CVE-2025-63607

Technical details for CVE-2025-63607 are not yet publicly available; the entry is reserved and awaiting publication. A single sighting reference exists but provides no concrete product, cause, or impact information. Monitor for updates.

CVE-2026-12763

CVE-2026-12763 is a reserved candidate with no public technical details yet. The affected product, vulnerability type, and impact remain unknown. Action: monitor for future updates when the details are published.

CVE-2026-19300

This CVE has been reserved as a placeholder; no technical details (affected product, root cause, or impact) are publicly available in the provided documents. Monitor for updates when the candidate is publicized.

CVE-2026-19299

CVE-2026-19299 is a reserved candidate with no public technical details yet. The underlying vulnerability, affected products, and impact remain unspecified. Monitor for updates once the reserving organization publicizes the issue.

CVE-2026-19302

CVE-2026-19302 is currently a reserved candidate with no public technical details available. The affected product, root cause, and impact remain unknown. Action: monitor for updates as details are expected to be published when the candidate is publicized.

CVE-2026-19306

CVE-2026-19306 is currently a reserved candidate with no public technical details available. No connected documents provide further information about affected products, root cause, or impact. Monitor for updates as the reserving organization publicizes the vulnerability.

CVE-2026-19298

CVE-2026-19298 is currently a reserved CVE candidate with no public technical details available in the provided documents. No affected product, root cause, or impact has been disclosed yet. Action: monitor for updates once the reserving organization publishes details.

CVE-2026-19301

CVE-2026-19301 is currently a reserved candidate with no public technical details. Affected product, root cause, and impact remain unspecified. Action: monitor for updates when the announcing organization publishes details.

CVE-2026-19304

CVE-2026-19304 has been reserved for a future security announcement. No technical details, affected products, or versions are currently available in the provided documents. Monitor for updates.

CVE-2026-12766

This CVE has been reserved but no technical details (affected product, root cause, or impact) are yet publicly available. Monitor for updates when the candidate is publicized.

CVE-2026-19305

CVE-2026-19305 is currently reserved with no publicly available technical details. Affected product, root cause, and impact are not yet disclosed. Monitor for updates when the candidate is publicized.

CVE-2026-55785

free5GC's AUSF component (prior to version 1.4.5) performs 5G-AKA cryptographic authentication comparisons in ue_authentication.go using non-constant-time helpers: strings.EqualFold for RES*/XRES* and bytes.Equal for AT_MAC/XMAC. Additionally, the expected XRES* value is logged at INFO level befo...

CVE-2026-55784

free5GC is an open-source 5G core network implementation. In versions 1.4.4 and earlier , the AUSF component stores per-subscriber authentication state in a global sync.Map keyed only by SUPI . Because each request unconditionally replaces the active context for that SUPI, an attacker with access...

CVE-2026-55779

Silverstripe Versioned (a versioning module for Silverstripe CMS) contains a stored XSS in RestoreAction::getRestoreMessage() (src/RestoreAction.php). The method builds ArchiveAdmin restore notifications rendered as CAST_HTML but inserts $restoredItem->Title, $restoredItem->URLSegment, $res...

CVE-2026-55867

Graylog (a log management platform) is affected in versions 6.2.0 through 6.3.12, 7.0.7, and 7.1.2 . The vulnerability resides in the DELETE /users/{userId}/tokens/{idOrToken} endpoint (UsersResource.revokeToken()), where the USERS_TOKENREMOVE permission is checked against an attacker-controlled ...

CVE-2026-55841

Graylog (a free and open log management platform) is affected by a parsing flaw in its FortiGate key-value syslog parser (GLFortiGateSyslogEvent.java and SyslogCodec.java). The root cause is that KV_PATTERN and QUOTED_KV_PATTERN mishandle field-like text inside quoted values: crafted values conta...

CVE-2026-55764

Klever-Go (the Go implementation of the Klever blockchain protocol), prior to 1.7.19 , contains a signed int64 overflow in the semi-fungible token add-quantity path. In core/kapp/systemAccount/systemAcount.go, SFTAddCirculation added amount to meta.Circulation before comparing against MaxSupply, ...

CVE-2026-55855

MariaDB Connector/Node.js is vulnerable to SQL injection when attacker-controlled Buffer parameters are escaped client-side under the big5, gbk, sjis, cp932, or gb18030 character sets. The root cause is in PacketOutputStream.writeBufferEscape (lib/io/packet-output-stream.js), which escaped bytes ...

CVE-2026-55854

MariaDB Connector/Node.js can disclose an account password in cleartext when PAM dialog authentication is negotiated over an insecure transport. The root cause is in lib/cmd/handshake/auth/pam-password-auth.js and lib/cmd/handshake/authentication.js, where SendPamAuthPacketFactory lacked the secu...

CVE-2026-22056

StorageGRID (formerly StorageGRID Webscale) versions 11.5 and higher are susceptible to a Denial of Service vulnerability when deployed in a non-standard configuration and scenario. A successful exploit allows an attacker with low privileges and some control over the environment to cause a partia...