🚨 CVE-2026-52473
An issue in Wgcloud 3.6.4 allows a remote attacker to escalate privileges via the content parameter is directly concatenated to the ProcessBuilder.
🎖@cveNotify
An issue in Wgcloud 3.6.4 allows a remote attacker to escalate privileges via the content parameter is directly concatenated to the ProcessBuilder.
🎖@cveNotify
GitHub
CVE/Wgcloud/RCE.md at main · Y4y17/CVE
Contribute to Y4y17/CVE development by creating an account on GitHub.
🚨 CVE-2026-75411
JeecgBoot v3.9.2 is vulnerable to Remote command execution. The CodeNode component of the AI Flow module supports Groovy script execution. While the `SecurityCheck` class employs a blacklist mechanism to intercept dangerous calls, the dynamic nature of Groovy allows this blacklist to be completely bypassed through string concatenation and reflection.
🎖@cveNotify
JeecgBoot v3.9.2 is vulnerable to Remote command execution. The CodeNode component of the AI Flow module supports Groovy script execution. While the `SecurityCheck` class employs a blacklist mechanism to intercept dangerous calls, the dynamic nature of Groovy allows this blacklist to be completely bypassed through string concatenation and reflection.
🎖@cveNotify
GitHub
[SECURITY] JeecgBoot V3.9.2 airag:flow:add后台RCE · Issue #9691 · jeecgboot/JeecgBoot
版本号：V3.9.2 分支：main 问题描述： JeecgBoot AI Flow 模块的 CodeNode 节点支持 Groovy 脚本执行，SecurityCheck 类使用黑名单机制拦截危险调用（Runtime.getRuntime()、Class.forName、ProcessBuilder、exec( 等）。但 Groovy 动态语言特性允许通过字符串拼接+反射完整绕过黑名单：使...
🚨 CVE-2026-75329
The Netty configuration distribution service (port 8283) of super-diamond-server <= 1.3.3 has no authentication mechanism. Attackers can directly obtain the full configuration of any project (including database passwords, API keys, etc.) by sending a TCP request without any credential.
🎖@cveNotify
The Netty configuration distribution service (port 8283) of super-diamond-server <= 1.3.3 has no authentication mechanism. Attackers can directly obtain the full configuration of any project (including database passwords, API keys, etc.) by sending a TCP request without any credential.
🎖@cveNotify
GitHub
CVE/super-diamond/NETTY-NOAUTH.md at main · fangtang7/CVE
CVE. Contribute to fangtang7/CVE development by creating an account on GitHub.
🚨 CVE-2026-75331
tamguo 1.5.3 is vulnerable to Unrestricted File Upload Leading to Stored XSS. The /uploadFile and /imgUpload endpoints in FileUploadController.java and UEditorController.java have no file type validation. Attackers can upload arbitrary HTML/JavaScript files to the server.
🎖@cveNotify
tamguo 1.5.3 is vulnerable to Unrestricted File Upload Leading to Stored XSS. The /uploadFile and /imgUpload endpoints in FileUploadController.java and UEditorController.java have no file type validation. Attackers can upload arbitrary HTML/JavaScript files to the server.
🎖@cveNotify
GitHub
CVE/tamgou/xss.md at main · fangtang7/CVE
CVE. Contribute to fangtang7/CVE development by creating an account on GitHub.
🚨 CVE-2026-75333
yx-image-recognition v1.0 is vulnerable to Path Traversal. Parameters such as dir, filePath are directly passed to new File() for file system operations without any path sanitization or whitelist validation.
🎖@cveNotify
yx-image-recognition v1.0 is vulnerable to Path Traversal. Parameters such as dir, filePath are directly passed to new File() for file system operations without any path sanitization or whitelist validation.
🎖@cveNotify
GitHub
CVE/yx-image-recognition/PATH_TRAVERSAL_REPORT.md at main · fangtang7/CVE
CVE. Contribute to fangtang7/CVE development by creating an account on GitHub.
🚨 CVE-2026-75330
The front-end interface /superdiamond/preview/{projectCode}/{module}/{type} of super-diamond-server <= 1.3.3 is vulnerable to SQL injection. The module parameter is directly concatenated into the SQL IN clause through StringUtils.split() and string concatenation without being parameterized and bound.
🎖@cveNotify
The front-end interface /superdiamond/preview/{projectCode}/{module}/{type} of super-diamond-server <= 1.3.3 is vulnerable to SQL injection. The module parameter is directly concatenated into the SQL IN clause through StringUtils.split() and string concatenation without being parameterized and bound.
🎖@cveNotify
GitHub
CVE/super-diamond/SQLI-HTTP.md at main · fangtang7/CVE
CVE. Contribute to fangtang7/CVE development by creating an account on GitHub.
🚨 CVE-2026-75332
Zyplayer-Doc <=1.0.0 is vulnerable to Server-Side Request Forgery (SSRF) via WikiPageWebService.download().
🎖@cveNotify
Zyplayer-Doc <=1.0.0 is vulnerable to Server-Side Request Forgery (SSRF) via WikiPageWebService.download().
🎖@cveNotify
GitHub
CVE/Zyplayer-Doc/Zyplayer-Doc.md at main · fangtang7/CVE
CVE. Contribute to fangtang7/CVE development by creating an account on GitHub.
🚨 CVE-2026-75336
Funiture 1.0.0 is vulnerable to SQL Injection in the backend tool interfaces /sys/tool/select.json and /sys/tool/update.json.
🎖@cveNotify
Funiture 1.0.0 is vulnerable to SQL Injection in the backend tool interfaces /sys/tool/select.json and /sys/tool/update.json.
🎖@cveNotify
GitHub
CVE/funiture/SQL Injection.md at main · fangtang7/CVE
CVE. Contribute to fangtang7/CVE development by creating an account on GitHub.
🚨 CVE-2026-26452
ccoap 77f55c4b466e99327c24ace8a2913d3ba7e2ccd5 lcontains a vulnerability in the option parsing logic that causes a segmentation fault when processing COAP messages containing invalid option numbers.
🎖@cveNotify
ccoap 77f55c4b466e99327c24ace8a2913d3ba7e2ccd5 lcontains a vulnerability in the option parsing logic that causes a segmentation fault when processing COAP messages containing invalid option numbers.
🎖@cveNotify
GitHub
GitHub - ipflavors/ccoap: A CoAP library in C
A CoAP library in C. Contribute to ipflavors/ccoap development by creating an account on GitHub.
🚨 CVE-2026-26453
ccoap 77f55c4b466e99327c24ace8a2913d3ba7e2ccd5 contains a null pointer dereference vulnerability in the coap_server_handle_session() function when processing COAP messages containing URI_PATH options with NULL data pointers. When the server searches for a URI_PATH option matching the string "separate", it directly calls strncmp() on option_list[i].data without checking if the pointer is NULL. This causes a segmentation fault when the option's data field is NULL.
🎖@cveNotify
ccoap 77f55c4b466e99327c24ace8a2913d3ba7e2ccd5 contains a null pointer dereference vulnerability in the coap_server_handle_session() function when processing COAP messages containing URI_PATH options with NULL data pointers. When the server searches for a URI_PATH option matching the string "separate", it directly calls strncmp() on option_list[i].data without checking if the pointer is NULL. This causes a segmentation fault when the option's data field is NULL.
🎖@cveNotify
GitHub
GitHub - ipflavors/ccoap: A CoAP library in C
A CoAP library in C. Contribute to ipflavors/ccoap development by creating an account on GitHub.
🚨 CVE-2026-26459
ccoap 77f55c4b466e99327c24ace8a2913d3ba7e2ccd5 contains a vulnerability in the option parsing logic that causes a segmentation fault when processing malformed COAP messages with insufficient option data.
🎖@cveNotify
ccoap 77f55c4b466e99327c24ace8a2913d3ba7e2ccd5 contains a vulnerability in the option parsing logic that causes a segmentation fault when processing malformed COAP messages with insufficient option data.
🎖@cveNotify
GitHub
GitHub - ipflavors/ccoap: A CoAP library in C
A CoAP library in C. Contribute to ipflavors/ccoap development by creating an account on GitHub.
🚨 CVE-2026-26897
An issue in EcoOnline EHS (com.airsweb.v10) application for Android, version 0.2.499 allows a remote attacker to obtain sensitive information and execute arbitrary code via the AndroidManifest.xml component
🎖@cveNotify
An issue in EcoOnline EHS (com.airsweb.v10) application for Android, version 0.2.499 allows a remote attacker to obtain sensitive information and execute arbitrary code via the AndroidManifest.xml component
🎖@cveNotify
🚨 CVE-2026-26899
An issue was discovered in luci-app-https-dns-proxy on OpenWrt PR #15 (< 2026-01-17). The setInitAction function in /usr/libexec/rpcd/luci.https-dns-proxy allows authenticated users to execute arbitrary shell commands via shell metacharacters in the name parameter
🎖@cveNotify
An issue was discovered in luci-app-https-dns-proxy on OpenWrt PR #15 (< 2026-01-17). The setInitAction function in /usr/libexec/rpcd/luci.https-dns-proxy allows authenticated users to execute arbitrary shell commands via shell metacharacters in the name parameter
🎖@cveNotify
GitHub
GitHub - iwallplace/CVE-2026-46368-OpenWrt-Exploit: Proof of Concept exploit for CVE-2026-46368 — authenticated root command injection…
Proof of Concept exploit for CVE-2026-46368 — authenticated root command injection in OpenWrt luci-app-https-dns-proxy (EDB-52521) - iwallplace/CVE-2026-46368-OpenWrt-Exploit
🚨 CVE-2026-30046
A reachable assertion vulnerability in the NUDM-UECM interface of Open5GS v2.7.6 allows attackers to cause a Denial of Service (DoS) via supplying a crafted DELETE request.
🎖@cveNotify
A reachable assertion vulnerability in the NUDM-UECM interface of Open5GS v2.7.6 allows attackers to cause a Denial of Service (DoS) via supplying a crafted DELETE request.
🎖@cveNotify
GitHub
[Bug]: UDM crashes due to reachable assertion when DELETE request omits pduSessionId path parameter · Issue #4264 · open5gs/open5gs
Open5GS Release, Revision, or Tag v2.7.6 Steps to reproduce curl --http2-prior-knowledge -X DELETE -v http://127.0.to.12:7777/nudm-uecm/v1/imsi-001010000000001/registrations/smf-registrations/ Logs...
🚨 CVE-2026-30047
A reachable assertion vulnerability in the /nsmf-pdusession/v1/sm-contexts component of Open5GS v2.7.6 allows attackers to cause a Denial of Service (DoS) via supplying a crafted DELETE request.
🎖@cveNotify
A reachable assertion vulnerability in the /nsmf-pdusession/v1/sm-contexts component of Open5GS v2.7.6 allows attackers to cause a Denial of Service (DoS) via supplying a crafted DELETE request.
🎖@cveNotify
GitHub
[Bug]: smf Crashed due to Assertion `psi != OGS_NAS_PDU_SESSION_IDENTITY_UNASSIGNED' failed. · Issue #4201 · open5gs/open5gs
Open5GS Release, Revision, or Tag v2.7.6 Steps to reproduce curl -X POST --http2-prior-knowledge http://127.0.0.4:7777/nsmf-pdusession/v1/sm-contexts -H "Content-Type: application/json" -...
🚨 CVE-2026-30050
An issue in the ModifyAMFEventSubscriptionProcedure function (processor/event_exposure.go) of free5gc v4.1.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted PATCH request.
🎖@cveNotify
An issue in the ModifyAMFEventSubscriptionProcedure function (processor/event_exposure.go) of free5gc v4.1.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted PATCH request.
🎖@cveNotify
GitHub
[Bugs] AMF Event Exposure ModifyAMFEventSubscriptionProcedure Panics on Negative Path Index · Issue #776 · free5gc/free5gc
Bug Description A vulnerability exists in the ModifyAMFEventSubscriptionProcedure function within the AMF Event Exposure service (processor/event_exposure.go). When processing a PATCH request to mo...
🚨 CVE-2026-30056
A NULL pointer dereference in the AMF NGAP Dispatcher component of free5gc v4.0.1 allows attackers to cause a Denial of Service (DoS) via supplying crafted NGAP messages during the initialization of a new RAN connection.
🎖@cveNotify
A NULL pointer dereference in the AMF NGAP Dispatcher component of free5gc v4.0.1 allows attackers to cause a Denial of Service (DoS) via supplying crafted NGAP messages during the initialization of a new RAN connection.
🎖@cveNotify
GitHub
[Bugs] Nil Pointer Dereference in AMF NGAP Dispatcher when receive unexpected message sequence · Issue #768 · free5gc/free5gc
Bug Description The issue occurs because the dispatcher does not enforce the mandatory NGAP message sequence during the initialization of a new RAN connection. Instead of requiring the first messag...
🚨 CVE-2026-30057
An issue in the CreateUEContext handler component of free5gc v4.1.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted request.
🎖@cveNotify
An issue in the CreateUEContext handler component of free5gc v4.1.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted request.
🎖@cveNotify
GitHub
[Bugs] AMF CreateUEContext Panic on multipart/related Content-Type due to improper deserialization · Issue #755 · free5gc/free5gc
Bug Description The AMF’s CreateUEContext handler (HTTPCreateUEContext in internal/sbi/api_communication.go) mishandles requests with Content-Type: multipart/related. When such a request is process...
🚨 CVE-2026-30062
An issue in the NGAP handler of free5gc v4.0.1 allows attackers to cause a Denial of Service (DoS) via a crafted NAS PDU.
🎖@cveNotify
An issue in the NGAP handler of free5gc v4.0.1 allows attackers to cause a Denial of Service (DoS) via a crafted NAS PDU.
🎖@cveNotify
GitHub
[Bugs] NGAP handler passes the received NAS PDU to the NAS decoding layer without sufficient validation · Issue #812 · free5gc/free5gc
Bug Description The AMF's NGAP handler passes the received NAS PDU to the NAS decoding layer without sufficient validation. A malformed NAS PDU (e.g., a single byte) causes the decoding functio...
🚨 CVE-2026-30073
An issue in the NssaiAvailabilitySubscriptionCreate component of free5gc v4.0.1 allows attackers to cause a Denial of Service (DoS) via a crafted POST request.
🎖@cveNotify
An issue in the NssaiAvailabilitySubscriptionCreate component of free5gc v4.0.1 allows attackers to cause a Denial of Service (DoS) via a crafted POST request.
🎖@cveNotify
GitHub
[Bugs] NSSF Nil Pointer Panic in NssaiAvailabilitySubscriptionCreate · Issue #764 · free5gc/free5gc
Bug Description Creating an NSSAI availability subscription can crash the NSSF with just a single POST request. The request handler (NssaiAvailabilitySubscriptionCreate) dereferences and mutates a ...
🚨 CVE-2026-75357
An issue in Bilibili Desktop v.1.17.9 allows a remote attacker to execute arbitrary code via the bili-inject.js and bili-bridge.js components.
🎖@cveNotify
An issue in Bilibili Desktop v.1.17.9 allows a remote attacker to execute arbitrary code via the bili-inject.js and bili-bridge.js components.
🎖@cveNotify
GitHub
bilibili-desktop-ipc-origin-validation/advisory.md at main · LeoWSY-hashblue/bilibili-desktop-ipc-origin-validation
Sanitized advisory for Bilibili Desktop privileged IPC sender URL allowlist bypass (CWE-346) - LeoWSY-hashblue/bilibili-desktop-ipc-origin-validation