https://vulnogram.org/ Most recent CVEs assigned by CERT/CC (certcc). https://vulnogram.org/seaview/icons/certcc.png https://vulnogram.org/ Wed, 21 Oct 2026 07:00:06 GMT https://vulnogram.org/CVE-2026-107692 https://vulnogram.org/CVE-2026-107692 The War Thunder game client transmits its authentication bearer token (auth_jwt) in the very first data packet after the TCP handshake, using only LZ4 compression rather than encryption. An attacker positioned on the network path can passively interc… Medium Network Exploitable Tue, 20 Oct 2026 19:49:57 GMT https://vulnogram.org/CVE-2026-97406 https://vulnogram.org/CVE-2026-97406 XERJ Console API bearer tokens can bypass the passkey‑only authentication requirement and directly invoke the API‑token creation endpoint, allowing unauthorized minting of persistent successor credentials. Tue, 20 Oct 2026 18:11:08 GMT https://vulnogram.org/CVE-2026-110746 https://vulnogram.org/CVE-2026-110746 A local privilege escalation vulnerability in TotalAV allows an unprivileged local user to forge the gRPC IPC authentication token, through loading IPC.dll and abuse the SYSTEM service's within TotalAV to execute arbitrary code as NT AUTHORITY\SYSTEM… High Thu, 15 Oct 2026 14:08:27 GMT https://vulnogram.org/CVE-2026-110005 https://vulnogram.org/CVE-2026-110005 The `periphery` agent's container-management functionality of Komodo version 2.2.0 contains an OS command injection vulnerability. An authenticated low-privileged user with `Execute`, or `Read` plus `Logs`, permission on a managed server can supply s… High Tue, 13 Oct 2026 19:23:52 GMT https://vulnogram.org/CVE-2026-16753 https://vulnogram.org/CVE-2026-16753 Incorrect authorization in the library-query execution endpoint in Lowcoder version, up to and including 2.4.10, allows an authenticated administrator or developer in one organization to execute a library query belonging to another organization via a… High Tue, 13 Oct 2026 19:21:10 GMT https://vulnogram.org/CVE-2026-104937 https://vulnogram.org/CVE-2026-104937 Shopware version 6.7 allows the upload of attacker‑controlled HTML files and serves them as text/html without effective security headers, enabling stored cross-site scripting (XSS). When a malicious uploaded file containing an embedded JavaScript pay… High Network Exploitable Tue, 13 Oct 2026 18:15:10 GMT https://vulnogram.org/CVE-2026-84286 https://vulnogram.org/CVE-2026-84286 ExLlamaV3’s EXL3 loader uses an untrusted, model-supplied index to select a CUDA kernel without first verifying that the index is within bounds. A malicious model can force the code to read and invoke an out‑of‑range function pointer, resulting in a… Critical Network Exploitable Mon, 12 Oct 2026 17:01:16 GMT https://vulnogram.org/CVE-2026-107248 https://vulnogram.org/CVE-2026-107248 Thelia 3.0.0's back-office Email/Messages feature contains a server‑side template injection (SSTI) flaw that allows any authenticated user with the “Messages” permission to supply unsandboxed Twig templates, which are then compiled and executed as ra… High Mon, 12 Oct 2026 15:06:55 GMT https://vulnogram.org/CVE-2026-103537 https://vulnogram.org/CVE-2026-103537 Thelia 2.6.1 contains an absolute path traversal vulnerability in its Smarty template handling that enables SSTI and remote code execution. The `checkTemplate()` validation restricts relative directory traversal sequences such as `../` but does not r… Medium Mon, 12 Oct 2026 14:56:21 GMT https://vulnogram.org/CVE-2026-103535 https://vulnogram.org/CVE-2026-103535 Thelia v2.6.1 contains path traversal and PHP code injection vulnerabilities in its translation editor that can be chained to achieve remote code execution. The `item_name` parameter, used to build the translation file's write path, does not sanitize… High Mon, 12 Oct 2026 14:55:58 GMT https://vulnogram.org/CVE-2026-103529 https://vulnogram.org/CVE-2026-103529 Thelia v2.6.0 permits authenticated administrators to upload and install modules via the ZIP upload function without validating or sandboxing embedded PHP code. An attacker can include malicious PHP code in a module's `install()` method which will th… Medium Mon, 12 Oct 2026 14:55:38 GMT https://vulnogram.org/CVE-2026-103528 https://vulnogram.org/CVE-2026-103528 Thelia 2.6.0 uses Smarty for email templates without properly restricting access to dangerous PHP functions. An authenticated administrator can inject malicious Smarty expressions into email templates via the messages configuration interface, and whe… Medium Mon, 12 Oct 2026 14:55:14 GMT https://vulnogram.org/CVE-2026-103527 https://vulnogram.org/CVE-2026-103527 Thelia v2.6.0's Smarty templates (address.html and address-update.html) fail to properly escape double quotes in the “next” parameter, enabling reflected Cross‑Site Scripting (XSS) when an authenticated user visits the malicious link containing attac… Medium Network Exploitable Mon, 12 Oct 2026 14:54:53 GMT https://vulnogram.org/CVE-2026-103526 https://vulnogram.org/CVE-2026-103526 In Thelia v2.6.0, both the administrative login and forgotten password endpoints return different responses for invalid usernames and incorrect passwords, allowing unauthenticated attackers to enumerate valid administrator accounts. Because the endpo… Low Network Exploitable Mon, 12 Oct 2026 14:54:35 GMT https://vulnogram.org/CVE-2026-103524 https://vulnogram.org/CVE-2026-103524 Thelia v2.6.0 is vulnerable to multiple stored XSS vulnerabilities within the administrative interface. User-supplied input is stored without sufficient output encoding or sanitization and is later rendered in the administrator interface and/or the w… Medium Mon, 12 Oct 2026 14:54:16 GMT https://vulnogram.org/CVE-2026-103523 https://vulnogram.org/CVE-2026-103523 Thelia v2.6.0 contains an open redirect vulnerability in its address creation workflow. After a user accesses a crafted URL and successfully submits the “Add New Address” form, the application redirects them to the URL specified in the `next` paramet… Medium Network Exploitable Mon, 12 Oct 2026 14:53:54 GMT https://vulnogram.org/CVE-2026-103522 https://vulnogram.org/CVE-2026-103522 In Thelia v2.6.0, the store banner upload feature performs insufficient filetype validation that relies exclusively on client‑supplied MIME types. An attacker with administrative access can upload a PHP file disguised as an image to bypass validation… High Mon, 12 Oct 2026 14:53:34 GMT https://vulnogram.org/CVE-2026-103521 https://vulnogram.org/CVE-2026-103521 In Thelia v2.6.0, the document upload endpoint properly blocks the upload of executable file types, but the document update endpoint does not perform the same validation. An attacker with administrative Thelia permissions can exploit this vulnerabili… High Mon, 12 Oct 2026 14:52:56 GMT https://vulnogram.org/CVE-2026-107709 https://vulnogram.org/CVE-2026-107709 A path traversal vulnerability exists in Bower decompress-zip through version 0.3.3. The vulnerability located in `lib/decompress-zip.js` improperly validates archive entry paths during ZIP extraction. A crafted ZIP archive containing entries that re… High Thu, 08 Oct 2026 16:59:10 GMT https://vulnogram.org/CVE-2026-93034 https://vulnogram.org/CVE-2026-93034 SGLang contains an arbitrary code execution vulnerability caused by the ZMQ message decoder unconditionally deserializing PickleWrapper payloads via pickle.loads() in _maybe_unwrap_pickle without type allowlisting or authentication; this vulnerabilit… Critical Network Exploitable Thu, 08 Oct 2026 14:00:09 GMT https://vulnogram.org/CVE-2026-107202 https://vulnogram.org/CVE-2026-107202 A command injection vulnerability exists in the h-ui (version v0.0.25 and below) administrative API due to improper validation of the listen configuration field. When an authenticated administrator submits a value containing shell metacharacters, the… Critical Network Exploitable Wed, 07 Oct 2026 14:26:49 GMT https://vulnogram.org/CVE-2026-106550 https://vulnogram.org/CVE-2026-106550 Mozilla's Node-convict (version 6.2.2 and later) is vulnerable to a Denial of Service vulnerability caused by incomplete prototype‑pollution protections in config.set(). An attacker controlling the configuration key can write arbitrary properties to… High Network Exploitable Tue, 06 Oct 2026 20:09:55 GMT https://vulnogram.org/CVE-2026-106511 https://vulnogram.org/CVE-2026-106511 MultiversX's multisig-improved (repository: mx-multisig-and-modules) reference implementation of their on-chain multisig smart contract system contains a vulnerability where a missing independent authorization check allows any account with the Propos… Critical Network Exploitable Tue, 06 Oct 2026 18:52:33 GMT https://vulnogram.org/CVE-2026-82988 https://vulnogram.org/CVE-2026-82988 There exists an arbitrary file download in vCast APK delivery mechanism in ViewSonic ViewBoard unknown allows a remote, unauthenticated attacker to trigger unprivileged APK installation via serving a malicious APK URL through an unauthenticated downl… High Network Exploitable Mon, 05 Oct 2026 23:14:28 GMT https://vulnogram.org/CVE-2026-82989 https://vulnogram.org/CVE-2026-82989 There is an input injection in vCast exposed network services in ViewSonic ViewBoard that allows a remote, unauthenticated attacker to inject arbitrary input into service endpoints via network-based HTTP requests to unauthenticated endpoints Critical Network Exploitable Mon, 05 Oct 2026 23:14:14 GMT https://vulnogram.org/CVE-2026-104056 https://vulnogram.org/CVE-2026-104056 Authlib version 1.7.2 and below contains a vulnerability where discovery JSON metadata is cached without validation or issuer-origin binding. This allows a poisoned discovery response to replace all endpoint values with attacker-controlled values rat… Critical Network Exploitable Thu, 01 Oct 2026 18:03:27 GMT https://vulnogram.org/CVE-2026-96760 https://vulnogram.org/CVE-2026-96760 Authlib (v1.7.2 and below) contains a signature verification bypass vulnerability. The JsonWebSignature.deserialize_json() method accepts a JSON Serialization JWS object and returns the payload as successfully verified without checking for a signatur… Critical Network Exploitable Mon, 28 Sep 2026 19:37:58 GMT https://vulnogram.org/CVE-2026-18311 https://vulnogram.org/CVE-2026-18311 Readwise Reader for Android contains a cross-site scripting vulnerability due to missing HTML sanitization in its processing of imported document metadata. Attacker-controlled fields such as the author meta tag are inserted into a WebView via innerHT… Medium Network Exploitable Fri, 25 Sep 2026 16:27:54 GMT https://vulnogram.org/CVE-2026-18320 https://vulnogram.org/CVE-2026-18320 Readwise Reader for Android uses a sanitize-html configuration that permits all attributes on SVG and PATH elements due to a wildcard attribute rule. This configuration fails to remove script-capable attributes such as event handlers (e.g., 'onload',… Medium Network Exploitable Fri, 25 Sep 2026 16:27:37 GMT https://vulnogram.org/CVE-2026-18312 https://vulnogram.org/CVE-2026-18312 Readwise Reader for Android constructs URLs in its WebView using attacker-controlled metadata without proper encoding or escaping. The application interpolates untrusted values directly into URL strings and inserts them into the DOM via innerHTML. Be… Medium Network Exploitable Fri, 25 Sep 2026 16:27:28 GMT https://vulnogram.org/CVE-2026-75907 https://vulnogram.org/CVE-2026-75907 The door access control on a Norwegian Cruise Line asset grants entry based only on the credential's static 7-byte UID stored on an NTAG212 NFC chip. A UID is a manufacturer serial number sent in the clear on every read and is not intended to be secr… High Network Exploitable Thu, 24 Sep 2026 15:56:08 GMT https://vulnogram.org/CVE-2026-82356 https://vulnogram.org/CVE-2026-82356 Imprivata EAM <=26.2.6 lacks the ability to rotate its RSA key pair after deployment when generating an X.509 certificate. Using an RSA key pair indefinitely for certificate generation is against best practices. High Network Exploitable Wed, 23 Sep 2026 18:25:22 GMT https://vulnogram.org/CVE-2026-86867 https://vulnogram.org/CVE-2026-86867 Cinnamon's Kotaemon (all versions up to and including v0.12.0) multi-user chat interface contains multiple vulnerabilities due to incorrect authorization and improper access controls. There are four handler methods in `libs/ktem/ktem/pages/chat/contr… Medium Wed, 23 Sep 2026 17:44:52 GMT https://vulnogram.org/CVE-2026-96804 https://vulnogram.org/CVE-2026-96804 MLflow's statsmodel flavor, versions 2.1.0 to 3.14.0, omits the MLFLOW_ALLOW_PICKLE_DESERIALIZATION=False security control entirely in _load_model(), which allows a remote attacker to execute arbitrary code via a crafted MLmodel artifact. High Wed, 23 Sep 2026 16:35:05 GMT https://vulnogram.org/CVE-2026-96775 https://vulnogram.org/CVE-2026-96775 MLflow's dspy flavor, versions >= 2.0, applies the MLFLOW_ALLOW_PICKLE_DESERIALIZATION=False security control only when the model_path ends in .pkl, which allows a remote attacker to execute arbitrary code via a crafted MLmodel artifact. High Network Exploitable Wed, 23 Sep 2026 16:28:59 GMT https://vulnogram.org/CVE-2026-94574 https://vulnogram.org/CVE-2026-94574 A local cross-user code execution vulnerability exists in GNU wget (Windows builds from eternallybored.org) due to a hardcoded configuration file path (C:\msys64) that is writable by unprivileged users, allowing for arbitrary code execution via the u… High Tue, 22 Sep 2026 19:18:31 GMT https://vulnogram.org/CVE-2026-89281 https://vulnogram.org/CVE-2026-89281 The Apache Lounge Windows distribution of Apache HTTP Server build contains a hardcoded configuration path vulnerability within openssl.cnf path that can allow local code execution. High Tue, 22 Sep 2026 19:17:19 GMT https://vulnogram.org/CVE-2026-89282 https://vulnogram.org/CVE-2026-89282 The Apache Lounge Windows distribution of Apache HTTP Server build contains an insecure installation directory permissions vulnerability through its default install directory on C:\, which inherits write access for Authenticated Users. Critical Network Exploitable Tue, 22 Sep 2026 19:17:15 GMT https://vulnogram.org/CVE-2026-94570 https://vulnogram.org/CVE-2026-94570 SGLang contains a DoS vulnerability caused by missing input validation for AUX_DATA ZeroMQ control messages in the Decode worker, which enables an unauthenticated remote attacker with network reachability to the Decode control PULL socket to terminat… Medium Network Exploitable Tue, 22 Sep 2026 14:15:00 GMT https://vulnogram.org/CVE-2026-93088 https://vulnogram.org/CVE-2026-93088 SGLang's multimodal generation runtime is vulnerable to unauthenticated arbitrary code execution because the disaggregated-diffusion orchestrator's DiffusionServer binds an unauthenticated ZeroMQ ROUTER socket to a network interface and passes the fi… Critical Network Exploitable Tue, 22 Sep 2026 14:07:45 GMT https://vulnogram.org/CVE-2026-90999 https://vulnogram.org/CVE-2026-90999 Sentry Seer is vulnerable to a multi-stage trust-boundary violation that allows unauthenticated attacker-controlled telemetry to become code that is executed by an agent in a privileged automation environment. An external attacker can submit fabricat… Critical Network Exploitable Wed, 16 Sep 2026 15:45:47 GMT https://vulnogram.org/CVE-2026-91021 https://vulnogram.org/CVE-2026-91021 Trilium Notes, version v0.103.0 and earlier, contains a stored cross-site scripting (XSS) vulnerability in the share renderer for webView notes due to improper HTML escaping of user-controlled #webViewSrc values. This vulnerability allows attackers w… Medium Mon, 14 Sep 2026 17:13:51 GMT https://vulnogram.org/CVE-2026-86793 https://vulnogram.org/CVE-2026-86793 SGLang allows unauthenticated pickle deserialization through /update_weights_from_tensor when no auth keys are configured, and the SafeUnpickler policy can be bypassed because builtins.import and builtins.getattr are resolvable, enabling code executi… Critical Network Exploitable Fri, 11 Sep 2026 11:35:20 GMT https://vulnogram.org/CVE-2026-86840 https://vulnogram.org/CVE-2026-86840 The `vtoken-minting` and `slpx` pallets in Bifrost contain an improper authorization vulnerability in channel commission attribution. A signed account can supply an arbitrary registered `channel_id` when minting tokens without verifying that the call… Critical Network Exploitable Tue, 08 Sep 2026 15:29:48 GMT https://vulnogram.org/CVE-2026-84282 https://vulnogram.org/CVE-2026-84282 A Server-Side Request Forgery (SSRF) vulnerability exists in the ONLYOFFICE ownCloud Integration plugin version 9.12. The /apps/onlyoffice/ajax/settings/address endpoint does not sufficiently validate the user-supplied Document Server URL before init… Medium Tue, 08 Sep 2026 14:27:08 GMT https://vulnogram.org/CVE-2026-80047 https://vulnogram.org/CVE-2026-80047 A vulnerability in Hugging Face Transformers (versions 4.57.0 to 5.16.1) allows remote Python files to be written to local disk without user consent when using GenerativePreTrainedModel.load_custom_generate(). The function fetches and caches a remote… High Tue, 01 Sep 2026 13:40:05 GMT https://vulnogram.org/CVE-2026-19913 https://vulnogram.org/CVE-2026-19913 The Kaltura HTML5 player (mwEmbed / html5lib) contains a local file disclosure vulnerability due to improper validation of the ServiceUrl parameter in mwEmbedLoader.php. This parameter is used as the base URL for a backend request and accepts non‑HTT… High Network Exploitable Tue, 25 Aug 2026 16:21:05 GMT https://vulnogram.org/CVE-2026-19912 https://vulnogram.org/CVE-2026-19912 The Kaltura HTML5 player (mwEmbed / html5lib) contains an unauthenticated remote code execution vulnerability caused by unsafe data deserialization and unsanitized filesystem path construction. mwEmbedLoader.php accepts a user‑controlled ServiceUrl,… Critical Network Exploitable Tue, 25 Aug 2026 16:20:45 GMT https://vulnogram.org/CVE-2026-19874 https://vulnogram.org/CVE-2026-19874 A heap-based buffer overflow vulnerability exists in Konami's Metal Gear Online 3, originating from improper validation of lobby data fields related to kicked players. The affected function processes a list of kicked player identifiers using the lobb… Critical Network Exploitable Mon, 24 Aug 2026 15:02:51 GMT https://vulnogram.org/CVE-2026-18482 https://vulnogram.org/CVE-2026-18482 Neo.mjs contains a command injection vulnerability within the FileSystemService.mjs component of the ai/mcp/server/file-system MCP server, where the checkSyntax() and runPlaywrightTest() functions unsafely interpolate caller-controlled absolutePath v… Critical Network Exploitable Thu, 20 Aug 2026 12:36:40 GMT