https://vulnogram.org/ Most recent CVEs assigned by EU Agency for Cybersecurity (ENISA) (enisa). https://vulnogram.org/seaview/icons/enisa.png https://vulnogram.org/ Wed, 21 Oct 2026 07:00:07 GMT https://vulnogram.org/CVE-2026-103905 https://vulnogram.org/CVE-2026-103905 The authentication middleware of the JTL-Shop administration backend processes the plugin safe mode toggle on the admin logout route before checking whether the requesting user is authenticated. An unauthenticated remote attacker can therefore switch… High Network Exploitable Wed, 14 Oct 2026 10:34:34 GMT https://vulnogram.org/CVE-2026-103904 https://vulnogram.org/CVE-2026-103904 The public consent endpoint of JTL-Shop accepts arbitrary consent names from unauthenticated visitors without validating them against the configured consent items. These names are stored in the consent statistics and rendered without output encoding… Critical Network Exploitable Wed, 14 Oct 2026 10:23:29 GMT https://vulnogram.org/CVE-2026-89310 https://vulnogram.org/CVE-2026-89310 A parameter taken from the request body is inserted into a T-SQL statement without parameterization or escaping, allowing a remote attacker to execute arbitrary SQL statements in the context of the application's database account. Critical Wed, 14 Oct 2026 06:50:34 GMT https://vulnogram.org/CVE-2026-89309 https://vulnogram.org/CVE-2026-89309 The authorization middleware of the WMS MobileServer fails to require authentication in two distinct cases. First, it only requires an Authorization header for GET and HEAD requests; requests using any other HTTP method are processed without an authe… Critical Network Exploitable Tue, 13 Oct 2026 08:38:59 GMT https://vulnogram.org/CVE-2026-103903 https://vulnogram.org/CVE-2026-103903 An incorrect authorization vulnerability in the WinBox authentication flow of MikroTik RouterOS allows a remote authenticated attacker with credentials for a low-privilege account permitted to use WinBox to obtain the authorization policy of a differ… High Mon, 12 Oct 2026 10:37:23 GMT https://vulnogram.org/CVE-2026-103902 https://vulnogram.org/CVE-2026-103902 Improper verification of cryptographic signature vulnerability in DigiDoc libdigidocpp, DigiDoc DigiDoc4, DigiDoc DigiDoc Android, and DigiDoc DigiDoc iOS. The vulnerability allows an attacker to create forged digital signatures that are displayed a… High Network Exploitable Mon, 12 Oct 2026 10:25:20 GMT https://vulnogram.org/CVE-2026-33586 https://vulnogram.org/CVE-2026-33586 Authenticated users are able to manipulate both the SMTP envelope “Envelope-from” and “From” fields when sending emails through OVH mail servers. Due to OVH's default SPF configuration, which commonly includes include:mx.ovh.com, any authenticated us… Medium Wed, 07 Oct 2026 15:00:14 GMT https://vulnogram.org/CVE-2026-28199 https://vulnogram.org/CVE-2026-28199 An authenticated user with access to the NetBackup Flex OS management shell could read arbitrary files from the underlying operating system by supplying a specially crafted path argument to a diagnostic command. Successful exploitation could expose s… Medium Fri, 18 Sep 2026 11:19:34 GMT https://vulnogram.org/CVE-2026-28198 https://vulnogram.org/CVE-2026-28198 An authenticated, low-privileged user with access to the NetBackup Flex OS management shell could bypass the cryptographic signature verification step of a privileged support command by supplying a specially formed access credential. Successful explo… Critical Fri, 18 Sep 2026 11:12:23 GMT https://vulnogram.org/CVE-2026-28197 https://vulnogram.org/CVE-2026-28197 An authenticated, low-privileged user with access to the NetBackup Flex OS management shell could supply a specially crafted input to a privileged administrative command, causing it to execute arbitrary code with root-level permissions. Successful ex… Critical Fri, 18 Sep 2026 11:07:19 GMT https://vulnogram.org/CVE-2026-89307 https://vulnogram.org/CVE-2026-89307 The "Firma Circolare" feature in the "Design Scuole Italia" WordPress theme allows an authenticated attacker to inject arbitrary HTML via the sign parameter, enabling forced redirection of visiting users to an attacker-controlled URL (Stored HTML Inj… Medium Tue, 15 Sep 2026 15:23:40 GMT https://vulnogram.org/CVE-2026-87793 https://vulnogram.org/CVE-2026-87793 The "Design Scuole Italia" WordPress theme is affected by a Reflected XSS vulnerability in the filters-scheda-didattica.php file, allowing an unauthenticated attacker to execute arbitrary JavaScript in a victim's browser via a crafted URL containing… Medium Network Exploitable Tue, 15 Sep 2026 15:21:47 GMT https://vulnogram.org/CVE-2026-87792 https://vulnogram.org/CVE-2026-87792 The "Design Scuole Italia" WordPress theme is affected by multiple Authorization Bypass vulnerabilities in the dsi_pdf_generator and dsi_csv_generator functions, allowing an unauthenticated attacker to access restricted "Circolare" content and regist… High Network Exploitable Tue, 15 Sep 2026 15:20:17 GMT https://vulnogram.org/CVE-2026-87791 https://vulnogram.org/CVE-2026-87791 A path traversal vulnerability exists in the reserved_file_check function of the functions.php file in the WordPress Design Scuole Italia theme. The vulnerability allows an unauthenticated attacker to download arbitrary files accessible by the web se… High Network Exploitable Tue, 15 Sep 2026 15:10:37 GMT https://vulnogram.org/CVE-2026-89308 https://vulnogram.org/CVE-2026-89308 An unauthenticated OS command injection vulnerability exists in the ping.php endpoint, allowing remote attackers to execute arbitrary commands on the underlying operating system and achieve remote code execution. Critical Network Exploitable Tue, 15 Sep 2026 11:44:00 GMT https://vulnogram.org/CVE-2026-59111 https://vulnogram.org/CVE-2026-59111 Improper neutralization of special elements used in an OS command ('OS command injection') vulnerability in Digitální a informační agentura (DIA) eObčanka-Identifikace on MacOS enables an attacker to register a custom URL scheme (czeeopauth://) for p… Critical Network Exploitable Mon, 31 Aug 2026 14:43:02 GMT https://vulnogram.org/CVE-2026-70383 https://vulnogram.org/CVE-2026-70383 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Estonian Information System Authority (RIA) DigiDoc4 client. This issue affects DigiDoc4: from 4.0.0 before 4.11.0. High Thu, 20 Aug 2026 14:04:15 GMT https://vulnogram.org/CVE-2026-22306 https://vulnogram.org/CVE-2026-22306 Download of code without integrity check, inclusion of functionality from untrusted control sphere, and cleartext transmission of sensitive information vulnerability in Ozols Grupa OZOLS on Windows caused by an abandoned auto-update domain. Affected… Critical Network Exploitable Wed, 19 Aug 2026 19:25:10 GMT https://vulnogram.org/CVE-2026-59109 https://vulnogram.org/CVE-2026-59109 SQL injection in the Zalktis accounting application via trading-partner-controlled text fields in received electronic invoices. When importing a received e-invoice (UBL/PEPPOL) or an e-commerce export, Zalktis concatenates partner-controlled values d… High Network Exploitable Thu, 13 Aug 2026 16:40:01 GMT https://vulnogram.org/CVE-2026-59112 https://vulnogram.org/CVE-2026-59112 Improper verification of cryptographic signature and Improper Check for Unusual or Exceptional Conditions vulnerability in Estonian Information System Authority (RIA) libdigidocpp, DigiDoc4, DigiDoc on Android, and DigiDoc on iOS. This issue affects… Medium Mon, 10 Aug 2026 13:57:37 GMT https://vulnogram.org/CVE-2026-0392 https://vulnogram.org/CVE-2026-0392 eParakstītājs 3.0 for Windows before version 1.10.0 retrieves and executes its automatic updates over a channel that is not authenticated or integrity-protected. On each launch the application fetches an update descriptor (XML) over TLS but accepts a… High Mon, 03 Aug 2026 09:56:31 GMT https://vulnogram.org/CVE-2026-33591 https://vulnogram.org/CVE-2026-33591 A vulnerability in Wapt Server before version 2.6.1.17813 allows a remote unauthenticated attacker to bypass security restriction using a specially crafted packet and retrieve a valid session token for the targeted account. Critical Network Exploitable Mon, 03 Aug 2026 09:35:40 GMT https://vulnogram.org/CVE-2026-11946 https://vulnogram.org/CVE-2026-11946 An unauthenticated remote attacker can exhaust server memory via the GetEndpoints Discovery Service in open62541. The endpointUrl field of GetEndpointsRequest is not validated for length. An attacker can declare an arbitrarily large string (up to ~4.… High Network Exploitable Thu, 02 Jul 2026 10:54:17 GMT https://vulnogram.org/CVE-2026-33592 https://vulnogram.org/CVE-2026-33592 An unauthenticated remote attacker can exhaust server memory via the FindServers Discovery Service in open62541. The serverUris field of FindServersRequest is not validated for length or array size. An attacker can declare an arbitrarily large string… High Network Exploitable Thu, 02 Jul 2026 07:12:24 GMT https://vulnogram.org/CVE-2026-22313 https://vulnogram.org/CVE-2026-22313 The device has a webserver that exposes a REST API authenticated with a token on the management network. By exploiting an OS command injection vulnerability an authenticated attacker can send arbitrary commands to the device that are executed with ad… Critical Tue, 16 Jun 2026 18:36:41 GMT https://vulnogram.org/CVE-2026-22312 https://vulnogram.org/CVE-2026-22312 The device has a webserver that exposes a REST API authenticated with a constant token. The unauthenticated API can be used by an attacker to get access to system settings, modify the configuration and execute some commands (e.g. system reboot). High Network Exploitable Tue, 16 Jun 2026 18:19:33 GMT https://vulnogram.org/CVE-2026-25600 https://vulnogram.org/CVE-2026-25600 The PDBM application relies on a static, hard‑coded secret embedded in the PDBM.exe executable. This secret is used by the application’s encryption routines, including the function responsible for decrypting credentials stored in the product’s config… Medium Mon, 01 Jun 2026 09:37:48 GMT https://vulnogram.org/CVE-2026-25599 https://vulnogram.org/CVE-2026-25599 Missing authentication and clear‑text transmission of data from the heat pumps to the control server, combined with the absence of input validation on aggregated data, can lead to stored XSS that enables theft of cookies from the pump’s web control i… Medium Network Exploitable Unsupported When Assigned Mon, 01 Jun 2026 09:17:51 GMT https://vulnogram.org/CVE-2026-33590 https://vulnogram.org/CVE-2026-33590 Insecure default settings of Portainer CE grant regular (non-admin) users privileges that allow host filesystem access and host-level code execution. An authenticated non-administrative user with endpoint access can exploit these settings to read hos… High Thu, 28 May 2026 19:30:06 GMT https://vulnogram.org/CVE-2026-25602 https://vulnogram.org/CVE-2026-25602 Insufficient Verification of Data Authenticity in the feedback function of Mesalvo MEONA (MEONA Client and MEONA Server). The MEONA Client transmits the recipient address of a feedback report to the MEONA Server, and the server sends the report to th… Low Wed, 20 May 2026 10:54:13 GMT https://vulnogram.org/CVE-2026-0857 https://vulnogram.org/CVE-2026-0857 Use of a Password Hash With Insufficient Computational Effort in Mesalvo MEONA (MEONA Server and MEONA Client) for user accounts whose password was last set under a version before MEONA 2024.10. MEONA versions before 2024.10 protected stored password… Medium Wed, 20 May 2026 10:50:58 GMT https://vulnogram.org/CVE-2026-0856 https://vulnogram.org/CVE-2026-0856 Improper Access Control vulnerability in Mesalvo MEONA (MEONA Client and MEONA Server) allows an authenticated MEONA user to access administrative functions of the MEONA Client (admin panel). The MEONA Server does not independently verify the role as… High Wed, 20 May 2026 10:38:53 GMT https://vulnogram.org/CVE-2026-33585 https://vulnogram.org/CVE-2026-33585 Improper management of the idle timeout parameter in the Keycloak interface of the Arqit SKA-Platform enables an attacker to impersonate an authenticated tenant user via an unexpired browser session. This issue affects Symmetric Key Agreement Platfor… Low Wed, 13 May 2026 18:46:13 GMT https://vulnogram.org/CVE-2026-33584 https://vulnogram.org/CVE-2026-33584 Exposed Keycloak management service in the Arqit Symmetric Key Agreement Platform enables unauthorized access to sensitive debug information such as metrics and health data. This issue affects Symmetric Key Agreement Platform: before 26.03. Medium Network Exploitable Wed, 13 May 2026 18:30:48 GMT https://vulnogram.org/CVE-2026-33583 https://vulnogram.org/CVE-2026-33583 Exposure of the QKEY (used as input into the ‘OTA-Quantum’ device registration process) and internal system keys via an unauthenticated and unencrypted HTTP GET method in the Arqit Symmetric Key Agreement Platform. This issue affects Symmetric Key Ag… High Network Exploitable Wed, 13 May 2026 18:19:34 GMT https://vulnogram.org/CVE-2026-33589 https://vulnogram.org/CVE-2026-33589 Lack of user input validation in the file upload functionality of Open Notebook v1.8.3 allows the application user to access local files content from the docker container via path traversal. High Thu, 07 May 2026 10:31:52 GMT https://vulnogram.org/CVE-2026-33588 https://vulnogram.org/CVE-2026-33588 Lack of user input validation in the file upload functionality of Open Notebook v1.8.3 allows the application user to create or modify files on the docker container via path traversal. High Thu, 07 May 2026 10:28:09 GMT https://vulnogram.org/CVE-2026-33587 https://vulnogram.org/CVE-2026-33587 Lack of user input sanitisation in Open Notebook v1.8.3 allows the application user to execute Python code (and subsequently OS commands) on the docker container via Server-Side Template Injection (SSTI) for user-created transformations. Critical Thu, 07 May 2026 10:22:16 GMT https://vulnogram.org/CVE-2026-28201 https://vulnogram.org/CVE-2026-28201 An improper input validation, together with an overly permissive default CORS configuration in Open Notebook v1.8.1 allows remote attacker to trick a legitimate user to alter or delete arbitrary database entries via specially crafted malicious URL. D… High Network Exploitable Thu, 07 May 2026 10:12:05 GMT https://vulnogram.org/CVE-2025-42611 https://vulnogram.org/CVE-2025-42611 RouterOS provides various services that rely on correct verification of client and server certificates to secure confidentiality and integrity of communications. This includes OpenVPN, CAPsMAN, Dot1x (802.1X), among others. The vulnerability lies in… Medium Network Exploitable Tue, 05 May 2026 10:58:36 GMT https://vulnogram.org/CVE-2026-25601 https://vulnogram.org/CVE-2026-25601 A vulnerability was identified in MEPIS RM, an industrial software product developed by Metronik. The application contained a hardcoded cryptographic key within the Mx.Web.ComponentModel.dll component. When the option to store domain passwords was en… Medium Wed, 01 Apr 2026 11:28:57 GMT https://vulnogram.org/CVE-2026-3999 https://vulnogram.org/CVE-2026-3999 A broken access control may allow an authenticated user to perform a horizontal privilege escalation. The vulnerability only impacts specific configurations. High Fri, 13 Mar 2026 08:38:59 GMT https://vulnogram.org/CVE-2026-27850 https://vulnogram.org/CVE-2026-27850 Due to an improperly configured firewall rule, the router will accept any connection on the WAN port with the source port 5222, exposing all services which are normally only accessible through the local network. This issue affects MR9600: 1.0.4.20553… High Network Exploitable Wed, 25 Feb 2026 16:58:06 GMT https://vulnogram.org/CVE-2026-27849 https://vulnogram.org/CVE-2026-27849 Due to missing neutralization of special elements, OS commands can be injected via the update functionality of a TLS-SRP connection, which is normally used for configuring devices inside the mesh network. This issue affects MR9600: 1.0.4.205530; MX42… Critical Network Exploitable Wed, 25 Feb 2026 16:20:25 GMT https://vulnogram.org/CVE-2026-27848 https://vulnogram.org/CVE-2026-27848 Due to missing neutralization of special elements, OS commands can be injected via the handshake of a TLS-SRP connection, which are ultimately run as the root user. This issue affects MR9600: 1.0.4.205530; MX4200: 1.0.13.210200. Critical Network Exploitable Wed, 25 Feb 2026 15:15:16 GMT https://vulnogram.org/CVE-2026-27847 https://vulnogram.org/CVE-2026-27847 Due to improper neutralization of special elements, SQL statements can be injected via the handshake of a TLS-SRP connection. This can be used to inject known credentials into the database that can be utilized to successfully complete the handshake a… Critical Network Exploitable Wed, 25 Feb 2026 15:10:30 GMT https://vulnogram.org/CVE-2026-27846 https://vulnogram.org/CVE-2026-27846 Due to missing authentication, a user with physical access to the device can misuse the mesh functionality for adding a new mesh device to the network to gain access to sensitive information, including the password for admin access to the web interfa… Medium Wed, 25 Feb 2026 15:03:58 GMT https://vulnogram.org/CVE-2026-25603 https://vulnogram.org/CVE-2026-25603 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Linksys MR9600, Linksys MX4200 allows that contents of a USB drive partition can be mounted in an arbitrary location of the file system. This may result i… Medium Tue, 24 Feb 2026 17:14:36 GMT https://vulnogram.org/CVE-2025-42620 https://vulnogram.org/CVE-2025-42620 In affected versions, vulnerability-lookup handled user-controlled content in comments and bundles in an unsafe way, which could lead to stored Cross-Site Scripting (XSS). On the backend, the related_vulnerabilities field of bundles accepted arbitrar… High Mon, 08 Dec 2025 12:15:15 GMT https://vulnogram.org/CVE-2025-42616 https://vulnogram.org/CVE-2025-42616 Some endpoints in vulnerability-lookup that modified application state (e.g. changing database entries, user data, configurations, or other privileged actions) may have been accessible via HTTP GET requests without requiring a CSRF token. This flaw l… High Mon, 08 Dec 2025 12:09:22 GMT