CVE-2026-84286

ExLlamaV3 (exllamav3_ext CUDA extension) contains an out-of-bounds memory access vulnerability caused by a missing bounds check in the kernel-table dispatch process. When the kernel parameter K is set to 0 in a crafted input, a negative array index is generated, leading to a CUDA illegal memory a...

CVE-2026-17585

CVE-2026-17585 affects the WordPress plugin Royal Elementor Addons (Addons and Templates Kit for Elementor), versions

CVE-2026-79393

A heap-based buffer overflow in the WS-Addressing Action transformation function of the Sofia IPC daemon in Xiongmai IP Camera XM530 (firmware HMT.CM2005-v220608.1837 and earlier) allows remote unauthenticated attackers to trigger a denial of service or potentially execute arbitrary code by sendi...

CVE-2026-71644

RACER by Robotics-STAR-Lab (SYSU STAR Group) is vulnerable to unsafe trajectory planning and potential UAV collisions when affected. The root cause is a missing default case in the Finite State Machine (FSM) that stops publishing swarm trajectories when a drone enters the IDLE state, allowing a r...

CVE-2023-40232

CVE-2023-40232 is one of four CVEs (40231–40234) associated with "Replacement Cycling Attacks" disclosed by Antoine Riard on the Bitcoin-Dev and Lightning-Dev mailing lists (Linux Foundation, 20 October 2023). The CVE itself remains in a reserved state with no expanded description, metrics, or re...

CVE-2026-79396

CVE-2026-79396 affects the Xiongmai IP Camera XM530 in firmware version HMT.CM2005-v220608.1837 and earlier . The root cause is the use of hardcoded default credentials stored in unencrypted plaintext within the file bin/config.xml and compiled into the Sofia executable . This allows a remote att...

CVE-2026-52630

CVE-2026-52630 is a SQL Injection vulnerability in Woltlab WCF (Woltlab Community Framework) affecting versions 6.2.4 and before . The vulnerable code resides in updateUserOptions within UserEditor.class.php and the update action in UserAction.class.php , allowing a remote attacker to inject SQL....

CVE-2025-66677

Traefik is affected by a Medium -severity vulnerability (CVE-2025-66677) in which HTTP/3 respondingTimeouts are not applied , meaning configured response timeouts may not be enforced for HTTP/3 connections. This could allow prolonged resource consumption or stalled responses beyond the intended t...

CVE-2026-79035

A reflected cross-site scripting (XSS) vulnerability exists in the p.rfihub.com component of Zeta Marketing Platform (ZMP) v1.0 . An attacker can inject a crafted URL into the ca parameter to execute arbitrary JavaScript in the victim's browser context. The provided references link to a proof-of-...

CVE-2024-86060

This candidate has been reserved by an organization or individual " "that will use it when announcing a new security problem. When the candidate has been " "publicized, the details for this candidate will be provided...

CVE-2026-79394

Xiongmai IP Camera XM530 (firmware HMT.CM2005-v220608.1837 and earlier ) ships with an insecure default configuration in the embedded Happytime RTSP server within the Sofia IPC daemon . Authentication is disabled by default, allowing remote unauthenticated attackers to access live H.264 video and...

CVE-2023-40233

CVE-2023-40233 is one of four CVEs (alongside CVE-2023-40231, -40232, and -40234) associated with Replacement Cycling Attacks disclosed by Antoine Riard on the Bitcoin-Dev and Lightning-Dev mailing lists (Linux Foundation, 20 October 2023). The CVE itself remains in a reserved state with no publi...

CVE-2026-71641

CVE-2026-71641 affects ZJU-FAST-Lab EGO-Planner-v2 , a motion planning and navigation system, in all versions up to commit 5c99a95880401e2599638d567abc0e240396cb42. An attacker can trigger a denial of service through a specific interaction between the traj_server , poscmd_2_odom , and the EGORepl...

CVE-2026-71646

CVE-2026-71646 affects Robotics-STAR-Lab (SYSU STAR Group) RACER , a swarm exploration system. The vulnerability resides in FastExplorationFSM::optTimerCallback() within swarm_exploration/exploration_manager/src/fast_exploration_fsm.cpp, allowing an attacker to cause a denial of service . The tes...

CVE-2025-69904

Linkstack v4.8.4 and earlier is affected by a Path Traversal vulnerability. An administrator with access to the application can read arbitrary files on the server by manipulating file path input, potentially gaining unauthorized access to sensitive system or application files. No specific patch v...

CVE-2026-79395

CVE-2026-79395 is a CRITICAL (CVSS 9.8) improper authentication flaw in the Sofia IPC daemon of the Xiongmai IP Camera XM530 (firmware HMT.CM2005-v220608.1837 and earlier). The vulnerability resides in the WS-Security (wsse:UsernameToken) verification routine: when the admin account's stored pass...

CVE-2026-78807

CVE-2026-78807 affects wpa_supplicant (all versions before v.2.12 ) due to missing validation in the driver-based PMKSA selection path in wpa.c. A local attacker with low privileges can bypass proper network context and AKMP matching for PMKSA caching , resulting in high confidentiality and integ...

CVE-2024-67277

This candidate has been reserved by an organization or individual " "that will use it when announcing a new security problem. When the candidate has been " "publicized, the details for this candidate will be provided...

CVE-2026-84941

CVE-2026-84941 is an XML External Entity (XXE) injection vulnerability in the SAML IdP Metadata Parsing of Omada Controller . An authenticated user with SAML configuration privileges can exploit insufficient validation of user-supplied SAML metadata to read arbitrary local files, leading to infor...

CVE-2026-77807

The AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 11.0.4 via the username Parameter. This makes it possible for unauthenticated attackers to read the conten...

CVE-2026-81906

Concrete CMS prior to version 9.5.3 is affected by an OAuth callback login flaw. The vulnerable component is the OAuth callback login path , which failed to verify whether an account was active or email-validated before establishing a session. As a result, a deactivated or unvalidated user with a...

CVE-2026-81905

Concrete CMS versions below 9.5.3 store user validation hashes (email/registration validation, password reset, persistent login) in a single table with a type column, but the redemption path resolves a hash by value alone without verifying its type . This allows a long-lived registration hash (60...

CVE-2026-17176

TP-Link Deco BE11000 is affected by an OS command injection vulnerability in its TDDP module . An attacker on the adjacent network can exploit this by sending a crafted UDP packet , executing arbitrary commands with root privileges without any prior authentication. Successful exploitation may lea...

CVE-2026-18121

Concrete CMS 9.5.2 and below is vulnerable to an authorization bypass (IDOR) in the Calendar block's frontend event dialog (/ccm/calendar/view_event/{bID}/{occurrence_id}). The controller loads the event occurrence from an attacker-supplied sequential identifier without verifying that the caller ...

CVE-2026-16174

Netskope Endpoint DLP (EPDLP) running on Windows is affected by an integer overflow in the EPDLP process port handling, leading to a kernel pool overflow and memory corruption. Exploitation requires a privileged user to send a crafted message to the EPDLP process port, with the EPDLP module enabl...

CVE-2026-16172

CVE-2026-16172 affects the Endpoint DLP (EPDLP) service of the Netskope Client , where an out-of-bounds heap read occurs due to a missing bounds check on a specially crafted message. A local standard user can trigger the flaw, causing the kernel driver handler to crash and potentially interruptin...

CVE-2026-59965

CVE-2026-59965 affects @jhb.software/payload-alt-text-plugin v0.7.0, a Payload CMS plugin. The root cause is that two custom endpoints (POST /api/alt-text-plugin/generate and /bulk) call Payload's Local API findByID and update without setting overrideAccess: false, which defaults to true and sile...

CVE-2026-59960

CVE-2026-59960 is an OS command injection (CWE-78, CVSS 7.5 High) in @argos-ci/[email protected] , affecting the @argos-ci/cli upload flow. The gitFetch() function in packages/core/src/ci-environment/git.ts:89 passes attacker-controlled CI branch/ref strings directly into an execSync() template literal,...

CVE-2026-2310

IBM webMethods Integration Server 11.1 is vulnerable to an XML External Entity Injection (XXE) flaw when processing XML data, as described by CWE-91 (XML Injection). A remote attacker with low privileges and a local attack vector can exploit this to expose sensitive information or consume memory ...

CVE-2026-19646

IBM Common Licensing Agent and IBM ART (Administration and Reporting Tool) versions 9.0, 9.0.0.1, and 9.0.0.2 are affected by improper validation of the HTTP Host header , allowing a remote attacker to redirect users to an arbitrary domain without authentication. The vulnerability is rated CVSS 9...

CVE-2026-49838

GoBGP , an open-source BGP implementation in Go, is vulnerable to a denial-of-service in its BGP UPDATE validator prior to version 4.7.0 . When a confederation eBGP peer sends a malformed UPDATE containing a zero-length AS_PATH , the attribute passes initial decoding but triggers an unchecked p.V...

CVE-2026-49837

GoBGP (open source BGP implementation in Go) versions prior to 4.6.0 contain a boundary validation flaw in the BGP OPEN capability parser. Several capability decoders read from the full remaining buffer instead of the slice bounded by the declared CapLen , allowing a malformed OPEN message to cau...

CVE-2026-54054

Transmute is a free, open-source, self-hosted file conversion and compression tool. Prior to version 1.3.0 , its URL import endpoint (POST /api/files/url) is vulnerable to full-read SSRF . The HTTP downloader fetches user-supplied URLs with redirects enabled and does not validate whether the targ...

CVE-2026-49836

psd-tools (Python library for Adobe Photoshop PSD files) is vulnerable to arbitrary file write and arbitrary file read via unsanitized smart-object paths. In all releases through v1.17.0 , SmartObject.save() uses the embedded filename from the PSD verbatim—no basename, no .. filtering, no absolut...

CVE-2026-75624

IBM App Connect Enterprise (runtime) versions 13.0.1.0–13.0.8.1 and 12.0.1.0–12.0.12.27 are vulnerable to privilege escalation and Denial of Service due to incorrect authorization (CWE-863). A remote authenticated attacker with low privileges can bypass security restrictions, yielding full compro...

CVE-2026-75777

IBM Aspera Enterprise WebApps versions 1.0.0 through 1.0.5 are vulnerable to a container escape caused by unrestricted system calls being permitted within the container. A local attacker with low privileges can exploit this to break out of the container, resulting in high impact to confidentialit...

CVE-2026-76059

IBM Langflow OSS versions 1.0.0 through 1.11.5 are affected by a protection mechanism failure (CWE-693) in its static code security scanner. An attacker who can submit custom component source code can bypass the scanner by crafting an annotated class-body assignment that resolves to a dangerous c...

CVE-2026-78569

IBM Langflow OSS (versions 1.0.0 through 1.11.5) is vulnerable to arbitrary code execution by an authenticated attacker due to an incomplete denylist in its agentic assistant code security scanner. The scanner omits process-spawning primitives and contains a logic error where annotated class-body...

CVE-2026-78571

IBM Langflow OSS versions 1.0.0 through 1.11.5 are vulnerable to arbitrary code execution via an unguarded eval() call in the lfx CodeParser , which passes return-type annotation source directly to eval without sanitization (CWE-94). A remote authenticated attacker can exploit this to execute arb...

CVE-2026-78573

IBM ContextForge MCP Gateway versions 1.0.0 through 1.0.7 are vulnerable to administrative takeover due to default credentials (CWE-1392). Three password fields—platform_admin_password, default_user_password, and basic_auth_password—ship with the publicly known value "changeme" . When an operator...

CVE-2026-45770

Suricata versions 8.0.0 through 8.0.5 (exclusive) are affected by a Lua sandbox bypass. A Lua rule that registers an excessive number of flow variables can corrupt Lua detection state , potentially escaping Suricata's restricted Lua sandbox. The attack requires a crafted Lua script/rule to be loa...

CVE-2026-78575

IBM Langflow OSS 1.0.0–1.11.5 is vulnerable to OS command injection (CWE-78) in the MCP stdio server configuration , allowing a remote authenticated attacker to execute arbitrary commands. The root cause involves two gaps: the MCP stdio validator on Windows recognizes only one cmd.exe execution s...

CVE-2026-79723

IBM Langflow OSS versions 1.0.0 through 1.11.5 allow a remote authenticated attacker to perform server-side request forgery (SSRF) via several connectors that skip the platform's shared SSRF validation guard. Affected components include the MCP server configuration URL field, the DataStax Astra D...

CVE-2026-79724

IBM Langflow OSS versions 1.0.0 through 1.11.5 are affected by an OS command injection vulnerability (CWE-78) caused by multiple incomplete code security controls and missing execution guards, including an incomplete denylist omitting process-spawning primitives, a logic error in the code scanner...

CVE-2026-79725

IBM Langflow OSS versions 1.0.0 through 1.11.5 are affected by an improper access control flaw (CWE-284 ) that allows a remote authenticated attacker to read arbitrary files. The vulnerability is part of a broader set of storage-path issues: the flow execution runtime accepts attacker-controlled ...

CVE-2026-79742

IBM Langflow OSS versions 1.0.0 through 1.11.5 are affected by an incomplete environment variable blocklist in the MCP stdio server configuration. The specific root cause is that the OPENSSL_CONF environment variable is absent from the blocklist, permitting native code execution via OpenSSL engin...

CVE-2026-80378

IBM DataStage on Cloud Pak for Data 5.4.0.0 contains an improper authorization flaw that a remote authenticated attacker can exploit to cause a denial of service . The CVSS 3.1 score is 8.5 (HIGH) , with a changed scope, low integrity impact, and high availability impact. The CVE title references...

CVE-2026-80380

IBM DataStage on Cloud Pak for Data 5.4.0.0 is affected by cross-site request forgery (CSRF) , allowing a remote attacker with no privileges but requiring user interaction to perform unauthorized actions. The flaw is attributed to open source software components within the product, as indicated b...

CVE-2026-45769

Suricata , a network IDS/IPS/NSM engine, is affected by an unbounded memory growth issue in its IKEv2 parser prior to versions 7.0.16 and 8.0.5 . The parser state can grow without bounds while storing client transforms, meaning repeated crafted UDP traffic may cause excessive memory consumption a...

CVE-2026-80434

IBM DataStage on Cloud Pak for Data 5.4.0.0 is affected by an insecure direct object reference (IDOR) flaw that allows a remote authenticated attacker to manipulate runtime caches and cause a denial of service . The vulnerability carries a CVSS 3.1 score of 7.4 (HIGH) , with a scope change indica...