CVE-2026-43631

A flaw was found in llama.cpp. This use-after-free vulnerability in the llama-server component, specifically within the vocab pointer when the --sleep-idle-seconds feature is enabled, allows unauthenticated remote attackers to execute arbitrary code. Attackers can exploit this by sending requests...

CVE-2026-55676

Malcolm’s file-upload PHP backend allows unrestricted uploads: an empty allow-list means any extension is accepted, and the filename sanitizer preserves .php. Uploaded files land under /var/www/upload/server/php/files and are served via nginx to php-fpm, enabling an authenticated GET to execute t...

CVE-2026-55676 Malcolm vulnerable to RCE via unrestricted .php upload to the file-upload component

Malcolm is a network traffic analysis tool suite. The file-upload component FilePond PHP backend accepts uploads at POST /server/php/submit.php and stores them in a directory served by the same nginx and php-fpm instance. The allow-list that should restrict accepted file types is an empty array b...

CVE-2026-55676 Malcolm vulnerable to RCE via unrestricted .php upload to the file-upload component

Malcolm is a network traffic analysis tool suite. The file-upload component FilePond PHP backend accepts uploads at POST /server/php/submit.php and stores them in a directory served by the same nginx and php-fpm instance. The allow-list that should restrict accepted file types is an empty array b...

GHSA-F23P-VX2J-J53R vulnerabilities

Vulnerabilities for packages: langfuse...

CVE-2026-71437 vulnerabilities

Vulnerabilities for packages: langfuse...

CVE-2026-71439 vulnerabilities

Vulnerabilities for packages: langfuse...

GHSA-79QM-7RJ5-M7R9 vulnerabilities

Vulnerabilities for packages: langfuse...

CVE-2026-73034

DB-GPT v0.8.1 contains an unauthenticated path traversal vulnerability that allows remote attackers to write arbitrary files to any location on the server by injecting directory traversal sequences into the userid HTTP header of the Python file-upload endpoint. Attackers can send a crafted...

CVE-2026-70339

Access of resource using incompatible type 'type confusion' in Microsoft Edge Chromium-based allows an unauthorized attacker to execute code over a network...

CVE-2026-66145

An unauthenticated remote code execution vulnerability was identified in GMS 9.5.1 Build 9510.1044 and earlier versions which allows remote attacker to read sensitive data and perform arbitrary file write via zipslip...

CVE-2026-19091

The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the deleterevision function in all versions up to, and including, 2.8.169. This makes it possible for...

CVE-2026-13457

The InstaWP Connect – 1-click WP Staging & Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 0.1.3.6 via the top-level script function. This is due to the plugin stores its encrypted options file as options-migratekey.txt in...

CVE-2026-67568

creationtimestamp| type| source ---|---|--- 2026-08-11 20:15:13+00:00| seen| https://www.cisa.gov/news-events/ics-medical-advisories/icsma-26-223-01 2026-08-11 22:18:45+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/2oepdilmaqi7n 2026-08-11 23:50:03+00:00| seen|...

CVE-2026-18844

creationtimestamp| type| source ---|---|--- 2026-08-11 20:14:43+00:00| seen| https://bsky.app/profile/cyfar.ca/post/3mstgjkadjw26 2026-08-11 20:15:22+00:00| seen| https://www.cisa.gov/news-events/ics-medical-advisories/icsma-26-223-02...

CVE-2026-29035 CivetWeb Heap/Stack Buffer Overflow via WebSocket permessage-deflate Decompression

CivetWeb commit 4a4f0c95 contains a heap and stack buffer overflow vulnerability in the readwebsocket function that allows unauthenticated remote attackers to corrupt memory by sending compressed WebSocket frames when both USEZLIB and MGEXPERIMENTALINTERFACES are defined. Attackers can negotiate...

CVE-2026-29035

CivetWeb commit 4a4f0c95 contains a heap and stack buffer overflow vulnerability in the readwebsocket function that allows unauthenticated remote attackers to corrupt memory by sending compressed WebSocket frames when both USEZLIB and MGEXPERIMENTALINTERFACES are defined. Attackers can negotiate...

CVE-2026-29035

CivetWeb commit 4a4f0c95 contains a heap and stack buffer overflow vulnerability in the readwebsocket function that allows unauthenticated remote attackers to corrupt memory by sending compressed WebSocket frames when both USEZLIB and MGEXPERIMENTALINTERFACES are defined. Attackers can negotiate...

EUVD-2026-56941

An unauthenticated command injection vulnerability was identified in the GMS Dispatcher Service in GMS 9.5.1 and earlier versions which allows remote attacker to perform remote code execution through specially crafted requests...

CVE-2026-66147

An unauthenticated command injection vulnerability was identified in the GMS Dispatcher Service in GMS 9.5.1 and earlier versions which allows remote attacker to perform remote code execution through specially crafted requests...