CVE-2026-37071: Improper Privilege Management

Arbitrary File Rename Leading to Privilege Escalation in Actions::renameFile function in Veno File Manager Project 4.4.9 allows an authenticated attacker with 'reanme' permission to take over the super administrator account via a specially crafted POST request to the affected endpoint renaming th...

CVE-2026-30046

A reachable assertion vulnerability in the NUDM-UECM interface of Open5GS v2.7.6 allows attackers to cause a Denial of Service DoS via supplying a crafted DELETE request...

CVE-2026-30047

A reachable assertion vulnerability in the /nsmf-pdusession/v1/sm-contexts component of Open5GS v2.7.6 allows attackers to cause a Denial of Service DoS via supplying a crafted DELETE request...

CVE-2026-30046

The Open5GS v2.7.6 software contains a reachable assertion vulnerability within the NUDM-UECM interface . An attacker can exploit this flaw by supplying a crafted DELETE request , which leads to a Denial of Service (DoS) . No specific remediation, exploit links, or MITRE ATT&CK IDs are provided i...

CVE-2026-30059

The free5gc v4.0.1 software is affected by a vulnerability in its NAS decoder component . An attacker can trigger a Denial of Service (DoS) by sending a crafted Registration Request message . While specific remediation steps are not provided in the documents, the vulnerability is characterized by...

PT-2026-82520

A reachable assertion vulnerability in the /nsmf-pdusession/v1/sm-contexts component of Open5GS v2.7.6 allows attackers to cause a Denial of Service DoS via supplying a crafted DELETE request...

EUVD-2026-67106

An issue in the CreateUEContextProcedure function /v1/ue-contexts/supi of free5gc v4.1.0 allows attackers to cause a Denial of Service DoS via supplying a crafted PUT request...

PT-2026-82857

A business logic flaw in WatchGuard Dimension allows an authenticated administrator to trigger multiple backend operations within a single logical flow by sending a specially crafted request...

CVE-2026-30059: Allocation of Resources Without Limits or Throttling

An issue in the NAS decoder component of free5gc v4.0.1 allows attackers to cause a Denial of Service DoS via a crafted Registration Request message...

CVE-2026-30047

A reachable assertion vulnerability in the /nsmf-pdusession/v1/sm-contexts component of Open5GS v2.7.6 allows attackers to cause a Denial of Service DoS via supplying a crafted DELETE request...

CVE-2026-30050

An issue in the ModifyAMFEventSubscriptionProcedure function processor/eventexposure.go of free5gc v4.1.0 allows attackers to cause a Denial of Service DoS via supplying a crafted PATCH request...

CVE-2026-30057: Allocation of Resources Without Limits or Throttling

An issue in the CreateUEContext handler component of free5gc v4.1.0 allows attackers to cause a Denial of Service DoS via supplying a crafted request...

EUVD-2026-67102

An integer overflow in the /nnrf-disc/v1/nf-instances component of open5gs v2.7.6 allows attackers to cause a Denial of Service DoS via supplying a crafted HTTP/2 GET request...

PT-2026-82410

Name of the Vulnerable Software and Affected Versions Spring Framework versions 7.0.0 through 7.0.8 Spring Framework versions 6.2.0 through 6.2.19 Spring Framework versions 6.1.0 through 6.1.28 Spring Framework versions 6.0.0 through 6.0.30 Spring Framework versions 5.3.0 through 5.3.49 Spring...

CVE-2026-37064

User enumeration in /vfm-admin/ajax/usr-check.php in Veno File Manager Project 4.4.9 allows an unauthenticated attacker to enumerate the application users via sending a specially crafted POST request to the affected endpoint with a chosen 'username' parameter to test if the user exists...

PT-2026-82468

Unauthenticated Cross Site Request Forgery CSRF in GeoDirectory = 2.8.176 versions...

PT-2026-82562

FrontAccounting through 2.4.20 generates a CSRF token in end form in includes/ui/ui controls.inc and embeds it as the token hidden field in every form it renders, but only admin/users.php and admin/change current user password.php call check csrf token to validate it. No financial transaction...

CVE-2026-37068

Arbitrary file write in /vfm-admin/index.php?section=translations&action=update in Veno File Manager Project 4.4.9 allows an authenticated user with the role of super administrator to overwrite any php file in the application via a specially crafted POST request to the affected endpoint...

CVE-2026-37070

Incorrect access control in /vfm-admin/ajax/streamvid.php in Veno File Manager Project in 4.4.9 allows an authenticated attacker to read any uploaded files by other users as long as it knows the path and filename via a specially crafted GET request to the affected endpoint...

CVE-2026-37068: Improper Limitation of a Pathname to a Restricted Directory

Arbitrary file write in /vfm-admin/index.php?section=translations&action=update in Veno File Manager Project 4.4.9 allows an authenticated user with the role of super administrator to overwrite any php file in the application via a specially crafted POST request to the affected endpoint...