WaratekVRT Sign in
Reset
More filters
Columns
Including CVEs outside Waratek scope✕
Overview 425,603 matches · 17,128 in Waratek scope · 1,799 protected · 5,900 exploited · 1,781 CISA KEV · 31,192 public PoC · 4,384 EPSS ≥ 0.5
425,603matches 17,128in Waratek scope4.0% 1,799protected0.4% 5,900exploited1.4% 1,781CISA KEV0.4% 31,192public PoC7.3% 4,384EPSS ≥ 0.51.0%
Protected by Waratek 1,806 0.4% Rule in development 7 0.0% Mitigation candidate 411 0.1% No exploit published 14,904 3.5% Outside Waratek scope 4,846 1.1% Not applicable 384,459 90.3% Withdrawn CVE 19,170 4.5%
Critical 43,961 10.3% High 165,454 38.9% Medium 174,827 41.1% Low 17,914 4.2% None 79 0.0% Unknown 23,368 5.5%
blocked by ARMR today 1,799 0.4% partly blocked 7 0.0% not blocked 423,786 99.6% not established 11 0.0% unrecorded 0 0.0%
Exploited 5,900 1.4% Working exploit published 26,493 6.2% Proof of concept only 46,800 11.0% Forecast only 857 0.2% No public exploit 345,553 81.2%
split by peak 100,326 / year
Withdrawn CVE: 19,170Not applicable: 384,459Outside Waratek scope: 4,846No exploit published: 14,904Mitigation candidate: 411Rule in development: 7Protected by Waratek: 1,806 Unknown: 23,368None: 79Low: 17,914Medium: 174,827High: 165,454Critical: 43,961 not established: 11not blocked: 423,786partly blocked: 7blocked by ARMR today: 1,799 No public exploit: 345,553Forecast only: 857Proof of concept only: 46,800Working exploit published: 26,493Exploited: 5,900
19882 Not applicable2 High2 not blocked2 Working exploit published1 No public exploit1 19893 Not applicable3 High2 Medium1 not blocked3 No public exploit3 199011 Not applicable11 High8 Medium2 Low1 not blocked11 Working exploit published1 No public exploit10 199115 Not applicable15 High11 Medium4 not blocked15 Working exploit published2 No public exploit13 199214 Not applicable13 Withdrawn CVE1 High12 Low1 Unknown1 not blocked14 No public exploit14 199313 Not applicable13 High8 Medium3 Low2 not blocked13 No public exploit13 199426 Not applicable25 Withdrawn CVE1 High14 Medium10 Low1 Unknown1 not blocked26 Working exploit published6 No public exploit20 199525 Not applicable25 Critical1 High17 Medium6 Low1 not blocked25 Working exploit published5 No public exploit20 199675 No exploit published1 Not applicable73 Withdrawn CVE1 Critical1 High43 Medium21 Low9 Unknown1 not blocked75 Working exploit published18 Forecast only1 No public exploit56 1997253 Not applicable252 Withdrawn CVE1 Critical1 High143 Medium89 Low19 Unknown1 not blocked253 Exploited2 Working exploit published73 Forecast only2 No public exploit176 1998247 Not applicable246 Withdrawn CVE1 Critical1 High137 Medium85 Low23 Unknown1 not blocked247 Exploited1 Working exploit published50 No public exploit196 1999923 No exploit published2 Outside Waratek scope1 Not applicable891 Withdrawn CVE29 Critical3 High423 Medium357 Low111 Unknown29 not blocked923 Exploited2 Working exploit published282 No public exploit639 20001,020 Mitigation candidate6 No exploit published6 Outside Waratek scope2 Not applicable1,005 Withdrawn CVE1 Critical2 High454 Medium467 Low96 Unknown1 not blocked1,020 Exploited5 Working exploit published427 Forecast only1 No public exploit587 20011,679 Protected by Waratek1 Mitigation candidate2 No exploit published10 Outside Waratek scope14 Not applicable1,649 Withdrawn CVE3 Critical12 High776 Medium706 Low182 Unknown3 blocked by ARMR today1 not blocked1,678 Exploited14 Working exploit published480 Forecast only2 No public exploit1,183 20022,170 Protected by Waratek3 Mitigation candidate8 No exploit published26 Outside Waratek scope12 Not applicable2,107 Withdrawn CVE14 Critical10 High1,023 Medium980 Low143 Unknown14 blocked by ARMR today3 not blocked2,167 Exploited12 Working exploit published545 Forecast only9 No public exploit1,604 20031,548 Protected by Waratek2 Mitigation candidate7 No exploit published30 Outside Waratek scope6 Not applicable1,482 Withdrawn CVE21 Critical9 High674 Medium747 Low97 Unknown21 blocked by ARMR today2 not blocked1,546 Exploited10 Working exploit published499 Forecast only1 No public exploit1,038 20042,479 Protected by Waratek2 Mitigation candidate1 No exploit published24 Outside Waratek scope8 Not applicable2,416 Withdrawn CVE28 Critical10 High973 Medium1,265 Low203 Unknown28 blocked by ARMR today2 not blocked2,477 Exploited21 Working exploit published755 Forecast only1 No public exploit1,702 20055,010 Protected by Waratek3 Mitigation candidate4 No exploit published75 Outside Waratek scope17 Not applicable4,833 Withdrawn CVE78 Critical13 High2,048 Medium2,430 Low441 Unknown78 blocked by ARMR today3 not blocked5,007 Exploited22 Working exploit published1,341 Forecast only11 No public exploit3,636 20066,659 Protected by Waratek8 Mitigation candidate4 No exploit published121 Outside Waratek scope67 Not applicable6,408 Withdrawn CVE51 Critical12 High2,763 Medium3,324 Low509 Unknown51 blocked by ARMR today8 not blocked6,651 Exploited37 Working exploit published2,440 Proof of concept only1 Forecast only6 No public exploit4,175 20076,596 Protected by Waratek6 Mitigation candidate10 No exploit published134 Outside Waratek scope83 Not applicable6,283 Withdrawn CVE80 Critical21 High3,162 Medium3,101 Low232 Unknown80 blocked by ARMR today6 not blocked6,590 Exploited47 Working exploit published2,495 Proof of concept only5 Forecast only5 No public exploit4,044 20085,664 Protected by Waratek7 Mitigation candidate9 No exploit published120 Outside Waratek scope74 Not applicable5,422 Withdrawn CVE32 Critical19 High2,846 Medium2,582 Low185 Unknown32 blocked by ARMR today7 not blocked5,657 Exploited42 Working exploit published2,518 Proof of concept only4 Forecast only9 No public exploit3,091 20095,778 Protected by Waratek9 Mitigation candidate13 No exploit published181 Outside Waratek scope62 Not applicable5,467 Withdrawn CVE46 Critical15 High2,734 Medium2,786 Low197 Unknown46 blocked by ARMR today9 not blocked5,769 Exploited73 Working exploit published2,591 Proof of concept only2 Forecast only3 No public exploit3,109 20104,667 Protected by Waratek9 Mitigation candidate12 No exploit published162 Outside Waratek scope86 Not applicable4,370 Withdrawn CVE28 Critical28 High2,093 Medium2,241 Low277 Unknown28 blocked by ARMR today9 not blocked4,658 Exploited73 Working exploit published1,313 Proof of concept only1 Forecast only9 No public exploit3,271 20114,172 Protected by Waratek6 Mitigation candidate9 No exploit published178 Outside Waratek scope116 Not applicable3,841 Withdrawn CVE22 Critical5 High1,784 Medium2,101 Low260 Unknown22 blocked by ARMR today6 not blocked4,166 Exploited50 Working exploit published691 Proof of concept only5 Forecast only4 No public exploit3,422 20125,351 Protected by Waratek9 Mitigation candidate24 No exploit published278 Outside Waratek scope94 Not applicable4,883 Withdrawn CVE63 Critical21 High1,724 Medium3,035 Low508 Unknown63 blocked by ARMR today9 not blocked5,340 not established2 Exploited59 Working exploit published831 Proof of concept only7 Forecast only46 No public exploit4,408 20135,324 Protected by Waratek26 Mitigation candidate18 No exploit published305 Outside Waratek scope300 Not applicable4,538 Withdrawn CVE137 Critical23 High1,735 Medium2,914 Low515 Unknown137 blocked by ARMR today26 not blocked5,297 not established1 Exploited97 Working exploit published520 Proof of concept only3 Forecast only21 No public exploit4,683 20148,008 Protected by Waratek41 Mitigation candidate12 No exploit published282 Outside Waratek scope253 Not applicable7,340 Withdrawn CVE80 Critical20 High1,938 Medium5,314 Low656 Unknown80 blocked by ARMR today41 not blocked7,967 Exploited97 Working exploit published795 Proof of concept only13 Forecast only16 No public exploit7,087 20156,595 Protected by Waratek32 Mitigation candidate6 No exploit published285 Outside Waratek scope202 Not applicable5,969 Withdrawn CVE101 Critical51 High2,354 Medium3,501 Low588 Unknown101 blocked by ARMR today32 not blocked6,563 Exploited95 Working exploit published647 Proof of concept only16 Forecast only19 No public exploit5,818 20166,517 Protected by Waratek58 Mitigation candidate12 No exploit published465 Outside Waratek scope129 Not applicable5,785 Withdrawn CVE68 Critical887 High2,895 Medium2,446 Low221 Unknown68 blocked by ARMR today57 partly blocked1 not blocked6,458 not established1 Exploited103 Working exploit published429 Proof of concept only27 Forecast only32 No public exploit5,926 201718,113 Protected by Waratek104 Mitigation candidate14 No exploit published682 Outside Waratek scope245 Not applicable13,597 Withdrawn CVE3,471 Critical2,113 High6,608 Medium5,687 Low234 Unknown3,471 blocked by ARMR today102 partly blocked2 not blocked18,009 Exploited211 Working exploit published1,260 Proof of concept only52 Forecast only23 No public exploit16,567 201818,154 Protected by Waratek176 Mitigation candidate16 No exploit published697 Outside Waratek scope338 Not applicable15,283 Withdrawn CVE1,644 Critical2,616 High7,571 Medium6,163 Low160 Unknown1,644 blocked by ARMR today175 partly blocked1 not blocked17,978 Exploited236 Working exploit published1,069 Proof of concept only87 Forecast only33 No public exploit16,729 201918,938 Protected by Waratek122 Rule in development1 Mitigation candidate24 No exploit published756 Outside Waratek scope514 Not applicable15,888 Withdrawn CVE1,633 Critical2,657 High7,227 Medium7,117 Low304 Unknown1,633 blocked by ARMR today120 partly blocked2 not blocked18,815 not established1 Exploited327 Working exploit published784 Proof of concept only126 Forecast only52 No public exploit17,649 202019,222 Protected by Waratek154 Mitigation candidate34 No exploit published898 Outside Waratek scope503 Not applicable16,733 Withdrawn CVE900 Critical2,780 High7,782 Medium7,359 Low401 Unknown900 blocked by ARMR today154 not blocked19,068 Exploited342 Working exploit published604 Proof of concept only156 Forecast only66 No public exploit18,054 202121,950 Protected by Waratek124 Rule in development1 Mitigation candidate24 No exploit published649 Outside Waratek scope491 Not applicable18,860 Withdrawn CVE1,801 Critical2,850 High8,770 Medium8,137 Low392 Unknown1,801 blocked by ARMR today124 not blocked21,826 Exploited489 Working exploit published446 Proof of concept only217 Forecast only167 No public exploit20,631 202226,431 Protected by Waratek213 Rule in development1 Mitigation candidate21 No exploit published895 Outside Waratek scope401 Not applicable23,542 Withdrawn CVE1,358 Critical4,441 High10,337 Medium9,908 Low385 Unknown1,360 blocked by ARMR today213 not blocked26,218 Exploited478 Working exploit published566 Proof of concept only2,768 Forecast only97 No public exploit22,522 202330,949 Protected by Waratek161 Mitigation candidate40 No exploit published876 Outside Waratek scope263 Not applicable27,476 Withdrawn CVE2,133 Critical5,031 High11,637 Medium11,824 Low323 Unknown2,134 blocked by ARMR today161 not blocked30,786 not established2 Exploited565 Working exploit published557 Proof of concept only5,593 Forecast only114 No public exploit24,120 202440,704 Protected by Waratek106 Mitigation candidate29 No exploit published617 Outside Waratek scope237 Not applicable38,964 Withdrawn CVE751 Critical4,874 High15,332 Medium18,998 Low740 None1 Unknown759 blocked by ARMR today105 partly blocked1 not blocked40,598 Exploited741 Working exploit published405 Proof of concept only7,469 Forecast only85 No public exploit32,004 202549,972 Protected by Waratek103 Rule in development4 Mitigation candidate25 No exploit published723 Outside Waratek scope151 Not applicable47,144 Withdrawn CVE1,822 Critical4,490 High16,670 Medium23,043 Low3,040 None10 Unknown2,719 blocked by ARMR today103 not blocked49,867 not established2 Exploited724 Working exploit published593 Proof of concept only10,991 Forecast only17 No public exploit37,647 2026100,326 Protected by Waratek321 Mitigation candidate27 No exploit published5,426 Outside Waratek scope177 Not applicable91,605 Withdrawn CVE2,770 Critical10,944 High40,724 Medium36,073 Low6,457 None68 Unknown6,060 blocked by ARMR today321 not blocked100,003 not established2 Exploited925 Working exploit published454 Proof of concept only19,257 Forecast only5 No public exploit79,685
1990199419982002200620102014201820222026
425,603 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed. ‹ prev page 1 of 4,257 next ›
CVE Severity Published▾ Status Exploitation Description
CVE-2026-97361 High 2026-11-13 Not applicable No public exploit There exists an improper privilege management vulnerability that could cause privilege escalation at the SpaceCom and Space Battery pack SP with WiFi.
CVE-2026-97358 High 2026-11-13 Not applicable No public exploit An inclusion of web functionality from an untrusted source could allow remote code execution on SpaceCom
CVE-2026-97357 Medium 2026-11-13 Not applicable No public exploit An Out-Of-Bounds Write due to missing input validation is possible in the autoprogramming interface of SpaceCom and Space Battery pack with WiFi which could lead to a denial of service of the affected communication device.
CVE-2026-95615 High 2026-11-13 Not applicable No public exploit OS command injection vulnerability in audio messages API in Zenitel Connect before 1.11.0 allows remote authenticated users to execute arbitrary OS commands as root in the hiatus application container via filename parameter to the /api/system/audio_messages endpoint.
CVE-2026-95614 Critical 2026-11-13 Not applicable No public exploit The host configuration watcher in Zenitel Connect before 1.11.0 applies a rsyslog configuration file written to a data volume that is shared with the hiatus application container, which allows local attackers with write access to the hiatus container filesystem to execute arbitrary OS commands as root on the host operating system via a crafted rsyslog configuration file.
CVE-2026-95613 High 2026-11-13 Not applicable No public exploit The pREST database REST API in Zenitel Connect firmware before 1.11.0 signs and verifies JWTs with the platform CA private key, which is stored on a data volume shared between containers, and sets the PostgreSQL session role from the unvalidated sub claim of each request while connected to the database as the "postgres" superuser, which allows local attackers who can read the platform CA private key from the container filesystem to execute database operations as the PostgreSQL superuser, including reading the master encryption key and password hashes, via a forged JWT with sub=postgres sent to the pREST API.
CVE-2026-95518 High 2026-11-13 Not applicable No public exploit Time-of-check time-of-use (TOCTOU) race condition vulnerability in TÜBİTAK BİLGEM Yazılım Teknolojileri Araştırma Enstitüsü Pardus Package Installer allows Leveraging Time-of-Check and Time-of-Use (TOCTOU) Race Conditions. This issue affects Pardus Package Installer: from 0.7.0 before 0.7.1.
CVE-2026-95379 High 2026-11-13 Not applicable No public exploit Path traversal in the certificate.deleteCertificate JSON-RPC method (POST /api/rpc) of the turbineweb web interface in Zenitel VSFF6, VSFF8, VSFF8MP, VSFF8MN, and VSFT devices with software versions from 10.0.3.0 before 10.1.3.0 allows authenticated administrators to delete arbitrary files as root via a relative path (../) in the file_name parameter. This can be used to cause denial of service or render the device inoperable by removing critical system files, and to weaken device security by removing files such as firewall rules or certificate trust stores.
CVE-2026-95378 High 2026-11-13 Not applicable No public exploit Path traversal in the certificate upload endpoint (/api/certificate/upload) of the turbineweb web interface in Zenitel VSFF6, VSFF8, VSFF8MP, VSFF8MN, and VSFT devices with software versions from 10.0.3.0 before 10.1.3.0 allows authenticated administrators to write arbitrary files as root via a crafted filename parameter in a multipart upload request when the type field is set to any value other than https_certificate. In that case, both path validation and certificate content validation are skipped. This can be escalated to arbitrary code execution as root, for example by overwriting startup scripts or planting SSH keys.
CVE-2026-95377 Critical 2026-11-13 Not applicable No public exploit OS command injection in the TFTP provisioning module of Zenitel EdgeAudioClient before 9.6.3.0, and 10.x before 10.1.3.0, on VSFF6, VSFF8, VSFF8MP, VSFF8MN, and VSFT devices allows unauthenticated adjacent attackers to execute arbitrary commands as root via a crafted DHCP option 66 (TFTP Server Name) value supplied by a rogue DHCP server on the same network segment. The DHCP-supplied value is passed to a shell without sanitization. Devices using DHCP, the default configuration, are affected on every boot and lease renewal. The same injection is also reachable via the config_update_tftp_server and sw_update_tftp_server configuration fields by an attacker able to modify the device configuration.
CVE-2026-93335 Medium 2026-11-13 Not applicable No public exploit Vault Community Edition and Vault Enterprise did not consistently apply explicit ACL policy deny rules to request paths that differ only by a trailing slash. This may allow an authenticated user who holds a broader delete permission on system configuration paths to disable a secrets engine, auth method, or audit device that a more specific deny rule was intended to protect. This vulnerability (CVE-2026-93335) is fixed in Vault Community Edition 2.2.2 and Vault Enterprise 2.2.2, 1.21.14, and 1.19.25.
CVE-2026-93333 Low 2026-11-13 Not applicable No public exploit Vault's audit devices did not validate the contents of a configured audit log prefix and did not consistently enforce the server-level setting that restricts audit log prefixing. This may allow a privileged operator to inject content into audit logs, potentially leading to forged or misleading audit records. This vulnerability (CVE-2026-93333) is fixed in Vault Community Edition 2.2.2 and Vault Enterprise 2.2.2, 1.21.14, and 1.19.25.
CVE-2026-92735 Medium 2026-11-13 Not applicable No public exploit HashiCorp Vault and Vault Enterprise are vulnerable to an issue in the integrated storage join process that may allow an unauthenticated attacker with network access to a new, uninitialized node to cause that node to send credentials from its server environment to an attacker-controlled server. This vulnerability (CVE-2026-92735) is fixed in Vault Community Edition 2.2.2 and Vault Enterprise 2.2.2, 1.21.14, and 1.19.25.
CVE-2026-92241 Medium 2026-11-13 Not applicable No public exploit The AVRCP browsing channel's L2CAP receive-buffer callback, browsing_avrcp_l2cap_alloc_buf() in subsys/bluetooth/host/classic/avrcp.c, allocated from the shared avctp_browsing_rx_pool with K_FOREVER. L2CAP invokes that callback from the Bluetooth RX work queue thread (bt_workq, "BT RX WQ"), both for the head buffer of a new SDU and — through l2cap_br_alloc_frag() and net_buf_append_bytes() — for every further fragment of a reassembled SDU. That same thread is the only context that ever releases these buffers, after bt_l2cap_br_recv_seg() delivers a completed SDU and calls net_buf_unref(), so a wait taken there can never be satisfied. The pool holds CONFIG_BT_MAX_CONN + 1 buffers of CONFIG_BT_AVRCP_BROWSING_L2CAP_MTU bytes (two buffers of 339 bytes in the default configuration). A connected browsing peer can drain it because bt_l2cap_br_recv_seg() in subsys/bluetooth/host/classic/l2cap_br.c accepts the SDU length declared in an SAR_START segment without bounding it by br_chan->rx.mtu: a peer that announces a large SDU and then streams continuation segments forces one pool buffer per segment-worth of data. Once the pool is empty the next allocation blocks forever inside the callback. Triggering the flaw requires a build with CONFIG_BT_CLASSIC and the experimental CONFIG_BT_AVRCP_BROWSING option, an application that registers AVRCP callbacks, and a BR/EDR peer that has established the AVRCP control channel and then the browsing channel, which requires an encrypted (paired) link. No malformed packet is needed — a few hundred bytes of ordinary segmented L2CAP traffic suffice. The consequence is a permanent hang of the whole Bluetooth host, not just of AVRCP: the blocked thread drains bt_dev.rx_queue for all HCI ACL data and low-priority events and also runs the host's internal work items, so all connections stop being serviced and the state is unrecoverable without a reboot. There is no memory-corruption or information-disclosure component. The fix allocates with K_NO_WAIT, so an empty pool now yields a local-busy indication or a channel disconnect that the application can recover from.
CVE-2026-91094 Unknown 2026-11-13 Not applicable No public exploit A directory traversal bug was discovered when unpacking 3.0 (quilt) source packages, where the packaging tarball could contain the quilt database directory (.pc) with attacker controlled symlinks, where that in combination with patches that would fail to apply, could be used to make the code used to restore the backup files to either modify or remove the files pointed to by the attacker controlled symlinks.
CVE-2026-86356 High 2026-11-13 Not applicable No public exploit Dell PowerStore contains an authorization-bypass vulnerability that could lead to elevation of privilege to administrator.
CVE-2026-86355 High 2026-11-13 Not applicable No public exploit Dell PowerStore contains an External Control of File Name or Path vulnerability. A remote authenticated attacker could exploit this vulnerability, potentially leading to privilege escalation on the appliance.
CVE-2026-86353 Medium 2026-11-13 Not applicable No public exploit Dell PowerStore contains a use of a weak cryptographic algorithm vulnerability that could allow an attacker with existing privileged access to the appliance to recover stored credentials.
CVE-2026-82414 High 2026-11-13 Not applicable No public exploit BACnet Stack is a BACnet open source protocol stack C library for embedded systems. From versions 1.4.0 to before 1.4.6, 1.5.0 to before 1.5.1, and 1.6.0 to before 1.6.1, the BACnet MS/TP receive path decodes COBS frames into an output pointer inside the same fixed input buffer, but passes the full input-buffer size as the decode capacity. A long valid COBS payload can therefore write past the end of the actual remaining buffer. This issue has been patched in versions 1.4.6, 1.5.1, 1.6.1, and 1.7.0.
CVE-2026-82179 Medium 2026-11-13 Not applicable No public exploit Dell PowerStore contains an authorization bypass vulnerability. An authenticated administrator could exploit this vulnerability to bypass multi-approver controls on critical operations.
CVE-2026-82177 High 2026-11-13 Not applicable No public exploit Dell PowerStore contains an OS Command Injection vulnerability. A high-privileged attacker could exploit this vulnerability, potentially leading to arbitrary root command execution on the appliance.
CVE-2026-82175 Low 2026-11-13 Not applicable No public exploit Dell PowerStore contains a Server-Side Request Forgery (SSRF) vulnerability. A high-privileged attacker could exploit this vulnerability to reach internal network services from the appliance.
CVE-2026-82174 Medium 2026-11-13 Not applicable No public exploit Dell PowerStore contains a content-injection vulnerability. An unauthenticated attacker could exploit this vulnerability to display misleading text on the genuine login page for phishing.
CVE-2026-77706 Medium 2026-11-13 Not applicable No public exploit Improper handling of highly compressed data (data amplification) vulnerability in Fileorbis Bilişim Hizmetleri Ticaret Anonim Şirketi FileOrbis NextGen FileServer allows Sustained Client Engagement. This issue affects FileOrbis NextGen FileServer: before 12.7.
CVE-2026-75578 High 2026-11-13 Not applicable No public exploit Cudy TR3000 before 2.5.42 contains a command injection vulnerability in luci/model/cbi/vpn/openvpn/client.lua, which embeds the shellquote()-quoted remote host token of an uploaded OpenVPN configuration inside an already single-quoted sed program run by os.execute(), so the nested quotes terminate the outer quote. Authenticated administrators can upload an .ovpn file whose remote host token contains a semicolon to execute arbitrary commands as root.
CVE-2026-75577 High 2026-11-13 Not applicable No public exploit Cudy TR3000 before 2.5.42 contains a command injection vulnerability that allows authenticated administrators to execute commands as root by storing a malicious WireGuard private key. Attackers can save a private_key containing $() shell substitution and call the vpn.export_conf method on the /cgi-bin/luci/rpc/app JSON-RPC endpoint, which passes the key to a wg pubkey shell command.
CVE-2026-75576 High 2026-11-13 Not applicable No public exploit Cudy TR3000 before 2.5.42 contains a command injection vulnerability that allows authenticated administrators to execute commands as root via an unvalidated multipart filename in the CBI FileUpload handler. Attackers can upload a valid OpenVPN configuration file through the VPN client config page with a filename containing $() shell substitution, which is passed through Lua %q to /bin/sh -c.
CVE-2026-75495 Critical 2026-11-13 Not applicable No public exploit Cudy TR3000 before 2.5.42 contains an OS command injection vulnerability that allows a malicious or compromised ACS to execute commands as root by supplying a crafted InternetGatewayDevice.User.{i}.Password value. Attackers can send a SetParameterValues request with shell metacharacters that obuspa_system.lua concatenates into a luci.util.exec() command string, gaining root command execution.
CVE-2026-75494 High 2026-11-13 Not applicable No public exploit Cudy TR3000 before 2.5.42 contains an argument injection vulnerability that allows a malicious or compromised ACS to inject curl options through unfiltered Username and Password values in the easycwmpd Upload handler. Attackers can embed whitespace to add options like -o and --url to the root-run curl command, writing attacker-controlled HTTP responses to arbitrary files on the device.
CVE-2026-75493 High 2026-11-13 Not applicable No public exploit Cudy TR3000 before 2.5.42 contains a stack buffer overflow vulnerability in an obuspa getter for the TR-098 WLANConfiguration KeyPassphrase parameter, which copies the stored value with strcpy() into a 4,096-byte stack buffer without a length check. A malicious or compromised ACS can set a 5,000-byte passphrase via SetParameterValues, and a later read of the parameter overflows the buffer and crashes obuspa, causing denial of service.
CVE-2026-75492 High 2026-11-13 Not applicable No public exploit Cudy TR3000 before 2.5.42 contains an unauthenticated stack buffer overflow vulnerability in the stun_client TR-111 UDP Connection Request parser that parses requests before verifying username or HMAC. Remote attackers can send a single crafted UDP datagram lacking a space in the request line, causing strncpy() to overflow a 10-byte stack buffer and crash stun_client for denial of service.
CVE-2026-75491 Critical 2026-11-13 Not applicable No public exploit Cudy TR3000 before 2.5.42 contains an authentication bypass vulnerability in the Mosquitto plugin auth_plugin_jwt.so that accepts unsigned JWTs using alg none. Attackers holding any Cudy-trusted client certificate can authenticate as admincudydevice on port 8883 and publish batchcmd requests to execute commands as root.
CVE-2026-75490 High 2026-11-13 Not applicable No public exploit Cudy TR3000 before 2.5.42 contains a remote code execution vulnerability that allows unauthenticated adjacent attackers to run root commands by advertising a rogue automesh controller over mDNS. Attackers on the upstream Ethernet segment can advertise _cudycmagent._tcp records pointing to a malicious MQTT broker, then send commands encrypted with a fixed AES key that router/batchcmd.lua executes as root.
CVE-2026-75489 Medium 2026-11-13 Not applicable No public exploit Cudy TR3000 before 2.5.42 contains an insufficient verification of data authenticity vulnerability in the mt_wifi Smart Mesh Technology (SMT) onboarding, which protects messages only with an AES-CBC key derived from public values and a CRC32 check. Adjacent unauthenticated attackers can forge SMT messages in Probe Request vendor IEs carrying an attacker-chosen SSID and pre-shared key, forcing unpaired devices to join attacker-controlled access points.
CVE-2026-75488 High 2026-11-13 Not applicable No public exploit Cudy TR3000 before 2.5.42 contains a stack buffer overflow vulnerability in the CWMP client that allows a malicious ACS to corrupt stack memory via oversized credentials. Attackers controlling the ACS can send Username and Password values up to 256 bytes in TR-069 Download or Upload requests, overflowing 128-byte stack buffers and crashing the CWMP process.
CVE-2026-75487 High 2026-11-13 Not applicable No public exploit Cudy TR3000 before 2.5.42 contains a command injection vulnerability that allows authenticated administrators to execute commands as root via the WireGuard server private_key option. Attackers can save a private key containing $() command substitution, which runs when action_wireguards_export() passes it to luci.sys.exec during configuration export.
CVE-2026-74911 Unknown 2026-11-13 Not applicable No public exploit Software installed and run as a non-privileged user may conduct improper GPU system calls to the execution of an error path that triggers an OOB read & write. An error can be triggered which causes the index of the array element to be cleaned up by the error path would be outside of the array bounds.
CVE-2026-63173 Medium 2026-11-13 Not applicable No public exploit Omnispace Agora Project through 26.10.0 contains a broken access control vulnerability in which the isAutor() function in MdlObject.php grants accessRight=3 based solely on object authorship without verifying the user still belongs to the object's space. Attackers who were previously members and authored objects can retain unauthorized read access to space objects even after being removed from the space, leading to persistent information disclosure.
CVE-2026-63170 Medium 2026-11-13 Not applicable No public exploit Omnispace Agora Project through 26.10.0 contains a predictable token generation vulnerability that allows unauthenticated attackers to forge the shared-calendar iCal share token by deriving md5Id() from predictable fields such as object creation time, which is self-disclosed through autorDate and the iCal CREATED field. Attackers can compute the creation minute and forge the md5Id token to access and read a shared calendar's iCal feed without authorization.
CVE-2026-63167 High 2026-11-13 Not applicable No public exploit Omnispace Agora Project through 26.10.0 contains a SQL injection vulnerability that allows authenticated general administrators to inject arbitrary SQL by setting the personsSort session value, which is concatenated unsanitized into ORDER BY clauses in MdlUser.php and MdlSpace.php. Attackers can submit an error-based extractvalue payload through personsSort to leak database information, such as the MariaDB version, via the user and space listing pages.
CVE-2026-63166 Medium 2026-11-13 Not applicable No public exploit Omnispace Agora Project through 26.10.0 contains a stored cross-site scripting vulnerability that allows attackers to inject malicious HTML markup by controlling imported directory data or an uploaded CSV file, as values are rendered into table cell text and value attributes after only Txt::utf8Encode() with no HTML escaping in VuePersonsImportExport.php. Attackers can craft a CSV cell containing an attribute-breakout payload that is rendered verbatim and executed in the browser of the administrator performing the import, leading to arbitrary script execution in the administrative context.
CVE-2026-63164 High 2026-11-13 Not applicable No public exploit Omnispace Agora Project through 26.10.0 contains an insecure direct object reference vulnerability that allows authenticated attackers to access another user's private mail by supplying a crafted reloadMailTypeId parameter to Ctrl::getCurObj() without a readRight() ownership check in CtrlMail.php. Attackers can manipulate the mail identifier value, such as reloadMailTypeId=mail-1, to retrieve the title and body of private messages belonging to other users, resulting in unauthorized disclosure of sensitive communications.
CVE-2026-63155 Medium 2026-11-13 Not applicable No public exploit Omnispace Agora Project through 26.10.0 contains an open redirect vulnerability that allows remote attackers to redirect users to arbitrary external URLs by manipulating the objUrl parameter in Ctrl.php's redir() function. Attackers can craft login links with objUrl set to a malicious site, causing the application to issue an HTTP 302 redirect to that external URL, which can be abused for phishing and credential theft.
CVE-2026-63151 High 2026-11-13 Not applicable No public exploit Omnispace Agora Project through 26.10.0 contains a predictable token generation vulnerability that allows unauthenticated attackers to access private calendar data by exploiting a missing dateCrea value that causes the md5Id token to collapse to md5(calendarId.userId), both small enumerable integers. Attackers can compute valid tokens and request the misc&action=DisplayIcal endpoint with a forged md5Id to read any user's private calendar events without authentication.
CVE-2026-63150 High 2026-11-13 Not applicable No public exploit Omnispace Agora Project through 26.10.0 contains a cross-site request forgery vulnerability that allows remote attackers to forge privileged actions such as administrator user creation by merging $_GET and $_POST parameters without requiring an anti-CSRF token. Attackers can craft a malicious link or auto-navigating page that issues a plain GET request, exploiting the lack of CSRF protection and SameSite=Lax cookie behavior on top-level navigations to create unauthorized administrator accounts.
CVE-2026-63079 Critical 2026-11-13 Not applicable No public exploit RBH Access Technologies Integra32 Security Management System 5.1.11 R5.0 contains an unauthenticated deserialization vulnerability in its deprecated .NET Remoting service, exposed on TCP port 2001 via the AxcvcLt.dll library using BinaryServerFormatterSinkProvider at TypeFilterLevel.Full without requiring authentication. A remote unauthenticated attacker can send a malicious serialized gadget payload (such as a ysoserial.net TypeConfuseDelegate chain) to the IntegraURI object endpoint, or exploit MarshalByRefObject/MarshalByValue unmarshalling for arbitrary file read/write and SMB/NTLMv2 credential coercion, to achieve remote code execution as NT AUTHORITY\SYSTEM and fully compromise the host.
CVE-2026-62977 Medium 2026-11-13 Not applicable No public exploit BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to version 1.5.1, the BACnet FILE object implementation allows remote WriteProperty(PROP_FILE_SIZE) requests to change the size of a stream-access FILE object without checking whether that FILE is marked Read_Only. When the FILE backend is RAMFS, enlarging the file only performs realloc() and updates the stored size; the newly exposed tail region is not initialized before later reads. As a result, a remote client can enlarge a read-only RAMFS-backed stream-access FILE and then immediately retrieve the newly exposed region with AtomicReadFile(stream-access). Depending on the allocator and build configuration, the returned data may contain sanitizer fill bytes, stale heap contents, or other unintended process memory. Shrinking the file through the same path can also remotely truncate content that was intended to be read-only. This issue has been patched in versions 1.5.1 and 1.6.0.
CVE-2026-62976 High 2026-11-13 Not applicable No public exploit BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to version 1.5.1, the RAMFS-backed FILE object implementation stores appended records as NUL-terminated strings, but its record-counting logic later walks the buffer as if an additional terminating empty record were present. As a result, two consecutive AtomicWriteFile(record-access) append requests can cause record_count() to call bacnet_strnlen() on a pointer that is already one byte past the end of the heap allocation. This issue has been patched in versions 1.5.1 and 1.6.0.
CVE-2026-62975 Medium 2026-11-13 Not applicable No public exploit BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to version 1.5.1, the RAMFS-backed FILE implementation accepts AtomicWriteFile(record-access) requests that replace existing records with caller-controlled content. If a client replaces a record with shorter data, the backend can shrink the heap allocation and then continue processing with a trailing-copy length derived from the old layout. During that replace path, the RAMFS backend computes the trailing-copy length from the old file layout, then shrinks the heap allocation, and finally uses the stale length in memmove(). As a result, the source range of that memmove() can extend beyond the end of the reallocated heap buffer, producing a heap out-of-bounds read. This issue has been patched in versions 1.5.1 and 1.6.0.
CVE-2026-62974 High 2026-11-13 Not applicable No public exploit BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to versions 1.4.5, 1.5.1, and 1.6.0, a malformed but non-empty BACnet WriteProperty request can drive the official server demo into a non-terminating request-processing loop with repeated heap-backed side effects. This results in a remote unauthenticated denial of service via uncontrolled resource consumption and a non-terminating request path. This issue has been patched in versions 1.4.5, 1.5.1, and 1.6.0.
CVE-2026-62973 High 2026-11-13 Not applicable No public exploit BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to versions 1.4.5, 1.5.1, and 1.6.0, a remote out-of-bounds read exists in the official BACnet client application apps/readpropm in bacnet-stack commit e2bdbf6. When readpropm sends a legitimate ReadPropertyMultiple request to a malicious BACnet/IP peer, the peer can reply with a malformed but structurally valid ReadPropertyMultiple-ACK that drives the client into a global-buffer-overflow read on the global receive buffer Rx_Buf. This issue has been patched in versions 1.4.5, 1.5.1, and 1.6.0.
CVE-2026-62972 Medium 2026-11-13 Not applicable No public exploit BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to versions 1.4.5, 1.5.1, and 1.6.0, lighting_command_decode in src/bacnet/lighting.c decodes its first field with the bounded apdu_size - apdu_len, but every nested decode in the operation switch is called with the original full apdu_size while the read pointer has been advanced to &apdu[apdu_len]. The leaf decoders bound their reads against the size they are told, so they read up to apdu_len bytes past the end of the caller's buffer, resulting in an out-of-bounds read. This issue has been patched in versions 1.4.5, 1.5.1, and 1.6.0.
CVE-2026-61418 High 2026-11-13 Not applicable No public exploit Dell SmartFabric OS10 Software, versions prior to 10.6.0.10, contains an Incorrect Authorization vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Command execution.
CVE-2026-61417 Medium 2026-11-13 Not applicable No public exploit Dell SmartFabric OS10 Software, versions prior to 10.6.0.10, contains an Improper Access Control vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Denial of service.
CVE-2026-59081 High 2026-11-13 Not applicable No public exploit Edito CMS deserializes JSON data without further validation. A user (even an administrator) cannot exploit this vulnerability through the application's normal functionality. An attacker who could modify cache entries or inject them could execute code on the server. This issue was fixed in version 5.10.2607.  Hotfixes for older versions (5.8) have also been released.
CVE-2026-59080 Low 2026-11-13 Not applicable No public exploit Edito CMS sends JWT token via GET requests. This allows a local attacker with access to browser history to obtain valid JWT token and perform action on behalf of the victim. The token is valid for only short period of time; after that time, it expires and can no longer be used. The vendor assessed the likelihood of exploitation as very low and determined that a fix is not necessary.
CVE-2026-59079 High 2026-11-13 Not applicable No public exploit Edito CMS restricts the ability to upload files via the UI to specific file types. However, an avatar upload functionality allows an attacker to upload files of any type and extension without restriction. This issue was fixed in version 5.10.2607.  Hotfixes for older versions (5.8) have also been released.
CVE-2026-59078 Medium 2026-11-13 Not applicable No public exploit Edito CMS is vulnerable to Stored XSS in avatar upload functionality. Authenticated attacker can inject arbitrary HTML and JS into website, which will be rendered/executed when visiting an URL leading to a edited avatar. This issue was fixed in version 5.10.2607.  Hotfixes for older versions (5.8) have also been released.
CVE-2026-59077 Medium 2026-11-13 Not applicable No public exploit Edito CMS is vulnerable to Stored XSS via content parameter in Tiny editor functionality. Authenticated attacker can inject arbitrary HTML and JS into website, which will be rendered/executed when user tries to edit changed entry. This issue was fixed in version 5.10.2607.  Hotfixes for older versions (5.8) have also been released.
CVE-2026-59076 Medium 2026-11-13 Not applicable No public exploit Edito CMS is vulnerable to Stored Cross-Site Scripting (XSS). Due to improper input validation, an authenticated attacker can inject malicious scripts into givenName and surname parameters via the /api/auth/profile endpoint. When an administrator visits the admin changelog logs, the injected script is automatically executed, in his browser. This issue was fixed in version 5.10.2607.  Hotfixes for older versions (5.8) have also been released.
CVE-2026-59075 High 2026-11-13 Not applicable No public exploit Edito CMS is vulnerable to Dynamic LINQ injection. Due to improper input validation, an authenticated attacker can inject conditional expressions into the sort parameter of paginated administrative endpoints. Analyzing the returned result order allows the attacker to extract value of any field character by character, leading to potential exposure of sensitive data. This issue was fixed in version 5.10.2607.  Hotfixes for older versions (5.8) have also been released.
CVE-2026-59074 High 2026-11-13 Not applicable No public exploit Edito CMS is vulnerable to improper cryptographic signature verification in the JWT refresh logic. An authenticated low-privilege user can submit self-crafted​ ​JWT​ containing​ ​an existing user​ ​identifier and, due to the lack of signature validation,​​  obtain​ ​a ​​valid,​​ fully-signed​​ session ​​token​​ for​​ any ​​account ​​in​ ​the​ ​system. This allows the attacker to impersonate any user, including administrators. This issue was fixed in version 5.10.2607.  Hotfixes for older versions (5.8) have also been released.
CVE-2026-58498 High 2026-11-13 Not applicable No public exploit BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to versions 1.4.5, 1.5.1, and 1.6.0, there is a remote global-buffer-overflow in the official router-ipv6 application shipped with bacnet-stack, this results in an out-of-bounds write to the global transmit buffer under ASan. This issue has been patched in versions 1.4.5, 1.5.1, and 1.6.0.
CVE-2026-58265 Medium 2026-11-13 Not applicable No public exploit BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to versions 1.4.5, 1.5.1, and 1.6.0, a BACnet/SC peer can trigger a heap out-of-bounds read (up to 3 bytes), pre-authentication, in the BACnet/SC header-option decoder. bvlc_sc_decode_proprietary_option() reads the vendor-id and option-type at fixed offsets [3],[4],[5] before checking the option's declared header length, and the option-list validator never enforces a minimum length for proprietary options. This issue has been patched in versions 1.4.5, 1.5.1, and 1.6.0.
CVE-2026-52790 High 2026-11-13 Not applicable No public exploit BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to versions 1.4.5, 1.5.1, and 1.6.0, there is a library-level memory safety issue that is reachable from an unmodified official sample server (apps/server-basic/main.c) over BACnet/IP resulting in a stack-use-after-return in writable Device string properties. This issue has been patched in versions 1.4.5, 1.5.1, and 1.6.0.
CVE-2026-52789 High 2026-11-13 Not applicable No public exploit BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to versions 1.4.5, 1.5.1, and 1.6.0, a Denial of Service (DoS) vulnerability exists in the BACnet stack's ReadPropertyMultiple (RPM) handler. When processing a malformed RPM request packet that lacks the expected closing tags, the function handler_read_property_multiple enters an infinite loop. This issue has been patched in versions 1.4.5, 1.5.1, and 1.6.0.
CVE-2026-52788 High 2026-11-13 Not applicable No public exploit BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to versions 1.4.5, 1.5.1, and 1.6.0, the bsc_node_parse_urls() function in src/bacnet/datalink/bsc/bsc-node.c contains three distinct bugs when parsing space-separated WebSocket URIs from a BACnet/SC Address Resolution ACK message. Two bugs cause out-of-bounds writes past the utf8_urls[10][129] array in the static BSC_ADDRESS_RESOLUTION structure. This issue has been patched in versions 1.4.5, 1.5.1, and 1.6.0.
CVE-2026-52787 High 2026-11-13 Not applicable No public exploit BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to versions 1.4.5, 1.5.1, and 1.6.0-rc2, a reachable out-of-bounds write exists when encoding the device.address-binding property. This issue has been patched in versions 1.4.5, 1.5.1, and 1.6.0-rc2.
CVE-2026-49990 High 2026-11-13 Not applicable No public exploit BACnet Stack is a BACnet open source protocol stack C library for embedded systems. From versions 1.4.2 to before 1.4.5, and 1.5.0 to before 1.5.1, a signed fileStartPosition taken from AtomicReadFile and AtomicWriteFile stream-access requests is not validated tightly enough before it reaches the RAM file backends. Practical impact includes: reliable denial of service via process crash, out-of-bounds read that may expose adjacent memory contents, or out-of-bounds write that may corrupt heap memory and destabilize the process. This issue has been patched in versions 1.4.5 and 1.5.1.
CVE-2026-49747 Unknown 2026-11-13 Not applicable No public exploit Software installed and run as a non-privileged user may conduct GPU system calls to trigger an integer overflow and allow OOB writes to GPU buffers. The integer overflow caused when mapping a GPU buffer >4GB causes corruption of array length, and can lead to kernel panics or out of bounds access.
CVE-2026-49341 High 2026-11-13 Not applicable No public exploit BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to version 1.5.1, there is a remotely reachable denial-of-service vulnerability in bacnet-stack affecting the default demo server built from the unmodified apps/server/main.c. This issue has been patched in version 1.5.1.
CVE-2026-16671 Low 2026-11-13 Not applicable No public exploit split_image_check() in boot/bootutil/src/loader.c declares a fixed uint8_t loader_hash[32] buffer and passes it as the out_hash out-parameter to bootutil_img_validate(). That routine copies IMAGE_HASH_SIZE bytes into out_hash (memcpy(out_hash, hash, IMAGE_HASH_SIZE) in boot/bootutil/src/image_validate.c), where IMAGE_HASH_SIZE is a compile-time constant of 64 for MCUBOOT_SHA512 or 48 for MCUBOOT_SIGN_EC384/SHA-384 (boot/bootutil/include/bootutil/crypto/sha.h). The buffer tracks SHA-256 (32 bytes) while the copy length tracks the configured algorithm, so the write overruns the buffer by 16 or 32 bytes. The overflow is only present in a non-default configuration: the legacy Mynewt split-image feature must be compiled (split_go()/split_image_check(), i.e. neither MCUBOOT_DIRECT_XIP nor MCUBOOT_RAM_LOAD), the digest must be larger than 32 bytes (MCUBOOT_SHA512 or MCUBOOT_SIGN_EC384), and MCUBOOT_SIGN_PURE must be off. split_go() is a public API with no caller inside MCUboot; it is invoked from a Mynewt application. In the default SHA-256 build there is no overflow. The over-written bytes are the one-way digest of the loader image and the overflow length is fixed at build time, so the contents are not meaningfully attacker-controlled and the size is not attacker-chosen. The realistic impact is bounded, uncontrolled corruption of the bootloader's stack on the split-boot path, manifesting as instability or failed boot in the affected configuration rather than reliable code execution. The fix is to size loader_hash to IMAGE_HASH_SIZE and pass IMAGE_HASH_SIZE as the matching seed length.
CVE-2026-16664 Medium 2026-11-13 Not applicable No public exploit MCUboot's Zephyr serial-recovery upload handler bs_upload() in boot/boot_serial/src/boot_serial.c decodes the host-supplied image field of an MCUmgr image-upload request into img_num (a full 32-bit value) and latches it on the off == 0 packet without any range check. It then passes img_num straight to flash_area_id_from_multi_image_slot(img_num, 0), which on the Zephyr port resolves to __flash_area_ids_for_slot() in boot/zephyr/include/sysflash/sysflash.h and indexes the static const int all_slots[] table as all_slots[img_num 2]. That table holds only MCUBOOT_IMAGE_NUMBER 2 entries, so any img_num >= MCUBOOT_IMAGE_NUMBER is an out-of-bounds read. The path is reachable by anyone with access to the serial / SMP recovery console, which is unauthenticated by design, and the bad value is supplied before any image signature is verified. The defect is specific to the default non-direct upload path (MCUBOOT_SERIAL_DIRECT_IMAGE_UPLOAD disabled) on the Zephyr port with the array-backed slot layout (not CONFIG_SINGLE_APPLICATION_SLOT). It is not gated on a multi-image configuration: MCUBOOT_IMAGE_NUMBER defaults to 1, so even a default single-image build is affected for any image >= 1. The MCUBOOT_SERIAL_DIRECT_IMAGE_UPLOAD path is safe (its flash_area_id_from_direct_image() switch returns -EINVAL for unknown indices). flash_area_id_from_multi_image_slot() takes a signed int image_index while img_num is uint32_t, so the attacker controls the sign of the index as well as its magnitude: an image of 0xFFFFFFFF converts to -1 and reads all_slots[-2], off the front of the table, while large positive values read off the end (CWE-192). Either way the index multiply img * 2 is performed in int, so a wild offset yields a bus/hard fault, giving a reliable denial of service of the bootloader during recovery. For moderately out-of-range indices the read returns adjacent .rodata as a garbage flash-area id that is handed to flash_area_open(); this normally fails with MGMT_ERR_EINVAL, but if the garbage id happens to match a valid non-image partition, the subsequent erase/write can target a partition outside the image set (CWE-787). The attacker-supplied value is never echoed back, so there is no information disclosure. The fix is to reject img_num >= BOOT_IMAGE_NUMBER on the off == 0 packet, before the slot lookup. The comparison must be made on the unsigned img_num: an equivalent guard applied after the conversion to int would not reject the negative case above. __flash_area_ids_for_slot() should bounds-check its own arguments as defence in depth. This vulnerability was reported independently twice: by NVIDIA Project Vanessa on 2026-06-22, and by Kai Phan (@kaimandalic) on 2026-07-19 as GHSA-8v33-88p6-jffj, which is closed as a duplicate of this advisory. Both original reports are reproduced in full below.
CVE-2026-16662 Low 2026-11-13 Not applicable No public exploit boot_save_boot_status() in boot/bootutil/src/boot_record.c reads the image's EXPECTED_HASH_TLV into a stack buffer image_hash[IMAGE_HASH_SIZE] that is never zero-initialised. The TLV handler validates only the upper bound (len > sizeof(image_hash)) and then reads exactly len bytes, so a TLV shorter than IMAGE_HASH_SIZE leaves the tail of image_hash holding stale stack content. The subsequent copy into the boot record, memcpy(buf + offset, image_hash, sizeof(image_hash)), uses the fixed buffer size rather than len, so up to IMAGE_HASH_SIZE - 1 bytes of uninitialised bootloader stack are written into the measured-boot record. The defect is reachable only under MCUBOOT_MEASURED_BOOT, and only when the image reaching boot_save_boot_status() was not hash-validated on that boot. bootutil_img_validate() rejects a hash TLV whose length is not exactly sizeof(hash) (boot/bootutil/src/image_validate.c:345), and primary-slot validation is on by default (Zephyr's CONFIG_BOOT_VALIDATE_SLOT0 defaults to y), so in a default build the malformed image never reaches this code. The direct-XIP and RAM-load strategies in boot/bootutil/src/loader.c validate the selected slot unconditionally and are not affected. The short TLV survives only where the integrator has turned primary-slot validation off: the swap and overwrite loader built without MCUBOOT_VALIDATE_PRIMARY_SLOT, which checks only the image magic before calling boot_add_shared_data(), and the Zephyr single-slot loader (boot/zephyr/single_loader.c) built without it, including the MCUBOOT_VALIDATE_PRIMARY_SLOT_ONCE variant, which skips validation once the trailer records an earlier successful one. It is also reachable through a time-of-check/time-of-use change to tamperable external flash between validation and the boot-record read. Placing the crafted image requires physical or flash-write access to the device; in a single-slot build with serial recovery enabled, the serial-recovery upload writes the primary slot directly and can place it as well. In these configurations the boot record's measurement is already not trustworthy: with validation off, the hash copied into the record is the image's own unverified EXPECTED_HASH_TLV, which the attacker chooses. The defect therefore does not weaken attestation integrity any further. What it adds is a path for bootloader memory to leave the device: up to 63 bytes (IMAGE_HASH_SIZE - 1) of uninitialised bootloader stack are embedded in the measurement field that a downstream attestation service sends to a remote verifier. In the configurations analysed the residue is bootloader internal state (TLV offsets and lengths, flash addresses, loop state), not key material, but what occupies that stack region depends on configuration and on which code ran before boot_save_boot_status(). It is reported as a low-severity, defense-in-depth disclosure with no integrity or availability impact. This is distinct from the already-fixed record_len integer underflow in the same routine (GHSA-8hrv-4cp5-4rg3). The fix rejects any EXPECTED_HASH_TLV whose length is not exactly IMAGE_HASH_SIZE.
CVE-2026-16659 Medium 2026-11-13 Not applicable No public exploit MCUboot's serial-recovery image-upload handler bs_upload() in boot/boot_serial/src/boot_serial.c declares const struct flash_area *fap = NULL and assigns it only via flash_area_open() part-way through the function. Two early validation failures (goto out_invalid_data) — a CBOR map that fails to decode, or an upload packet missing the off/data members — branch past the open while fap is still NULL, then fall into the shared epilogue. In MCUBOOT_ENC_IMAGES builds that epilogue unconditionally calls boot_handle_enc_fw(fap), which reaches boot_image_load_header() and flash_area_read() and dereferences the NULL flash_area. The defect is reachable pre-authentication: the trigger is the very first serial-recovery upload command carrying a malformed payload. The guarding conditions are default-true on a fresh recovery session — img_num, curr_off and img_size are zero-initialized statics, so curr_off == img_size and the primary-slot test both hold. It requires a non-default build: encrypted images (MCUBOOT_ENC_IMAGES / Zephyr CONFIG_BOOT_ENCRYPT_IMAGE) together with an active serial-recovery transport, on the Zephyr or Mynewt port (the two that build both boot/boot_serial/src/boot_serial.c and boot_serial_encryption.c with MCUBOOT_ENC_IMAGES). The impact is a transient denial of service of the bootloader during recovery. fap is a hard NULL rather than an attacker-controlled value, so there is no memory-corruption or information-leak primitive and image authentication is unaffected. Whether the dereference faults is platform-dependent — on targets where address 0x0 is mapped readable flash the read merely returns an error and execution continues, while targets that trap NULL (MPU / null-pointer-exception detection) take a hard fault. Because serial recovery is unauthenticated by design and already permits the console attacker to write the secondary slot, the added capability is only a low-value transient crash. The related unconditional flash_area_close(fap) call in the same epilogue is a safe no-op on the ports that reach it, so it does not contribute to the dereference. The affected ports are the Zephyr port — boot/zephyr/CMakeLists.txt compiles boot_serial.c under CONFIG_MCUBOOT_SERIAL and boot_serial_encryption.c under CONFIG_BOOT_ENCRYPT_IMAGE — and the Mynewt port, whose mcuboot_config.h defines MCUBOOT_SERIAL unconditionally and MCUBOOT_ENC_IMAGES under any BOOTUTIL_ENCRYPT_ syscfg, with boot/boot_serial/pkg.yml declaring no explicit source list so the whole directory is built. The Espressif port is not affected**: it compiles boot_serial.c but not boot_serial_encryption.c, and defines no MCUBOOT_ENC_IMAGES, so the #ifdef MCUBOOT_ENC_IMAGES block containing the call is preprocessed away. The NuttX, Cypress and Mbed ports do not build boot_serial.c at all.
CVE-2026-15465 Unknown 2026-11-13 Not applicable No public exploit Software installed and run as a non-privileged user may conduct improper GPU system calls through the DDK kernel module interface. Under unsupported use of the interface, a use-after-free condition may occur that can lead to kernel memory corruption, platform instability, or system reboot. The weakness occurs when software references memory after it has been released. Accessing memory after free may result in corruption of valid data structures, unexpected program behaviour, process crashes, or execution of unintended operations.
CVE-2026-129172 Medium 2026-11-13 Not applicable No public exploit EdgeEver 1.9.0 before 2.13.0 contains a stored cross-site scripting vulnerability in the backup restore endpoint PUT /api/v1/restores/json/resources/:id, which accepts a resource kind of image paired with a text/html MIME type without checking consistency. Authenticated members can share the note and send the public blob link to a victim, whose browser executes the script to mint a non-expiring API token granting read and write access to the victim's notes.
CVE-2026-129171 Critical 2026-11-13 Not applicable No public exploit NginxPulse 1.5.0 before 1.6.26 contains an unauthenticated sql injection vulnerability that allows remote attackers to append SQL via the id and locationType parameters of /api/stats/:type. Attackers can close the quoted table-name identifier and use error-based output to read database contents, and read or write server files via PostgreSQL superuser functions.
CVE-2026-129170 Medium 2026-11-13 Not applicable No public exploit FileCodeBox 2.2.1 through 2.8.4 contains a stored cross-site scripting vulnerability in renderMarkdownPreview, which returns unsanitized text when the marked parser throws. Unauthenticated attackers can share text with thousands of nested blockquote markers followed by HTML payloads, executing script that steals the admin token from localStorage.
CVE-2026-129169 Medium 2026-11-13 Not applicable No public exploit PMail 2.5.0 through 2.9.8 contains a stored cross-site scripting vulnerability that allows authenticated users to inject scripts by sending unsanitized HTML through /api/email/send. Attackers can embed event-handler payloads like img onerror that execute when administrators view the message, enabling privileged API calls such as password changes for account takeover.
CVE-2026-129168 Medium 2026-11-13 Not applicable No public exploit PMail 2.9.1 through 2.9.8 contains a stored cross-site scripting vulnerability because the /attachments/{id}/{cid} endpoint returns email attachments verbatim with the sender-supplied Content-Type after cid: references are rewritten into attachment links. Unauthenticated SMTP senders can email a text/html attachment and a page-covering cid link, so a recipient who clicks the message runs script in their webmail session to change passwords, including the administrator's.
CVE-2026-129167 Critical 2026-11-13 Not applicable No public exploit Seafile SeaDoc converter 2.0.4 before 2.0.11 and 3.0.0 before 3.0.8 contains an absolute path traversal vulnerability that allows unauthenticated attackers holding a public share token to execute code. Attackers supply an absolute filename to /api/v1/confluence-to-wiki/ to extract a ZIP from download_url into the Python library path, then trigger the module's import via a file-convert request.
CVE-2026-129166 High 2026-11-13 Not applicable No public exploit Keep 0.34.10 through 0.55.0 contains a blind SQL injection vulnerability in its CEL-to-SQL converter, which inserts bracket-indexed JSON keys from CEL filters unescaped into JSON path expressions for SQLite, PostgreSQL, and MySQL. Authenticated users with read:alert permission can submit crafted CEL expressions to /alerts/query or the cel parameter of /incidents, using result counts as a boolean oracle to extract other tenants' alerts and password hashes.
CVE-2026-129165 Critical 2026-11-13 Not applicable No public exploit Tactical RMM 0.17.0 through 1.6.1 contains an arbitrary file read in the /reporting/templates/preview/ endpoint because WeasyPrint resolves file:// links in user-supplied template_md and embeds the files in the returned PDF. Users with report management permission can read the Django SECRET_KEY, reused as the NATS password, and publish runscript commands to every managed agent.
CVE-2026-129164 High 2026-11-13 Not applicable No public exploit Dromara free-fs 2.0.1 through 2.3.1 contains an authorization bypass vulnerability that allows attackers to access code-protected shares because share codes are enforced only client-side. Attackers knowing a share ID can call the share items and download endpoints to list and download files without the code, even on preview-only shares.
CVE-2026-129163 Medium 2026-11-13 Not applicable No public exploit Dromara free-fs 2.0.1 through 2.3.1 contains a stored cross-site scripting vulnerability that allows registered users to run script by uploading HTML files served inline as text/html. Attackers can send a victim the /api/file/stream/preview/{fileId} link to execute script in the application origin, calling /apis endpoints to expose the victim's files and account.
CVE-2026-129162 High 2026-11-13 Not applicable No public exploit Dromara free-fs 2.0.1 through 2.3.1 contains a missing authentication vulnerability in FileStreamController.preview that allows unauthenticated attackers to download stored files. Attackers who obtain a file ID from share listings or preview links can request /api/file/stream/preview/{fileId} to download any user's or workspace's files.
CVE-2026-129161 Critical 2026-11-13 Not applicable No public exploit Dromara free-fs 2.0.1 through 2.3.1 contains an improper restriction of authentication attempts vulnerability that allows unauthenticated attackers to brute-force six-digit password reset codes via PUT /apis/user/forget-password. Attackers can request a code for a known email and submit unlimited guesses during its 300-second lifetime to set a chosen password and take over the account.
CVE-2026-129160 High 2026-11-13 Not applicable No public exploit free-fs 2.0.1 through 2.3.1 contains an SQL injection vulnerability in FileShareServiceImpl.getPages, which passes the orderBy parameter of the /apis/share/pages endpoint verbatim into the ORDER BY clause via MyBatis-Flex without a column whitelist. Authenticated users can supply CASE WHEN subquery expressions that use share ordering as a boolean oracle to read arbitrary database contents, such as share codes.
CVE-2026-129158 Medium 2026-11-13 Not applicable No public exploit ragent 1.1.0 contains a stored cross-site scripting vulnerability that allows authenticated users to inject scripts by uploading SVG knowledge-base documents served inline as image/svg+xml. Attackers can upload a script-bearing SVG via /knowledge-base/{kb-id}/docs/upload so that victims opening /knowledge-base/docs/{docId}/file execute it in the application origin, enabling account takeover.
CVE-2026-129157 Medium 2026-11-13 Not applicable No public exploit ragent 1.0.0 through 1.1.0 contains a missing authorization vulnerability in RagTraceController that allows any logged-in user to view all users' RAG traces. Attackers can page through /rag/traces/runs and related node endpoints to read other users' usernames, user ids, conversation ids, questions, and per-node execution details.
CVE-2026-129156 Medium 2026-11-13 Not applicable No public exploit DjangoBlog commit d186b1c through commit 6134ed6 contains a stored cross-site scripting vulnerability that allows authenticated OAuth users to inject script via an unescaped nickname in comment reactions. Attackers can set their OAuth display name to a payload closing the single-quoted data-reactions attribute, then react to a comment to execute script in article visitors' browsers.
CVE-2026-129155 Medium 2026-11-13 Not applicable No public exploit DjangoBlog 2.0.0.0 through 2.1.0.0 contains a stored cross-site scripting vulnerability because the class_filter comment sanitizer passes event-handler attributes on span, div, pre and code tags. Authenticated commenters can post a div with autofocus and onfocus attributes, executing script without interaction for every visitor, including administrators.
CVE-2026-129154 Medium 2026-11-13 Not applicable No public exploit SurveyKing 1.13.0 through 1.13.2 contains a stored cross-site scripting vulnerability because the server accepts a respondent-supplied survey snapshot and the frontend renders its titles via innerHTML. Anonymous respondents can submit a forged snapshot embedding event handlers such as img onerror that execute in an administrator's browser session when the response is viewed.
CVE-2026-129153 High 2026-11-13 Not applicable No public exploit SurveyKing 1.12.0 through 1.13.2 contains an authorization bypass in the linked survey feature that fails to verify the referenced linkSurveyId belongs to the caller's own project. Authenticated attackers can point a linked option at another user's survey so that loadLinkResult and updateLinkSurveyAnswer read, rewrite, or create responses in that survey.
CVE-2026-129152 Medium 2026-11-13 Not applicable No public exploit SurveyKing 1.12.0 through 1.13.2 contains an authentication bypass vulnerability that allows unauthenticated attackers to submit survey responses because AnswerServiceImpl.saveAnswer skips login-required and survey password checks. Attackers can submit responses to protected surveys and set createBy in the request body to impersonate other users, corrupting survey results.
CVE-2026-129151 High 2026-11-13 Not applicable No public exploit SurveyKing 1.13.2 contains a missing authorization vulnerability in result lookup: the anonymous survey view leaks the lookup configuration, including its password, and the lookup password check is skipped when no answer is sent. Unauthenticated attackers with a public survey link can inject a % wildcard into the MyBatis LIKE condition to match all responses, then call loadProject with an answerId to read complete responses including hidden fields.
CVE-2026-129144 Medium 2026-11-13 Not applicable No public exploit paicoding 1.0.3 contains a payment bypass vulnerability that allows authenticated attackers to unlock paid articles by guessing weak payment confirmation codes. Attackers can start a payment, enumerate roughly 2000 IdUtil.genPayCode counter values, and submit the matching verifyCode to the unauthenticated callback to mark it paid.
CVE-2026-129143 High 2026-11-13 Not applicable No public exploit paicoding 1.0.3 contains a missing authorization vulnerability in the ArticleRestController article detail endpoint that allows unauthenticated attackers to read restricted articles. Attackers can enumerate article IDs via GET /article/api/data/detail/{articleId} to retrieve full content of paid, login-only, member-only and draft articles.
CVE-2026-129142 Medium 2026-11-13 Not applicable No public exploit paicoding commit 766c48b through commit 903adce contains a stored cross-site scripting vulnerability in payment notifications, where NotifyMsgListener inserts the payer's display name unescaped and notify-system-item.html renders it via th:utext. Authenticated attackers can set a malicious display name and start a pending payment on a paid article, executing script in the author's browser when the author views notifications.
‹ prev page 1 of 4,257 next ›