CVE-2026-26396

OpenBMB XAgent v1.0.0 and earlier are affected by a path traversal in the file() function within XAgent/XAgentServer/application/routers/workspace.py. The input parameter filename is user-controllable and concatenated into the file path without proper validation, enabling potential disclosure of ...

CVE-2026-51536

OpENer 2.3.0 is affected by CVE-2026-51536 due to inconsistent typing of the length parameter across the call stack: an upstream int length is passed to a downstream function expecting a 16-bit signed EipInt16. A crafted CIP packet can cause the length to overflow or become negative, bypassing bo...

CVE-2025-45869

CVE-2025-45869 affects LogicalDOC Enterprise up to and before v9.1.1. The vulnerability is a Server-Side Request Forgery (SSRF) in the ShareFileCallback servlet, exploitable by an unauthenticated attacker who can manipulate input parameters to trigger a server-side request to an attacker-controll...

CVE-2026-39042

The CVE-2026-39042 issue affects MikroTik RouterOS, specifically 7.21.x prior to 7.21.4 and 7.22.x prior to 7.22.2. The vulnerability resides in the unflatten() function within libumsg.so, allowing a remote attacker to cause a denial of service. No exploitation details are provided in the documen...

CVE-2026-51537

OpENer 2.3.0 (commit 76b95cf) contains an out-of-bounds read in the Connection Manager when processing malformed ForwardOpen/LargeForwardOpen requests, allowing a remote attacker to trigger the issue over the network without authentication. Red Hat notes potential denial of service or information...

CVE-2026-51538

CVE-2026-51538 (OpENer 2.3.0) describes an Incorrect Access Control in encapsulation session handling. The server validates that a session_handle exists in the global list but does not verify that the handle belongs to the TCP connection issuing the request. With no strong binding between a sessi...

CVE-2026-51541

OpENer 2.3.0 (commit 76b95cf) is affected by CVE-2026-51541 due to an out-of-bounds read in CIP message parsing when processing malformed explicit requests with a forged EPath size. An ENIP SendRRData frame carrying a short CIP payload with a larger declared path_size can cause the parser to cont...

CVE-2026-61706

Technical details about CVE-2026-61706 are not publicly available in the provided documents. No affected products, components, root cause, or remediation are specified. Monitor for updates when additional information is published.

CVE-2026-61826

Technical details for CVE-2026-61826 are not publicly available in the provided documents. No affected products, impact, or remediation are disclosed. Monitor for updates as new information is released.

CVE-2026-52533

CVE-2026-52533 affects D-Link DIR-1253 v1.0.1.250923.142435. The issue enables privilege escalation via the etc/shadow component file. Details across connected sources consistently describe the same affected product and vector; no exploit steps or patches are provided in the supplied documents. T...

CVE-2026-51540

OpENer 2.3.0 (master up to commit 76b95cf) is affected by a severe memory corruption vulnerability due to an integer underflow in processing of connected explicit messages (SendUnitData). The CVE-2026-51540 entry lists a CVSS v3.1 base score of 9.8 (CRITICAL) with NETWORK attack vector, no privil...

CVE-2026-15514

Metasoft MetaCRM (up to version 6.4.0 Beta06) contains a SQL injection vulnerability in PHPRPC Remote Call Interface, specifically in RPCService.query within /customizemt/xkq/rpc.jsp. The issue arises from manipulation of the argument phprpc_args, enabling remote exploitation. Public exploit avai...

CVE-2026-15513

The CVE-2026-15513 vulnerability affects the Wavlink WL-NU516U1 (model 260515) in the CGI handler /cgi-bin/adm.cgi, specifically the wlink_uci_set_value function. An attacker can remotely manipulate the lan_ip argument to trigger an OS command injection. Impact is described as network-accessible ...

CVE-2026-15512

CVE-2026-15512 affects pig-mesh Pig up to 3.9.2. The issue lies in pig-codegen, specifically GeneratorServiceImpl.java, where certain manipulation leads to code injection. The vulnerability appears exploitable remotely, with a publicly available exploit. The vendor was contacted early but did not...

CVE-2026-15511

Comfast CF-WR631AX V3 devices affected up to version 2.7.0.8; the FastCGI Backend’s /usr/bin/webmgnt module function system_wl_upload_pic_file accepts a manipulated filename, leading to OS command injection. Attacks can be remotely initiated; the exploit has been publicly disclosed and vendor res...

CVE-2026-15510

Leantime up to 3.8.0 is affected by an improper authorization issue in API:Setting::saveSetting. The root cause is improper access control in the SaveSetting function, enabling a remote attack. Public exploit exists and could be used. The vulnerability impacts the API component and is rated with ...

CVE-2026-15509

Leantime up to 3.8.0 is affected by a vulnerability in the JSON-RPC Endpoint functions editUser/addUser where manipulating the role argument leads to improper authorization. The issue is exploitable remotely and has been publicly disclosed; vendor response was not provided. Affected impact includ...

CVE-2026-15508

Helicone ai-gateway (up to 0.2.0-beta.30) is affected. The flaw is in the AWS Metadata Service component, specifically the build_target_url function in ai-gateway/src/dispatcher/service.rs, where manipulating extracted_path_and_query can trigger server-side request forgery. Exploitation is possib...

CVE-2026-15507

CVE-2026-15507 affects coollabsio Coolify up to version 4.1.1. The vulnerability is in the Policy Handler component, specifically an unknown function under /app/Policies/. Manipulation can cause missing authorization and enables remote exploitation; the exploit is public. No additional remediatio...

CVE-2026-15506

CVE-2026-15506 affects SecureAge CatchPulse (up to 10.9.3). The vulnerable element is an unknown function in the saappctl.sys driver library, where manipulation leads to a heap-based buffer overflow. Exploitation is local, and publicly disclosed exploits exist. The vendor was contacted about this...