Vulnerability

Attackers are actively exploiting an unauthenticated remote code execution vulnerability (CVE-2026-58115) in Siemens SIMATIC IoT2050 Advanced devices to deploy botnet payloads and establish persistent backdoors.

The SureCart WordPress plugin contains an authentication vulnerability in the VerificationCodeController REST endpoint, allowing unauthenticated attackers to brute-force verification codes to hijack user accounts.

The Easy Digital Downloads WordPress plugin is vulnerable to authentication bypass and account takeover due to insecure association of guest checkout orders with existing user accounts based on email address.

The Advanced Custom Fields: Extended PRO plugin for WordPress is vulnerable to Limited Code Injection via the render_field function.

The BuddyPress XProfile Image Field plugin for WordPress up to and including version 3.1.0 is vulnerable to arbitrary file deletion via unauthenticated registration metadata.

PyMuPDF versions prior to 2.0 contain a stack-based buffer overflow in the JM_set_annot_callout_line function, allowing remote code execution via specifically crafted callout arguments in Page.add_freetext_annot.

Multiple Barracuda appliance products are affected by pre-authentication authorization bypass and command injection vulnerabilities that may allow unauthenticated remote attackers to execute arbitrary commands.

SUSE Rancher is vulnerable to a meta proxy allowlist bypass that results in server-side request forgery (SSRF), allowing potential unauthorized internal network requests.

The psqlODBC driver is vulnerable to memory corruption during loread operations because it fails to validate server-provided data lengths against buffer sizes.

An improper neutralization vulnerability in the Amazon Virtual Engineering Workbench publishing component allows authenticated remote attackers to execute arbitrary code via crafted CloudFormation templates.

The Attendo Admin Android application version 3.0.13 and earlier contains hard-coded MQTT credentials in bundled configuration files, allowing unauthorized access to production data and potential message injection.

QuickJS-NG before 0.16.0 contains an integer overflow in the js_proxy_get_own_property_names function that can lead to heap buffer overflows and potential code execution on 32-bit hosts via malicious Proxy ownKeys traps.

Netpbm is vulnerable to a heap-based buffer overflow in the sgitopnm utility via crafted SGI image files, potentially allowing for arbitrary code execution.

Multiple vulnerabilities in Redmine allow remote attackers to perform cross-site scripting (XSS), bypass security policies, or trigger denial-of-service conditions.

Tenable Identity Exposure is affected by multiple vulnerabilities that allow for remote code execution, denial-of-service, and data confidentiality breaches.

A vulnerability in Microsoft Visual Studio could allow a remote, unauthenticated attacker to perform unauthorized information disclosure or data manipulation.

Collabora Online contains multiple vulnerabilities that allow a remote, authenticated attacker to bypass security measures, conduct Cross-Site Scripting (XSS) attacks, or perform unauthorized information disclosure.

A critical, unpatched vulnerability in Linksys routers allows remote, unauthenticated attackers to escalate privileges to administrator, disclose sensitive information, manipulate files, or trigger a denial-of-service.

A vulnerability in multiple JetBrains integrated development environments allows a remote, unauthenticated attacker to bypass security controls.

A vulnerability in JetBrains Toolbox App and IntelliJ IDEA allows a remote, unauthenticated attacker to bypass security measures.

Dell OpenManage Enterprise versions prior to 4.8.0 are susceptible to an OS Command Injection vulnerability, potentially allowing a low-privileged attacker with adjacent network access to execute commands.

ManageEngine Eventlog Analyzer and Log360 versions prior to 13062 contain an authenticated remote code execution vulnerability in the log forwarding feature.

CVE-2026-18199 is an authenticated remote code execution vulnerability in Zohocorp ManageEngine Password Manager Pro versions before 13236 and PAM360 versions before 8601.

A critical OS command injection vulnerability in the DNS Resolution Handler of Wavlink WN551X3-A allows unauthenticated remote attackers to execute arbitrary commands via the data argument, with a public proof-of-concept exploit now available.

XunRuiCMS versions up to 4.7.4 are vulnerable to code injection via the _get_tpl_content function in the Email Template Rendering component.

Network-AI versions prior to 5.15.5 contain a path traversal vulnerability in InputSanitizer.sanitizePath() that allows attackers to escape the base directory via sibling-directory paths.

Multiple vulnerabilities were discovered in the C-Kermit communication software during a code audit, including a remote code execution vector exploitable by a malicious peer and an authentication bypass with TLS certificate spoofing.

An authenticated OS command injection vulnerability in the TP-Link Archer AX17 router allows administrative LAN users to achieve root command execution via malicious OpenVPN client profile descriptions.

Multiple threat actors, including STORM-0940, are utilizing autonomous, LLM-driven offensive frameworks like ARTEX to conduct highly automated, high-velocity intrusions.

The Google::Auth Perl module is vulnerable to server-side request forgery (SSRF) via unvalidated AWS credential URLs (CVE-2026-74759) and an OAuth authorization bypass (CVE-2026-74760) due to missing state validation in the gcloud-auth login callback.

Beta9 worker pods execute tenant image definition shell commands with inadequate isolation, allowing access to the worker's filesystem and privileged resources.

A format string vulnerability (CVE-2024-23113) in the FortiGate FGFM service on TCP port 541 allows unauthenticated remote code execution via specially crafted input.

Multiple vulnerabilities within the SUSE Linux kernel across various distributions and modules could allow unauthorized actors to compromise data confidentiality, bypass security policies, or cause denial-of-service.

A heap out-of-bounds write vulnerability in the Linux kernel SMB1 client allows an attacker-controlled server to overwrite process credentials and escalate privileges to root.

An authentication bypass vulnerability (CVE-2026-112816) in the Canonical LXD HTTPS interface allows attackers to impersonate trusted clients via crafted TLS certificate chains, granting unauthorized control over clusters, containers, and host systems.

A vulnerability in konflux-ci allows local attackers on build runners to retrieve sensitive GitHub access tokens stored in plaintext by CI automation scripts.

The Mail logging & Catcher plugin for WordPress (<= 2.2.0) contains an information exposure vulnerability allowing authenticated users to extract password-reset keys and escalate privileges to administrator.

The Popup Builder WordPress plugin contains an authorization bypass vulnerability (CVE-2026-89270) that allows unauthenticated attackers to bulk delete published popups via a crafted GET request.

Crypttech Vatos DLP versions 1.1.176 through 1.1.242 store passwords in plaintext, facilitating unauthorized access to domain credentials.

Mail Mint versions 1.31.0 and earlier contain an unauthenticated PHP object injection vulnerability in the REST API endpoint /mint-form-submit that allows remote attackers to trigger arbitrary object instantiation.

An authentication bypass vulnerability in the ASUSWRT infosvr daemon allows unauthenticated remote attackers to execute arbitrary system commands with root privileges via UDP port 9999.

Puwell IP cameras (firmware 2.x - 4.x) contain an unauthenticated remote code execution vulnerability in a DebugShell interface on TCP port 34567, which is currently being targeted by botnets.

An authorization bypass vulnerability in SUSE Rancher Manager (CVE-2026-104623) allows authenticated users to spawn an unprivileged shell pod in the cattle-system namespace.

An authenticated, low-privileged user can trigger a stack-based buffer overflow in the RouterOS mtget binary via a crafted TFTP fetch request to gain persistent administrative privileges.

Multiple vulnerabilities in Veeam Management Pack for Microsoft System Center allow remote attackers to achieve arbitrary code execution on affected systems.

Multiple vulnerabilities in MongoDB Database Tools, Java Driver, and Laravel MongoDB may lead to data integrity compromise, SQL injection, and security policy bypass.

An unauthenticated remote code execution vulnerability in the Delinea Privilege Manager Windows agent allows attackers to achieve system-level code execution by exploiting an insecure WCF callback endpoint on TCP 5593.

A critical path traversal and local file inclusion vulnerability in jsPDF versions prior to 4.0.0 allows unauthenticated attackers to read arbitrary files in Node.js server-side environments.

An authenticated administrator can exploit a Server-Side Template Injection (SSTI) vulnerability in the Zammad AI Agent feature to achieve remote code execution via the type_enrichment_data configuration.

Blender versions prior to 4.5.15 and 5.x prior to 5.2.3 contain a heap buffer overflow in the thumbnail extractor that can lead to remote code execution when parsing maliciously crafted .blend files.

Blender contains a heap-based buffer overflow in the ptcache_data_alloc function, allowing attackers to trigger memory corruption and potential code execution via a maliciously crafted point cache file.

Scribus versions prior to 1.6.7 contain a heap out-of-bounds write vulnerability in the PSD loader that allows attackers to trigger memory corruption via a malicious file.

Fleet contains multiple vulnerabilities that can be exploited by an authenticated remote attacker to bypass security controls, escalate privileges, perform information disclosure, manipulate data, or trigger a denial-of-service condition.

A vulnerability in Adobe Digital Editions allows an unauthenticated remote attacker to bypass security measures and gain unauthorized write access to files on the host system.

ServiceNow AI Platform contains multiple vulnerabilities that allow a remote, authenticated attacker to achieve remote code execution, bypass security controls, and perform unauthorized data manipulation or disclosure.

Composer contains multiple vulnerabilities allowing remote, anonymous attackers to bypass security controls, manipulate files, or perform unauthorized information disclosure.

The SQLite command-line shell through version 3.54.1 is vulnerable to command injection because the .recover command emits malicious dot-commands stored in the database schema, which execute when the output is piped back into the shell.

Jellyfin versions up to 12.4 contain an SSRF vulnerability where authenticated users can bypass image validation by submitting gzip-compressed SVG payloads in data URIs to interact with internal network resources or read local files.

CakePHP versions through 5.4.3 contain an SQL injection vulnerability in the WindowExpression::range() and frame() methods that allows attackers to execute arbitrary SQL via crafted input passed to the OVER clause.

The Formidable Forms WordPress plugin is vulnerable to arbitrary plugin installation via the 'file_url' parameter in versions up to and including 6.35.

An out-of-bounds write vulnerability in Apple's AVEVideoEncoder component allows for kernel-level denials of service through specifically crafted high-resolution H.264 compression sessions.

OAuthLib fails to validate the device_code parameter during device flow token requests, allowing attackers with a valid client ID to illicitly obtain bearer tokens.

The activity.LoadLinkLaterActivity component in Handy News Reader versionCode 116 contains a vulnerability that allows attackers to force the application to fetch arbitrary crafted URLs.

A vulnerability in glib-networking allows a malicious TLS 1.3 server to trigger unbounded memory consumption in client applications via excessive session ticket messages, leading to a denial-of-service condition.

A vulnerability in Spring Security versions < 7.0.4 allows attackers to bypass security header injection by manipulating the Content-Length header, leading to the absence of X-Frame-Options and other security headers.

Pillow multi-frame loaders retain stale native image storage across mode transitions, leading to out-of-bounds writes and potential remote command execution when processing crafted MPO, PSD, DCX, or MIC files.

A local, low-privileged user can exploit an External Control of File Name or Path vulnerability in Ubiquiti WiFiman Desktop for macOS to execute arbitrary commands as root.

A vulnerability in systemd allows an attacker to bypass security measures and manipulate files on affected Linux systems.

Tandoor Recipes versions before 2.7.0 are vulnerable to SSRF in the Pestle importer, allowing authenticated low-privileged users to force server-side GET requests to arbitrary internal or external targets.

Multiple vulnerabilities in Red Hat Enterprise Linux components pki and Libreswan allow remote attackers to bypass security measures or trigger denial-of-service conditions.

Multiple vulnerabilities in WordPress versions prior to 7.1.4 allow remote attackers to execute arbitrary code, conduct denial-of-service, perform unauthorized data access, and bypass security policies.

A security policy bypass vulnerability in Mattermost Server could allow an attacker to circumvent configured server security policies.

A denial of service vulnerability in Kaspersky Network Agent and Security Center Administration Server modules allows an attacker to disrupt service availability (CVE-2026-88941).

A vulnerability in the Rapid7 Insight Agent for Linux and macOS allows an authenticated local user to achieve privilege escalation by supplying a crafted filesystem path during inventory collection.

An unauthenticated Cross-Site Scripting (XSS) vulnerability in Easy Property Listings versions 3.5.25 and earlier allows attackers to inject malicious scripts into web pages viewed by other users.

WP Crowdfunding versions 2.2.2 and earlier contain an unauthenticated sensitive data exposure vulnerability.

A race condition in the Linux kernel IPv4 TCP handshake allows remote unauthenticated attackers to trigger a use-after-free, potentially leading to kernel memory corruption or root code execution.

A security policy bypass vulnerability in Belden ICX35 industrial gateways allows attackers to reset login lockouts, circumventing authentication security controls.

A reflected cross-site scripting vulnerability in WP Swings Upsell Order Bump Offer for WooCommerce (versions <= 3.1.6) allows attackers to execute arbitrary scripts in a user's browser via crafted input.

The VideoWhisper Broadcast Live Video WordPress plugin contains a missing authorization vulnerability (CVE-2026-115963) in versions up to 7.3.9, allowing unauthorized users to bypass access control checks.

The toml-node library is vulnerable to a quadratic-complexity denial-of-service attack, where long dotted keys in TOML documents cause CPU exhaustion or process crashes via memory depletion.

Progress WhatsUp Gold is vulnerable to unauthenticated remote code execution via a write-what-where primitive in the WriteDataFile service, allowing attackers to plant webshells on the target system.

The Canadian Centre for Cyber Security has released an advisory regarding multiple unidentified vulnerabilities impacting a wide range of Red Hat enterprise software products.

IBM SPSS Analytic Server contains a vulnerability that allows a remote, unauthenticated attacker to cause a denial of service condition.

OPNsense contains a vulnerability that allows a remote, authenticated attacker to execute arbitrary code with administrator privileges.

A vulnerability in Adobe Connect allows a remote, unauthenticated attacker to achieve arbitrary code execution on affected systems.

A vulnerability in Grafana allows a remote, authenticated attacker to bypass security measures and perform unauthorized information disclosure.

An unauthenticated local file inclusion vulnerability in Ziahamza webui-aria2 allows remote attackers to perform file enumeration, with publicly available proof-of-concept exploit code increasing the risk of information disclosure.

A public Proof of Concept has been released for CVE-2025-0098, an activity token leak vulnerability in the Android framework allowing arbitrary startActivity() calls due to insufficient process identifier validation.

A privilege leftover vulnerability in Cloud Foundry UAA allows authenticated users to reuse their access tokens to impersonate a client and gain unauthorized authorities, such as the ability to create new OAuth clients.

Node Version Manager (nvm) versions 0.31.2 through 0.40.5 are vulnerable to command injection via malicious version strings due to improper sanitization in the nvm_ls function when invoked with tools like nvm use or automated shell hooks.

A privilege escalation vulnerability in the Linux kernel io_uring subsystem caused by incorrect compound page validation allows local attackers to achieve out-of-bounds memory access and modify process credentials.

Itech-gmbh Ilabclient version 3.7.1 stores credentials in cleartext within an Apache Derby database, allowing local attackers to extract configuration data via the ij tool.

CVE-2024-51791 is an unauthenticated arbitrary file upload vulnerability in the Made I.T. Forms WordPress plugin allowing remote code execution via a PHP web shell.

A path traversal and race condition vulnerability exists in the Sophos UTM email proxy, allowing unauthenticated remote attackers to execute arbitrary code as root.

CVE-2025-0288 is a local privilege escalation vulnerability in the biontdrv.sys Windows driver used by multiple Paragon Software products, for which a proof-of-concept exploit is publicly available.

n8n workflow nodes for Microsoft Outlook and SharePoint contain an OData $filter injection vulnerability allowing unauthorized data access and modification.

Multiple vulnerabilities in the Perl MIME-tools library prior to version 5.521 allow for header parsing manipulation, potentially leading to security bypasses or desynchronization in applications processing complex MIME messages.

An unauthenticated remote code execution vulnerability in JBoss EAP allows attackers to instantiate arbitrary classes from a remote URL when the server is configured with the -secmgr flag.

A missing authentication vulnerability in Juniper Networks Session Smart Router allows unauthenticated network-based attackers to escalate privileges via crafted URL parameters on non-onboarded devices.

An authenticated principal in Apache Kafka can leverage crafted IncrementalAlterConfigs or AlterConfigs requests to perform arbitrary file and environment variable reads from the broker host.

Google has released security updates for Chrome addressing a large number of vulnerabilities affecting Linux, Windows, and macOS installations.

Metabase has released security updates for multiple unspecified vulnerabilities affecting Pro, Enterprise, and open-source editions, requiring an upgrade to version 0.64.3.4 or 1.64.3.4.

CVE-2025-52694 is a critical unauthenticated SQL injection vulnerability in Advantech IoTSuite and IoT Edge products that allows remote database manipulation and potential code execution.

Threat actors are actively probing for CVE-2026-101767, a critical unauthenticated SQL injection vulnerability in the Oracle E-Business Suite Application Object Library that allows for remote code execution.

The VikRentCar plugin for WordPress (<= 1.4.8) contains a CSRF vulnerability in the condtext_update_tmpl function that permits unauthenticated attackers to achieve remote code execution by injecting PHP code into template files.

rtl_433 versions up to 25.12 contain a stack-based buffer overflow in the proflame2_mc function that allows attackers to trigger memory corruption via malicious OOK radio signals or input files.

Wails v2 allows attackers to bypass BindingsAllowedOrigins restrictions via a permissive regex flaw in origin validation, potentially enabling unauthorized execution of Go backend methods.

A double-free vulnerability in the XKB SetGeometry implementation in X.Org X Server and X Wayland allows local clients to cause a denial of service or potential arbitrary code execution.

CVE-2026-118129 is an authentication bypass vulnerability in the Chitchatter PostMessage Handler allowing remote attackers to manipulate the parentDomain argument to perform improper authentication.

Moxa has released security updates addressing three vulnerabilities in the Remote Connect Suite (MRC Client) and the OnCell G3150A-LTE Series.

Johnson Controls has released a security advisory addressing two vulnerabilities in Kantech Entrapass versions prior to 9.20.

The MembershipWorks WordPress plugin prior to version 6.17 fails to enforce content protection filters on WordPress REST API requests, allowing unauthenticated attackers to retrieve restricted member-only content.

A security vulnerability in git-annex (CVE-2026-112818) allows for unauthorized cross-repository data exfiltration, requiring an update to version 10.20261026 or the application of backported patches.

Multiple security vulnerabilities have been identified and addressed in samtools versions 1.24 and earlier, with patches now available in release 1.25 and backported versions.

A critical 16-year-old memory corruption flaw (CVE-2026-97631) in the EDK II PXE-Base Code driver allows attackers on the local network to execute arbitrary code with Ring 0 privileges during the early boot sequence.

A stack-based buffer overflow in WatchGuard Fireware OS allows remote attackers to trigger a DoS or execute arbitrary code by tampering with FireCloud Gateway configuration payloads via man-in-the-middle attacks.

Adobe Campaign Classic is vulnerable to an unauthenticated SQL injection flaw (CVE-2026-105781) that allows for remote code execution, with public exploit code now available.

Tanium has addressed an improper output sanitization vulnerability in Enforce.

Tanium has addressed an unauthorized code execution vulnerability in its Certificate Manager component.

An improper authentication vulnerability in the TeamViewer Remote Management Monitoring IPC mechanism allows local, low-privileged attackers to impersonate the IPC broker and execute arbitrary code as NT AUTHORITY\SYSTEM.

An improper access control vulnerability in the TeamViewer installer staging directory allows local low-privileged users to achieve arbitrary code execution as SYSTEM via a crafted installer options file.

The GoAhead embedded web server contains critical flaws in its TLS backend and authentication logic, including failure to enforce certificate revocation, improper certificate chain validation, session decryption risks, and a login bypass vulnerability.

Multiple vulnerabilities in Firefox for iOS versions prior to 156.1, detailed in MFSA2026-117, allow for data integrity compromise and security policy bypass.

Multiple vulnerabilities in Microsoft Edge allow for remote code execution, privilege escalation, and unauthorized data access, requiring immediate updates to patched versions.

Multiple vulnerabilities in the Squid web proxy cache allow remote unauthenticated attackers to cause a denial of service or perform information disclosure.

A vulnerability in the xdg-dbus-proxy component of Red Hat Enterprise Linux allows a remote, unauthenticated attacker to bypass security restrictions, potentially enabling arbitrary code execution.

A vulnerability in NoMachine allows a remote, unauthenticated attacker to execute arbitrary code on the target system.

A vulnerability in the go-git library integrated into Red Hat OpenShift GitOps may allow an unauthenticated remote attacker to manipulate files or disclose sensitive information.

Multiple vulnerabilities in the Qt framework allow a remote, unauthenticated attacker to cause a denial-of-service condition and manipulate or disclose sensitive data.

OpenBao contains multiple undisclosed vulnerabilities that allow an attacker to bypass security controls.

Nextcloud disclosed multiple vulnerabilities across its server platform and various applications, including Tables, Whiteboard, Files Confidential, Collectives, and Richdocuments, which could allow attackers to bypass security controls, manipulate data, or cause Denial-of-Service.

An authorization bypass vulnerability in the Grav CMS Debugger component allows unauthenticated remote attackers to access sensitive profiler data when the application is deployed behind a reverse proxy.

The ai-sdlc plugin MCP server through 0.31.2 is vulnerable to OS command injection via the repo argument, allowing execution of commands by supplying shell metacharacters.

Multiple vulnerabilities in Apple iOS and iPadOS allow unauthorized access, privilege escalation, or system crashes via malicious files, network traffic, or web pages.

NVIDIA TensorRT-LLM contains an improper tokenizer loading vulnerability that could allow an attacker to achieve remote code execution, information disclosure, data tampering, or denial of service by influencing the control sphere.

Researchers have published analysis and crash-inducing proof-of-concept generators for two out-of-bounds write vulnerabilities in the Apple CoreGraphics PDF stack, both patched in iOS 27.2.

Semantic MediaWiki from 7.3.0 before 7.3.1 contains a missing authorization vulnerability in the smwtask API module that allows unauthenticated attackers to run queued jobs and force store updates.

REDAXO core versions 5.3.0 through 5.21.3 contain an authentication bypass vulnerability in the structure/history plugin that allows unauthenticated attackers to forge administrative login tokens and achieve code execution.

A stack-based buffer overflow vulnerability has been identified in JP1/Automatic Job Management System 3.

A public proof-of-concept exploit for CVE-2021-31166, a use-after-free vulnerability in the Windows http.sys driver, demonstrates remote code execution via a malformed Accept-Encoding header.

CVE-2026-115905 is a critical vulnerability in the Rust zip crate (versions <= 9.0.4) allowing arbitrary file overwrites or RCE via ZIP header discrepancy between CDFH and LFH.

Attackers are hijacking Dahua IP cameras and recorders via the Easy4IP P2P cloud access feature by using brute-force attacks or exploiting CVE-2021-33044 and CVE-2021-33045 to gain unauthorized device control.

An authenticated PHP object injection vulnerability in the Kirki WordPress plugin allows attackers with subscriber-level access to escalate privileges to administrator via a POP chain.

Google has released security updates for the Brotli compression library to address vulnerabilities affecting multiple version branches.

A heap out-of-bounds write vulnerability in llama.cpp versions b5899 through b10260 allows attackers to achieve memory corruption or potential code execution via maliciously crafted GGUF model files.

Tencent RapidJSON versions up to 1.1.0 contain an out-of-bounds read vulnerability in the GenericStringStream function within the Regex Parser component.

Starman versions prior to 0.4019 are susceptible to multiple denial-of-service vectors, including resource exhaustion via stalled request bodies, CPU exhaustion from regex backtracking, and response desynchronization.

A vulnerability in the Godot 4.x .po translation file loader allows for arbitrary code execution due to improper validation of the Plural-Forms header during plural lookup operations.

Multiple vulnerabilities across MongoDB drivers and tools expose systems to arbitrary code execution, data integrity and confidentiality loss, denial of service, and injection attacks.

Multiple vulnerabilities discovered in various VMware Tanzu Platform components, including API Gateway, Tanzu Hub, and associated buildpacks, require urgent review of Broadcom security advisories for remediation.

A security policy bypass vulnerability in Citrix XenServer versions 8.4 and 9 allows attackers to circumvent established security controls, as detailed in Citrix bulletin CTX697257.

OpenSTAManager versions 2.9.8 and earlier contain an authenticated remote code execution vulnerability (CVE-2025-69212) due to improper file path sanitization in the importFE_ZIP plugin.

An unauthenticated denial of service vulnerability in the HashiCorp Consul HTTP API allows remote attackers to exhaust memory on target agents, leading to service unavailability.

An SQL injection vulnerability in the @aws-cdk/aws-redshift-alpha module allows attackers to execute arbitrary SQL commands with superuser privileges on Amazon Redshift clusters by manipulating construct property values.

A vulnerability in HCL BigFix allows a remote, unauthenticated attacker to bypass security measures and manipulate files on the affected system.

CVE-2026-114148 allows local privilege escalation on Linux when an administrator extracts a malicious .NET tarball containing root-owned SUID binaries.

Timescale pgvectorscale before 0.9.1 contains a type confusion vulnerability allowing authenticated users with schema creation privileges to trigger out-of-bounds memory access through crafted DiskANN index operations.

Siemens has identified an authentication bypass vulnerability in its Mendix SAML module, which could allow unauthenticated attackers to circumvent authentication controls.

David Lingren Media Library Assistant contains a Blind SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command.

The Simple Open EtherCAT Master (SOEM) library version 2.0.0 and earlier fails to validate length and offset fields in device messages, allowing a malicious device to trigger out-of-bounds memory reads.

Fuji Electric V-SFT is vulnerable to a stack-based buffer overflow during the parsing of crafted V7 files, potentially enabling arbitrary code execution.

A logic flaw in the Rocq kernel guard checker permits the construction of false proofs by failing to track recursive calls in fixpoints, undermining the integrity of formal verification.

A soundness vulnerability in the Lean 4 kernel allows the construction of false mathematical proofs due to improper validation of structure projections and insufficient type-checking in the inductive definition process.

A logic soundness vulnerability in the Rocq kernel allows for the construction of invalid proofs due to improper state management of the universe checking flag after closing a module.

HTTP::Server::PSGI versions before 1.0056 are susceptible to a remote denial-of-service vulnerability triggered by an excessively large Content-Length header.

Wazuh Manager versions 4.4.0 through 4.9.0 are vulnerable to remote code execution due to insecure deserialization in the DistributedAPI component.

Rclone versions 1.55.0 through 1.75.1 contain a signature verification bypass in the selfupdate function that allows attackers to install malicious executables by prepending unsigned checksums to the verification block.

An unauthenticated denial of service vulnerability in vLLM versions 0.10.2 through 0.24.x allows attackers to trigger an out-of-memory condition by submitting decompression-bomb images to the /v1/chat/completions endpoint.

SiYuan versions 3.5.4 through 3.8.6 on Windows contain a path denylist bypass vulnerability (CVE-2026-116171) that allows authenticated attackers to exfiltrate sensitive workspace files by prepending a Windows extended-length prefix to path parameters.

Jenkins versions prior to 2.442 and LTS 2.426.3 contain an arbitrary file read vulnerability caused by the CLI parser improperly expanding @ file references, allowing unauthenticated attackers to read contents from the Jenkins controller filesystem.

A server-side request forgery vulnerability in Zylon PrivateGPT versions 1.0.0 and 1.0.1 allows remote attackers to perform unauthorized requests via the URI Artifact Loader component.

A public exploit exists for CVE-2023-52076, a path traversal and arbitrary file write vulnerability in Atril and Xreader document viewers that enables remote code execution via malicious EPUB files.

A security vulnerability in the Unitree Go2 component chat_go allows for remote OS command injection via the set_volume function.

Public proof-of-concept exploits are available for two vulnerabilities in the ThroughTek TUTK SDK (v3.1.10.0-4.3.8.1) that could allow remote heap overflow and out-of-bounds read conditions in downstream IoT devices.

An origin validation error in the msal-node library allows an attacker to intercept sensitive parameters during the authorization code flow, potentially leading to unauthorized information disclosure.

A critical vulnerability (CVE-2026-30612) in the abandoned Time4Popcorn application allows remote attackers to hijack the unauthenticated background updater to execute arbitrary code with SYSTEM or root privileges.

The WP User Frontend Pro WordPress plugin is vulnerable to arbitrary file upload via the upload_files function, allowing authenticated attackers to achieve remote code execution.

CVE-2025-21479 is a high-severity local privilege escalation vulnerability in the Qualcomm Adreno GPU driver allowing for kernel-level arbitrary physical memory writes, with functional exploits now targeting Android devices including the iQOO Neo9.

A vulnerability in the obsidian-tc server allows malicious or non-compliant clients to execute destructive tool calls by echoing validly bound request states even after a human-in-the-loop confirmation is declined.

The obsidian-tc package HTTP transport lacks Origin header validation and DNS-rebinding protection, allowing drive-by vault access via loopback.

CVE-2025-52691 is a critical arbitrary file upload vulnerability in SmarterMail (Build 9406 and earlier) that enables unauthenticated remote code execution, with multiple proof-of-concept exploits publicly available.

CVE-2024-0582 is a privilege escalation vulnerability in the Linux kernel io_uring subsystem that enables unauthorized write access to /etc/passwd via a Dirty Cred technique.

An authentication bypass vulnerability in Mitel MiCollab versions 9.8.1.201 and earlier enables unauthenticated attackers to perform arbitrary file reads via a path traversal flaw.

A critical path traversal vulnerability in the npm package image-downloader allows attackers to perform arbitrary file writes by providing a specially crafted percent-encoded URL.

IBM SPSS Modeler contains a vulnerability that allows an authenticated, remote attacker to manipulate files on the host system.

HPE has addressed multiple vulnerabilities affecting various versions of its Networking Wireless Operating Systems (AOS-10 and AOS-8) that require firmware updates.

Multiple critical vulnerabilities in Oracle Fusion Middleware allow unauthenticated attackers to achieve remote code execution, unauthorized data access, and privilege escalation.

AivahThemes Hostme version 7.0 and earlier contains a DOM-based cross-site scripting vulnerability resulting from improper input sanitization during web page generation.

PraisonAI versions 4.5.2 to before 4.6.59 contain an authorization bypass vulnerability in Discord, Slack, and Telegram approval backends, allowing unauthorized users to approve high-risk multi-agent tool calls.

A vulnerability in PHP allows a remote, unauthenticated attacker to disclose sensitive information, though specific version details and CVE identifiers remain undisclosed by the vendor.

A heap buffer overflow in GStreamer's libgstvideo via untrusted unixfd deserialization allows remote attackers to trigger out-of-bounds memory access, potentially leading to code execution.

CVE-2024-0235 is an unauthenticated information disclosure vulnerability in the Myeventon Eventon plugin that allows remote attackers to enumerate user email addresses via the 'eventon_get_virtual_users' AJAX action.

Coraza WAF versions prior to 3.8.1 contain a filename parsing vulnerability that allows attackers to bypass file-based security rules using specifically crafted multipart upload parameters.

Multiple vulnerabilities in HAPI FHIR version 8.10.0 allow for cross-tenant partition override, authorization bypasses, and heap exhaustion via gzip compression, potentially exposing patient data in multi-tenant environments.

A vulnerability in CFITSIO up to version 4.7.0 allows for arbitrary code execution through an out-of-bounds write in the ffgcls2 function when processing maliciously crafted FITS files.

A project restriction bypass in Incus 7.3.0 through 7.4.x allows restricted users to inject malicious arguments into the mkfs command, leading to privilege escalation on the host.

Mistune versions 3.0.0 through 3.2.x are vulnerable to an algorithmic complexity issue in the parse_link_text function, allowing unauthenticated attackers to trigger CPU exhaustion via crafted Markdown containing unbalanced brackets.

The JetBackup WordPress plugin before 3.1.24.10 is vulnerable to an arbitrary file write attack via malicious symbolic links in backup archives, allowing authenticated administrators to achieve remote code execution.

Incus versions 7.0.0 through 7.0.1 and 7.1.0 through 7.4.0 contain a path traversal vulnerability in instance backup processing that allows authenticated attackers to write files to the host filesystem, resulting in full host compromise.

The Storybook development server exposes authentication tokens via WebSocket, allowing attackers on the same local network to inject malicious code into story files and execute arbitrary commands through vulnerable addons.

Multiple vulnerabilities in JupyterHub allow a remote, authenticated attacker to achieve privilege escalation, bypass security measures, manipulate data, and trigger a denial-of-service.

Multiple vulnerabilities in Cisco IOS XE, Secure Firewall Threat Defense (SFTD), and Snort allow attackers to execute arbitrary code, bypass security controls, or cause a denial-of-service condition.

Multiple vulnerabilities in Apache Traffic Server allow a remote, unauthenticated attacker to execute arbitrary code, bypass security controls, perform data manipulation, or trigger a denial-of-service condition.

The PHP Group has disclosed multiple vulnerabilities that allow a remote, anonymous attacker to cause a denial-of-service condition, bypass security controls, or achieve other unknown impacts.

The retired Apache Abdera library is vulnerable to XML external entity (XXE) injection, enabling unauthenticated remote attackers to access sensitive files or perform server-side requests via malicious XML input.

CVE-2023-5359 is a cleartext credential storage vulnerability in W3 Total Cache versions 2.7.5 and earlier that allows unauthenticated remote attackers to retrieve API keys and OAuth secrets via direct HTTP requests to plugin PHP files.

PHPOK versions 4.5.000 through 5.4.080 contain an unauthenticated SQL injection vulnerability in the sort parameter of the project index API, enabling error-based database information extraction.

The CozyThemes Rootblox plugin for WordPress, versions 1.0.6 and earlier, contains a Local File Inclusion vulnerability that allows unauthenticated remote attackers to include arbitrary files, potentially leading to remote code execution.

A critical vulnerability in the RingRTC library used by Signal allows a remote peer to block call termination by flooding the Finite State Machine (FSM) event queue, enabling unauthorized extension of audio and video capture.

Cisco has patched 34 vulnerabilities, including critical-severity remote code execution and authentication bypass flaws, affecting Expressway Series, Unified Communications products, and Snort 3.

NT OneAPP fails to validate server certificates and hostnames, allowing network-adjacent attackers to conduct man-in-the-middle attacks.

A public exploit exists for a use-after-free vulnerability in the legacy JScript engine (jscript.dll) that allows remote code execution via Internet Explorer 11.

Rex versions through 1.16.1 for Perl accept unknown SSH host keys during remote rsync transfers due to a hardcoded StrictHostKeyChecking=no configuration.

The Net::LibSSH Perl module fails to verify host keys against known_hosts during connection establishment, enabling man-in-the-middle attacks.

The Robots-Validate Perl module (versions 0.4.3 through 0.4.9) fails to clear User-Agent matcher state between requests, causing legitimate clients to be incorrectly classified as imposter robots.

Splunk Enterprise versions prior to 10.4.4, 10.2.8, 10.0.11, and 9.4.16 contain a vulnerability where authenticated users with the schedule_search capability can bypass SPL command safeguards during scheduled searches, potentially leading to unauthorized data access, modification, or service disruption.

Django REST framework versions 3.12.0 through 3.18.1 contain a logic flaw where TokenProxy.delete() uses an incorrect primary key, causing credential revocation attempts to fail silently.

Apache Pulsar Manager is vulnerable to missing authentication and authorization, leading to potential administrative credential disclosure, and will not receive patches due to the project reaching end-of-life status.

A race condition in the Zephyr RTOS scheduler wait queue management allows unprivileged user-mode threads to trigger out-of-bounds memory access or use-after-free in supervisor context by exploiting improper locking in SMP configurations.

MongoDB Compass is vulnerable to arbitrary code execution when processing specially crafted BSON values from a stored view aggregation pipeline during an editing operation.

Apache Traffic Server is vulnerable to request smuggling due to the improper handling of shared origin connections when client request bodies are incomplete, allowing cache poisoning and access control bypass.

NTPsec ntpd versions 1.1.4 through 1.2.5 are vulnerable to a remote denial-of-service attack due to an out-of-bounds read flaw triggered by malformed NTS extension fields.

Apache IoTDB versions 2.0.0 through 2.0.10 contain a privilege escalation vulnerability where the Legacy Pipe receiver protocol uses a hardcoded root identity to perform unauthorized data operations.

Node.js is vulnerable to NUL byte truncation in dns.resolve* functions, allowing attackers to bypass allowlist filters and perform SSRF by injecting a NUL character into hostname strings.

Multiple unspecified vulnerabilities have been identified in Mattermost Server, requiring immediate review of vendor security bulletins and application of necessary patches.

Multiple vulnerabilities in Mozilla Firefox and Thunderbird, including CVE-2026-113399 through CVE-2026-113869, may lead to arbitrary code execution, data confidentiality compromise, or denial of service.

Oracle has disclosed multiple vulnerabilities affecting various Oracle Systems, which could allow a remote, anonymous, or authenticated attacker to compromise the confidentiality, integrity, and availability of the affected systems.

Multiple vulnerabilities in Oracle TimesTen In-Memory Database allow a remote, authenticated attacker to compromise the confidentiality, integrity, and availability of the system.

The camel-fop component in Apache Camel is vulnerable to XXE injection when a third-party JAXP TransformerFactory is present, enabling local file disclosure and SSRF via maliciously crafted XSL-FO documents.

Microsoft addressed 1,413 vulnerabilities including 75 critical flaws and an exploited zero-day (CVE-2026-96951) bypass in Windows Shell that circumvents Mark of the Web protections.

PHP has announced two critical vulnerabilities rated CVSS v4.0 9.2 and a security release scheduled for 21 October at 14:00 UTC. Exploit details and affected versions are not yet confirmed by PHP.

An XPath injection vulnerability in the Hugging Face smolagents library (CVE-2025-11844) allows for local data extraction and arbitrary DOM traversal via improper input validation in the search_item_ctrl_f function.

A critical vulnerability in D-Link DHP-W610AV allows remote attackers to force an empty password configuration via the HNAP Login interface, enabling unauthorized access.

An existence check bypass in launch-editor on Windows allows attackers to execute arbitrary commands by supplying crafted file paths ending in ..:line:column.

An unauthenticated remote attacker can trigger a denial-of-service condition by sending specially crafted multipart requests that cause uncontrolled file descriptor allocation in the aiohttp library.

The A2A Java SDK for Android fails to properly disable HTTP redirects in synchronous POST requests, allowing sensitive authentication tokens to be leaked to unauthorized authorities following a 302 redirect.

A command injection vulnerability in virtualenv prior to 21.14.9 allows arbitrary code execution via malformed interpreter paths when generating POSIX console scripts.

A missing authorization vulnerability in the Kiro Crew WhatsApp integration allows remote attackers who are group members to hijack agent sessions and execute arbitrary commands on the host system.

The Issuu Panel plugin for WordPress before 1.6.6 is susceptible to unauthenticated remote and local file inclusion via the abspath parameter, enabling arbitrary PHP code execution.

The Memphis Documents Library plugin for WordPress is vulnerable to path traversal via the mdocs-img-preview parameter, allowing unauthenticated attackers to read arbitrary files.

The Aspose PDF Exporter plugin for WordPress before version 2.0 is vulnerable to path traversal via the file parameter, allowing unauthenticated remote attackers to retrieve arbitrary files like wp-config.php.

An OS command injection vulnerability in the TOTOLINK X2000R router allows an authenticated attacker to execute arbitrary system commands via the boa formPasswordSetup function.

SolarWinds Observability Self-Hosted contains a broken authorization schema vulnerability that permits low-privileged users to access or modify restricted information, leading to unauthorized privilege escalation within the application.

Hitachi Energy MicroSCADA X SYS600 is affected by multiple vulnerabilities, including CSV injection, authentication bypass, and privilege escalation, which could allow attackers to gain unauthorized access or control over host systems.

Multiple vulnerabilities in WAGO industrial controller firmware allow an authenticated low-privileged user to achieve root-level OS command injection and bypass configuration authorization checks.

A buffer under-read vulnerability in Apache Tomcat versions 11.0.0-M25 through 11.0.26 allows for sensitive data leakage or request failure by incorrectly mixing response bodies between consecutive requests on the same connection.

An input validation vulnerability in Apache Camel’s SagaProcessor allows unauthorized actors to hijack saga associations via the Long-Running-Action header, potentially leading to incorrect compensation or workflow manipulation.

DrayTek Vigor2960 firmware version 1.5.1.6 Revision 8218 is vulnerable to unauthenticated remote command injection via the set_table function in mainfunction.cgi.

A heap-based buffer overflow in the media.swcodec component of Google Android 16.0 allows for remote code execution via a ROP chain triggered by a maliciously crafted video file.

CVE-2026-85296 allows cross-partner signing key leakage in Apache Camel AS2 deployments due to improper state management of per-request keys in shared instance fields.

A logic error in the Stormshield Network Security (SNS) dynamic data file signature verification routine allows attackers to bypass validation and inject unauthenticated updates during the autoupdate process.

An authenticated SQL injection vulnerability in YS-infoware BA-Workflow allows remote attackers to execute arbitrary database commands, compromising data integrity and confidentiality.

An incomplete security fix in Ghostscript 9.27 on RHEL 8 allows attackers to bypass -dSAFER restrictions, leading to arbitrary file access or command execution via crafted PostScript files.

A vulnerability in Pingora versions prior to 0.8.1 allows unauthenticated remote attackers to trigger out-of-memory termination via HTTP/2 header-list and stream resource exhaustion.

EvoScientist versions 0.1.0 through 0.2.4 contain an approval bypass vulnerability enabling attackers to execute arbitrary shell commands via unsanitized content ingestion.

OpenSRE versions through 0.1.2026.10.19 are vulnerable to an approval gate bypass that enables arbitrary command execution via manipulated alert or messaging inputs.

JoySafeter version 1.0.0 and earlier contains a remote code execution vulnerability allowing authenticated users to execute shell commands via an unsandboxed agent tool.

DB-GPT versions 0.8.2 and earlier contain an unauthenticated remote code execution vulnerability in the ReAct agent endpoint that allows attackers to execute arbitrary system commands as root.

An unauthenticated remote code execution vulnerability in piflow versions 2.0.0 through 2.0.1 allows attackers to execute arbitrary system commands via the DeepAgents chat agent.

Ning compress-lzf versions prior to 1.2.0 are vulnerable to an out-of-bounds memory access flaw in the UnsafeChunkDecoder, which can be exploited via crafted LZF streams to leak JVM heap memory or cause application crashes.

Mozilla Sccache versions prior to 0.4.0 are vulnerable to arbitrary code execution due to improper handling of the LD_PRELOAD environment variable when invoking compilers.

A NULL pointer dereference vulnerability in FFmpeg version N-119856-gbe46370941 allows remote attackers to trigger a Denial of Service through specially crafted media files.

IBM Sterling Connect Direct for Unix is susceptible to local privilege escalation due to improper privilege management in versions 6.3.0.0 through 6.4.0.6, identified as CVE-2026-105453.

A vulnerability in the Netis EAP930 CGI endpoint allows remote attackers to trigger a backdoor via crafted manipulation of the SIGNATURE argument in the /cgi-bin/debug file.

An unauthenticated command injection vulnerability in the sub_416874 function of H3C Magic NX15 (100R017) allows remote attackers to execute arbitrary system commands via /usr/bin/usrlist.

A vulnerability in the Zephyr RTOS OSDP Control Panel implementation allows attackers with access to the RS-485 bus to trigger a stack-based buffer overflow and potential code execution.

An incorrect permission assignment vulnerability in the Dell Application Store allows a local low-privileged attacker to disclose sensitive information.

The orbitale imagemagick-php library up to version 3.3.5 is vulnerable to remote OS command injection via the Command::font function in src/Command.php, allowing unauthenticated attackers to execute arbitrary commands.

Siemens Software Center versions prior to 4.0.9.8 are vulnerable to a DLL sideloading attack identified as CVE-2026-110936, which is currently being exploited in the wild to achieve arbitrary code execution.

CVE-2026-33234 is an SSRF vulnerability in the AutoGPT Platform that allows authenticated users to bypass IP blocklists via the SendEmailBlock component to conduct internal network reconnaissance and banner grabbing.

Apache Answer versions 2.0.2 and earlier contain an authentication bypass vulnerability in the reaction API that allows unauthorized users to access restricted metadata and manipulate content reactions.

An unauthenticated remote SQL injection vulnerability in the xp_cmdshell function of the /ws.asmx endpoint in Wubang Five-in-One Safety Production Management Information System allows for arbitrary command execution.

Multiple vulnerabilities identified in Stormshield Network Security firmware may allow remote attackers to bypass security policies, manipulate data integrity, or conduct cross-site scripting (XSS) attacks.

PCMan FTP Server 2.0 is vulnerable to a stack-based buffer overflow via the pwd command, allowing unauthenticated remote code execution.

An unauthenticated vulnerability in DWR request processing allows attackers to execute arbitrary workflow rules by chaining method calls.

An uncontrolled recursion vulnerability (CVE-2026-112368) in the MongoDB PHP driver allows an unauthenticated attacker to trigger stack exhaustion and process termination by providing malicious BSON documents.

An SQL injection vulnerability in NocoBase plugin-collection-sql allows authenticated privileged users to bypass validation and execute arbitrary SQL commands on the underlying PostgreSQL database.

IBM MQ Operator contains an unrestricted Java deserialization vulnerability in MQ Classes for Java that allows authenticated attackers to cause a denial of service or execute arbitrary code.

IBM MQ contains a vulnerability in its MQOPEN operations that permits an authenticated attacker to induce a denial of service or trigger memory corruption through improper buffer size validation.

Authenticated users with the task_runner role in Semaphore UI versions up to 2.19.16 can achieve remote code execution by injecting malicious Ansible configuration parameters into task environment payloads.

CVE-2023-22047 allows unauthenticated attackers to perform arbitrary file reads via the wsrp-url parameter in Oracle PeopleSoft Enterprise PeopleTools.

An unrestricted file upload vulnerability in the Criminal-Management-System allows remote attackers to upload arbitrary files via the my_img parameter in home.php.

The Television (tv) package, versions 0.15.0 through 0.15.9, is vulnerable to OS command injection due to improper sanitization of single quotes within the format_command function.

Multiple D-Link router models contain hard-coded credentials in the MQTT Broker component, allowing for potential remote unauthorized access via public exploit code.

CheckCle versions up to 1.6.0 contain a critical missing authorization vulnerability allowing unauthenticated access to database records via improperly configured PocketBase API rules.

An XML External Entity (XXE) vulnerability in the Apache Camel camel-xpath component allows attackers to trigger local file disclosure or server-side request forgery when documentType is set to InputSource.

Red Hat Advanced Cluster Security for Kubernetes contains a SAML authentication flaw allowing attackers to replay unexpired assertions to obtain multiple valid session tokens.

An unauthenticated SQL injection vulnerability in the Administrative Mutation Handler of the Online Clinic Management System allows remote attackers to execute arbitrary database queries via the docid parameter.

DBeaver contains multiple security vulnerabilities that may allow a local or remote attacker to achieve arbitrary code execution or cause a denial-of-service condition.