https://vulnogram.org/ Most recent CVEs assigned by CERT.PL (cert-pl). https://vulnogram.org/seaview/icons/cert-pl.png https://vulnogram.org/ Wed, 21 Oct 2026 07:00:06 GMT https://vulnogram.org/CVE-2026-106030 https://vulnogram.org/CVE-2026-106030 NordVPN for Windows allows local attackers to stop unprotected Windows system services and change their startup type to Manual via named pipes. The NordVPN user-mode application allows a low-privileged attacker to act as a trusted process and connect… Medium Fri, 16 Oct 2026 09:47:20 GMT https://vulnogram.org/CVE-2026-88794 https://vulnogram.org/CVE-2026-88794 Enterprise Architect is vulnerable to XML External Entity (XXE) injection in the XSLT Debugger feature. When a user loads a crafted XML file containing a `DOCTYPE` with an external DTD reference, the parser processes external entities, allowing an at… High Network Exploitable Thu, 15 Oct 2026 12:24:54 GMT https://vulnogram.org/CVE-2026-63315 https://vulnogram.org/CVE-2026-63315 WebCTI service for Slican IPx telephone exchanges stores temporary subscriber password in plaintext. An attacker with access to the database can obtain the user's password and log in to the subscriber's account. This issue was fixed in IPx series ver… High Network Exploitable Thu, 15 Oct 2026 09:00:45 GMT https://vulnogram.org/CVE-2026-63314 https://vulnogram.org/CVE-2026-63314 WebCTI service for Slican IPx telephone exchanges is vulnerable to SQL Injection in /webcti/admin_json.php enpoint. Improper neutralization of input allows an authenticated attacker to execute SQL Injection attacks. This issue was fixed in IPx series… High Thu, 15 Oct 2026 09:00:40 GMT https://vulnogram.org/CVE-2026-35088 https://vulnogram.org/CVE-2026-35088 Slican telephone exchanges use symmetric encryption for TCP/IP communication. Secret key is hardcoded in multiple binary files. An attacker who has access to these files can decrypt the communication. This issue was fixed in IPx series version 6.62.0… High Network Exploitable Thu, 15 Oct 2026 09:00:35 GMT https://vulnogram.org/CVE-2026-63316 https://vulnogram.org/CVE-2026-63316 A SQL injection vulnerability has been identified in Payload CMS. Improper neutralization of input provided by user into "in" and "not_in" query paramethers allows an authenticated attacker to perform SQL Injection attacks. This issue was fixed in ve… High Tue, 13 Oct 2026 11:05:09 GMT https://vulnogram.org/CVE-2026-103663 https://vulnogram.org/CVE-2026-103663 Ollama is vulnerable to path traversal in the `/api/pull` endpoint due to insufficient validation of layer digests by the `digestToPath` function. An unauthenticated remote attacker can specify a path traversal sequence as a layer digest, causing a m… Critical Network Exploitable Thu, 08 Oct 2026 13:19:04 GMT https://vulnogram.org/CVE-2026-75820 https://vulnogram.org/CVE-2026-75820 GNU Aspell contains an integer truncation vulnerability in the WritableDict::add() function in modules/speller/default/writable.cpp. When loading a personal wordlist, the word length is stored as a single byte, causing truncation for words whose leng… Low Tue, 06 Oct 2026 10:57:59 GMT https://vulnogram.org/CVE-2026-75819 https://vulnogram.org/CVE-2026-75819 GNU Aspell contains an out-of-bounds read vulnerability in ReadOnlyDict::load() in readonly_ws.cpp. When loading a binary .rws dictionary file, it uses offset fields from the file header as byte indices into a heap buffer without validating their bou… Low Tue, 06 Oct 2026 10:57:56 GMT https://vulnogram.org/CVE-2026-75818 https://vulnogram.org/CVE-2026-75818 GNU Aspell prezip-bin contains a heap-based buffer overflow vulnerability in the decompressor in prog/prezip.c. The decompressor does not properly check buffer space, so a crafted compressed file can cause out-of-bounds read and write operations on t… Low Tue, 06 Oct 2026 10:57:52 GMT https://vulnogram.org/CVE-2026-91784 https://vulnogram.org/CVE-2026-91784 cjbassi/gotop is vulnerable to local argument injection via process termination functionality. The process name is passed directly to pkill without sanitization. A local attacker can create a process with a crafted name beginning with -- (e.g. contai… Medium Unsupported When Assigned Fri, 02 Oct 2026 08:38:42 GMT https://vulnogram.org/CVE-2026-74865 https://vulnogram.org/CVE-2026-74865 sogo_yhn configures SOGo with a parameter "SOGoTrustProxyAuthentication=YES". This causes the password to be bypassed during HTTP Basic authentication. An unauthenticated attacker who provides the username of an existing user and any arbitrary passwo… Critical Network Exploitable Wed, 30 Sep 2026 12:02:40 GMT https://vulnogram.org/CVE-2026-74864 https://vulnogram.org/CVE-2026-74864 sogo_yhn configures SOGo with a parameter that forces the request with HTTP header "x-webobjects-remote-user" to be treated as sent by a verified user without performing password validation. Since Nginx does not strip this header, any client can supp… Critical Network Exploitable Wed, 30 Sep 2026 12:02:29 GMT https://vulnogram.org/CVE-2026-41875 https://vulnogram.org/CVE-2026-41875 Quick.Cart is vulnerable to Cross-Site Request Forgery in admin config panel. Malicious attacker can craft special website, which when visited by the admin, will automatically send a POST request that changes admin's login and password. This software… Medium Network Exploitable Tue, 29 Sep 2026 11:43:40 GMT https://vulnogram.org/CVE-2026-85520 https://vulnogram.org/CVE-2026-85520 Google Merchant Center Feed (gmfeed) module for PrestaShop is vulnerable to unauthenticated arbitrary file write in the feed.php endpoint. An unauthenticated attacker can send a crafted request that controls the output file name, path, extension, and… Critical Known Exploited Network Exploitable Tue, 29 Sep 2026 11:28:55 GMT https://vulnogram.org/CVE-2026-19547 https://vulnogram.org/CVE-2026-19547 Ghostscript for Windows is vulnerable to local privilege escalation through PostScript resource file hijacking. Due to the application searching for PostScript resource files in predictable paths under C:\\gs\\ that do not exist by default on Windows… High Tue, 29 Sep 2026 10:13:31 GMT https://vulnogram.org/CVE-2026-15390 https://vulnogram.org/CVE-2026-15390 Das U-Boot with CONFIG_IP_DEFRAG=y parameter fails to clear IP reassembly state after delivering a complete datagram. An attacker who can deliver fragmented IP traffic can execute arbitrary code by sending duplicated last-fragment IP packets. This is… Critical Tue, 29 Sep 2026 10:04:31 GMT https://vulnogram.org/CVE-2026-73642 https://vulnogram.org/CVE-2026-73642 Dayforce ESS Excelity is vulnerable to Path Traversal in file download functionality. An unauthenticated attacker can sent GET request with file path parameter set to any path including an absolute local file path. This issue was fixed in version V4. Critical Network Exploitable Mon, 28 Sep 2026 13:12:46 GMT https://vulnogram.org/CVE-2026-73641 https://vulnogram.org/CVE-2026-73641 Dayforce ESS Excelity is vulnerable to Reflected XSS in multiple endpoints. An attacker can prepare a specially crafted URL that, when opened, results in arbitrary JavaScript execution in the victim's browser. This issue was fixed in version V4. Medium Network Exploitable Mon, 28 Sep 2026 13:12:41 GMT https://vulnogram.org/CVE-2026-73640 https://vulnogram.org/CVE-2026-73640 Dayforce ESS Excelity is vulnerable to Time Based-Blind SQL Injection in password recovery functionality. The unauthenticated attacker can prepare GET request with one of the parameters filled in with an arbitrary SQL query. The parameter is interpre… Critical Network Exploitable Mon, 28 Sep 2026 13:12:34 GMT https://vulnogram.org/CVE-2026-52749 https://vulnogram.org/CVE-2026-52749 The Kaon AR2140X router improperly issues session cookies in responses to unauthenticated HTTP requests. This vulnerability allows a remote attacker to obtain a valid session identifier without providing credentials, resulting in an authentication by… Medium Mon, 28 Sep 2026 13:01:59 GMT https://vulnogram.org/CVE-2026-52748 https://vulnogram.org/CVE-2026-52748 The Kaon AR2140X router contains a vulnerability where the backup functionality is accessible without authentication. This allows an unauthenticated remote attacker to trigger a configuration backup and retrieve it in a form encrypted by a device-spe… High Mon, 28 Sep 2026 13:01:54 GMT https://vulnogram.org/CVE-2026-82936 https://vulnogram.org/CVE-2026-82936 mH-DEVELOPER smart home module is vulnerable to Denial of Service due to uncontrolled resource consumption. The Express bodyParser is configured with a 250 MB limit for JSON and URL-encoded request bodies. An authenticated attacker on the LAN can sen… Medium Mon, 28 Sep 2026 12:12:28 GMT https://vulnogram.org/CVE-2026-82935 https://vulnogram.org/CVE-2026-82935 mH-DEVELOPER smart home module ships with an end-of-life, unsupported Debian 8 and Node.js runtime v17.0.1 in its production firmware. This exposes the device to publicly known vulnerabilities that will not receive security patches. An attacker could… Medium Network Exploitable Mon, 28 Sep 2026 12:12:21 GMT https://vulnogram.org/CVE-2026-82933 https://vulnogram.org/CVE-2026-82933 mH-DEVELOPER smart home module sends its web interface and API traffic over unencrypted HTTP. Passwords, authentication tokens, and device commands are transmitted in cleartext. An attacker on the same network can intercept this traffic, steal creden… Medium Mon, 28 Sep 2026 12:12:13 GMT https://vulnogram.org/CVE-2026-82932 https://vulnogram.org/CVE-2026-82932 mH-DEVELOPER smart home module does not load any firewall rules at startup. This leaves all listening services, including SSH, HTTP, WebSocket, and Node-RED, fully exposed on the LAN without access control. Any client on the same network can reach ev… Medium Mon, 28 Sep 2026 12:12:06 GMT https://vulnogram.org/CVE-2026-82930 https://vulnogram.org/CVE-2026-82930 mH-DEVELOPER smart home module does not verify tokens in its authorization middleware, leaving all HTTP API and WebSocket endpoints accessible without authentication. An unauthenticated attacker on the LAN can query these endpoints, access system inf… Medium Mon, 28 Sep 2026 12:11:59 GMT https://vulnogram.org/CVE-2026-82929 https://vulnogram.org/CVE-2026-82929 mH-DEVELOPER smart home module uses the same hard-coded SSH host keys on every device, with no per-device key generation. An attacker who extracts these keys from the firmware can set up a rogue SSH server that clients will trust without warning, ena… Medium Network Exploitable Mon, 28 Sep 2026 12:11:47 GMT https://vulnogram.org/CVE-2026-82928 https://vulnogram.org/CVE-2026-82928 mH-DEVELOPER smart home module contains a hardcoded SSH public key in /root/.ssh/authorized_keys, serving as a potential backdoor. The SSH daemon allows root login via key authentication and starts automatically. An attacker with the matching private… High Mon, 28 Sep 2026 12:11:40 GMT https://vulnogram.org/CVE-2026-92419 https://vulnogram.org/CVE-2026-92419 WEBCON BPS is vulnerable to Insecure Direct Object Reference (IDOR) in the /api/vacations/{path} endpoint. The selectedPeople parameter in the Gantt vacation chart API does not validate whether the requesting user is authorized to access the requeste… Medium Wed, 23 Sep 2026 14:41:08 GMT https://vulnogram.org/CVE-2026-58147 https://vulnogram.org/CVE-2026-58147 WNC T-Mobile 5G Box IDU router contains an OS command injection vulnerability in the portal.cgi component's password change functionality. The application improperly neutralizes special elements in the http_passwd_hidden and http_passwdConfirm_hidden… Critical Wed, 16 Sep 2026 11:21:16 GMT https://vulnogram.org/CVE-2026-58146 https://vulnogram.org/CVE-2026-58146 WNC T-Mobile 5G Box IDU router is vulnerable to OS command injection vulnerability. The vulnerability exists within the /cgi-bin/portal.cgi endpoint, specifically through the cli_cookie POST parameter. The cli_cookie parameter value is directly conca… Critical Wed, 16 Sep 2026 11:21:15 GMT https://vulnogram.org/CVE-2026-40857 https://vulnogram.org/CVE-2026-40857 WNC T-Mobile 5G Box IDU router contains a cross-site request forgery (CSRF) vulnerability in the portal.cgi component. The anti-CSRF mechanism fails to validate the csrf_token_value parameter, accepting any arbitrary value as valid. This allows a rem… High Wed, 16 Sep 2026 11:21:14 GMT https://vulnogram.org/CVE-2026-40856 https://vulnogram.org/CVE-2026-40856 WNC T-Mobile 5G Box IDU router is vulnerable to improper access control. The vulnerability exists in the wnc_maccheck.cgi endpoint, which is accessible without authentication. It allows a remote attacker to retrieve sensitive configuration data, incl… High Wed, 16 Sep 2026 11:21:13 GMT https://vulnogram.org/CVE-2026-40855 https://vulnogram.org/CVE-2026-40855 WNC T-Mobile 5G Box IDU router is vulnerable to a command injection. The vulnerability exists in the ping functionality within the /cgi-bin/portal.cgi endpoint, specifically affecting the ping_ip, ping_size, and ping_times POST parameters. The root c… Critical Wed, 16 Sep 2026 11:21:11 GMT https://vulnogram.org/CVE-2026-40854 https://vulnogram.org/CVE-2026-40854 WNC T-Mobile 5G Box IDU router contains an authentication bypass vulnerability in the portal.cgi component. The session verification mechanism improperly validates the sessionid cookie by checking for the existence of a corresponding file in /tmp/log… High Wed, 16 Sep 2026 11:21:10 GMT https://vulnogram.org/CVE-2026-15600 https://vulnogram.org/CVE-2026-15600 Alior Bank PrestaShop module "raty" for commercial partners is vulnerable to SQL Injection in the toggleCategoryPromotionAction method. The module inserts value of the POST parameter "status" into SQL UPDATE queries without any sanitization or valida… High Mon, 14 Sep 2026 14:09:38 GMT https://vulnogram.org/CVE-2026-7848 https://vulnogram.org/CVE-2026-7848 Alior Bank PrestaShop module "raty" for commercial partners is vulnerable to SQL Injection in the "hookActionObjectProductUpdateBefore", "hookActionObjectCategoryUpdateBefore", and "hookActionObjectCategoryAddAfter" hook methods. The module inserts v… High Mon, 14 Sep 2026 14:09:34 GMT https://vulnogram.org/CVE-2026-17038 https://vulnogram.org/CVE-2026-17038 DrEryk Gabinet before 11.5.0 uses hard-coded API credentials in its ticket reporting component. These credentials can be used to authenticate directly to the ticket system API. This allows an attacker to perform privileged operations beyond what is o… Medium Network Exploitable Thu, 10 Sep 2026 12:02:12 GMT https://vulnogram.org/CVE-2026-86060 https://vulnogram.org/CVE-2026-86060 RouterOS contains an argument-handling flaw in the SSH login path involving usernames that begin with a prohibited character, allowing for the trusted RouterOS policy mask to be changed, leading to privilege escalation. Exploitation requires an unaut… Critical Known Exploited Network Exploitable Sat, 05 Sep 2026 20:00:59 GMT https://vulnogram.org/CVE-2026-67281 https://vulnogram.org/CVE-2026-67281 RouterOS WebFig contains an unauthenticated file-read vulnerability in the /jsproxy path where a newly allocated session retains a stale uninitialized principal pointer used for file authorization. An unauthenticated attacker can prepare the allocato… High Network Exploitable Sat, 05 Sep 2026 20:00:58 GMT https://vulnogram.org/CVE-2026-67279 https://vulnogram.org/CVE-2026-67279 RouterOS SSH enters the connection protocol after a client-requested rekey even though user authentication was never attempted, allowing an unauthenticated client to open a session channel and send an exec request. On affected builds the server dispa… Medium Known Exploited Network Exploitable Sat, 05 Sep 2026 20:00:57 GMT https://vulnogram.org/CVE-2026-67278 https://vulnogram.org/CVE-2026-67278 MikroTik RouterOS accepts malformed RSA/PKCS#1 v1.5 signatures across RSA-based services, including TLS/X.509 certificate validation and SSH host-key authentication. Because its trust store includes an e=3 root CA, an attacker controlling or redirect… Medium Network Exploitable Sat, 05 Sep 2026 20:00:57 GMT https://vulnogram.org/CVE-2026-67277 https://vulnogram.org/CVE-2026-67277 RouterOS accepts a "related" btest connection before the corresponding primary session has completed authentication. An unauthenticated client can use this state to start an IPv4 UDP test. With "random-data=false", the sender transmits an uninitializ… High Known Exploited Network Exploitable Sat, 05 Sep 2026 20:00:56 GMT https://vulnogram.org/CVE-2026-67276 https://vulnogram.org/CVE-2026-67276 RouterOS does not compare the complete RSA public key when matching an SSH authentication request to an authorized user key, checking the key type and modulus but omitting the exponent. Because signature verification uses the client-supplied key, an… Critical Network Exploitable Sat, 05 Sep 2026 20:00:55 GMT https://vulnogram.org/CVE-2026-15933 https://vulnogram.org/CVE-2026-15933 OptimiDoc Server (On-Premise) stores credentials for external services in cleartext. An authenticated administrator can view previously configured service passwords, including SMTP, FTP (for scan delivery), Active Directory (for user list import), an… Medium Thu, 03 Sep 2026 10:09:33 GMT https://vulnogram.org/CVE-2026-56651 https://vulnogram.org/CVE-2026-56651 Dool in versions up to 1.3.8 is vulnerable to symlink following when the "--devel" flag is used, as the application opens a log file without the "O_NOFOLLOW" flag. A local attacker can exploit this by creating a symlink at the expected log file path… Low Thu, 27 Aug 2026 13:22:17 GMT https://vulnogram.org/CVE-2026-56652 https://vulnogram.org/CVE-2026-56652 Dool in versions up to 1.3.8 is vulnerable to a CSV injection vulnerability when exporting data to a CSV file, as it fails to sanitize cell content beginning with special formula characters like =, +, -, or @. A local attacker can exploit this by run… Medium Thu, 27 Aug 2026 13:22:13 GMT https://vulnogram.org/CVE-2026-16599 https://vulnogram.org/CVE-2026-16599 GNU wget is vulnerable to denial of service in its FTP OPIE/S-KEY authentication functionality. The server-supplied sequence number from the FTP challenge line is used as an iteration count for an MD5 key-derivation loop without any upper bound valid… Medium Network Exploitable Tue, 25 Aug 2026 14:17:04 GMT https://vulnogram.org/CVE-2025-63080 https://vulnogram.org/CVE-2025-63080 Firmware in KAON PG5298A and PG5298B routers allow an authenticated user to send crafted JSON-RPC requests and perform operations not possible via GUI, e.g. system file read or command execution. This vulnerability has been fixed in firmware version:… High Mon, 24 Aug 2026 11:11:24 GMT