🚨 CVE-2025-6508
The Swagger UI Try-out console within the API Publisher documentation allows an external Swagger API definition URL to be loaded, overriding the existing API definitions within the Publisher portal.
By exploiting this vulnerability, malicious actors can deceive users into interacting with these overwritten API definitions. This could lead to the exposure of sensitive information or the initiation of unintended requests to backend services.
🎖@cveNotify
The Swagger UI Try-out console within the API Publisher documentation allows an external Swagger API definition URL to be loaded, overriding the existing API definitions within the Publisher portal.
By exploiting this vulnerability, malicious actors can deceive users into interacting with these overwritten API definitions. This could lead to the exposure of sensitive information or the initiation of unintended requests to backend services.
🎖@cveNotify
Wso2
Security Advisory WSO2-2025-4306/CVE-2025-6508 - WSO2 Security and Compliance Documentation
WSO2 security advisories, CVE justifications, cloud security bulletins, secure coding and deployment guidelines, and how to report a vulnerability.
🚨 CVE-2026-3415
The XML and schema validation functionalities within the SchemaValidator Mediator process XML input as part of validation flows. Under certain conditions, the XML parser allows the resolution of external entities when handling user-supplied XML content during validation operations. This behavior can occur when an attacker supplies crafted XML payloads to the relevant mediator flows with sufficient privileges.
Successful exploitation may allow a highly privileged actor to read files accessible within the server hosting the affected product. Additionally, it may be possible to trigger outbound requests to unintended internal or external locations, depending on the server environment and network configuration. Specially crafted XML payloads can also lead to excessive resource consumption during parsing, impacting the availability of the product.
🎖@cveNotify
The XML and schema validation functionalities within the SchemaValidator Mediator process XML input as part of validation flows. Under certain conditions, the XML parser allows the resolution of external entities when handling user-supplied XML content during validation operations. This behavior can occur when an attacker supplies crafted XML payloads to the relevant mediator flows with sufficient privileges.
Successful exploitation may allow a highly privileged actor to read files accessible within the server hosting the affected product. Additionally, it may be possible to trigger outbound requests to unintended internal or external locations, depending on the server environment and network configuration. Specially crafted XML payloads can also lead to excessive resource consumption during parsing, impacting the availability of the product.
🎖@cveNotify
Wso2
Security Advisory WSO2-2026-5001/CVE-2026-3415 - WSO2 Security and Compliance Documentation
WSO2 security advisories, CVE justifications, cloud security bulletins, secure coding and deployment guidelines, and how to report a vulnerability.
🚨 CVE-2026-3418
The System REST API accepts user-supplied file uploads without enforcing sufficient validation on the file type or destination, allowing files to be written to arbitrary server-accessible locations. Exploitation requires authenticated administrative access with publisher privileges.
Successful exploitation permits an authenticated publisher to upload files to server-accessible locations. Depending on the deployment environment and how uploaded files are handled, this could lead to the execution of uploaded content, potentially resulting in remote code execution.
🎖@cveNotify
The System REST API accepts user-supplied file uploads without enforcing sufficient validation on the file type or destination, allowing files to be written to arbitrary server-accessible locations. Exploitation requires authenticated administrative access with publisher privileges.
Successful exploitation permits an authenticated publisher to upload files to server-accessible locations. Depending on the deployment environment and how uploaded files are handled, this could lead to the execution of uploaded content, potentially resulting in remote code execution.
🎖@cveNotify
Wso2
Security Advisory WSO2-2026-5146/CVE-2026-3418 - WSO2 Security and Compliance Documentation
WSO2 security advisories, CVE justifications, cloud security bulletins, secure coding and deployment guidelines, and how to report a vulnerability.
🚨 CVE-2026-11430
Grav CMS's scheduler-webhook plugin contains an authentication bypass in the webhook token check. When the webhook feature is enabled but no webhookToken is configured, a compound conditional short-circuits and skips token validation, so an unauthenticated remote attacker who can reach POST /scheduler/webhook can trigger the operator's already-configured scheduled jobs by sending a single request. The primitive is triggering-existing-jobs, not attacker-chosen command execution: the attacker controls when the jobs run and which one runs (via ?job=), but does not control what the jobs do. Code execution follows only when the operator has configured a job that shells out, and even then the attacker controls timing rather than payload. Not a default-install issue: reaching the endpoint requires the separate scheduler-webhook GPM plugin to be installed, scheduler.modern.webhook.enabled to be true (default false), and no webhookToken to be configured; a stock Grav or Grav-Admin install exposes nothing here.
🎖@cveNotify
Grav CMS's scheduler-webhook plugin contains an authentication bypass in the webhook token check. When the webhook feature is enabled but no webhookToken is configured, a compound conditional short-circuits and skips token validation, so an unauthenticated remote attacker who can reach POST /scheduler/webhook can trigger the operator's already-configured scheduled jobs by sending a single request. The primitive is triggering-existing-jobs, not attacker-chosen command execution: the attacker controls when the jobs run and which one runs (via ?job=), but does not control what the jobs do. Code execution follows only when the operator has configured a job that shells out, and even then the attacker controls timing rather than payload. Not a default-install issue: reaching the endpoint requires the separate scheduler-webhook GPM plugin to be installed, scheduler.modern.webhook.enabled to be true (default false), and no webhookToken to be configured; a stock Grav or Grav-Admin install exposes nothing here.
🎖@cveNotify
GitHub
GitHub - getgrav/grav: Modern, Crazy Fast, Ridiculously Easy and Amazingly Powerful Flat-File CMS powered by PHP, Markdown, Twig…
Modern, Crazy Fast, Ridiculously Easy and Amazingly Powerful Flat-File CMS powered by PHP, Markdown, Twig, and Symfony - getgrav/grav
🚨 CVE-2026-59090
A flaw was found in GIMP's PSD file format plugin. This vulnerability, an unsigned integer underflow in the `block_rem` variable, occurs when a user opens a specially crafted `.psd` image file. The underflow leads to parser confusion, enabling an attacker to inject arbitrary data as layer resource blocks. This can ultimately result in arbitrary code execution, allowing the attacker to run malicious code on the victim's system.
🎖@cveNotify
A flaw was found in GIMP's PSD file format plugin. This vulnerability, an unsigned integer underflow in the `block_rem` variable, occurs when a user opens a specially crafted `.psd` image file. The underflow leads to parser confusion, enabling an attacker to inject arbitrary data as layer resource blocks. This can ultimately result in arbitrary code execution, allowing the attacker to run malicious code on the victim's system.
🎖@cveNotify
🚨 CVE-2026-50770
An issue in Squirro Cognitive Search before v.3.14.2 allows a remote attacker to escalate privileges via a crafted request.
🎖@cveNotify
An issue in Squirro Cognitive Search before v.3.14.2 allows a remote attacker to escalate privileges via a crafted request.
🎖@cveNotify
Squirro Documentation
Squirro Search
Introduction: Accessing the correct information quickly is increasingly difficult in a world filled with siloed data. End users can’t search all of their connected data sources easily, and their se...
🚨 CVE-2026-50772
An issue in Squirro Cognitive Search < 3.14.2 allows a remote attacker to execute arbitrary code via a crafted payload to the password reset function.
🎖@cveNotify
An issue in Squirro Cognitive Search < 3.14.2 allows a remote attacker to execute arbitrary code via a crafted payload to the password reset function.
🎖@cveNotify
Squirro Documentation
Squirro Search
Introduction: Accessing the correct information quickly is increasingly difficult in a world filled with siloed data. End users can’t search all of their connected data sources easily, and their se...
🚨 CVE-2026-50773
An issue in CGM Germany - CompuGroup Medical CGM ISIS MED 2510.1.0.20 allows a remote attacker to execute arbtirary code via a crafted .dll file.
🎖@cveNotify
An issue in CGM Germany - CompuGroup Medical CGM ISIS MED 2510.1.0.20 allows a remote attacker to execute arbtirary code via a crafted .dll file.
🎖@cveNotify
GitHub
CVEs/CVE-2026-50773 at main · Henkel-CyberVM/CVEs
CVE reports created by Henkel AG & Co. KGaA's Cyber Defense team. - Henkel-CyberVM/CVEs
🚨 CVE-2026-67678
File Upload vulnerability in RainyGao-Hithub DocSys v.2.02.80 allows a remote attacker to execute arbitrary code
🎖@cveNotify
File Upload vulnerability in RainyGao-Hithub DocSys v.2.02.80 allows a remote attacker to execute arbitrary code
🎖@cveNotify
GitHub
[Security] DocSys V2.02.80 存在任意文件上传漏洞 · Issue #49 · RainyGao-GitHub/DocSys
漏洞版本 V2.02.80 漏洞描述 用户通过认证后，攻击者可以上传任意文件到服务器，导致服务器被用户接管。 漏洞证明 这个漏洞是后台的，而且需要是管理员权限，在/uploadDoc.do 接口中： 如果传递的 usage 不为空的话，就会判断当前的用户是否具备管理员的权限。后续就不会存在任何的文件校验，且文件名是用户自己可以控制的！ 这里我们要分析的是，能否无需管理员权限，或者无需登录就可...
🚨 CVE-2026-67925
Cross Site Scripting vulnerability in JeecgBoot v.3.9.2 allows a remote attacker to execute arbitrary code via the endpoint /airag/chat/upload
🎖@cveNotify
Cross Site Scripting vulnerability in JeecgBoot v.3.9.2 allows a remote attacker to execute arbitrary code via the endpoint /airag/chat/upload
🎖@cveNotify
GitHub
High Risk Stored XSS Vulnerability in JeecgBoot 3.9.2 · Issue #9773 · jeecgboot/JeecgBoot
版本号： JeecgBoot 3.9.2（26.x/ 4.6 系列） 分支： 问题描述： JeecgBoot 存在未授权文件上传引发的存储型 XSS 漏洞。匿名可直接调用免登上传接口/airag/chat/upload，后端文件校验允许 SVG、HTML 等支持 JS 脚本的文件格式，上传文件持久存储至服务器磁盘，框架静态资源路由将上传目录对外开放，任意用户均可直接访问上传文件。 攻击者上传...
🚨 CVE-2026-67926
An issue in JeecgBoot v.3.9.2 allows a remote attacker to execute arbitrary code via the files Parameter in JeecgBoot AI Chat Module
🎖@cveNotify
An issue in JeecgBoot v.3.9.2 allows a remote attacker to execute arbitrary code via the files Parameter in JeecgBoot AI Chat Module
🎖@cveNotify
GitHub
Unauthenticated SSRF Triggered by files Parameter in JeecgBoot AI Chat Module · Issue #9774 · jeecgboot/JeecgBoot
版本号： JeecgBoot v3.9.2 问题描述： JeecgBoot /airag/chat/send 接口存在 SSRF 漏洞，接口未对传入的files参数做内网 IP、本地地址访问限制，攻击者可构造恶意 URL 传入 files 数组，服务端会主动发起网络请求。利用该漏洞可扫描内网资产、访问内网服务、读取本地文件，无身份校验即可触发，危害内网安全。 The /airag/chat/...
🚨 CVE-2026-67965
An issue in Tneda W20E v.16.01.0.6(2782) allows a remote attacker to execute arbitrary code via the url_need_login function
🎖@cveNotify
An issue in Tneda W20E v.16.01.0.6(2782) allows a remote attacker to execute arbitrary code via the url_need_login function
🎖@cveNotify
GitHub
GitHub - H0111mes/Tenda-W20E-Vulnerability-Disclosure
Contribute to H0111mes/Tenda-W20E-Vulnerability-Disclosure development by creating an account on GitHub.
🚨 CVE-2026-42163
Mahara before 25.04.5 and 26.04.0 is vulnerable to unauthorized access to internal accounts via Learning Tools Interoperability (LTI) under certain circumstances. This applies to LTI 1.1 and LTI 1.3 Advantage.
🎖@cveNotify
Mahara before 25.04.5 and 26.04.0 is vulnerable to unauthorized access to internal accounts via Learning Tools Interoperability (LTI) under certain circumstances. This applies to LTI 1.1 and LTI 1.3 Advantage.
🎖@cveNotify
mahara.org
Security announcements - Security maintenance releases Mahara 25.04.7 and Mahara 26.04.1 - Mahara ePortfolio System
Mahara is an open source ePortfolio and social networking web application.
It provides people with tools to create and maintain a digital portfolio of their learning and social networking features to allow them to interact with each other.
It provides people with tools to create and maintain a digital portfolio of their learning and social networking features to allow them to interact with each other.
🚨 CVE-2026-51977
An issue in Trueview T18061 WiFi 3MP Robot Pan-Tilt Security Camera Version 1.0 allows a physically proximate attacker to escalate privileges via the RSA private key component
🎖@cveNotify
An issue in Trueview T18061 WiFi 3MP Robot Pan-Tilt Security Camera Version 1.0 allows a physically proximate attacker to escalate privileges via the RSA private key component
🎖@cveNotify
GitHub
CVE/CVE-2026-51977/README.md at main · EmbdCDACHyd/CVE
Research repository focused on security vulnerabilities (CVEs) in IoT devices, firmware, communication protocols, and embedded systems. - EmbdCDACHyd/CVE
🚨 CVE-2026-67854
SQL Injection vulnerability in Qcms v.6.0.6 allows a remote attacker to execute arbitrary code
🎖@cveNotify
SQL Injection vulnerability in Qcms v.6.0.6 allows a remote attacker to execute arbitrary code
🎖@cveNotify
JiuZero's Blog
QCMS tableField_Action Backend SQL Injection Vulnerability White-box Audit Report
This content is encrypted, please enter the password to view.
🚨 CVE-2026-67960
An issue in PbootCMS v.3.2.15 allows an attacker to execute arbitrary code via the MemberController.php, UserController.php, CommentController.php, ContentController.php, and helper.php components
🎖@cveNotify
An issue in PbootCMS v.3.2.15 allows an attacker to execute arbitrary code via the MemberController.php, UserController.php, CommentController.php, ContentController.php, and helper.php components
🎖@cveNotify
🚨 CVE-2026-42162
Mahara before 25.04.5 and 26.04.0 is vulnerable to artefacts being accessible to others under certain circumstances when the file path to an artefact in a page is manipulated.
🎖@cveNotify
Mahara before 25.04.5 and 26.04.0 is vulnerable to artefacts being accessible to others under certain circumstances when the file path to an artefact in a page is manipulated.
🎖@cveNotify
mahara.org
Home - Mahara ePortfolio System
Mahara is an open source ePortfolio and social networking web application.
It provides people with tools to create and maintain a digital portfolio of their learning and social networking features to allow them to interact with each other.
It provides people with tools to create and maintain a digital portfolio of their learning and social networking features to allow them to interact with each other.
🚨 CVE-2026-42164
Mahara before 25.04.5 and 26.04.0 is vulnerable in the Text block/section functionality when a call is crafted in a certain way that allows it to recall the backed-up content from another Text section.
🎖@cveNotify
Mahara before 25.04.5 and 26.04.0 is vulnerable in the Text block/section functionality when a call is crafted in a certain way that allows it to recall the backed-up content from another Text section.
🎖@cveNotify
mahara.org
Home - Mahara ePortfolio System
Mahara is an open source ePortfolio and social networking web application.
It provides people with tools to create and maintain a digital portfolio of their learning and social networking features to allow them to interact with each other.
It provides people with tools to create and maintain a digital portfolio of their learning and social networking features to allow them to interact with each other.
🚨 CVE-2026-52606
A reflected cross-site scripting (XSS) vulnerability in reportico-web <= 8.1.0 allows remote attackers to execute arbitrary JavaScript in the web browser of a user by including a malicious payload in the loadTemplate parameter in conjunction with the execute_mode=PREPARE parameter of run.php.
🎖@cveNotify
A reflected cross-site scripting (XSS) vulnerability in reportico-web <= 8.1.0 allows remote attackers to execute arbitrary JavaScript in the web browser of a user by including a malicious payload in the loadTemplate parameter in conjunction with the execute_mode=PREPARE parameter of run.php.
🎖@cveNotify
GitHub
vulnerability-research/CVE-2026-52606 at main · kilotel/vulnerability-research
This repository contains information on the CVEs I found. - kilotel/vulnerability-research
🚨 CVE-2026-52607
A directory traversal vulnerability in reportico-web <= 8.1.0 allows remote attackers to expose or execute arbitrary php files on the web server by specifying the filename in the target_format parameter in conjunction with the execute_mode=EXECUTE parameter of the run.php endpoint.
🎖@cveNotify
A directory traversal vulnerability in reportico-web <= 8.1.0 allows remote attackers to expose or execute arbitrary php files on the web server by specifying the filename in the target_format parameter in conjunction with the execute_mode=EXECUTE parameter of the run.php endpoint.
🎖@cveNotify
GitHub
vulnerability-research/CVE-2026-52607 at main · kilotel/vulnerability-research
This repository contains information on the CVEs I found. - kilotel/vulnerability-research
🚨 CVE-2026-52608
An incorrect access control vulnerability in reportico-web <= 8.1.0 allows an unauthenticated attacker to inject arbitrary php code into the PreExecuteCode attribute of any report regardless of the safe_mode setting leading to remote code execution.
🎖@cveNotify
An incorrect access control vulnerability in reportico-web <= 8.1.0 allows an unauthenticated attacker to inject arbitrary php code into the PreExecuteCode attribute of any report regardless of the safe_mode setting leading to remote code execution.
🎖@cveNotify
GitHub
vulnerability-research/CVE-2026-52608 at main · kilotel/vulnerability-research
This repository contains information on the CVEs I found. - kilotel/vulnerability-research