🚨 CVE-2026-38708
TR1200 v2.4.15, TR3000 v2.4.21, WR300 v2.4.25, WR1200 v2.4.23, WR1300 v2.4.22, WR1500 v2.3.10, WR3000 v2.4.19, WR3600 v2.3.16, and WR6500 v2.3.15 were discovered to contain a command injection vulnerability in the system.setclock interface. This vulnerability allows attackers to execute arbitrary commands as root via a crafted input.
🎖@cveNotify
TR1200 v2.4.15, TR3000 v2.4.21, WR300 v2.4.25, WR1200 v2.4.23, WR1300 v2.4.22, WR1500 v2.3.10, WR3000 v2.4.19, WR3600 v2.3.16, and WR6500 v2.3.15 were discovered to contain a command injection vulnerability in the system.setclock interface. This vulnerability allows attackers to execute arbitrary commands as root via a crafted input.
🎖@cveNotify
Cudy
Cudy-SA-26-7-AIHGTK
A vulnerability allows command execution on the underlying system
🚨 CVE-2026-38713
TR1200 v2.4.15, TR3000 v2.4.21, WR300 v2.4.25, WR1200 v2.4.23, WR1300 v2.4.22, WR1500 v2.3.10, WR3000 v2.4.19, WR3600 v2.3.16, and WR6500 v2.3.15 were discovered to contain a command injection vulnerability in the ipsec_conn interface. This vulnerability allows attackers to execute arbitrary commands as root via a crafted input.
🎖@cveNotify
TR1200 v2.4.15, TR3000 v2.4.21, WR300 v2.4.25, WR1200 v2.4.23, WR1300 v2.4.22, WR1500 v2.3.10, WR3000 v2.4.19, WR3600 v2.3.16, and WR6500 v2.3.15 were discovered to contain a command injection vulnerability in the ipsec_conn interface. This vulnerability allows attackers to execute arbitrary commands as root via a crafted input.
🎖@cveNotify
Cudy
Cudy-SA-26-7-EHIXBE
A vulnerability allows command execution on the underlying system
🚨 CVE-2026-50986
PrestaShop module, totadministrativemandate <1.8.1 is vulnerable to Cross Site Request Forgery (CSRF). The payment validation controller has no CSRF token. An attacker can confirm an order in an awaiting status by hijacking a link.
🎖@cveNotify
PrestaShop module, totadministrativemandate <1.8.1 is vulnerable to Cross Site Request Forgery (CSRF). The payment validation controller has no CSRF token. An attacker can confirm an order in an awaiting status by hijacking a link.
🎖@cveNotify
Prestashop
Mandat administratif
La solution de paiement la plus adaptée pour les organismes administratifs. Ce module vous propose un moyen de paiement incontournable auprès des administrations et collectivités.
🚨 CVE-2026-51785
An issue in Hugo Leisink Hiawatha v.12.1 and before allows a remote attacker to execute arbitrary code via a crafted request
🎖@cveNotify
An issue in Hugo Leisink Hiawatha v.12.1 and before allows a remote attacker to execute arbitrary code via a crafted request
🎖@cveNotify
Fenrisk
HTTP Request Smuggling in Hiawatha - CVE-2026-51785
Security experts
🚨 CVE-2026-9335
A vulnerability in keras-team/keras versions <= 3.14.0 allows arbitrary local HDF5 file content disclosure due to improper handling of HDF5 ExternalLinks. The `KerasFileEditor` and `keras.saving.load_weights` functions bypass the `safe_get_h5_group` and `safe_get_h5_dataset` helpers, which are designed to reject ExternalLinks and SoftLinks. This results in automatic dereferencing of links to external HDF5 files, enabling attackers to disclose sensitive data from the victim's local filesystem. Specifically, `KerasFileEditor` extracts attributes and datasets from linked files into its internal structures, while `keras.saving.load_weights` loads weights from linked files into the user's model. This issue can be exploited by providing a malicious `.h5`, `.weights.h5`, or `.keras` file containing ExternalLinks.
🎖@cveNotify
A vulnerability in keras-team/keras versions <= 3.14.0 allows arbitrary local HDF5 file content disclosure due to improper handling of HDF5 ExternalLinks. The `KerasFileEditor` and `keras.saving.load_weights` functions bypass the `safe_get_h5_group` and `safe_get_h5_dataset` helpers, which are designed to reject ExternalLinks and SoftLinks. This results in automatic dereferencing of links to external HDF5 files, enabling attackers to disclose sensitive data from the victim's local filesystem. Specifically, `KerasFileEditor` extracts attributes and datasets from linked files into its internal structures, while `keras.saving.load_weights` loads weights from linked files into the user's model. This issue can be exploited by providing a malicious `.h5`, `.weights.h5`, or `.keras` file containing ExternalLinks.
🎖@cveNotify
GitHub
Fix: KerasFileEditor eject HDF5 ExternalLink/SoftLink groups (#22899) · keras-team/keras@23370f1
* KerasFileEditor: reject HDF5 ExternalLink/SoftLink groups
`_extract_weights_from_store` walked the HDF5 tree with raw subscripts
(`data[key]`, `value["vars"]`). When the input ...
`_extract_weights_from_store` walked the HDF5 tree with raw subscripts
(`data[key]`, `value["vars"]`). When the input ...
🚨 CVE-2026-12259
In nltk version 3.9.4, the `nltk.downloader.Downloader._download_package()` function writes downloaded package bytes to disk and may extract them before enforcing SHA-256 or MD5 checksum validation. This allows an attacker to tamper with the package response body for `info.url` through a compromised mirror, malicious proxy, or other source-substitution condition, leading to the installation of attacker-controlled package bytes. The vulnerability can result in malicious corpus or model content being trusted by downstream users or applications.
🎖@cveNotify
In nltk version 3.9.4, the `nltk.downloader.Downloader._download_package()` function writes downloaded package bytes to disk and may extract them before enforcing SHA-256 or MD5 checksum validation. This allows an attacker to tamper with the package response body for `info.url` through a compromised mirror, malicious proxy, or other source-substitution condition, leading to the installation of attacker-controlled package bytes. The vulnerability can result in malicious corpus or model content being trusted by downstream users or applications.
🎖@cveNotify
🚨 CVE-2026-38444
osTicket v1.18.3 is vulnerable to Stored Cross-Site Scripting (XSS) via the email From-header display name. The value is extracted without sanitization in include/class.mailparse.php and stored raw in the poster field of ost_thread_entry. When an unauthenticated attacker sends a reply email to an existing ticket from an unregistered address with an XSS payload in the From display name.
🎖@cveNotify
osTicket v1.18.3 is vulnerable to Stored Cross-Site Scripting (XSS) via the email From-header display name. The value is extracted without sanitization in include/class.mailparse.php and stored raw in the poster field of ost_thread_entry. When an unauthenticated attacker sends a reply email to an existing ticket from an unregistered address with an XSS payload in the From display name.
🎖@cveNotify
GitHub
cve-disclosures/osTicket/CVE-2026-38444.md at master · fr3akhacks/cve-disclosures
Security advisories / CVE references for osTicket 1.18.3 (CVE-2026-38444, 38446, 38447) - fr3akhacks/cve-disclosures
🚨 CVE-2026-38446
A stored cross-site scripting (XSS) vulnerability exists in osTicket 1.18.3 due to improper sanitization of the thread entry title field. User-controlled input in the title is stored without adequate HTML escaping and later rendered in multiple staff-facing templates without proper output encoding. An attacker can inject arbitrary JavaScript by submitting a crafted ticket reply or email with a malicious subject line.
🎖@cveNotify
A stored cross-site scripting (XSS) vulnerability exists in osTicket 1.18.3 due to improper sanitization of the thread entry title field. User-controlled input in the title is stored without adequate HTML escaping and later rendered in multiple staff-facing templates without proper output encoding. An attacker can inject arbitrary JavaScript by submitting a crafted ticket reply or email with a malicious subject line.
🎖@cveNotify
GitHub
cve-disclosures/osTicket/CVE-2026-38446.md at master · fr3akhacks/cve-disclosures
Security advisories / CVE references for osTicket 1.18.3 (CVE-2026-38444, 38446, 38447) - fr3akhacks/cve-disclosures
🚨 CVE-2026-38447
osTicket 1.18.3 generates API keys using a predictable construction based on MD5 hashing. The use of MD5, combined with predictable inputs such as the current timestamp and client IP address, significantly reduces entropy. An attacker can approximate the key generation time and brute-force the key space within a feasible time window.
🎖@cveNotify
osTicket 1.18.3 generates API keys using a predictable construction based on MD5 hashing. The use of MD5, combined with predictable inputs such as the current timestamp and client IP address, significantly reduces entropy. An attacker can approximate the key generation time and brute-force the key space within a feasible time window.
🎖@cveNotify
GitHub
cve-disclosures/osTicket/CVE-2026-38447.md at master · fr3akhacks/cve-disclosures
Security advisories / CVE references for osTicket 1.18.3 (CVE-2026-38444, 38446, 38447) - fr3akhacks/cve-disclosures
🚨 CVE-2026-52520
Emlog CMS <= 2.6.14 contains a stored cross-site scripting (XSS) vulnerability in the article publishing module (/admin/article.php). A remote authenticated attacker can inject arbitrary JavaScript code via the article content. When an administrator reviews or previews the submitted article in the backend, the malicious script executes in the admin's browser session, allowing the attacker to perform administrative actions such as creating a backdoor administrator account.
🎖@cveNotify
Emlog CMS <= 2.6.14 contains a stored cross-site scripting (XSS) vulnerability in the article publishing module (/admin/article.php). A remote authenticated attacker can inject arbitrary JavaScript code via the article content. When an administrator reviews or previews the submitted article in the backend, the malicious script executes in the admin's browser session, allowing the attacker to perform administrative actions such as creating a backdoor administrator account.
🎖@cveNotify
GitHub
GitHub - LING12138-sg/MyCVE-Report
Contribute to LING12138-sg/MyCVE-Report development by creating an account on GitHub.
🚨 CVE-2026-67972
An issue in the CF_CFDP_RecvMd() component of NASA cFS v7.0.1 allows attackers to contrl where received content and data is stored, possibly leading to an information disclosure.
🎖@cveNotify
An issue in the CF_CFDP_RecvMd() component of NASA cFS v7.0.1 allows attackers to contrl where received content and data is stored, possibly leading to an information disclosure.
🎖@cveNotify
GitHub
GitHub - nasa/cFS: The Core Flight System (cFS)
The Core Flight System (cFS). Contribute to nasa/cFS development by creating an account on GitHub.
🚨 CVE-2026-67976
The Ref::SignalGen component of fprime framework v4.2.2 does not validate the safety of user-controlled parameters, allowing attackers to cause a Denial of Service (DoS) via inputting unsafe parameters.
🎖@cveNotify
The Ref::SignalGen component of fprime framework v4.2.2 does not validate the safety of user-controlled parameters, allowing attackers to cause a Denial of Service (DoS) via inputting unsafe parameters.
🎖@cveNotify
GitHub
CVE-2026-67976:Ref::SignalGenRef::SignalGen /0 cause dos · Issue #2 · freedomfoxvare/cve
Summary Ref::SignalGen accepts externally commanded Frequency and SignalType values without any range validation. Once the component enters the running state, the scheduled execution path uses thos...
🚨 CVE-2026-67969
An issue in the HS_MonitorApplications() component of NASA cFS v7.0.1 allows attackers to force the processor to reset via supplying a crafted HS.AppMon_Tbl entry.
🎖@cveNotify
An issue in the HS_MonitorApplications() component of NASA cFS v7.0.1 allows attackers to force the processor to reset via supplying a crafted HS.AppMon_Tbl entry.
🎖@cveNotify
GitHub
GitHub - nasa/cFS: The Core Flight System (cFS)
The Core Flight System (cFS). Contribute to nasa/cFS development by creating an account on GitHub.
🚨 CVE-2026-67970
Incorrect access control in the DS_SetDestPathCmd() component of NASA cFS v7.0.1 allows attackers to access sensitive components via a path traversal.
🎖@cveNotify
Incorrect access control in the DS_SetDestPathCmd() component of NASA cFS v7.0.1 allows attackers to access sensitive components via a path traversal.
🎖@cveNotify
GitHub
[SECURITY] DS basename field allows path traversal without modifying pathname · Issue #1072 · nasa/cFS
Checklist (Please check before submitting) I reviewed the Contributing Guide. I performed a cursory search to see if the bug report is relevant, not redundant, nor in conflict with other tickets. D...
🚨 CVE-2026-67974
A parser boundary flaw in the Software Bus Network (SBN) application's peer subscription message handling in NASA cFS v7.0.1 allows attackers to cause a Denial of Service (DoS) via sending a crafted packet.
🎖@cveNotify
A parser boundary flaw in the Software Bus Network (SBN) application's peer subscription message handling in NASA cFS v7.0.1 allows attackers to cause a Denial of Service (DoS) via sending a crafted packet.
🎖@cveNotify
GitHub
GitHub - nasa/cFS: The Core Flight System (cFS)
The Core Flight System (cFS). Contribute to nasa/cFS development by creating an account on GitHub.
🚨 CVE-2026-67975
Incorrect access control in NASA cFS v7.0.1 allows attackers to arbitrarily remove low-index subscriptions and add new streams via sending TO_LAB add/remove subscription commands.
🎖@cveNotify
Incorrect access control in NASA cFS v7.0.1 allows attackers to arbitrarily remove low-index subscriptions and add new streams via sending TO_LAB add/remove subscription commands.
🎖@cveNotify
GitHub
GitHub - nasa/cFS: The Core Flight System (cFS)
The Core Flight System (cFS). Contribute to nasa/cFS development by creating an account on GitHub.
🚨 CVE-2026-67978
An issue in the SBN UDP interface of NASA cFS v7.0.1 allows attackers to cause a Denial of Service (DoS) via transmitting a crafted SBN frame.
🎖@cveNotify
An issue in the SBN UDP interface of NASA cFS v7.0.1 allows attackers to cause a Denial of Service (DoS) via transmitting a crafted SBN frame.
🎖@cveNotify
GitHub
[SECURITY] SBN UDP Information Disclosure via Truncated Frame Expansion in cFS · Issue #1058 · nasa/cFS
Checklist (Please check before submitting) [V] I reviewed the Contributing Guide. [V] I performed a cursory search to see if the bug report is relevant, not redundant, nor in conflict with other ti...
🚨 CVE-2026-18801
OpenMeter contains a stored, or second-order, SQL injection vulnerability in the handling of customer usage-attribution values.
An attacker who can create or update a customer can store a malicious value in the usageAttribution.key or usageAttribution.subjectKeys fields. When that customer is subsequently used in a meter or event query, OpenMeter inserts the stored value into a ClickHouse WITH map(...) expression using string concatenation.
OpenMeter versions from v1.0.0-beta.218 through v1.0.0-beta.231 are affected.
🎖@cveNotify
OpenMeter contains a stored, or second-order, SQL injection vulnerability in the handling of customer usage-attribution values.
An attacker who can create or update a customer can store a malicious value in the usageAttribution.key or usageAttribution.subjectKeys fields. When that customer is subsequently used in a meter or event query, OpenMeter inserts the stored value into a ClickHouse WITH map(...) expression using string concatenation.
OpenMeter versions from v1.0.0-beta.218 through v1.0.0-beta.231 are affected.
🎖@cveNotify
GitHub
SQL injection through customer usageAttribution subjectKeys (and key) into the shared ClickHouse meter/event query
### Summary
An authenticated tenant can inject arbitrary SQL into the shared ClickHouse meter/event queries through the `subjectKeys` (or `key`) values of a customer's `usageAttribution`. When...
An authenticated tenant can inject arbitrary SQL into the shared ClickHouse meter/event queries through the `subjectKeys` (or `key`) values of a customer's `usageAttribution`. When...
🚨 CVE-2026-67979
Incorrect access control in the Executive Services dynamic application start path component of NASA cFS v7.0.1 allows attackers to execute arbitrary code via placing a shared object on target storage.
🎖@cveNotify
Incorrect access control in the Executive Services dynamic application start path component of NASA cFS v7.0.1 allows attackers to execute arbitrary code via placing a shared object on target storage.
🎖@cveNotify
GitHub
[SECURITY] Arbitrary Module Execution via ES_StartApp Command and CFDP Ingress in cFS · Issue #1057 · nasa/cFS
Describe the bug I would like maintainer guidance on whether the following behavior is considered expected trusted-operator authority in cFS sample deployments. In my local reproduction, I was able...
🚨 CVE-2026-51144
Cross Site Scripting vulnerability in Soliton Systems MailZen Management Protal v.2.62, v.2.63 allows a remote attacker to execute arbitrary code via the Role Name, First Name, Last Name, and Username fields.
🎖@cveNotify
Cross Site Scripting vulnerability in Soliton Systems MailZen Management Protal v.2.62, v.2.63 allows a remote attacker to execute arbitrary code via the Role Name, First Name, Last Name, and Username fields.
🎖@cveNotify
GitHub
Vulnerability-Research/soliton-mailzen.md at main · FahadAljuaid/Vulnerability-Research
Contribute to FahadAljuaid/Vulnerability-Research development by creating an account on GitHub.
🚨 CVE-2026-67855
open62541 contains a heap use-after-free in the GDS PushManagement certificate update workflow when UA_ENABLE_GDS_PUSHMANAGEMENT is enabled. This allows a remote attacker to cause a denial of service.
🎖@cveNotify
open62541 contains a heap use-after-free in the GDS PushManagement certificate update workflow when UA_ENABLE_GDS_PUSHMANAGEMENT is enabled. This allows a remote attacker to cause a denial of service.
🎖@cveNotify
GitHub
GitHub - open62541/open62541: Open source implementation of OPC UA (OPC Unified Architecture) aka IEC 62541 licensed under Mozilla…
Open source implementation of OPC UA (OPC Unified Architecture) aka IEC 62541 licensed under Mozilla Public License v2.0 - open62541/open62541