CVE-2026-15811

Kronosnet (version

CVE-2023-37507

Technical details for CVE-2023-37507 are not publicly available in the provided documents. The descriptions only state an information disclosure in HCL DevOps Plan. Monitor sources for updates and new technical details.

CVE-2026-16266

Mongo-object versions before 3.0.3 are vulnerable to prototype pollution via the expandKey() function in util.js, allowing an attacker to modify Object.prototype by crafting paths containing proto . This can lead to DoS or potentially remote code execution, depending on how polluted prototypes im...

CVE-2026-15927

CVE-2026-15927: Red Hat Quay repository-level mirror feature allows SSRF via external_reference in POST/PUT to endpoints/api/mirror.py, not applying the stricter validate_external_registry_url() used by organization-level mirrors. This enables a repository administrator to craft a hostname that m...

CVE-2023-37508

Technical details for CVE-2023-37508 are not publicly available in the provided documents. Monitor for updates from vendors and security feeds for affected products, versions, root cause, and mitigation steps.

CVE-2026-15156

CVE-2026-15156 affects the WordPress plugin “Essential Addons for Elementor – Popular Elementor Templates & Widgets” up to version 6.6.11. Root cause: insufficient input sanitization and output escaping leading to a Stored Cross-Site Scripting (XSS) vulnerability. Impact: authenticated users with...

CVE-2026-59776

The CVE describes a Missing Cryptographic Step (CWE-325) vulnerability in certain FeliCa IC chips shipped in or before 2017. If exploited, information stored in the IC chip may be read or tampered with. The issue concerns the cryptographic workflow of affected FeliCa chips and is supported by CVS...

CVE-2026-16336

Technical details about CVE-2026-16336 are not publicly available in the provided documents. Monitor for updates from trinodb/trino project and CVE listings.

CVE-2026-16334

The CVE-2026-16334 entry concerns itsourcecode Hospital Management System 1.0. A SQL injection vulnerability is present in an unknown code path of /prescriptionorder.php, triggered by manipulating the editid parameter. The issue is exploitable remotely, and publicly available exploit material exi...

CVE-2026-6952

The CVE affects Zyxel AX7501-B1 firmware up to version 5.17(ABPC.7.2)C0, where a post-authentication command injection in the LogServer component of the syslog module is possible. An authenticated administrator can execute OS commands on the device, per the description. CVSS v3.1 metrics indicate...

CVE-2026-63729

The CVE affects the SyncTeX parser (synctex_parser.c) shipped with TeX Live and used by downstream consumers like GNOME Evince. A heap use-after-free exists when processing malformed .synctex or .synctex.gz files: a malformed SyncTeX file can create a ref node with a NULL parent pointer, causing ...

CVE-2026-16332

CVE-2026-16332 affects D-Link DNS-320 with firmware 1.0.2. The vulnerability resides in the file /mydlink/multi_uploadify.php; manipulating the argument Filedata[] enables unrestricted upload. This can be exploited remotely, and the exploit is public and may be used. The connected documents provi...

CVE-2026-16331

The CVE-2026-16331 entry concerns D-Link DNS-320 firmware 1.0.2. The vulnerability affects the file /web/function/save_ajax.php, where manipulation of an argument in the Malicious Handler can lead to unrestricted file upload. Exploitation is possible remotely, and public disclosure of the exploit...

CVE-2026-16330

CVE-2026-16330 affects D-Link DNS-320 1.0.2. The vulnerability resides in an unknown function within /web/jquery/uploader/uploadify.php, where manipulation of a parameter leads to unrestricted upload and remote exploitation. Publicly available exploit code exists, with exploit maturity shown as P...

CVE-2026-16329

The CVE-2026-16329 entry affects D-Link DNS-320 firmware 1.0.2. A vulnerable function in /photo_center/php/uploadify.php can be triggered by manipulating the Malicious Handler argument to allow unrestricted file upload. Exploitation is described as remote, with a publicly available exploit. No pa...

CVE-2026-50758

CVE-2026-50758 describes a Cross Site Scripting vulnerability in DayuanJiang’s next-ai-draw-io (version 0.4.13) where an attacker can remotely execute arbitrary code via the mcp parameter. Technical details across multiple trusted sources confirm the affected software and the vulnerability patter...

CVE-2026-30632

CVE-2026-30632 affects knowns-dev/knowns 0.11.4. The vulnerability is a directory traversal triggered by a crafted folder name value to the create_doc tool. CVSSv3.1 base score 7.5 (HIGH) with Network attack vector, Low attack complexity, Privileges Required: None, User Interaction: None; Impact:...

CVE-2026-58431

Gitea: Public-only API token restriction is not enforced on team API routes. The /api/v1/teams/{id} endpoint may return private team repository metadata and private activity feed entries when called with a public-only token. Impact is exposure of non-public information via public tokens; exploita...

CVE-2026-30633

CVE-2026-30633 affects knowns-dev/knowns 0.11.4 and is a Directory traversal vuln triggered by crafted path values to the get_doc and update_doc tools. The baseline CVSSv3.1 score is 7.5 (HIGH) with NETWORK attack vector, LOW attack complexity, no privileges required, no user interaction, and imp...

CVE-2026-50759

CVE-2026-50759 affects exo-explore exo 1.0.69. A remote attacker can escalate privileges via unauthenticated access to GET /state and DELETE /instance/{instance_id}. The vulnerability appears to allow privilege escalation without authentication, with CVSS 3.1 base score 7.5 (HIGH) and network exp...

CVE-2026-58416

Gitea: Fork-PR Actions task can read a third private repository via the collaborative-owner branch (missing fork-PR guard). The cross-repo branches enforce a fork-PR discriminator, except the collaborative-owner branch, which lacks the !task.IsForkPullRequest guard that its siblings have. As a re...

CVE-2026-58420

Gitea: Local File Inclusion via file:// URI in Migration Restore. The restore-repo command reads release.yml from a user archive and passes the DownloadURL to uri.Open() without validating the scheme, enabling an operator to exfiltrate arbitrary files from the server filesystem as release attachm...

CVE-2026-52470

Technical details about CVE-2026-52470 are not publicly available in the provided documents. No affected products, versions, impact, or remediation specifics are disclosed here. Monitor for updates from official sources.

CVE-2025-68640

CVE-2025-68640 affects Apple's Find My backend service (through 2025-12-17). With a valid Private Endpoint Token (PET), an attacker can enumerate devices linked to an Apple ID and remove offline devices without triggering two‑factor authentication or ownership verification, potentially leading to...

CVE-2026-63134

CVE-2026-63134 is referenced in PT-Security advisories for Malcolm. The issue concerns path traversal during archive extraction in Malcolm’s archive handling logic. The trusted details specify that the vulnerability is addressed by validating resolved paths and enabling libarchive secure extracti...

CVE-2026-81042

CVE-2026-81042 (TerraSmuggle) is a critical RCE and credential-leak vulnerability disclosed for Terraform and OpenTofu. Root cause: improper verification in the HCL parser when resolving custom provider checksums and remote module sources during initialization. Attack vector: an attacker compromi...

CVE-2026-58438

Gitea vulnerability CVE-2026-58438: cross-repository IDOR/broken access control allows an attacker to tamper with issue dependency relationships and insert attacker-authored comments into private repositories they cannot access. This cross-border write primitive is bounded to existing dependency ...

CVE-2026-63177

CVE-2026-63177 is a security advisory in Malcolm (Malcolm v26.07.0). The vulnerability is an RBAC bypass caused by URI normalization differences between Nginx location matching and the Lua authorization layer, enabling potential unauthorized access. The PTSecurity entries indicate the issue is ad...

CVE-2026-50755

CVE-2026-50755 affects DayuanJiang’s next-ai-draw-io 0.4.13. The issue enables an attacker to obtain sensitive information by manipulating the X-Forwarded-For header, leading to potential information disclosure. The publicly provided details describe the vulnerability as a remote-access risk with...

CVE-2026-52472

CVE-2026-52472 is an SQL injection vulnerability affecting Wgcloud 3.6.4, exploitable via the PortInfoMapper.xml file. The NVD entry describes that a remote attacker can escalate privileges by sending crafted input to this component. The CVSS v3.1 vector indicates a network-accessible, low-comple...

CVE-2026-50756

CVE-2026-50756 affects DayuanJiang’s DayuanJiang next-ai-draw-io v0.4.13, with the vulnerability residing in the x-ai-provider component. The included metrics indicate a network-accessible issue with high impact on confidentiality (C:H) but no integrity or availability impact, and no user interac...

CVE-2025-66390

CVE-2025-66390 affects Microsoft Azure API Management Developer Portal: when Basic Authentication signup is enabled in Tenant A, an attacker can register on Tenant B by altering the Host header, bypassing a UI-level signup disable because the underlying /signup API remains accessible and validate...

CVE-2026-60151

Technical details for CVE-2026-60151 are not provided in the supplied documents. No affected products, root cause, impact, or remediation information is available here; monitor for updates.

CVE-2026-30631

CVE-2026-30631 affects bytebot-ai, with a root cause allowing arbitrary code execution via a crafted path to computer_write_file (commit 3d37894ce07ef8d8b40adc7fd309ad96c2a71313, 2025-09-11). The vulnerability is tracked across multiple feeds (NVD, CVE list, CVE records) and has a CVSS v3.1 base ...

CVE-2026-58417

Gitea: The REST API endpoint GET /orgs/{org}/public_members/{username} exposes membership information of private organizations to public. This leaks which users are members of private orgs via a public endpoint. The document does not specify root cause details beyond the endpoint exposure or any ...

CVE-2026-52469

CVE-2026-52469 affects Crocus v1.3.44. A SQL injection vulnerability in DeviceInfoMapper.xml allows a remote attacker to escalate privileges. The issue is described with a high-severity CVSS v3.1 base score of 9.8 (CRITICAL), with network attack vector and no user interaction required. Authors re...

CVE-2026-60341

Technical details for CVE-2026-60341 are not publicly available in the provided documents. No affected products, root cause, or remediation are disclosed here. Monitor for updates.

CVE-2026-52475

CVE-2026-52475 affects aiflowy

CVE-2026-52474

The vulnerability CVE-2026-52474 affects the aiflowy package (versions

CVE-2026-58427

Gitea-related CVE-2026-58427 is linked to an incomplete fix for PR #38145, where any authenticated user can enumerate all members of a private organization via the /members API endpoint. The connected doc indicates a privacy leakage in member enumeration that was not fully addressed by the fix. T...

CVE-2026-50757

DayuanJiang’s DayuanJiang next-ai-draw-io 0.4.13 contains a Directory Traversal vulnerability that allows a remote attacker to execute arbitrary code via the nex-ai-draw-io/mcp-server. Affected component: next-ai-draw-io (version 0.4.13). Root cause: directory traversal in the mcp-server componen...

CVE-2026-52476

CVE-2026-52476 affects aiflowy up to version 2.1.2. The vulnerability is a SQL Injection in getPageData (DatacenterQuery.java), enabling a remote attacker to obtain sensitive information. Documents consistently identify the flaw, but do not provide remediation details or exploit code. No explicit...

CVE-2026-63133

CVE-2026-63133 is mapped to Malcolm security advisory GHSA-c35g-mgc3-95rx. The PT Security documents describe a vulnerability in Malcolm where archive extraction could be abused to trigger inode- and resource-exhaustion DoS. The root cause is insufficient safeguards during archive extraction, lea...

CVE-2026-16327

The CVE-2026-16327 entry concerns D-Link DNS-320 firmware 1.0.2 where the /web/web_file/upload.php upload handling is vulnerable. Manipulating the File argument enables unrestricted file upload, with the attack executable remotely. The exploit has been publicly disclosed. No further remediation d...

CVE-2026-63728

Gitleaks before version 8.30.1 is affected by a template injection vulnerability in the report template feature. Attackers who can supply or influence report templates can leverage non-hermetic Sprig template functions (env, expandenv, getHostByName) to read arbitrary environment variables and ex...

CVE-2026-55833

Netty (network application framework) contains a vulnerability in SPDY header decoding. Prior to versions 4.1.136.Final and 4.2.16.Final, the zlib-compressed header blocks may continue inflating after the header parser exceeds maxHeaderSize, allowing a remote peer to send a small compressed HEADE...

CVE-2026-55831

Netty CVE-2026-55831 affects the SPDY SETTINGS decoder. Prior to 4.1.136.Final and 4.2.16.Final, the decoder accepts a peer-declared SETTINGS entry count up to the 24-bit frame-length limit and materializes every unique setting ID in DefaultSpdySettingsFrame. A remote SPDY/3.1 peer could send a s...

CVE-2026-15905

CVE-2026-15905 is a local-use-after-free vulnerability in the Aura component of Google Chrome (Chromium-based) prior to 150.0.7871.128, allowing a local attacker to potentially cause heap corruption via a malicious file. The issue is confirmed in multiple sources and is addressed by an update to ...

CVE-2026-15904

Google Chrome on Linux with Ozone is vulnerable to a use-after-free in Ozone that can lead to heap corruption. A remote attacker would need user interaction (specific UI gestures) and a crafted HTML page to potentially exploit the issue, with affected versions prior to 150.0.7871.128. Remediation...

CVE-2026-15903

CVE-2026-15903 affects Google Chrome’s V8 engine, with an out-of-bounds read/write vulnerability in V8 prior to version 150.0.7871.128. The issue allows a crafted HTML page to run arbitrary code inside the sandbox. The description notes the vulnerability as High severity and implies remote code e...