CVE-2026-93338

Grandstream GWN7660ELR firmware prior to version 1.0.27.6 contains an information disclosure vulnerability in its SNMP v2c service, which ships with the default community string public . An unauthenticated remote attacker can query standard MIBs to retrieve the operating system and kernel version...

CVE-2026-81505

Convoy , a cloud-native webhooks gateway, is affected by a cross-tenant IDOR in the GET /api/v1/projects/{projectID}/sources/{sourceID} endpoint. The handler authorizes the project in the URL but sources.Service.FindSourceByID() fetches the source solely by sourceID without verifying that its Pro...

CVE-2026-73863

NanoMQ, an MQTT broker, contains a heap-buffer-overflow in the broker-side function nmq_subinfo_decode() located in nng/src/sp/protocol/mqtt/mqtt_parser.c. The root cause is an incorrect reuse of the len_of_varint value from the outer Properties Length field when parsing repeated SUBSCRIPTION_IDE...

CVE-2026-85497

CareCam CM2507 IP cameras store the root-account password using a fixed legacy hash that provides insufficient resistance to offline cracking. An attacker who obtains the firmware image or password database can recover the credential, which may be reusable across other devices running the same fi...

CVE-2026-61633

NanoMQ (MQTT broker) contains a flaw in its client-side function nni_mqtt_msg_decode_unsubscribe() in mqtt_codec.c. A malformed UNSUBSCRIBE packet with a zero-length topic followed by trailing data can cause a failed read_uint16() that leaves the buffer position unchanged while the topic count ke...

CVE-2026-44639

NanoMQ , an MQTT broker, is vulnerable to an O(N²) denial of service in its MQTT v5 property decoder (in nng/src/supplemental/mqtt/mqtt_codec.c). The root cause is that property_append() traverses the entire linked list for each property added by decode_buf_properties(), resulting in quadratic CP...

CVE-2026-85478

The CareCam CM2507 IP camera running firmware HMT.CM2507 v251211.1507 exposes an interactive bootloader through a physical debug interface with no authentication required . An attacker with physical access can interrupt the normal boot process and inspect or modify boot configuration, firmware da...

CVE-2026-93533

spatie Scotty (a Laravel package) is affected by an OS command injection in the Doctor Command Handler component, specifically in the DoctorCommand::checkSshConnectivity and DoctorCommand::checkRemoteTools functions within app/Commands/DoctorCommand.php. The vulnerability exists in versions up to...

CVE-2026-81305

CareCam CM2507 IP cameras automatically execute a predetermined script from removable media without verifying its authenticity or integrity (CWE: Inclusion of Functionality from Untrusted Control Sphere). An attacker with physical access to the device can supply a malicious script, achieving arbi...

CVE-2026-61682

kcp is a Kubernetes-like control plane. Prior to 0.31.4 and 0.32.2 , the kcp front-proxy does not strip inbound X-Remote-User, X-Remote-Group, or X-Remote-Extra-* identity headers before forwarding requests to shards. An authenticated tenant can inject headers such as X-Remote-Group: system:maste...

CVE-2026-54147

http4k-security-digest (a module of the Kotlin HTTP toolkit http4k) contains a bug in DigestAuthProvider.verify where the configured algorithm parameter is silently ignored and every digest response is verified with hardcoded MD5 , regardless of the intended algorithm. Deployments believing they ...

CVE-2026-11537

CVE-2026-11537 affects IBM WebSphere Application Server versions prior to 9.0.5.29 and 8.5.5.31 . A remote attacker with adjacent network access can obtain sensitive information about the file system through the FileTransfer servlet , requiring no privileges or user interaction. The CVSS 3.1 scor...

CVE-2026-84400

CareCam CM2507 IP cameras are affected by an insufficiently protected network maintenance mechanism that can activate a remote debugging service , classified as missing authentication for a critical function. An attacker on the same local network who satisfies certain device state conditions coul...

CVE-2026-54148

http4k (a Kotlin HTTP toolkit) is vulnerable in the http4k-security-digest module. The DigestAuthProvider.verify method did not compare the uri parameter in an Authorization: Digest response with the actual request URL, meaning a captured valid Digest authentication response could be replayed aga...

CVE-2026-11381

IBM MQ is vulnerable to a heap-based buffer overflow (CWE-122) in the queue manager's message descriptor conversion when processing message distribution list structures . An authenticated network attacker can trigger a denial of service or potentially execute arbitrary code. IBM rates the severit...

CVE-2026-11378

IBM MQ (queue manager and appliance) is vulnerable to an integer overflow (CWE-190) in distribution list processing that can cause the queue manager to write zeros to arbitrary heap memory locations. This allows a remote authenticated attacker to trigger a denial of service or potentially achieve...

CVE-2025-61682

Semantic MediaWiki , a free open-source extension to MediaWiki, is vulnerable to stored XSS through wikitext in versions 3.1.0 through 6.x (prior to 7.0.0). The root cause is the insertion of the unsanitized value of a data attribute into the DOM as HTML, enabling attackers to inject malicious sc...

CVE-2026-11375

IBM MQ (Server component) and IBM MQ Appliance are affected by a stack buffer overflow triggered when processing XA transaction identifiers , allowing an authenticated remote attacker to cause denial of service or potentially execute arbitrary code (CVSS 8.8, CWE-122). Affected versions span IBM ...

CVE-2026-77568

This CVE entry is rejected and does not represent an active vulnerability entry.

CVE-2026-10858

CVE-2026-10858 is a heap buffer underflow in the IBM MQ queue manager's protocol handling, triggered when processing multi-segment messages . An authenticated remote attacker can cause a denial of service or potentially execute arbitrary code . IBM rates it CVSS 3.1: 9.9 (Critical) with changed s...

CVE-2026-84398

CareCam CM2507 IP cameras are vulnerable to unauthorized access due to an empty password accepted for a privileged account exposed through the ONVIF management service. The root cause is an empty password stored in a configuration file, allowing an attacker with network access to reach privileged...

CVE-2026-10853

IBM MQ is affected by a heap buffer overflow in the queue manager's cluster repository manager , caused by improper validation of cluster command message lengths. An authenticated attacker with cluster access can trigger a denial of service or potentially achieve arbitrary code execution (CVSS 7....

CVE-2026-68914

CVE-2026-68914 is a duplicate of CVE-2026-14803 . The underlying vulnerability affects the Mojolicious Perl web framework, specifically the pure-Perl implementation of Mojo::JSON prior to version 9.47 . When Cpanel::JSON::XS is unavailable or MOJO_NO_JSON_XS is enabled, the decoder does not limit...

CVE-2026-10841

IBM WebSphere Application Server versions 8.5 (through 8.5.5.30), 9.0 (through 9.0.5.28), and Liberty (17.0.0.3 through 26.0.0.8) are vulnerable to HTTP request smuggling (CWE-444: Inconsistent Interpretation of HTTP Requests). The vulnerability allows an authenticated attacker with low privilege...

CVE-2026-88259

CareCam CM2507 IP cameras are affected by a missing authentication for critical function vulnerability in their network video streaming service. An unauthenticated attacker with network access to the device can retrieve live camera video without credentials. The CISA advisory (ICSA-26-258-08 ) as...

CVE-2026-84450

libheif versions 1.19.0 through 1.23.3 are affected by a crafted-image vulnerability in the tiling API. A HEIF/AVIF image containing a clap property with an ispe width or height exceeding INT32_MAX + 1 triggers crop calculations via heif_image_handle_get_image_tiling(). The Fraction::Fraction() u...

CVE-2026-93737

Azkaban through 4.0.0 contains an authorization bypass in the ScheduleServlet fetchSchedule action , which omits project permission checks. An authenticated user can supply arbitrary project and flow identifiers to retrieve sensitive schedule details of any project, including execution times, cro...

CVE-2026-93736

Mealie before 3.21.0 contains an information disclosure vulnerability in the ratings and favorites endpoints , where user ownership is not validated. An authenticated attacker can read any user's recipe ratings, favorites, and private recipe identifiers by specifying arbitrary user IDs in the URL...

CVE-2026-84449

libheif (HEIF/AVIF encoder/decoder) is affected by an integer overflow in Op_RGB24_32_to_YCbCr::convert_colorspace() (prior to v1.19.6). When extremely large RGB images are created via heif_image_create() and heif_image_add_plane(), the image-plane stride stored in an integer width can overflow. ...

CVE-2026-84451

libheif versions 1.19.0 through 1.23.3 contain an out-of-bounds read caused by an incomplete remediation of CVE-2026-62292 . In the no-icef full-item branch of unc_decoder::get_compressed_image_data_uncompressed(), an addition-based range check can wrap around when a crafted uncompressed tile gri...

CVE-2026-84447

libheif (HEIF/AVIF decoder/encoder) versions 1.23.1 and earlier are affected by a CPU/memory amplification denial-of-service vulnerability. Crafted grid , iovl , and iden reference graphs can repeatedly decode the same base image because processed_ids is copied per branch and ImageItem::decode_im...

CVE-2026-84384

libheif (a HEIF and AVIF file format decoder/encoder) is affected by a decompression-bomb OOM/DoS vulnerability in versions 1.19.0 through 1.23.1 . Crafted HEIF or AVIF files with malicious mime metadata and unci image data cause decompress_brotli() and do_inflate() to grow accumulated output wit...

CVE-2026-10751

IBM MQ Java and JMS client libraries are vulnerable to remote code execution via a deserialization filter bypass in exception handling (CWE-502). An authenticated attacker can execute arbitrary code on client applications. The CVSS 3.1 base score is 7.5 (HIGH) , with a high attack complexity and ...

CVE-2026-84444

libheif (HEIF/AVIF decoder/encoder) is vulnerable to an out-of-bounds heap write in versions prior to 1.23.2 when the WITH_UNCOMPRESSED_CODEC option is enabled. The root cause is a missing check_component_sizes() gate in unc_encoder::encode_tile(): an independently constructed image tile whose co...

CVE-2026-84383

libheif, a HEIF and AVIF decoder/encoder, is affected by a heap out-of-bounds write (CVSS 9.8 Critical) in versions 1.22.0 through 1.23.2. A crafted item graph using nested iden and auxl references causes scale_nearest_neighbor() to write 16-bit samples into an 8-bit Alpha plane allocation, with ...

CVE-2026-10747

IBM MQ Appliance is vulnerable to a heap buffer overflow (CWE-122) in the queue manager's protocol message processing, exploitable before authentication over the network. An unauthenticated remote attacker with access to the listener port can trigger a denial of service or potentially achieve arb...

CVE-2026-84446

libheif (a HEIF and AVIF file format decoder/encoder) prior to version 1.23.2 is vulnerable to a denial-of-service via crafted HEIF sequence timing and edit-list data. The root cause is that Track::init_sample_timing_table() computes an m_num_output_samples value exceeding the uint32_t counters u...

CVE-2026-10744

CVE-2026-10744 is an integer overflow (CWE-122, Heap-based Buffer Overflow) in the MQINQ request validation of IBM MQ, affecting the queue manager and appliance when CONNAUTH is in use. An authenticated attacker over the network can trigger a denial of service or potentially escalate privileges ....

CVE-2026-84448

libheif , a HEIF and AVIF file format decoder/encoder, contains a heap out-of-bounds read in its region writer API prior to version 1.23.2 . The function heif_region_item_add_region_inline_mask_data() in heif_regions.cc accepts a mask_data_len parameter without verifying it matches the byte count...

CVE-2026-10575

IBM MQ (versions 9.1 through 10.0.0.0) is affected by a heap-based buffer overflow (CWE-122) triggered when processing MQPUT operations with malformed distribution headers . An authenticated remote attacker can exploit this to cause a denial of service or potentially escalate privileges . The vul...

CVE-2026-1037

IBM Common Licensing Agent and IBM License Key Server Administration and Reporting Tool (ART) versions 9.0, 9.0.0.1, and 9.0.0.2 are affected by a cross-site scripting (XSS) vulnerability in their Web UI. An unauthenticated attacker can embed arbitrary JavaScript, altering intended functionality ...

CVE-2026-1031

IBM Common Licensing Agent versions 9.0, 9.0.0.1, 9.0.0.2 and IBM ART versions 9.0, 9.0.0.1, 9.0.0.2 are affected by a cross-site scripting vulnerability. An unauthenticated attacker can embed arbitrary JavaScript code in the Web UI, altering its intended functionality and potentially leading to ...

CVE-2026-77960

Bransys ELD (an Electronic Logging Device) ships with hardcoded MQTT credentials , allowing an unauthenticated network attacker to gain read access to real-time data for every active device connected to the affected MQTT broker across a subset of carriers. The CISA ICS advisory (ICSA-26-260-01) a...

CVE-2026-1030

CVE-2026-1030 affects IBM Common Licensing (Agent 9.0, 9.0.0.1, 9.0.0.2; ART 9.0, 9.0.0.1, 9.0.0.2), which generates error messages containing sensitive information about its environment, users, or associated data (CWE-209). The vulnerability requires low privileges and no user interaction, with ...

CVE-2026-65969

OpenImageIO (a toolset for reading, writing, and manipulating image files used in VFX/animation) is affected by a signed 32-bit integer overflow in GifSplitPalette() (src/gif.imageio/gif.h). A truncated TGA input can leave a pending GIF frame that is processed during output close; the multiplicat...

CVE-2026-1029

CVE-2026-1029 affects IBM Common Licensing Agent 9.0, 9.0.0.1, 9.0.0.2, ART 9.0, 9.0.0.1, and 9.0.0.2 (also identified as IBM License Key Server Administration and Reporting Tool and IBM LKS Administration Agent ). The vulnerability is a cross-site scripting (XSS) flaw that allows users to embed ...

CVE-2026-1025

IBM Common Licensing (Agent 9.0, 9.0.0.1, 9.0.0.2, ART 9.0, ART 9.0.0.1, and ART 9.0.0.2) contains a cross-site scripting flaw (CWE-79) in its Web UI. An attacker can embed arbitrary JavaScript code that alters intended functionality, potentially leading to credentials disclosure within a trusted...

CVE-2026-67549

OpenImageIO is a toolset for reading, writing, and manipulating image files used in VFX/animation. Prior to 3.1.16.0 , a crafted 1-bit contiguous CMYK TIFF triggers a heap out-of-bounds write in tiffinput::bit_convert() (src/tiff.imageio/tiffinput.cpp). The bug occurs because a native uint1 Image...

CVE-2026-86689

Bransys ELD (Electronic Logging Device) is shipped with hardcoded MQTT credentials , which grant read access to real-time data for every active device across a subset of carriers connected to the affected MQTT broker. The vulnerability is assessed at CVSS 3.1: 5.9 (MEDIUM) and CVSS 4.0: 8.2 (HIGH...

CVE-2026-63638

OpenImageIO (a VFX/animation image I/O toolset) is vulnerable to a heap out-of-bounds write in its Cineon image reader. A crafted cineon file can declare an unsupported component bit depth of 26 ; cineoninput::open() maps it to a 32-bit ImageSpec, but libcineon maps the depth to an 8-byte value, ...