CVE-2026-16221
(7.5 HIGH)

EPSS: 0.00%

updated 2026-07-19T15:16:49.027000

2 posts

Impact: fast-uri versions from 2.3.1 through 4.1.0 (including the 3.x line up to 3.1.3 and the 2.x line up to 2.4.2) do not treat a literal backslash character (U+005C) as an authority delimiter. Node's native WHATWG URL parser, used by fetch, undici, and Node's http and https clients, normalizes the backslash to a forward slash for special schemes such as http, https, ws, wss, ftp, and file. As a

CVE-2026-16228
(7.3 HIGH)

EPSS: 0.41%

updated 2026-07-19T12:30:30

1 posts

A vulnerability was detected in SourceCodester Class and Exam Timetabling System 1.0. Affected is an unknown function of the file /edit_schoolyr.php. Performing a manipulation of the argument ID results in sql injection. It is possible to initiate the attack remotely. The exploit is now public and may be used.

CVE-2026-16229
(4.3 MEDIUM)

EPSS: 0.44%

updated 2026-07-19T12:30:30

1 posts

A flaw has been found in itsourcecode Courier Management System up to 1.0. Affected by this vulnerability is an unknown functionality of the file /index.php. Executing a manipulation of the argument page can lead to cross site scripting. It is possible to launch the attack remotely. The exploit has been published and may be used.

CVE-2026-16227
(7.3 HIGH)

EPSS: 0.41%

updated 2026-07-19T12:30:21

1 posts

A security vulnerability has been detected in SourceCodester Class and Exam Timetabling System 1.0. This impacts an unknown function of the file /edit_subject.php. Such manipulation of the argument ID leads to sql injection. The attack may be performed from remote. The exploit has been disclosed publicly and may be used.

CVE-2026-16223
(6.3 MEDIUM)

EPSS: 0.21%

updated 2026-07-19T09:31:42

1 posts

A vulnerability was determined in 1Panel-dev CordysCRM up to 1.4.1. Impacted is the function getSqlBotSrc of the file backend/crm/src/main/java/cn/cordys/crm/system/service/IntegrationConfigService.java of the component Third Party Edit Endpoint. Executing a manipulation of the argument appSecret can lead to server-side request forgery. The attack may be launched remotely. The exploit has been pub

CVE-2026-16217
(6.3 MEDIUM)

EPSS: 0.22%

updated 2026-07-19T06:30:33

1 posts

A security vulnerability has been detected in guohongze adminset up to 0.61. Affected by this vulnerability is an unknown functionality of the file delivery/deli.py of the component Delivery Deployment Endpoint. The manipulation of the argument project_id leads to authorization bypass. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used. The proj

CVE-2026-16210
(7.3 HIGH)

EPSS: 0.40%

updated 2026-07-19T04:17:04.343000

1 posts

A vulnerability was found in newpanjing simpleui 2026.01.13. This affects the function self.get_action of the file simpleui/admin.py of the component AjaxAdmin AJAX Endpoint. Performing a manipulation results in missing authentication. Remote exploitation of the attack is possible. The exploit has been made public and could be used. The project was informed of the problem early through an issue re

CVE-2026-10130
(8.2 HIGH)

EPSS: 0.37%

updated 2026-07-19T00:30:23

2 posts

QueryWeaver contains an authentication bypass vulnerability that allows unauthenticated attackers to obtain valid session tokens for existing accounts by submitting a signup request with a known victim email address. The signup route unconditionally creates and links a new token to the matching Identity via a Cypher MERGE operation before checking whether the email belongs to an existing account,

CVE-2026-12228
(8.7 HIGH)

EPSS: 0.26%

updated 2026-07-18T21:30:30

2 posts

A stored cross-site scripting (XSS) vulnerability exists in the `POST /api/prompts/share` endpoint of parisneo/lollms (latest version). The endpoint stores attacker-controlled `prompt_content` into `DBDirectMessage.content` without server-side sanitization. When a victim opens the direct message (DM) thread, the message is rendered by the DM UI through `MessageContentRenderer`, which uses `v-html`

CVE-2026-53994
(7.5 HIGH)

EPSS: 0.40%

updated 2026-07-18T20:17:30.283000

2 posts

ProFTPD mod_sftp contains a heap-based buffer overflow reachable by an authenticated SFTP user. The fxp_packet_read() function accepts the attacker-supplied 32-bit big-endian SFTP packet length without a minimum sanity check. A value of 0 causes an unsigned subtraction elsewhere in the read path to underflow to approximately 4 GB. That oversized request reaches the core memory allocator, where the

CVE-2026-55518
(9.6 CRITICAL)

EPSS: 0.33%

updated 2026-07-18T17:22:30

1 posts

## Summary A critical missing authorization flaw exists in Avo's association attach workflow. The UI and `GET /resources/:resource/:id/:related/new` path can check `attach_<association>?`, but the actual write endpoint, `POST /resources/:resource/:id/:related`, does not run the same authorization check before mutating the association. As a result, an authenticated low-privileged Avo user can byp

CVE-2026-16125
(7.3 HIGH)

EPSS: 0.29%

updated 2026-07-18T16:17:12.873000

1 posts

A vulnerability was found in zevorn rt-claw up to 0.2.0. The affected element is the function claw_net_get/claw_net_post of the file claw/services/tools/net.c of the component http_request. The manipulation of the argument url results in server-side request forgery. The attack can be executed remotely. The exploit has been made public and could be used. The project was informed of the problem earl

CVE-2026-11826
(8.8 HIGH)

EPSS: 0.42%

updated 2026-07-18T15:31:56

2 posts

OpenPLC_v3 contains a heap-based buffer overflow in the getData() function in webserver/core/modbus_master.cpp. getData() reads characters between two delimiters into a caller-supplied buffer with no size parameter and no bounds check. In parseConfig() the function is invoked with the 100-byte heap-allocated MB_device.dev_name field. An authenticated attacker with access to the OpenPLC web interfa

CVE-2026-9323
(8.1 HIGH)

EPSS: 0.42%

updated 2026-07-18T15:31:56

1 posts

The urwid web display backend (urwid/display/web.py) generates web session identifiers (urwid_id) in Screen.start() by concatenating two random.randrange(10**9) calls that use Python's Mersenne Twister PRNG, which is not cryptographically secure. Each call consumes approximately 30 bits of PRNG state, and the Mersenne Twister internal state is approximately 19,937 bits, so an attacker who observes

CVE-2026-9147
(7.8 HIGH)

EPSS: 0.15%

updated 2026-07-18T15:31:55

2 posts

uproot dynamically generates Python class source code from ROOT TStreamerInfo records in a file and compiles it at runtime. Some file-controlled streamer metadata fields (for example, streamer element names) are interpolated into the generated Python source without safe quoting via repr() or the !r format specifier. An attacker who can supply a crafted ROOT file can place Python expression-breakin

CVE-2026-16117
(10.0 CRITICAL)

EPSS: 0.27%

updated 2026-07-18T14:17:11.620000

1 posts

Impact: @fastify/http-proxy versions up to and including 11.5.0 fail to rewrite the request prefix when the prefix segment is URL-encoded. Fastify's router URL-decodes paths for route matching, but request.url retains the original encoded form, and the prefix-rewrite step uses a literal string replace against the decoded prefix. A request that encodes one or more characters of the configured prefi

CVE-2026-16097
(8.8 HIGH)

EPSS: 0.46%

updated 2026-07-18T12:33:18

2 posts

A vulnerability was found in Shibby Tomato 1.28. This vulnerability affects the function sub_42537C of the component Scheduler Name Handler. The manipulation of the argument a1 results in stack-based buffer overflow. It is possible to launch the attack remotely. This project is superseded by FreshTomato.

CVE-2026-16096
(8.8 HIGH)

EPSS: 0.44%

updated 2026-07-18T12:33:13

3 posts

A vulnerability has been found in Shibby Tomato 1.28 RT-N5x MIPSR2 Build 124. This affects the function sub_40BB50 of the file /proc/webmon_recent_domains. The manipulation leads to stack-based buffer overflow. It is possible to initiate the attack remotely. This project is superseded by FreshTomato.

CVE-2026-16095
(8.8 HIGH)

EPSS: 0.42%

updated 2026-07-18T11:16:43.833000

1 posts

A flaw has been found in Shibby Tomato 1.28 RT-N5x MIPSR2 Build 124. Affected by this issue is the function setup_conntrack of the file /sbin/rc. Executing a manipulation of the argument ct_tcp_timeout can lead to out-of-bounds write. The attack may be performed from remote. This project is superseded by FreshTomato.

CVE-2026-47871
(8.8 HIGH)

EPSS: 0.90%

updated 2026-07-18T09:32:24

1 posts

VMware Avi Load Balancer contains a directory traversal vulnerability. Flaws in file path validation allow malicious, authenticated network users to perform directory traversal attacks. Affected versions: 32.1.1 (fixed in 32.1.2) 31.1.1 through 31.2.2 (fixed in 31.2.2-2p3) 30.1.1 through 30.2.6 (fixed in 30.2.7) 22.1.1 through 22.1.7 (fixed in 30.2.7)

CVE-2026-47869
(8.7 HIGH)

EPSS: 0.68%

updated 2026-07-18T09:32:24

1 posts

VMware Avi Load Balancer contains a remote code execution vulnerability. A malicious authenticated user with network access may be able to inject and execute code. Affected versions: 32.1.1 (fixed in 32.1.2) 31.1.1 through 31.2.2 (fixed in 31.2.2-2p3) 30.1.1 through 30.2.6 (fixed in 30.2.7) 22.1.1 through 22.1.7 (fixed in 30.2.7)

CVE-2026-47866
(8.3 HIGH)

EPSS: 0.43%

updated 2026-07-18T09:32:24

1 posts

VMware Avi Load Balancer contains an authorization bypass vulnerability. A malicious actor on the network can access a limited subset of the Avi Control Plane without proper authorization. Affected versions: 32.1.1 (fixed in 32.1.2) 31.1.1 through 31.2.2 (fixed in 31.2.2-2p3) 30.1.1 through 30.2.6 (fixed in 30.2.7) 22.1.1 through 22.1.7 (fixed in 30.2.7)

CVE-2026-47865
(9.8 CRITICAL)

EPSS: 0.66%

updated 2026-07-18T09:32:24

1 posts

VMware Avi Load Balancer contains an authentication bypass vulnerability. A malicious user with network access may be able to access the Avi Control plane by bypassing the authentication mechanism. Affected versions: 31.1.1 through 31.2.2 (fixed in 31.2.2-2p3) 30.1.1 through 30.2.6 (fixed in 30.2.7) 22.1.1 through 22.1.7 (fixed in 30.2.7)

CVE-2026-47868
(7.8 HIGH)

EPSS: 0.15%

updated 2026-07-18T09:32:18

1 posts

VMware Avi Load Balancer contains a local privilege escalation vulnerability. A malicious user with local access may be able to escalate their privileges to run code as root. Affected versions: 32.1.1 (fixed in 32.1.2) 31.1.1 through 31.2.2 (fixed in 31.2.2-2p3) 30.1.1 through 30.2.6 (fixed in 30.2.7) 22.1.1 through 22.1.7 (fixed in 30.2.7)

CVE-2026-47867
(8.7 HIGH)

EPSS: 0.68%

updated 2026-07-18T09:17:08.527000

1 posts

VMware Avi Load Balancer contains a remote code execution vulnerability. A malicious user with network access may be able to access the Avi Control plane and execute code remotely. Affected versions: 32.1.1 (fixed in 32.1.2) 31.1.1 through 31.2.2 (fixed in 31.2.2-2p3) 30.1.1 through 30.2.6 (fixed in 30.2.7) 22.1.1 through 22.1.7 (fixed in 30.2.7)

CVE-2026-9198
(9.8 CRITICAL)

EPSS: 0.35%

updated 2026-07-18T05:16:56.320000

1 posts

IBM Langflow OSS 1.0.0 through 1.10.0 allows unauthenticated attackers to chain /api/v1/auto_login (mints SUPERUSER tokens to any network caller) with /api/v1/validate/code (executes user code via exec()) to achieve full RCE on default Langflow deployments

CVE-2026-62228
(8.8 HIGH)

EPSS: 0.26%

updated 2026-07-18T05:16:55.780000

2 posts

OpenClaw before 2026.6.5 contain an authorization bypass vulnerability in node exec approvals that allows lower-trust callers to execute actions beyond their intended authorization by using different gateway and node environments. Attackers can exploit mismatched environment configurations to persist or execute actions that exceed the caller's approved permissions.

CVE-2026-44739
(8.7 HIGH)

EPSS: 0.28%

updated 2026-07-18T00:16:47.840000

1 posts

Pimcore is an Open Source Data & Experience Management Platform. Prior to 11.5.17 (LTS) and 12.3.6, the columnConfigAction endpoint in bundles/CustomReportsBundle/src/Controller/Reports/CustomReportController.php passes malicious SQL configuration through CustomReportController:columnConfigAction, SqlAdapter::getColumns, SqlAdapter::buildQueryString, and Db::fetchAssociative(), allowing an attacke

CVE-2026-56740
(7.5 HIGH)

EPSS: 0.51%

updated 2026-07-17T22:17:57.153000

1 posts

JLine is a Java library for handling console input. Prior to 3.30.14, 4.0.16, and 4.2.1, the JLine3 Telnet server remote-telnet module does not limit the number of environment variables a client may inject via the Telnet NEW-ENVIRON option, and TelnetIO.readNEVariables() in TelnetIO.java:1127-1180 stores each variable pair in a HashMap held by ConnectionData, allowing an unauthenticated attacker t

CVE-2026-7667
(8.8 HIGH)

EPSS: 0.34%

updated 2026-07-17T21:31:53

1 posts

IBM Langflow OSS 1.0.0 through 1.10.0 allows an authenticated attacker to create a malicious flow pointing to an attacker-controlled URL that returns a specially crafted Content-Disposition header (e.g., filename="../../../target/path" ), enabling arbitrary file write operations with attacker-controlled content to any path accessible by the Langflow process.

CVE-2026-8481
(9.9 CRITICAL)

EPSS: 0.44%

updated 2026-07-17T21:31:53

1 posts

IBM Langflow OSS 1.0.0 through 1.10.0 contain a critical remote code execution vulnerability in the code validation API endpoint. The POST /api/v1/validate/code endpoint accepts user-supplied Python code and executes it directly using Python's built-in exec() function without sandboxing, input validation, or privilege restrictions, enabling any authenticated user to execute arbitrary system comman

CVE-2026-7755
(8.8 HIGH)

EPSS: 0.41%

updated 2026-07-17T21:31:53

1 posts

IBM Langflow OSS 1.0.0 through 1.10.0 Langflow could allow remote code execution due to incomplete validation enforcement on MCP server configuration files.

CVE-2026-8859
(9.9 CRITICAL)

EPSS: 0.34%

updated 2026-07-17T21:31:53

1 posts

IBM Langflow OSS 1.0.0 through 1.10.0 Langflow could allow an attacker to write arbitrary files to unintended locations due to improper input validation in the APIRequest component. A path traversal vulnerability exists when the "Save to File" feature is enabled, where filenames extracted from HTTP response Content-Disposition headers are not sanitized before being joined to the temporary director

CVE-2026-8505
(9.8 CRITICAL)

EPSS: 0.60%

updated 2026-07-17T21:31:53

2 posts

IBM Langflow OSS 1.0.0 through 1.10.0 has a vulnerability in Langflow's webhook authentication logic allows unauthenticated users to trigger the execution of any flow. The system incorrectly bypasses API key validation when the WEBHOOK_AUTH_ENABLE configuration is set to False (which is the default setting). This allows a remote attacker who knows a flow's UUID to execute it as if they were the ow

CVE-2026-14499
(8.8 HIGH)

EPSS: 0.43%

updated 2026-07-17T21:31:52

1 posts

IBM Langflow OSS 1.0.0 through 1.10.1 Langflow could allow an authenticated user to execute arbitrary commands with elevated privileges on the system due to improper validation of user supplied input in the Python Interpreter component.

CVE-2026-13473
(8.1 HIGH)

EPSS: 0.46%

updated 2026-07-17T21:31:52

1 posts

IBM Storage Protect Client 8.1.0.0 through 8.1.27.0, 8.1.27.1, and 8.2.0.0 through 8.2.1.0 IBM Storage Protect is vulnerable to a heap-based buffer overflow, caused by improper bounds checking. A remote attacker could overflow a buffer and execute arbitrary code on the system or cause the server to crash.

CVE-2026-13448
(8.1 HIGH)

EPSS: 0.44%

updated 2026-07-17T21:31:52

1 posts

IBM Langflow OSS 1.0.0 through 1.10.1 Lanflow OSS contains an unauthenticated remote code execution vulnerability in the public flow build endpoint ( /api/v1/build_public_tmp/{flow_id}/flow ). The vulnerability stems from an incomplete denylist in the validate_public_flow_no_code_execution() function that fails to block several code-execution agent components including OpenDsStarAgent, CodeActAgen

CVE-2026-15091
(9.3 CRITICAL)

EPSS: 0.57%

updated 2026-07-17T21:31:52

1 posts

IBM Engineering AI Hub 1.0.0, 1.1.0, and 1.2.0 could allow a remote attacker to execute arbitrary scripts due to improper neutralization of input during web page generation.

CVE-2026-48373
(7.8 HIGH)

EPSS: 0.19%

updated 2026-07-17T21:31:52

1 posts

Acrobat Reader is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

CVE-2026-8476
(9.9 CRITICAL)

EPSS: 0.47%

updated 2026-07-17T21:31:52

1 posts

IBM Langflow OSS 1.0.0 through 1.10.0 contain a critical remote code execution vulnerability in the disk-based caching mechanism. The AsyncDiskCache class uses Python's unsafe pickle.loads() function to deserialize cached objects from disk without validation, integrity verification, or authentication, enabling arbitrary code execution when malicious pickle payloads are processed. Attackers who can

CVE-2026-8635
(9.9 CRITICAL)

EPSS: 0.29%

updated 2026-07-17T21:31:52

1 posts

IBM Langflow OSS 1.0.0 through 1.10.0 allows authenticated users to escalate privileges to superuser by directly manipulating the database, execute arbitrary system commands, and achieve full system compromise with Langflow service permissions.

CVE-2026-9171
(7.5 HIGH)

EPSS: 0.55%

updated 2026-07-17T21:31:52

1 posts

IBM PowerVM Novalink are vulnerable to a denial of service, caused by sending a specially-crafted request. A remote attacker could exploit this vulnerability to cause the server to consume memory resources.

CVE-2026-9103
(9.8 CRITICAL)

EPSS: 0.41%

updated 2026-07-17T21:31:52

1 posts

IBM Langflow OSS 1.0.0 through 1.10.0 could allow a remote attacker to gain unauthorized access due to improper authentication in the /api/v1/login/auto_login endpoint. The endpoint issues long-lived superuser bearer tokens without requiring authentication when the AUTO_LOGIN configuration is enabled (enabled by default), which may allow an unauthenticated network attacker to obtain full administr

CVE-2026-54159
(10.0 CRITICAL)

EPSS: 0.75%

updated 2026-07-17T21:17:07.963000

1 posts

PrestaShop ps_facetedsearch is a module that adds layered navigation filters. From 3.0.0 until 4.0.4, the ps_facetedsearch module rebuilds selected search filters from the request URL, and the value of a slider filter, price or weight, is taken from the URL without sufficient validation and stored in an internal filter-block cache where it is serialized and later read back with a raw native unseri

CVE-2026-50274
(7.5 HIGH)

EPSS: 0.79%

updated 2026-07-17T21:17:07.337000

2 posts

Datadog dd-trace-go is a Go client library for Datadog application performance monitoring, profiling, and security monitoring. Prior to 2.8.1, Datadog tracing libraries that implement W3C baggage propagation parse incoming baggage HTTP headers without enforcing DD_TRACE_BAGGAGE_MAX_ITEMS or DD_TRACE_BAGGAGE_MAX_BYTES limits on the extract path. A remote, unauthenticated attacker can send a request

CVE-2026-50271
(7.5 HIGH)

EPSS: 0.79%

updated 2026-07-17T21:17:07.070000

1 posts

Datadog dd-trace-py is the Datadog Python APM client. Prior to 4.8.2, Datadog tracing libraries that implement W3C baggage propagation parse incoming baggage HTTP headers without enforcing DD_TRACE_BAGGAGE_MAX_ITEMS or DD_TRACE_BAGGAGE_MAX_BYTES limits on the extract path. A remote, unauthenticated attacker can send a request whose baggage header contains an arbitrarily large number of comma-separ

CVE-2026-13446
(9.8 CRITICAL)

EPSS: 0.21%

updated 2026-07-17T21:17:05.960000

2 posts

IBM Langflow OSS 1.0.0 through 1.10.1 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data.

CVE-2026-13445
(8.1 HIGH)

EPSS: 0.20%

updated 2026-07-17T21:17:05.473000

1 posts

IBM Langflow OSS 1.0.0 through 1.10.1 can allow an authenticated attacker to exploit the SaveToFile component to read and modify another user's uploaded files by specifying absolute paths pointing to victim storage locations. In append mode, the attacker's workflow reads victim file contents, appends attacker-controlled data, and uploads a copy containing victim data to the attacker's namespace (c

CVE-2026-8056
(8.8 HIGH)

EPSS: 0.29%

updated 2026-07-17T20:17:30.500000

1 posts

IBM Langflow OSS 1.0.0 through 1.10.0 allows authenticated users to override component parameters at runtime via the API. A critical security flaw exists in the parameter filtering mechanism within the `apply_tweaks()` function.

CVE-2026-7872
(7.5 HIGH)

EPSS: 0.38%

updated 2026-07-17T20:17:30.377000

1 posts

IBM Langflow OSS 1.0.0 through 1.10.0 allows an authenticated attacker to read arbitrary files including the JWT signing key and forge authentication tokens for any user.

CVE-2026-7754
(7.7 HIGH)

EPSS: 0.22%

updated 2026-07-17T20:17:29.470000

1 posts

IBM Langflow OSS 1.0.0 through 1.10.0 Langflow 1.9.0 could allow server-side request forgery (SSRF) due to insecure default configuration and incomplete enforcement of the SSRF protection mechanism.

CVE-2026-58195
(8.8 HIGH)

EPSS: 0.46%

updated 2026-07-17T20:17:27.157000

1 posts

Agentic-Flow is an AI agent orchestration platform. Prior to 2.0.14, agentic-flow MCP server tools in src/mcp/standalone-stdio.ts, src/mcp/fastmcp/servers/claude-flow-sdk.ts, src/mcp/fastmcp/servers/stdio-full.ts, src/mcp/fastmcp/servers/http-streaming-updated.ts, src/mcp/fastmcp/servers/http-sse.ts, src/mcp/fastmcp/servers/poc-stdio.ts, src/mcp/fastmcp/tools/agent/{execute,list,parallel}.ts, src/

CVE-2026-50273
(7.5 HIGH)

EPSS: 0.79%

updated 2026-07-17T20:17:24.220000

1 posts

Datadog .NET Tracer is a client library for Datadog APM for .NET applications. Prior to 3.43.0, Datadog tracing libraries that implement W3C baggage propagation parse incoming baggage HTTP headers without enforcing DD_TRACE_BAGGAGE_MAX_ITEMS or DD_TRACE_BAGGAGE_MAX_BYTES on extraction, allowing a remote unauthenticated attacker to send a baggage header with many comma-separated key-value pairs or

CVE-2026-15322
(7.5 HIGH)

EPSS: 0.52%

updated 2026-07-17T20:17:15.800000

1 posts

IBM Engineering AI Hub 1.0.0, 1.1.0, and 1.2.0 could allow a remote attacker to obtain sensitive information due to the exposure of session tokens in URLs.

CVE-2026-9135
(9.9 CRITICAL)

EPSS: 0.80%

updated 2026-07-17T19:17:19.390000

1 posts

IBM Langflow OSS 1.0.0 through 1.10.0 Langflow versions up to 1.9.2 (commit 94981c443d4918517b9e8163d70fc598dc33a32d) contain a code injection vulnerability in the Policies component's ToolGuard integration that bypasses the allow_custom_components=false security control. The vulnerability exists because the validation mechanism only checks the main component source code in node_template["code"]["

CVE-2026-62241
(9.1 CRITICAL)

EPSS: 0.39%

updated 2026-07-17T19:17:18.647000

3 posts

clawvet self-hosted API server (apps/api) before 0.7.5 hard-codes a fallback JWT secret ('clawvet-dev-secret-change-me') in auth.ts and ships it as the default in .env.example. Because GET /api/v1/scans returns scan records containing userId values without authentication, a remote unauthenticated attacker can harvest a victim's userId, forge a valid HS256 cg_session cookie offline using the known

CVE-2026-62227
(7.7 HIGH)

EPSS: 0.24%

updated 2026-07-17T19:17:18.390000

2 posts

OpenClaw 2026.4.14 before 2026.5.26 contain a server-side request forgery vulnerability in browser snapshot routes that fail to validate post-navigation destinations. Attackers with lower-trust access can bypass OpenClaw policy checks to reach network destinations that should have been blocked.

CVE-2026-55173
(8.1 HIGH)

EPSS: 3.43%

updated 2026-07-17T18:36:41.143000

1 posts

WWBN AVideo is an open source video platform. Versions 29.0 and below remain vulnerable to OS command injection because the fix for CVE-2026-33482 was incomplete and still does not neutralize a single & ( the shell background operator). CVE-2026-33482 reported that sanitizeFFmpegCommand() (plugin/API/standAlone/functions.php) failed to strip $(...) command substitution, allowing OS command injecti

CVE-2026-44182
(0 None)

EPSS: 0.35%

updated 2026-07-17T18:35:23.877000

1 posts

Jupyter Enterprise Gateway launches remote Jupyter Notebook kernels across distributed clusters like Apache Spark, Kubernetes, and Docker Swarm. In versions prior to 3.3.0, the server interpolates untrusted environment variables (e.g., KERNEL_XXX) into Kubernetes manifests without YAML-aware escaping, enabling YAML injection attacks. Attackers can inject new fields, overwrite critical fields (e.g.

CVE-2025-60357
(8.1 HIGH)

EPSS: 0.40%

updated 2026-07-17T18:32:30

1 posts

AhnLab EPP Management v1.0.14.32-6249 was discovered to contain a NoSQL injection vulnerability via the eventlog/agentEvent/list endpoint.

1 repos

https://github.com/Nullbyte3117/CVE-2025-60357

CVE-2026-13410
(8.2 HIGH)

EPSS: 0.24%

updated 2026-07-17T18:32:29

1 posts

Dancer::Plugin::Auth::Google versions through 0.07 for Perl have TLS verification disabled. The default user agent is initialised with SSL_verify_mode explicitly disabled. An attacker with network man-in-the-middle (MITM) capability between the Dancer application and googleapis.com can intercept the OAuth2 token exchange and userinfo fetch, return a forged access_token and user profile, and be l

CVE-2026-51080
(9.8 CRITICAL)

EPSS: 0.30%

updated 2026-07-17T18:32:29

1 posts

libpvestorage-perl v9.1.1 and libpve-storage-perl v8.3.7 were discovered to contain an XML External Entity (XXE) vulnerability.

CVE-2026-57860
(7.8 HIGH)

EPSS: 0.13%

updated 2026-07-17T18:31:35

1 posts

ForgeCode (tailcallhq/forgecode), an AI pair-programming CLI, automatically loads and executes the MCP servers defined in a repository's .mcp.json file on startup without user confirmation. A malicious repository can supply a crafted .mcp.json whose mcpServers entries specify arbitrary command and args values (for example, command: bash with args: ['-c', 'touch /tmp/pwned']). When a user runs the

CVE-2026-9762
(7.8 HIGH)

EPSS: 0.17%

updated 2026-07-17T18:31:35

1 posts

IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.4 is vulnerable to remote code execution when jdbc url is under user control.

CVE-2026-9202
(9.8 CRITICAL)

EPSS: 0.29%

updated 2026-07-17T18:31:35

2 posts

IBM Langflow OSS 1.0.0 through 1.10.0 allows unauthenticated attackers to create unlimited user accounts on any Langflow instance; when NEW_USER_IS_ACTIVE=true (documented deployment option), newly created accounts are immediately active and can authenticate to reach RCE endpoints, bypassing the need for AUTO_LOGIN.

CVE-2026-12694
(9.1 CRITICAL)

EPSS: 0.24%

updated 2026-07-17T18:31:34

1 posts

Missing Authorization vulnerability in Vimesoft Inc. Enterprise Video Platform allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Enterprise Video Platform: from 3.11.0.0 before 3.25.0.

CVE-2026-12693
(9.4 CRITICAL)

EPSS: 0.26%

updated 2026-07-17T18:31:34

1 posts

Authorization bypass through User-Controlled key vulnerability in Vimesoft Inc. Enterprise Video Platform allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Enterprise Video Platform: from 3.11.0.0 before 3.25.0.

CVE-2026-12692
(9.8 CRITICAL)

EPSS: 0.35%

updated 2026-07-17T18:31:34

1 posts

Unverified password change vulnerability in Vimesoft Inc. Enterprise Video Platform allows Authentication Bypass. This issue affects Enterprise Video Platform: from 3.11.0.0 before 3.25.0.

CVE-2026-12691
(7.5 HIGH)

EPSS: 0.30%

updated 2026-07-17T18:31:34

1 posts

Missing authentication for critical function vulnerability in Vimesoft Inc. Enterprise Video Platform allows Authentication Bypass. This issue affects Enterprise Video Platform: from 3.11.0.0 before 3.25.0.

CVE-2026-63101
(7.5 HIGH)

EPSS: 0.30%

updated 2026-07-17T18:31:34

1 posts

Open Event Server through 1.19.1 contains a missing authentication vulnerability that allows unauthenticated attackers to export the complete member roster of any group, including email addresses, names, join dates, and roles, by submitting requests to the group followers CSV export endpoint which lacks any authentication decorator. Attackers can enumerate sequential group IDs via brute-force, tri

CVE-2026-8297
(9.8 CRITICAL)

EPSS: 0.26%

updated 2026-07-17T17:54:18.640000

1 posts

Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Gis Informatics Engineering Consulting Laboratory R&D and Software Services Inc. GisLab Laboratory Management System allows SQL Injection. This issue affects GisLab Laboratory Management System: from 1.4.03 through 08072026.

CVE-2026-13352
(8.8 HIGH)

EPSS: 0.57%

updated 2026-07-17T16:17:13.187000

1 posts

The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 4.16.18 via the allowed_mime_types function. This is due to the unconditional registration of an upload_mimes filter that adds executable file extensions (.exe, .apk, .msi) to the

CVE-2026-62386
(7.5 HIGH)

EPSS: 0.27%

updated 2026-07-17T15:44:29.553000

2 posts

The Grav API plugin (getgrav/grav-plugin-api) before 1.0.0-rc.16 accepts JWT access tokens through the ?token= URL query parameter on every API route (JwtAuthenticator::extractBearerToken fallback). Because tokens are embedded in URLs, they are logged verbatim in web server access logs, leaked via the Referer header, stored in browser history, and captured by upstream proxy and CDN logs, exposing

CVE-2026-62234
(8.1 HIGH)

EPSS: 0.30%

updated 2026-07-17T15:44:29.553000

2 posts

Grav before 2.0.4 fails to restrict cURL protocols in webhook dispatch, allowing authenticated users with api.webhooks.write permission to create webhooks with file://, dict://, or gopher:// URLs. Attackers can trigger webhook events to read local files, access process information, or pivot to internal services via unrestricted protocol handlers.

CVE-2026-62232
(7.4 HIGH)

EPSS: 0.28%

updated 2026-07-17T15:44:29.553000

1 posts

Grav before 2.0.4 contains a two-factor authentication bypass vulnerability in the login plugin where the regenerate2FASecret task checks only user existence, not authorization, during the pending TOTP challenge window. Attackers who know the victim's password can call this task without a CSRF nonce to overwrite the 2FA secret with an attacker-chosen value, compute a valid TOTP code, and complete

CVE-2026-11575
(7.5 HIGH)

EPSS: 0.21%

updated 2026-07-17T15:33:32

1 posts

The PhonePe Payment Solutions WordPress plugin before 3.1.0 does not properly verify the authenticity of incoming payment callbacks: the secret used to validate the callback signature is empty on sites configured through the current setup flow, so the expected signature reduces to an unkeyed hash of the request body that anyone can compute. This allows unauthenticated attackers to forge a payment-

CVE-2026-8396
(7.5 HIGH)

EPSS: 0.26%

updated 2026-07-17T15:32:37

1 posts

Improper restriction of XML external entity reference vulnerability in Netcad Software Inc. NetGIS allows Serialized Data External Linking. This issue affects NetGIS: from 5.0.66 before 7.2.2.

CVE-2026-7488
(7.5 HIGH)

EPSS: 0.24%

updated 2026-07-17T15:32:37

1 posts

Insertion of sensitive information into sent data vulnerability in IKAS Technology Inc. E-Commerce allows Retrieve Embedded Sensitive Data. This issue affects E-Commerce: through 03062026.

CVE-2026-63094
(8.1 HIGH)

EPSS: 0.17%

updated 2026-07-17T15:32:37

1 posts

SigNoz through 0.133.0 contains an open redirect vulnerability in the SSO authentication flow that allows unauthenticated attackers to steal session tokens from any user on instances configured with Google OAuth, SAML, or OIDC. Attackers can call the unauthenticated sessions context endpoint with a ref parameter pointing to an attacker-controlled host, deliver the resulting crafted login URL to a

CVE-2026-63093
(8.8 HIGH)

EPSS: 0.43%

updated 2026-07-17T15:32:37

1 posts

Cursor for Windows version 3.2.16 contains a binary planting vulnerability that allows remote attackers to achieve arbitrary code execution by placing a malicious git.exe file in the repository root directory. When a developer clones and opens a crafted repository, Cursor automatically resolves and executes the workspace-resident git.exe during IDE startup and on a recurring timed cadence without

CVE-2026-7189
(7.5 HIGH)

EPSS: 0.24%

updated 2026-07-17T15:32:29

1 posts

Insertion of sensitive information into sent data vulnerability in Proliz Software Ltd. Co. Proliz's OBS allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Proliz's OBS: before v3.6.0.

CVE-2026-9810
(9.8 CRITICAL)

EPSS: 0.28%

updated 2026-07-17T15:32:28

1 posts

The AI Copilot WordPress plugin before 1.5.4 does not bind OAuth access tokens to a WordPress user, and accepts any valid token as an administrator session, allowing unauthenticated attackers who complete the public OAuth flow to execute privileged MCP tools as an administrator, including arbitrary user creation and role escalation.

CVE-2026-11961
(8.1 HIGH)

EPSS: 0.23%

updated 2026-07-17T15:32:27

2 posts

The User Registration & Membership WordPress plugin before 5.2.3 does not validate that the membership tier submitted during public registration is one of the tiers allowed by the registration form before assigning that tier's associated user role, allowing unauthenticated users to register into an arbitrary published membership tier and obtain its role — up to administrator when such a tier exis

CVE-2026-15982
(9.8 CRITICAL)

EPSS: 0.29%

updated 2026-07-17T14:59:38.667000

2 posts

The Aimogen Pro - All-in-One AI Content Writer, Editor, ChatBot & Automation Toolkit plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.8.4. This is due to due to a missing capability check on the 'aiomatic_call_google_ai_function' function. This makes it possible for unauthenticated attackers to leverage the 'aimogen_wp_god_mode' tool to clear funct

CVE-2026-13765
(7.5 HIGH)

EPSS: 0.39%

updated 2026-07-17T06:31:06

1 posts

The LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.4.1 via the check_answer. This makes it possible for unauthenticated attackers to extract the correct-answer markers, full option lists, explanations, and question content for any quiz question on the site — including

CVE-2026-50454
(7.8 HIGH)

EPSS: 0.40%

updated 2026-07-17T05:16:39.690000

1 posts

Relative path traversal in Windows User Interface Core allows an authorized attacker to elevate privileges locally.

CVE-2026-25089
(9.8 CRITICAL)

EPSS: 36.13%

updated 2026-07-17T05:16:38.687000

4 posts

A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.5, FortiSandbox 4.4.0 through 4.4.8, FortiSandbox 4.2 all versions, FortiSandbox Cloud 5.0.4 through 5.0.5, FortiSandbox PaaS 5.0.4 through 5.0.5 may allow an unauthenticated attacker to execute unauthorized commands via specifically crafted HTTP req

2 repos

https://github.com/HORKimhab/CVE-2026-25089

https://github.com/0xBlackash/CVE-2026-25089

CVE-2026-53412
(9.8 CRITICAL)

EPSS: 0.51%

updated 2026-07-17T00:32:18

5 posts

Improper Input Validation in Zoom Desktop Client for Windows, Zoom VDI Client for Windows, and Zoom Meeting SDK for Windows may allow an unauthenticated user to conduct an account takeover via network access.

CVE-2026-53409
(7.8 HIGH)

EPSS: 0.15%

updated 2026-07-16T21:30:46

1 posts

Improper Privilege Management in Zoom Rooms for Windows before version 7.1.0 may allow an authenticated user to conduct an escalation of privilege via local access.

CVE-2026-39808
(9.8 CRITICAL)

EPSS: 84.16%

updated 2026-07-16T18:32:24

4 posts

A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiSandbox 4.4.0 through 4.4.8 may allow attacker to execute unauthorized code or commands via <insert attack vector here>

Nuclei template

6 repos

https://github.com/0xBlackash/CVE-2026-39808

https://github.com/samu-delucas/CVE-2026-39808

https://github.com/HORKimhab/CVE-2026-39808

https://github.com/Lechansky/CVE-2026-39808

https://github.com/error-inside/CVE-2026-39808

https://github.com/ynsmroztas/FortiSandbox-RCE-Exploit-CVE-2026-39808

CVE-2026-58644
(9.8 CRITICAL)

EPSS: 1.47%

updated 2026-07-16T18:31:26

7 posts

Deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attacker to execute code over a network.

CVE-2026-12525
(8.8 HIGH)

EPSS: 0.24%

updated 2026-07-16T18:16:41.633000

1 posts

The Redux Framework WordPress plugin before 4.5.13 does not restrict which user meta keys can be written when saving custom profile fields, allowing users with at least the Subscriber role to escalate their privileges to Administrator by submitting a crafted value while updating their own profile, on sites where the Redux Framework WordPress plugin before 4.5.13's user-profile (Users extension) fe

CVE-2026-11386
(9.0 None)

EPSS: 0.32%

updated 2026-07-16T15:33:11

2 posts

An input validation and injection vulnerability exists in Canonical ubuntu-pro-client (formerly ubuntu-advantage-tools). The client constructs APT source files (such as /etc/apt/sources.list.d/ubuntu-.list or their DEB822 equivalents) using data received directly from the contract server response via the directives.suites[] and directives.aptURL fields. Because the client utilizes Python's str.for

CVE-2026-63305
(8.1 HIGH)

EPSS: 1.38%

updated 2026-07-16T15:33:11

1 posts

AVideo through 29.0 contains an OS command injection vulnerability in the ffmpeg.json.php endpoint where notifyCode and callback parameters are concatenated into a shell command without escaping. Attackers who can craft a valid encrypted payload can inject arbitrary shell metacharacters into these fields to execute OS commands as the web-server user.

CVE-2026-62314
(5.8 MEDIUM)

EPSS: 0.27%

updated 2026-07-16T14:16:56.427000

1 posts

Anubis is a Web AI Firewall Utility that challenges users' connections in order to protect upstream resources from scraper bots. From 1.22.0 until 1.26.0-pre1, lib/policy/checker.go PathChecker.Check() trusted the client-controlled X-Original-URI header before matching r.URL.Path, allowing an HTTP client to match default data/common/keep-internet-working.yaml ALLOW rules such as ^/\.well-known/.*$

CVE-2026-22752
(9.6 CRITICAL)

EPSS: 0.43%

updated 2026-07-16T12:32:28

1 posts

Authentication bypass by primary weakness vulnerability in Spring Security Spring Authorization Server. This issue affects Spring Authorization Server: from 7.0.0 through 7.0.4, from 1.5.0 through 1.5.6, from 1.4.0 through 1.4.9, from 1.3.0 through 1.3.10.

CVE-2026-15013
(9.8 CRITICAL)

EPSS: 0.30%

updated 2026-07-16T06:31:33

1 posts

The SAML Single Sign On – SSO Login plugin for WordPress is vulnerable to Authentication Bypass via SAML Signature Algorithm Confusion in all versions up to, and including, 5.4.3. The vulnerability exists because `Mo_SAML_Utilities::mo_saml_cast_key()` reads the `SignatureMethod` Algorithm attribute directly from the attacker-controlled `SAMLResponse` parameter rather than enforcing the locally co

CVE-2026-20298
(5.3 MEDIUM)

EPSS: 0.22%

updated 2026-07-16T05:16:19.120000

1 posts

In Splunk Enterprise versions below 10.4.1, 10.2.5, 10.0.8, and 9.4.13, and Splunk Cloud Platform versions below 10.5.2605.0, 10.4.2604.6, 10.3.2512.15, 10.2.2510.18, and 10.1.2507.24, a low-privileged user that does not hold the 'admin' or 'power' Splunk roles could view stored credential hashes when they access the `/servicesNS/-/-/storage/passwords` REST endpoint through the `|rest` Search Proc

CVE-2026-50272
(7.5 HIGH)

EPSS: 0.79%

updated 2026-07-15T22:58:53

1 posts

### Impact Datadog tracing libraries that implement W3C baggage propagation parse incoming baggage HTTP headers without enforcing item-count or byte-size limits on the extract path. The DD_TRACE_BAGGAGE_MAX_ITEMS (default 64) and DD_TRACE_BAGGAGE_MAX_BYTES (default 8192) limits were applied only to baggage injection, not extraction. A remote, unauthenticated attacker can send a request whose bagga

CVE-2026-54498
(8.7 HIGH)

EPSS: 0.45%

updated 2026-07-15T22:51:05

1 posts

## Summary `ViewComponent::Base#around_render` can return HTML-unsafe strings that bypass the escaping behavior applied to normal `#call` return values. This creates an XSS risk when downstream applications use `around_render` to wrap, replace, instrument, or conditionally return content that includes user-controlled data. The issue is especially dangerous in collection rendering because `ViewCo

CVE-2026-15895
(7.8 HIGH)

EPSS: 1.24%

updated 2026-07-15T21:31:26

1 posts

OS command injection in the npm package loading component in AWS jsii-diff before 1.131.0 might allow context-dependent attackers to execute arbitrary commands via crafted package specifiers passed to the npm: source argument. To mitigate this issue, users should upgrade to jsii-diff v1.131.0 or later.

CVE-2026-46817
(9.8 CRITICAL)

EPSS: 1.04%

updated 2026-07-15T18:32:50

4 posts

Vulnerability in the Oracle Payments product of Oracle E-Business Suite (component: File Transmission). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Payments. Successful attacks of this vulnerability can result in takeover of Oracle Payments. CVSS 3.1 Base Score 9.8 (Con

2 repos

https://github.com/HORKimhab/CVE-2026-46817

https://github.com/0xBlackash/CVE-2026-46817

CVE-2023-4346
(7.5 HIGH)

EPSS: 0.85%

updated 2026-07-15T18:32:50

2 posts

KNX devices that use KNX Connection Authorization and support Option 1 are, depending on the implementation, vulnerable to being locked and users being unable to reset them to gain access to the device. The BCU key feature on the devices can be used to create a password for the device, but this password can often not be reset without entering the current password. If the device is configured to in

CVE-2026-20297
(7.2 HIGH)

EPSS: 0.38%

updated 2026-07-15T18:32:05

1 posts

In Splunk Enterprise versions below 10.4.1, 10.2.5, 10.0.8, 9.4.13, and 9.3.14, and Splunk Cloud Platform versions below 10.5.2605.0, 10.4.2604.6, 10.2.2510.18, and 10.1.2507.24, a user who holds a role that contains the `edit_local_apps` and `install_apps` capabilities could cause a legitimate app installation to write files outside the intended app directory, into `$SPLUNK_HOME/etc/` and its sub

CVE-2026-20296
(8.3 HIGH)

EPSS: 0.17%

updated 2026-07-15T18:32:05

1 posts

In Splunk Enterprise versions below 10.4.1, 10.2.5, 10.0.8, and 9.4.13, and Splunk Cloud Platform versions below 10.5.2605.0, 10.4.2604.7, 10.3.2512.16, 10.2.2510.18, and 10.1.2507.24, an attacker could trick a user that holds a role with the `list_deployment_server` capability into running arbitrary Search Processing Language (SPL) searches on their behalf as `splunk-system-user`, allowing for ac

CVE-2026-60005
(8.2 HIGH)

EPSS: 0.61%

updated 2026-07-15T16:23:03.437000

1 posts

NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_slice_module module. When the slice directive and unnamed regex captures are configured or when a background cache update happens, unauthenticated attackers can send requests that may cause uninitialized memory access in the NGINX worker process, leading to limited disclosure of memory or a restart. Impact: This vulnerability m

CVE-2026-42533
(8.1 HIGH)

EPSS: 0.83%

updated 2026-07-15T15:33:14

1 posts

A vulnerability exists in NGINX Plus and NGINX Open Source when a map directive uses regex matching and a string expression references the map's regex capture variables before referencing the map output variable. Alternatively, the same result could be achieved by using a non-cacheable variable in a string expression under certain conditions. An unauthenticated attacker along with conditions beyon

1 repos

https://github.com/0xCyberstan/CVE-2026-42533-Config-Scanner

CVE-2026-56434
(6.5 MEDIUM)

EPSS: 0.39%

updated 2026-07-15T15:33:13

1 posts

NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_ssi_module module. This vulnerability may exist when the Server-Side Includes (SSI), proxy_pass, and proxy_buffering off directives are configured. With this configuration, an unauthenticated attacker with man-in-the-middle (MITM) ability to control responses from an upstream server may be able to cause a heap buffer over-read i

CVE-2026-48309
(7.8 HIGH)

EPSS: 0.17%

updated 2026-07-15T13:51:52.543000

1 posts

Audition is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

CVE-2026-9770(CVSS UNKNOWN)

EPSS: 0.22%

updated 2026-07-15T03:33:02

1 posts

Kasa EC71 v4 and EC70 v4 firmware contains a static cryptographic private key stored in a read-only filesystem that is shared across devices.  An attacker with access to the firmware image can extract the embedded key.  Successful exploitation may allow an unauthenticated attacker on the same network to use this key in the web management service, compromising the confidentiality of encry

CVE-2026-13585(CVSS UNKNOWN)

EPSS: 0.11%

updated 2026-07-15T03:33:01

1 posts

Allocation of Resources Without Limits and Throttling and Sensitive Information in Resource Not Removed Before Reuse in the ASUS System Control Interface driver and ASUS Business Manager allow a local administrator to disclose sensitive information via crafted IOCTL requests, which, in severe cases, may lead to a Denial of Service (DoS) on the system. Refer to the '  Security Update for ASUS Syste

1 repos

https://github.com/416rehman/asus-bsitf-0-day-poc

CVE-2026-56155
(7.8 HIGH)

EPSS: 0.38%

updated 2026-07-14T21:32:52

2 posts

Insufficient granularity of access control in Active Directory Federation Services (AD FS) allows an authorized attacker to elevate privileges locally.

CVE-2026-15409
(10.0 CRITICAL)

EPSS: 1.27%

updated 2026-07-14T21:32:22

3 posts

A Server-side request forgery (SSRF) vulnerability has been identified in the SMA1000 Appliance Work Place interface. A remote unauthenticated attacker could potentially cause the appliance to make requests to unintended location.

5 repos

https://github.com/remmons-r7/rapid7-CVE-2026-15409

https://github.com/MrRawBit/SonicWall-SMA1000-Zero-Day-IoC-Check

https://github.com/HORKimhab/CVE-2026-15409

https://github.com/0xBlackash/CVE-2026-15409

https://github.com/tc4dy/CVE-2026-15409-15410-Framework

CVE-2026-15410
(7.2 HIGH)

EPSS: 1.49%

updated 2026-07-14T21:32:21

1 posts

Post-authentication improper control of generation of code ('Code Injection') vulnerability has been identified in the SMA1000 Appliance Management Console (AMC) which in specific conditions could potentially enable a remote authenticated attacker as administrator to execute arbitrary OS commands.

3 repos

https://github.com/MrRawBit/SonicWall-SMA1000-Zero-Day-IoC-Check

https://github.com/HORKimhab/CVE-2026-15410

https://github.com/tc4dy/CVE-2026-15409-15410-Framework

CVE-2026-13001
(9.8 CRITICAL)

EPSS: 1.08%

updated 2026-07-14T21:32:21

1 posts

The Podlove Podcast Publisher plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'podlove_handle_cache_files' function in all versions up to, and including, 4.5.1. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.

2 repos

https://github.com/shinthink/CVE-2026-13001

https://github.com/Raimu0x19/CVE-2026-13001

CVE-2026-56164
(5.3 MEDIUM)

EPSS: 5.60%

updated 2026-07-14T21:10:41.693000

1 posts

Missing authentication for critical function in Microsoft Office SharePoint allows an unauthorized attacker to elevate privileges over a network.

1 repos

https://github.com/sentinel-aidefense/CVE-2026-56164-EXP

CVE-2026-44891
(7.5 HIGH)

EPSS: 0.69%

updated 2026-07-14T20:16:37

1 posts

### Summary The StompSubframeDecoder fails to limit the total number of headers or their cumulative size per frame, allowing an attacker to cause an OutOfMemoryError, leading to a Denial of Service. ### Details `io.netty.handler.codec.stomp.StompSubframeDecoder` implements the STOMP protocol. The `maxLineLength` parameter restricts the length of individual header lines, but there is no mechanism

CVE-2026-54052
(9.9 CRITICAL)

EPSS: 0.39%

updated 2026-07-14T19:07:15

2 posts

## Impact In multi-tenant HTTP deployments — where a single n8n-mcp server serves several tenants — the locally stored workflow version history (the automatic backups taken before workflow updates) was not isolated per tenant. An authenticated tenant could read workflow version snapshots belonging to other tenants, and could delete or destroy other tenants' stored backups. A stored snapshot incl

CVE-2026-58635
(7.8 HIGH)

EPSS: 0.22%

updated 2026-07-14T18:32:12

1 posts

Improper neutralization of special elements used in a command ('command injection') in Windows Narrator Braille allows an authorized attacker to elevate privileges locally.

1 repos

https://github.com/DavidCarliez/CVE-2026-58635-PoC

CVE-2026-50663
(8.8 HIGH)

EPSS: 0.65%

updated 2026-07-14T18:32:06

1 posts

Relative path traversal in Age of Empires II: Definitive Edition Game allows an unauthorized attacker to execute code over a network.

CVE-2026-53565(CVSS UNKNOWN)

EPSS: 0.10%

updated 2026-07-14T15:32:25

1 posts

Improper Privilege Management vulnerability in Citrix Secure Access Client for Windows, Citrix Citrix Endpoint Analysis Client for Windows. This issue affects Secure Access Client for Windows: before 26.6.1.20; Citrix Endpoint Analysis Client for Windows: before 26. 5.1.7.

CVE-2026-53566(CVSS UNKNOWN)

EPSS: 0.11%

updated 2026-07-14T15:32:24

1 posts

Out-of-bounds read vulnerability in Citrix Citrix Secure Access Client for Windows. This issue affects Citrix Secure Access Client for Windows: before 26.6.1.20.

CVE-2026-6875(CVSS UNKNOWN)

EPSS: 0.51%

updated 2026-07-13T21:31:30

1 posts

ServiceNow has addressed a remote code execution vulnerability that was identified in the ServiceNow AI platform. This vulnerability could enable an unauthenticated user, in certain circumstances, to execute code within the ServiceNow platform. ServiceNow addressed this vulnerability by deploying a security update to hosted instances. Relevant security updates have also been provided to ServiceN

CVE-2026-45260
(8.1 HIGH)

EPSS: 0.43%

updated 2026-07-10T19:08:23

1 posts

### Summary Pimcore's WebDAV asset endpoint exposes a `MOVE` operation through `/asset/webdav{path}` without adding an authentication plugin in the WebDAV controller. The `Tree::move()` implementation then performs asset mutation and deletion before checking a current Pimcore user or any asset permissions. An unauthenticated remote attacker who knows two existing asset paths in the same directory

CVE-2026-45162
(8.0 HIGH)

EPSS: 0.57%

updated 2026-07-10T19:07:30

1 posts

# GitHub Security Advisory Draft — GM-374 ## Summary Multiple locations in Pimcore v11 call PHP's `unserialize()` on data from database columns and filesystem files without the `allowed_classes` restriction, enabling object injection if an attacker can control the serialized data source. ## Severity CVSS 3.1: 8.0 (High) — AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H ## Affected Component - **Package:**

CVE-2026-56688
(9.1 CRITICAL)

EPSS: 1.29%

updated 2026-07-10T12:31:56

1 posts

Dell PowerFlex Manager, Version prior to 5.1.0.1, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability during OS Repository processing to achieve arbitrary command execution as root, potentially leading to full appliance compromise and latera

CVE-2026-15378
(9.3 CRITICAL)

EPSS: 0.42%

updated 2026-07-10T12:31:55

1 posts

A flaw was found in the `guardrails-detectors` component. This vulnerability allows a remote attacker to perform a blind Server-Side Request Forgery (SSRF) by submitting a specially crafted XML Schema Definition (XSD) string. This can lead to unauthorized access to sensitive information, including credentials from cloud metadata services, Kubernetes API, internal MinIO, and other internal network

CVE-2026-59826
(9.1 CRITICAL)

EPSS: 0.39%

updated 2026-07-10T05:16:38.427000

1 posts

Metabase is an open-source business intelligence and embedded analytics tool. From 1.55.0 until 1.58.15.1, 1.59.12, 1.60.6.3, and 1.61.2, Metabase did not validate unsafe H2 connection properties on one database-creation code path, allowing an authenticated administrator to register a crafted H2 database connection and execute arbitrary Java code on the Metabase server. This issue is fixed in vers

CVE-2026-49485
(7.5 HIGH)

EPSS: 0.68%

updated 2026-07-09T13:43:04

1 posts

# Summary All implementations of FHIRPathEngine accept arbitrary FHIRPath expressions and evaluate them without input validation. The utility intended to secure this evaluation did so incorrectly, and did not fully cover all places in which evaluation was being done. An attacker can send a resource containing an evil regex pattern that causes catastrophic backtracking, exhausting system resources,

CVE-2026-54496
(9.3 CRITICAL)

EPSS: 0.32%

updated 2026-07-06T21:23:42

1 posts

### Summary A soundness vulnerability in the variable-base scalar multiplication gadget of `halo2_gadgets` allowed a malicious prover to produce a valid proof for an Orchard Action with an *under-constrained* base point. Because this gadget enforces the diversified-address-integrity condition of the Orchard Action statement, the flaw let a prover satisfy that condition for an arbitrary (pk<sub>d<

CVE-2026-52746
(7.5 HIGH)

EPSS: 0.68%

updated 2026-07-02T20:13:56

1 posts

### Impact In JSONata `<v2.2.0`, it is possible to craft non-matching inputs to the [$toMillis](https://docs.jsonata.org/date-time-functions#tomillis) function that cause superlinear backtracking in the ISO-8601 validation regex. This may lead to denial of service in applications that evaluate user-provided JSONata expressions. ### Patches This issue has been addressed in JSONata version >= 2.2.0

CVE-2026-45659
(8.8 HIGH)

EPSS: 3.22%

updated 2026-07-01T21:35:53

1 posts

Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.

1 repos

https://github.com/HORKimhab/CVE-2026-45659

CVE-2026-50151
(7.5 HIGH)

EPSS: 0.48%

updated 2026-07-01T21:35:48

1 posts

## Summary oras-go follows a registry-controlled `Location` header during the monolithic blob upload flow and reuses the `Authorization` header from the initial `POST` request for the subsequent `PUT` request. If a malicious registry returns a cross-host `Location`, oras-go can send the caller's credentials to an attacker-controlled endpoint. ## Affected Versions tested: v2.6.0 (commit 03243809

CVE-2026-54458
(9.6 CRITICAL)

EPSS: 0.30%

updated 2026-06-22T14:36:04

2 posts

# Unauthenticated Stored DOM XSS via `page_title` Broadcast in AVideo YPTSocket Plugin ## Summary A stored DOM Cross-Site Scripting vulnerability (CWE-79) in the AVideo YPTSocket plugin lets any unauthenticated remote attacker execute arbitrary JavaScript in the authenticated origin of every administrator currently viewing a page that renders the YPTSocket online-users debug panel. `plugin/YPTSo

CVE-2026-43088
(5.5 MEDIUM)

EPSS: 0.12%

updated 2026-06-19T15:34:14

1 posts

In the Linux kernel, the following vulnerability has been resolved: net: af_key: zero aligned sockaddr tail in PF_KEY exports PF_KEY export paths use `pfkey_sockaddr_size()` when reserving sockaddr payload space, so IPv6 addresses occupy 32 bytes on the wire. However, `pfkey_sockaddr_fill()` initializes only the first 28 bytes of `struct sockaddr_in6`, leaving the final 4 aligned bytes uninitial

CVE-2026-3891
(9.8 CRITICAL)

EPSS: 2.77%

updated 2026-06-17T10:44:23.283000

1 posts

The Pix for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads due to missing capability check and missing file type validation in the 'lkn_pix_for_woocommerce_c6_save_settings' function in all versions up to, and including, 1.5.0. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution

Nuclei template

7 repos

https://github.com/joshuavanderpoll/CVE-2026-3891

https://github.com/m4sh-wacker/CVE-2026-3891-Pix-for-WooCommerce-Plugin-Exploit

https://github.com/Nxploited/CVE-2026-3891

https://github.com/AnggaTechI/Mass-Scanner-CVE-2026-3891

https://github.com/willygailo/CVE-2026-3891-Linux

https://github.com/VeronnX666/CVE-2026-3891

https://github.com/shinthink/CVE-2026-3891

CVE-2026-32201
(6.5 MEDIUM)

EPSS: 21.48%

updated 2026-06-17T10:35:20.103000

1 posts

Improper input validation in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network.

1 repos

https://github.com/B1tBit/CVE-2026-32201-exploit

CVE-2026-2699
(9.8 CRITICAL)

EPSS: 49.42%

updated 2026-06-17T10:31:33.870000

1 posts

Customer Managed ShareFile Storage Zones Controller (SZC) allows an unauthenticated attacker to access restricted configuration pages. This leads to changing system configuration and potential remote code execution.

Nuclei template

2 repos

https://github.com/watchtowrlabs/watchTowr-vs-Progress-ShareFile-CVE-2026-2699

https://github.com/0xBlackash/CVE-2026-2699

CVE-2026-48062
(9.8 CRITICAL)

EPSS: 0.44%

updated 2026-06-11T17:16:09

1 posts

### Impact The `ext_in` upload validation rule checked the MIME-derived guessed extension instead of the client-provided filename extension. As a result, an uploaded file named `shell.php` containing GIF-like content could pass validation such as: ``` uploaded[avatar]|is_image[avatar]|mime_in[avatar,image/gif]|ext_in[avatar,gif] ``` because the detected MIME type maps to `gif`, even though the upl

CVE-2026-44023
(8.6 HIGH)

EPSS: 0.29%

updated 2026-06-03T21:16:26

1 posts

### Impact In versions `>= 1.5.0, < 2.74.1`, `docling-core` did not sufficiently restrict remote request destinations and could resolve a server-provided `Content-Disposition` to a local path in an unsafe manner. In applications that accept untrusted URLs, this could allow SSRF attacks targeting local files outside the user-defined cache directory. ### Patches Patched in `docling-core` `2.74.1`.

CVE-2026-45799
(7.5 HIGH)

EPSS: 0.50%

updated 2026-05-19T19:54:51

1 posts

# CVE-2026-45799 ## Maintainer summary Wire's protobuf group-skipping logic did not reject negative lengths before skipping a length-delimited field inside a group. A crafted protobuf payload could cause Wire to throw an unchecked runtime exception during decoding instead of the documented `IOException` / `ProtocolException` failure path. This can crash services that decode untrusted protobuf p

CVE-2026-46339
(10.0 CRITICAL)

EPSS: 4.57%

updated 2026-05-19T19:22:06

1 posts

## Summary 9router exposes two unauthenticated API endpoints that, when chained together, allow any network-adjacent attacker to execute arbitrary OS commands as the user running the 9router process — with **zero prerequisites** and **no credentials required**. The vulnerability exists because the Next.js middleware that enforces authentication (`src/proxy.js`) only guards 8 explicitly listed ro

Nuclei template

CVE-2026-3220
(8.8 HIGH)

EPSS: 0.32%

updated 2026-05-18T15:30:37

1 posts

The Autoptimize WordPress plugin before 3.1.15, Clearfy Cache WordPress plugin before 2.4.2, Speed Optimizer WordPress plugin before 7.7.9 are vulnerable to unauthenticated Stored Cross-Site Scripting (XSS) due to a predictable replacement hash used during the HTML minification process and abusing a regular expression. This allows an attacker to inject arbitrary HTML attributes in the final HTML

4 repos

https://github.com/cloud2783/CVE-2026-32202

https://github.com/B1tBit/CVE-2026-32201-exploit

https://github.com/virus-or-not/CVE-2026-32202

https://github.com/solarlynxsqueeze/CVE-2026-32202

CVE-2025-69443
(6.3 MEDIUM)

EPSS: 0.31%

updated 2026-05-15T15:31:41

1 posts

Remote Code Execution in coleam00 Archon 0.1.0. A crafted HTML page, when accessed by a victim, can execute commands, run prompts on behalf of the user, control the Archon UI features, and steal all Archon information available on the UI including API keys.

CVE-2025-40949
(9.1 CRITICAL)

EPSS: 0.67%

updated 2026-05-12T12:32:14

1 posts

A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.17.1), RUGGEDCOM ROX MX5000RE (All versions < V2.17.1), RUGGEDCOM ROX RX1400 (All versions < V2.17.1), RUGGEDCOM ROX RX1500 (All versions < V2.17.1), RUGGEDCOM ROX RX1501 (All versions < V2.17.1), RUGGEDCOM ROX RX1510 (All versions < V2.17.1), RUGGEDCOM ROX RX1511 (All versions < V2.17.1), RUGGEDCOM ROX RX1512 (All vers

CVE-2026-2701
(9.1 CRITICAL)

EPSS: 48.81%

updated 2026-04-21T00:33:18

1 posts

Authenticated user can upload a malicious file to the server and execute it, which leads to remote code execution.

CVE-2026-3300
(9.8 CRITICAL)

EPSS: 40.99%

updated 2026-03-31T03:31:35

1 posts

The Everest Forms Pro plugin for WordPress is vulnerable to Remote Code Execution via PHP Code Injection in all versions up to, and including, 1.9.12. This is due to the Calculation Addon's process_filter() function concatenating user-submitted form field values into a PHP code string without proper escaping before passing it to eval(). The sanitize_text_field() function applied to input does not

Nuclei template

2 repos

https://github.com/HORKimhab/CVE-2026-3300

https://github.com/adamshaikhma/CVE-2026-3300