CVE-2026-44878

CVE-2026-44878 affects HPE Aruba Networking EdgeConnect SD-WAN Gateways running ECOS. The vulnerability in the web-based management interface allows an authenticated, highly privileged remote attacker to access the device filesystem, with potential to read sensitive files and tamper with or delet...

CVE-2026-55982

Technical details for CVE-2026-55982 are not publicly available in the provided documents; monitor for updates.

CVE-2026-58434

Technical details are not publicly available in the provided documents for CVE-2026-58434. Monitor for updates.

CVE-2026-54481

Technical details about CVE-2026-54481 are not publicly available in the provided documents. Monitor for updates for disclosure, affected products, impact, and remediation.

CVE-2026-47688

FOGProject vulnerability CVE-2026-47688 affects the FOGPage in FOG software. Before versions 1.5.10.1832 and 1.6.0-beta.2313, the clearAES and clearPMTasks methods can be invoked unauthenticated via a single HTTP GET to the public client node endpoint, enabling remote wiping of host AES encryptio...

CVE-2026-50105

Technical details for CVE-2026-50105 are not publicly available in the provided documents. Monitor for updates as information about affected products, impact, or fixes has not been disclosed.

CVE-2026-42931

Technical details are not publicly available in the provided documents. This CVE entry is reserved with no public details; monitor for updates.

CVE-2026-58445

Technical details for CVE-2026-58445 are not publicly available in the provided documents. Monitor for updates when the organization publishes details.

CVE-2026-47687

FOGProject vulnerability CVE-2026-47687: an unauthenticated attacker who knows a registered host MAC can post a crafted sysproduct to /service/inventory.php, causing the selectForm() helper to render unescaped input in option labels. This stored value is eventually displayed when an administrator...

CVE-2026-58444

Technical details for CVE-2026-58444 are not publicly available in the provided documents. No affected products, components, or impact are specified. Monitor for updates from the issuing organization.

CVE-2026-58442

Technical details for CVE-2026-58442 are not publicly available in the provided documents. Monitor for updates; no information on affected software, impact, vectors, or remediation is present.

CVE-2026-47685

FOGProject vulnerable to stored cross-site scripting (XSS) in the Host Management Inventory page due to two issues disclosed across connected sources: (1) unauthenticated inventory service endpoint /service/inventory.php persists client-supplied values without sanitization; and (2) the Host Manag...

CVE-2026-58441

Technical details for CVE-2026-58441 are not publicly available in the provided documents. Monitor for updates as information may be disclosed later.

CVE-2026-63764

LMDeploy prior to 0.14.0 contains a server-side request forgery (SSRF) in the _load_http_url function of the media handler. The private-IP guard validates only the original URL; after HTTP redirects, hosts are not re-validated. An unauthenticated attacker can submit a crafted image_url to the cha...

CVE-2026-63139

CVE-2026-63139 describes an Uncontrolled Resource Consumption (CWE-400) in Kibana, specifically targeting the Canvas functionality. An authenticated low-privilege user can trigger a specially crafted request that causes excessive allocation, leading to the Kibana server process termination and a ...

CVE-2026-46556

The CVE describes a Server-Side Request Forgery (SSRF) in FlaskBB prior to 2.2.1, where get_image_info(url) passes the supplied URL directly to requests.get without validating scheme/host/IP. This allows any authenticated user to cause the server to access internal endpoints and cloud metadata se...

CVE-2026-64821

The issue CVE-2026-64821 affects djangoSIGE up to version 1.10. The vulnerability arises in order-cancellation logic (CancelarOrcamentoVendaView, CancelarPedidoVendaView, CancelarOrcamentoCompraView, CancelarPedidoCompraView) implemented in HTTP GET handlers, allowing unauthenticated attackers to...

CVE-2026-65054

Affected software: MediaCMS 8.2.0. Vulnerability: Information disclosure via playlist ownership loophole. Authenticated users can expose private media metadata belonging to other users by bypassing access controls when manipulating their own playlists. Root cause / trigger: Attacker issues a PUT ...

CVE-2026-64822

The CVE-2026-64822 entry describes a user enumeration vulnerability in djangoSIGE

CVE-2026-12139

Technical details for CVE-2026-12139 are not publicly available in the provided documents. Monitor for updates from Tanium or NVD for affected components, impact, and remediation.

CVE-2026-11925

Technical details (affected component/version/root cause/impact) are not publicly available in the provided documents. Monitor for updates from Tanium and CVE records for any additional technical specifics.

CVE-2026-56654

Technical details for CVE-2026-56654 are not publicly available in the provided documents. The entry is reserved; monitor for updates.

CVE-2026-56755

Technical details for CVE-2026-56755 are not publicly available in the provided documents. Monitor for updates from the disclosure source.

CVE-2026-58507

Technical details for CVE-2026-58507 are not publicly available in the provided documents. Monitor for updates and new disclosures when the candidate is announced or published; no risk assessment can be given from the current data.

CVE-2026-57886

Technical details for CVE-2026-57886 are not publicly available in the provided documents. Monitor for updates.

CVE-2026-23603

Technical details for CVE-2026-23603 are not publicly available in the provided documents. Monitor for updates as information remains reserved.

CVE-2026-58425

Technical details for CVE-2026-58425 are not provided in the supplied documents; no affected products, root cause, impact, or remediation are disclosed. Monitor for updates.

CVE-2026-59763

CVE-2026-59763 (Gitea) relates to an unbounded Arch package file metadata vulnerability in the Gitea package registry. The issue arises when uploading Arch archives: non-dot regular file entries are recorded into package metadata (FileMetadata.Files) without an explicit cap on count or total file...

CVE-2026-56750

Gitea Remember-Me token handling is vulnerable: when a stolen Remember-Me token is used, the system rotates the hash (same ID, new Hash) and, on hash mismatch later, should invalidate all sessions. However, CheckAuthToken returns ErrAuthTokenInvalidHash and autoSignIn deletes the local cookie but...

CVE-2026-63136

CVE-2026-63136 describes an uncontrolled resource consumption issue (CWE-400) in Elasticsearch that can cause a denial of service via excessive heap allocation. A user with search privileges can craft a request that drives a data node to exhaust heap memory, leading to node unavailability and clu...

CVE-2026-58432

This CVE describes a vulnerability in Gitea where attachments linked to draft releases can be downloaded via UUID-based web endpoints even when the draft release is hidden in API calls. Root cause: the web attachment handler (ServeAttachment) only checks read permissions and does not enforce the ...

CVE-2026-58428

The connected GHSA advisory details a concrete vulnerability in Gitea where the web path for editing release attachments (EditReleasePost) does not perform the same allowlist validation as the API path. A user with write permissions can rename an existing release attachment to a forbidden extensi...

CVE-2026-56443

Summary of relevant details (CVE-2026-56443): The connected advisory describes a token-scopes bypass issue remaining for Limited-owner repositories and packages in Gitea after the CVE-2026-25714 fix. In tests on gitea/gitea:1.26.2, a public-only token with scopes including read:package/read:repos...

CVE-2026-56147

CVE-2026-56147 describes an Authorization Bypass in Kibana where a low-privileged authenticated user can bypass file access controls due to a mismatch between access checks and resource retrieval. The vulnerability enables unauthorized retrieval, modification, or deletion of case attachments (inc...

CVE-2026-58439

CVE-2026-58439 / Gitea advisory : The vulnerability arises when a pull request’s base branch is changed after an approval, but existing reviews are not re-evaluated against the new target branch’s protection rules. In Gitea, approvals are stored with an “official” flag and are only counted agains...

CVE-2026-16318

The CVE-2026-16318 issue affects server-side QUIC deployments using s2n-tls, where the QUIC transport parameters extension handler uses s2n_alloc instead of s2n_realloc. During TLS 1.3 HelloRetryRequest, the handler runs twice on the same connection; on the second run it zeroes the existing point...

CVE-2026-63358

Summary of CVE-2026-63358 (FileGator privilege escalation) The affected software is FileGator. The vulnerability arises in the /chmoditems API endpoint, which accepts arbitrary Unix permission values and passes them directly to PHP’s native chmod() via octdec() without validation. This enables an...

CVE-2026-59766

The connected advisory details Gitea CVE-2026-20800: two sibling endpoints that return data keyed to the caller’s relationship do not re-check repo access at output time. As a revoked user, you can leak private stars and private issue titles via GET /api/v1/user/starred and GET /api/v1/user/times...

CVE-2026-65058

The CVE-2026-65058 affects Trezor Safe firmware 3, 5, and 7, where a confirmation-binding flaw in the Ethereum sign_tx / sign_tx_eip1559 flow allows an attacker to present calldata and later supply a different tail, changing the signed transaction while only the initial calldata chunk is confirme...

CVE-2026-16317

The flaw affects s2n-tls (TLS 1.3) where the outer content_type byte is not covered by the AEAD tag because it is hardcoded in AAD instead of using the wire byte. This allows an active MITM to silently discard individual application_data records without detection, enabling selective suppression o...

CVE-2026-58440

Linked connected advisory GHSA-66M4-5JJR-2RG5 details a Gitea vulnerability where webhooks created by a collaborator keep firing after access is revoked, enabling ongoing real-time exfiltration of private content. The issue affects Gitea’s collaboration handling (DeleteCollaboration) and webhook ...

CVE-2026-47143

Capstone disassembly framework vulnerability CVE-2026-47143 affects Capstone builds compiled with -DCAPSTONE_X86_REDUCE. A NULL pointer dereference in modRMRequired() and decode() when disassembling 3DNow! opcodes (0F 0F) can crash applications using the reduced X86 library if given a crafted inp...

CVE-2026-64881

CVE-2026-64881 involves an audit file upload handler that fails to sanitize filenames, allowing shell metacharacters to flow into system command execution. This input validation failure enables command injection when chained with a related vulnerability. The CVSS scores indicate high impact to co...

CVE-2026-56146

CVE-2026-56146 : In Kibana, an improper access control (CWE-284) in the Entity Analytics Watchlist configuration allows a low-privileged, authenticated user with read-only Security Solution access to perform write operations on watchlist data that should require elevated privileges, and potential...

CVE-2026-56145

CVE-2026-56145 describes an Elasticsearch vulnerability of uncontrolled resource consumption (CWE-400) leading to denial of service via excessive memory allocation (CAPEC-130). A low-privileged authenticated user who can execute EQL sequence queries against an index they control can craft queries...

CVE-2026-64880

CVE-2026-64880 corresponds to a blind SQL injection in Tenable Security Center, caused by unsanitized user input in report filtering parameters that is concatenated into SQL queries. This can enable unauthorized database read access. The CVE is listed with a base score of 7.1 (HIGH) on CVSS v3.1/...

CVE-2026-47671

Nhost CLI prior to 1.46.0 exposes an unauthenticated, cross-origin-configurable configserver via nhost dev. The hidden configserver serves Mimir GraphQL with dummy authorization and permissive CORS (Access-Control-Allow-Origin: *). An attacker-controlled web page can reach localhost and perform q...

CVE-2026-47667

CVE-2026-47667 affects the CImg Library prior to 4.0.0. In _load_analyze(), header_size is read as an unsigned int from the first 4 bytes of an Analyze/NIfTI header and passed directly to new unsigned char[header_size] without bounding to the actual file size. Values up to ~4 GB are accepted; if ...

CVE-2026-64879

Technical details about CVE-2026-64879 are not publicly available in the provided documents. Monitor for updates.

CVE-2026-46403

Summary (verified): Klever-Go KVM read-only execution can leak state changes via contract delete/upgrade side effects when invoked through ExecuteReadOnlyWithTypedArguments. The root cause is applying read-only as runtime state while not enforcing it in state-changing host-core paths, allowing a ...