CVE-2026-63646

CordysCRM is an open source AI-powered customer relationship management system that supports private deployment. Prior to 1.7.2, GET /mcp/form/config/formKey calls McpController.getMcpField without authentication because ShiroFilter.addPublicPathFilters marks /mcp/ as anonymous and the controller...

CVE-2026-63646 CordysCRM MCP Form Configuration Endpoint Exposed to Anonymous Users

CordysCRM is an open source AI-powered customer relationship management system that supports private deployment. Prior to 1.7.2, GET /mcp/form/config/formKey calls McpController.getMcpField without authentication because ShiroFilter.addPublicPathFilters marks /mcp/ as anonymous and the controller...

CVE-2026-61552

Icinga 2 , an open source monitoring and alerting system, is affected by a DSL injection vulnerability in the /v1/objects API . The root cause is that attacker-controlled template names are written into generated configuration without escaping , allowing an authenticated ApiUser with an objects/c...

EUVD-2026-83202

LMDeploy is a toolkit for compressing, deploying, and serving large language models. Versions 012.1 through 0.12.2 contain a code injection vulnerability in lmdeploy/pytorch/config.py line 620 that allows an attacker to execute arbitrary Python code by publishing a malicious HuggingFace model wit...

CVE-2026-93763

This vulnerability affects Mongoid , a Ruby object-document mapper for MongoDB. A protection mechanism failure in the encryption configuration generation — specifically an unresolved callable database name in the encryption schema map — causes fields declared for client-side field-level encryptio...

CVE-2026-84398 CareCam CM2507 Empty Password in Configuration File

CM2507 IP cameras accept an empty password for a privileged account exposed through its ONVIF management service. An attacker with network access to the affected device could access privileged management functions and obtain device, user, media-profile, and stream configuration information...

CVE-2026-84398 CareCam CM2507 Empty Password in Configuration File

CM2507 IP cameras accept an empty password for a privileged account exposed through its ONVIF management service. An attacker with network access to the affected device could access privileged management functions and obtain device, user, media-profile, and stream configuration information...

CLEANSTART-2026-SB47522 Security fix for CVE-2026-22741 applied in: activemq 5.19.8-r3, activemq 6.1.8-r1, activemq 6.2.3-r1, cloud-config-server 4.1.7-r2, cloud-config-server 4.2.4-r0, cloud-config-server 4.3.2-r2, cloud-config-server 4.3.4-r0, cloud-config-server 5.0.2-r3, cloud-config-server 5.0.4-r0, kafka-ui 1.4.2-r6

CVE-2026-22741 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-YX18209 Security fix for CVE-2026-22745 applied in: activemq 5.19.8-r3, activemq 6.1.8-r1, activemq 6.2.3-r1, apache-hive 4.1.0-r5, apache-nifi 2.6.0-r3, apache-nifi-registry 2.9.0-r3, cloud-config-server 4.1.7-r2, cloud-config-server 4.2.4-r0, cloud-config-server 4.3.2-r2, cloud-config-server 4.3.4-r0, cloud-config-server 5.0.2-r3, cloud-config-server 5.0.4-r0, kafka-ui 1.4.2-r6, spring-boot 3.4.13-r3

CVE-2026-22745 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-UJ95320 Security fix for CVE-2026-40976 applied in: cloud-config-server 5.0.2-r3, cloud-config-server 5.0.4-r0

CVE-2026-40976 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-DZ11796 Security fix for CVE-2026-40973 applied in: cloud-config-server 4.1.7-r2, cloud-config-server 4.2.4-r0, cloud-config-server 4.3.2-r2, cloud-config-server 4.3.4-r0, cloud-config-server 5.0.2-r3, cloud-config-server 5.0.4-r0, kafka-ui 1.4.2-r6

CVE-2026-40973 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-QX79556 Security fix for CVE-2026-43514 applied in: cloud-config-server 4.1.7-r2, cloud-config-server 4.2.4-r0, cloud-config-server 4.3.2-r2, cloud-config-server 4.3.4-r0, cloud-config-server 5.0.2-r3, cloud-config-server 5.0.4-r0

CVE-2026-43514 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-BN96016 Security fix for CVE-2026-42498 applied in: cloud-config-server 4.1.7-r2, cloud-config-server 4.2.4-r0, cloud-config-server 4.3.2-r2, cloud-config-server 4.3.4-r0, cloud-config-server 5.0.2-r3, cloud-config-server 5.0.4-r0, thingsboard 4.2.2.3-r1, thingsboard 4.3.1.3-r1

CVE-2026-42498 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-MU35489 Security fix for CVE-2026-43513 applied in: cloud-config-server 4.1.7-r2, cloud-config-server 4.2.4-r0, cloud-config-server 4.3.2-r2, cloud-config-server 4.3.4-r0, cloud-config-server 5.0.2-r3, cloud-config-server 5.0.4-r0, thingsboard 4.2.2.3-r1, thingsboard 4.3.1.3-r1

CVE-2026-43513 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-MV28193 Security fix for CVE-2026-41284 applied in: cloud-config-server 4.1.7-r2, cloud-config-server 4.2.4-r0, cloud-config-server 4.3.2-r2, cloud-config-server 4.3.4-r0, cloud-config-server 5.0.2-r3, cloud-config-server 5.0.4-r0, thingsboard 4.2.2.3-r1, thingsboard 4.3.1.3-r1

CVE-2026-41284 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-SE01248 Security fix for CVE-2026-43515 applied in: cloud-config-server 4.1.7-r2, cloud-config-server 4.2.4-r0, cloud-config-server 4.3.2-r2, cloud-config-server 4.3.4-r0, cloud-config-server 5.0.2-r3, cloud-config-server 5.0.4-r0, thingsboard 4.2.2.3-r1, thingsboard 4.3.1.3-r1

CVE-2026-43515 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-OD91042 Security fix for CVE-2026-43512 applied in: cloud-config-server 4.1.7-r2, cloud-config-server 4.2.4-r0, cloud-config-server 4.3.2-r2, cloud-config-server 4.3.4-r0, cloud-config-server 5.0.2-r3, cloud-config-server 5.0.4-r0, thingsboard 4.2.2.3-r1, thingsboard 4.3.1.3-r1

CVE-2026-43512 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-NC17468 Security fix for CVE-2026-41293 applied in: cloud-config-server 4.1.7-r2, cloud-config-server 4.2.4-r0, cloud-config-server 4.3.2-r2, cloud-config-server 4.3.4-r0, cloud-config-server 5.0.2-r3, cloud-config-server 5.0.4-r0, thingsboard 4.2.2.3-r1, thingsboard 4.3.1.3-r1, tomcat10 10.0.27-r1

CVE-2026-41293 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-GO18294 Security fix for CVE-2026-22746 applied in: apache-nifi 2.7.2-r7, cloud-config-server 4.1.7-r2, cloud-config-server 4.2.4-r0, cloud-config-server 4.3.2-r2, cloud-config-server 4.3.4-r0, kafka-ui 1.4.2-r6, rundeck 6.0.0-r0

CVE-2026-22746 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-WO51602 Security fix for CVE-2026-22751 applied in: apache-nifi 2.7.2-r7, cloud-config-server 4.1.7-r2, cloud-config-server 4.2.4-r0, cloud-config-server 4.3.2-r2, cloud-config-server 4.3.4-r0, kafka-ui 1.4.2-r6, rundeck 6.0.0-r0

CVE-2026-22751 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...