Exploit for CVE-2026-98432

Check · Exploit · Detection · PCAP · Impact · Write-up ---...

CVE-2026-91901: Dell Alienware Command Center (AWCC): Dell Alienware Command Center (AWCC), versions prior to 6.14.54.0, contain an Improper Authorization in Handler for…

Dell Alienware Command Center AWCC, versions prior to 6.14.54.0, contain an Improper Authorization in Handler for Custom URL Scheme vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Client-Side Request Forgery...

CVE-2026-120067: PostgreSQL psqlODBC: For updatable cursors, which are enabled by default, psqlODBC adds hidden ctid and, for tables with OIDs, oid columns…

For updatable cursors, which are enabled by default, psqlODBC adds hidden ctid and, for tables with OIDs, oid columns to the query. It copies each value into a 32-byte stack buffer using the length the server sent, without checking it against the buffer size, so a value of 32 bytes or more writes...

CVE-2026-120063: PostgreSQL psqlODBC: When psqlODBC quotes a schema or table name into a 128-byte stack buffer, its length check lets it write up to two…

When psqlODBC quotes a schema or table name into a 128-byte stack buffer, its length check lets it write up to two bytes past the end of the buffer for a long name. The names come from the application's SQL text: the table of a statement the driver parses to describe its columns, and the target o...

CVE-2026-120058: PostgreSQL psqlODBC: psqlODBC sizes its row cache from the column count of a cursor's first result, but recomputes the column count from…

psqlODBC sizes its row cache from the column count of a cursor's first result, but recomputes the column count from each later FETCH reply without checking that it matches. A server not trusted under current SSL settings can answer a later FETCH with more columns and make the driver write tuple...

CVE-2026-120060: PostgreSQL psqlODBC: psqlODBC trusts counts and lengths in server data in three places

psqlODBC trusts counts and lengths in server data in three places. SQLBulkOperations uses a server-supplied row count in a size subtraction that can underflow. SQLStatistics iterates index keys using a server-supplied key count without bounding it to the fixed storage. Bytea octal decoding reads ...

CVE-2026-120061: PostgreSQL psqlODBC: The psqlODBC parser for ODBC escape sequences in application SQL text writes the argument offsets of a {fn} escape into…

The psqlODBC parser for ODBC escape sequences in application SQL text writes the argument offsets of a fn escape into a fixed 16-entry stack array without a bound and does not initialize the array. An escape with too many arguments overflows the stack, and a reference to an unsupplied argument...

CVE-2026-120066: PostgreSQL psqlODBC: On Unix-like systems, when logging is enabled, psqlODBC creates its log files in /tmp by default, named from the…

On Unix-like systems, when logging is enabled, psqlODBC creates its log files in /tmp by default, named from the program name, user name, and process ID, with the default permissions, typically world-readable, and follows symbolic links when opening them. A local user can read query text and data...

CVE-2026-120597: Welcart e-Commerce Plugin: A vulnerability was identified in Welcart e-Commerce Plugin up to 2.12.6 on WordPress

A vulnerability was identified in Welcart e-Commerce Plugin up to 2.12.6 on WordPress. This affects the function ESCOTTMAIN::errorpagemessage of the file classes/paymentESCOTT.main.class.php. Such manipulation of the argument ResponseCd leads to cross site scripting. The attack can be launched...

CVE-2026-49924: Google Android: In ShortcutInfo of ShortcutInfo.java, there is a possible way to crash the launcher via unauthorized shortcuts due to…

In ShortcutInfo of ShortcutInfo.java, there is a possible way to crash the launcher via unauthorized shortcuts due to resource exhaustion. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-106803: n/a: A stack-based buffer overflow exists in Kamailio v6.1.3 and v6.1.4 in the ims_registrar_pcscf module

A stack-based buffer overflow exists in Kamailio v6.1.3 and v6.1.4 in the imsregistrarpcscf module. When processing a crafted application/reginfo+xml NOTIFY message, processcontact copies an attacker-controlled port value from the alias parameter into a fixed 5-byte stack buffer without validatin...

CVE-2026-88809: SUSE Rancher: A security vulnerability exists in the SUSE Rancher Manager meta proxy endpoint (/meta/proxy)

A security vulnerability exists in the SUSE Rancher Manager meta proxy endpoint /meta/proxy. This endpoint is intended to forward requests only to destinations that appear on a configured allowlist. The allowlist decision was evaluated in a place where it could not stop a request from being...

CVE-2026-120596: Ethernut / egnite GmbH Nut/Net TCP/IP Stack: A remotely exploitable denial-of-service vulnerability exists in the TCP options parser of the Nut/Net TCP/IP stack…

A remotely exploitable denial-of-service vulnerability exists in the TCP options parser of the Nut/Net TCP/IP stack included in Nut/OS, developed by Ethernut/Egnite. Nut/OS releases up to version 5.1 are affected. An unauthenticated attacker can send a single TCP segment containing an unknown TCP...

CVE-2026-105769: chainguard kaniko: kaniko before 1.25.20 can send a Microsoft Entra ID (Azure AD) access token for Azure Resource Manager to an…

kaniko before 1.25.20 can send a Microsoft Entra ID Azure AD access token for Azure Resource Manager to an attacker-controlled registry host. kaniko uses the Azure Container Registry credential helper github.com/chrismellard/docker-credential-acr-env, which decides whether a host is an ACR regist...

CVE-2026-106805: n/a: A resource exhaustion issue exists in Free5GC v4.2.3 during PFCP Session Establishment failure handling

A resource exhaustion issue exists in Free5GC v4.2.3 during PFCP Session Establishment failure handling. When the SMF does not receive a PFCP Session Establishment Response from the UPF, allocated UE IP address resources are not properly released. Repeated failed session establishment attempts ca...

CVE-2026-106807: n/a: A denial-of-service vulnerability exists in open5GS v2.8.0 in the PFCP transaction handling path

A denial-of-service vulnerability exists in open5GS v2.8.0 in the PFCP transaction handling path. When the PFCP transaction or timer resource pool is exhausted, ogspfcpxactremotecreate returns NULL, but the failure is not handled properly and leads to an ogsassertnew failure in ogspfcpxactreceive...

CVE-2026-105600: php-web-design.com StageIt extension for Joomla: Joomla Extension - php-web-design.com - RCE via setting strings in StageIt 1.0-5.7.5, 6.0-6.3.5

Joomla Extension - php-web-design.com - RCE via setting strings in StageIt 1.0-5.7.5, 6.0-6.3.5...

CVE-2026-105602: joomshaper.com Helix Ultimate extension for Joomla: Joomla Extension - joomshaper.com - Stored Cross-Site Scripting (XSS) in Mega Menu Badge Text in Helix Ultimate <…

Joomla Extension - joomshaper.com - Stored Cross-Site Scripting XSS in Mega Menu Badge Text in Helix Ultimate 2.2.11...

CVE-2026-120488: LaraDashboard: LaraDashboard before 1.4.9 contains a stored cross-site scripting vulnerability that allows authenticated users with…

LaraDashboard before 1.4.9 contains a stored cross-site scripting vulnerability that allows authenticated users with post.create or post.edit permission to inject scripts via unsanitized LaraBuilder designjson block content. Attackers can save text-editor, HTML, text or heading blocks containing...

CVE-2026-120457: Deutsches Klimarechenzentrum libaec: libaec through 1.1.7 contains an out-of-bounds read vulnerability in m_se_decode() in src/decode.c that allows…

libaec through 1.1.7 contains an out-of-bounds read vulnerability in msedecode in src/decode.c that allows attackers to bypass a signed bounds check via an overlong fundamental sequence. Attackers can supply a crafted CCSDS 121.0/SZIP stream with 2^31 or more zero bits to crash the decoder or lea...