CVE-2026-54758

Technical details for CVE-2026-54758 are not publicly available in the provided documents. This entry appears placeholder; monitor for updates.

CVE-2026-57233

Technical details are not publicly available in the provided documents. Monitor for updates.

CVE-2026-13385

The CVE-2026-13385 entry affects certain ASUS router models. It covers an vulnerability path where an attacker can perform a remote MITM to cause the device to download and execute arbitrary commands via a spoofed server, due to improper validation of the integrity check value and improper certif...

CVE-2026-15029

The CVE-2026-15029 entry covers an Untrusted Pointer Dereference in ASUS System Control Interface v3, ASUS System Control Interface, and ASUS Business Manager. The vulnerability permits a local administrator to perform arbitrary physical memory read and write operations via crafted IOCTL requests...

CVE-2026-15030

The CVE-2026-15030 entry concerns ASUS components: System Control Interface v3, System Control Interface, and ASUS Business Manager. The weakness is an out-of-bounds read caused by a crafted IOCTL request that bypasses validation, enabling a local administrator to read memory regions beyond the i...

CVE-2026-13585

The CVE-2026-13585 affects the ASUS System Control Interface (SCI) driver and ASUS Business Manager. The root cause is Allocation of Resources Without Limits and Throttling, leading to potential exposure of sensitive information via crafted IOCTL requests. A local administrator can leverage this ...

CVE-2026-8920

The vulnerability CVE-2026-8920 concerns ASUS Aura Wallpaper Service. It describes Improper Restriction of Communication Channel to Intended Endpoints and External Control of File Name or Path, enabling a local user to perform file operations by sending crafted commands that contain an arbitrary ...

CVE-2026-8919

CVE-2026-8919 affects ASUS GameSDK. A permissive cross-domain policy with untrusted domains could let a remote user induce a local UNC request to the application’s local service endpoint, exposing a local NTLM hash and enabling information disclosure, data tampering, or service disruption. The is...

CVE-2026-11851

CVE-2026-11851 is an SQL Injection vulnerability in the web management interface of certain ASUS router models. The root cause is improper neutralization of special elements in SQL commands. It can be exploited by a remote authenticated attacker with high privileges, without user interaction, to ...

CVE-2026-13230

The CVE-2026-13230 entry concerns TP-Link Kasa EC70 v4 and EC71 v4. The issue lies in the local discovery mechanism, where geolocation-related data can be retrieved without authentication. Affects confidentiality only; no evidence of integrity or availability impact is reported. Exploitation cont...

CVE-2026-9770

Affected products: TP-Link Kasa EC70 v4 and EC71 v4 firmware. Issue: a static cryptographic private key is stored in a read-only filesystem shared across devices, allowing extraction from the firmware image. Impact: an unauthenticated attacker on the same network could use the embedded key in the...

CVE-2026-26718

CVE-2026-26718 – xxl-job-admin 3.0.0 CSRF flaw . A Cross-Site Request Forgery exists in the xxl-job-admin web application (v3.0.0) that enables an attacker to perform unauthorized modifications to Glue IDE shell scripts. The affected endpoint lacks proper CSRF token validation and accepts arbitra...

CVE-2026-38753

CVE-2026-38753 affects Busybox v1.38.0 in the editors/awk.c file, specifically the awk_sub() function, where a use-after-free leads to Denial of Service when presented with a crafted AWK script. The available connected sources confirm the affected product and root cause, and describe the impact a...

CVE-2026-15916

The connected OSV/Drupal entries describe a vulnerability in Drupal's Image module where access to image style derivatives is not sufficiently checked when files are served via a non-private file stream. This leads to information disclosure. Affected component: Drupal Image module (core) with ima...

CVE-2026-6071

PT-2026-60348 references a Rockwell Automation Arena Simulation vulnerability: DOE File Parsing Out-Of-Bounds Write leading to Remote Code Execution. The issue is triggered during parsing of DOE files in Arena Simulation; root cause is an out-of-bounds write. Details on affected versions, exploit...

CVE-2025-65720

Open Source GPT Researcher v3.3.7 is affected by CVE-2025-65720, described as a remote code execution vulnerability. Attackers can cause arbitrary commands to run on a victim system by interacting with a crafted HTML page. The linked ENISA EUVD entry confirms the issue and references exploitation...

CVE-2026-52522

Technical details for CVE-2026-52522 are not publicly available in the provided documents; monitor for updates and disclosures.

CVE-2026-68105

The CVE-2026-68105 entry corresponds to a VaultWhisper vulnerability in HashiCorp Vault (Transit Secrets Engine). The fault lies in the transit cache’s memory manager, which under certain conditions fails to enforce read-policy restrictions on cached cryptographic keys. An authenticated user or l...

CVE-2026-38752

Affected software: BusyBox. Vulnerability location: evaluate() in editors/awk.c, commit 371fe9. Issue: stack overflow that can cause a Denial of Service when given a crafted AWK script. Impact: DoS; CVSS indicates high availability impact with network attack vector and no privileges. Evidence not...

CVE-2026-26719

CVE-2026-26719 affects xxl-job-admin v3.0.0 with a stored/reflected XSS in JobInfoController.java via unsanitized addressList (stored/URL-encoded JavaScript). Affected versions are

CVE-2026-61371

Microsoft AVML before 0.17.0 is affected. On Unix, it could follow a symlink when opening a destination output path, allowing truncation/overwrite of the symlink target at open-time via O_TRUNC and potentially before full input validation. This is described as a truncation-before-validation issue...

CVE-2026-30623

CVE-2026-30623 affects LiteLLM 1.18.10 via the MCP server creation feature. The vulnerability arises when MCP configuration JSON can set arbitrary values for command and args, which LiteLLM executes on the host without validation, enabling remote code execution with the LiteLLM process privileges...

CVE-2026-15917

Drupal core (version 11.2 and later) integrates the HTMX JavaScript library. The HTMX-related XSS vulnerability arises because Drupal core’s XSS filter does not sufficiently sanitize certain HTMX attributes, enabling cross-site scripting if an attacker can inject HTML with those attributes. The v...

CVE-2026-55805

CVE-2026-55805 is linked to a Drupal core issue (DRUPAL-CORE-2026-012) involving a cross-site scripting (XSS) vulnerability in the Layout Builder module. The root cause is inadequate sanitization of block labels in certain scenarios, allowing script injection when both the attacker and the target...

CVE-2026-38974

CVE-2026-38974 affects Dulwich up to 1.1.0, where the SSH host key verification is missing in contrib/paramiko_vendor.py. The flaw enables a remote attacker to impersonate a legitimate Git server during SSH connections, potentially exposing sensitive data or enabling code execution on the client....

CVE-2026-59159

Linux Mint 23 with Wayland has fixed CVE-2026-59159 in mintupdate. Users should update to apply the fix and mitigate the vulnerability.

CVE-2026-20374

PT-2026-60284 (PT Security) references CVE-2026-20374 and outlines research themes around it, including UART access, use of Ghidra, remote debugging, ROP chains, and embedded exploit development. The entry does not specify affected products, versions, root cause, or remediation in the provided te...

CVE-2026-36590

The CVE-2026-36590 entry concerns EMQ NanoMQ (version 0.24.9). Affected component is the broker_tcp.c module, specifically the nni_qos_db_set function, which can be exploited remotely to cause a denial of service. The CVSS v3.1 vector indicates a Network, Low-Privilege, No User Interaction attack...

CVE-2026-51380

CVE-2026-51380 affects Tenda AC10 v3 with firmware V03.03.16.09. A buffer overflow in the /cgi-bin/UploadCfg endpoint could lead to a permanent DoS or remote code execution. The CVSSv3.1 score is 9.8 (CRITICAL), with network access, no privileges required, no user interaction, and high impact on ...

CVE-2026-38755

BusyBox 1.38.0 is affected by CVE-2026-38755 due to a heap overflow in the evalcommand() function (shell/ash.c). The vulnerability can be triggered by crafted input and leads to Denial of Service. The CVE entry reports CVSSv3.1 base score 7.5 (HIGH) with network attack vector, low attack complexi...

CVE-2026-38754

CVE-2026-38754 describes a heap overflow in Busybox v1.38.0, specifically in the ifsbreakup() function (shell/ash.c). Exploitation via crafted input can cause a Denial of Service (DoS). Connected sources confirm the affected software and the underlying cause; there is no public exploit detail in ...

CVE-2026-30618

CVE-2026-30618 affects xszyou Fay 4.3.1, where the MCP STDIO server management and command execution handling can be abused via a publicly exposed MCP management interface to execute arbitrary commands in the Fay service context. Technical details across sources describe an RCE via attacker-contr...

CVE-2026-15753

CVE-2026-15753 affects zhinianboke xianyu-auto-reply on Server; the vulnerability concerns the /api/v1/payment/withdraw/review?action=approve endpoint where manipulation can cause the server to trust HTTP permission methods. The patch 19fc3282a1bb78a05c34945c088525d20e081cbd is referenced as a fi...

CVE-2026-5269

Technical details about CVE-2026-5269 are not publicly available in the provided documents; no affected product versions, exploit information, or remediation specifics are included. Monitor for updates.

CVE-2026-5270

Technical details (affected product versions, components, root cause, exploitability, and fixes) are not publicly provided in the supplied documents. Monitor for updates from official sources (NVD, ENISA EUVD, CVE listings) for concrete mitigation guidance.

CVE-2026-15752

CVE-2026-15752 affects the backend user endpoint of zhinianboke xianyu-auto-reply, specifically an issue in an unknown function under the file path /api/v1/users/ that permits remote manipulation leading to missing authorization. The vulnerability is linked to a rolling-release project with no pu...

CVE-2026-56154

Technical details for CVE-2026-56154 are not publicly available in the provided documents. The entry remains reserved with no disclosed impact, affected products, or remediation in the supplied sources. Monitor for updates.

CVE-2026-15751

CVE-2026-15751 affects the mastergo-design mastergo-magic-mcp component set up to version 0.2.0. The vulnerability targets the execute function in mastergo/component-workflow.md for mcp__getComponentGenerator, where manipulation of the rootPath argument enables path traversal. Exploitation is loc...

CVE-2026-54684

CVE-2026-54684 — jadx (Dex to Java decompiler) Affected versions: 1.5.2 to 1.5.5. The vulnerability arises when processing a malicious .xapk file: XApkLoader resolves each entry name directly with tmpDir.resolve(fileName) after a CWD-based ZIP security check, allowing an attacker to write archive...

CVE-2026-42447

CVE-2026-42447 affects jadx, the Dex-to-Java decompiler. Prior to 1.5.6, jadx-gui’s Summary tab is vulnerable to HTML injection because SummaryNode.java appends arches and perArchCount values derived from APK .so path components into an HTML panel without escaping. A malicious APK with a HTML URL...

CVE-2026-42049

CVE-2026-42049 affects jadx (Dex to Java decompiler). Before 1.5.6, exporting a decompiled APK as an Android Gradle project could cause the android:versionName from the manifest to be inserted into the generated app/build.gradle Groovy template without proper sanitization, enabling opening or bui...

CVE-2026-59733

CVE-2026-59733 affects the rclone tool before version 1.74.4, specifically when using the command set “serve restic --private-repos.” The issue arises because authorization is enforced using the routed user path segment while the backend object key is built from the raw, uncleaned URL path, allow...

CVE-2026-54572

Rogue symlink handling in rclone before 1.74.4: when using -l/--links, rclone serializes symlinks as .rclonelink and recreates them locally without validating the target, allowing an attacker-controlled remote to plant an escaping symlink and cause subsequent writes to land outside the destinatio...

CVE-2026-21840

CVE-2026-21840 — HCL BigFix Platform is reported to have a user enumeration vulnerability. The available documents indicate that an attacker could perform some level of user enumeration for the BigFix service by observing system behavior/response times. The CVSS 3.1 metrics show a low base score ...

CVE-2026-59732

The CVE describes a vulnerability in rclone where rclone archive extract could write extracted files outside the user-specified destination prefix when processing crafted archives containing parent path components (e.g., ../). This allowed creating or overwriting sibling objects in the same bucke...

CVE-2026-50130

CVE-2026-50130 : Pi-hole on versions 6.0–6.4.2 is vulnerable to local privilege escalation from the unprivileged pihole user to root via replacement of /etc/pihole/logrotate. The attack works because the replacement is laundered to root:root by pihole-FTL-prestart.sh and then parsed as root by th...

CVE-2026-48290

CAI Content Credentials is affected by a Server-Side Request Forgery (SSRF) vulnerability that could lead to arbitrary code execution in the context of the current user. An attacker could exploit this to inject malicious scripts into a web page and potentially gain elevated access or control over...

CVE-2026-48295

Technical details about CVE-2026-48295 are not publicly available in the provided documents. Monitor for updates from official sources; the available information notes insufficiently protected credentials and potential unauthorized read access without user interaction.

CVE-2026-48357

Technical details about CVE-2026-48357 are not publicly available in the provided documents. Monitor for updates.

CVE-2026-48296

CVE-2026-48296 concerns CAI Content Credentials and describes an Integer Underflow (Wrap or Wraparound) (CWE-191) that could cause an application to crash and enter a denial‑of‑service condition. Exploitation is characterized as local with no required user interaction (per CVSS 3.1 metrics: AV:L/...