CVE-2026-45681

Summary: OpenTelemetry eBPF Instrumentation contains a memory‑read overflow in the CPU‑mismatch fallback path. Prior to version 0.9.0, a 256‑byte backup buffer is used for the per‑CPU message buffer, while the logical payload size can reach 8KB. If a CPU mismatch occurs, the code can read beyond ...

CVE-2026-45680

CVE-2026-45680 affects OpenTelemetry eBPF Instrumentation (OBI) prior to version 0.9.0. The root cause is an unbounded delta in calculateStats(), where bp.runCount − bp.prevRunCount is used without a cap, causing the exporter to loop over probe hits for large run-count deltas. This can lead to hi...

CVE-2026-45679

CVE-2026-45679 affects OpenTelemetry eBPF Instrumentation (OBI). Prior to version 0.9.0, OBI exports raw Redis error text as the span status message, causing Redis error replies to be exposed in telemetry backends. This can leak attacker-controlled or sensitive data (tokens, PII, etc.) into downs...

CVE-2026-45678

The CVE-2026-45678 vulnerability affects OpenTelemetry eBPF Instrumentation before version 0.9.0, where the Postgres BIND parsing logic mishandles BIND payloads that are empty or unterminated. The issue arises in the Postgres protocol parser that assumes a NUL-terminated portal name; a crafted pa...

CVE-2026-45676

CVE-2026-45676 affects OpenTelemetry eBPF Instrumentation (OBI). Before version 0.9.0, OBI’s replacement ELF parser trusts section offsets, counts, and string offsets from the executable, allowing a crafted local ELF to trigger invalid dereferences or out-of-bounds slicing in the parser. The vuln...

CVE-2026-45682

OpenTelemetry eBPF Instrumentation CVE-2026-45682 describes a leak in CappedConcurrentHashMap used for Java TLS state tracking: when entries are deleted, keys are not removed from the insertion-order queue, allowing the queue to grow in long-running instrumented JVMs. The issue causes heap exhaus...

CVE-2026-33398

NamelessMC 2.2.4 is affected by an insecure access control in modules/Forum/pages/forum/get_quotes.php, which only checks that a caller is logged in and reads a post by an attacker-controlled post ID. The backend helper in modules/Forum/classes/Forum.php does not enforce forum or topic ACLs, allo...

CVE-2026-40780

CVE-2026-40780 (WordPress BookIt plugin) : Affected product is the BookIt plugin (Liquid Web / StellarWP) for WordPress. The vulnerability is a broken authentication/password-recovery bypass via an alternate path or channel, enabling password recovery exploitation. Affects BookIt versions prior t...

CVE-2026-42654

CVE-2026-42654 affects the WordPress Wallet System for WooCommerce plugin (versions up to 2.7.5). The vulnerability is an authentication bypass via an alternate path or channel that enables password recovery exploitation. This is described as a broken authentication vulnerability and specifically...

CVE-2026-40619

CVE-2026-40619 affects Genetec Security Center main server installations. The issue could allow an attacker with local OS privileges on the main server to access the Server Admin credentials . It is tied to specific installation package builds, not just the product version, with vulnerable and re...

CVE-2026-10629

CVE-2026-10629 concerns Verizon IMS SIP signaling lacking IPsec integrity protection. The SIP signaling stack (unspecified Verizon IMS version) reportedly sends SIP messages without ESP encapsulation or Security-Client/Security-Server headers, exposing REGISTER, INVITE, MESSAGE, BYE, UPDATE, and ...

CVE-2026-10047

The CVE-2026-10047 entry describes an out-of-bounds write in Bitdefender Napoca bare-metal hypervisor’s real-mode hook handler (napoca/kernel/handler.c). The vulnerability arises from using a guest-controlled SS:SP-derived offset as an index into the 1MB RealModeMemory buffer without bounds check...

CVE-2026-10046

Bitdefender Napoca bare-metal hypervisor contains an out-of-bounds write in the BIOS INT 0x15 / E820 memory map handler (napoca/guests/bios_handlers.c). The handler derives a destination offset into the guest RealModeMemory from guest-controlled ES and EDI without validating the address against t...

CVE-2026-49753

Summary of the vulnerability : CVE-2026-49753 affects the Elixir Mint HTTP/1 client. The root cause is a lenient Content-Length parser in Mint.HTTP1.Parse.content_length_header/1, which accepts a leading + sign (e.g., +0, +123) despite RFC 7230 requiring unsigned digits only. When the same Mint c...

CVE-2026-47117

OpenMed prior to version 1.5.2 is affected by a remote code execution vulnerability in the PII privacy-filter model loading path. The privacy-filter dispatcher uses broad substring matching on the user-supplied model_name, enabling a value like attacker/foo-privacy-filter-bar to route to a path t...

CVE-2026-49754

The CVE-2026-49754 entry describes a memory exhaustion vulnerability in elixir-mint Mint’s HTTP/2 receive path. When a HEADERS frame arrives without END_HEADERS, the unparsed header-block is queued and each subsequent CONTINUATION frame on that stream appends to the accumulator with no cap. There...

CVE-2026-48862

Mint’s HTTP/2 client is vulnerable to unbounded growth of conn.streams due to PUSH_PROMISE handling. In Mint.HTTP2.decode_push_promise_headers_and_add_response/5, a :reserved_remote entry is created for every promised stream ID, and assert_valid_promised_stream_id/2 only checks that the ID is eve...

CVE-2026-48861

The CVE describes a CRLF injection risk in elixir-mint Mint through the HTTP/1 request line construction. Specifically, encode_request_line/2 directly embeds caller-supplied method and target into the line, allowing an attacker to terminate the line and inject headers, enabling HTTP request split...

CVE-2026-9522

Summary (CVE-2026-9522): Improper access control in the PAM account discovery feature of Devolutions Server 2026.1.19 and earlier enables an authenticated user without administrative privileges to delete network discovery scan configurations. Affected product is Devolutions Server (version line n...

CVE-2026-7299

Appsmith CVE-2026-7299 affects the SQL query editor autocomplete renderer, where unsanitized database object names rendered into innerHTML enable persistent XSS by a developer with access. This can execute arbitrary JavaScript in other workspace members’ sessions when interacting with the same da...

CVE-2026-9590

Technical details beyond the description are not publicly provided in the supplied documents. No affected versions, exploit specifics, or remediation steps are confirmed here; monitor for updates from the vendor and standard advisories.

CVE-2026-10621

CVE-2026-10621 : Path traversal (Zip Slip) in Collibra Agent during ZIP extraction allows a remote attacker to write arbitrary files outside the extraction directory via a crafted ZIP archive, notably through POST /rest/restore. Exploitation can lead to remote code execution when a malicious JSP ...

CVE-2026-49782

CVE-2026-49782 concerns the WordPress Elementor Website Builder plugin (

CVE-2026-27351

CVE-2026-27351 affects the WordPress Crew HRM plugin up to version 1.2.2. Root cause: Missing Authorization through incorrectly configured access control. Impact includes Low integrity, Low availability, and No confidentiality impact per CVSS 3.1 (base score 5.4). Attack vector is Network with Lo...

CVE-2026-10622

CVE-2026-10622 concerns the Collibra Agent and exposes remote unauthenticated access via exposed REST endpoints (/rest/*). The issue stems from improper authentication/authorization for privileged functionality, enabling remote attackers to interact with sensitive functionality. CVSS v3.1 vector:...

CVE-2019-25719

Dräger Infinity Acute Care System and Standalone Infinity M540 monitors running VG4.1.1, VG4.0.3, and lower are affected by network message handling vulnerabilities. The issue allows network-adjacent attackers to spoof or tamper with data and to cause denial-of-service conditions. If an attacker ...

CVE-2026-28116

CVE-2026-28116 affects the WordPress Progress Planner plugin up to version 1.9.0. The issue is a Stored XSS due to improper neutralization of input during web page generation. Under CVSS 3.1, the impact is Low for confidentiality, integrity, and availability, with a Network attack vector, Low att...

CVE-2025-68886

CVE-2025-68886 is a WordPress Cookiteer theme vulnerable to Local File Inclusion (LFI) due to improper filename handling in PHP Include/Require. Affected: Cookiteer versions up to 1.4.8. The vulnerability is classified as high risk (CVSS v3.1 base score 8.1; Attack Vector: Network; Impact: Confid...

CVE-2025-69369

CVE-2025-69369 is a Local File Inclusion vulnerability in the WordPress theme Racquet (Racquet

CVE-2025-58897

The CVE-2025-58897 entry concerns the WordPress Fermentio theme (

CVE-2025-58707

The CVE-2025-58707 issue is a Local File Inclusion vulnerability in the WordPress Spin theme (Spin) versions up to 1.8. It arises from improper handling of filenames for include/require statements in a PHP program, enabling PHP LFI. Affected product: Axiomthemes Spin (WordPress Spin theme

CVE-2019-25717

CVE-2019-25717 affects Dräger Infinity Delta, Delta XL, and Kappa patient monitors. The vulnerability allows unauthenticated attackers over a network to access exposed log files, exposing device internals, location data, and wired network configuration details. No root cause or remediation detail...

CVE-2026-42795

Gleam: Symlink following in Hex package export vulnerability (CVE-2026-42795) allows embedding files outside the project root into the generated Hex package. Root cause: file collection in compiler-cli/src/fs.rs uses follow_links(true) for publishable directories (e.g., src/, priv/) and add_path_...

CVE-2026-43965

Gleam path traversal vulnerability CVE-2026-43965 allows arbitrary directory deletion via malicious build/packages/packages.toml content. During deps download, package keys read from build/packages/packages.toml are passed to path construction without validation, enabling absolute or relative tra...

CVE-2026-32685

CVE-2026-32685 describes a path traversal in Gleam’s docs build process. The vulnerability arises from unvalidated handling of documentation.pages paths and sources in gleam.toml, enabling an attacker to read arbitrary local files and to write generated documentation outside the intended output d...

CVE-2026-32250

CVE-2026-32250 affects NamelessMC (Minecraft server website software). The issue is a Reflected XSS in the id parameter of the endpoint “/index.php?route=/queries/user/”. User input is echoed into the HTML response without proper sanitization/output encoding, enabling an attacker to inject JavaSc...

CVE-2026-39555

The CVE-2026-39555 entry concerns the WordPress Askka theme (versions up to 1.3.1). The vulnerability is a PHP Object Injection via a deserialization of untrusted data in the Askka plugin/theme, allowing object injection. Affected component: WordPress Askka theme

CVE-2026-9844

The vulnerability CVE-2026-9844 affects Roche Diagnostics navify Digital Pathology, specifically the RabbitMQ Management interface modules, where default credentials are used. Affected versions are navify Digital Pathology 2.0.0 up to (but not including) 2.4.1. The problem is the use of default u...

CVE-2026-7313

CVE-2026-7313 affects Progress Sitefinity Web Services (versions 8.0.5700–13.3.7652). It describes CWE-522: Insufficiently Protected Credentials in web services, allowing a remote authenticated attacker to obtain plaintext credentials used to connect to the Sitefinity Insight service. Exploitatio...

CVE-2026-7312

CVE-2026-7312 affects Progress Sitefinity versions 14.0.7700–14.4.8152, 15.0.8200–15.0.8234, 15.1.8300–15.1.8335, 15.2.8400–15.2.8441, 15.3.8500–15.3.8531, and 15.4.8600–15.4.8630. CWE‑522 describes Insufficiently Protected Credentials in web services. The vulnerability allows a remote unauthenti...

CVE-2026-7201

Progress Sitefinity (Progress) is affected by CVE-2026-7201: CWE-639, an authorization bypass through a user-controlled key in web services. A remote authenticated attacker can modify account properties of other users, potentially leading to account compromise, requiring access to values not norm...

CVE-2026-7198

Progress Sitefinity CMS is affected by CVE-2026-7198 due to CWE-284 Improper Access Control in web services. Versions affected: 15.4.8623 and earlier, with disclosure that 15.4.8630 addresses the issue (exact remediation not detailed in the provided documents). A remote unauthenticated attacker c...

CVE-2026-7195

CVE-2026-7195 affects Progress Sitefinity web services. The issue is CWE-20: Improper Input Validation in Sitefinity versions 14.1.x–14.3.x, 14.4.x before 14.4.8152, 15.0.x before 15.0.8234, 15.1.x before 15.1.8335, 15.2.x before 15.2.8441, 15.3.x before 15.3.8531, and 15.4.x before 15.4.8630. A ...

CVE-2026-10611

CVE-2026-10611 describes an authentication bypass in MISP when LDAP mixed authentication is enabled with OTP enforcement. In deployments with LdapAuth.mixedAuth=true and Security.require_otp=true, users authenticated via an authentication plugin (e.g., LDAP) may have their session established dur...

CVE-2026-39553

CVE-2026-39553 concerns WordPress WaveRide theme versions up to 1.4, due to improper control of the filename for include/require in a PHP program, enabling Local File Inclusion (LFI). Affected software: WaveRide theme (Select-Themes) with PHP-based inclusion vulnerability. Root cause: inadequate ...

CVE-2026-39552

CVE-2026-39552 affects the WordPress Blueprint theme prior to 1.1.5, which suffers from an Improper Control of Filename for Include/Require (PHP Local File Inclusion). The vulnerability arises from inadequate validation of included/required filenames, enabling an attacker to cause local file incl...

CVE-2026-41918

The vulnerability CVE-2026-41918 affects RUGGEDCOM RST2428P (6GK6242-6PA00) all versions before V4.0. The issue arises when an authenticated user modifies certain configurations, causing sensitive information to be stored in the browser cache. An authenticated attacker could access this cached da...

CVE-2026-8993

Technical details are not publicly available in the provided documents. Monitor for updates.

CVE-2026-39551

The CVE-2026-39551 entry concerns the WordPress Töbel theme (versions <= 1.8.1) with a PHP Object Injection /deserialization vulnerability in Töbel. Affected component: Töbel theme; root cause: deserialization of untrusted data enabling object injection. Impact metrics from Patchstack indicate...

CVE-2026-39550

CVE-2026-39550 affects the WordPress Aperitif theme (versions up to 1.6). The issue is a PHP Object Injection caused by deserialization of untrusted data in Aperitif, enabling exploitation via a network vector with no user interaction and no privileges required. The CVSSv3.1 base score is 8.1 (HI...