CVE-2026-42169

A heap-buffer-overflow vulnerability exists in the APNG Animated PNG file loader of GIMP. This flaw occurs when the fcTL width exceeds the IHDR width, leading to pixel data being written past the end of a heap allocation. Additionally, a heap-based buffer overflow exists in the DDS plug-in due to...

CVE-2026-18723

CVE-2026-18723 affects diaowen DWSurvey up to version 6.14.0. The vulnerability lies in an unknown function within /api/dwsurvey/app/survey/up-survey-status.do of the Survey Status Handler, leading to improper authorization. Exploitation could be remote (network vector) with low privileges requir...

CVE-2026-18722

Technical details (affected product, vulnerable component, root cause, impact, fixes) are not publicly available in the provided documents; monitor for updates.

CVE-2026-18721

CVE-2026-18721 affects kalcaddle kodbox 1.67 Build 02, specifically the /user/sso/apiLogin handler in the SSO API Login component. The vulnerability arises from improper handling of the callbackUrl parameter, enabling an open redirect. Exploitation is possible remotely, and publicly disclosed exp...

CVE-2026-14818

CVE-2026-14818 describes a path traversal vulnerability in the CLI command used to execute configuration files on Zyxel devices. Affected firmware ranges include Zyxel ATP series (V4.32–V5.42 Patch 1), USG FLEX series (V4.50–V5.42 Patch 1), USG FLEX 50(W) series (V4.16–V5.42 Patch 1), and USG20(W...

CVE-2026-17614

CVE-2026-17614 affects WildFly-core in domain mode. The LocalFileRepository.getFile() and getConfigurationFile() do not ensure that resolved paths stay within the configured repository or configuration root, enabling a path traversal via crafted relative paths (e.g., ../../etc/passwd) sent throug...

CVE-2026-8508

The CVE applies to Zyxel WAX650S devices with firmware up to 7.10(ABRM.4)C0, where the social_login.cgi CGI component performs improper authentication. This could allow a WLAN attacker to bypass captive portal authentication, implying an authentication bypass vulnerability in the device’s login f...

CVE-2026-6837

CVE-2026-6837 affects Zyxel WAX650S devices, via a post-authentication command injection in the export-cgi CGI program. The flaw is exploitable by an authenticated administrator, enabling OS command execution on the device. Affected firmware versions go through 7.10(ABRM.4)C0. The CVSS 3.1 vector...

CVE-2026-18720

The CVE concerns kalcaddle kodbox 1.67 Build 02, specifically the /index.php?plugin/msgWarning/action area of the msgWarning Plugin. The vulnerability allows remote, unauthenticated manipulation leading to improper authorization. Exploitation is reported as possible, with PoC exploit activity obs...

CVE-2026-18719

CVE-2026-18719 affects cemtan sar2html 4.0.0, specifically an issue in the Search component’s sar2html.py that enables SQL injection via manipulation of the Search argument. The vulnerability may be exploitable remotely; public exploit activity is noted. The entry notes that the vendor was contac...

CVE-2026-58045

The CVE-2026-58045 entry describes a vulnerability in Node.js where a spoofed TypedArray byteLength can trigger a reachable assertion in the synchronous node:zlib APIs, causing the process to crash. All 11 synchronous zlib functions are affected, and repeated exploitation may lead to denial of se...

CVE-2026-58042

Affected software: Node.js 22.x, 24.x, and 26.x. Vulnerability: dns.resolveAny() can cause the Node.js process to abort when a DNS response contains more than 256 A records. Repeated triggering may lead to a denial of service. Root cause/impact: The flaw in dns.resolveAny() leads to process termi...

CVE-2026-58044

CVE-2026-58044 describes a flaw in the Node.js HTTP client that can cause request desynchronization for Node.js-based forwarding proxies. The problem arises because Node.js may omit headers beyond maxHeadersCount/maxHeaderPairs from req.headers, req.rawHeaders, and req.headersDistinct, yet contin...

CVE-2026-58041

CVE-2026-58041 affects Node.js with the node:sqlite integration. The issue: a stale StatementSyncIterator created via DatabaseSync#createTagStore() can continue executing a cached prepared statement after it has been reset and rebound with new parameters. The underlying cause is that SQLTagStore ...

CVE-2026-56846

Node.js HTTP/2 handling flaw (CVE-2026-56846) affects Node.js 24.x and 22.x. The issue allows HTTP/2 retained header blocks to evade maxSessionMemory, enabling remote memory exhaustion. Exploitation details are not provided in the documents. Remediation follows the vendor advisory: apply the July...

CVE-2026-56845

The CVE describes an unauthenticated Local File Inclusion (LFI) vulnerability under /custom-sounds/ when CustomSounds storage uses FileSystem. An attacker can use ../ sequences in the request path to read arbitrary files outside the base directory. Documented impact is reading sensitive files; no...

CVE-2026-42170

Technical details are not publicly available in the provided documents for CVE-2026-42170. Monitor for updates as more information becomes available; no affected products, impact, or remediation details are disclosed in the supplied data.

CVE-2026-11835

Caliptra Core ROM (2.1.0–2.1.1) contains a TOCTOU vulnerability in UpdateResetFlow::run() that, with missing input validation, lets a compromised MCU firmware with AXI manager access inject an unvalidated AXI staging address. This bypasses secure boot by not validating against SS_EXTERNAL_STAGING...

CVE-2026-11836

The CVE concerns Caliptra Core ROM and Core Firmware in subsystem mode, where validate_debug_unlock_token() fails to bind the token to a specific device. An attacker with access to the integrator’s debug unlock signing service can unlock production debug on an unintended device by presenting a va...

CVE-2026-18686

GL.iNet GL-MT3000 (versions up to 4.4.5) is affected by a command-injection vulnerability in the nas-web RPC Wrapper. The issue lies in the nas-web.add_user function within /cgi-bin/glc, allowing remote manipulation to execute arbitrary commands. Public exploit appears to be available. Vendor con...

CVE-2026-18685

CVE-2026-18685 affects GL.iNet GL-MT3000 devices up to firmware 4.4.5, specifically the function set_upgrade in /cgi-bin/glc of the component modem.so. The issue enables remote command injection due to the underlying vulnerability; attack vector is network with no authentication and no user inter...

CVE-2026-62870

CVE-2026-62870 describes a use-after-free in Microsoft Excel that could allow a remote attacker to execute code over a network. The issue has a high impact (C/H/I/A) with network-based, low-attack-complexity exploitation and requires user interaction. Microsoft has published a security update (KB...

CVE-2026-66326

CVE-2026-66326 affects Microsoft Edge (Chromium-based). The issue is a missing authorization vulnerability in Edge that could allow a remote attacker to execute code over a network. CVSS 3.1 indicates network access, low attack complexity, no privileges required, but user interaction is required;...

CVE-2026-66325

Technical details are not publicly available in the provided documents for CVE-2026-66325 beyond the basic briefing that it is an SSRF/spoofing issue in Microsoft Edge (Chromium-based). Monitor for updates and authoritative advisories to assess impact and remediation.

CVE-2026-66317

Technical details (affected product/components, root cause, impact, or remediation) are not publicly available in the provided documents. Monitor for updates from MSRC/NVD/ENISA EUVD for new information.

CVE-2026-66322

The CVE-2026-66322 issue concerns Microsoft Edge (Chromium-based). The connected sources describe an origin validation error that enables an unauthorized attacker to perform spoofing over a network. Affected software is Edge (Chromium-based); the vulnerability is tied to origin validation in the ...

CVE-2026-66311

CVE-2026-66311: Microsoft Edge (Chromium-based) Tampering Vulnerability. Local attacker can tamper due to missing authorization. Affects Edge when running Chromium-based builds; CVSSv3.1 base score 6.2 (Medium), confidentiality impact High, no impact to integrity/availability. Remediation: apply ...

CVE-2026-65802

CVE-2026-65802 affects Microsoft Edge for Android. The vulnerability is described as external control of a file name or path that enables an unauthorized attacker to disclose information over a network. It is network‑accessible with low attack complexity, no privileges required, but user interact...

CVE-2026-65804

Technical details about CVE-2026-65804 are not publicly provided in the supplied documents; no information on affected versions, root cause specifics, or mitigations is available. Monitor for updates.

CVE-2026-66316

Technical details for CVE-2026-66316 are not publicly available in the provided documents. Monitor for updates from MSRC/NVD.

CVE-2026-66314

Microsoft Edge (Chromium-based) is affected by a time-of-check time-of-use (TOCTOU) race condition that could allow an unauthenticated attacker to disclose information over a network. The vulnerability impacts the browser’s ability to protect data during network interactions. Root cause described...

CVE-2026-66315

Technical details about CVE-2026-66315 are not publicly available in the provided documents. Monitor for updates from the vendors and security advisories to obtain affected products, vulnerable components, impact specifics, and remediations.

CVE-2026-66313

CVE-2026-66313: A origin validation error in Microsoft Edge (Chromium-based) enables local tampering by an unauthorized attacker. Documents confirm the vulnerability exists but provide no specific exploit details or mitigations; no patch/version is stated in the supplied sources. Remediation stat...

CVE-2026-66310

Microsoft Edge for Android is affected by CVE-2026-66310, described as external control of a file name or path that allows an unauthorized local attacker to disclose information. The vulnerability is labeled with CVSS v3.1 base score 7.7 (HIGH), with attack vector LOCAL, all else equal; no user i...

CVE-2026-66312

CVE-2026-66312 affects Microsoft Edge (Chromium-based). The vulnerability is a buffer over-read in Edge that could allow an authorized attacker to execute code over a network. This is documented with a CVSS v3.1 base score of 6.5 (Medium) with network access and low privileges required, no user i...

CVE-2026-66321

CVE-2026-66321 is a Microsoft Edge (Chromium-based) remote code execution vulnerability caused by a resource access type confusion. The issue allows an unauthorized attacker to execute code over the network (attack vector: NETWORK) with no privileges required and user interaction needed, affectin...

CVE-2026-66318

CVE-2026-66318 affects Microsoft Edge (Chromium-based). Description: origin validation error may allow an unauthorized attacker to disclose information over a network. Metrics indicate CVSS v3.1 Base Score 8.1 (High) with network attack vector, low attack complexity, no privileges required, but u...

CVE-2026-18684

This CVE concerns GL.iNet GL-MT3000 devices (firmware up to 4.4.5). The issue lies in the function remove_profile of the file /cgi-bin/glc within component modem.so, enabling command injection. The vulnerability can be triggered remotely, and public exploit code exists. The vendor was informed an...

CVE-2026-48323

CVE-2026-48323 affects Adobe Campaign Classic (ACC): an Improper Neutralization of Special Elements Used in a Template Engine vulnerability could allow arbitrary code execution in the current user context. Exploitation does not require user interaction; the scope has been changed. The connected d...

CVE-2026-48333

CVE-2026-48333 affects Adobe Campaign Classic (ACC). The vulnerability is an Incorrect Authorization issue that could enable an attacker to attain elevated privileges. Exploitation does not require user interaction and is described with a high impact: confidentiality, integrity, and availability ...

CVE-2026-48317

Adobe Campaign Classic (ACC) is affected by an Eval Injection vulnerability (Improper Neutralization of Directives in Dynamically Evaluated Code) that could allow arbitrary code execution in the context of the current user. The issue can be exploited by a low-privileged attacker without user inte...

CVE-2026-48331

Adobe Campaign Classic (ACC) is affected by a Server-Side Request Forgery (SSRF) vulnerability that could lead to privilege escalation. The issue requires no user interaction and has a CRITICAL severity (CVSSv3.1: 10.0, Scope: CHANGED) with high impact on confidentiality, integrity, and availabil...

CVE-2026-48330

Adobe Campaign Classic (ACC) is affected by an SQL Injection (CWE-89) vulnerability: Improper neutralization of special elements in SQL commands could allow arbitrary code execution in the current user context. Attack vector is network with no user interaction required; scope is changed. CVSS v3....

CVE-2026-48399

Technical details about CVE-2026-48399 are not publicly available in the provided documents. Monitor for updates from official advisories to assess impact, affected products, and remediation.

CVE-2026-48326

Adobe Campaign Classic (ACC) is affected by an SQL Injection (Improper Neutralization of Special Elements used in an SQL Command) that could enable arbitrary code execution in the context of the current user. The issue can be exploited by a low-privileged attacker without user interaction, and th...

CVE-2026-18667

Affected product: Tenable Sensor Proxy; version: 1.4.2 (the release fixes a vulnerability). Vulnerability and impact: A remote attacker can cause code to execute with elevated privileges by persuading an operator to connect the sensor to an attacker-controlled host. The CVSS metrics indicate high...

CVE-2026-46714

Misskey web client (versions 8.63.0 and later prior to 2026.5.4) is vulnerable to a DoS caused by a malformed theme triggering uncontrolled recursion during theme compilation, which can slow or crash the client. The issue is fixed in version 2026.5.4. Remediation is to upgrade to 2026.5.4 or late...

CVE-2026-47746

CVE-2026-47746 affects Misskey (open source federated social platform). Affected versions are 12.37.0 and later, up to but not including 2026.5.4. The issue is a TOCTOU vulnerability in timing attacks during JSON-LD signature validation and the JSON-LD compaction process, caused by a non-shared p...

CVE-2026-67617

CVE-2026-67617 (Microweber CMS 2.0.20) describes a stored XSS in the content tagging system. An admin-authenticated attacker can inject arbitrary JavaScript by submitting payloads to the tag_names parameter of the GET /api/save_content_admin endpoint. The vulnerability allegedly bypasses three sa...

CVE-2026-67616

CVE-2026-67616 affects Camaleon CMS up to version 2.9.2. The flaw is a missing authorization on the drafts endpoint (admin/post_type drafts) that lets any authenticated low-privileged user bypass role/permission checks to create draft posts. These unauthorized drafts appear in the administrative ...