CVE-2026-35080

CVE-2026-35080 affects the ugw-restoreinfo method, where insufficient validation of user-controlled input enables a remote attacker with user privileges to delete arbitrary local files. The incident is described with the impact of local file deletion and requires LOW privileges with network attac...

CVE-2026-35079

The CVE-2026-35079 entry describes an issue in the ugw-restore method where a remote attacker with user privileges can delete arbitrary local files due to insufficient validation of user-controlled input. The vulnerability is assessed with high severity (CVSS 4.0: base 7.2; CVSS 3.1: base 8.1), r...

CVE-2026-35078

CVE-2026-35078 affects the ugw-logstop method. The vulnerability allows a remote attacker with user privileges to delete arbitrary local files due to insufficient validation of user-controlled input. According to the connected records, CVSS v4.0 base score 7.2 (HIGH) and CVSS v3.1 base score 8.1 ...

CVE-2026-35077

Technical details such as affected product versions, root cause specifics, and remediation are not publicly available in the provided documents. Monitor for updates from CERT VDE and CVE listings.

CVE-2026-35076

CVE-2026-35076 describes an arbitrary local file delete vulnerability in the bac-scanresult method caused by insufficient validation of user-controlled input. The issue allows a remote attacker with user privileges to delete arbitrary local files. The provided metrics indicate a high-severity imp...

CVE-2026-35075

CVE-2026-35075: An unauthenticated remote attacker can recover a default, hard-coded password from a firmware image, gaining full access to all affected devices. The Connected documents confirm the vulnerability allows extraction of the credential from firmware and implies full device compromise;...

CVE-2026-41032

The CVE-2026-41032 entry concerns Phoenix Contact CHARX SEC-3xxx charging controller firmware. Affected component: firmware on CHARX SEC-3xxx charging controllers. Vulnerability: an unauthenticated adjacent attacker can download log files from the controller, potentially exposing restricted infor...

CVE-2025-14774

ABB T-MAC Plus 4.0-24 is affected by an Incorrect Authorization vulnerability. The CVSS metrics indicate adjacent access with low attack complexity and no user interaction, but no exploitable details or patch information are provided in the documents. Impact is reported as HIGH for integrity and ...

CVE-2025-14773

CVE-2025-14773 is a stored cross-site scripting (XSS) vulnerability in ABB T-MAC Plus web application, affecting T-MAC Plus 4.0-24. The issue stems from improper neutralization of input during web page generation. CVSS metrics from ABB indicate a HIGH severity (CVSS v4.0 base 7.2; v3.1 base 8.0),...

CVE-2026-47065

CVE-2026-47065 (Apache MINA context) describes two deserialization bypass issues: first, resolveProxyClass bypasses the accept/allow-list when JDK resolves proxy interfaces from a serialized proxy via ObjectInputStream.readProxyDesc(), and second, readClassDescriptor triggers static initializers ...

CVE-2025-14772

CVE-2025-14772 concerns ABB T-MAC Plus, affected version 4.0-24. The issue is described as an authorization bypass via a User-Controlled key, indicating a broken access control vulnerability in the web application. Connected documents (NVD and CVE records) corroborate the same title and descripti...

CVE-2025-14771

Technical details (affected components, versions, impact, remediation) are not publicly available in the provided documents. Monitor for updates on ABB T-MAC Plus CVE-2025-14771.

CVE-2025-15656

CVE-2025-15656 is an Incorrect Privilege Assignment vulnerability affecting the WordPress School Management plugin (the CVE entry and related records list affected scope as WordPress School Management up to version 93.2.0). The underlying issue is privilege escalation via improper privilege assig...

CVE-2025-15655

The CVE-2025-15655 entry pertains to a SQL Injection in the WordPress School Management plugin (

CVE-2025-15654

CVE-2025-15654 describes a Reflected XSS in the Fox-themes Prague WordPress plugin (≤ 2.2.8). The root cause is improper neutralization of input during web page generation. Affected software is the Prague plugin, with vulnerable versions listed as up to 2.2.8; the issue is classified with CVSS 3....

CVE-2026-4035

CVE-2026-4035 affects mlflow/mlflow versions before 3.11.0. The API for AI Gateway secrets allows the api_key field to contain $ENV_VAR references, which are resolved against the MLflow server environment at runtime. Attackers can exfiltrate server-side environment credentials (e.g., AWS_ACCESS_K...

CVE-2026-5078

CVE-2026-5078 affects the morgan logging middleware; versions 1.2.0 through 1.10.1 write the Basic auth username from the Authorization header into logs without neutralizing CR/LF control characters, enabling log forgery. Affected formats include built-in combined, common, default, short, and any...

CVE-2026-50052

Affected products/versions: Vinyl Cache < 9.0.1 and Varnish Cache

CVE-2026-50031

The CVE affects FreeIPMI’s ipmi-oem client prior to version 1.16.18, where two OEM subcommands (ipmi-oem dell get-active-directory-config and ipmi-oem fujitsu get-sel-entry-long-text) can trigger exploitable buffer overflows on responses. Root cause: buffer overflows in response handling. Impact ...

CVE-2026-10705

CVE-2026-10705 affects dask up to 3.0, specifically the nunique_approx function in dask/dataframe/hyperloglog.py (HLL Handler). The flaw enables resource consumption and is exploitable remotely; attack complexity is reported as high. A fix is pending review (pull request awaiting acceptance). The...

CVE-2026-48099

Technical details for CVE-2026-48099 are not publicly available in the provided documents. Monitor for updates.

CVE-2026-10704

CVE-2026-10704 affects SourceCodester Pizzafy E-Commerce System 1.0. The vulnerability is in the Login function of /admin/admin_class_novo.php, where manipulating the Username parameter yields a SQL injection. The issue can be exploited remotely and the exploit is public. CVSS details indicate a ...

CVE-2026-10703

CVE-2026-10703 affects EIPStackGroup OpENer

CVE-2026-9516

CVE-2026-9516 affects Cpanel::JSON::XS for Perl prior to 4.41. A UTF-8 BOM prefixed input with a throwing decode filter callback can cause the decoder to skip restoration of the input pointer, leaving the scalar with an offset pointer. When the scalar is freed, the allocator may receive an invali...

CVE-2026-9334

Cpanel::JSON::XS (Perl) is affected by a type-confusion issue in decode_hv() for versions before 4.41 when dupkeys_as_arrayref is enabled. The code tests duplicate keys by evaluating SvTYPE (old_value) != SVt_RV && SvTYPE (SvRV (old_value)) != SVt_PVAV, which dereferences a value via SvRV(old_val...

CVE-2026-10694

SourceCodester Online Food Ordering System 2.0 is affected in the index.php include handling. The vulnerability arises from manipulation of the page parameter, causing a file inclusion (remote exploit surface). The issue is exploitable remotely and the exploit is public, enabling an attacker to i...

CVE-2026-10693

SourceCodester Online Boat Reservation System 1.0 is affected by an improper authorization issue in the Administrative Endpoint. The vulnerability enables remote manipulation across multiple endpoints, with exploit publicly disclosed and documented at CVE-2026-10693. CVSS metrics indicate network...

CVE-2026-36609

Mercusys AC12G (EU) V1 router affected. The vulnerability stems from a static authentication nonce that does not change between requests from the same source IP, compounded by a predictable XOR-based password encoding (securityEncode). This combination enables an attacker who captures authenticat...

CVE-2026-54171

CVE-2026-54171 affects the Ruby Excon library (RedirectFollower middleware). The vulnerability is due to not stripping sensitive headers when following redirects, risking inadvertent leakage of header data. A patch exists in v1.5.0; backporting the fix is possible as a workaround. No exploitation...

CVE-2021-27137

CVE-2021-27137 is a UPnP buffer overflow in DD-WRT firmware that allows remote code execution when an oversized uuid is processed in M-SEARCH over UDP port 1900. The vulnerability affects DD-WRT builds (change set 45723 and earlier; Buffalo devices with DD-WRT are noted as vulnerable). Exploitati...

CVE-2026-36607

Mercusys AC12G (EU) V1 router, firmware AC12G(EU)_V1_200909, is affected by CVE-2026-36607. The TDDP password change endpoint (code=10) allows unauthenticated brute-force attempts without rate limiting, unlike the login endpoint (code=7). An attacker on an adjacent network can attempt unlimited p...

CVE-2026-26824

CVE-2026-26824 affects libxls up to version 1.6.3, where the MSAT (Master Sector Allocation Table) memory allocated during read_MSAT() is not fully initialized before use by ole2_validate_sector_chain() in the OLE container parser. This use-of-uninitialized-memory can cause application crashes or...

CVE-2025-70101

lwext4 1.0.0 exposes an out-of-bounds read in ext4_ext_binsearch_idx (src/ext4_extent.c) that can trigger denial of service when processing a crafted ext4 image. The vulnerability stems from insufficient validation of extent header fields prior to performing a binary search over extent index entr...

CVE-2026-36606

CVE-2026-36606 affects Mercusys AC12G (EU) V1 router running firmware AC12G(EU)_V1_200909. The vulnerability stems from encrypting configuration backups with a hardcoded DES key using single DES in ECB mode. An attacker who gains a backup file can decrypt it to recover all stored credentials, inc...

CVE-2026-36611

CVE-2026-36611 affects Mercusys AC12G (EU) V1 with firmware AC12G(EU)_V1_200909. When the device processes UPnP POST requests on port 1900 without a SOAPAction header, it returns 128 bytes of uninitialized memory, exposing internal data to unauthenticated adjacent-network attackers. The NVD/NVD-d...

CVE-2026-36603

Mercusys AC12G (EU) V1 router (firmware AC12G(EU)_V1_200909) is affected by a UPnP IGD issue: 15 of 18 UPnP actions are exposed without authentication on port 1900, with UPnP enabled by default via the admin interface. This allows any unauthenticated LAN device to create arbitrary port forwarding...

CVE-2026-36605

CVE-2026-36605 affects the Mercusys AC12G (EU) V1 router with firmware AC12G(EU)_V1_200909. The issue is a vulnerability to a HTTP denial of service triggered by a small number of crafted incomplete HTTP requests, resulting in a persistent crash that requires physical power cycling to recover. Th...

CVE-2026-46447

OpenStack Ironic

CVE-2026-10770

CVE-2026-10770 in the initial document appears reserved. Connected entry DRUPAL-CONTRIB-2026-042 describes a vulnerability in the Drupal CleanTalk contrib module where _cleantalk_die() and ct_die() output the CleanTalk API response directly into HTML without sanitization, enabling potential HTML/...

CVE-2026-26825

Libxls 1.6.3 contains a use-of-uninitialized memory vulnerability when parsing malformed XLS files. The issue is triggered by uninitialized heap memory originating from the OLE layer (ole2_read) and is reachable via xls_parseWorkBook(). MemorySanitizer can detect it; the advisory notes undefined ...

CVE-2026-36602

CVE-2026-36602 affects the Mercusys AC12G (EU) V1 router with firmware AC12G(EU)_V1_200909. The issue arises in UPnP GetStatusInfo handling, which discloses kernel memory layout. An unauthenticated attacker on an adjacent network can obtain a raw MIPS KSEG0 kernel pointer, exposing kernel memory ...

CVE-2026-26379

CVE-2026-26379 affects Koha v0: Koha v.25.11 and earlier, where the Z39.50 configuration module is the entry point. The issue enables a remote attacker to execute arbitrary code. The available sources do not specify the underlying root cause details or exact vulnerable file/function, nor do they ...

CVE-2026-10040

CVE-2026-10040 is tracked against Arista EOS. The advisory confirms a local privilege condition: a user with eos-admin privileges on affected EOS platforms with Secure Boot enabled can bypass Secure Boot Software Image verification by using a specially crafted file. Exploitation requires local ac...

CVE-2026-10768

Technical details for CVE-2026-10768 are not publicly available in the provided documents; the entry is reserved with no disclosed impact, affected products, or mitigation information. Monitor for updates.

CVE-2026-36748

RockRMS vulnerability CVE-2026-36748 affects v16.13 and earlier of RockRMS up to v17.7.0, allowing Cross Site Scripting (XSS) via social media links in a user profile. The connected documents confirm the affected product version range and the XSS impact, but do not provide rooted technical detail...

CVE-2026-36576

The vulnerability CVE-2026-36576 affects the openlabs docker-wkhtmltopdf-aas project, specifically the app.py component, with evidence across NVD and related feeds. Up to commit 9f50579, an OS command injection allows an attacker to execute arbitrary commands via a crafted POST request. The CVSS ...

CVE-2026-36574

CVE-2026-36574 describes a DLL hijacking vulnerability in Wassimulator’s CactusViewer v2.3.0. The issue, rooted in DLL loading, enables local privilege escalation and arbitrary code execution. The CVSS details indicate LOCAL attack vector, no privileges required, but user interaction is required,...

CVE-2026-36608

The advisory concerns the Mercusys AC12G (EU) V1 router with firmware AC12G(EU)_V1_200909. A UPnP AddPortMapping issue allows an unauthenticated LAN attacker to forward external ports to the router’s admin interface by abusing the InternalClient field (accepting 192.168.1.1 or 127.0.0.1). This en...

CVE-2026-36616

CVE-2026-36616 affects the Mercusys AC12G (EU) V1 with firmware AC12G(EU)_V1_200909. The issue is the presence of hardcoded WiFi driver credentials embedded in the production firmware binary: a RADIUS shared secret, a WPS test key, and a default PSK. The vulnerability arises from these sensitive ...

CVE-2026-26378

Affects Koha 25.11 and earlier. Cross-Site Scripting via the file upload function in Invoice features allows a remote attacker to execute arbitrary code. Root cause details are not provided beyond this description. No remediation or patch version is stated in the available documents.