CVE-2026-9794

Keycloak contains an information-disclosure flaw (CVE-2026-9794) where a remote, unauthenticated attacker can send crafted SOAP requests to the SAML ECP endpoint and observe differing faultstrings to infer the client protocol type. This is the scoped impact reported across NVD/Red Hat CVE entries...

CVE-2026-9792

CVE-2026-9792 – Keycloak Client Policies bypass of ROPC block : A flaw in Keycloak’s Client Policies (org.keycloak.protocol.oidc) allows an unauthenticated attacker to obtain tokens via ROPC grants even when a policy blocks them. The issue occurs when certain condition providers (client-type, cli...

CVE-2026-9793

Keycloak vulnerability CVE-2026-9793: when a JSON Web Encryption (JWE) encrypted request object is submitted, Keycloak may incorrectly process unsigned claims if the decrypted content is raw JSON, bypassing the configured signature policy. This can lead to unauthorized claims and data integrity c...

CVE-2026-7802

The CVE-2026-7802 entry concerns the Frontend Admin by DynamiApps WordPress plugin. Affected versions up to 3.29.2 are vulnerable to an authorization bypass that lets authenticated users with subscriber-level access and higher overwrite administrator profile fields (e.g., user_pass, user_email, n...

CVE-2026-9228

The Timetable and Event Schedule by MotoPress plugin for WordPress (MP Timetable) is affected by an Insecure Direct Object Reference vulnerability (CVE-2026-9228) in all versions up to 2.4.16. The root cause is missing validation on a user-controlled key in the action_get_event_data endpoint, ena...

CVE-2026-2374

The CVE-2026-2374 entry applies to the Login No Captcha reCAPTCHA WordPress plugin (v <= 1.8.0). The vulnerability is a Stored Cross-Site Scripting (XSS) that occurs because authenticate() stores the unsanitized basename($_SERVER['PHP_SELF']) output in the login_nocaptcha_error WordPress optio...

CVE-2026-9241

The FOX – Currency Switcher Professional for WooCommerce WordPress plugin (up to version 1.4.6) is affected by an Authorization Bypass through a user-controlled key. The flaw resides in get_value() in classes/fixed/fixed_user_role.php, which trusts the attacker-controlled $_REQUEST['wooc_order_us...

CVE-2026-5737

CVE-2026-5737 concerns the Independent Analytics plugin for WordPress, vulnerable through an unauthenticated SSRF in versions up to 2.14.9. A public tracking route at /wp-json/iawp/search accepts attacker-controlled referrer_url values when signatures match, compounded by a scheduled favicon fetc...

CVE-2026-9791

CVE-2026-9791 describes a flaw in Keycloak where an authenticated user with existing organization membership can access user-facing APIs (e.g., the account API) or request an OpenID Connect token with the organization scope. This can lead to leakage of organization metadata in tokens even after a...

CVE-2026-9789

The CVE-2026-9789 entry describes a Local Privilege Escalation affecting Acer NitroSense software prior to 3.01.3052. The root cause is a PSAdminAgent service that creates a Named Pipe with a weak ACL, allowing any authenticated local user to connect and issue commands. The service does not verif...

CVE-2026-8915

Technical details about CVE-2026-8915 are not publicly available in the provided documents. Monitor for updates from Samsung Escargot advisories and NVD entries for affected versions, impact, and remediation.

CVE-2026-30760

CVE-2026-30760 affects SourceBans Material Admin prior to v1.1.6. A crafted XAJAX call allows an attacker to manipulate arbitrary user data in the web application. The root cause is related to insufficient validation/authorization in handling XAJAX requests, leading to data integrity impacts (arb...

CVE-2026-38707

Affects InHand Networks IR302 firmware v3.5.108, IR305 v1.0.118, IR315 v1.0.118, IR615 v1.0.118 (and earlier). The issue is a command injection in the IPSec VPN feature that can grant ROOT privileges on remote targets. CVSS 3.1: 9.8 (CRITICAL) with network access, no user interaction, and high im...

CVE-2026-38702

CVE-2026-38702 is a command injection vulnerability in InHand Networks’ Admin Access feature affecting IR302 (V3.5.108) and IR305/IR315/IR615 (V1.0.118) and earlier firmware. The issue could allow remote attackers to gain ROOT privileges on target devices. The connected sources confirm affected m...

CVE-2026-37266

CVE-2026-37266 : The issue affects Responsive File Manager’s Web application (Version 9.14.0). A vulnerability in the force_download.php component allows a remote attacker to execute arbitrary code. The publicly documented impact is significant (base CVSS v3.1: AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H...

CVE-2026-37579

CVE-2026-37579 affects SMSGate sms-core

CVE-2026-48004

Technical details for CVE-2026-48004 are not publicly available in the provided documents; monitor for updates.

CVE-2026-38703

CVE-2026-38703 describes a command injection in the ZeroTier VPN feature of InHand Networks IR302 firmware V3.5.108, IR305 V1.0.118, IR315 V1.0.118, IR615 V1.0.118 and earlier versions. Exploitation could yield ROOT privileges on remote devices. Affected component: ZeroTier VPN on the InHand IR s...

CVE-2026-38704

CVE-2026-38704 describes a command injection vulnerability in the WireGuard VPN feature of InHand Networks firmware. Affected devices include IR302 (V3.5.108), IR305 (V1.0.118), IR315 (V1.0.118), IR615 (V1.0.118), and earlier versions. Successful exploitation can yield ROOT privileges on remote t...

CVE-2026-40710

Dell Container Storage Modules are affected by CVE-2026-40710, a critical vulnerability caused by hardcoded credentials exposed in public repositories. This allows remote attackers to access sessions, exfiltrate data, and move laterally. The PT-2026-44502 entry confirms CVSS 10.0. The provided do...

CVE-2026-42998

Summary of CVE-2026-42998 (OpenStack Keystone) : The Keystone application credential authentication plugin fails to verify that the requester owns the credential, allowing an attacker to authenticate with their own application credential and specify another user in the request. The resulting toke...

CVE-2026-30761

SourceBans Material Admin v1.1.6 contains an arbitrary file upload vulnerability in pages/admin.uploadmapimg.php that allows code execution via a crafted image file. Affected component is the upload handler; root cause is improper validation of uploaded files. CVSS v3.1 base score 7.3 (HIGH); att...

CVE-2026-43000

CVE-2026-43000 affects OpenStack Keystone (identity service). Affected: Keystone before 29.0.2. The issue arises when an impersonation vulnerability in application credentials is chained with Keystone trusts, allowing a user with member role to escalate to admin by delegating the victim's admin r...

CVE-2026-42999

OpenStack Keystone prior to 29.0.2 contains CVE-2026-42999, where the RBAC policy enforcer in enforce_call unconditionally merges the raw JSON request body into the policy enforcement dictionary (policy_dict.update(json_input.copy())). Since flask.request.get_json is called with force=True, this ...

CVE-2026-44394

CVE-2026-44394 affects OpenStack Keystone before 29.0.2. The federated token rescoping mechanism does not propagate the original token expiry to the newly issued token; repeated rescopes can allow indefinite access by issuing tokens with a fresh TTL, bypassing token lifetime policies. Affected de...

CVE-2026-48824

CVE-2026-48824 is reserved in Initial Description; connected FreeBSD entry reports a memory-exhaustion DoS affecting mail/mailpit caused by unbounded JSON bodies on /api/v1/messages, /api/v1/tags, and /api/v1/message/{id}/release. No vendor/version details or patches are provided in the documents...

CVE-2026-4888

CVE-2026-4888 affects the Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder for WordPress. The vulnerability is due to a missing capability check in the send_test_email() function across all versions up to and including 3.4.7, allowing authenticated attackers with Sub...

CVE-2026-45725

The CVE entry CVE-2026-45725 is not detailed in the Initial Description, but connected material documents a concrete vulnerability in the compliance-trestle project. The issue resides in trestle/core/remote/cache.py (HTTPSFetcher and SFTPFetcher) of the compliance-trestle library (version ~4.0.2)...

CVE-2026-47717

The connected advisory (GHSA-Q3W6-Q3HC-C5X6) details a data disclosure flaw in FUXA v1.3.0-2773 where GET /api/project exposes full project data to unauthenticated requests even when secureEnabled is true. The root cause is that the secure middleware calls verifyToken but auto-generates a guest J...

CVE-2026-46621

The Connected document GHSA-2G95-6X5Q-XJWJ describes a Server-Side Code Injection in Yamcs where the script evaluation engine for Python algorithms uses Jython via the JSR-223 ScriptEngine API without a secure sandbox. An authenticated user with the ChangeMissionDatabase privilege can override an...

CVE-2026-46562

CVE-2026-46562 is reserved; however, connected data reveal an explicit vulnerability in Yamcs: remote code execution via the Mission Database algorithm override due to a Nashorn ScriptEngine created without a ClassFilter, allowing attacker-supplied JavaScript to reach arbitrary Java classes. The ...

CVE-2026-45704

Pimcore CustomReports vulnerability: a backend user with the reports permission can read a report’s configuration by directly requesting it even when the report is not visible in the listing, due to inconsistent authorization between listing and detail endpoints. The root cause is that getAction(...

CVE-2026-45703

CVE-2026-45703 / GHSA-332X-R494-54FQ (Pimcore WordExport authorization bypass) : The advisory describes an authorization flaw in Pimcore’s WordExport export flow where the system only checks a feature permission (word_export) and does not enforce object-level access rights on the target element (...

CVE-2026-46538

CVE-2026-46538 affects Microsoft UFO open-source framework; in version 3.0.1-4-ge2626659, the constellation client tracks pending task responses by session_id and does not bind completion to the originating device. An authenticated peer can forge a TASK_END with the same session_id to inject atta...

CVE-2026-46416

Microsoft UFO (open-source framework for intelligent automation) in version 3.0.1-4-ge2626659 uses a single shared UFOWebSocketHandler instance for multiple authenticated WebSocket connections. The handler caches per-connection protocol objects in mutable fields, and each new connection overwrite...

CVE-2026-46414

Technical details are not publicly available in the provided documents. Monitor for updates.

CVE-2026-46402

Microsoft UFO (open-source framework) 3.0.1-4-ge2626659 exposes a path traversal risk by using the user-controlled task_name when building session log paths, enabling an authenticated client to create log directories/files outside the intended logs/ directory. This can impact integrity and availa...

CVE-2026-46544

Technical details beyond the provided CVE description are not publicly available in the supplied documents. Monitor for updates from the referenced UFO advisory and CVE entry.

CVE-2026-9739

CVE-2026-9739 describes a DNS rebinding vulnerability due to a hardcoded Access-Control-Allow-Origin: * in the SSE initialization handler, despite earlier attempts to align with MCP security guidelines using allowed-origins and allowed-hosts. The issue specifically affects users connecting via To...

CVE-2026-45309

CVE-2026-45309 is a reserved entry with no public technical details in the Initial document, but connected documents describe a concrete vulnerability in AsyncSSH. Affected: AsyncSSH (Python package, pip ecosystem), version 2.22.0. Root cause: the OpenSSH-compatible AuthorizedKeysFile token %u is...

CVE-2026-45322

CVE-2026-45322 affects Microsoft UFO (open-source framework for intelligent automation) up to v3.0.0. The issue is an OS command injection in the shell action replay path: ShellReceiver.run_shell() takes a command string from action parameters and passes it to subprocess.Popen() with shell=True a...

CVE-2026-45152

CVE-2026-45152 affects uniget prior to 0.27.1, where a command injection is possible via the check field loaded from untrusted JSON metadata. The implementation runs /bin/bash -c on tool.Check, allowing an attacker-controlled value to execute arbitrary shell commands during common operations (des...

CVE-2026-44720

OpenLearnX (pre-2.0.4) has a critical authentication vulnerability where JWT signature verification is disabled, enabling an attacker to bypass authentication and take over user accounts. Impact is unauthorized access under specific conditions; the issue is fixed in 2.0.4. Remediation: upgrade to...

CVE-2026-45083

Goobi viewer (4.8.0–26.04.0/1) exposed a vulnerable REST endpoint POST /api/v1/index/stream that accepted arbitrary Solr streaming expressions from unauthenticated clients and forwarded them to the backend Solr server without restriction. This allowed reading the complete Solr index and, in defau...

CVE-2026-9208

Technical details are not publicly available in the provided documents. Monitor for updates.

CVE-2026-44247

CVE-2026-44247 : Volcano’s webhook server does not enforce a size limit on incoming HTTP request bodies. Any in-cluster pod that can reach the webhook endpoint may send an arbitrarily large request body, potentially causing the webhook server to be killed by OOM. All Volcano deployments with the ...

CVE-2026-45137

Summary: CVE-2026-45137 affects Anchor (Solana programs) where Program validation fails due to using Pubkey::default() as a sentinel, causing System and () to be treated equivalently and allowing any executable program in place of the system program. Impact: potential arbitrary CPI or payment byp...

CVE-2026-45136

Claude Code cache proxy claude-code-cache-fix is vulnerable to local code execution due to a Python triple-quote injection in tools/quota-statusline.sh. From v3.5.0–v3.5.1, user-controlled payloads can embed a ''' sequence which closes the Python literal and executes subsequent bytes in the user’...

CVE-2026-44660

Summary of CVE-2026-44660 : UltraJSON’s ujson.dump() to a file-like object can leak memory if the underlying write() raises an exception. The root cause is that the temporary JSON string created during objToJSONFile() is not decremented on early return, causing memory growth proportional to the p...

CVE-2026-44712

pam_usb on Linux is vulnerable prior to 0.8.7 due to two issues: (1) a crafted filesystem UUID or config UUID can trigger root RCE when pamusb-conf --reset-pads is run, and (2) userName from the XML config is passed to os.system(), invoking a shell via pamusb-agent. Some USB controllers may permi...