🚨 CVE-2026-26453
ccoap 77f55c4b466e99327c24ace8a2913d3ba7e2ccd5 contains a null pointer dereference vulnerability in the coap_server_handle_session() function when processing COAP messages containing URI_PATH options with NULL data pointers. When the server searches for a URI_PATH option matching the string "separate", it directly calls strncmp() on option_list[i].data without checking if the pointer is NULL. This causes a segmentation fault when the option's data field is NULL.
🎖@cveNotify
ccoap 77f55c4b466e99327c24ace8a2913d3ba7e2ccd5 contains a null pointer dereference vulnerability in the coap_server_handle_session() function when processing COAP messages containing URI_PATH options with NULL data pointers. When the server searches for a URI_PATH option matching the string "separate", it directly calls strncmp() on option_list[i].data without checking if the pointer is NULL. This causes a segmentation fault when the option's data field is NULL.
🎖@cveNotify
GitHub
GitHub - ipflavors/ccoap: A CoAP library in C
A CoAP library in C. Contribute to ipflavors/ccoap development by creating an account on GitHub.
🚨 CVE-2026-26459
ccoap 77f55c4b466e99327c24ace8a2913d3ba7e2ccd5 contains a vulnerability in the option parsing logic that causes a segmentation fault when processing malformed COAP messages with insufficient option data.
🎖@cveNotify
ccoap 77f55c4b466e99327c24ace8a2913d3ba7e2ccd5 contains a vulnerability in the option parsing logic that causes a segmentation fault when processing malformed COAP messages with insufficient option data.
🎖@cveNotify
GitHub
GitHub - ipflavors/ccoap: A CoAP library in C
A CoAP library in C. Contribute to ipflavors/ccoap development by creating an account on GitHub.
🚨 CVE-2026-26897
An issue in EcoOnline EHS (com.airsweb.v10) application for Android, version 0.2.499 allows a remote attacker to obtain sensitive information and execute arbitrary code via the AndroidManifest.xml component
🎖@cveNotify
An issue in EcoOnline EHS (com.airsweb.v10) application for Android, version 0.2.499 allows a remote attacker to obtain sensitive information and execute arbitrary code via the AndroidManifest.xml component
🎖@cveNotify
🚨 CVE-2026-26899
An issue was discovered in luci-app-https-dns-proxy on OpenWrt PR #15 (< 2026-01-17). The setInitAction function in /usr/libexec/rpcd/luci.https-dns-proxy allows authenticated users to execute arbitrary shell commands via shell metacharacters in the name parameter
🎖@cveNotify
An issue was discovered in luci-app-https-dns-proxy on OpenWrt PR #15 (< 2026-01-17). The setInitAction function in /usr/libexec/rpcd/luci.https-dns-proxy allows authenticated users to execute arbitrary shell commands via shell metacharacters in the name parameter
🎖@cveNotify
GitHub
GitHub - iwallplace/CVE-2026-46368-OpenWrt-Exploit: Proof of Concept exploit for CVE-2026-46368 — authenticated root command injection…
Proof of Concept exploit for CVE-2026-46368 — authenticated root command injection in OpenWrt luci-app-https-dns-proxy (EDB-52521) - iwallplace/CVE-2026-46368-OpenWrt-Exploit
🚨 CVE-2026-30046
A reachable assertion vulnerability in the NUDM-UECM interface of Open5GS v2.7.6 allows attackers to cause a Denial of Service (DoS) via supplying a crafted DELETE request.
🎖@cveNotify
A reachable assertion vulnerability in the NUDM-UECM interface of Open5GS v2.7.6 allows attackers to cause a Denial of Service (DoS) via supplying a crafted DELETE request.
🎖@cveNotify
GitHub
[Bug]: UDM crashes due to reachable assertion when DELETE request omits pduSessionId path parameter · Issue #4264 · open5gs/open5gs
Open5GS Release, Revision, or Tag v2.7.6 Steps to reproduce curl --http2-prior-knowledge -X DELETE -v http://127.0.to.12:7777/nudm-uecm/v1/imsi-001010000000001/registrations/smf-registrations/ Logs...
🚨 CVE-2026-30047
A reachable assertion vulnerability in the /nsmf-pdusession/v1/sm-contexts component of Open5GS v2.7.6 allows attackers to cause a Denial of Service (DoS) via supplying a crafted DELETE request.
🎖@cveNotify
A reachable assertion vulnerability in the /nsmf-pdusession/v1/sm-contexts component of Open5GS v2.7.6 allows attackers to cause a Denial of Service (DoS) via supplying a crafted DELETE request.
🎖@cveNotify
GitHub
[Bug]: smf Crashed due to Assertion `psi != OGS_NAS_PDU_SESSION_IDENTITY_UNASSIGNED' failed. · Issue #4201 · open5gs/open5gs
Open5GS Release, Revision, or Tag v2.7.6 Steps to reproduce curl -X POST --http2-prior-knowledge http://127.0.0.4:7777/nsmf-pdusession/v1/sm-contexts -H "Content-Type: application/json" -...
🚨 CVE-2026-30050
An issue in the ModifyAMFEventSubscriptionProcedure function (processor/event_exposure.go) of free5gc v4.1.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted PATCH request.
🎖@cveNotify
An issue in the ModifyAMFEventSubscriptionProcedure function (processor/event_exposure.go) of free5gc v4.1.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted PATCH request.
🎖@cveNotify
GitHub
[Bugs] AMF Event Exposure ModifyAMFEventSubscriptionProcedure Panics on Negative Path Index · Issue #776 · free5gc/free5gc
Bug Description A vulnerability exists in the ModifyAMFEventSubscriptionProcedure function within the AMF Event Exposure service (processor/event_exposure.go). When processing a PATCH request to mo...
🚨 CVE-2026-30056
A NULL pointer dereference in the AMF NGAP Dispatcher component of free5gc v4.0.1 allows attackers to cause a Denial of Service (DoS) via supplying crafted NGAP messages during the initialization of a new RAN connection.
🎖@cveNotify
A NULL pointer dereference in the AMF NGAP Dispatcher component of free5gc v4.0.1 allows attackers to cause a Denial of Service (DoS) via supplying crafted NGAP messages during the initialization of a new RAN connection.
🎖@cveNotify
GitHub
[Bugs] Nil Pointer Dereference in AMF NGAP Dispatcher when receive unexpected message sequence · Issue #768 · free5gc/free5gc
Bug Description The issue occurs because the dispatcher does not enforce the mandatory NGAP message sequence during the initialization of a new RAN connection. Instead of requiring the first messag...
🚨 CVE-2026-30057
An issue in the CreateUEContext handler component of free5gc v4.1.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted request.
🎖@cveNotify
An issue in the CreateUEContext handler component of free5gc v4.1.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted request.
🎖@cveNotify
GitHub
[Bugs] AMF CreateUEContext Panic on multipart/related Content-Type due to improper deserialization · Issue #755 · free5gc/free5gc
Bug Description The AMF’s CreateUEContext handler (HTTPCreateUEContext in internal/sbi/api_communication.go) mishandles requests with Content-Type: multipart/related. When such a request is process...
🚨 CVE-2026-30062
An issue in the NGAP handler of free5gc v4.0.1 allows attackers to cause a Denial of Service (DoS) via a crafted NAS PDU.
🎖@cveNotify
An issue in the NGAP handler of free5gc v4.0.1 allows attackers to cause a Denial of Service (DoS) via a crafted NAS PDU.
🎖@cveNotify
GitHub
[Bugs] NGAP handler passes the received NAS PDU to the NAS decoding layer without sufficient validation · Issue #812 · free5gc/free5gc
Bug Description The AMF's NGAP handler passes the received NAS PDU to the NAS decoding layer without sufficient validation. A malformed NAS PDU (e.g., a single byte) causes the decoding functio...
🚨 CVE-2026-30073
An issue in the NssaiAvailabilitySubscriptionCreate component of free5gc v4.0.1 allows attackers to cause a Denial of Service (DoS) via a crafted POST request.
🎖@cveNotify
An issue in the NssaiAvailabilitySubscriptionCreate component of free5gc v4.0.1 allows attackers to cause a Denial of Service (DoS) via a crafted POST request.
🎖@cveNotify
GitHub
[Bugs] NSSF Nil Pointer Panic in NssaiAvailabilitySubscriptionCreate · Issue #764 · free5gc/free5gc
Bug Description Creating an NSSAI availability subscription can crash the NSSF with just a single POST request. The request handler (NssaiAvailabilitySubscriptionCreate) dereferences and mutates a ...
🚨 CVE-2026-75357
An issue in Bilibili Desktop v.1.17.9 allows a remote attacker to execute arbitrary code via the bili-inject.js and bili-bridge.js components.
🎖@cveNotify
An issue in Bilibili Desktop v.1.17.9 allows a remote attacker to execute arbitrary code via the bili-inject.js and bili-bridge.js components.
🎖@cveNotify
GitHub
bilibili-desktop-ipc-origin-validation/advisory.md at main · LeoWSY-hashblue/bilibili-desktop-ipc-origin-validation
Sanitized advisory for Bilibili Desktop privileged IPC sender URL allowlist bypass (CWE-346) - LeoWSY-hashblue/bilibili-desktop-ipc-origin-validation
🚨 CVE-2026-30612
An issue in Time4 Popcorn for Windows <= 6.2.1.18 and Time4Popcorn for MacOS <= 6.2.1.17 and Time4Popcorn for Android <= 3.5.0.173 allows a remote attacker to execute arbitrary code via the updater.exe for windows, PT.updd on MacOS components
🎖@cveNotify
An issue in Time4 Popcorn for Windows <= 6.2.1.18 and Time4Popcorn for MacOS <= 6.2.1.17 and Time4Popcorn for Android <= 3.5.0.173 allows a remote attacker to execute arbitrary code via the updater.exe for windows, PT.updd on MacOS components
🎖@cveNotify
🚨 CVE-2026-36102
An issue in the inviteController.js component in Bluewave Labs Checkmate <=3.3.0 allows remote authenticated administrators to escalate privileges to superadmin via the role parameter to the /api/v1/invite endpoint.
🎖@cveNotify
An issue in the inviteController.js component in Bluewave Labs Checkmate <=3.3.0 allows remote authenticated administrators to escalate privileges to superadmin via the role parameter to the /api/v1/invite endpoint.
🎖@cveNotify
Gist
checkmateso-privilege-escalation.md
GitHub Gist: instantly share code, notes, and snippets.
🚨 CVE-2026-37004
BerriAI litellm <=1.82.4 is vulnerable to Server-Side Template Injection (SSTI), which allows unauthenticated remote attackers to execute arbitrary OS commands via a crafted dotprompt_content parameter in the /prompts/test endpoint due to use of an unsandboxed jinja2.Environment.
🎖@cveNotify
BerriAI litellm <=1.82.4 is vulnerable to Server-Side Template Injection (SSTI), which allows unauthenticated remote attackers to execute arbitrary OS commands via a crafted dotprompt_content parameter in the /prompts/test endpoint due to use of an unsandboxed jinja2.Environment.
🎖@cveNotify
GitHub
litellm/litellm/proxy/prompts/prompt_endpoints.py at 244bdffd1bfe7bebdfdef516e1ebe426a898e2f0 · BerriAI/litellm
The fastest, litest AI Gateway. Rust core with Python SDK. Call 100+ LLM APIs in OpenAI (or native) format with cost tracking, guardrails, load balancing, and logging [Bedrock, Azure, OpenAI, Anthr...
🚨 CVE-2026-37007
A vulnerability in FileWriterTool in crewai-tools <= 1.10.2rc1 allows a remote attacker to achieve code execution via malicious path traversal sequences in the filename argument.
🎖@cveNotify
A vulnerability in FileWriterTool in crewai-tools <= 1.10.2rc1 allows a remote attacker to achieve code execution via malicious path traversal sequences in the filename argument.
🎖@cveNotify
GitHub
fix: prevent path traversal in FileWriterTool (#4895) · crewAIInc/crewAI@713fa7d
* fix: add base_dir path containment to FileWriterTool
os.path.join does not prevent traversal — joining "./" with "../../../etc/cron.d/pwned"
resolves cleanly ...
os.path.join does not prevent traversal — joining "./" with "../../../etc/cron.d/pwned"
resolves cleanly ...
🚨 CVE-2026-37012
A vulnerability in pentestgpt/core/langfuse.py in PentestGPT 1.0.0 allows remote attackers to disclose sensitive user telemetry data via hardcoded API credentials.
🎖@cveNotify
A vulnerability in pentestgpt/core/langfuse.py in PentestGPT 1.0.0 allows remote attackers to disclose sensitive user telemetry data via hardcoded API credentials.
🎖@cveNotify
GitHub
PentestGPT/pentestgpt/core/langfuse.py at 6e84be8df5338b724adfb21c19700dd03547b007 · GreyDGL/PentestGPT
Automated Penetration Testing Agentic Framework Powered by Large Language Models - GreyDGL/PentestGPT
🚨 CVE-2026-37064
User enumeration in /vfm-admin/ajax/usr-check.php in Veno File Manager Project 4.4.9 allows an unauthenticated attacker to enumerate the application users via sending a specially crafted POST request to the affected endpoint with a chosen 'user_name' parameter to test if the user exists.
🎖@cveNotify
User enumeration in /vfm-admin/ajax/usr-check.php in Veno File Manager Project 4.4.9 allows an unauthenticated attacker to enumerate the application users via sending a specially crafted POST request to the affected endpoint with a chosen 'user_name' parameter to test if the user exists.
🎖@cveNotify
Veno
Großhandel für Kurzwaren, Zubehör & modische Trends - VENO
Wir machen kreative Fachhändler besonders - mit exklusiven Marken, schneller Lieferung, Einrichtungen und persönlichem Service in allen Sortimenten.
🚨 CVE-2026-37065
Veno File Manager Project 4.4.9 is vulnerable to Arbitrary File Deletion in /vfm-admin/index.php?section=translations&action=update&remove=.
🎖@cveNotify
Veno File Manager Project 4.4.9 is vulnerable to Arbitrary File Deletion in /vfm-admin/index.php?section=translations&action=update&remove=.
🎖@cveNotify
Veno
Großhandel für Kurzwaren, Zubehör & modische Trends - VENO
Wir machen kreative Fachhändler besonders - mit exklusiven Marken, schneller Lieferung, Einrichtungen und persönlichem Service in allen Sortimenten.
🚨 CVE-2026-37066
Path traversal leading to Arbitrary File Read in /vfm-admin/index.php and /vfm-admin/ajax/streamvid.php in Veno File Manager Project 4.4.9 allows and authenticated attacker with super administrator role to disclose sensitive information via two specially crafted http requests (POST and GET) to the affected endpoints.
🎖@cveNotify
Path traversal leading to Arbitrary File Read in /vfm-admin/index.php and /vfm-admin/ajax/streamvid.php in Veno File Manager Project 4.4.9 allows and authenticated attacker with super administrator role to disclose sensitive information via two specially crafted http requests (POST and GET) to the affected endpoints.
🎖@cveNotify
Veno
Großhandel für Kurzwaren, Zubehör & modische Trends - VENO
Wir machen kreative Fachhändler besonders - mit exklusiven Marken, schneller Lieferung, Einrichtungen und persönlichem Service in allen Sortimenten.
🚨 CVE-2026-37068
Arbitrary file write in /vfm-admin/index.php?section=translations&action=update in Veno File Manager Project 4.4.9 allows an authenticated user with the role of super administrator to overwrite any php file in the application via a specially crafted POST request to the affected endpoint.
🎖@cveNotify
Arbitrary file write in /vfm-admin/index.php?section=translations&action=update in Veno File Manager Project 4.4.9 allows an authenticated user with the role of super administrator to overwrite any php file in the application via a specially crafted POST request to the affected endpoint.
🎖@cveNotify
Veno
Großhandel für Kurzwaren, Zubehör & modische Trends - VENO
Wir machen kreative Fachhändler besonders - mit exklusiven Marken, schneller Lieferung, Einrichtungen und persönlichem Service in allen Sortimenten.