CVE-2026-53420

Buffer overflow in a Zoom Phone feature of Zoom Workplace Clients may allow an unauthenticated user to conduct a escalation of privilege via network access...

CVE-2026-102603 Gotify: Insufficiently Protected Password Change endpoint

Gotify server is a simple server for sending and receiving messages in real-time per WebSocket. Prior to 3.0.0, the password change endpoint POST /current/user/password accepts a valid client token without requiring the account's current password or another elevated authentication step. An attack...

CVE-2026-65199 Huawei openUBMC low-privilege SNMP to administrator privilege escalation

openUBMC assigns the full privilege set to pseudo-identities representing SNMP callers. An authenticated, but low-privilege, SNMP user can therefore invoke mapped backend operations as an administrative identity. In routemapper/account.lua, getuserprivilege returns the complete nine-privilege set...

CVE-2026-53418

Improper Authorization in Handler for Custom URL Scheme in Zoom Workplace for Android before version 7.2.1 may allow an unauthenticated user to conduct an escalation of privilege via network access...

CVE-2026-77362 obsidian-tc bridge tools expose data outside the read ACL

obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. Prior to 1.3.1, bridge tools do not consistently apply the read access-control list ACL to every returned field. The tasksfilter tool exposes group counts derived from denied notes, makemdquery passes...

CVE-2026-77362 obsidian-tc bridge tools expose data outside the read ACL

obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. Prior to 1.3.1, bridge tools do not consistently apply the read access-control list ACL to every returned field. The tasksfilter tool exposes group counts derived from denied notes, makemdquery passes...

CVE-2026-74043 Wazuh 4.1.1 before 4.14.8 Path Traversal via Cluster Upload Functions

Wazuh from 4.1.1 before 4.14.8 contains a path traversal vulnerability in uploadlistfile, uploadrulefile, and uploaddecoderfile that allows malicious cluster workers to write files at arbitrary paths. Attackers holding the cluster key can send DistributedAPI requests with ../ sequences in filenam...

CVE-2026-74043 Wazuh 4.1.1 before 4.14.8 Path Traversal via Cluster Upload Functions

Wazuh from 4.1.1 before 4.14.8 contains a path traversal vulnerability in uploadlistfile, uploadrulefile, and uploaddecoderfile that allows malicious cluster workers to write files at arbitrary paths. Attackers holding the cluster key can send DistributedAPI requests with ../ sequences in filenam...

CVE-2026-74035 Wazuh 4.6.0 before 4.14.8 Authentication Bypass via Empty Password in update_user

Wazuh versions from 4.6.0 before 4.14.8 contain an authentication bypass vulnerability where security.updateuser places the reserved user guard and password policy inside a falsy truthiness check. A delegated user administrator can send an empty password to the user update endpoint, bypassing the...

CVE-2026-74035 Wazuh 4.6.0 before 4.14.8 Authentication Bypass via Empty Password in update_user

Wazuh versions from 4.6.0 before 4.14.8 contain an authentication bypass vulnerability where security.updateuser places the reserved user guard and password policy inside a falsy truthiness check. A delegated user administrator can send an empty password to the user update endpoint, bypassing the...

CVE-2026-74031 Wazuh 4.1.1 before 4.14.8 Path Traversal File Deletion via Rule/Decoder Delete Helpers

Wazuh from 4.1.1 before 4.14.8 contains a path traversal vulnerability in the deleterulefile and deletedecoderfile helpers that allows malicious cluster workers to delete arbitrary files via an unvalidated filename parameter. Attackers holding the cluster key can invoke these helpers through...

CVE-2026-74031 Wazuh 4.1.1 before 4.14.8 Path Traversal File Deletion via Rule/Decoder Delete Helpers

Wazuh from 4.1.1 before 4.14.8 contains a path traversal vulnerability in the deleterulefile and deletedecoderfile helpers that allows malicious cluster workers to delete arbitrary files via an unvalidated filename parameter. Attackers holding the cluster key can invoke these helpers through...

CVE-2026-74031 Wazuh 4.1.1 before 4.14.8 Path Traversal File Deletion via Rule/Decoder Delete Helpers

Wazuh from 4.1.1 before 4.14.8 contains a path traversal vulnerability in the deleterulefile and deletedecoderfile helpers that allows malicious cluster workers to delete arbitrary files via an unvalidated filename parameter. Attackers holding the cluster key can invoke these helpers through...

CVE-2026-109938 FreeRDP 3.11.0 before 3.32.0 Integer Overflow via Mapped Video Geometry Update

Positive mapped-video coordinates overflow and abort FreeRDP clients A malicious or compromised RDP server can terminate a FreeRDP client after the user connects with video redirection enabled...

CVE-2026-109680 FreeRDP 3.18.0 before 3.32.0 Heap Out-of-Bounds Write via ARM Redirected Username

FreeRDP 3.18.0 before 3.32.0 has a heap-based out-of-bounds write in freerdpinterruptiblegetline, which shrinks the buffer to 32 bytes while keeping a pre-filled suggested username's length as its write offset. A malicious or compromised ARM routing service can return a long redirectedUsername th...

CVE-2026-109938 FreeRDP 3.11.0 before 3.32.0 Integer Overflow via Mapped Video Geometry Update

Positive mapped-video coordinates overflow and abort FreeRDP clients A malicious or compromised RDP server can terminate a FreeRDP client after the user connects with video redirection enabled...

CVE-2026-109680 FreeRDP 3.18.0 before 3.32.0 Heap Out-of-Bounds Write via ARM Redirected Username

FreeRDP 3.18.0 before 3.32.0 has a heap-based out-of-bounds write in freerdpinterruptiblegetline, which shrinks the buffer to 32 bytes while keeping a pre-filled suggested username's length as its write offset. A malicious or compromised ARM routing service can return a long redirectedUsername th...

The vulnerability of the QAFA Firmware for telecommunications equipment lies in its ability to bypass authentication using a user-controlled key. This allows attackers to gain access to the administrative web console.

The vulnerability of the QAFA Firmware for telecommunications equipment relates to bypassing authentication using a key controlled by the user. Exploiting this vulnerability can allow an attacker, operating remotely, to gain access to the administrative web console...

Ghostcat-Tomcat-AJP-Exploit-Py3

Tomcat Ghostcat CVE-2020-1938 / CNVD-2020-10487 Vulnerability Detection Tool Introduction This project provides a Python verification script for verifying the Apache Tomcat AJP protocol local file inclusion vulnerability commonly known as Ghostcat, CVE-2020-1938 / CNVD-2020-10487. This script is ...

CVE-2026-54337-PoC

CVE-2026-54337 PoC CVE-2026-54337 - Unauthenticated File Write/Overwrite in fireshare test.mp4 Step 2 : Run the following curl command make sure to change the placeholder $ curl -s -w "HTTP %httpcode\n" \ -F "file=@;filename= -selectstreams v.mp4" \ -F "folder=testfolder -o " ...