๐จ CVE-2026-37072
Veno File Manager Project Veno File Manager Project 4.4.9 is vulnerable to Incorrect Access Control in admin-head-updates.php.
๐@cveNotify
Veno File Manager Project Veno File Manager Project 4.4.9 is vulnerable to Incorrect Access Control in admin-head-updates.php.
๐@cveNotify
Veno
Groรhandel fรผr Kurzwaren, Zubehรถr & modische Trends - VENO
Wir machen kreative Fachhรคndler besonders - mit exklusiven Marken, schneller Lieferung, Einrichtungen und persรถnlichem Service in allen Sortimenten.
๐จ CVE-2026-59285
Spring for GraphQL applications are vulnerable to Unsafe Deserialization when processing paginated GraphQL queries.
Spring for GraphQL 2.0.0 - 2.0.4
๐@cveNotify
Spring for GraphQL applications are vulnerable to Unsafe Deserialization when processing paginated GraphQL queries.
Spring for GraphQL 2.0.0 - 2.0.4
๐@cveNotify
Spring for GraphQL Unsafe Deserialization in pagination support
Level up your Java code and explore what Spring can do for you.
๐จ CVE-2026-38345
A Division-by-Zero vulnerability in the ff_sws_init_single_context function (/libswscale/utils.c) of FFmpeg N-122528-gdd2976b9e1 allows attackers to cause a Denial of Service (DoS) via a crafted input.
๐@cveNotify
A Division-by-Zero vulnerability in the ff_sws_init_single_context function (/libswscale/utils.c) of FFmpeg N-122528-gdd2976b9e1 allows attackers to cause a Denial of Service (DoS) via a crafted input.
๐@cveNotify
FFmpeg Forgejo
[Bug Report] Division by Zero @ libswscale/utils.c:1412:60
# Summary of the bug
a division by zero vulnerability in libswscale's scaling context initialization at libswscale/utils.c:1412:60. When scaling yuv411p format to a very narrow width (8 pixels), the chroma destination width becomes 2 pixels, and the codeโฆ
a division by zero vulnerability in libswscale's scaling context initialization at libswscale/utils.c:1412:60. When scaling yuv411p format to a very narrow width (8 pixels), the chroma destination width becomes 2 pixels, and the codeโฆ
๐จ CVE-2026-51611
Incorrect access control in the startSlaveReboot function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to arbitrarily force a reboot via sending a crafted MQTT message.
๐@cveNotify
Incorrect access control in the startSlaveReboot function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to arbitrarily force a reboot via sending a crafted MQTT message.
๐@cveNotify
GitHub
CVE-Vendor-Coordination/TOTOLINK/20260416_T6_vuln_report.pdf at main ยท ShengWu00/CVE-Vendor-Coordination
Contribute to ShengWu00/CVE-Vendor-Coordination development by creating an account on GitHub.
๐จ CVE-2026-82018
IGEL OS 12 before 12.9.0, 12.8.3 LTS and IGEL OS 11 before 11.11.150 contain a secure boot bypass vulnerability in the GRUB boot stage that allows physically present attackers to gain unauthorized root access by placing an unsigned empty file named igel.conf on a partition. Attackers can exploit GRUB's fail-open signature verification behavior to drop into an interactive GRUB prompt, then boot the device's own kernel with additional command-line arguments to obtain a root shell with the disk unlocked while leaving TPM PCR values unaltered.
๐@cveNotify
IGEL OS 12 before 12.9.0, 12.8.3 LTS and IGEL OS 11 before 11.11.150 contain a secure boot bypass vulnerability in the GRUB boot stage that allows physically present attackers to gain unauthorized root access by placing an unsigned empty file named igel.conf on a partition. Attackers can exploit GRUB's fail-open signature verification behavior to drop into an interactive GRUB prompt, then boot the device's own kernel with additional command-line arguments to obtain a root shell with the disk unlocked while leaving TPM PCR values unaltered.
๐@cveNotify
Amberwolf
Thin Client? Thin Crypto: An overview.
AmberWolf Security Research Blog
๐จ CVE-2026-82451
Formwork through 2.3.14 contains a stored cross-site scripting vulnerability in visit tracking that records the Referer header host unescaped. Unauthenticated attackers can craft malicious Referer headers to inject markup that executes in administrator browsers when viewing the Statistics panel.
๐@cveNotify
Formwork through 2.3.14 contains a stored cross-site scripting vulnerability in visit tracking that records the Referer header host unescaped. Unauthenticated attackers can craft malicious Referer headers to inject markup that executes in administrator browsers when viewing the Statistics panel.
๐@cveNotify
GitHub
GitHub - getformwork/formwork: ๐ Formwork is a simple, fast and flexible flat-file CMS that allows you to create and manage websitesโฆ
๐ Formwork is a simple, fast and flexible flat-file CMS that allows you to create and manage websites without the need for a database - getformwork/formwork
๐จ CVE-2026-82456
argocd-mcp 0.8.0 binds its HTTP transport to every network interface and accepts MCP sessions without requiring caller credentials when ARGOCD_API_TOKEN is configured. Attackers who can reach the listener can invoke the full tool surface using the operator's stored token to create applications, request syncs, and modify Argo CD resources.
๐@cveNotify
argocd-mcp 0.8.0 binds its HTTP transport to every network interface and accepts MCP sessions without requiring caller credentials when ARGOCD_API_TOKEN is configured. Attackers who can reach the listener can invoke the full tool surface using the operator's stored token to create applications, request syncs, and modify Argo CD resources.
๐@cveNotify
GitHub
GitHub - argoproj-labs/mcp-for-argocd: An implementation of Model Context Protocol (MCP) server for Argo CD.
An implementation of Model Context Protocol (MCP) server for Argo CD. - argoproj-labs/mcp-for-argocd
๐จ CVE-2026-82463
pac4j-core before 6.5.6 contains an authentication bypass vulnerability in CheckProfileTypeAuthorizer that reverses the profile type validation logic. Attackers can authenticate through a weaker client and access resources requiring a stronger profile type by satisfying generic profile checks.
๐@cveNotify
pac4j-core before 6.5.6 contains an authentication bypass vulnerability in CheckProfileTypeAuthorizer that reverses the profile type validation logic. Attackers can authenticate through a weaker client and access resources requiring a stronger profile type by satisfying generic profile checks.
๐@cveNotify
GitHub
GitHub - pac4j/pac4j: Security engine for Java (authentication, authorization, multi frameworks): OpenID Connect, SAML2, CAS, OAuthโฆ
Security engine for Java (authentication, authorization, multi frameworks): OpenID Connect, SAML2, CAS, OAuth, LDAP, JWT... - pac4j/pac4j
๐จ CVE-2026-82468
Rodauth before 2.47.0 contains a cross-site request forgery protection bypass vulnerability in the JSON request content type validation. Attackers can craft cross-origin form posts with content types containing application/json substrings to bypass CSRF token validation and force victims to authenticate to attacker-controlled accounts.
๐@cveNotify
Rodauth before 2.47.0 contains a cross-site request forgery protection bypass vulnerability in the JSON request content type validation. Attackers can craft cross-origin form posts with content types containing application/json substrings to bypass CSRF token validation and force victims to authenticate to attacker-controlled accounts.
๐@cveNotify
GitHub
GitHub - jeremyevans/rodauth: Ruby's Most Advanced Authentication Framework
Ruby's Most Advanced Authentication Framework. Contribute to jeremyevans/rodauth development by creating an account on GitHub.
๐จ CVE-2026-82641
Keploy versions 3.1.0 through 3.6.25, fixed in 3.6.26, bind the agent control-plane HTTP server to all interfaces without authentication, exposing endpoints that stream TLS session keys and traffic data. Attackers can access the /agent/pcap/keylog endpoint to retrieve NSS keylog lines and decrypt recorded TLS traffic, or invoke /agent/stop and /agent/storemocks to manipulate recording sessions.
๐@cveNotify
Keploy versions 3.1.0 through 3.6.25, fixed in 3.6.26, bind the agent control-plane HTTP server to all interfaces without authentication, exposing endpoints that stream TLS session keys and traffic data. Attackers can access the /agent/pcap/keylog endpoint to retrieve NSS keylog lines and decrypt recorded TLS traffic, or invoke /agent/stop and /agent/storemocks to manipulate recording sessions.
๐@cveNotify
GitHub
fix(agent): bind control-plane HTTP server to loopback only (#4451) ยท keploy/keploy@a6257d2
* fix(agent): bind control-plane HTTP server to loopback only
The agent's control-plane HTTP server carries no authentication.
GET /agent/pcap/keylog streams live TLS session keys, POST /a...
The agent's control-plane HTTP server carries no authentication.
GET /agent/pcap/keylog streams live TLS session keys, POST /a...
๐จ CVE-2026-51705
Incorrect access control in the setWiFiMeshName function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to rename mesh entries via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
๐@cveNotify
Incorrect access control in the setWiFiMeshName function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to rename mesh entries via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
๐@cveNotify
GitHub
CVE-Vendor-Coordination/TOTOLINK/README.md at main ยท ShengWu00/CVE-Vendor-Coordination
Contribute to ShengWu00/CVE-Vendor-Coordination development by creating an account on GitHub.
๐จ CVE-2026-51750
Incorrect access control in the updatePriChannel function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to rescan and switch the primary mesh channel via sending a crafted MQTT message to the cs_broker component.
๐@cveNotify
Incorrect access control in the updatePriChannel function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to rescan and switch the primary mesh channel via sending a crafted MQTT message to the cs_broker component.
๐@cveNotify
GitHub
CVE-Vendor-Coordination/TOTOLINK/README.md at main ยท ShengWu00/CVE-Vendor-Coordination
Contribute to ShengWu00/CVE-Vendor-Coordination development by creating an account on GitHub.
๐จ CVE-2026-51757
Incorrect access control in the meshSlaveUpdate function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to start a firmware download or flash workflow on the slave device via sending a crafted MQTT message to the cs_broker component.
๐@cveNotify
Incorrect access control in the meshSlaveUpdate function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to start a firmware download or flash workflow on the slave device via sending a crafted MQTT message to the cs_broker component.
๐@cveNotify
GitHub
CVE-Vendor-Coordination/TOTOLINK/README.md at main ยท ShengWu00/CVE-Vendor-Coordination
Contribute to ShengWu00/CVE-Vendor-Coordination development by creating an account on GitHub.
๐จ CVE-2026-51764
Incorrect access control in the recvSlaveCloudCheckStatus function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to overwrite cloud-result tracking files via sending a crafted MQTT message to the cs_broker component.
๐@cveNotify
Incorrect access control in the recvSlaveCloudCheckStatus function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to overwrite cloud-result tracking files via sending a crafted MQTT message to the cs_broker component.
๐@cveNotify
GitHub
CVE-Vendor-Coordination/TOTOLINK/README.md at main ยท ShengWu00/CVE-Vendor-Coordination
Contribute to ShengWu00/CVE-Vendor-Coordination development by creating an account on GitHub.
๐จ CVE-2026-51769
Incorrect access control in the remoteCloudUpdateCheck function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to restart the cloud update check workflow via sending a crafted MQTT message to the cs_broker component.
๐@cveNotify
Incorrect access control in the remoteCloudUpdateCheck function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to restart the cloud update check workflow via sending a crafted MQTT message to the cs_broker component.
๐@cveNotify
GitHub
CVE-Vendor-Coordination/TOTOLINK/README.md at main ยท ShengWu00/CVE-Vendor-Coordination
Contribute to ShengWu00/CVE-Vendor-Coordination development by creating an account on GitHub.
๐จ CVE-2026-19591
OpenAI Codex CLI for Windows, macOS, and Linux and Codex Desktop for Windows and macOS misclassified certain PowerShell commands as safe because their command-safety parser interpreted PowerShell's stop-parsing token (--%) differently than PowerShell itself. If a user opens an attacker-prepared repository and Codex follows its instructions, Codex can run a file-writing Git command without requesting user approval. On macOS and Linux, exploitation additionally requires separately installed PowerShell Core (pwsh) to be invoked. If filesystem protections permit the write, the command can modify Codex's configuration. If Codex later loads the modified configuration, it can launch an attacker-controlled MCP server and execute code with the user's privileges, allowing it to read, change, or delete files accessible to that account. The approval bypass does not disable filesystem sandboxing; the default filesystem sandbox on macOS and Linux can prevent writes outside permitted locations.
๐@cveNotify
OpenAI Codex CLI for Windows, macOS, and Linux and Codex Desktop for Windows and macOS misclassified certain PowerShell commands as safe because their command-safety parser interpreted PowerShell's stop-parsing token (--%) differently than PowerShell itself. If a user opens an attacker-prepared repository and Codex follows its instructions, Codex can run a file-writing Git command without requesting user approval. On macOS and Linux, exploitation additionally requires separately installed PowerShell Core (pwsh) to be invoked. If filesystem protections permit the write, the command can modify Codex's configuration. If Codex later loads the modified configuration, it can launch an attacker-controlled MCP server and execute code with the user's privileges, allowing it to read, change, or delete files accessible to that account. The approval bypass does not disable filesystem sandboxing; the default filesystem sandbox on macOS and Linux can prevent writes outside permitted locations.
๐@cveNotify
GitHub
[codex] treat PowerShell stop-parsing forms as unsupported by bookholt-oai ยท Pull Request #22643 ยท openai/codex
Summary
Treat PowerShell stop-parsing token forms as unsupported in the AST-backed command flattener.
Add focused regressions at the parser layer and Windows command-safety layer.
Why
The command...
Treat PowerShell stop-parsing token forms as unsupported in the AST-backed command flattener.
Add focused regressions at the parser layer and Windows command-safety layer.
Why
The command...
๐จ CVE-2026-51974
An eval() injection vulnerability in the get_list function in modules/meta_parser.py in lllyasviel Fooocus 2.1.854 through 2.5.5 allows remote attackers to execute arbitrary Python code via a crafted styles payload in the EXIF metadata of an uploaded image file.
๐@cveNotify
An eval() injection vulnerability in the get_list function in modules/meta_parser.py in lllyasviel Fooocus 2.1.854 through 2.5.5 allows remote attackers to execute arbitrary Python code via a crafted styles payload in the EXIF metadata of an uploaded image file.
๐@cveNotify
GitHub
Fooocus/modules/meta_parser.py at main ยท lllyasviel/Fooocus
Focus on prompting and generating. Contribute to lllyasviel/Fooocus development by creating an account on GitHub.
๐จ CVE-2026-52131
llama.cpp b5693 and before has a Reachable Assertion via the gguf_reader::read function.
๐@cveNotify
llama.cpp b5693 and before has a Reachable Assertion via the gguf_reader::read function.
๐@cveNotify
Ph4nt0m
llama.cpp json-schema-to-grammar ๋ฌด์ ์ด ์ฌ๊ท DoS
llama.cpp <=b5693์ common/json-schema-to-grammar.cpp์ ๋ฌด์ ์ด ์ฌ๊ท๋ก ์ธํด ์๋น์ค ๊ฑฐ๋ถ(DoS)์ ์ทจ์ฝํฉ๋๋ค. POST /completions ๊ฒฝ๋ก๋ง ์ํฅ์ ๋ฐ์ต๋๋ค.
๐จ CVE-2026-73716
A remote code execution vulnerability exists in the underlying operating system of HPE Networking Fabric Composer that could allow an unauthenticated remote attacker to run arbitrary commands on the underlying host if certain preconditions outside of the attacker's control are met. Successful exploitation could allow an attacker to execute arbitrary commands as a privileged user on the underlying operating system, leading to complete compromise of the HPE Networking Fabric Composer host.
๐@cveNotify
A remote code execution vulnerability exists in the underlying operating system of HPE Networking Fabric Composer that could allow an unauthenticated remote attacker to run arbitrary commands on the underlying host if certain preconditions outside of the attacker's control are met. Successful exploitation could allow an attacker to execute arbitrary commands as a privileged user on the underlying operating system, leading to complete compromise of the HPE Networking Fabric Composer host.
๐@cveNotify
๐จ CVE-2026-73717
A command injection vulnerability exists in the web-based management interface of HPE Networking Fabric Composer that could allow an unauthenticated remote attacker to run arbitrary commands on the underlying host if certain preconditions outside of the attacker's control are met. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system leading to complete system compromise.
๐@cveNotify
A command injection vulnerability exists in the web-based management interface of HPE Networking Fabric Composer that could allow an unauthenticated remote attacker to run arbitrary commands on the underlying host if certain preconditions outside of the attacker's control are met. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system leading to complete system compromise.
๐@cveNotify
๐จ CVE-2026-73728
Denial-of-service vulnerabilities exist in the API of HPE Networking Fabric Composer that could allow an authenticated low privilege operator user to cause a denial of service. Successful exploitation could allow an attacker to interrupt the normal operation of the affected service.
๐@cveNotify
Denial-of-service vulnerabilities exist in the API of HPE Networking Fabric Composer that could allow an authenticated low privilege operator user to cause a denial of service. Successful exploitation could allow an attacker to interrupt the normal operation of the affected service.
๐@cveNotify