🚨 CVE-2026-26899
An issue was discovered in luci-app-https-dns-proxy on OpenWrt PR #15 (< 2026-01-17). The setInitAction function in /usr/libexec/rpcd/luci.https-dns-proxy allows authenticated users to execute arbitrary shell commands via shell metacharacters in the name parameter
🎖@cveNotify
An issue was discovered in luci-app-https-dns-proxy on OpenWrt PR #15 (< 2026-01-17). The setInitAction function in /usr/libexec/rpcd/luci.https-dns-proxy allows authenticated users to execute arbitrary shell commands via shell metacharacters in the name parameter
🎖@cveNotify
GitHub
GitHub - iwallplace/CVE-2026-46368-OpenWrt-Exploit: Proof of Concept exploit for CVE-2026-46368 — authenticated root command injection…
Proof of Concept exploit for CVE-2026-46368 — authenticated root command injection in OpenWrt luci-app-https-dns-proxy (EDB-52521) - iwallplace/CVE-2026-46368-OpenWrt-Exploit
🚨 CVE-2026-30046
A reachable assertion vulnerability in the NUDM-UECM interface of Open5GS v2.7.6 allows attackers to cause a Denial of Service (DoS) via supplying a crafted DELETE request.
🎖@cveNotify
A reachable assertion vulnerability in the NUDM-UECM interface of Open5GS v2.7.6 allows attackers to cause a Denial of Service (DoS) via supplying a crafted DELETE request.
🎖@cveNotify
GitHub
[Bug]: UDM crashes due to reachable assertion when DELETE request omits pduSessionId path parameter · Issue #4264 · open5gs/open5gs
Open5GS Release, Revision, or Tag v2.7.6 Steps to reproduce curl --http2-prior-knowledge -X DELETE -v http://127.0.to.12:7777/nudm-uecm/v1/imsi-001010000000001/registrations/smf-registrations/ Logs...
🚨 CVE-2026-30047
A reachable assertion vulnerability in the /nsmf-pdusession/v1/sm-contexts component of Open5GS v2.7.6 allows attackers to cause a Denial of Service (DoS) via supplying a crafted DELETE request.
🎖@cveNotify
A reachable assertion vulnerability in the /nsmf-pdusession/v1/sm-contexts component of Open5GS v2.7.6 allows attackers to cause a Denial of Service (DoS) via supplying a crafted DELETE request.
🎖@cveNotify
GitHub
[Bug]: smf Crashed due to Assertion `psi != OGS_NAS_PDU_SESSION_IDENTITY_UNASSIGNED' failed. · Issue #4201 · open5gs/open5gs
Open5GS Release, Revision, or Tag v2.7.6 Steps to reproduce curl -X POST --http2-prior-knowledge http://127.0.0.4:7777/nsmf-pdusession/v1/sm-contexts -H "Content-Type: application/json" -...
🚨 CVE-2026-30050
An issue in the ModifyAMFEventSubscriptionProcedure function (processor/event_exposure.go) of free5gc v4.1.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted PATCH request.
🎖@cveNotify
An issue in the ModifyAMFEventSubscriptionProcedure function (processor/event_exposure.go) of free5gc v4.1.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted PATCH request.
🎖@cveNotify
GitHub
[Bugs] AMF Event Exposure ModifyAMFEventSubscriptionProcedure Panics on Negative Path Index · Issue #776 · free5gc/free5gc
Bug Description A vulnerability exists in the ModifyAMFEventSubscriptionProcedure function within the AMF Event Exposure service (processor/event_exposure.go). When processing a PATCH request to mo...
🚨 CVE-2026-30056
A NULL pointer dereference in the AMF NGAP Dispatcher component of free5gc v4.0.1 allows attackers to cause a Denial of Service (DoS) via supplying crafted NGAP messages during the initialization of a new RAN connection.
🎖@cveNotify
A NULL pointer dereference in the AMF NGAP Dispatcher component of free5gc v4.0.1 allows attackers to cause a Denial of Service (DoS) via supplying crafted NGAP messages during the initialization of a new RAN connection.
🎖@cveNotify
GitHub
[Bugs] Nil Pointer Dereference in AMF NGAP Dispatcher when receive unexpected message sequence · Issue #768 · free5gc/free5gc
Bug Description The issue occurs because the dispatcher does not enforce the mandatory NGAP message sequence during the initialization of a new RAN connection. Instead of requiring the first messag...
🚨 CVE-2026-30057
An issue in the CreateUEContext handler component of free5gc v4.1.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted request.
🎖@cveNotify
An issue in the CreateUEContext handler component of free5gc v4.1.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted request.
🎖@cveNotify
GitHub
[Bugs] AMF CreateUEContext Panic on multipart/related Content-Type due to improper deserialization · Issue #755 · free5gc/free5gc
Bug Description The AMF’s CreateUEContext handler (HTTPCreateUEContext in internal/sbi/api_communication.go) mishandles requests with Content-Type: multipart/related. When such a request is process...
🚨 CVE-2026-30062
An issue in the NGAP handler of free5gc v4.0.1 allows attackers to cause a Denial of Service (DoS) via a crafted NAS PDU.
🎖@cveNotify
An issue in the NGAP handler of free5gc v4.0.1 allows attackers to cause a Denial of Service (DoS) via a crafted NAS PDU.
🎖@cveNotify
GitHub
[Bugs] NGAP handler passes the received NAS PDU to the NAS decoding layer without sufficient validation · Issue #812 · free5gc/free5gc
Bug Description The AMF's NGAP handler passes the received NAS PDU to the NAS decoding layer without sufficient validation. A malformed NAS PDU (e.g., a single byte) causes the decoding functio...
🚨 CVE-2026-30073
An issue in the NssaiAvailabilitySubscriptionCreate component of free5gc v4.0.1 allows attackers to cause a Denial of Service (DoS) via a crafted POST request.
🎖@cveNotify
An issue in the NssaiAvailabilitySubscriptionCreate component of free5gc v4.0.1 allows attackers to cause a Denial of Service (DoS) via a crafted POST request.
🎖@cveNotify
GitHub
[Bugs] NSSF Nil Pointer Panic in NssaiAvailabilitySubscriptionCreate · Issue #764 · free5gc/free5gc
Bug Description Creating an NSSAI availability subscription can crash the NSSF with just a single POST request. The request handler (NssaiAvailabilitySubscriptionCreate) dereferences and mutates a ...
🚨 CVE-2026-75357
An issue in Bilibili Desktop v.1.17.9 allows a remote attacker to execute arbitrary code via the bili-inject.js and bili-bridge.js components.
🎖@cveNotify
An issue in Bilibili Desktop v.1.17.9 allows a remote attacker to execute arbitrary code via the bili-inject.js and bili-bridge.js components.
🎖@cveNotify
GitHub
bilibili-desktop-ipc-origin-validation/advisory.md at main · LeoWSY-hashblue/bilibili-desktop-ipc-origin-validation
Sanitized advisory for Bilibili Desktop privileged IPC sender URL allowlist bypass (CWE-346) - LeoWSY-hashblue/bilibili-desktop-ipc-origin-validation
🚨 CVE-2026-30612
An issue in Time4 Popcorn for Windows <= 6.2.1.18 and Time4Popcorn for MacOS <= 6.2.1.17 and Time4Popcorn for Android <= 3.5.0.173 allows a remote attacker to execute arbitrary code via the updater.exe for windows, PT.updd on MacOS components
🎖@cveNotify
An issue in Time4 Popcorn for Windows <= 6.2.1.18 and Time4Popcorn for MacOS <= 6.2.1.17 and Time4Popcorn for Android <= 3.5.0.173 allows a remote attacker to execute arbitrary code via the updater.exe for windows, PT.updd on MacOS components
🎖@cveNotify
🚨 CVE-2026-36102
An issue in the inviteController.js component in Bluewave Labs Checkmate <=3.3.0 allows remote authenticated administrators to escalate privileges to superadmin via the role parameter to the /api/v1/invite endpoint.
🎖@cveNotify
An issue in the inviteController.js component in Bluewave Labs Checkmate <=3.3.0 allows remote authenticated administrators to escalate privileges to superadmin via the role parameter to the /api/v1/invite endpoint.
🎖@cveNotify
Gist
checkmateso-privilege-escalation.md
GitHub Gist: instantly share code, notes, and snippets.
🚨 CVE-2026-37004
BerriAI litellm <=1.82.4 is vulnerable to Server-Side Template Injection (SSTI), which allows unauthenticated remote attackers to execute arbitrary OS commands via a crafted dotprompt_content parameter in the /prompts/test endpoint due to use of an unsandboxed jinja2.Environment.
🎖@cveNotify
BerriAI litellm <=1.82.4 is vulnerable to Server-Side Template Injection (SSTI), which allows unauthenticated remote attackers to execute arbitrary OS commands via a crafted dotprompt_content parameter in the /prompts/test endpoint due to use of an unsandboxed jinja2.Environment.
🎖@cveNotify
GitHub
litellm/litellm/proxy/prompts/prompt_endpoints.py at 244bdffd1bfe7bebdfdef516e1ebe426a898e2f0 · BerriAI/litellm
The fastest, litest AI Gateway. Rust core with Python SDK. Call 100+ LLM APIs in OpenAI (or native) format with cost tracking, guardrails, load balancing, and logging [Bedrock, Azure, OpenAI, Anthr...
🚨 CVE-2026-37007
A vulnerability in FileWriterTool in crewai-tools <= 1.10.2rc1 allows a remote attacker to achieve code execution via malicious path traversal sequences in the filename argument.
🎖@cveNotify
A vulnerability in FileWriterTool in crewai-tools <= 1.10.2rc1 allows a remote attacker to achieve code execution via malicious path traversal sequences in the filename argument.
🎖@cveNotify
GitHub
fix: prevent path traversal in FileWriterTool (#4895) · crewAIInc/crewAI@713fa7d
* fix: add base_dir path containment to FileWriterTool
os.path.join does not prevent traversal — joining "./" with "../../../etc/cron.d/pwned"
resolves cleanly ...
os.path.join does not prevent traversal — joining "./" with "../../../etc/cron.d/pwned"
resolves cleanly ...
🚨 CVE-2026-37012
A vulnerability in pentestgpt/core/langfuse.py in PentestGPT 1.0.0 allows remote attackers to disclose sensitive user telemetry data via hardcoded API credentials.
🎖@cveNotify
A vulnerability in pentestgpt/core/langfuse.py in PentestGPT 1.0.0 allows remote attackers to disclose sensitive user telemetry data via hardcoded API credentials.
🎖@cveNotify
GitHub
PentestGPT/pentestgpt/core/langfuse.py at 6e84be8df5338b724adfb21c19700dd03547b007 · GreyDGL/PentestGPT
Automated Penetration Testing Agentic Framework Powered by Large Language Models - GreyDGL/PentestGPT
🚨 CVE-2026-37064
User enumeration in /vfm-admin/ajax/usr-check.php in Veno File Manager Project 4.4.9 allows an unauthenticated attacker to enumerate the application users via sending a specially crafted POST request to the affected endpoint with a chosen 'user_name' parameter to test if the user exists.
🎖@cveNotify
User enumeration in /vfm-admin/ajax/usr-check.php in Veno File Manager Project 4.4.9 allows an unauthenticated attacker to enumerate the application users via sending a specially crafted POST request to the affected endpoint with a chosen 'user_name' parameter to test if the user exists.
🎖@cveNotify
Veno
Großhandel für Kurzwaren, Zubehör & modische Trends - VENO
Wir machen kreative Fachhändler besonders - mit exklusiven Marken, schneller Lieferung, Einrichtungen und persönlichem Service in allen Sortimenten.
🚨 CVE-2026-37065
Veno File Manager Project 4.4.9 is vulnerable to Arbitrary File Deletion in /vfm-admin/index.php?section=translations&action=update&remove=.
🎖@cveNotify
Veno File Manager Project 4.4.9 is vulnerable to Arbitrary File Deletion in /vfm-admin/index.php?section=translations&action=update&remove=.
🎖@cveNotify
Veno
Großhandel für Kurzwaren, Zubehör & modische Trends - VENO
Wir machen kreative Fachhändler besonders - mit exklusiven Marken, schneller Lieferung, Einrichtungen und persönlichem Service in allen Sortimenten.
🚨 CVE-2026-37066
Path traversal leading to Arbitrary File Read in /vfm-admin/index.php and /vfm-admin/ajax/streamvid.php in Veno File Manager Project 4.4.9 allows and authenticated attacker with super administrator role to disclose sensitive information via two specially crafted http requests (POST and GET) to the affected endpoints.
🎖@cveNotify
Path traversal leading to Arbitrary File Read in /vfm-admin/index.php and /vfm-admin/ajax/streamvid.php in Veno File Manager Project 4.4.9 allows and authenticated attacker with super administrator role to disclose sensitive information via two specially crafted http requests (POST and GET) to the affected endpoints.
🎖@cveNotify
Veno
Großhandel für Kurzwaren, Zubehör & modische Trends - VENO
Wir machen kreative Fachhändler besonders - mit exklusiven Marken, schneller Lieferung, Einrichtungen und persönlichem Service in allen Sortimenten.
🚨 CVE-2026-37068
Arbitrary file write in /vfm-admin/index.php?section=translations&action=update in Veno File Manager Project 4.4.9 allows an authenticated user with the role of super administrator to overwrite any php file in the application via a specially crafted POST request to the affected endpoint.
🎖@cveNotify
Arbitrary file write in /vfm-admin/index.php?section=translations&action=update in Veno File Manager Project 4.4.9 allows an authenticated user with the role of super administrator to overwrite any php file in the application via a specially crafted POST request to the affected endpoint.
🎖@cveNotify
Veno
Großhandel für Kurzwaren, Zubehör & modische Trends - VENO
Wir machen kreative Fachhändler besonders - mit exklusiven Marken, schneller Lieferung, Einrichtungen und persönlichem Service in allen Sortimenten.
🚨 CVE-2026-37070
Incorrect access control in /vfm-admin/ajax/streamvid.php in Veno File Manager Project in 4.4.9 allows an authenticated attacker to read any uploaded files by other users as long as it knows the path and filename via a specially crafted GET request to the affected endpoint.
🎖@cveNotify
Incorrect access control in /vfm-admin/ajax/streamvid.php in Veno File Manager Project in 4.4.9 allows an authenticated attacker to read any uploaded files by other users as long as it knows the path and filename via a specially crafted GET request to the affected endpoint.
🎖@cveNotify
Veno
Großhandel für Kurzwaren, Zubehör & modische Trends - VENO
Wir machen kreative Fachhändler besonders - mit exklusiven Marken, schneller Lieferung, Einrichtungen und persönlichem Service in allen Sortimenten.
🚨 CVE-2026-37071
Arbitrary File Rename Leading to Privilege Escalation in Actions::renameFile() function in Veno File Manager Project 4.4.9 allows an authenticated attacker with 'reanme' permission to take over the super administrator account via a specially crafted POST request to the affected endpoint renaming the application configuration file and triggering a rebuild of configuration and resetting super administrator credentials to default values.
🎖@cveNotify
Arbitrary File Rename Leading to Privilege Escalation in Actions::renameFile() function in Veno File Manager Project 4.4.9 allows an authenticated attacker with 'reanme' permission to take over the super administrator account via a specially crafted POST request to the affected endpoint renaming the application configuration file and triggering a rebuild of configuration and resetting super administrator credentials to default values.
🎖@cveNotify
Veno
Großhandel für Kurzwaren, Zubehör & modische Trends - VENO
Wir machen kreative Fachhändler besonders - mit exklusiven Marken, schneller Lieferung, Einrichtungen und persönlichem Service in allen Sortimenten.
🚨 CVE-2026-37072
Veno File Manager Project Veno File Manager Project 4.4.9 is vulnerable to Incorrect Access Control in admin-head-updates.php.
🎖@cveNotify
Veno File Manager Project Veno File Manager Project 4.4.9 is vulnerable to Incorrect Access Control in admin-head-updates.php.
🎖@cveNotify
Veno
Großhandel für Kurzwaren, Zubehör & modische Trends - VENO
Wir machen kreative Fachhändler besonders - mit exklusiven Marken, schneller Lieferung, Einrichtungen und persönlichem Service in allen Sortimenten.