EUVD-2026-35449

Mem0 versions through 0.2.8, fixed in commit ae7f406, contain a missing authorization vulnerability in the self-hosted server component where the POST /configure endpoint modifies global LLM provider and embedder configuration but only verifies authentication via JWT or X-API-Key without validati...

CVE-2026-49959

Hermes WebUI before version 0.51.311 contains a remote code execution vulnerability that allows authenticated attackers to execute arbitrary commands by placing malicious executable Git configuration in a workspace repository's .git/config file. Attackers can exploit Git subprocess invocations in...

CVE-2026-49959 Hermes WebUI < 0.51.311 RCE via Git Configuration Injection

Hermes WebUI before version 0.51.311 contains a remote code execution vulnerability that allows authenticated attackers to execute arbitrary commands by placing malicious executable Git configuration in a workspace repository's .git/config file. Attackers can exploit Git subprocess invocations in...

CVE-2026-11517

A vulnerability was determined in UTT HiPER 2610G up to 3.0.0-171107. This impacts the function strcpy of the file /goform/formConfigDnsFilterGlobal. Executing a manipulation of the argument GroupName can lead to buffer overflow. The attack can be executed remotely. The exploit has been publicly...

CVE-2026-11492

A security flaw has been discovered in D-Link DIR-823G 1.0.2B05. The affected element is an unknown function of the file /etc/vsftpd.conf of the component vsftpd. Performing a manipulation results in least privilege violation. The attack can be initiated remotely. The exploit has been released to...

com.github.skeychen:dswork-common-ssosdk (>=9.0.1, <=9.1.1), com.github.skeychen:dswork-config (>=9.0.1, <=9.1.1) +127 more potentially affected by CVE-2026-41852 via org.springframework:spring-expression (4.3.28.release)

org.springframework:spring-expression MAVEN version 4.3.28.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-expression and may be impacted: - com.github.skeychen:dswork-common-ssosdk =9.0.1, =9.0.1, =9.0.1, =9.0.1,...

at.molindo.social:spring-social-config (1.1.4.release), at.molindo.social:spring-social-security (1.1.4.release) +178 more potentially affected by CVE-2026-41846 via org.springframework:spring-webmvc (4.1.8.release)

org.springframework:spring-webmvc MAVEN version 4.1.8.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-webmvc and may be impacted: - at.molindo.social:spring-social-config 1.1.4.release -...

at.molindo.social:spring-social-config (1.1.0.release), at.molindo.social:spring-social-core (1.1.0.release) +310 more potentially affected by CVE-2026-41852 via org.springframework:spring-expression (4.0.3.release)

org.springframework:spring-expression MAVEN version 4.0.3.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-expression and may be impacted: - at.molindo.social:spring-social-config 1.1.0.release -...

com.github.skeychen:dswork-config (>=9.0.1, <=9.1.1), com.github.skeychen:dswork-javaweb (>=9.0.1, <=9.1.1) +45 more potentially affected by CVE-2026-41842 via org.springframework:spring-webmvc (4.3.28.release)

org.springframework:spring-webmvc MAVEN version 4.3.28.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-webmvc and may be impacted: - com.github.skeychen:dswork-config =9.0.1, =9.0.1, =9.0.1, =2.2.0, =2.2.0, =2.2.0,...

cn.home1:spring-cloud-config-monitor (>=0.0.1, <=1.0.1.u1), cn.home1:spring-cloud-config-server (>=0.0.1, <=1.0.1.u1) +474 more potentially affected by CVE-2026-41845 via org.springframework:spring-webmvc (4.3.16.release)

org.springframework:spring-webmvc MAVEN version 4.3.16.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-webmvc and may be impacted: - cn.home1:spring-cloud-config-monitor =0.0.1, =0.0.1, =0.0.1, =0.0.1, =1.0.1.release,...

com.github.skeychen:dswork-config (>=9.0.1, <=9.1.1), com.github.skeychen:dswork-javaweb (>=9.0.1, <=9.1.1) +45 more potentially affected by CVE-2026-41845 via org.springframework:spring-webmvc (4.3.28.release)

org.springframework:spring-webmvc MAVEN version 4.3.28.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-webmvc and may be impacted: - com.github.skeychen:dswork-config =9.0.1, =9.0.1, =9.0.1, =2.2.0, =2.2.0, =2.2.0,...

com.github.skeychen:dswork-config (>=9.0.1, <=9.1.1), com.github.skeychen:dswork-javaweb (>=9.0.1, <=9.1.1) +45 more potentially affected by CVE-2026-41843 via org.springframework:spring-webmvc (4.3.28.release)

org.springframework:spring-webmvc MAVEN version 4.3.28.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-webmvc and may be impacted: - com.github.skeychen:dswork-config =9.0.1, =9.0.1, =9.0.1, =2.2.0, =2.2.0, =2.2.0,...

CVE-2026-11620 TOTOLINK EX200 vsftpd vsftpd.conf least privilege violation

A security flaw has been discovered in TOTOLINK EX200 4.0.3c.7646. This affects an unknown function of the file /etc/vsftpd.conf of the component vsftpd. The manipulation results in least privilege violation. It is possible to launch the attack remotely. The exploit has been released to the publi...

EUVD-2026-35294

A vulnerability was identified in Dolibarr ERP CRM up to 23.0.2. The impacted element is an unknown function of the file htdocs/core/filemanagerdol/connectors/php/config.inc.php of the component Legacy Filemanager. The manipulation leads to improper authorization. It is possible to initiate the...

CVE-2026-49959: Improper Neutralization of Special Elements used in an OS Command

Hermes WebUI before version 0.51.311 contains a remote code execution vulnerability that allows authenticated attackers to execute arbitrary commands by placing malicious executable Git configuration in a workspace repository's .git/config file. Attackers can exploit Git subprocess invocations in...

Dolibarr ERP CRM 安全漏洞

Dolibarr ERP CRM is an open-source enterprise and sales management system developed by Dolibarr. Versions of Dolibarr ERP CRM prior to 23.0.2 contain security vulnerabilities. These vulnerabilities stem from unauthorized permissions granted to unknown functions in the...

Linux Distros Unpatched Vulnerability : CVE-2026-40981

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - When using Google Secrets Manager as a backend for the Spring Cloud Config server a client can craft a request to the config server potentially exposing secret...

PT-2026-48121

Hermes WebUI before version 0.51.311 contains a remote code execution vulnerability that allows authenticated attackers to execute arbitrary commands by placing malicious executable Git configuration in a workspace repository's .git/config file. Attackers can exploit Git subprocess invocations in...

Linux Distros Unpatched Vulnerability : CVE-2026-40982

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Spring Cloud Config allows applications to serve arbitrary text and binary files through the spring-cloud- config-server module. A malicious user, or attacker,...

User Impersonation

Overview org.springframework.security:spring-security-config is a security configuration package for Spring Framework. Affected versions of this package are vulnerable to User Impersonation via username extraction in SubjectDnX509PrincipalExtractor. An attacker can impersonate another user by...