https://vulnogram.org/ Most recent CVEs assigned by Project Black (prjblk). https://vulnogram.org/seaview/icons/prjblk.png https://vulnogram.org/ Wed, 21 Oct 2026 07:00:07 GMT https://vulnogram.org/CVE-2026-80214 https://vulnogram.org/CVE-2026-80214 LibreNMS’s Virtualization Discovery module is vulnerable to command line injection. An authenticated admin user can execute arbitrary code on the host server. High Wed, 26 Aug 2026 02:11:01 GMT https://vulnogram.org/CVE-2026-16007 https://vulnogram.org/CVE-2026-16007 AppFlowy's qcuiknote feature is affected by a SQL injection vulnerability. Authenticated users with access to the feature can inject arbitrary SQL to exfiltrate data in the underlying SQL database. High Sat, 15 Aug 2026 05:21:17 GMT https://vulnogram.org/CVE-2026-12196 https://vulnogram.org/CVE-2026-12196 HestiaCP panel cronjob feature is affected by a broken access control vulnerability. Low privilege users can modify the panel cronjob to execute scripts HestiaCP management scripts with passwordless sudo. This could result in the takeover of administ… High Sat, 04 Jul 2026 12:05:19 GMT https://vulnogram.org/CVE-2026-12195 https://vulnogram.org/CVE-2026-12195 myVesta is affected by an authenticated remote code execution vulnerability. Low privileged users can insert arbitrary commands as a part of the v_ftp_user parameter when deleting FTP usernames. This could result in the execution of commands as the a… High Sat, 04 Jul 2026 11:33:27 GMT https://vulnogram.org/CVE-2026-12194 https://vulnogram.org/CVE-2026-12194 PHPIPAM is affected by an authenticated local file inclusion vulnerability that allows users with access to the API to execute/include arbitrary PHP files on the web server's file system. The API is not enabled by default on installations. Low Sat, 04 Jul 2026 06:54:21 GMT https://vulnogram.org/CVE-2026-12673 https://vulnogram.org/CVE-2026-12673 Liquidfiles versions before 4.2.12 are affected by a broken access control vulnerability resulting in privilege escalation from an Admin in a secondary domain to a Sysadmin by modifying a group in their managed secondary (non-default) group. Medium Sat, 20 Jun 2026 12:36:23 GMT https://vulnogram.org/CVE-2026-8209 https://vulnogram.org/CVE-2026-8209 Gibbon versions before v30.0.01 are affected by a path traversal vulnerability resulting in DOS by attempting extraction of web application PHP files, failed .zip extraction results in deletion of the file and a DOS condition. Successful exploitation… Medium Sat, 09 May 2026 03:19:27 GMT https://vulnogram.org/CVE-2026-8208 https://vulnogram.org/CVE-2026-8208 Gibbon versions before v30.0.01 are affected by a local file inclusion vulnerability resulting in RCE by changing the report archive directory and forcing interpretation of a user provided .zip as PHP. Successful exploitation requires Teacher or high… High Sat, 09 May 2026 02:58:43 GMT https://vulnogram.org/CVE-2026-8207 https://vulnogram.org/CVE-2026-8207 Gibbon versions before v30.0.01 are affected by an authenticated SQL Injection vulnerability by abusing the Tracking/graphing https://github.com/GibbonEdu/core/blob/c431e25fdc874adece5d2dc7e408e9aa2d1abadb/modules/Tracking/graphing.php#L145 feature.… High Sat, 09 May 2026 02:41:46 GMT https://vulnogram.org/CVE-2026-6204 https://vulnogram.org/CVE-2026-6204 LibreNMS versions before 26.3.0 are affected by an authenticated remote code execution vulnerability by abusing the Binary Locations config and the Netcommand feature. Successful exploitation requires administrative privileges. Exploitation could res… High Mon, 13 Apr 2026 10:56:16 GMT https://vulnogram.org/CVE-2026-2728 https://vulnogram.org/CVE-2026-2728 LibreNMS versions before 26.3.0 are affected by an authenticated Cross-site Scripting vulnerability on the showconfig page. Successful exploitation requires administrative privileges. Exploitation could result in XSS attacks being performed against o… Medium Mon, 13 Apr 2026 10:39:54 GMT https://vulnogram.org/CVE-2025-15586 https://vulnogram.org/CVE-2025-15586 OGP-Website installs prior git commit 52f865a4fba763594453068acf8fa9e3fc38d663 are affected by a type juggling flaw which if exploited can result in authentication bypass without knowledge of the victim account's password. Critical Network Exploitable Thu, 19 Feb 2026 03:41:04 GMT https://vulnogram.org/CVE-2025-15585 https://vulnogram.org/CVE-2025-15585 Fileflows versions before 25.05.2 are affected by an authenticated SQL injection vulnerability in the library-file search function. Successful exploitation requires the system to use MySQL as the underlying database and could result in privilege esca… Medium Wed, 18 Feb 2026 23:44:40 GMT https://vulnogram.org/CVE-2025-15581 https://vulnogram.org/CVE-2025-15581 Orthanc versions before 1.12.10 are affected by an authorisation logic flaw in the application's HTTP Basic Authentication implementation. Successful exploitation could result in Privilege Escalation, potentially allowing full administrative access. Medium Wed, 18 Feb 2026 22:59:55 GMT