Zeros312
CVE-2026-35527 | Incus is an open source container and virtual machine manager. In versions prior to 7.0.0, the image import flow issues an outbound HEAD request to a user-supplied URL before validating the request against project restrictions such as restricted.images.servers. The imgPostURLInfo function constructs and sends a HEAD request directly from the attacker-supplied source URL to resolve image metadata, and this network interaction occurs before the flow reaches the point where the import would be rejected by policy. Although the actual image download is blocked by the project restriction, an authenticated user can coerce the daemon into making blind HEAD requests to arbitrary destinations.
These requests include server metadata in custom headers (Incus-Server-Architectures, Incus-Server-Version), which discloses information about the host environment to the attacker-controlled endpoint. This blind SSRF primitive can be used to probe internal services, unroutable address space, or cloud metadata endpoints reachable from the host.
This vulnerability pattern is similar to CVE-2026-24767. This issue has been fixed in version 7.0.0. | 5.30 | ['https://github.com/lxc/incus/blob/v6.22.0/cmd/incusd/images.go', 'https://github.com/lxc/incus/security/advisories/GHSA-8gw4-p4wq-4hcv'] | 2026-05-06 00:16:22+03:00 | {'in_kev': False} | de10b03acc71fdfdab201bfefc121a4fa2cc3bebf5b7d019c6a7dfd6a33edbbe | 2026-05-27 22:46:07.164160+03:00 | 2026-05-28 17:55:21.240206+03:00 | |||||
CVE-2026-34596 | Sandboxie-Plus is an open source sandbox-based isolation software for Windows. In versions 1.17.2 and earlier, a Time-of-Check-to-Time-of-Use (TOCTOU) race condition exists during addon installation. When a user installs an addon through the SandMan interface, UpdUtil.exe is spawned as SYSTEM by SbieSvc but stages files in the user-writable %TEMP%\sandboxie-updater directory. After UpdUtil verifies file hashes against the signed addon manifest, install.bat extracts files.cab and executes config.exe from its contents. Between hash verification and extraction, an unprivileged user can replace files.cab with a crafted cabinet containing a malicious executable, which is then run as SYSTEM. No UAC prompt is required.
This issue has been fixed in version 1.17.3. | 5.40 | ['https://github.com/sandboxie-plus/Sandboxie/security/advisories/GHSA-xjvp-63f2-v585'] | 2026-05-05 23:16:38+03:00 | {'in_kev': False} | 95fdbf5422d920d24b98ee1c511ee567506e7fe3bc5b2e3e73a9b3e0e2347600 | 2026-05-27 22:46:07.164160+03:00 | 2026-05-28 17:55:21.240206+03:00 | |||||
CVE-2026-35397 | Jupyter Server is the backend for Jupyter web applications. In versions 2.17.0 and earlier, a path traversal vulnerability in the REST API allows an authenticated user to escape the configured root_dir and access sibling directories whose names begin with the same prefix as the root_dir. For example, with a root_dir named "test", the API permits access to a sibling directory named "testtest" through a crafted request to the /api/contents endpoint using encoded path components. An attacker can read, write, and delete files in affected sibling directories. Multi-tenant deployments using predictable naming schemes are particularly at risk, as a user with a directory named "user1" could access directories for user10 through user19 and beyond. A user who can choose a single-character folder name could gain access to a significant number of sibling directories.
Version 2.18.0 contains a fix. As a workaround, ensure folder names do not share a common prefix with any sibling directory. | 7.60 | ['https://github.com/jupyter-server/jupyter_server/security/advisories/GHSA-5789-5fc7-67v3'] | 2026-05-05 23:16:38+03:00 | {'in_kev': False} | 8d1fa46c3ada2715b1cf32d37f5ed0a3fede9f907be9a8f6bf04e311db71ea20 | 2026-05-27 22:46:07.164160+03:00 | 2026-05-28 17:55:21.240206+03:00 | |||||
CVE-2026-35453 | PhpSpreadsheet is a library for reading and writing spreadsheet files. In versions 1.30.3 and earlier, 2.0.0 through 2.1.15, 2.2.0 through 2.4.4, 3.3.0 through 3.10.4, and 4.0.0 through 5.6.0, the HTML Writer skips htmlspecialchars() output escaping when a cell uses a custom number format containing the @ text placeholder with additional literal text (e.g., @ "items"). The escaping is only applied when the formatted output strictly equals the original cell value. When the format code contains @ with quoted literal text, the formatter substitutes the raw cell value into the format string and returns early without invoking the escaping callback. An attacker who can control cell content in a spreadsheet processed by the HTML Writer can inject arbitrary HTML and JavaScript into the generated output. This issue has been fixed in versions 1.30.4, 2.1.16, 2.4.5, 3.10.5, and 5.7.0. | 4.80 | ['https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-6wpp-88cp-7q68'] | 2026-05-05 23:16:38+03:00 | {'in_kev': False} | 1debdf0d001dee21991e132d82ff58351e26b1a02aa5e1351042e92cbc97f27a | 2026-05-27 22:46:07.164160+03:00 | 2026-05-28 17:55:21.240206+03:00 | |||||
CVE-2026-40280 | Gotenberg is an API-based document conversion tool. In versions 8.30.1 and earlier, the default private-IP deny-lists for the --webhook-deny-list and --api-download-from-deny-list flags use a case-sensitive regular expression (^https?://) to match URL schemes. Because Go's net/url.Parse() normalizes the scheme to lowercase before establishing the outbound TCP connection, an attacker can bypass the deny-list by simply capitalizing part of the URL scheme (e.g., HTTP://, HTTPS://, or Http://). This allows unauthenticated requests to reach internal network services, including private IP ranges, loopback addresses, and cloud instance metadata endpoints such as HTTP://169.254.169.254/latest/meta-data/.
This bypasses the same security control that was patched in CVE-2026-27018.
This issue has been fixed in version 8.31.0. | 7.80 | ['https://github.com/advisories/GHSA-jjwv-57xh-xr6r', 'https://github.com/gotenberg/gotenberg/commit/3f01ca18d3cc21375a1e2da4b5a3f261c8548e47', 'https://github.com/gotenberg/gotenberg/security/advisories/GHSA-5q7p-7jgv-ww56'] | 2026-05-05 23:16:38+03:00 | {'in_kev': False} | 94031b360ab4719fa6126c8807c52d11933905ad53300c3d5e0dccdf4ef0953f | 2026-05-27 22:46:07.164160+03:00 | 2026-05-28 17:55:21.240206+03:00 | |||||
CVE-2026-40329 | Masa CMS is an open source content management system. In versions 7.5.2 and earlier, a SQL injection vulnerability exists in the beanFeed.cfc component within the getQuery function's processing of the sortBy parameter. The application fails to properly sanitize or parameterize this input before incorporating it into dynamic SQL statements. An unauthenticated remote attacker can execute arbitrary SQL commands against the database, potentially gaining access to sensitive data, modifying or deleting records, or escalating privileges to administrative control.
This issue has been fixed in versions 7.2.10, 7.3.15, 7.4.10, and 7.5.3. As a workaround, configure WAF rules to block malicious SQL patterns in the sortBy parameter sent to beanFeed.cfc. | 9.30 | ['https://github.com/MasaCMS/MasaCMS/security/advisories/GHSA-3xpq-q494-8qq4'] | 2026-05-05 23:16:38+03:00 | {'in_kev': False} | 811b4b5d059d0e81f887480aaa4343b78ba9c04b718c2283754fa9de26d9c13c | 2026-05-27 22:46:07.164160+03:00 | 2026-05-28 17:55:21.240206+03:00 | |||||
CVE-2022-50284 | In the Linux kernel, the following vulnerability has been resolved:
ipc: fix memory leak in init_mqueue_fs()
When setup_mq_sysctls() failed in init_mqueue_fs(), mqueue_inode_cachep is
not released. In order to fix this issue, the release path is reordered. | 5.50 | {'score': 5.5} | 0.000130000 | ['https://git.kernel.org/stable/c/12b677f2c697d61e5ddbcb6c1650050a39392f54', 'https://git.kernel.org/stable/c/28dad915abe46d38c5799a0c8130e9a2a1540385', 'https://git.kernel.org/stable/c/86273624a68d07f129dc182b8394f487ed4de484'] | 2025-09-15 18:15:39+03:00 | {'in_kev': False} | 657aba4c388432f44d458c610fe15c974197b43c9dc5482d7fa5d9d261e05356 | 2026-05-28 15:02:31.528817+03:00 | 2026-05-28 17:55:48.813332+03:00 | |||
CVE-2026-40330 | Masa CMS is an open source content management system. In versions 7.2.0 through 7.2.9, 7.3.0 through 7.3.14, 7.4.0 through 7.4.9, and 7.5.0 through 7.5.2, a SQL injection vulnerability exists in the beanFeed.cfc component within the getQuery function's handling of the sortDirection parameter. The parameter value is concatenated directly into SQL queries without sanitization or parameterization. An unauthenticated remote attacker can exploit this to extract sensitive information, modify or delete database records, or potentially achieve remote code execution on the underlying database server.
This issue has been fixed in versions 7.2.10, 7.3.15, 7.4.10, and 7.5.3. As a workaround, use a WAF to block or restrict access to the beanFeed.cfc component, or deploy rules to detect SQL injection patterns targeting the sortDirection parameter. | 9.30 | ['https://github.com/MasaCMS/MasaCMS/security/advisories/GHSA-56cc-gxfr-hqp8'] | 2026-05-05 23:16:38+03:00 | {'in_kev': False} | 405ab023ee3cffb0b8cf8e35890a013e8ea288657bbc822dce559eb75f194df6 | 2026-05-27 22:46:07.164160+03:00 | 2026-05-28 17:55:21.240206+03:00 | |||||
CVE-2026-34084 | PhpSpreadsheet is a library for reading and writing spreadsheet files. In versions 1.30.2 and earlier, 2.0.0 through 2.1.14, 2.2.0 through 2.4.3, 3.3.0 through 3.10.3, and 4.0.0 through 5.5.0, when the filename argument to IOFactory::load() is user-controlled, an attacker can supply a PHP stream wrapper path (such as phar://, ftp://, or ssh2.sftp://) that passes the is_file() check in File::assertFile(). The phar:// wrapper triggers deserialization of the PHAR metadata, which can lead to remote code execution if a suitable gadget chain is available in the application. The ftp:// and ssh2.sftp:// wrappers can be used for server-side request forgery. This issue has been fixed in versions 1.30.3, 2.1.15, 2.4.4, 3.10.4, and 5.6.0. | 9.20 | ['https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-q4q6-r8wh-5cgh', 'https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-q4q6-r8wh-5cgh'] | 2026-05-05 23:16:37+03:00 | {'in_kev': False} | a801d184a45d74955e00c60626a0167eb82271ab8d85f23b9ae8fbd29155f641 | 2026-05-27 22:46:07.164160+03:00 | 2026-05-28 17:55:21.240206+03:00 | |||||
CVE-2026-34458 | Sandboxie-Plus is an open source sandbox-based isolation software for Windows. In versions 1.17.2 and earlier, an INI injection vulnerability allows any standard local user to bypass configuration restrictions (EditAdminOnly and ConfigPassword) and inject arbitrary directives into the global Sandboxie.ini configuration file. The background service skips authorization checks for IPC messages targeting sections beginning with UserSettings_, but does not sanitize CRLF characters in either the value parameter (via MSGID_SBIE_INI_ADD_SETTING) or the setting name parameter (via MSGID_SBIE_INI_SET_SETTING). An attacker can inject a new sandbox section header with unrestricted permissions, enabling sandbox escape and SYSTEM privilege escalation. This issue has been fixed in version 1.17.3. | 9.30 | ['https://github.com/sandboxie-plus/Sandboxie/releases/tag/v1.17.3', 'https://github.com/sandboxie-plus/Sandboxie/security/advisories/GHSA-6xqg-2cjq-95qf'] | 2026-05-05 23:16:37+03:00 | {'in_kev': False} | 5fd41643df73861c50e3c6bae7789b95ad815da4f0e51ed07bc51229abbffc7d | 2026-05-27 22:46:07.164160+03:00 | 2026-05-28 17:55:21.240206+03:00 | |||||
CVE-2026-34459 | Sandboxie-Plus is an open source sandbox-based isolation software for Windows. In versions 1.17.2 and earlier, the SbieSvc proxy service's GetRawInputDeviceInfoSlave handler contains two vulnerabilities that can be chained for sandbox escape. First, when a sandboxed process sends an IPC request with cbSize set to 0, up to 32KB of uninitialized stack memory from the service process is returned, leaking return addresses and stack cookies which bypass ASLR and /GS protections. Second, the handler performs a memcpy with an attacker-controlled length without verifying it fits within the 32KB stack buffer, enabling a stack buffer overflow. By chaining the information leak with the overflow, a sandboxed process can execute a ROP chain to achieve SYSTEM privilege escalation, even from a Security Hardened Sandbox. Hardware-enforced shadow stacks (Intel CET) prevent the ROP chain execution but do not mitigate the information leak. This issue has been fixed in version 1.17.3. | 8.80 | ['https://github.com/sandboxie-plus/Sandboxie/security/advisories/GHSA-7cpc-5hv7-rfmh'] | 2026-05-05 23:16:37+03:00 | {'in_kev': False} | 0617eb0ee64bbdd6a03eb3fc4e2009c8b4b53da5a3f7fcba1c9074096d6e1b40 | 2026-05-27 22:46:07.164160+03:00 | 2026-05-28 17:55:21.240206+03:00 | |||||
CVE-2026-34461 | Sandboxie-Plus is an open source sandbox-based isolation software for Windows. In versions 1.17.2 and earlier, the SbieIniServer RunSbieCtrl handler contains a stack buffer overflow. The MSGID_SBIE_INI_RUN_SBIE_CTRL message is handled before normal sandbox and impersonation checks, and for non-sandboxed callers, the handler copies the trailing message payload into a fixed-size WCHAR ctrlCmd[128] stack buffer using memcpy without verifying the length fits within the buffer. The service pipe is created with a NULL DACL, allowing any local interactive process to connect and send an oversized payload to overflow the stack. This can lead to a crash of the SbieSvc service or potential code execution as SYSTEM. This issue has been fixed in version 1.17.3. | 7.30 | ['https://github.com/sandboxie-plus/Sandboxie/security/advisories/GHSA-wpjw-jh2p-gwx7'] | 2026-05-05 23:16:37+03:00 | {'in_kev': False} | 4eccfd8153b618aa834cd9234ee2121c886b03ff184d702680ca50b80b16d938 | 2026-05-27 22:46:07.164160+03:00 | 2026-05-28 17:55:21.240206+03:00 | |||||
CVE-2026-34462 | Sandboxie-Plus is an open source sandbox-based isolation software for Windows. In versions 1.17.2 and earlier, several ProcessServer handlers (KillAllHandler, SuspendAllHandler, and RunSandboxedHandler) copy a WCHAR boxname[34] field from request structures into WCHAR[40] stack buffers using wcscpy without verifying null termination. Because the service pipe accepts variable-length packets larger than the request structure, an attacker can fill the boxname field with non-zero data and append additional controlled wide characters after the structure. wcscpy then reads past the fixed field and overflows the destination stack buffer. The service pipe is created with a NULL DACL, allowing any local process to connect, and the unsafe copy occurs before authorization checks. This can lead to a crash of the SbieSvc service or potential code execution as SYSTEM. This issue has been fixed in version 1.17.3. | 7.30 | ['https://github.com/sandboxie-plus/Sandboxie/security/advisories/GHSA-9cjg-vh9m-hhx4'] | 2026-05-05 23:16:37+03:00 | {'in_kev': False} | 0c06416af92656c5e34cdc540c3a1812507078f114f65c7c7d3aa70c4043708a | 2026-05-27 22:46:07.164160+03:00 | 2026-05-28 17:55:21.240206+03:00 | |||||
CVE-2026-34464 | Sandboxie-Plus is an open source sandbox-based isolation software for Windows. In versions 1.17.2 and earlier, NamedPipeServer::OpenHandler copies the server field from NAMED_PIPE_OPEN_REQ into a fixed WCHAR pipename[160] stack buffer using wcscat without verifying null termination. The handler only enforces a minimum packet size, and since the service pipe accepts variable-length messages, a sandboxed caller can fill the server[48] field with non-zero data and append additional controlled wide characters after the structure. wcscat then reads past the fixed field and overflows the stack buffer in the SYSTEM service. This message is restricted to sandboxed callers, making it a sandbox escape vector. This can lead to a crash of the SbieSvc service or potential code execution as SYSTEM. This issue has been fixed in version 1.17.3. | 8.80 | ['https://github.com/sandboxie-plus/Sandboxie/security/advisories/GHSA-cf8x-f33g-vwfg'] | 2026-05-05 23:16:37+03:00 | {'in_kev': False} | da475bd0471d475c54c50c34a8f938b6c5df7314e598ac9a46ca0e8036d5bb16 | 2026-05-27 22:46:07.164160+03:00 | 2026-05-28 17:55:21.240206+03:00 | |||||
CVE-2026-34527 | Sandboxie-Plus is an open source sandbox-based isolation software for Windows. In versions 1.17.2 and earlier, SbieIniServer::HashPassword converts a SHA-1 digest to hexadecimal incorrectly. The high nibble of each byte is shifted right by 8 instead of 4, which always produces zero for an 8-bit value. As a result, the stored EditPassword hash only preserves the low nibble of each digest byte, reducing the effective entropy from 160 bits to 80 bits. This is layered on top of an unsalted SHA-1 scheme. The reduced entropy makes leaked or backed-up password hashes materially easier to brute-force.
This issue has been fixed in version 1.17.3. | 2.00 | ['https://github.com/sandboxie-plus/Sandboxie/security/advisories/GHSA-w37h-qm9p-h4x2'] | 2026-05-05 23:16:37+03:00 | {'in_kev': False} | 3d319f19c69ee2cc2c56f29112b4fc37edc80deeb856bb25264e4832877bb6bd | 2026-05-27 22:46:07.164160+03:00 | 2026-05-28 17:55:21.240206+03:00 | |||||
CVE-2026-32936 | CoreDNS is a DNS server that chains plugins. In versions prior to 1.14.3, the DNS-over-HTTPS (DoH) GET path accepts oversized dns= query parameter values and performs URL query parsing, base64 decoding, and DNS message unpacking before rejecting the request. Unlike the POST path, which applies a bounded read via http.MaxBytesReader limited to 65536 bytes, the GET path has no equivalent size validation before expensive processing. A remote, unauthenticated attacker can repeatedly send oversized DoH GET requests to force high CPU usage, large transient memory allocations, and elevated garbage-collection pressure, leading to denial of service. This issue has been fixed in version 1.14.3. | 8.70 | ['https://github.com/coredns/coredns/releases/tag/v1.14.3', 'https://github.com/coredns/coredns/security/advisories/GHSA-63cw-r7xf-jmwr', 'https://github.com/coredns/coredns/security/advisories/GHSA-63cw-r7xf-jmwr'] | 2026-05-05 23:16:36+03:00 | {'in_kev': False} | 56dedf05954e29027c78c5d0b1a45f956fd3023786f3ee611f9bfa242f4f0af5 | 2026-05-27 22:46:07.164160+03:00 | 2026-05-28 17:55:21.240206+03:00 | |||||
CVE-2026-33190 | CoreDNS is a DNS server that chains plugins. In versions prior to 1.14.3, the tsig plugin can be bypassed on non-plain-DNS transports (DoT, DoH, DoH3, DoQ, and gRPC) because it trusts the transport writer's TsigStatus() instead of performing verification itself. The DoH and DoH3 writer's TsigStatus() always returns nil, the DoT server does not set TsigSecret on the dns.Server, and the DoQ and gRPC writers also unconditionally return nil. This allows an unauthenticated remote client to bypass TSIG-based authentication and access resources intended to be restricted behind a tsig require all policy. Plain DNS over TCP and UDP are not affected. This issue has been fixed in version 1.14.3. | 8.70 | ['https://github.com/coredns/coredns/releases/tag/v1.14.3', 'https://github.com/coredns/coredns/security/advisories/GHSA-qhmp-q7xh-99rh'] | 2026-05-05 23:16:36+03:00 | {'in_kev': False} | 5577a5005259590ec162952015bdd3a5d150084cab819799cf374d54ab7e5c1d | 2026-05-27 22:46:07.164160+03:00 | 2026-05-28 17:55:21.240206+03:00 | |||||
CVE-2026-33324 | SQLBot is an intelligent Text-to-SQL system based on large language models and RAG. In versions 1.7.0 and earlier, the Text2SQL chat interface is vulnerable to prompt injection. The user-provided question parameter is directly concatenated into the LLM prompt without filtering or escaping, and the SQL extracted from the LLM response is executed against the database without validation or sanitization. An authenticated attacker can craft a malicious question to manipulate the LLM into generating and executing arbitrary SQL statements. When connected to a PostgreSQL data source, this can lead to remote code execution via COPY FROM PROGRAM. This issue has been fixed in version 1.7.1. | 9.40 | ['https://github.com/dataease/SQLBot/security/advisories/GHSA-q2q6-gqqh-4xrx', 'https://github.com/dataease/SQLBot/security/advisories/GHSA-q2q6-gqqh-4xrx'] | 2026-05-05 23:16:36+03:00 | {'in_kev': False} | 82694ea9f4e5aced02b4f24a818c80cd6002baef37fead5092dee401cacf63ca | 2026-05-27 22:46:07.164160+03:00 | 2026-05-28 17:55:21.240206+03:00 | |||||
CVE-2026-33420 | Vaultwarden is a Bitwarden-compatible server written in Rust. In version 1.35.4 and earlier, the get_org_collections_details endpoint (GET /api/organizations/{org_id}/collections/details) is missing the has_full_access() authorization check that exists on the sibling get_org_collections endpoint. This allows any Manager-role user with accessAll=False and no collection assignments to retrieve the names, UUIDs, user-to-collection mappings, and group-to-collection mappings for all collections in the organization. This issue has been fixed in version 1.35.5. | 5.30 | ['https://github.com/dani-garcia/vaultwarden/releases/tag/1.35.5', 'https://github.com/dani-garcia/vaultwarden/security/advisories/GHSA-jjxg-p3v6-52ww'] | 2026-05-05 23:16:36+03:00 | {'in_kev': False} | d0af98e57be3f56ba9c46eade47ccde730a69d0a298198d27c414c8b942a907b | 2026-05-27 22:46:07.164160+03:00 | 2026-05-28 17:55:21.240206+03:00 | |||||
CVE-2026-33489 | CoreDNS is a DNS server that chains plugins. In versions prior to 1.14.3, the transfer plugin can select the wrong ACL stanza when both a parent zone and a more-specific subzone are configured. The longestMatch() function in plugin/transfer/transfer.go uses a lexicographic string comparison instead of an actual longest-suffix match to select the winning zone. As a result, a permissive parent-zone transfer rule can override a restrictive subzone rule depending on zone name ordering (e.g., "example.org." > "a.example.org." lexicographically). This allows an unauthorized remote client to perform AXFR/IXFR for the subzone and retrieve its full zone contents. This issue has been fixed in version 1.14.3. | 8.20 | ['https://github.com/coredns/coredns/releases/tag/v1.14.3', 'https://github.com/coredns/coredns/security/advisories/GHSA-h8mm-c463-wjq3', 'https://github.com/coredns/coredns/security/advisories/GHSA-h8mm-c463-wjq3'] | 2026-05-05 23:16:36+03:00 | {'in_kev': False} | ef4a472978dc6d3dfc9f5da7185b126e23d0e14c090b715a71c3f659f39be13e | 2026-05-27 22:46:07.164160+03:00 | 2026-05-28 17:55:21.240206+03:00 | |||||
CVE-2026-33975 | Twenty is an open source CRM built with NestJS (Node.js). In versions 1.18.0 and earlier, the SSRF protection in twenty-server's SecureHttpClientService can be bypassed using IPv4-mapped IPv6 addresses in URL IP literals. Node.js's URL parser normalizes IPv4-mapped IPv6 addresses to compressed hex form (e.g., ::ffff:169.254.169.254 becomes ::ffff:a9fe:a9fe), but the isPrivateIp utility only recognizes the dotted-decimal notation. As a result, the hex form passes the SSRF check unchecked. Additionally, the socket lookup validation event does not fire for IP literal addresses, bypassing the second validation layer. An authenticated user can reach any internal IP, including cloud metadata endpoints, to exfiltrate credentials such as IAM keys. | 8.30 | ['https://github.com/twentyhq/twenty/security/advisories/GHSA-vrcj-hv2q-c58m'] | 2026-05-05 23:16:36+03:00 | {'in_kev': False} | 21a047f77cc810e5ea0a75978a9cdbd4d5589ee65e5140fb82adac0a8844176d | 2026-05-27 22:46:07.164160+03:00 | 2026-05-28 17:55:21.240206+03:00 | |||||
CVE-1999-0031 | JavaScript in Internet Explorer 3.x and 4.x, and Netscape 2.x, 3.x and 4.x, allows remote attackers to monitor a user's web activities, aka the Bell Labs vulnerability. | 2.60 | {'score': 2.6} | 0.029390000 | ['http://www.codetalker.com/advisories/vendor/hp/hpsbux9707-065.html', 'http://www.codetalker.com/advisories/vendor/hp/hpsbux9707-065.html'] | ['cpe:2.3:a:microsoft:internet_explorer:3.0', 'cpe:2.3:a:microsoft:internet_explorer:4.0', 'cpe:2.3:a:netscape:communicator:2.0', 'cpe:2.3:a:netscape:communicator:3.0', 'cpe:2.3:a:netscape:communicator:4.0'] | 1997-07-08 04:00:00+04:00 | {'in_kev': False} | 1ba00a1e771aee05f3100efc9a8681553ee706e7ceabbce49d9ffde9b24dc285 | 2026-06-10 18:34:38.588522+03:00 | 2026-06-10 18:34:38.588522+03:00 | ||
CVE-2026-31893 | Tunnelblick is an open source graphic user interface for OpenVPN on macOS. In versions 3.3beta26 through 9.0beta01, any local user can read arbitrary root-owned files by exploiting a symlink following vulnerability in tunnelblick-helper, reachable through the world-accessible tunnelblickd Unix socket. The socket is configured with mode 0666, allowing any local user to connect. No authorization check is performed on the connecting client. The tunnelblick-helper process constructs a path to config.ovpn inside a user-controlled .tblk directory and reads it as root without symlink validation. An attacker can create a .tblk configuration with a symlinked config.ovpn pointing to any file and request tunnelblickd to read it. This issue has been fixed in versions 9.0beta02. | 6.80 | ['https://github.com/Tunnelblick/Tunnelblick/releases/tag/v9.0beta02', 'https://github.com/Tunnelblick/Tunnelblick/security/advisories/GHSA-927j-vcjf-hq69', 'https://github.com/Tunnelblick/Tunnelblick/security/advisories/GHSA-927j-vcjf-hq69'] | 2026-05-05 23:16:35+03:00 | {'in_kev': False} | 4620e5a18dc535fc70772640cc939b354b8f585281d030b56661d48af83da298 | 2026-05-27 22:46:07.164160+03:00 | 2026-05-28 17:55:21.240206+03:00 | |||||
CVE-2026-32603 | Sandboxie is an open source sandbox-based isolation software for Windows. In versions 1.17.2 and earlier, a local denial of service vulnerability exists in the Sandboxie kernel driver. An unprivileged process running inside a Standard Sandbox can send a malformed IOCTL to the \Device\SandboxieDriverApi driver, triggering an immediate kernel crash (BSOD). The vulnerability affects the Standard Sandbox configuration both with and without dropped administrator privileges, but does not affect the Security Hardened Sandbox configuration. This issue has been fixed in version 1.17.3. Users who cannot update can use the Security Hardened Sandbox configuration as a workaround. | 8.20 | ['https://github.com/sandboxie-plus/Sandboxie/releases/tag/v1.17.3', 'https://github.com/sandboxie-plus/Sandboxie/security/advisories/GHSA-vvf8-cf4j-v8fv'] | 2026-05-05 23:16:35+03:00 | {'in_kev': False} | 23acf2f499947edb0a431146647591f488789e75b9e5d01b47f1bdaf7c772454 | 2026-05-27 22:46:07.164160+03:00 | 2026-05-28 17:55:21.240206+03:00 | |||||
CVE-2026-32699 | FacturaScripts is an open source accounting and invoicing software. In versions 2025.92 and earlier, the application fails to validate the nick parameter during a POST request to the EditUser controller. Although the user interface prevents editing this field, a user can bypass this restriction by intercepting the request and modifying the nick form-data parameter to rename any account, including the administrator account. This leads to unauthorized modification of a field intended to be immutable. | 5.30 | ['https://github.com/NeoRazorX/facturascripts/security/advisories/GHSA-pp79-hqv6-vmc3', 'https://github.com/NeoRazorX/facturascripts/security/advisories/GHSA-pp79-hqv6-vmc3'] | 2026-05-05 23:16:35+03:00 | {'in_kev': False} | 105c213966ed3818b1240909dafe142cdefb3fec436295f87b5bde1e9f3cf6f3 | 2026-05-27 22:46:07.164160+03:00 | 2026-05-28 17:55:21.240206+03:00 | |||||
CVE-2024-52911 | Bitcoin Core through 28.x has a security issue, the details of which are not disclosed. The earliest affected version is 0.14. | ['https://bitcoincore.org', 'https://bitcoincore.org/en/2026/05/05/disclose-cve-2024-52911/', 'https://en.bitcoin.it/wiki/Common_Vulnerabilities_and_Exposures'] | 2026-05-05 23:16:34+03:00 | {'in_kev': False} | 9a6707d6027e69d97adcd8a6ffba3383415945e891f083af624c7204779ba7e1 | 2026-05-27 22:46:07.164160+03:00 | 2026-05-28 17:55:21.240206+03:00 | ||||||
CVE-2026-7854 | A security vulnerability has been detected in D-Link DI-8100 16.07.26A1. Affected by this vulnerability is the function url_rule_asp of the file /url_rule.asp of the component POST Parameter Handler. Such manipulation leads to buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used. | 8.90 | {'score': 10.0} | {'score': 9.8} | ['https://github.com/draw-ctf/report/blob/main/DI-8100/url_rule_asp_overflow.md', 'https://vuldb.com/submit/807838', 'https://vuldb.com/vuln/361131', 'https://vuldb.com/vuln/361131/cti', 'https://www.dlink.com/'] | 2026-05-05 22:16:23+03:00 | {'in_kev': False} | 328efe9660b94db12e9740c5e3a526a661adf31cc3a00a046d2c8e3e0f8462a6 | 2026-05-27 22:46:07.164160+03:00 | 2026-05-28 17:55:21.240206+03:00 | |||
CVE-2026-7855 | A vulnerability was detected in D-Link DI-8100 16.07.26A1. Affected by this issue is the function tggl_asp of the file /tggl.asp of the component HTTP Request Handler. Performing a manipulation of the argument Name results in buffer overflow. The attack can be initiated remotely. The exploit is now public and may be used. | 7.40 | {'score': 9.0} | {'score': 8.8} | ['https://github.com/draw-ctf/report/blob/main/DI-8100/tggl_asp_overflow.md', 'https://vuldb.com/submit/807841', 'https://vuldb.com/vuln/361132', 'https://vuldb.com/vuln/361132/cti', 'https://www.dlink.com/'] | 2026-05-05 22:16:23+03:00 | {'in_kev': False} | 884f0672bb6eddf584b31fed9d63da8089c7b5193741a867f2940d87cba5eb5b | 2026-05-27 22:46:07.164160+03:00 | 2026-05-28 17:55:21.240206+03:00 | |||
CVE-2026-42997 | An issue was discovered in idrac in OpenStack Ironic before 35.0.1. During import, a user invoking molds can request authorization to be sent to a remote endpoint. The credential forwarded is a time-limited Keystone token (which provides access to all OpenStack services Ironic is authorized for); or basic credentials configured for molds storage. The fixed versions are 26.1.6, 29.0.5, 32.0.1, and 35.0.1. | 7.70 | {'score': 7.7} | ['https://www.openwall.com/lists/oss-security/2026/05/05/10', 'http://www.openwall.com/lists/oss-security/2026/05/05/10'] | 2026-05-05 22:16:22+03:00 | {'in_kev': False} | 8f6284814a935232731eaed7cb3ede6baf82573e6adde84a99d8d44c5f838af6 | 2026-05-27 22:46:07.164160+03:00 | 2026-05-28 17:55:21.240206+03:00 | ||||
CVE-2026-27960 | OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. In versions 6.6.0 through 6.9.12, there is a privilege escalation vulnerability that can be exploited by unauthenticated attackers to query the API as any existing user, including the default admin account. This issue has been fixed in version 6.9.13. As a workaround, the default admin can be disabled using the `APP__ADMIN__EXTERNALLY_MANAGED` configuration. | 9.80 | {'score': 9.8} | ['https://github.com/OpenCTI-Platform/opencti/security/advisories/GHSA-6vvv-vmfr-xhrx'] | 2026-05-05 22:16:21+03:00 | {'in_kev': False} | fca596b292917256e5adf6c93d5ab487d1de91c73d506d02423c5ba0632cb56d | 2026-05-27 22:46:07.164160+03:00 | 2026-05-28 17:55:21.240206+03:00 | ||||
CVE-2026-30923 | ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. Libmodsecurity is one component of the ModSecurity v3 project. A segmentation fault occurs when a rule using the t:hexDecode transformation inspects a query string parameter containing a single character. An attacker can exploit this to crash worker processes, causing a denial of service. Service resumes once the attack stops as worker processes recover from the segfault. All versions before 3.0.15 of libModSecurity3 are affected. This has been patched in version 3.0.15. | 8.20 | ['https://github.com/owasp-modsecurity/ModSecurity/releases/tag/v3.0.15', 'https://github.com/owasp-modsecurity/ModSecurity/security/advisories/GHSA-qrjc-3jpc-3h2g', 'https://github.com/owasp-modsecurity/ModSecurity/security/advisories/GHSA-qrjc-3jpc-3h2g'] | 2026-05-05 22:16:21+03:00 | {'in_kev': False} | 8f99a8a56af99a93b1b16809da708dce445f3284cd0838b6961761fa5e9f78a4 | 2026-05-27 22:46:07.164160+03:00 | 2026-05-28 17:55:21.240206+03:00 | |||||
CVE-1999-0062 | The chpass command in OpenBSD allows a local user to gain root access through file descriptor leakage. | 7.20 | {'score': 7.2} | 0.000600000 | ['http://www.osvdb.org/7559', 'http://www.osvdb.org/7559'] | ['cpe:2.3:o:openbsd:openbsd:2.3'] | 1998-08-03 04:00:00+04:00 | {'in_kev': False} | 8f427e5b0309f1b925d21a8c7b9a35af672f91b813c058f0309923e58ddbae80 | 2026-06-10 18:34:38.588522+03:00 | 2026-06-10 18:34:38.588522+03:00 | ||
CVE-2026-31835 | Vaultwarden is a Bitwarden-compatible server written in Rust. In versions 1.35.4 and earlier, the WebAuthn authentication flow in `validate_webauthn_login()` updates persistent credential metadata (1backup_eligible1 and 1backup_state flags1) based on unverified `authenticatorData` before signature validation is performed. An attacker who knows a user's password but cannot produce a valid WebAuthn signature can permanently modify the stored backup flags for that user's credential. If signature verification fails, the database update is not rolled back. This can result in a persistent denial of service of WebAuthn two-factor authentication for affected credentials. This issue has been fixed in version 1.35.5. | 5.30 | ['https://github.com/dani-garcia/vaultwarden/releases/tag/1.35.5', 'https://github.com/dani-garcia/vaultwarden/security/advisories/GHSA-x7g7-cgx5-jhx2'] | 2026-05-05 22:16:21+03:00 | {'in_kev': False} | 888c1e3af87e6933d407cb0fe6861015d3c5e2c29d6826cb86118a6722f25633 | 2026-05-27 22:46:07.164160+03:00 | 2026-05-28 17:55:21.240206+03:00 | |||||
CVE-2026-7853 | A weakness has been identified in D-Link DI-8100 16.07.26A1. Affected is the function sprintf of the file /auto_reboot.asp of the component HTTP Handler. This manipulation of the argument enable/time causes buffer overflow. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks. | 8.90 | {'score': 10.0} | {'score': 9.8} | ['https://github.com/draw-ctf/report/blob/main/DI-8100/auto_reboot_asp_overflow.md', 'https://vuldb.com/submit/807837', 'https://vuldb.com/vuln/361130', 'https://vuldb.com/vuln/361130/cti', 'https://www.dlink.com/'] | 2026-05-05 21:16:04+03:00 | {'in_kev': False} | bdca1c77bdaecdcfa842c75af64bc25d03cdc9eba31c0b6a56750c59916246b6 | 2026-05-27 22:46:07.164160+03:00 | 2026-05-28 17:55:21.240206+03:00 | |||
CVE-2026-7851 | A vulnerability was identified in D-Link DI-8100 16.07.26A1. This affects the function sprintf of the file yyxz.asp. The manipulation of the argument ID leads to stack-based buffer overflow. The attack is possible to be carried out remotely. The exploit is publicly available and might be used. | 7.30 | {'score': 8.3} | {'score': 7.2} | ['https://github.com/draw-ctf/report/blob/main/DI-8100/yyxz_dlink_asp_overflow.md', 'https://vuldb.com/submit/807798', 'https://vuldb.com/vuln/361128', 'https://vuldb.com/vuln/361128/cti', 'https://www.dlink.com/'] | 2026-05-05 21:16:03+03:00 | {'in_kev': False} | 7556d6ecb731d9809b048dec63ea419f2333303ea1192c222f576478401d7f17 | 2026-05-27 22:46:07.164160+03:00 | 2026-05-28 17:55:21.240206+03:00 | |||
CVE-2026-7847 | A vulnerability was found in chatchat-space Langchain-Chatchat up to 0.3.1.3. The affected element is the function _get_file_id of the file libs/chatchat-server/chatchat/server/api_server/openai_routes.py of the component Uploaded File Handler. Performing a manipulation results in insufficiently random values. Access to the local network is required for this attack. The attack's complexity is rated as high. The exploitability is described as difficult. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet. | 1.20 | {'score': 1.4} | {'score': 2.6} | ['https://github.com/3em0/cve_repo/blob/main/Langchain-Chatchat/Vuln-3-Predictable-File-ID.md', 'https://github.com/chatchat-space/Langchain-Chatchat/', 'https://github.com/chatchat-space/Langchain-Chatchat/issues/5464', 'https://vuldb.com/submit/807796', 'https://vuldb.com/vuln/361126', 'https://vuldb.com/vuln/361126/cti'] | 2026-05-05 20:17:05+03:00 | {'in_kev': False} | 31a6c2fb7c588ed9e222681f1d81899829dd6b8465595d9081280515541f5abc | 2026-05-27 22:46:07.164160+03:00 | 2026-05-28 17:55:21.240206+03:00 | |||
CVE-2026-38431 | ERPNext v15.103.1 and before is vulnerable to Server-Side Template Injection (SSTI). An attacker with permission to create or edit email templates can inject template expressions that are executed on the server when the template is rendered. | ['https://c0wking.hashnode.dev/ssti-in-erpnext-frappe-email-template-engine'] | 2026-05-05 20:17:04+03:00 | {'in_kev': False} | 0d70cc724f5f6e495e9a9ad0565d5f8abf7147a28b93341f99ff82ae680fd428 | 2026-05-27 22:46:07.164160+03:00 | 2026-05-28 17:55:21.240206+03:00 | ||||||
CVE-2026-38432 | ERPNext v15.103.1 and before is vulnerable to Cross Site Scripting (XSS) in the Email Template engine. An attacker with permission to create or edit email templates can inject malicious JavaScript code that are executed on the victim's browser when the template is applied. | ['https://c0wking.hashnode.dev/stored-xss-in-erpnext-frappe-email-template-engine'] | 2026-05-05 20:17:04+03:00 | {'in_kev': False} | 9579da730918a570bdccaed8e6b05325aad40dab8accbe184a258a3991f86c6a | 2026-05-27 22:46:07.164160+03:00 | 2026-05-28 17:55:21.240206+03:00 | ||||||
CVE-2026-43002 | An issue was discovered in OpenStack Horizon 25.6 and 25.7 before 25.7.3. There is a write operation to the session storage backend before authentication and thus storage can be exhausted by unauthenticated requests. This is a regression of the CVE-2014-8124 fix. | 5.30 | {'score': 5.3} | ['https://bugs.launchpad.net/horizon/+bug/2150331', 'https://www.openwall.com/lists/oss-security/2026/05/05/7', 'https://bugs.launchpad.net/horizon/+bug/2150331'] | 2026-05-05 20:17:04+03:00 | {'in_kev': False} | fbf9f06543d3d201f65ac044d7dc0cb67987dfd3da111261de392758339dfd52 | 2026-05-27 22:46:07.164160+03:00 | 2026-05-28 17:55:21.240206+03:00 | ||||
CVE-2026-23631 | Redis is an in-memory data structure store. In all versions of redis-server with Lua scripting, an authenticated attacker can exploit the master-replica synchronization mechanism to trigger a use-after-free on replicas where replica-read-only is disabled or can be disabled, which may lead to remote code execution. A workaround is to prevent users from executing Lua scripts or avoid using replicas where replica-read-only is disabled. This is patched in version 8.6.3. | 6.10 | ['https://github.com/redis/redis/releases/tag/8.6.3', 'https://github.com/redis/redis/security/advisories/GHSA-8ghh-qpmp-7826'] | 2026-05-05 20:17:03+03:00 | {'in_kev': False} | 45af28351c066eb7ec1f9bd7392e553c87e54571b10453daebd4ef1360b638bb | 2026-05-27 22:46:07.164160+03:00 | 2026-05-28 17:55:21.240206+03:00 | |||||
CVE-2026-25243 | Redis is an in-memory data structure store. In versions of redis-server up to 8.6.3, the RESTORE command does not properly validate serialized values. An authenticated attacker with permission to execute RESTORE can supply a crafted serialized payload that triggers invalid memory access and may lead to remote code execution. A workaround is to restrict access to the RESTORE command with ACL rules. This is patched in version 8.6.3. | 7.70 | ['https://github.com/redis/redis/releases/tag/8.6.3', 'https://github.com/redis/redis/security/advisories/GHSA-c8h9-259x-jff4'] | 2026-05-05 20:17:03+03:00 | {'in_kev': False} | 02476b20a8565dc31d2ade6874bb71d4c296fcbd2860a8653c8ffa4d2f9e119c | 2026-05-27 22:46:07.164160+03:00 | 2026-05-28 17:55:21.240206+03:00 | |||||
CVE-2026-25588 | RedisTimeSeries is a time-series module for Redis. In all versions before 1.12.14 of RedisTimeSeries, the module does not properly validate serialized values processed through the Redis RESTORE command. An authenticated attacker with permission to execute RESTORE on a server with the RedisTimeSeries module loaded can supply a crafted serialized payload that triggers invalid memory access and may lead to remote code execution. A workaround is to restrict access to the RESTORE command with ACL rules. This has been patched in version 1.12.14. | 7.70 | ['https://github.com/RedisTimeSeries/RedisTimeSeries/releases/tag/v1.12.14', 'https://github.com/RedisTimeSeries/RedisTimeSeries/security/advisories/GHSA-7jwr-g5qv-w3gw'] | 2026-05-05 20:17:03+03:00 | {'in_kev': False} | d7db7fb70f113dc7351e10a2c892e7d94ef12a1d79177fd001e71d9b125822bb | 2026-05-27 22:46:07.164160+03:00 | 2026-05-28 17:55:21.240206+03:00 | |||||
CVE-2026-25589 | RedisBloom is a probabilistic data structures module for Redis. In all versions of RedisBloom before 2.8.20, the module does not properly validate serialized values processed through the Redis RESTORE command. An authenticated attacker with permission to execute RESTORE on a server with the RedisBloom module loaded can supply a crafted serialized payload that triggers invalid memory access and may lead to remote code execution. A workaround is to restrict access to the RESTORE command with ACL rules. This issue is fixed in version 2.8.20. | 7.70 | ['https://github.com/RedisBloom/RedisBloom/releases/tag/v2.8.20', 'https://github.com/RedisBloom/RedisBloom/security/advisories/GHSA-7862-34pw-44wv'] | 2026-05-05 20:17:03+03:00 | {'in_kev': False} | 5d476126899b5a8631d45de3ec4413b2f3cec1bedea635932a929282b851948b | 2026-05-27 22:46:07.164160+03:00 | 2026-05-28 17:55:21.240206+03:00 | |||||
CVE-2026-23479 | Redis is an in-memory data structure store. In redis-server from 7.2.0 until 8.6.3, the unblock client flow does not handle an error return from `processCommandAndResetClient` when re-executing a blocked command. If a blocked client is evicted during this flow, an authenticated attacker can trigger a use-after-free that may lead to remote code execution. This has been patched in version 8.6.3. | 7.70 | ['https://github.com/redis/redis/releases/tag/8.6.3', 'https://github.com/redis/redis/security/advisories/GHSA-93m2-935m-8rj3'] | 2026-05-05 20:17:02+03:00 | {'in_kev': False} | 7a9a941e91fe8676e30fe1fea9e9254110f768e81f4be8bb7c96999a1fa889f1 | 2026-05-27 22:46:07.164160+03:00 | 2026-05-28 17:55:21.240206+03:00 | |||||
CVE-2026-7844 | A vulnerability was detected in chatchat-space Langchain-Chatchat up to 0.3.1.3. This vulnerability affects the function files/list_files/retrieve_file/retrieve_file_content/delete_file of the file libs/chatchat-server/chatchat/server/api_server/openai_routes.py of the component Compatible File Service. The manipulation results in missing authentication. The attacker must have access to the local network to execute the attack. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet. | 2.10 | {'score': 5.8} | {'score': 6.3} | ['https://github.com/3em0/cve_repo/blob/main/Langchain-Chatchat/Vuln-4-Missing-Auth-File-Endpoints.md', 'https://github.com/chatchat-space/Langchain-Chatchat/', 'https://github.com/chatchat-space/Langchain-Chatchat/issues/5465', 'https://vuldb.com/submit/807790', 'https://vuldb.com/vuln/361123', 'https://vuldb.com/vuln/361123/cti'] | 2026-05-05 19:16:19+03:00 | {'in_kev': False} | 7f027435592a2046a12a40c2c912d0ba71a84d64ae3ba9f673493e3eec381e87 | 2026-05-27 22:46:07.164160+03:00 | 2026-05-28 17:55:21.240206+03:00 | |||
CVE-2026-7845 | A flaw has been found in chatchat-space Langchain-Chatchat up to 0.3.1.3. This issue affects the function PIL.Image.tobytes of the file libs/chatchat-server/chatchat/webui_pages/dialogue/dialogue.py of the component Vision Chat Paste Image Handler. This manipulation of the argument paste_image.image_data causes use of weak hash. The attacker needs to be present on the local network. The attack is considered to have high complexity. The exploitability is assessed as difficult. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet. | 1.20 | {'score': 1.4} | {'score': 2.6} | ['https://github.com/3em0/cve_repo/blob/main/Langchain-Chatchat/Vuln-1-tobytes-Hash-Collision.md', 'https://github.com/chatchat-space/Langchain-Chatchat/', 'https://github.com/chatchat-space/Langchain-Chatchat/issues/5462', 'https://vuldb.com/submit/807794', 'https://vuldb.com/vuln/361124', 'https://vuldb.com/vuln/361124/cti', 'https://github.com/chatchat-space/Langchain-Chatchat/issues/5462'] | 2026-05-05 19:16:19+03:00 | {'in_kev': False} | 4fe7d2c3ca88fe58998cde42613e0e037c708f3b1c524cfbfb4808ab851476da | 2026-05-27 22:46:07.164160+03:00 | 2026-05-28 17:55:21.240206+03:00 | |||
CVE-2026-7846 | A vulnerability has been found in chatchat-space Langchain-Chatchat up to 0.3.1.3. Impacted is the function files of the file libs/chatchat-server/chatchat/server/api_server/openai_routes.py of the component OpenAI-Compatible File Upload API. Such manipulation of the argument file.filename leads to time-of-check time-of-use. Access to the local network is required for this attack to succeed. The attack requires a high level of complexity. The exploitability is considered difficult. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through an issue report but has not responded yet. | 1.20 | {'score': 1.4} | {'score': 2.6} | ['https://github.com/3em0/cve_repo/blob/main/Langchain-Chatchat/Vuln-2-Silent-File-Overwrite.md', 'https://github.com/chatchat-space/Langchain-Chatchat/', 'https://github.com/chatchat-space/Langchain-Chatchat/issues/5463', 'https://vuldb.com/submit/807795', 'https://vuldb.com/vuln/361125', 'https://vuldb.com/vuln/361125/cti'] | 2026-05-05 19:16:19+03:00 | {'in_kev': False} | 511c96a9936ded84feee860c10868a231162d95513c14bdba77fe0283aaa0da0 | 2026-05-27 22:46:07.164160+03:00 | 2026-05-28 17:55:21.240206+03:00 | |||
CVE-2026-7865 | A hidden console command is vulnerable to command injection
flaw when control characters are passed to its second argument.
A third party researcher Eugene Lim had discovered vulnerability
in the way console command passes to a popen function call. Attackers with
authenticated access to SSH console of Crestron devices may use to run
underlying OS commands. | 7.40 | ['https://www.crestron.com/Software-Firmware/Firmware/Touchpanels/TS-770-TS-1070-TSS-770-TSS-1070-TSW-570/3-003-0015-001', 'https://www.crestron.com/release_notes/tsw-xx70_3.003.0015.001_release_notes.pdf'] | 2026-05-05 19:16:19+03:00 | {'in_kev': False} | f83a5a95aec91bd6796d6b7b01d419842dc8e28bfd43e038e65c13b1c3b8894d | 2026-05-27 22:46:07.164160+03:00 | 2026-05-28 17:55:21.240206+03:00 | |||||
CVE-2026-6907 | An issue was discovered in 6.0 before 6.0.5 and 5.2 before 5.2.14.
`django.middleware.cache.UpdateCacheMiddleware` erroneously caches requests where the `Vary` header contained an asterisk (`'*'`). This can lead to private data being stored and served.
Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.
Django would like to thank Ahmad Sadeddin for reporting this issue. | 2.30 | {'score': 4.3} | ['https://docs.djangoproject.com/en/dev/releases/security/', 'https://groups.google.com/g/django-announce', 'https://www.djangoproject.com/weblog/2026/may/05/security-releases/'] | 2026-05-05 19:16:18+03:00 | {'in_kev': False} | cccabb551fa3893ac76fd07031c740e7df00ce1523023fdfdbef19f2a116b007 | 2026-05-27 22:46:07.164160+03:00 | 2026-05-28 17:55:21.240206+03:00 | ||||
CVE-2026-7411 | In Eclipse BaSyx Java Server SDK versions prior to 2.0.0-milestone-10, inadequate path normalization in the Submodel HTTP API allows an unauthenticated remote attacker to perform a path traversal attack. By supplying a maliciously crafted fileName parameter during a file upload operation, an attacker can bypass intended storage boundaries and write arbitrary files to any location on the host filesystem accessible by the Java process. This can lead to Remote Code Execution (RCE) and complete system compromise. | 10.00 | {'score': 10.0} | ['https://gitlab.eclipse.org/security/cve-assignment/-/issues/102', 'https://gitlab.eclipse.org/security/vulnerability-reports/-/issues/423'] | 2026-05-05 19:16:18+03:00 | {'in_kev': False} | 09cf2209fe3037a7134d19fd9236868f0969606917f93fc375bd522493b21c9f | 2026-05-27 22:46:07.164160+03:00 | 2026-05-28 17:55:21.240206+03:00 | ||||
CVE-1999-0077 | Predictable TCP sequence numbers allow spoofing. | 5.00 | {'score': 5.0} | 0.121280000 | ['https://exchange.xforce.ibmcloud.com/vulnerabilities/139', 'https://exchange.xforce.ibmcloud.com/vulnerabilities/139'] | ['cpe:2.3:o:microsoft:windows_nt:4.0'] | 1995-01-01 05:00:00+03:00 | {'in_kev': False} | 241246e42536d399856268a6c84cea04e195b70d49cf9f9dbecf68208d8fcb13 | 2026-06-10 18:34:38.588522+03:00 | 2026-06-10 18:34:38.588522+03:00 | ||
CVE-2026-38428 | Kestra v1.3.3 and before is vulnerable to SQL Injection. The vulnerability occurs because user-controlled input from a GET parameter is directly concatenated into an SQL query without proper sanitization or parameterization. As a result, attackers can inject arbitrary SQL expressions into the database query. | ['https://github.com/kestra-io/kestra/security/advisories/GHSA-365w-2m69-mp9x', 'https://www.link.com'] | 2026-05-05 22:16:21+03:00 | {'in_kev': False} | 8c9e3f40471f3ec1fb8428ca43157b754c906e84b274016182e534efbfb95c4c | 2026-05-27 22:46:07.164160+03:00 | 2026-05-28 17:55:21.240206+03:00 | ||||||
CVE-2026-43068 | In the Linux kernel, the following vulnerability has been resolved:
ext4: avoid allocate block from corrupted group in ext4_mb_find_by_goal()
There's issue as follows:
...
EXT4-fs (mmcblk0p1): Delayed block allocation failed for inode 206 at logical offset 0 with max blocks 1 with error 117
EXT4-fs (mmcblk0p1): This should not happen!! Data will be lost
EXT4-fs (mmcblk0p1): Delayed block allocation failed for inode 206 at logical offset 0 with max blocks 1 with error 117
EXT4-fs (mmcblk0p1): This should not happen!! Data will be lost
EXT4-fs (mmcblk0p1): Delayed block allocation failed for inode 206 at logical offset 0 with max blocks 1 with error 117
EXT4-fs (mmcblk0p1): This should not happen!! Data will be lost
EXT4-fs (mmcblk0p1): Delayed block allocation failed for inode 206 at logical offset 0 with max blocks 1 with error 117
EXT4-fs (mmcblk0p1): This should not happen!! Data will be lost
EXT4-fs (mmcblk0p1): Delayed block allocation failed for inode 2243 at logical offset 0 with max blocks 1 with error 117
EXT4-fs (mmcblk0p1): This should not happen!! Data will be lost
EXT4-fs (mmcblk0p1): Delayed block allocation failed for inode 2239 at logical offset 0 with max blocks 1 with error 117
EXT4-fs (mmcblk0p1): This should not happen!! Data will be lost
EXT4-fs (mmcblk0p1): error count since last fsck: 1
EXT4-fs (mmcblk0p1): initial error at time 1765597433: ext4_mb_generate_buddy:760
EXT4-fs (mmcblk0p1): last error at time 1765597433: ext4_mb_generate_buddy:760
...
According to the log analysis, blocks are always requested from the
corrupted block group. This may happen as follows:
ext4_mb_find_by_goal
ext4_mb_load_buddy
ext4_mb_load_buddy_gfp
ext4_mb_init_cache
ext4_read_block_bitmap_nowait
ext4_wait_block_bitmap
ext4_validate_block_bitmap
if (!grp || EXT4_MB_GRP_BBITMAP_CORRUPT(grp))
return -EFSCORRUPTED; // There's no logs.
if (err)
return err; // Will return error
ext4_lock_group(ac->ac_sb, group);
if (unlikely(EXT4_MB_GRP_BBITMAP_CORRUPT(e4b->bd_info))) // Unreachable
goto out;
After commit 9008a58e5dce ("ext4: make the bitmap read routines return
real error codes") merged, Commit 163a203ddb36 ("ext4: mark block group
as corrupt on block bitmap error") is no real solution for allocating
blocks from corrupted block groups. This is because if
'EXT4_MB_GRP_BBITMAP_CORRUPT(e4b->bd_info)' is true, then
'ext4_mb_load_buddy()' may return an error. This means that the block
allocation will fail.
Therefore, check block group if corrupted when ext4_mb_load_buddy()
returns error. | ['https://git.kernel.org/stable/c/0b84571c886719823d537f05f4f07cad6357c4b7', 'https://git.kernel.org/stable/c/1895f7904be71c48f1e6f338b28f24dabd6b8aeb', 'https://git.kernel.org/stable/c/1c0d7c4cde38a887c6d74e0c89ddb25226943c78', 'https://git.kernel.org/stable/c/2d31a5073f86a177edf44015e0dedb0c47cfd6d8', 'https://git.kernel.org/stable/c/46066e3a06647c5b186cc6334409722622d05c44', 'https://git.kernel.org/stable/c/9370207b36d26e45a8c8ef0500706d37036edd6b', 'https://git.kernel.org/stable/c/fea6b2e250ff48f10d166011b57a8516ae5438c9', 'https://git.kernel.org/stable/c/ffc0a282462d45fee5957621be5afa29752f3b6d'] | 2026-05-05 19:16:16+03:00 | {'in_kev': False} | bdb8ea66e55e580f4584bd2160f0bca7b53a74a0f03c90d7ebd8a99fc053604c | 2026-05-27 22:46:07.164160+03:00 | 2026-05-28 17:55:21.240206+03:00 | ||||||
CVE-2026-43069 | In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: hci_ll: Fix firmware leak on error path
Smatch reports:
drivers/bluetooth/hci_ll.c:587 download_firmware() warn:
'fw' from request_firmware() not released on lines: 544.
In download_firmware(), if request_firmware() succeeds but the returned
firmware content is invalid (no data or zero size), the function returns
without releasing the firmware, resulting in a resource leak.
Fix this by calling release_firmware() before returning when
request_firmware() succeeded but the firmware content is invalid. | ['https://git.kernel.org/stable/c/28904375d54b436a757641fb0331537778c0de5a', 'https://git.kernel.org/stable/c/31148a7be723aa9f2e8fbd62424825ab8d577973', 'https://git.kernel.org/stable/c/5213ef54528dd1ac79b846e30d8f72ce092794aa', 'https://git.kernel.org/stable/c/95e8601af227b2b4390eecf8db6abdb9f6a91f17', 'https://git.kernel.org/stable/c/9ecbfd93cd6de6c78cb7fd51fe079e36c7ff074b', 'https://git.kernel.org/stable/c/a7803df606a7d22e896b030f619e1d9d20ae0c6b', 'https://git.kernel.org/stable/c/b2dfbf1b5ff192cefd49574b951a4af9ddd32213', 'https://git.kernel.org/stable/c/e6d95488c8c964d1df0d3e1db44c958706311e86'] | 2026-05-05 19:16:16+03:00 | {'in_kev': False} | f886ec8cb6f6da97b8d36335379df248be25c2b7c694fd0da0be8ed342dcb226 | 2026-05-27 22:46:07.164160+03:00 | 2026-05-28 17:55:21.240206+03:00 | ||||||
CVE-2026-43070 | In the Linux kernel, the following vulnerability has been resolved:
bpf: Reset register ID for BPF_END value tracking
When a register undergoes a BPF_END (byte swap) operation, its scalar
value is mutated in-place. If this register previously shared a scalar ID
with another register (e.g., after an `r1 = r0` assignment), this tie must
be broken.
Currently, the verifier misses resetting `dst_reg->id` to 0 for BPF_END.
Consequently, if a conditional jump checks the swapped register, the
verifier incorrectly propagates the learned bounds to the linked register,
leading to false confidence in the linked register's value and potentially
allowing out-of-bounds memory accesses.
Fix this by explicitly resetting `dst_reg->id` to 0 in the BPF_END case
to break the scalar tie, similar to how BPF_NEG handles it via
`__mark_reg_known`. | ['https://git.kernel.org/stable/c/0d15c3611a2cc5d08993545d4032055ae10ae2c1', 'https://git.kernel.org/stable/c/a17443af874229408ce6b78e2c8a2b5adeb4b7d8', 'https://git.kernel.org/stable/c/a3125bc01884431d30d731461634c8295b6f0529'] | 2026-05-05 19:16:16+03:00 | {'in_kev': False} | 3f0cd323247a0ada304afe1c9cea2a5792cf1d52e24e612d3ddc4b9c74235735 | 2026-05-27 22:46:07.164160+03:00 | 2026-05-28 17:55:21.240206+03:00 | ||||||
CVE-2026-43071 | In the Linux kernel, the following vulnerability has been resolved:
dcache: Limit the minimal number of bucket to two
There is an OOB read problem on dentry_hashtable when user sets
'dhash_entries=1':
BUG: unable to handle page fault for address: ffff888b30b774b0
#PF: supervisor read access in kernel mode
#PF: error_code(0x0000) - not-present page
Oops: Oops: 0000 [#1] SMP PTI
RIP: 0010:__d_lookup+0x56/0x120
Call Trace:
d_lookup.cold+0x16/0x5d
lookup_dcache+0x27/0xf0
lookup_one_qstr_excl+0x2a/0x180
start_dirop+0x55/0xa0
simple_start_creating+0x8d/0xa0
debugfs_start_creating+0x8c/0x180
debugfs_create_dir+0x1d/0x1c0
pinctrl_init+0x6d/0x140
do_one_initcall+0x6d/0x3d0
kernel_init_freeable+0x39f/0x460
kernel_init+0x2a/0x260
There will be only one bucket in dentry_hashtable when dhash_entries is
set as one, and d_hash_shift is calculated as 32 by dcache_init(). Then,
following process will access more than one buckets(which memory region
is not allocated) in dentry_hashtable:
d_lookup
b = d_hash(hash)
dentry_hashtable + ((u32)hashlen >> d_hash_shift)
// The C standard defines the behavior of right shift amounts
// exceeding the bit width of the operand as undefined. The
// result of '(u32)hashlen >> d_hash_shift' becomes 'hashlen',
// so 'b' will point to an unallocated memory region.
hlist_bl_for_each_entry_rcu(b)
hlist_bl_first_rcu(head)
h->first // read OOB!
Fix it by limiting the minimal number of dentry_hashtable bucket to two,
so that 'd_hash_shift' won't exceeds the bit width of type u32. | ['https://git.kernel.org/stable/c/277cedabb0ab86baae83fa58218be13c6d3e5526', 'https://git.kernel.org/stable/c/426ef05e82ee52c8d0e95fc0808b7383d8352d73', 'https://git.kernel.org/stable/c/5718df131ab78897a9dd1f2e71c3ba732d4392af', 'https://git.kernel.org/stable/c/755b40903eff563768d4d96fd4ef51ec48adde3b', 'https://git.kernel.org/stable/c/ddd57ebce245f9c7e2f6902a6c087d6186d2385d', 'https://git.kernel.org/stable/c/f08fe8891c3eeb63b73f9f1f6d97aa629c821579'] | 2026-05-05 19:16:16+03:00 | {'in_kev': False} | 801cf1fb70fd7aa7c1c2e1e4d2e7d73d150626c53a827bcda16fbe337743fc3f | 2026-05-27 22:46:07.164160+03:00 | 2026-05-28 17:55:21.240206+03:00 | ||||||
CVE-1999-0005 | Arbitrary command execution via IMAP buffer overflow in authenticate command. | 10.00 | {'score': 10.0} | 0.126300000 | ['http://sunsolve.sun.com/pub-cgi/retrieve.pl?doctype=coll&doc=secbull/177', 'http://www.securityfocus.com/bid/130', 'http://sunsolve.sun.com/pub-cgi/retrieve.pl?doctype=coll&doc=secbull/177', 'http://www.securityfocus.com/bid/130'] | ['cpe:2.3:a:netscape:messaging_server:3.55', 'cpe:2.3:a:university_of_washington:imap:10.234'] | 1998-07-20 04:00:00+04:00 | {'in_kev': False} | a8ba249e95ba6ead97bceb0876ba13e3edb5b34da001f4441e0a43ce7ce787d2 | 2026-06-10 18:34:38.588522+03:00 | 2026-06-10 18:34:38.588522+03:00 | ||
CVE-1999-0020 | Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-1999-0032. Reason: This candidate is a duplicate of CVE-1999-0032. Notes: All CVE users should reference CVE-1999-0032 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage | 1999-01-01 05:00:00+03:00 | {'in_kev': False} | ccfedd26bf2f869274e9d4851ec6e0bf7e57a657759cecd76c9cfb231e6837ef | 2026-06-10 18:34:38.588522+03:00 | 2026-06-10 18:34:38.588522+03:00 | |||||||
CVE-2026-43072 | In the Linux kernel, the following vulnerability has been resolved:
drm/vc4: platform_get_irq_byname() returns an int
platform_get_irq_byname() will return a negative value if an error
happens, so it should be checked and not just passed directly into
devm_request_threaded_irq() hoping all will be ok. | ['https://git.kernel.org/stable/c/0185e0494a561edfc482507f9de89c2ad798b33d', 'https://git.kernel.org/stable/c/0c1b117f7ba46fb8f6ebc5e0bfe5b58568c301ba', 'https://git.kernel.org/stable/c/63c11b19cdc154fa848a6c3b535bfb1dc7b60378', 'https://git.kernel.org/stable/c/9c10b83a004442c93d7a484c3d221a06a45821e1', 'https://git.kernel.org/stable/c/e597a809a2b97e927060ba182f58eb3e6101bc70', 'https://git.kernel.org/stable/c/ef2ee9db13b68c5e332b77c0a7108a2d4d56e114'] | 2026-05-05 19:16:16+03:00 | {'in_kev': False} | ca412a288ad1fa4b1eb5816f360784b89a4e6947c70b9c721e662fe99871f000 | 2026-05-27 22:46:07.164160+03:00 | 2026-05-28 17:55:21.240206+03:00 | ||||||
CVE-2026-43073 | In the Linux kernel, the following vulnerability has been resolved:
x86-64: rename misleadingly named '__copy_user_nocache()' function
This function was a masterclass in bad naming, for various historical
reasons.
It claimed to be a non-cached user copy. It is literally _neither_ of
those things. It's a specialty memory copy routine that uses
non-temporal stores for the destination (but not the source), and that
does exception handling for both source and destination accesses.
Also note that while it works for unaligned targets, any unaligned parts
(whether at beginning or end) will not use non-temporal stores, since
only words and quadwords can be non-temporal on x86.
The exception handling means that it _can_ be used for user space
accesses, but not on its own - it needs all the normal "start user space
access" logic around it.
But typically the user space access would be the source, not the
non-temporal destination. That was the original intention of this,
where the destination was some fragile persistent memory target that
needed non-temporal stores in order to catch machine check exceptions
synchronously and deal with them gracefully.
Thus that non-descriptive name: one use case was to copy from user space
into a non-cached kernel buffer. However, the existing users are a mix
of that intended use-case, and a couple of random drivers that just did
this as a performance tweak.
Some of those random drivers then actively misused the user copying
version (with STAC/CLAC and all) to do kernel copies without ever even
caring about the exception handling, _just_ for the non-temporal
destination.
Rename it as a first small step to actually make it halfway sane, and
change the prototype to be more normal: it doesn't take a user pointer
unless the caller has done the proper conversion, and the argument size
is the full size_t (it still won't actually copy more than 4GB in one
go, but there's also no reason to silently truncate the size argument in
the caller).
Finally, use this now sanely named function in the NTB code, which
mis-used a user copy version (with STAC/CLAC and all) of this interface
despite it not actually being a user copy at all. | ['https://git.kernel.org/stable/c/14b9194db4a28421a4dbe5d6e519efbaa7c5f3cd', 'https://git.kernel.org/stable/c/c6d4e0599e7e73abc04e2488dfeb7940c4039660', 'https://git.kernel.org/stable/c/d187a86de793f84766ea40b9ade7ac60aabbb4fe', 'https://git.kernel.org/stable/c/d993e1723aa2a085aa0d72e70ea889031fc225b4', 'https://git.kernel.org/stable/c/efea91ad1729ff1853d7418e4d3bc27d085e72d0'] | 2026-05-05 19:16:16+03:00 | {'in_kev': False} | 6ccdfadb820bad70fcce605929a9a308f7b08200c5d2dd9af8768b7eca5ae886 | 2026-05-27 22:46:07.164160+03:00 | 2026-05-28 17:55:21.240206+03:00 | ||||||
CVE-2026-43060 | In the Linux kernel, the following vulnerability has been resolved:
netfilter: nft_ct: drop pending enqueued packets on removal
Packets sitting in nfqueue might hold a reference to:
- templates that specify the conntrack zone, because a percpu area is
used and module removal is possible.
- conntrack timeout policies and helper, where object removal leave
a stale reference.
Since these objects can just go away, drop enqueued packets to avoid
stale reference to them.
If there is a need for finer grain removal, this logic can be revisited
to make selective packet drop upon dependencies. | ['https://git.kernel.org/stable/c/36eae0956f659e48d5366d9b083d9417f3263ddc', 'https://git.kernel.org/stable/c/3da0b946835f33bf36b459ead764c61a761e689b', 'https://git.kernel.org/stable/c/6802ff8beceb9c4254318e81c1395720438f2cc2', 'https://git.kernel.org/stable/c/77da55dee67720e2b8d2db49a53334e6c017ee7b', 'https://git.kernel.org/stable/c/8a64e76933672b08bd85b63086f33432070fd729', 'https://git.kernel.org/stable/c/ab50302190b303f847c4eba0e31a01a56dec596e', 'https://git.kernel.org/stable/c/e68a8db3a0546482b34e9ca5ca886bcf73eb37bb', 'https://git.kernel.org/stable/c/f29a055e4f593e577805b41228b142b58f48df1b'] | 2026-05-05 19:16:15+03:00 | {'in_kev': False} | 07a0024300898550647d061ccf7db3443b76775c2f4ee5287eda7b123afab75d | 2026-05-27 22:46:07.164160+03:00 | 2026-05-28 17:55:21.240206+03:00 | ||||||
CVE-2026-43061 | In the Linux kernel, the following vulnerability has been resolved:
serial: 8250: Fix TX deadlock when using DMA
`dmaengine_terminate_async` does not guarantee that the
`__dma_tx_complete` callback will run. The callback is currently the
only place where `dma->tx_running` gets cleared. If the transaction is
canceled and the callback never runs, then `dma->tx_running` will never
get cleared and we will never schedule new TX DMA transactions again.
This change makes it so we clear `dma->tx_running` after we terminate
the DMA transaction. This is "safe" because `serial8250_tx_dma_flush`
is holding the UART port lock. The first thing the callback does is also
grab the UART port lock, so access to `dma->tx_running` is serialized. | ['https://git.kernel.org/stable/c/2a72403b985aea6b4aac3171830492f9a387f9e1', 'https://git.kernel.org/stable/c/5f6b17562f03fc65c7d3474ef8f1959b19d1ca41', 'https://git.kernel.org/stable/c/79a19bd936bb35f56ef0ccab1b3b59ebce8c762d', 'https://git.kernel.org/stable/c/8190f9ab6ad90cb97652adbebd238b874a4ef70d', 'https://git.kernel.org/stable/c/a424a34b8faddf97b5af41689087e7a230f79ba7', 'https://git.kernel.org/stable/c/b5ad887339503103d0fbe9827b16ad287597c275', 'https://git.kernel.org/stable/c/d2719a0a9c3439abf67843a5504b7afccd9ded93', 'https://git.kernel.org/stable/c/f76d91271bcacbd759a2e4ee3ea61faa6a727ccf'] | 2026-05-05 19:16:15+03:00 | {'in_kev': False} | efc187e9f3f0047597ac9221b2bbb393c4247482bd5611f3def83d996d1111b0 | 2026-05-27 22:46:07.164160+03:00 | 2026-05-28 17:55:21.240206+03:00 | ||||||
CVE-2026-43062 | In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: L2CAP: Fix type confusion in l2cap_ecred_reconf_rsp()
l2cap_ecred_reconf_rsp() casts the incoming data to struct
l2cap_ecred_conn_rsp (the ECRED *connection* response, 8 bytes with
result at offset 6) instead of struct l2cap_ecred_reconf_rsp (2 bytes
with result at offset 0).
This causes two problems:
- The sizeof(*rsp) length check requires 8 bytes instead of the
correct 2, so valid L2CAP_ECRED_RECONF_RSP packets are rejected
with -EPROTO.
- rsp->result reads from offset 6 instead of offset 0, returning
wrong data when the packet is large enough to pass the check.
Fix by using the correct type. Also pass the already byte-swapped
result variable to BT_DBG instead of the raw __le16 field. | ['https://git.kernel.org/stable/c/111f74547eee8cfedfb854284e80f35c8a491186', 'https://git.kernel.org/stable/c/15145675690cab2de1056e7ed68e59cbd0452529', 'https://git.kernel.org/stable/c/21d3ba696918d6373233aac0b9d51fcabdedddc0', 'https://git.kernel.org/stable/c/3b94e62caa1dc1198d0d55d97bd710da1dee15d7', 'https://git.kernel.org/stable/c/5a1ea296f8589ce8f1e3141b2b123b34ad010e19', 'https://git.kernel.org/stable/c/d90150c72d2e6a8a3079e88755dafcfbe91c746d', 'https://git.kernel.org/stable/c/dd3b221e21079ade8263fbb7176f3d55ad75d3b6', 'https://git.kernel.org/stable/c/f110b8f58b254bf997cec1bd60701b7798e9bb82'] | 2026-05-05 19:16:15+03:00 | {'in_kev': False} | 04b7270d8cbe044e60c6ff2f555836b8a73397c3f5dfa9eba22801a486c95475 | 2026-05-27 22:46:07.164160+03:00 | 2026-05-28 17:55:21.240206+03:00 | ||||||
CVE-2026-43063 | In the Linux kernel, the following vulnerability has been resolved:
xfs: don't irele after failing to iget in xfs_attri_recover_work
xlog_recovery_iget* never set @ip to a valid pointer if they return
an error, so this irele will walk off a dangling pointer. Fix that. | ['https://git.kernel.org/stable/c/40082d08b638485cbaa543dc8087a3d1844d6f08', 'https://git.kernel.org/stable/c/70685c291ef82269180758130394ecdc4496b52c', 'https://git.kernel.org/stable/c/a1a5df1038f0b3c560d204270373621a4e622808', 'https://git.kernel.org/stable/c/b5c5a50c2f513d4a13a6763564a07b470e69cc5a'] | 2026-05-05 19:16:15+03:00 | {'in_kev': False} | f615c8173f602ff0bcd5384c6edd3302a97078cd6f66a9de642f6dbdd842f07d | 2026-05-27 22:46:07.164160+03:00 | 2026-05-28 17:55:21.240206+03:00 | ||||||
CVE-2026-43064 | In the Linux kernel, the following vulnerability has been resolved:
dmaengine: idxd: Fix not releasing workqueue on .release()
The workqueue associated with an DSA/IAA device is not released when
the object is freed. | ['https://git.kernel.org/stable/c/2bb9e9e93adff9cc8a138ae9a3a8d59b3452272e', 'https://git.kernel.org/stable/c/3d33de353b1ff9023d5ec73b9becf80ea87af695', 'https://git.kernel.org/stable/c/958e96533ddbd1edd127feb7624a7eed0cc379dc', 'https://git.kernel.org/stable/c/d02c24af126dee45247dc7890409c86d1831859d', 'https://git.kernel.org/stable/c/fc34f199eb576b3a73089452fdf0056cc9a9301d', 'https://git.kernel.org/stable/c/fd4cb61bbd0fc3a749a8da6145cbb56d8f6dba35'] | 2026-05-05 19:16:15+03:00 | {'in_kev': False} | f76703544afa477416f9686b98b5bb729fc71a006d939facd881b3484a371887 | 2026-05-27 22:46:07.164160+03:00 | 2026-05-28 17:55:21.240206+03:00 | ||||||
CVE-2015-7142 | Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2015. Notes: none | 2017-05-11 14:29:52+03:00 | {'in_kev': False} | aceaa35fbfe502c4f9cfc3bd7ec895d209bf38cafc8778874cd95fabf3bbc4be | 2026-06-10 18:49:22.763817+03:00 | 2026-06-10 18:49:22.763817+03:00 | |||||||
CVE-2026-43065 | In the Linux kernel, the following vulnerability has been resolved:
ext4: always drain queued discard work in ext4_mb_release()
While reviewing recent ext4 patch[1], Sashiko raised the following
concern[2]:
> If the filesystem is initially mounted with the discard option,
> deleting files will populate sbi->s_discard_list and queue
> s_discard_work. If it is then remounted with nodiscard, the
> EXT4_MOUNT_DISCARD flag is cleared, but the pending s_discard_work is
> neither cancelled nor flushed.
[1] https://lore.kernel.org/r/20260319094545.19291-1-qiang.zhang@linux.dev/
[2] https://sashiko.dev/#/patchset/20260319094545.19291-1-qiang.zhang%40linux.dev
The concern was valid, but it had nothing to do with the patch[1].
One of the problems with Sashiko in its current (early) form is that
it will detect pre-existing issues and report it as a problem with the
patch that it is reviewing.
In practice, it would be hard to hit deliberately (unless you are a
malicious syzkaller fuzzer), since it would involve mounting the file
system with -o discard, and then deleting a large number of files,
remounting the file system with -o nodiscard, and then immediately
unmounting the file system before the queued discard work has a change
to drain on its own.
Fix it because it's a real bug, and to avoid Sashiko from raising this
concern when analyzing future patches to mballoc.c. | ['https://git.kernel.org/stable/c/1c82f863f090ab899085bdfade073313384b514b', 'https://git.kernel.org/stable/c/812b6a7cd3e7f3a3e8a24db85bc6313c26cb1098', 'https://git.kernel.org/stable/c/9b4d9dda6a71ad3425c8109d27c4c6bfb9da97b8', 'https://git.kernel.org/stable/c/9ee29d20aab228adfb02ca93f87fb53c56c2f3af', 'https://git.kernel.org/stable/c/b4737e26d4688b8aea88ad6ea4dbfeb6e78b0327', 'https://git.kernel.org/stable/c/c360e9d0def4f4ae03254a67c683103908555b75', 'https://git.kernel.org/stable/c/e96c2354b170aaa53300c8e8fd59e41b133160f7'] | 2026-05-05 19:16:15+03:00 | {'in_kev': False} | 33d46d5be2a67d25eab00653160285c3b4eea34e9197e754f4b67b8058ab4e04 | 2026-05-27 22:46:07.164160+03:00 | 2026-05-28 17:55:21.240206+03:00 | ||||||
CVE-2026-43066 | In the Linux kernel, the following vulnerability has been resolved:
ext4: fix iloc.bh leak in ext4_fc_replay_inode() error paths
During code review, Joseph found that ext4_fc_replay_inode() calls
ext4_get_fc_inode_loc() to get the inode location, which holds a
reference to iloc.bh that must be released via brelse().
However, several error paths jump to the 'out' label without
releasing iloc.bh:
- ext4_handle_dirty_metadata() failure
- sync_dirty_buffer() failure
- ext4_mark_inode_used() failure
- ext4_iget() failure
Fix this by introducing an 'out_brelse' label placed just before
the existing 'out' label to ensure iloc.bh is always released.
Additionally, make ext4_fc_replay_inode() propagate errors
properly instead of always returning 0. | ['https://git.kernel.org/stable/c/0892f12cd49fde5d5db68137923db107f894f3a3', 'https://git.kernel.org/stable/c/19782b4c793b49a6aa4abbb307ddff3610009d21', 'https://git.kernel.org/stable/c/5a63033696e60b5d70816f1d119645ac5b0b0a03', 'https://git.kernel.org/stable/c/9c90449a9ac2cd1ba540ad2561b8b70c1bfb0a25', 'https://git.kernel.org/stable/c/c426231e3d51916e83b6d1ab7ed8a65e83bca5b4', 'https://git.kernel.org/stable/c/ca99cbcc316cdfd2040cc2b13d1426ccb3b3b50b', 'https://git.kernel.org/stable/c/ec0a7500d8eace5b4f305fa0c594dd148f0e8d29', 'https://git.kernel.org/stable/c/f7817ad399d604e8639005d87d148b5ec626ad26'] | 2026-05-05 19:16:15+03:00 | {'in_kev': False} | 9996c73a31a871a7c21b80ac70a9ed56f71548f3fde00675100844980847ebd1 | 2026-05-27 22:46:07.164160+03:00 | 2026-05-28 17:55:21.240206+03:00 | ||||||
CVE-2026-43067 | In the Linux kernel, the following vulnerability has been resolved:
ext4: handle wraparound when searching for blocks for indirect mapped blocks
Commit 4865c768b563 ("ext4: always allocate blocks only from groups
inode can use") restricts what blocks will be allocated for indirect
block based files to block numbers that fit within 32-bit block
numbers.
However, when using a review bot running on the latest Gemini LLM to
check this commit when backporting into an LTS based kernel, it raised
this concern:
If ac->ac_g_ex.fe_group is >= ngroups (for instance, if the goal
group was populated via stream allocation from s_mb_last_groups),
then start will be >= ngroups.
Does this allow allocating blocks beyond the 32-bit limit for
indirect block mapped files? The commit message mentions that
ext4_mb_scan_groups_linear() takes care to not select unsupported
groups. However, its loop uses group = *start, and the very first
iteration will call ext4_mb_scan_group() with this unsupported
group because next_linear_group() is only called at the end of the
iteration.
After reviewing the code paths involved and considering the LLM
review, I determined that this can happen when there is a file system
where some files/directories are extent-mapped and others are
indirect-block mapped. To address this, add a safety clamp in
ext4_mb_scan_groups(). | ['https://git.kernel.org/stable/c/12624c5b724a81e14e532972b40d863b0de3b7d1', 'https://git.kernel.org/stable/c/2a368ccddfc492a0aa951e2caef2985f20e96503', 'https://git.kernel.org/stable/c/4bec4a498ce86314d470ae6144120461f2138c29', 'https://git.kernel.org/stable/c/83170a05908b6cf2fb3235d3065bf613ff866f3c', 'https://git.kernel.org/stable/c/bb81702370fad22c06ca12b6e1648754dbc37e0f', 'https://git.kernel.org/stable/c/f89bba144938921a2249237ad04a0183ff3f8930'] | 2026-05-05 19:16:15+03:00 | {'in_kev': False} | 873cfafe94d003567771925178a29268f2d96f92bdd3ba23d0c6f4d1947c121b | 2026-05-27 22:46:07.164160+03:00 | 2026-05-28 17:55:21.240206+03:00 | ||||||
CVE-2026-31196 | The traceroute diagnostic handler in /bin/httpd_clientside for ALTICE LABS / SFR France GR140DG and GR140IG fibre CPE/Router/Gateway, inserts unsanitized user input into a system() call, allowing authenticated remote attackers to execute arbitrary commands as root via crafted destAddr parameters using shell command substitution. | ['http://altice.com', 'http://gr140dg.com', 'https://xerod.ai/advisories/XEROD-2026-0002'] | 2026-05-05 19:16:11+03:00 | {'in_kev': False} | fa4721a2899abef5d7a3bb24884b0341877635465924771fa9d12bcc3b5f9e5c | 2026-05-27 22:46:07.164160+03:00 | 2026-05-28 17:55:21.240206+03:00 | ||||||
CVE-2026-34408 | An issue was discovered in Gambio 4.9.2.0 (patched in 2024-02 v1.0.0 for GX4 v4.0.0.0 to v4.9.2.0). The password reset function can be bypassed to set arbitrary passwords for arbitrary accounts if the ID is known. | ['https://herolab.usd.de/security-advisories/usd-2024-0002/', 'https://www.gambio.de/forum/threads/wichtiges-security-update-2024-02-v1-0-fuer-gx4-v4-0-0-0-bis-v4-9-2-0.50896/'] | 2026-05-05 17:16:08+03:00 | {'in_kev': False} | b01f4e0c46cf79cdd7bd689ebf3909e0c79849e9446af26f67b499eae3fe6e84 | 2026-05-27 22:46:07.164160+03:00 | 2026-05-28 17:55:21.240206+03:00 | ||||||
CVE-2026-36355 | The rtl8192cd Wi-Fi kernel driver in the Realtek rtl819x Jungle SDK (all known versions through v3.4.14B) does not perform any access control checks on the write_mem (ioctl 0x89F5) and read_mem (ioctl 0x89F6) debug handlers, which are compiled into production builds via the unconditionally defined _IOCTL_DEBUG_CMD_ macro in 8192cd_cfg.h | 7.70 | {'score': 7.7} | ['http://realtek.com', 'https://github.com/totekuh/CVE-2026-36355', 'https://github.com/totekuh/CVE-2026-36355'] | 2026-05-05 17:16:08+03:00 | {'in_kev': False} | 1ff57ac2f0d1ca8c9bdcef71752ecef4ec9c0978c8a14c188f33681d6ab23e38 | 2026-05-27 22:46:07.164160+03:00 | 2026-05-28 17:55:21.240206+03:00 | ||||
CVE-1999-0036 | IRIX login program with a nonzero LOCKOUT parameter allows creation or damage to files. | 8.40 | {'score': 7.2} | {'score': 8.4} | 0.008340000 | ['ftp://patches.sgi.com/support/free/security/advisories/19970508-02-PX', 'http://www.ciac.org/ciac/bulletins/h-106.shtml', 'http://www.osvdb.org/990', 'https://exchange.xforce.ibmcloud.com/vulnerabilities/557', 'ftp://patches.sgi.com/support/free/security/advisories/19970508-02-PX', 'http://www.ciac.org/ciac/bulletins/h-106.shtml', 'http://www.osvdb.org/990', 'https://exchange.xforce.ibmcloud.com/vulnerabilities/557'] | ['cpe:2.3:o:sgi:irix:5.1', 'cpe:2.3:o:sgi:irix:5.2', 'cpe:2.3:o:sgi:irix:5.3', 'cpe:2.3:o:sgi:irix:6.0', 'cpe:2.3:o:sgi:irix:6.1', 'cpe:2.3:o:sgi:irix:6.2', 'cpe:2.3:o:sgi:irix:6.3', 'cpe:2.3:o:sgi:irix:6.4'] | 1997-05-26 04:00:00+04:00 | {'in_kev': False} | a3f5177bde5ddb6de2e18545b81c7aa5b8a0280808527efe47ea810a956bcde9 | 2026-06-10 18:34:38.588522+03:00 | 2026-06-10 18:34:38.588522+03:00 | |
CVE-2026-36356 | The GoAhead web server on MeiG Smart FORGE_SLT711 devices (firmware MDM9607.LE.1.0-00110-STD.PROD-1) allows unauthenticated OS command injection via the /action/SetRemoteAccessCfg endpoint. | 9.10 | {'score': 9.1} | ['http://forgeslt711.com', 'http://meig.com', 'https://github.com/totekuh/CVE-2026-36356', 'https://github.com/totekuh/CVE-2026-36356'] | 2026-05-05 17:16:08+03:00 | {'in_kev': False} | bc21c1a22e2995fb339b93099f130061476942f05a5157bfa912bc918491aae9 | 2026-05-27 22:46:07.164160+03:00 | 2026-05-28 17:55:21.240206+03:00 | ||||
CVE-2026-7832 | A security flaw has been discovered in IObit Advanced SystemCare 19. This affects an unknown part of the file ASC.exe of the component Service. The manipulation results in symlink following. Attacking locally is a requirement. This attack is characterized by high complexity. It is indicated that the exploitability is difficult. The exploit has been released to the public and may be used for attacks. | 6.40 | {'score': 6.0} | {'score': 7.0} | ['https://github.com/usernameone101/Writeups/blob/main/IObit%20Zero%20Day%20(Updated%20v2).pdf', 'https://vuldb.com/submit/797630', 'https://vuldb.com/vuln/361111', 'https://vuldb.com/vuln/361111/cti'] | 2026-05-05 16:16:31+03:00 | {'in_kev': False} | 352723b6e5ec9e625419e695defb3f82cf1aadf640960b2b7354b68ee7b84a60 | 2026-05-27 22:46:07.164160+03:00 | 2026-05-28 17:55:21.240206+03:00 | |||
CVE-2026-7833 | A weakness has been identified in EFM ipTIME C200 up to 1.092. This vulnerability affects the function sub_408F90 of the file /cgi/iux_set.cgi of the component ApplyRestore Endpoint. This manipulation of the argument RestoreFile causes command injection. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way. | 7.30 | {'score': 8.3} | {'score': 7.2} | ['https://github.com/glkfc/IoT-Vulnerability/blob/main/iptime/c200/sub_409054_vulnerability_report_EN.md', 'https://vuldb.com/submit/807786', 'https://vuldb.com/vuln/361112', 'https://vuldb.com/vuln/361112/cti'] | 2026-05-05 16:16:31+03:00 | {'in_kev': False} | f9a2511a3b03adb620a6e7ad0c29595a84ad27ac37149b03f7804cf83053531a | 2026-05-27 22:46:07.164160+03:00 | 2026-05-28 17:55:21.240206+03:00 | |||
CVE-2026-28510 | eLabFTW is an open source electronic lab notebook. In elabftw versions through 5.4.1, the login flow did not reliably preserve the multi-factor authentication state across authentication steps. Under certain conditions, an attacker with valid primary credentials could complete authentication with an attacker-controlled TOTP secret and bypass the additional factor. This could result in unauthorized account access. This issue is fixed in version 5.4.2. | 5.90 | {'score': 5.9} | ['https://github.com/elabftw/elabftw/commit/8b7a575aef128870861187eaa2b2f0f08654ecf9', 'https://github.com/elabftw/elabftw/security/advisories/GHSA-x5wv-c9q4-fj65'] | 2026-05-05 16:16:28+03:00 | {'in_kev': False} | 04c8b6668000ba78441c6224c6c921d18219f0da7aff35d92e3974bcad015ec8 | 2026-05-27 22:46:07.164160+03:00 | 2026-05-28 17:55:21.240206+03:00 | ||||
CVE-2026-30246 | Fiber is a web framework for Go. In github.com/gofiber/fiber/v3 versions through 3.1.0, the default key generator in the cache middleware uses only the request path and does not include the query string. As a result, requests for the same path with different query parameters can share a cache key and receive the wrong cached response. This can cause response mix-up for query-dependent endpoints and may expose data intended for a different request. This issue is fixed after version 3.1.0. | 6.50 | {'score': 6.5} | ['https://github.com/gofiber/fiber/blob/main/middleware/cache/cache_test.go#L599-L621', 'https://github.com/gofiber/fiber/blob/main/middleware/cache/config.go#L90-L92', 'https://github.com/gofiber/fiber/security/advisories/GHSA-35hp-hqmv-8qg8', 'https://github.com/gofiber/fiber/security/advisories/GHSA-35hp-hqmv-8qg8'] | 2026-05-05 16:16:28+03:00 | {'in_kev': False} | 92629113a98bd2f3a7f42a54a52e6822d88e5af8a11b6c4276fe01cebfb0ad2c | 2026-05-27 22:46:07.164160+03:00 | 2026-05-28 17:55:21.240206+03:00 | ||||
CVE-2026-27644 | Traccar is an open source GPS tracking system. In versions between 6.11.1 and 6.13.0, the CSV export functionality writes position data, including user-controlled device and computed attributes, to CSV output without proper escaping. An attacker can inject spreadsheet formulas through exported fields. When a manager or administrator opens the exported CSV file in spreadsheet software, this can cause formula execution and lead to command execution or data exfiltration. This has been patched in version 6.13.0. | 6.50 | {'score': 6.5} | ['https://github.com/traccar/traccar/blob/v6.11.1/src/main/java/org/traccar/reports/CsvExportProvider.java#L89-L91', 'https://github.com/traccar/traccar/security/advisories/GHSA-745r-9qgj-x7m7', 'https://github.com/traccar/traccar/security/advisories/GHSA-745r-9qgj-x7m7'] | 2026-05-05 16:16:27+03:00 | {'in_kev': False} | 56214d54d3919df16640ddacee1dd0445d7cee37bbd1fa2d6d0d90971c8713dd | 2026-05-27 22:46:07.164160+03:00 | 2026-05-28 17:55:21.240206+03:00 | ||||
CVE-2026-43574 | OpenClaw before 2026.4.12 contains an improper authorization vulnerability in helper-backed channels where empty resolved approver lists are interpreted as explicit approval authorization. Attackers can resolve pending approvals without proper authorization by exploiting this logic flaw if they know an approval id. | 6.00 | {'score': 6.5} | 0.000270000 | ['https://github.com/openclaw/openclaw/commit/0a105c0900de701d2ee9f1abc96b017afbd0afdd', 'https://github.com/openclaw/openclaw/security/advisories/GHSA-49cg-279w-m73x', 'https://www.vulncheck.com/advisories/openclaw-improper-authorization-via-empty-approver-lists'] | 2026-05-05 15:16:21+03:00 | {'in_kev': False} | 92cd01f0ac97e28f6556fac6bcafcbe54baf90b5cfe104ed3b7dc2bfd8597af0 | 2026-05-27 22:46:07.164160+03:00 | 2026-05-28 17:55:21.240206+03:00 | |||
CVE-2026-6261 | The Betheme theme for WordPress is vulnerable to Arbitrary File Upload in versions up to, and including, 28.4. This is due to the upload_icons() function workflow moving and unzipping user-controlled ZIP files into a public uploads directory without validating extracted file types. This makes it possible for authenticated attackers, with author-level access and above, to upload arbitrary files (including PHP) and achieve remote code execution via the Icons icon-pack upload flow. | 8.80 | {'score': 8.8} | 0.002360000 | ['https://support.muffingroup.com/changelog/', 'https://www.wordfence.com/threat-intel/vulnerabilities/id/722c04c3-8f74-4081-b3a4-cb1ae2027312?source=cve'] | 2026-05-05 15:16:21+03:00 | {'in_kev': False} | 8e0036c66849aed10632a06079d8b84e6473a6d442fa2a35e63a9f4364173af3 | 2026-05-27 22:46:07.164160+03:00 | 2026-05-28 17:55:21.240206+03:00 | |||
CVE-2026-6262 | The Betheme theme for WordPress is vulnerable to Arbitrary File Deletion in versions up to, and including, 28.4. This is due to the upload_icons() function workflow using a user-controlled upload path (`mfn-icon-upload`) in a filesystem move operation without constraining it to the uploads directory. This makes it possible for authenticated attackers, with contributor-level access and above, to move/delete arbitrary local files via path traversal. | 6.50 | {'score': 6.5} | 0.000460000 | ['https://support.muffingroup.com/changelog/', 'https://www.wordfence.com/threat-intel/vulnerabilities/id/3486f114-5625-4751-a25e-2c5ab7b15b38?source=cve'] | 2026-05-05 15:16:21+03:00 | {'in_kev': False} | ad9b7d2ab0c5eb258cc60ef9f59967619a8323c846da4a7705fee4fc29022a14 | 2026-05-27 22:46:07.164160+03:00 | 2026-05-28 17:55:21.240206+03:00 | |||
CVE-2015-7157 | Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2015. Notes: none | 2017-05-11 14:29:52+03:00 | {'in_kev': False} | c58fce14bafb2c6e96c63b0a7a1c8d53a33fbb15d63939646d0b9e85722ffb28 | 2026-06-10 18:49:22.763817+03:00 | 2026-06-10 18:49:22.763817+03:00 | |||||||
CVE-2026-43566 | OpenClaw versions 2026.4.7 before 2026.4.14 contain a privilege escalation vulnerability where heartbeat owner downgrade logic skips webhook wake events carrying untrusted content. Attackers can exploit this by sending untrusted webhook wake events to preserve owner-like execution context when the run should have been downgraded. | 9.10 | {'score': 9.1} | 0.001030000 | ['https://github.com/openclaw/openclaw/commit/31281bc92f55796817a92bc43f722cba1e77ab42', 'https://github.com/openclaw/openclaw/security/advisories/GHSA-g2hm-779g-vm32', 'https://www.vulncheck.com/advisories/openclaw-privilege-escalation-via-untrusted-webhook-wake-events'] | 2026-05-05 15:16:20+03:00 | {'in_kev': False} | f352721214e05dab16a8ea7023f16b7c8ad71555e0d21a42a6cbbf240cb39550 | 2026-05-27 22:46:07.164160+03:00 | 2026-05-28 17:55:21.240206+03:00 | |||
CVE-2026-43567 | OpenClaw before 2026.4.10 contains a path traversal vulnerability in the screen_record tool's outPath parameter that bypasses workspace-only filesystem guards. Attackers can exploit this by specifying an outPath outside the workspace boundary to write files to unintended locations on the system. | 7.10 | {'score': 6.5} | 0.000250000 | ['https://github.com/openclaw/openclaw/commit/635bb35b68d8faa5bfa2fda35feadd315122748a', 'https://github.com/openclaw/openclaw/security/advisories/GHSA-jf25-7968-h2h5', 'https://www.vulncheck.com/advisories/openclaw-path-traversal-in-screen-record-outpath-parameter'] | 2026-05-05 15:16:20+03:00 | {'in_kev': False} | 5e16233aa1c7ea7a13dcc50b0f5b1e9dc8d16cb834049471863d8c228377d43b | 2026-05-27 22:46:07.164160+03:00 | 2026-05-28 17:55:21.240206+03:00 | |||
CVE-2026-43571 | OpenClaw before 2026.4.10 contains a plugin trust bypass vulnerability that allows channel setup catalog lookups to resolve workspace plugin shadows before bundled channel plugins. Attackers can exploit this by crafting malicious workspace plugins that bypass intended trust gates during setup-time plugin loading. | 7.70 | {'score': 8.8} | 0.000400000 | ['https://github.com/openclaw/openclaw/commit/1fede43b948df40ca8674511d4bd08d39f6c5837', 'https://github.com/openclaw/openclaw/security/advisories/GHSA-82qx-6vj7-p8m2', 'https://www.vulncheck.com/advisories/openclaw-untrusted-workspace-plugin-shadow-resolution-in-channel-setup'] | 2026-05-05 15:16:20+03:00 | {'in_kev': False} | 417676f675fccba14b1909e08835939e8309c508bf5f7401f11763143cddd274 | 2026-05-27 22:46:07.164160+03:00 | 2026-05-28 17:55:21.240206+03:00 | |||
CVE-2026-43529 | OpenClaw before 2026.4.10 contains a time-of-check-time-of-use vulnerability in the validateScriptFileForShellBleed function that allows local attackers to bypass workspace boundary checks. An attacker with workspace write access can race-condition swap the target file between validation and preflight read, causing the validator to inspect a different file identity than the one that passed the initial boundary check. | 2.00 | {'score': 2.5} | 0.000100000 | ['https://github.com/openclaw/openclaw/commit/b024fae9e5df43e9b69b2daebb72be3469d52e91', 'https://github.com/openclaw/openclaw/security/advisories/GHSA-gj9q-8w99-mp8j', 'https://www.vulncheck.com/advisories/openclaw-time-of-check-time-of-use-toctou-race-condition-in-exec-script-preflight-validator'] | 2026-05-05 15:16:19+03:00 | {'in_kev': False} | 08743f5146cc1460074737b6decec75bf1dff8a9b8ccdba3a92ed072fca92522 | 2026-05-27 22:46:07.164160+03:00 | 2026-05-28 17:55:21.240206+03:00 | |||
CVE-2026-43530 | OpenClaw versions 2026.2.23 before 2026.4.12 contain a weakened exec approval binding vulnerability in busybox and toybox applet execution that allows attackers to obscure which applet would actually run. Attackers can exploit opaque multi-call binaries to bypass exec approval mechanisms and weaken risk classification of unsafe applet invocations. | 8.70 | {'score': 8.8} | 0.000510000 | ['https://github.com/openclaw/openclaw/commit/666f48d9b882a8a1415ca53f9567c72499d850c9', 'https://github.com/openclaw/openclaw/security/advisories/GHSA-2cq5-mf3v-mx44', 'https://www.vulncheck.com/advisories/openclaw-weakened-exec-approval-binding-via-busybox-and-toybox-applet-execution'] | 2026-05-05 15:16:19+03:00 | {'in_kev': False} | 6fea31e2c54b79843890dd36a4bad663c727fc5e4ccfcc7eb7ce5bd35c5ffd1f | 2026-05-27 22:46:07.164160+03:00 | 2026-05-28 17:55:21.240206+03:00 | |||
CVE-2026-43534 | OpenClaw before 2026.4.10 contains an input validation vulnerability that allows external hook metadata to be enqueued as trusted system events. Attackers can supply malicious hook names to escalate untrusted input into higher-trust agent context. | 9.30 | {'score': 9.1} | 0.000150000 | ['https://github.com/openclaw/openclaw/commit/e3a845bde5b54f4f1e742d0a51ba9860f9619b29', 'https://github.com/openclaw/openclaw/security/advisories/GHSA-7g8c-cfr3-vqqr', 'https://www.vulncheck.com/advisories/openclaw-unsanitized-external-input-in-agent-hook-events'] | 2026-05-05 15:16:19+03:00 | {'in_kev': False} | f888d0eb5f83b162c2e3376218343b1bd3aa5356606e276da7f7c54aa8ff9238 | 2026-05-27 22:46:07.164160+03:00 | 2026-05-28 17:55:21.240206+03:00 | |||
CVE-2026-43535 | OpenClaw before 2026.4.14 contains an authorization context reuse vulnerability in collect-mode queue batches that allows messages from different senders to inherit the final sender's authorization context. Attackers can exploit this by sending multiple queued messages to drain batches using a more privileged sender's context, causing earlier messages to execute with elevated permissions. | 7.60 | {'score': 6.8} | 0.000220000 | ['https://github.com/openclaw/openclaw/commit/43d4be902755c970b3d15608679761877718da69', 'https://github.com/openclaw/openclaw/security/advisories/GHSA-jwrq-8g5x-5fhm', 'https://www.vulncheck.com/advisories/openclaw-authorization-context-reuse-in-collect-mode-queue-batches'] | 2026-05-05 15:16:19+03:00 | {'in_kev': False} | 44968f3b0b0f89a7550c2763b238aff367e4a97ee8b4d121152987ba1d860fdd | 2026-05-27 22:46:07.164160+03:00 | 2026-05-28 17:55:21.240206+03:00 | |||
CVE-2026-42436 | OpenClaw before 2026.4.14 contains an improper access control vulnerability in browser snapshot, screenshot, and tab routes that fail to consistently validate the final browser target after navigation. Authenticated callers can bypass SSRF restrictions to expose internal or disallowed page content by exploiting route-driven navigation without proper policy re-validation. | 4.90 | {'score': 7.7} | 0.000270000 | ['https://github.com/openclaw/openclaw/commit/b75ad800a59009fc47eaa3471410f69046150e59', 'https://github.com/openclaw/openclaw/security/advisories/GHSA-c4qm-58hj-j6pj', 'https://www.vulncheck.com/advisories/openclaw-internal-page-content-exposure-via-browser-snapshot-and-screenshot-routes'] | 2026-05-05 15:16:18+03:00 | {'in_kev': False} | b64d542810c933c3eda97a7533524f0fa45110a740264d5eb3c1270922f21219 | 2026-05-27 22:46:07.164160+03:00 | 2026-05-28 17:55:21.240206+03:00 | |||
CVE-2026-42437 | OpenClaw versions 2026.4.9 before 2026.4.10 contain a denial of service vulnerability in the voice-call realtime WebSocket path that accepts oversized frames without proper validation. Remote attackers can send oversized WebSocket frames to cause service unavailability for deployments exposing the webhook path. | 8.20 | {'score': 7.5} | 0.000910000 | ['https://github.com/openclaw/openclaw/commit/afadb7dae6738819ad9c7d2597ace0516957d20e', 'https://github.com/openclaw/openclaw/security/advisories/GHSA-vw3h-q6xq-jjm5', 'https://www.vulncheck.com/advisories/openclaw-denial-of-service-via-oversized-websocket-frames-in-voice-call-realtime-path'] | 2026-05-05 15:16:18+03:00 | {'in_kev': False} | 26200339ac7d22d97121124ad53ba9754c9f86f16b594962d27d189a082fcf76 | 2026-05-27 22:46:07.164160+03:00 | 2026-05-28 17:55:21.240206+03:00 | |||
CVE-2015-7159 | Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2015. Notes: none | 2017-05-11 14:29:52+03:00 | {'in_kev': False} | 903e33faaf5cce0b90fa4eb941b5b56002db3930576c72bcfe2d04638e47b688 | 2026-06-10 18:49:22.763817+03:00 | 2026-06-10 18:49:22.763817+03:00 | |||||||
CVE-2026-43526 | OpenClaw before 2026.4.12 contains a server-side request forgery vulnerability in QQBot reply media URL handling that allows attackers to fetch arbitrary content. Attackers can exploit this by providing malicious media URLs that trigger SSRF requests, with fetched bytes subsequently re-uploaded through the channel. | 8.30 | {'score': 8.2} | 0.000300000 | ['https://github.com/openclaw/openclaw/commit/08ae021d1f4f02e0ca5fd8a3b9659291c1ecf95a', 'https://github.com/openclaw/openclaw/commit/ddb7a8dd80b8d5dd04aafa44ce7a4354b568bb2d', 'https://github.com/openclaw/openclaw/security/advisories/GHSA-2767-2q9v-9326', 'https://www.vulncheck.com/advisories/openclaw-server-side-request-forgery-via-qqbot-reply-media-url-handling'] | 2026-05-05 15:16:18+03:00 | {'in_kev': False} | b2502b32ae2f04bb515068ba08eb6c1fbd75a081d655d64e6127463461d4a8a4 | 2026-05-27 22:46:07.164160+03:00 | 2026-05-28 17:55:21.240206+03:00 | |||
CVE-2026-43527 | OpenClaw before 2026.4.14 contains a server-side request forgery vulnerability in browser SSRF policy that allows private-network navigation by default. Attackers can exploit this misconfiguration to access internal services or metadata endpoints through browser-driven requests. | 6.30 | {'score': 7.7} | 0.000320000 | ['https://github.com/openclaw/openclaw/commit/024f4614a1a1831406e763adc40ef226e3d5e9ed', 'https://github.com/openclaw/openclaw/commit/1dabfef28db523e7de81edeb3dd689e9171236a2', 'https://github.com/openclaw/openclaw/commit/213c36cf51121ef6c05cfccd78037371f968f31a', 'https://github.com/openclaw/openclaw/commit/7eecfa411df3d12e6b810e6ca5df47254fc3db3f', 'https://github.com/openclaw/openclaw/security/advisories/GHSA-53vx-pmqw-863c', 'https://www.vulncheck.com/advisories/openclaw-server-side-request-forgery-via-private-network-navigation'] | 2026-05-05 15:16:18+03:00 | {'in_kev': False} | ee9e4f8b857a77ba257e0f34b3cc731f38af4980bc3f4bfc2e30c036390b909d | 2026-05-27 22:46:07.164160+03:00 | 2026-05-28 17:55:21.240206+03:00 | |||
CVE-2026-43528 | OpenClaw before 2026.4.14 contains a redaction bypass vulnerability that allows authenticated gateway clients to receive unredacted secrets through sourceConfig and runtimeConfig alias fields. Attackers with config read access can exploit this to obtain provider API keys, gateway authentication material, and channel credentials that should have been redacted. | 7.10 | {'score': 6.5} | 0.000550000 | ['https://github.com/openclaw/openclaw/commit/86734ef93a2f25063371b04f1946eb300548acd4', 'https://github.com/openclaw/openclaw/security/advisories/GHSA-8372-7vhw-cm6q', 'https://www.vulncheck.com/advisories/openclaw-redaction-bypass-via-sourceconfig-and-runtimeconfig-aliases'] | 2026-05-05 15:16:18+03:00 | {'in_kev': False} | f38efb3fe4f4fa960ba35b887f1062df79839639bbf0ce716ccad375e772d728 | 2026-05-27 22:46:07.164160+03:00 | 2026-05-28 17:55:21.240206+03:00 | |||
CVE-2023-54346 | WordPress Plugin Backup Migration 1.2.8 contains an information disclosure vulnerability that allows unauthenticated attackers to download complete database backups by accessing predictable file paths. Attackers can enumerate backup directories through configuration files and complete logs, then construct direct download URLs to retrieve sensitive backup archives containing full database dumps. | 8.70 | {'score': 7.5} | 0.000400000 | ['https://backupbliss.com/', 'https://downloads.wordpress.org/plugin/backup-backup.1.2.8.zip', 'https://www.exploit-db.com/exploits/51445', 'https://www.vulncheck.com/advisories/wordpress-plugin-backup-migration-unauthenticated-database-backup-download'] | 2026-05-05 15:16:17+03:00 | {'in_kev': False} | d03f8dc73f47b43f70f8756ef6ca474483f23055a8d71f6ba530d19383d415d4 | 2026-05-27 22:46:07.164160+03:00 | 2026-05-28 17:55:21.240206+03:00 | |||
CVE-2023-54347 | OpenEMR 7.0.1 contains an authentication brute force vulnerability that allows attackers to bypass rate limiting protections by sending repeated login attempts to the main login endpoint. Attackers can submit POST requests with authUser and clearPass parameters to systematically test username and password combinations without account lockout restrictions. | 8.70 | {'score': 7.5} | 0.001480000 | ['https://github.com/openemr/openemr/archive/refs/tags/v7_0_1.tar.gz', 'https://www.exploit-db.com/exploits/51413', 'https://www.open-emr.org/', 'https://www.vulncheck.com/advisories/openemr-authentication-brute-force-mitigation-bypass'] | 2026-05-05 15:16:17+03:00 | {'in_kev': False} | a19433a83c5f8c4c874677a58c91283199ab69f2486c5738cf029be088cda454 | 2026-05-27 22:46:07.164160+03:00 | 2026-05-28 17:55:21.240206+03:00 | |||
CVE-2026-42435 | OpenClaw versions from 2026.2.22 before 2026.4.12 contain an insufficient shell-wrapper detection vulnerability allowing attackers to inject environment variable assignments at the argv level. Attackers can bypass exec preflight handling to manipulate high-risk shell variables like SHELLOPTS and PS4, affecting execution semantics and security controls. | 8.70 | {'score': 8.8} | 0.000960000 | ['https://github.com/openclaw/openclaw/commit/8f8492d172f4c5b4fd7dd9a47855ed620c8770ab', 'https://github.com/openclaw/openclaw/security/advisories/GHSA-j6c7-3h5x-99g9', 'https://www.vulncheck.com/advisories/openclaw-shell-wrapper-detection-bypass-via-environment-variable-assignment-injection'] | 2026-05-05 15:16:17+03:00 | {'in_kev': False} | 7be16b7e526f8258c84704e4b3e803c12ebfe37a8e0197d19ab7ff31675cc3ae | 2026-05-27 22:46:07.164160+03:00 | 2026-05-28 17:55:21.240206+03:00 | |||
CVE-2023-54344 | Eclipse Equinox OSGi 3.7.2 and earlier contains a remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary commands by sending payloads to the console interface. Attackers can connect to the OSGi console port and send base64-encoded bash commands wrapped in fork directives to achieve code execution and establish reverse shell connections. | 9.30 | {'score': 9.8} | 0.001950000 | ['https://www.exploit-db.com/exploits/51879', 'https://www.vulncheck.com/advisories/eclipse-equinox-osgi-remote-code-execution-via-console'] | 2026-05-05 15:16:16+03:00 | {'in_kev': False} | c31c8d5cc07f4da4079af696bf9843d8376932fe5e3b648791114b7489428723 | 2026-05-27 22:46:07.164160+03:00 | 2026-05-28 17:55:21.240206+03:00 |