๐จ CVE-2026-51739
Incorrect access control in the CloudSrvVersionCheck function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to trigger cloud update checks via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
๐@cveNotify
Incorrect access control in the CloudSrvVersionCheck function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to trigger cloud update checks via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
๐@cveNotify
GitHub
CVE-Vendor-Coordination/TOTOLINK/README.md at main ยท ShengWu00/CVE-Vendor-Coordination
Contribute to ShengWu00/CVE-Vendor-Coordination development by creating an account on GitHub.
๐จ CVE-2026-81297
Subscriber Privilege Escalation in Fluent Forms Pro Add On Pack <= 6.2.12 versions.
๐@cveNotify
Subscriber Privilege Escalation in Fluent Forms Pro Add On Pack <= 6.2.12 versions.
๐@cveNotify
Patchstack
Privilege Escalation in WordPress Fluent Forms Pro Add On Pack Plugin
Patchstack is the leading open source vulnerability research organization. Find information and protection for all WordPress and Drupal security issues.
๐จ CVE-2026-81763
Unauthenticated SQL Injection in Throws SPAM Away <= 3.8.2 versions.
๐@cveNotify
Unauthenticated SQL Injection in Throws SPAM Away <= 3.8.2 versions.
๐@cveNotify
Patchstack
SQL Injection in WordPress Throws SPAM Away Plugin
Patchstack is the leading open source vulnerability research organization. Find information and protection for all WordPress and Drupal security issues.
๐จ CVE-2026-81780
Unauthenticated Arbitrary File Upload in Hash Form <= 1.4.2 versions.
๐@cveNotify
Unauthenticated Arbitrary File Upload in Hash Form <= 1.4.2 versions.
๐@cveNotify
Patchstack
Arbitrary File Upload in WordPress Hash Form Plugin
Patchstack is the leading open source vulnerability research organization. Find information and protection for all WordPress and Drupal security issues.
๐จ CVE-2026-82228
Unauthenticated Bypass Vulnerability in SiteGround Security <= 1.6.6 versions.
๐@cveNotify
Unauthenticated Bypass Vulnerability in SiteGround Security <= 1.6.6 versions.
๐@cveNotify
Patchstack
Bypass Vulnerability in WordPress SiteGround Security Plugin
Patchstack is the leading open source vulnerability research organization. Find information and protection for all WordPress and Drupal security issues.
๐จ CVE-2026-83596
A flaw was found in WebKitGTK. Processing malicious web content can cause memory corruption due to improper memory handling.
๐@cveNotify
A flaw was found in WebKitGTK. Processing malicious web content can cause memory corruption due to improper memory handling.
๐@cveNotify
Redhat
CVE-2026-83596 - Red Hat Customer Portal
CVE Details App
๐จ CVE-2026-82971
A vulnerability was determined in QVidium Opera11 3.3.2a26-Ax4x-opera11. This affects an unknown part of the file /cgi-bin/net_tr.cgi of the component CGI Script. This manipulation of the argument ipaddr causes command injection. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor explains: "QVidium has now closed its doors and no longer will be able to sell products or provide support." This vulnerability only affects products that are no longer supported by the maintainer.
๐@cveNotify
A vulnerability was determined in QVidium Opera11 3.3.2a26-Ax4x-opera11. This affects an unknown part of the file /cgi-bin/net_tr.cgi of the component CGI Script. This manipulation of the argument ipaddr causes command injection. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor explains: "QVidium has now closed its doors and no longer will be able to sell products or provide support." This vulnerability only affects products that are no longer supported by the maintainer.
๐@cveNotify
uvxbywu62qm.feishu.cn
Docs
๐จ CVE-2026-84059
A flaw has been found in ICP DAS UA-2200 and UA-5200 up to 20260704. The affected element is the function ArmAngstromInstructionSet of the file /CGI?RestApi=SetHostname. Executing a manipulation of the argument ParameterArray can lead to command injection. The attack can be executed remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
๐@cveNotify
A flaw has been found in ICP DAS UA-2200 and UA-5200 up to 20260704. The affected element is the function ArmAngstromInstructionSet of the file /CGI?RestApi=SetHostname. Executing a manipulation of the argument ParameterArray can lead to command injection. The attack can be executed remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
๐@cveNotify
uvxbywu62qm.feishu.cn
Docs
๐จ CVE-2026-51742
Incorrect access control in the discoverWan function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to trigger WAN discovery logic via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
๐@cveNotify
Incorrect access control in the discoverWan function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to trigger WAN discovery logic via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
๐@cveNotify
GitHub
CVE-Vendor-Coordination/TOTOLINK/README.md at main ยท ShengWu00/CVE-Vendor-Coordination
Contribute to ShengWu00/CVE-Vendor-Coordination development by creating an account on GitHub.
๐จ CVE-2026-51748
Incorrect access control in the sendStaticInfoToMaster function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to update stored slave inventory records via sending a crafted MQTT message to the cs_broker component.
๐@cveNotify
Incorrect access control in the sendStaticInfoToMaster function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to update stored slave inventory records via sending a crafted MQTT message to the cs_broker component.
๐@cveNotify
GitHub
CVE-Vendor-Coordination/TOTOLINK/README.md at main ยท ShengWu00/CVE-Vendor-Coordination
Contribute to ShengWu00/CVE-Vendor-Coordination development by creating an account on GitHub.
๐จ CVE-2026-80047
A vulnerability in Hugging Face Transformers (versions >= 4.49.0 and <= 5.8.1) allows remote Python files to be written to local disk without user consent when using GenerativePreTrainedModel.load_custom_generate(). The function fetches and caches a remote module file before performing the required trust_remote_code consent check, inverting the security model enforced by other code-loading paths (such as AutoConfig, AutoModel, and AutoTokenizer). As a result, attackerโcontrolled Python code from custom_generate/generate.py is copied into the userโs ~/.cache/huggingface/modules directory even if the user declines the trust prompt. Although execution is correctly gated, the file write is not reversible and can persist across sessions. This can lead to persistent, unauthorized files on disk and stale cache collisions where cached attacker code may later be executed during trusted model loads. The issue stems from an unconditional file write in dynamic_module_utils.py prior to any trust verification.
๐@cveNotify
A vulnerability in Hugging Face Transformers (versions >= 4.49.0 and <= 5.8.1) allows remote Python files to be written to local disk without user consent when using GenerativePreTrainedModel.load_custom_generate(). The function fetches and caches a remote module file before performing the required trust_remote_code consent check, inverting the security model enforced by other code-loading paths (such as AutoConfig, AutoModel, and AutoTokenizer). As a result, attackerโcontrolled Python code from custom_generate/generate.py is copied into the userโs ~/.cache/huggingface/modules directory even if the user declines the trust prompt. Although execution is correctly gated, the file write is not reversible and can persist across sessions. This can lead to persistent, unauthorized files on disk and stale cache collisions where cached attacker code may later be executed during trusted model loads. The issue stems from an unconditional file write in dynamic_module_utils.py prior to any trust verification.
๐@cveNotify
GitHub
GitHub - huggingface/transformers: ๐ค Transformers: the model-definition framework for state-of-the-art machine learning modelsโฆ
๐ค Transformers: the model-definition framework for state-of-the-art machine learning models in text, vision, audio, and multimodal models, for both inference and training. - huggingface/transformers
๐จ CVE-2026-70405
Improper Validation of Specified Quantity in Input vulnerability in Erlang/OTP snmp allows a remote attacker to degrade availability by sending an SNMP message containing a BER INTEGER whose length field is arbitrarily large.
snmp_pdus:dec_integer_notag/1 defaults its size limit to infinity, and do_dec_integer_notag/2 then accumulates the value across every declared byte with a recursive shift and bitwise or. Work grows superlinearly in the declared length because each operation acts on a progressively larger bignum. The size-limited variant dec_integer_notag/2 exists but is reached from only one call site, dec_snmp_version/1, which bounds the version field to ten bytes; the request identifier, error status and index, generic and specific trap fields, engine boots and time, and every varbind value decoded by dec_value/1 all use the unbounded form. The decode runs before the PDU is processed, so no valid request is required beyond what the deployment demands to accept the message at all.
This issue affects OTP from OTP 17.0 before OTP 27.3.4.17, from OTP 28.0 before OTP 28.5.0.6, and from OTP 29.0 before OTP 29.0.6, corresponding to snmp from 4.25.1 before 5.18.2.1, from 5.19 before 5.20.2.2, and from 5.20.3 before 5.20.5. Whether OTP before OTP 17.0, corresponding to snmp before 4.25.1, is affected is unknown.
๐@cveNotify
Improper Validation of Specified Quantity in Input vulnerability in Erlang/OTP snmp allows a remote attacker to degrade availability by sending an SNMP message containing a BER INTEGER whose length field is arbitrarily large.
snmp_pdus:dec_integer_notag/1 defaults its size limit to infinity, and do_dec_integer_notag/2 then accumulates the value across every declared byte with a recursive shift and bitwise or. Work grows superlinearly in the declared length because each operation acts on a progressively larger bignum. The size-limited variant dec_integer_notag/2 exists but is reached from only one call site, dec_snmp_version/1, which bounds the version field to ten bytes; the request identifier, error status and index, generic and specific trap fields, engine boots and time, and every varbind value decoded by dec_value/1 all use the unbounded form. The decode runs before the PDU is processed, so no valid request is required beyond what the deployment demands to accept the message at all.
This issue affects OTP from OTP 17.0 before OTP 27.3.4.17, from OTP 28.0 before OTP 28.5.0.6, and from OTP 29.0 before OTP 29.0.6, corresponding to snmp from 4.25.1 before 5.18.2.1, from 5.19 before 5.20.2.2, and from 5.20.3 before 5.20.5. Whether OTP before OTP 17.0, corresponding to snmp before 4.25.1, is affected is unknown.
๐@cveNotify
๐จ CVE-2026-83609
xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. From 0.9.0 until 0.9.12, the shared reg() builder in lib/grammar.js compiles the anchored QName_exact validator with the multiline flag, so ^ and $ validate only one line instead of the complete name. createElementNS, createAttributeNS, createDocumentType, and createAttribute consequently accept a malformed XML name whose first line is valid and whose later text injects markup when serialized through either the default path or requireWellFormed: true. The triggering ECMAScript line terminators are U+000A, U+000D, U+2028, and U+2029. This issue is fixed in @xmldom/xmldom version 0.9.12.
๐@cveNotify
xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. From 0.9.0 until 0.9.12, the shared reg() builder in lib/grammar.js compiles the anchored QName_exact validator with the multiline flag, so ^ and $ validate only one line instead of the complete name. createElementNS, createAttributeNS, createDocumentType, and createAttribute consequently accept a malformed XML name whose first line is valid and whose later text injects markup when serialized through either the default path or requireWellFormed: true. The triggering ECMAScript line terminators are U+000A, U+000D, U+2028, and U+2029. This issue is fixed in @xmldom/xmldom version 0.9.12.
๐@cveNotify
GitHub
fix: prevent multiline-anchor bypass of name/id validation by droppinโฆ ยท xmldom/xmldom@7b2ec67
โฆg the reg() m flag (GHSA-jxjr-3g7g-3944, GHSA-vr34-hp96-76pp, GHSA-3px3-54cx-rmw9, GHSA-6h8r-xr42-gp59)
The shared `reg()` builder in `lib/grammar.js` compiled every anchored production with the ...
The shared `reg()` builder in `lib/grammar.js` compiled every anchored production with the ...
๐จ CVE-2026-83619
xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. From 0.7.0 until 0.8.15, the release-0.8.x parser in lib/sax.js trims captured end-tag names with the unanchored global expression /[ \t\n\r]+$/g. For an end tag containing a long whitespace run followed by a non-whitespace character, the expression retries from each possible starting position and backtracks quadratically before failing its end anchor. DOMParser.parseFromString() reaches the path under default options, allowing a small unauthenticated XML input to stall the Node.js event loop; the 0.9.x and unscoped npm lines do not contain this expression. This issue is fixed in @xmldom/xmldom version 0.8.15.
๐@cveNotify
xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. From 0.7.0 until 0.8.15, the release-0.8.x parser in lib/sax.js trims captured end-tag names with the unanchored global expression /[ \t\n\r]+$/g. For an end tag containing a long whitespace run followed by a non-whitespace character, the expression retries from each possible starting position and backtracks quadratically before failing its end anchor. DOMParser.parseFromString() reaches the path under default options, allowing a small unauthenticated XML input to stall the Node.js event loop; the 0.9.x and unscoped npm lines do not contain this expression. This issue is fixed in @xmldom/xmldom version 0.8.15.
๐@cveNotify
GitHub
fix: prevent end-tag whitespace-trim ReDoS via anchored trim (GHSA-x4โฆ ยท xmldom/xmldom@3abb093
โฆfp-j954-r2f4)
The end-tag name trim used an unanchored global regex `/[ \t\n\r]+$/g`. On a name
shaped `whitespace-run + one non-whitespace char` (an end tag `</ โฆ x>`), the
eng...
The end-tag name trim used an unanchored global regex `/[ \t\n\r]+$/g`. On a name
shaped `whitespace-run + one non-whitespace char` (an end tag `</ โฆ x>`), the
eng...
๐จ CVE-2026-84114
A vulnerability has been found in Cleo Harmony up to 5.8.1.10. Impacted is the function LocalUserUtil.getNativeUserByAssertions of the component SAML Authentication. Such manipulation of the argument Email leads to improper authentication. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 5.8.1.11 is recommended to address this issue. Upgrading the affected component is recommended.
๐@cveNotify
A vulnerability has been found in Cleo Harmony up to 5.8.1.10. Impacted is the function LocalUserUtil.getNativeUserByAssertions of the component SAML Authentication. Such manipulation of the argument Email leads to improper authentication. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 5.8.1.11 is recommended to address this issue. Upgrading the affected component is recommended.
๐@cveNotify
Cleo
Cleo Harmonyยฎ 5.8.1 Release Notes
Important:Cleo product patches often contain security-strengthening capability enhancements and updates. We strongly recommend that customers remain on the latest product version and apply updates ...
๐จ CVE-2026-79682
Dell PowerStore contains a Command Injection vulnerability. An authenticated user with limited privileges could potentially exploit this vulnerability to execute arbitrary commands with root privileges.
๐@cveNotify
Dell PowerStore contains a Command Injection vulnerability. An authenticated user with limited privileges could potentially exploit this vulnerability to execute arbitrary commands with root privileges.
๐@cveNotify
๐จ CVE-2026-84203
Memos versions 0.26.0 through 0.30.0 fail to revoke refresh tokens when a user changes their password, allowing attackers to maintain account access. An attacker with a stolen refresh token can call the RefreshToken RPC to obtain new access tokens and rotate the refresh token indefinitely, bypassing the password change security measure.
๐@cveNotify
Memos versions 0.26.0 through 0.30.0 fail to revoke refresh tokens when a user changes their password, allowing attackers to maintain account access. An attacker with a stolen refresh token can call the RefreshToken RPC to obtain new access tokens and rotate the refresh token indefinitely, bypassing the password change security measure.
๐@cveNotify
GitHub
GitHub - usememos/memos: Open-source, self-hosted note-taking tool built for quick capture. Markdown-native, lightweight, and fullyโฆ
Open-source, self-hosted note-taking tool built for quick capture. Markdown-native, lightweight, and fully yours. - usememos/memos
๐จ CVE-2026-84268
A flaw was found in the SFTP backend in gvfs. When mounting a share and reading a file, a malicious SFTP server can cause read_reply() to process a length that exceeds the size requested by the client. The function does not verify the server-provided length against the allocated buffer size, causing the operation to write past the intended boundaries. This issue allows a malicious server to corrupt adjacent heap memory in the gvfsd-sftp process, resulting in a denial of service as the process aborts upon detecting the heap corruption or potentially allowing arbitrary code execution.
๐@cveNotify
A flaw was found in the SFTP backend in gvfs. When mounting a share and reading a file, a malicious SFTP server can cause read_reply() to process a length that exceeds the size requested by the client. The function does not verify the server-provided length against the allocated buffer size, causing the operation to write past the intended boundaries. This issue allows a malicious server to corrupt adjacent heap memory in the gvfsd-sftp process, resulting in a denial of service as the process aborts upon detecting the heap corruption or potentially allowing arbitrary code execution.
๐@cveNotify
Redhat
CVE-2026-84268 - Red Hat Customer Portal
CVE Details App
๐จ CVE-2026-52130
llama.cpp b5693 and before is vulnerable to Uncontrolled Recursion in common/json-schema-to-grammar.cpp, resulting in a denial of service.
๐@cveNotify
llama.cpp b5693 and before is vulnerable to Uncontrolled Recursion in common/json-schema-to-grammar.cpp, resulting in a denial of service.
๐@cveNotify
Ph4nt0m
llama.cpp json-schema-to-grammar ๋ฌด์ ์ด ์ฌ๊ท DoS
llama.cpp <=b5693์ common/json-schema-to-grammar.cpp์ ๋ฌด์ ์ด ์ฌ๊ท๋ก ์ธํด ์๋น์ค ๊ฑฐ๋ถ(DoS)์ ์ทจ์ฝํฉ๋๋ค. POST /completions ๊ฒฝ๋ก๋ง ์ํฅ์ ๋ฐ์ต๋๋ค.
๐จ CVE-2026-81846
An authorization bypass in the runZero Platform MCP service has been resolved in version 5.1.260826.0. This issue is an instance of CWE-639: Authorization Bypass Through User-Controlled Key and has an estimated CVSS score of CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N (3.5 Low).
๐@cveNotify
An authorization bypass in the runZero Platform MCP service has been resolved in version 5.1.260826.0. This issue is an instance of CWE-639: Authorization Bypass Through User-Controlled Key and has an estimated CVSS score of CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N (3.5 Low).
๐@cveNotify
runZero
Release notes
5.1.260827.2Aug 27, 2026
More reliable AI-generated labelling: generated script resources now carry the embedded label on download, and the exported-report label is placed and de-duplicated more robustly.
An issue rendering the credentialโฆ
More reliable AI-generated labelling: generated script resources now carry the embedded label on download, and the exported-report label is placed and de-duplicated more robustly.
An issue rendering the credentialโฆ