15T18:31:56

2 posts

Authorization Bypass Through User-Controlled Key vulnerability in Mahmudul Hasan Arif FluentBoards fluent-boards allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects FluentBoards: from n/a through <= 1.91.2.

CVE-2026-40764
(8.1 HIGH)

EPSS: 0.02%

updated 2026-04-15T18:31:55

2 posts

Cross-Site Request Forgery (CSRF) vulnerability in Syed Balkhi Contact Form by WPForms wpforms-lite allows Cross Site Request Forgery.This issue affects Contact Form by WPForms: from n/a through <= 1.10.0.2.

CVE-2026-40745
(7.6 HIGH)

EPSS: 0.03%

updated 2026-04-15T18:31:55

2 posts

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in bdthemes Element Pack Elementor Addons bdthemes-element-pack-lite allows Blind SQL Injection.This issue affects Element Pack Elementor Addons: from n/a through <= 8.4.2.

CVE-2026-6372
(7.5 HIGH)

EPSS: 0.03%

updated 2026-04-15T17:17:06.547000

1 posts

Missing Authorization vulnerability in Plisio Accept Cryptocurrencies with Plisio allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Accept Cryptocurrencies with Plisio: from n/a through 2.0.5.

CVE-2026-4145
(7.8 HIGH)

EPSS: 0.01%

updated 2026-04-15T15:31:50

2 posts

During an internal security assessment, a potential vulnerability was discovered in Lenovo Software Fix that could allow a local authenticated user to perform arbitrary code execution with elevated privileges.

CVE-2024-3721
(6.3 MEDIUM)

EPSS: 83.86%

updated 2026-04-15T00:35:42.020000

1 posts

A vulnerability was found in TBK DVR-4104 and DVR-4216 up to 20240412 and classified as critical. This issue affects some unknown processing of the file /device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___. The manipulation of the argument mdb/mdc leads to os command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-260573

1 repos

https://github.com/bytecategory/homeip

CVE-2026-33155(CVSS UNKNOWN)

EPSS: 0.05%

updated 2026-04-14T21:59:48

1 posts

### Summary The pickle unpickler `_RestrictedUnpickler` validates which classes can be loaded but does not limit their constructor arguments. A few of the types in `SAFE_TO_IMPORT` have constructors that allocate memory proportional to their input (`builtins.bytes`, `builtins.list`, `builtins.range`). A 40-byte pickle payload can force 10+ GB of memory, which crashes applications that load delta

CVE-2026-33825
(7.8 HIGH)

EPSS: 0.04%

updated 2026-04-14T18:30:52

1 posts

Insufficient granularity of access control in Microsoft Defender allows an authorized attacker to elevate privileges locally.

1 repos

https://github.com/Letlaka/redsun-bluehammer-undefend-detection-pack

CVE-2026-33829
(4.3 MEDIUM)

EPSS: 0.07%

updated 2026-04-14T18:30:51

3 posts

Exposure of sensitive information to an unauthorized actor in Windows Snipping Tool allows an unauthorized attacker to perform spoofing over a network.

CVE-2026-34621
(8.6 HIGH)

EPSS: 4.56%

updated 2026-04-13T21:23:27

1 posts

Acrobat Reader versions 24.001.30356, 26.001.21367 and earlier are affected by an Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

5 repos

https://github.com/eduardorossi84/CVE-2026-34621-POC

https://github.com/ercihan/CVE-2026-34621_PDF_SAMPLE

https://github.com/KeulenR01/Remediate-AdobeAcrobat-CVE-2026-34621

https://github.com/ercihan/CVE-2026-34621

https://github.com/NULL200OK/cve_2026_34621_advanced

CVE-2026-33555
(4.0 None)

EPSS: 0.01%

updated 2026-04-13T18:30:42

1 posts

An issue was discovered in HAProxy before 3.3.6. The HTTP/3 parser does not check that the received body length matches a previously announced content-length when the stream is closed via a frame with an empty payload. This can cause desynchronization issues with the backend server and could be used for request smuggling. The earliest affected version is 2.6.

1 repos

https://github.com/r3verii/CVE-2026-33555

CVE-2026-35582
(8.8 HIGH)

EPSS: 0.05%

updated 2026-04-13T16:38:27

1 posts

### Summary `Executrix.getCommand()` constructs shell commands by substituting temporary file paths directly into a `/bin/sh -c` string with no escaping. The `IN_FILE_ENDING` and `OUT_FILE_ENDING` configuration keys flow into those paths unmodified. A place author who sets either key to a shell metacharacter sequence achieves arbitrary OS command execution in the JVM's security context when the p

CVE-2026-40259
(8.1 HIGH)

EPSS: 0.08%

updated 2026-04-10T21:32:47

1 posts

## Summary An authenticated publish-service reader can invoke `/api/av/removeUnusedAttributeView` and cause persistent deletion of arbitrary attribute view (`AV`) definition files from the workspace. The route is protected only by generic `CheckAuth`, which accepts publish `RoleReader` requests. The handler forwards a caller-controlled `id` directly into a model function that deletes `data/stora

CVE-2026-40258
(9.1 CRITICAL)

EPSS: 0.05%

updated 2026-04-10T21:32:42

2 posts

## Summary A path traversal vulnerability (Zip Slip) exists in the media archive import feature. An authenticated user with owner-level privileges can craft a malicious ZIP file with directory-traversal filenames to write arbitrary files outside the intended temporary extraction directory on the server's local filesystem. ## Details When importing media archives as ZIP file, `MediaImporter._che

CVE-2026-40200
(8.2 HIGH)

EPSS: 0.02%

updated 2026-04-10T18:31:28

1 posts

An issue was discovered in musl libc 0.7.10 through 1.2.6. Stack-based memory corruption can occur during qsort of very large arrays, due to incorrectly implemented double-word primitives. The number of elements must exceed about seven million, i.e., the 32nd Leonardo number on 32-bit platforms (or the 64th Leonardo number on 64-bit platforms, which is not practical).

CVE-2026-6042
(3.3 LOW)

EPSS: 0.01%

updated 2026-04-10T12:31:44

1 posts

A security flaw has been discovered in musl libc up to 1.2.6. Affected is the function iconv of the file src/locale/iconv.c of the component GB18030 4-byte Decoder. Performing a manipulation results in inefficient algorithmic complexity. The attack must be initiated from a local position. To fix this issue, it is recommended to deploy a patch.

1 repos

https://github.com/jensnesten/CVE-2026-6042-PoC

CVE-2026-39987(CVSS UNKNOWN)

EPSS: 3.20%

updated 2026-04-09T19:06:18

3 posts

## Summary Marimo (19.6k stars) has a Pre-Auth RCE vulnerability. The terminal WebSocket endpoint `/terminal/ws` lacks authentication validation, allowing an unauthenticated attacker to obtain a full PTY shell and execute arbitrary system commands. Unlike other WebSocket endpoints (e.g., `/ws`) that correctly call `validate_auth()` for authentication, the `/terminal/ws` endpoint only checks the

Nuclei template

5 repos

https://github.com/fevar54/marimo_CVE-2026-39987_RCE_PoC

https://github.com/Nxploited/CVE-2026-39987

https://github.com/0xBlackash/CVE-2026-39987

https://github.com/mki9/CVE-2026-39987_exploit

https://github.com/keraattin/CVE-2026-39987

CVE-2026-22729
(8.6 HIGH)

EPSS: 0.08%

updated 2026-04-01T16:53:35.810000

1 posts

A JSONPath injection vulnerability in Spring AI's AbstractFilterExpressionConverter allows authenticated users to bypass metadata-based access controls through crafted filter expressions. User-controlled input passed to FilterExpressionBuilder is concatenated into JSONPath queries without proper escaping, enabling attackers to inject arbitrary JSONPath logic and access unauthorized documents. Thi

CVE-2026-3055
(9.8 CRITICAL)

EPSS: 55.71%

updated 2026-03-31T13:18:14.213000

2 posts

Insufficient input validation in NetScaler ADC and NetScaler Gateway when configured as a SAML IDP leading to memory overread

Nuclei template

5 repos

https://github.com/l0lsec/check-cve-2026-3055-netscaler

https://github.com/0xBlackash/CVE-2026-3055

https://github.com/fevar54/CVE-2026-3055---Citrix-NetScaler-Memory-Overread-PoC

https://github.com/fevar54/CVE-2026-3055-Scanner---Herramienta-de-Detecci-n

https://github.com/NetVanguard-cmd/CVE-2026-3055

CVE-2026-4368
(0 None)

EPSS: 0.02%

updated 2026-03-24T15:54:09.400000

2 posts

Race Condition in NetScaler ADC and NetScaler Gateway when appliance is configured as Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server leading to User Session Mixup

CVE-2026-32746
(9.8 CRITICAL)

EPSS: 0.03%

updated 2026-03-23T15:31:40

2 posts

telnetd in GNU inetutils through 2.7 allows an out-of-bounds write in the LINEMODE SLC (Set Local Characters) suboption handler because add_slc does not check whether the buffer is full.

5 repos

https://github.com/watchtowrlabs/watchtowr-vs-telnetd-CVE-2026-32746

https://github.com/danindiana/cve-2026-32746-mitigation

https://github.com/chosenonehacks/CVE-2026-32746

https://github.com/jeffaf/cve-2026-32746

https://github.com/ekomsSavior/telnet_scan

CVE-2026-4440
(8.8 HIGH)

EPSS: 0.07%

updated 2026-03-20T15:32:13

2 posts

Out of bounds read and write in WebGL in Google Chrome prior to 146.0.7680.153 allowed a remote attacker to perform arbitrary read/write via a crafted HTML page. (Chromium security severity: Critical)

CVE-2026-22730
(8.8 HIGH)

EPSS: 0.02%

updated 2026-03-18T20:20:40

1 posts

A critical SQL injection vulnerability in Spring AI's MariaDBFilterExpressionConverter allows attackers to bypass metadata-based access controls and execute arbitrary SQL commands. The vulnerability exists due to missing input sanitization.

1 repos

https://github.com/NULL200OK/CVE-2026-22730-Scanner

CVE-2026-3888
(7.8 HIGH)

EPSS: 0.01%

updated 2026-03-18T04:17:30.720000

1 posts

Local privilege escalation in snapd on Linux allows local attackers to get root privilege by re-creating snap's private /tmp directory when systemd-tmpfiles is configured to automatically clean up this directory. This issue affects Ubuntu 16.04 LTS, 18.04 LTS, 20.04 LTS, 22.04 LTS, and 24.04 LTS.

6 repos

https://github.com/fevar54/CVE-2026-3888-POC-all-from-the-Qualys-platform.

https://github.com/netw0rk7/CVE-2026-3888-PoC

https://github.com/nomaisthere/CVE-2026-3888

https://github.com/Many-Hat-Group/Ubuntu-CVE-2026-3888-patcher

https://github.com/TheCyberGeek/CVE-2026-3888-snap-confine-systemd-tmpfiles-LPE

https://github.com/DanielTangnes/CVE-2026-3888

CVE-2026-25554
(6.5 MEDIUM)

EPSS: 0.09%

updated 2026-02-27T21:31:20

1 posts

OpenSIPS versions 3.1 before 3.6.4 containing the auth_jwt module (prior to commit 3822d33) contain a SQL injection vulnerability in the jwt_db_authorize() function in modules/auth_jwt/authorize.c when db_mode is enabled and a SQL database backend is used. The function extracts the tag claim from a JWT without prior signature verification and incorporates the unescaped value directly into a SQL qu

CVE-2026-24061
(9.8 CRITICAL)

EPSS: 88.02%

updated 2026-02-10T18:30:34

1 posts

telnetd in GNU Inetutils through 2.7 allows remote authentication bypass via a "-f root" value for the USER environment variable.

Nuclei template

69 repos

https://github.com/SafeBreach-Labs/CVE-2026-24061

https://github.com/hackingyseguridad/root

https://github.com/canpilayda/inetutils-telnetd-cve-2026-24061

https://github.com/XsanFlip/CVE-2026-24061-Scanner

https://github.com/BrainBob/CVE-2026-24061

https://github.com/Mefhika120/Ashwesker-CVE-2026-24061

https://github.com/Remnant-DB/CVE-2026-24061

https://github.com/Parad0x7e/CVE-2026-24061

https://github.com/shivam-bathla/CVE-2026-24061-setup

https://github.com/Gabs-hub/CVE-2026-24061_Lab

https://github.com/LucasPDiniz/CVE-2026-24061

https://github.com/0x7556/CVE-2026-24061

https://github.com/HD0x01/CVE-2026-24061-NSE

https://github.com/0p5cur/CVE-2026-24061-POC

https://github.com/midox008/CVE-2026-24061

https://github.com/X-croot/CVE-2026-24061_POC

https://github.com/setuju/telnetd

https://github.com/Mr-Zapi/CVE-2026-24061

https://github.com/obrunolima1910/CVE-2026-24061

https://github.com/Risma2025/CVE-2026-24061-GNU-InetUtils-telnetd-Authentication-Bypass-Vulnerability

https://github.com/SeptembersEND/CVE--2026-24061

https://github.com/Chocapikk/CVE-2026-24061

https://github.com/monstertsl/CVE-2026-24061

https://github.com/Alter-N0X/CVE-2026-24061-POC

https://github.com/Lingzesec/CVE-2026-24061-GUI

https://github.com/ilostmypassword/Melissae-Honeypot-Framework

https://github.com/buzz075/CVE-2026-24061

https://github.com/dotelpenguin/telnetd_CVE-2026-24061_tester

https://github.com/mbanyamer/CVE-2026-24061-GNU-Inetutils-telnetd-Remote-Authentication-Bypass-Root-Shell-

https://github.com/novitahk/Exploit-CVE-2026-24061

https://github.com/Ali-brarou/telnest

https://github.com/yanxinwu946/CVE-2026-24061--telnetd

https://github.com/duy-31/CVE-2026-24061---telnetd

https://github.com/ms0x08-dev/CVE-2026-24061-POC

https://github.com/cumakurt/tscan

https://github.com/athack-ctf/chall2026-telneted

https://github.com/MY0723/GNU-Inetutils-telnet-CVE-2026-24061-

https://github.com/z3n70/CVE-2026-24061

https://github.com/ekomsSavior/telnet_scan

https://github.com/parameciumzhang/Tell-Me-Root

https://github.com/tiborscholtz/CVE-2026-24061

https://github.com/punitdarji/telnetd-cve-2026-24061

https://github.com/androidteacher/CVE-2026-24061-PoC-Telnetd

https://github.com/0xXyc/telnet-inetutils-auth-bypass-CVE-2026-24061

https://github.com/franckferman/CVE_2026_24061

https://github.com/h3athen/CVE-2026-24061

https://github.com/lavabyte/telnet-CVE-2026-24061

https://github.com/nrnw/CVE-2026-24061-GNU-inetutils-Telnet-Detector

https://github.com/ibrahmsql/CVE-2026-24061-PoC

https://github.com/madfxr/Twenty-Three-Scanner

https://github.com/xuemian168/CVE-2026-24061

https://github.com/typeconfused/CVE-2026-24061

https://github.com/m3ngx1ng/cve_2026_24061_cli

https://github.com/ridpath/Terrminus-CVE-2026-2406

https://github.com/JayGLXR/CVE-2026-24061-POC

https://github.com/0xBlackash/CVE-2026-24061

https://github.com/infat0x/CVE-2026-24061

https://github.com/RStephanH/vuln-deb

https://github.com/TryA9ain/CVE-2026-24061

https://github.com/FurkanKAYAPINAR/CVE-2026-24061-telnet2root

https://github.com/SystemVll/CVE-2026-24061

https://github.com/balgan/CVE-2026-24061

https://github.com/BrainBob/Telnet-TestVuln-CVE-2026-24061

https://github.com/hyu164/Terrminus-CVE-2026-2406

https://github.com/r00tuser111/CVE-2026-24061

https://github.com/przemytn/CVE-2026-24061

https://github.com/scumfrog/cve-2026-24061

https://github.com/leonjza/inetutils-telnetd-auth-bypass

https://github.com/killsystema/scan-cve-2026-24061

CVE-2025-0520(CVSS UNKNOWN)

EPSS: 2.03%

updated 2025-11-05T19:58:03

2 posts

An unrestricted file upload vulnerability in ShowDoc caused by improper validation of file extension allows execution of arbitrary PHP, leading to remote code execution. This issue affects ShowDoc: before 2.8.7.

CVE-2019-1367
(7.5 HIGH)

EPSS: 89.25%

updated 2025-10-29T14:34:22.990000

2 posts

A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka 'Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-1221.

1 repos

https://github.com/mandarenmanman/CVE-2019-1367

CVE-2023-33538
(8.8 HIGH)

EPSS: 91.13%

updated 2025-10-22T00:33:51

1 posts

TP-Link TL-WR940N V2/V4, TL-WR841N V8/V10, and TL-WR740N V1/V2 was discovered to contain a command injection vulnerability via the component /userRpm/WlanNetworkRpm .

2 repos

https://github.com/explxx/CVE-2023-33538

https://github.com/mrowkoob/CVE-2023-33538-msf

CVE-2025-59284
(3.3 LOW)

EPSS: 0.03%

updated 2025-10-14T18:30:47

1 posts

Exposure of sensitive information to an unauthorized actor in Windows NTLM allows an unauthorized attacker to perform spoofing locally.

1 repos

https://github.com/lytnc/CVE-2025-59284-PoC

CVE-2024-32114
(8.5 HIGH)

EPSS: 2.02%

updated 2025-02-11T16:31:00.073000

1 posts

In Apache ActiveMQ 6.x, the default configuration doesn't secure the API web context (where the Jolokia JMX REST API and the Message REST API are located). It means that anyone can use these layers without any required authentication. Potentially, anyone can interact with the broker (using Jolokia JMX REST API) and/or produce/consume messages or purge/delete destinations (using the Message REST AP

CVE-2026-39973
(0 None)

EPSS: 0.00%

2 posts

N/A

CVE-2026-5617
(0 None)

EPSS: 0.04%

2 posts

N/A

CVE-2026-40582
(0 None)

EPSS: 0.11%

1 posts

N/A

CVE-2026-40317
(0 None)

EPSS: 0.02%

2 posts

N/A

CVE-2026-32107
(0 None)

EPSS: 0.01%

1 posts

N/A

CVE-2026-35215
(0 None)

EPSS: 0.04%

1 posts

N/A

CVE-2026-40196
(0 None)

EPSS: 0.03%

1 posts

N/A

CVE-2026-40286
(0 None)

EPSS: 0.03%

1 posts

N/A

CVE-2026-40285
(0 None)

EPSS: 0.03%

1 posts

N/A

CVE-2026-40351
(0 None)

EPSS: 0.05%

1 posts

N/A

CVE-2026-40492
(0 None)

EPSS: 0.04%

2 posts

N/A

CVE-2026-40349
(0 None)

EPSS: 0.01%

1 posts

N/A

CVE-2026-40348
(0 None)

EPSS: 0.01%

1 posts

N/A

CVE-2026-40484
(0 None)

EPSS: 0.05%

2 posts

N/A