CVE ID: CVE-2026-4312 Severity: CRITICAL (CVSS 9.3) CWE: CWE-306 Affected: cpe:2.3:a:dragonsoft:gcb\/fcb_government_financial_cybersecurity_configuration_audit_software:-:*:*:*:*:*:*:* KEV (actively exploited): NO Description: GCB/FCB Audit Software developed by DrangSoft has a Missing Authentication vulnerability, allowing unauthenticated remote attackers to directly access certain APIs to create a new administrative account.


CVE ID: CVE-2026-33551 Severity: MEDIUM (CVSS 5.3) CWE: CWE-863 Affected: cpe:2.3:a:openstack:keystone:*:*:*:*:*:*:*:*, cpe:2.3:a:openstack:keystone:27.0.0:*:*:*:*:*:*:*, cpe:2.3:a:openstack:keystone:28.0.0:*:*:*:*:*:*:*, cpe:2.3:a:openstack:keystone:29.0.0:*:*:*:*:*:*:* KEV (actively exploited): NO Description: An issue was discovered in OpenStack Keystone 14 through 26 before 26.1.1, 27.0.0, 28.0.0, and 29.0.0. Restricted application credentials can create EC2 credentials. By using a restricted application credential to call the EC2 credential creation API, an authenticated user with only a reader role may obtain an EC2/S3 credential that carries the full set of the parent user's S3 permissions, effectively bypassing the role restrictions imposed on the application credential. Only deployments that use restricted application credentials in combination with the EC2/S3 compatibility API (swift3 / s3api) are affected.


CVE ID: CVE-2025-7743 Severity: CRITICAL (CVSS 9.6) CWE: CWE-319 Affected: cpe:2.3:a:dolusoft:omaspot:*:*:*:*:*:*:*:* KEV (actively exploited): NO Description: Cleartext Transmission of Sensitive Information vulnerability in Dolusoft Omaspot allows Interception, Privilege Escalation. This issue affects Omaspot: before 12.09.2025.


CVE ID: CVE-2025-7714 Severity: CRITICAL (CVSS 9.8) CWE: CWE-89 Affected: cpe:2.3:a:globalmedya:content_management_system:*:*:*:*:*:*:*:* KEV (actively exploited): NO Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Global Interactive Design Media Software Inc. Content Management System (CMS) allows Command Line Execution through SQL Injection. This issue affects Content Management System (CMS): through 21072025.


CVE ID: CVE-2025-7713 Severity: MEDIUM (CVSS 6.1) CWE: CWE-79 Affected: cpe:2.3:a:globalmedya:content_management_system:*:*:*:*:*:*:*:* KEV (actively exploited): NO Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Global Interactive Design Media Software Inc. Content Management System (CMS) allows XSS Through HTTP Headers. This issue affects Content Management System (CMS): through 21072025.


CVE ID: CVE-2024-58135 Severity: MEDIUM (CVSS 5.3) CWE: CWE-338 Affected: cpe:2.3:a:mojolicious:mojolicious:*:*:*:*:*:perl:*:* KEV (actively exploited): NO Description: Mojolicious versions from 7.28 through 9.45 for Perl will generate weak HMAC session cookie secrets via "mojo generate app" by default. When creating a default app skeleton with the "mojo generate app" tool, a weak secret is written to the application's configuration file using the insecure rand() function, and used for authenticating and protecting the integrity of the application's sessions. This may allow an attacker to brute force the application's session keys. Release 9.46 fixes the issue by providing high quality randomness, even in absence of CryptX. Users should be aware that the update does not replace previously generated weak secrets. A secret generated with the previous version MUST be replaced to ensure the updated version is using a strong secret.


CVE ID: CVE-2025-12686 Severity: CRITICAL (CVSS 9.8) CWE: CWE-120 Affected: cpe:2.3:o:synology:beestation_os:*:*:*:*:*:*:*:* KEV (actively exploited): NO Description: Buffer copy without checking size of input ('Classic Buffer Overflow') vulnerability in AdminCenter in Synology BeeStation OS before 1.3.2-65648 allows remote attackers to execute arbitrary code via unspecified vectors.


CVE ID: CVE-2026-22750 Severity: HIGH (CVSS 7.5) CWE: CWE-15 Affected: cpe:2.3:a:vmware:spring_cloud_gateway:4.2.0:*:*:*:*:*:*:* KEV (actively exploited): NO Description: When configuring SSL bundles in Spring Cloud Gateway by using the configuration property spring.ssl.bundle, the configuration was silently ignored and the default SSL configuration was used instead. Note: The 4.2.x branch is no longer under open source support. If you are using Spring Cloud Gateway 4.2.0 and are not an enterprise customer, you can upgrade to any Spring Cloud Gateway 4.2.x release newer than 4.2.0 available on Maven Centeral https://repo1.maven.org/maven2/org/springframework/cloud/spring-cloud-gateway/ . Ideally if you are not an enterprise customer, you should be upgrading to 5.0.2 or 5.1.1 which are the current supported open source releases.


CVE ID: CVE-2026-5525 Severity: HIGH (CVSS 7.8) CWE: CWE-121 Affected: cpe:2.3:a:notepad-plus-plus:notepad\+\+:8.9.3:*:*:*:*:*:*:* KEV (actively exploited): NO Description: A stack-based buffer overflow vulnerability exists in Notepad++ version 8.9.3 in the file drop handler component. When a user drags and drops a directory path of exactly 259 characters without a trailing backslash, the application appends a backslash and null terminator without proper bounds checking, resulting in a stack buffer overflow and application crash (STATUS_STACK_BUFFER_OVERRUN).


CVE ID: CVE-2026-40989 Severity: MEDIUM (CVSS 6.5) CWE: CWE-674 Affected: cpe:2.3:a:vmware:spring_cloud_function:*:*:*:*:*:*:*:* KEV (actively exploited): NO Description: Under infinite recursion in the routing layer, request-handling can cause OOM error. Affected Spring Products and Versions: Spring Cloud Function 3.2.x: versions prior to 3.2.16 Spring Cloud Function 4.1.x: versions prior to 4.1.10 Spring Cloud Function 4.2.x: versions prior to 4.2.6 Spring Cloud Function 4.3.x: versions prior to 4.3.3 Spring Cloud Function 5.0.x: versions prior to 5.0.2 Older, unsupported versions are also affected.


CVE ID: CVE-2026-40990 Severity: MEDIUM (CVSS 6.5) CWE: CWE-770 Affected: cpe:2.3:a:vmware:spring_cloud_function:*:*:*:*:*:*:*:* KEV (actively exploited): NO Description: OOM error is possible while attempting to add infinite amount of functions to Function Registry. Affected Spring Products and Versions: Spring Cloud Function 3.2.x: versions prior to 3.2.16 Spring Cloud Function 4.1.x: versions prior to 4.1.10 Spring Cloud Function 4.2.x: versions prior to 4.2.6 Spring Cloud Function 4.3.x: versions prior to 4.3.3 Spring Cloud Function 5.0.x: versions prior to 5.0.2 Older, unsupported versions are also affected.


CVE ID: CVE-2026-34993 Severity: HIGH (CVSS 7.3) CWE: CWE-502 Affected: cpe:2.3:a:aiohttp:aiohttp:*:*:*:*:*:*:*:* KEV (actively exploited): NO Description: AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.14.0, using ``CookieJar.load()`` with untrusted input may allow arbitrary code execution. Most applications using this function will be doing so with the user's own data, so this is unlikely to affect many applications. Version 3.14.0 patches the issue. If an application does allow attacker controlled files to be loaded, a workaround on older releases would be to sanitize the files before loading.


CVE ID: CVE-2026-47265 Severity: MEDIUM (CVSS 6.6) CWE: CWE-346 Affected: cpe:2.3:a:aiohttp:aiohttp:*:*:*:*:*:*:*:* KEV (actively exploited): NO Description: AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.14.0, cookies set with the `cookies` parameter on requests are sent after following a cross-origin redirect. If a developer uses the `cookies` parameter on a per-request basis then sensitive data might be leaked to an attacker if they manage to control a redirect. Version 3.14.0 patches the issue. If unable to upgrade, using a `Cookie` header in the `headers` parameter is not vulnerable.


CVE ID: CVE-2026-50256 Severity: HIGH (CVSS 7.8) CWE: CWE-121 KEV (actively exploited): NO Description: A stack-based buffer overflow flaw was found in the X.Org X server and Xwayland. A mismatch between the X server and the libXfont2 library's maximum font name length can cause a stack buffer overflow during font alias resolution. The server allocates a 256 byte stack buffer but libXfont2's alias target name length is 1024 bytes. A font alias name between 257 and 1023 bytes causes the X server to copy that name into the undersized stack buffer without further checks. This may be used to crash the server, or for privilege escalation if the X server runs as root.


CVE ID: CVE-2026-50257 Severity: HIGH (CVSS 7.8) CWE: CWE-416 KEV (actively exploited): NO Description: A use-after-free flaw was found in the X.Org X server and Xwayland in miSyncDestroyFence(). A client that sets up multiple fence triggers can trigger a use-after-free function pointer call. An attacker would connect to the X server to set up a fence and await that fence, then a second X connection destroys the fence, causing the use-after-free. This may be used to crash the server, or for privilege escalation if the X server runs as root.


CVE ID: CVE-2026-50258 Severity: HIGH (CVSS 7.8) CWE: CWE-121 KEV (actively exploited): NO Description: A stack-based buffer overflow flaw was found in the X.Org X server and Xwayland. The X server has multiple stack buffers sized XkbMaxShiftLevel * XkbNumKbdGroups but CheckKeyTypes() does not verify or clamp non-canonical key types to XkbMaxShiftLevel. A client can change key types to excessive shift levels and trigger stack overflows. This is caused by an incomplete fix of CVE-2025-26597. This may be used to crash the server, or for privilege escalation if the X server runs as root.


CVE ID: CVE-2026-50259 Severity: HIGH (CVSS 7.8) CWE: CWE-121 KEV (actively exploited): NO Description: A stack-based buffer overflow flaw was found in the X.Org X server and Xwayland. _XkbSetMapChecks() declares a fixed-size stack buffer mapWidths[256] indexed by key type index. The helper function CheckKeyTypes() writes to this buffer at a client-controlled offset, allowing a stack buffer overflow. This may be used to crash the server, or for privilege escalation if the X server runs as root.


CVE ID: CVE-2026-50260 Severity: HIGH (CVSS 7.8) CWE: CWE-416 KEV (actively exploited): NO Description: A use-after-free flaw was found in the X.Org X server and Xwayland in FreeCounter(). A client that sets up multiple SyncCounters and awaits on those triggers can trigger a use-after-free when destroying those counters via a second client connection. This may be used to crash the server, or for privilege escalation if the X server runs as root.


CVE ID: CVE-2026-50261 Severity: HIGH (CVSS 7.8) CWE: CWE-416 KEV (actively exploited): NO Description: A use-after-free flaw was found in the X.Org X server and Xwayland in SyncChangeCounter(). A client that sets up multiple SyncCounters can trigger a use-after-free when destroying those counters via a second client connection while changing those counters. This may be used to crash the server, or for privilege escalation if the X server runs as root.


CVE ID: CVE-2026-50262 Severity: MEDIUM (CVSS 5.5) CWE: CWE-125 KEV (actively exploited): NO Description: An out-of-bounds read flaw was found in the X.Org X server and Xwayland in __glXDisp_ChangeDrawableAttributes(). A wrong size validation check can read a client-controlled number of bytes, exceeding the request buffer, leading to information disclosure. A write path also exists but requires byte-swapped clients which is disabled by default.


CVE ID: CVE-2026-50263 Severity: MEDIUM (CVSS 5.5) CWE: CWE-416 KEV (actively exploited): NO Description: A use-after-free flaw was found in the X.Org X server and Xwayland in CreateSaverWindow(). A client can trigger a use-after-free read after changing window attributes and forcing the screen saver, leading to information disclosure.


CVE ID: CVE-2026-50264 Severity: HIGH (CVSS 7.8) CWE: CWE-787 KEV (actively exploited): NO Description: An out-of-bounds write flaw was found in the X.Org X server and Xwayland in DRIGetBuffers/DRIGetBuffersWithFormat. A client that requests multiple DRI2BufferBackLeft attachments and one DRI2BufferFrontLeft can trigger an out-of-bounds heap write. This may be used to crash the server, or for privilege escalation if the X server runs as root.


CVE ID: CVE-2026-11312 Severity: LOW (CVSS 1.9) CWE: CWE-404, CWE-407 KEV (actively exploited): NO Description: A vulnerability was found in bytedance InfiniStore up to 0.2.33. The impacted element is the function purge_kv_map in the library /src/infinistore.h of the component KV Map Handler. Performing a manipulation results in inefficient algorithmic complexity. The attack requires a local approach. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.


CVE ID: CVE-2026-49777 Severity: CRITICAL (CVSS 10.0) CWE: CWE-1284 KEV (actively exploited): NO Description: Improper Validation of Specified Quantity in Input vulnerability in ShapedPlugin, LLC Product Slider Pro for WooCommerce allows Malicious Software Implanted. This issue affects Product Slider Pro for WooCommerce: from n/a before 3.5.3. No patched version is available - the vendor has applied a fix to an existing release without publishing a new version. While the patch provided by the vendor is valid, releasing it under the existing version number leaves users unable to reliably determine whether they are running a patched or vulnerable installation. As a result, we treat this as an unpatched version.


CVE ID: CVE-2026-11329 Severity: LOW (CVSS 2.0) CWE: CWE-327, CWE-328 KEV (actively exploited): NO Description: A vulnerability has been found in onnx onnx-mlir up to 0.5.0.0. Affected by this issue is the function generate_hash_key of the file src/Runtime/python/torch_onnxmlir/src/torch_onnxmlir/backend.py of the component Placeholder Node Cache Handler. Such manipulation leads to use of weak hash. An attack has to be approached locally. A high complexity level is associated with this attack. The exploitation is known to be difficult. The name of the patch is 72c5187ff6d13c2c2b3d3789b8f5faf99f08a5b4. Applying a patch is advised to resolve this issue.


CVE ID: CVE-2026-10870 Severity: HIGH (CVSS 7.3) CWE: CWE-77, CWE-78 KEV (actively exploited): NO Description: A flaw has been found in Shibby Tomato 1.28.0000. This affects the function start_dhcpc of the file /sbin/rc of the component Web UI. This manipulation causes os command injection. It is possible to initiate the attack remotely. The exploit has been published and may be used. This project is superseded by FreshTomato.


CVE ID: CVE-2026-10871 Severity: HIGH (CVSS 7.3) CWE: CWE-77, CWE-78 KEV (actively exploited): NO Description: A vulnerability has been found in Shibby Tomato 1.28.0000. This vulnerability affects the function start_6rd_tunnel of the file /sbin/rc of the component Web UI. Such manipulation of the argument ipv6_6rd_borderrelay leads to os command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. This project is superseded by FreshTomato.


CVE ID: CVE-2026-10872 Severity: HIGH (CVSS 7.3) CWE: CWE-77, CWE-78 KEV (actively exploited): NO Description: A vulnerability was found in Shibby Tomato 1.28.0000. This issue affects the function start_vpnserver of the file /sbin/rc of the component Web UI. Performing a manipulation results in os command injection. The attack can be initiated remotely. The exploit has been made public and could be used. This project is superseded by FreshTomato.


CVE ID: CVE-2026-10874 Severity: LOW (CVSS 2.1) CWE: CWE-74, CWE-89 KEV (actively exploited): NO Description: A vulnerability was identified in projectworlds Online Art Gallery Shop Project 1.0. The affected element is an unknown function of the file /admin/adminHome.php. The manipulation of the argument social_insta leads to sql injection. The attack may be initiated remotely. The exploit is publicly available and might be used.


CVE ID: CVE-2026-10875 Severity: LOW (CVSS 2.1) CWE: CWE-74, CWE-89 KEV (actively exploited): NO Description: A security flaw has been discovered in projectworlds Online Art Gallery Shop Project 1.0. The impacted element is an unknown function of the file /admin/adminHome.ph. The manipulation of the argument social_twitter results in sql injection. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks.


CVE ID: CVE-2026-10586 Severity: HIGH (CVSS 7.2) CWE: CWE-918 KEV (actively exploited): NO Description: The Gutenberg Essential Blocks – Page Builder for Gutenberg Blocks & Patterns plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 6.1.3 via the `save_ai_generated_image()` function. This makes it possible for authenticated attackers, with Author-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.


CVE ID: CVE-2026-10876 Severity: LOW (CVSS 2.1) CWE: CWE-266, CWE-285 KEV (actively exploited): NO Description: A weakness has been identified in SourceCodester Ship Ferry Ticket Reservation System 1.0. This affects an unknown function of the file /admin/. This manipulation of the argument page causes improper authorization. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be used for attacks.


CVE ID: CVE-2026-10877 Severity: MEDIUM (CVSS 5.5) CWE: CWE-74, CWE-89 KEV (actively exploited): NO Description: A security vulnerability has been detected in SourceCodester Ship Ferry Ticket Reservation System up to 1.0. This impacts an unknown function of the file /admin/login.php of the component Admin Login. Such manipulation of the argument Username leads to sql injection. The attack can be executed remotely. The exploit has been disclosed publicly and may be used.


CVE ID: CVE-2025-8303 Severity: MEDIUM (CVSS 6.5) CWE: CWE-79 KEV (actively exploited): NO Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in EKA Software Computer Information Advertising Services Ltd. Real Estate Script V5 (With Doping Module – Store Module – New Language System) allows Cross-Site Scripting (XSS). This issue affects Real Estate Script V5 (With Doping Module – Store Module – New Language System): through 17022026. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.


CVE ID: CVE-2025-8276 Severity: MEDIUM (CVSS 4.3) CWE: CWE-116, CWE-74, CWE-79 KEV (actively exploited): NO Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting'), Improper Encoding or Escaping of Output, Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability in Patika Global Technologies HumanSuite allows Cross-Site Scripting (XSS), Phishing. This issue affects HumanSuite: before 53.21.0.


CVE ID: CVE-2025-8079 Severity: MEDIUM (CVSS 4.6) CWE: CWE-79 KEV (actively exploited): NO Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Akıllı Ticaret Software Technologies Ltd. Co. Smart Trade E-Commerce allows Reflected XSS. This issue affects Smart Trade E-Commerce: before 4.5.0.0.1.


CVE ID: CVE-2025-8057 Severity: MEDIUM (CVSS 6.5) CWE: CWE-285, CWE-610, CWE-639 KEV (actively exploited): NO Description: Authorization Bypass Through User-Controlled Key, Externally Controlled Reference to a Resource in Another Sphere, Improper Authorization vulnerability in Patika Global Technologies HumanSuite allows Exploiting Trust in Client. This issue affects HumanSuite: before 53.21.0.


CVE ID: CVE-2025-8025 Severity: CRITICAL (CVSS 9.8) CWE: CWE-284, CWE-306 KEV (actively exploited): NO Description: Missing Authentication for Critical Function, Improper Access Control vulnerability in Dinosoft Business Solutions Dinosoft ERP allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Dinosoft ERP: from < 3.0.1 through 11022026. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.


CVE ID: CVE-2025-7799 Severity: HIGH (CVSS 8.6) CWE: CWE-79 KEV (actively exploited): NO Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Zirve Information Technologies Inc. E-Taxpayer Accounting Website allows Reflected XSS. This issue affects e-Taxpayer Accounting Website: through 07082025.


CVE ID: CVE-2025-7760 Severity: HIGH (CVSS 7.6) CWE: CWE-79 KEV (actively exploited): NO Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Ofisimo Web-Based Software Technologies Association Web Package Flora allows XSS Through HTTP Headers. This issue affects Association Web Package Flora: from v3.0 through 03022026. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.


CVE ID: CVE-2025-7744 Severity: CRITICAL (CVSS 9.8) CWE: CWE-89 Affected: cpe:2.3:a:dolusoft:omaspot:*:*:*:*:*:*:*:* KEV (actively exploited): NO Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Dolusoft Omaspot allows SQL Injection. This issue affects Omaspot: before 12.09.2025.


CVE ID: CVE-2025-48041 Severity: HIGH (CVSS 7.1) CWE: CWE-400, CWE-770 KEV (actively exploited): NO Description: Allocation of Resources Without Limits or Throttling vulnerability in Erlang OTP ssh (ssh_sftp modules) allows Excessive Allocation, Flooding. This vulnerability is associated with program files lib/ssh/src/ssh_sftpd.erl. This issue affects OTP from OTP 17.0 until OTP 28.0.3, OTP 27.3.4.3 and 26.2.5.15 corresponding to ssh from 3.0.1 until 5.3.3, 5.2.11.3 and 5.1.4.12.


CVE ID: CVE-2025-48040 Severity: MEDIUM (CVSS 6.9) CWE: CWE-400, CWE-770 KEV (actively exploited): NO Description: Uncontrolled Resource Consumption vulnerability in Erlang OTP ssh (ssh_sftp modules) allows Excessive Allocation, Flooding. This vulnerability is associated with program files lib/ssh/src/ssh_sftpd.erl. This issue affects OTP from OTP 17.0 until OTP 28.0.3, OTP 27.3.4.3 and 26.2.5.15 corresponding to ssh from 3.0.1 until 5.3.3, 5.2.11.3 and 5.1.4.12.


CVE ID: CVE-2025-48039 Severity: MEDIUM (CVSS 5.3) CWE: CWE-400, CWE-770 KEV (actively exploited): NO Description: Allocation of Resources Without Limits or Throttling vulnerability in Erlang OTP ssh (ssh_sftp modules) allows Excessive Allocation, Resource Leak Exposure. This vulnerability is associated with program files lib/ssh/src/ssh_sftpd.erl. This issue affects OTP from OTP 17.0 until OTP 28.0.3, OTP 27.3.4.3 and 26.2.5.15 corresponding to ssh from 3.0.1 until 5.3.3, 5.2.11.3 and 5.1.4.12.


CVE ID: CVE-2025-48038 Severity: MEDIUM (CVSS 5.3) CWE: CWE-400, CWE-770 KEV (actively exploited): NO Description: Allocation of Resources Without Limits or Throttling vulnerability in Erlang OTP ssh (ssh_sftp modules) allows Excessive Allocation, Resource Leak Exposure. This vulnerability is associated with program files lib/ssh/src/ssh_sftpd.erl. This issue affects OTP from OTP 17.0 until OTP 28.0.3, OTP 27.3.4.3 and 26.2.5.15 corresponding to ssh from 3.0.1 until 5.3.3, 5.2.11.3 and 5.1.4.12.


CVE ID: CVE-2024-6699 Severity: CRITICAL (CVSS 9.3) CWE: CWE-89 Affected: cpe:2.3:h:mikafon:ma7:-:*:*:*:*:*:*:*, cpe:2.3:o:mikafon:ma7_firmware:*:*:*:*:*:*:*:* KEV (actively exploited): NO Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Mikafon Electronic Inc. Mikafon MA7 allows SQL Injection. This issue affects Mikafon MA7: from v3.0 before v3.1.


CVE ID: CVE-2024-1662 Severity: HIGH (CVSS 7.5) CWE: CWE-306, CWE-862 Affected: cpe:2.3:a:porty:powerbank:*:*:*:*:*:*:*:* KEV (actively exploited): NO Description: Missing Authentication for Critical Function, Missing Authorization vulnerability in PORTY Smart Tech Technology Joint Stock Company PowerBank Application allows Retrieve Embedded Sensitive Data. This issue affects PowerBank Application: before 2.02.


CVE ID: CVE-2026-35212 Severity: MEDIUM (CVSS 5.3) CWE: CWE-79 Affected: cpe:2.3:a:citeum:opencti:*:*:*:*:*:*:*:* KEV (actively exploited): NO Description: OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Versions prior to 7.260227.0 are vulnerable to XSS in the rendering of email-message observable body data. The content of the body field isn't appropriately sanitized when being rendered. Does require user interaction but could be exploited by someone sharing stix or any of the ingester. This could lead to CSRF and then large scale session theft. Version 7.260227.0 contains a fix.


CVE ID: CVE-2026-35193 Severity: LOW (CVSS 2.3) CWE: CWE-524 Affected: cpe:2.3:a:djangoproject:django:*:*:*:*:*:*:*:* KEV (actively exploited): NO Description: An issue was discovered in Django 5.2 before 5.2.15 and 6.0 before 6.0.6. `django.middleware.cache.UpdateCacheMiddleware` in Django does not add `Authorization` to the `Vary` response header for requests bearing that header without `Cache-Control: public`, which allows remote attackers to read private cached responses via unauthenticated requests to the same URL. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Shai Berger for reporting this issue.


CVE ID: CVE-2026-48587 Severity: LOW (CVSS 2.3) CWE: CWE-1023 Affected: cpe:2.3:a:djangoproject:django:*:*:*:*:*:*:*:* KEV (actively exploited): NO Description: An issue was discovered in Django 5.2 before 5.2.15 and 6.0 before 6.0.6. `django.utils.cache.has_vary_header()` in Django does not strip leading or trailing whitespace from `Vary` response header values before comparison, which allows remote attackers to read cached responses via requests to URLs whose responses contain whitespace-padded Vary header values. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Navid Rezazadeh for reporting this issue.


CVE ID: CVE-2026-6873 Severity: LOW (CVSS 2.3) CWE: CWE-347 Affected: cpe:2.3:a:djangoproject:django:*:*:*:*:*:*:*:* KEV (actively exploited): NO Description: An issue was discovered in Django 6.0 before 6.0.6 and 5.2 before 5.2.15. `django.http.HttpRequest.get_signed_cookie` in Django uses a non-injective salt derivation (concatenating the cookie name and salt argument), which allows a remote attacker to use a cookie in a context different from the one where it was signed, via distinct `(name, salt)` pairs that produce the same concatenation. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Peng Zhou for reporting this issue.


CVE ID: CVE-2026-20025 Severity: MEDIUM (CVSS 6.8) CWE: CWE-190 Affected: cpe:2.3:a:cisco:firepower_threat_defense_software:*:*:*:*:*:*:*:*, cpe:2.3:o:cisco:adaptive_security_appliance_software:*:*:*:*:*:*:*:* KEV (actively exploited): NO Description: A vulnerability in the OSPF protocol of Cisco Secure Firewall ASA Software and Cisco Secure FTD Software could allow an authenticated, adjacent attacker to cause an affected device to reload unexpectedly, resulting in a DoS condition. To exploit this vulnerability, the attacker must have the OSPF secret key. This vulnerability is due to insufficient input validation when processing OSPF link-state update (LSU) packets. An attacker could exploit this vulnerability by sending crafted OSPF LSU packets. A successful exploit could allow the attacker to corrupt the heap, causing the device to reload, resulting in a DoS condition.


CVE ID: CVE-2026-20016 Severity: MEDIUM (CVSS 6.7) CWE: CWE-88 Affected: cpe:2.3:a:cisco:firepower_threat_defense_software:*:*:*:*:*:*:*:*, cpe:2.3:o:cisco:adaptive_security_appliance_software:*:*:*:*:*:*:*:* KEV (actively exploited): NO Description: A vulnerability in the Cisco FXOS Software CLI feature for Cisco Secure Firewall ASA Software and Secure FTD Software could allow an authenticated, local attacker to execute arbitrary commands on the underlying operating system with root-level privileges. To exploit this vulnerability, the attacker must have valid administrative credentials on an affected device. This vulnerability is due to insufficient input validation of user-supplied command arguments. An attacker could exploit this vulnerability by submitting crafted input for specific CLI commands. A successful exploit could allow the attacker to execute commands on the underlying operating system with root-level privileges.


CVE ID: CVE-2026-7666 Severity: LOW (CVSS 2.3) CWE: CWE-319 Affected: cpe:2.3:a:djangoproject:django:*:*:*:*:*:*:*:* KEV (actively exploited): NO Description: An issue was discovered in Django 6.0 before 6.0.6 and 5.2 before 5.2.15. `django.core.mail.backends.smtp.EmailBackend` in Django fails to prevent reuse of a partially-initialized connection after a failed `STARTTLS` handshake when `fail_silently=True`, which allows on-path network attackers to read email content via cleartext interception. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Kasper Dupont for reporting this issue.


CVE ID: CVE-2026-8404 Severity: LOW (CVSS 2.3) CWE: CWE-178 Affected: cpe:2.3:a:djangoproject:django:*:*:*:*:*:*:*:* KEV (actively exploited): NO Description: An issue was discovered in Django 5.2 before 5.2.15 and 6.0 before 6.0.6. `django.middleware.cache.UpdateCacheMiddleware` in Django does not match `Cache-Control` response directives case-insensitively, which allows remote attackers to read responses that were incorrectly cached because their `Cache-Control` directives used uppercase or mixed-case values. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Ahmed Badawe for reporting this issue.


CVE ID: CVE-2026-41054 Severity: HIGH (CVSS 7.8) CWE: CWE-305 KEV (actively exploited): NO Description: In `src/havegecmd.c`, the `socket_handler` function performs a credential check on the abstract UNIX socket (`\0/sys/entropy/haveged`). However, while it detects if the connecting user is not root (`cred.uid != 0`) and prepares a negative acknowledgement (`ASCII_NAK`), it fails to stop execution. The code proceeds to the `switch` statement, allowing any local unprivileged user to execute privileged commands such as `MAGIC_CHROOT`.


CVE ID: CVE-2025-9986 Severity: HIGH (CVSS 8.2) CWE: CWE-497 KEV (actively exploited): NO Description: Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Vadi Corporate Information Systems Ltd. Co. DIGIKENT allows Excavation. This issue affects DIGIKENT: through 13092025.


CVE ID: CVE-2025-9969 Severity: HIGH (CVSS 7.1) CWE: CWE-79 KEV (actively exploited): NO Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Vizly Web Design Real Estate Packages allows Content Spoofing, CAPEC - 593 - Session Hijacking, CAPEC - 591 - Reflected XSS. This issue affects Real Estate Packages: before 5.1.


CVE ID: CVE-2025-9953 Severity: CRITICAL (CVSS 9.8) CWE: CWE-566 KEV (actively exploited): NO Description: Authorization Bypass Through User-Controlled SQL Primary Key vulnerability in DATABASE Software Training Consulting Ltd. Databank Accreditation Software allows SQL Injection. This issue affects Databank Accreditation Software: through 19022026. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.


CVE ID: CVE-2025-9902 Severity: HIGH (CVSS 7.5) CWE: CWE-639 KEV (actively exploited): NO Description: Authorization Bypass Through User-Controlled Key vulnerability in AKIN Software Computer Import Export Industry and Trade Co. Ltd. QRMenu allows Privilege Abuse. This issue affects QRMenu: from 1.05.12 before Version dated 05.09.2025.


CVE ID: CVE-2025-9846 Severity: CRITICAL (CVSS 10.0) CWE: CWE-434 KEV (actively exploited): NO Description: Unrestricted Upload of File with Dangerous Type vulnerability in TalentSys Consulting Information Technology Industry Inc. Inka.Net allows Command Injection. This issue affects Inka.Net: before 6.7.1.


CVE ID: CVE-2025-9798 Severity: HIGH (CVSS 8.9) CWE: CWE-79 KEV (actively exploited): NO Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Netcad Software Inc. Netigma allows Stored XSS. This issue affects Netigma: from 6.3.3 before 6.3.5 V8.


CVE ID: CVE-2025-9588 Severity: CRITICAL (CVSS 9.8) CWE: CWE-78 Affected: cpe:2.3:a:ironmountain:envision:*:*:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:* KEV (actively exploited): NO Description: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Iron Mountain Archiving Services Inc. EnVision allows Command Injection. This issue affects enVision: before 250563.


CVE ID: CVE-2025-9342 Severity: MEDIUM (CVSS 6.5) CWE: CWE-639 KEV (actively exploited): NO Description: Authorization Bypass Through User-Controlled Key vulnerability in Anadolu Hayat Emeklilik Inc. AHE Mobile allows Privilege Abuse. This issue affects AHE Mobile: from 1.9.7 before 1.9.9.


CVE ID: CVE-2025-9062 Severity: HIGH (CVSS 7.3) CWE: CWE-639 KEV (actively exploited): NO Description: Authorization Bypass Through User-Controlled Key vulnerability in MeCODE Informatics and Engineering Services Ltd. Envanty allows Parameter Injection. This issue affects Envanty: before 1.0.6. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. The vulnerability was learned to be remediated through reporter information and testing.


CVE ID: CVE-2025-9035 Severity: MEDIUM (CVSS 5.4) CWE: CWE-79 KEV (actively exploited): NO Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Horato Internet Technologies Ind. And Trade Inc. Virtual Library Platform allows Reflected XSS. This issue affects Virtual Library Platform: before v202.


CVE ID: CVE-2025-9031 Severity: MEDIUM (CVSS 4.3) CWE: CWE-203, CWE-208 KEV (actively exploited): NO Description: Observable Timing Discrepancy vulnerability in DivvyDrive Information Technologies Inc. DivvyDrive Web allows Cross-Domain Search Timing. This issue affects DivvyDrive Web: from 4.8.2.2 before 4.8.2.15.


CVE ID: CVE-2025-8887 Severity: MEDIUM (CVSS 6.1) CWE: CWE-200, CWE-639, CWE-862 KEV (actively exploited): NO Description: Authorization Bypass Through User-Controlled Key, Missing Authorization, Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Usta Information Systems Inc. Aybs Interaktif allows Forceful Browsing, Parameter Injection, Input Data Manipulation. This issue affects Aybs Interaktif: from 2024 through 28082025.


CVE ID: CVE-2025-8886 Severity: MEDIUM (CVSS 6.7) CWE: CWE-200, CWE-732, CWE-862, CWE-863 KEV (actively exploited): NO Description: Incorrect Permission Assignment for Critical Resource, Exposure of Sensitive Information to an Unauthorized Actor, Missing Authorization, Incorrect Authorization vulnerability in Usta Information Systems Inc. Aybs Interaktif allows Privilege Abuse, Authentication Bypass. This issue affects Aybs Interaktif: from 2024 through 28082025.


CVE ID: CVE-2025-8884 Severity: MEDIUM (CVSS 5.5) CWE: CWE-639 KEV (actively exploited): NO Description: Authorization Bypass Through User-Controlled Key vulnerability in VHS Electronic Software Ltd. Co. ACE Center allows Privilege Abuse, Exploitation of Trusted Identifiers. This issue affects ACE Center: from 3.10.100.1768 before 3.10.161.2255.


CVE ID: CVE-2025-8855 Severity: HIGH (CVSS 8.1) CWE: CWE-302, CWE-639, CWE-640 KEV (actively exploited): NO Description: Authorization Bypass Through User-Controlled Key, Weak Password Recovery Mechanism for Forgotten Password, Authentication Bypass by Assumed-Immutable Data vulnerability in Optimus Software Brokerage Automation allows Exploiting Trust in Client, Authentication Bypass, Manipulate Registry Information. This issue affects Brokerage Automation: before 1.1.71.


CVE ID: CVE-2025-8695 Severity: MEDIUM (CVSS 5.4) CWE: CWE-79 KEV (actively exploited): NO Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Netcad NetGIS Server allows Reflected XSS. This issue affects NetGIS Server: from 5.2.4 through 22.08.2025.


CVE ID: CVE-2025-8668 Severity: CRITICAL (CVSS 9.4) CWE: CWE-79 KEV (actively exploited): NO Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in E-Kalite Software Hardware Engineering Design and Internet Services Industry and Trade Ltd. Co. Turboard allows Reflected XSS. This issue affects Turboard: from 2025.07 before 2026.02. NOTE: This CVE record updated after the vendor implemented mitigations.


CVE ID: CVE-2025-8664 Severity: MEDIUM (CVSS 6.3) CWE: CWE-79 KEV (actively exploited): NO Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Saysis Computer Systems Trade Ltd. Co. StarCities E-Municipality Management allows Cross-Site Scripting (XSS). This issue affects StarCities E-Municipality Management: before 20250825.


CVE ID: CVE-2025-8590 Severity: HIGH (CVSS 7.5) CWE: CWE-200 KEV (actively exploited): NO Description: Exposure of Sensitive Information to an Unauthorized Actor vulnerability in AKCE Software Technology R&D Industry and Trade Inc. SKSPro allows Directory Indexing. This issue affects SKSPro: through 07012026.


CVE ID: CVE-2025-8589 Severity: HIGH (CVSS 7.6) CWE: CWE-79 KEV (actively exploited): NO Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in AKCE Software Technology R&D Industry and Trade Inc. SKSPro allows Reflected XSS. This issue affects SKSPro: through 07012026.


CVE ID: CVE-2025-8587 Severity: CRITICAL (CVSS 9.8) CWE: CWE-89 Affected: cpe:2.3:a:akceyazilim:skspro:*:*:*:*:*:*:*:* KEV (actively exploited): NO Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in AKCE Software Technology R&D Industry and Trade Inc. SKSPro allows SQL Injection. This issue affects SKSPro: through 07012026.


CVE ID: CVE-2025-8532 Severity: MEDIUM (CVSS 6.4) CWE: CWE-285, CWE-639 KEV (actively exploited): NO Description: Authorization Bypass Through User-Controlled Key, Improper Authorization vulnerability in Bimser Solution Software Trade Inc. EBA Document and Workflow Management System allows Forceful Browsing. This issue affects eBA Document and Workflow Management System: from 6.7.164 before 6.7.166.


CVE ID: CVE-2025-8463 Severity: MEDIUM (CVSS 5.3) CWE: CWE-639 KEV (actively exploited): NO Description: Authorization Bypass Through User-Controlled Key vulnerability in SecHard Information Technologies SecHard allows Forceful Browsing. This issue affects SecHard: before 3.6.2-20250805.


CVE ID: CVE-2025-8461 Severity: HIGH (CVSS 7.6) CWE: CWE-79 KEV (actively exploited): NO Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Seres Software syWEB allows Reflected XSS. This issue affects syWEB: through 03022026. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.


CVE ID: CVE-2025-8456 Severity: HIGH (CVSS 7.6) CWE: CWE-79 KEV (actively exploited): NO Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Kod8 Software Technologies Trade Ltd. Co. Kod8 Individual and SME Website allows Reflected XSS. This issue affects Kod8 Individual and SME Website: through 03022026. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.


CVE ID: CVE-2025-8411 Severity: HIGH (CVSS 7.1) CWE: CWE-79 KEV (actively exploited): NO Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Dokuzsoft Technology E-Commerce Web Design Product allows XSS Through HTTP Headers. This issue affects E-Commerce Web Design Product: before 11.08.2025.


CVE ID: CVE-2025-8350 Severity: CRITICAL (CVSS 9.8) CWE: CWE-306, CWE-698 KEV (actively exploited): NO Description: Execution After Redirect (EAR), Missing Authentication for Critical Function vulnerability in Inrove Software and Internet Services BiEticaret CMS allows Authentication Bypass, HTTP Response Splitting. This issue affects BiEticaret CMS: from 2.1.13 through 19022026. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.


CVE ID: CVE-2025-8308 Severity: MEDIUM (CVSS 6.3) CWE: CWE-79 KEV (actively exploited): NO Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Key Software Solutions Inc. INFOREX- General Information Management System allows XSS Through HTTP Headers. This issue affects INFOREX- General Information Management System: from 2025 and before through 18022026. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.


CVE ID: CVE-2025-10161 Severity: HIGH (CVSS 7.3) CWE: CWE-307, CWE-602, CWE-807 KEV (actively exploited): NO Description: Improper Restriction of Excessive Authentication Attempts, Client-Side Enforcement of Server-Side Security, Reliance on Untrusted Inputs in a Security Decision vulnerability in Turkguven Software Technologies Inc. Perfektive allows Brute Force, Authentication Bypass, Functionality Bypass. This issue affects Perfektive: before Version: 12574 Build: 2701.


CVE ID: CVE-2025-10024 Severity: HIGH (CVSS 7.5) CWE: CWE-639 KEV (actively exploited): NO Description: Authorization Bypass Through User-Controlled Key vulnerability in EXERT Computer Technologies Software Ltd. Co. Education Management System allows Parameter Injection. This issue affects Education Management System: through 23.09.2025.


CVE ID: CVE-2019-25737 Severity: MEDIUM (CVSS 5.3) CWE: CWE-79 KEV (actively exploited): NO Description: Live Chat Unlimited 2.8.3 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts through the chat input field. Attackers can submit payloads containing script tags and event handlers that execute in the admin area, enabling cookie theft or forced redirects to malicious websites.


CVE ID: CVE-2019-25731 Severity: MEDIUM (CVSS 5.3) CWE: CWE-79 KEV (actively exploited): NO Description: Zuz Music 2.1 contains a persistent cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious JavaScript by submitting crafted contact form data. Attackers can inject script code through the name, subject, and message parameters in POST requests to /gmusic/zuzconsole/___contact, which executes when administrators view messages in the inbox interface.


CVE ID: CVE-2026-48840 Severity: MEDIUM (CVSS 5.3) CWE: CWE-839 Affected: cpe:2.3:a:exim:exim:*:*:*:*:*:*:*:* KEV (actively exploited): NO Description: Exim 4.88 before 4.99.4, in some proxy configurations, mishandles certain short payloads, leading to disclosure of uninitialized stack memory values to a client.


CVE ID: CVE-2025-10438 Severity: HIGH (CVSS 8.6) CWE: CWE-27 KEV (actively exploited): NO Description: Path Traversal: 'dir/../../filename' vulnerability in Yordam Information Technology Consulting Education and Electrical Systems Industry Trade Inc. Yordam Katalog allows Path Traversal. This issue affects Yordam Katalog: before 21.7.


CVE ID: CVE-2025-10437 Severity: CRITICAL (CVSS 9.8) CWE: CWE-89 KEV (actively exploited): NO Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Eksagate Electronic Engineering and Computer Industry Trade Inc. Webpack Management System allows SQL Injection. This issue affects Webpack Management System: through 20251119.


CVE ID: CVE-2025-10228 Severity: HIGH (CVSS 8.8) CWE: CWE-384 KEV (actively exploited): NO Description: Session Fixation vulnerability in Rolantis Information Technologies Agentis allows Session Hijacking. This issue affects Agentis: before 4.44.


CVE ID: CVE-2025-10174 Severity: HIGH (CVSS 8.3) CWE: CWE-319 KEV (actively exploited): NO Description: Cleartext Transmission of Sensitive Information vulnerability in Pan Software & Information Technologies Ltd. PanCafe Pro allows Flooding. This issue affects PanCafe Pro: from < 3.3.2 through 23092025.


CVE ID: CVE-2025-10855 Severity: HIGH (CVSS 7.5) CWE: CWE-639 KEV (actively exploited): NO Description: Authorization Bypass Through User-Controlled Key vulnerability in Solvera Software Services Trade Inc. Teknoera allows Exploitation of Trusted Identifiers. This issue affects Teknoera: through 01102025.


CVE ID: CVE-2025-10727 Severity: MEDIUM (CVSS 5.4) CWE: CWE-79 KEV (actively exploited): NO Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in ArkSigner Software and Hardware Inc. AcBakImzala allows Reflected XSS. This issue affects AcBakImzala: before v5.1.4.


CVE ID: CVE-2025-10612 Severity: MEDIUM (CVSS 6.1) CWE: CWE-79 KEV (actively exploited): NO Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in giSoft Information Technologies City Guide allows Reflected XSS. This issue affects City Guide: before 1.4.45.


CVE ID: CVE-2025-10610 Severity: CRITICAL (CVSS 9.8) CWE: CWE-89 KEV (actively exploited): NO Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in SFS Consulting Information Processing Industry and Foreign Trade Inc. Winsure allows Blind SQL Injection. This issue affects Winsure: through Version dated 21.08.2025.


CVE ID: CVE-2025-10609 Severity: MEDIUM (CVSS 5.9) CWE: CWE-798 KEV (actively exploited): NO Description: Use of Hard-coded Credentials vulnerability in Logo Software Inc. TigerWings ERP allows Read Sensitive Constants Within an Executable. This issue affects TigerWings ERP: from 01.01.00 before 3.03.00.


CVE ID: CVE-2025-10468 Severity: HIGH (CVSS 7.5) CWE: CWE-22 KEV (actively exploited): NO Description: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Beyaz Computer CityPlus allows Path Traversal. This issue affects CityPlus: before 24.29375.


CVE ID: CVE-2025-10467 Severity: HIGH (CVSS 8.9) CWE: CWE-79 KEV (actively exploited): NO Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in PROLIZ Computer Software Hardware Service Trade Ltd. Co. OBS (Student Affairs Information System) allows Stored XSS. This issue affects OBS (Student Affairs Information System): before v25.0401.


CVE ID: CVE-2025-10465 Severity: HIGH (CVSS 8.8) CWE: CWE-434 KEV (actively exploited): NO Description: Unrestricted Upload of File with Dangerous Type vulnerability in Birtech Information Technologies Industry and Trade Ltd. Co. Sensaway allows Upload a Web Shell to a Web Server. This issue affects Sensaway: through 09022026. NOTE: Because the product was developed using outdated technology, the manufacturer is unable to fix the relevant vulnerabilities. Users of the Sensaway application are advised to contact the manufacturer and review updated products developed with newer technology.


CVE ID: CVE-2025-10464 Severity: MEDIUM (CVSS 6.5) CWE: CWE-312, CWE-922 KEV (actively exploited): NO Description: Insecure Storage of Sensitive Information vulnerability in Birtech Information Technologies Industry and Trade Ltd. Co. Senseway allows Retrieve Embedded Sensitive Data. This issue affects Senseway: through 09022026. NOTE: Because the product was developed using outdated technology, the manufacturer is unable to fix the relevant vulnerabilities. Users of the Sensaway application are advised to contact the manufacturer and review updated products developed with newer technology.


CVE ID: CVE-2025-10463 Severity: HIGH (CVSS 7.3) CWE: CWE-287 KEV (actively exploited): NO Description: Improper Authentication vulnerability in Birtech Information Technologies Industry and Trade Ltd. Co. Senseway allows Authentication Abuse. This issue affects Senseway: through 09022026. NOTE: Because the product was developed using outdated technology, the manufacturer is unable to fix the relevant vulnerabilities. Users of the Sensaway application are advised to contact the manufacturer and review updated products developed with newer technology.


CVE ID: CVE-2025-10449 Severity: HIGH (CVSS 8.6) CWE: CWE-22 KEV (actively exploited): NO Description: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Saysis Computer Systems Trade Ltd. Co. Saysis Web Portal allows Path Traversal. This issue affects Saysis Web Portal: from 3.1.9 & 3.2.0 before 3.2.1.


CVE ID: CVE-2025-10439 Severity: CRITICAL (CVSS 9.8) CWE: CWE-89 KEV (actively exploited): NO Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Yordam Informatics Yordam Library Automation System allows SQL Injection. This issue affects Yordam Library Automation System: from 21.5 & 21.6 before 21.7.


CVE ID: CVE-2026-42250 Severity: MEDIUM (CVSS 4.8) CWE: CWE-787 KEV (actively exploited): NO Description: bzip2 contains an off‑by‑one error in the bzip2recover utility. When processing a specially crafted file, the application performs an out‑of‑bounds write to a global buffer, resulting in memory corruption and a crash (denial of service). This issue was fixed in bzip2 patch 35d122a3df8b0cc4082a4d89fdc6ee99f375fe67


CVE ID: CVE-2025-10969 Severity: CRITICAL (CVSS 9.8) CWE: CWE-89 Affected: cpe:2.3:a:farktor:e-commerce_package:*:*:*:*:*:*:*:* KEV (actively exploited): NO Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Farktor Software E-Commerce Services Inc. E-Commerce Package allows Blind SQL Injection. This issue affects E-Commerce Package: through 27112025.


CVE ID: CVE-2025-10968 Severity: HIGH (CVSS 8.8) CWE: CWE-89 KEV (actively exploited): NO Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'), CWE - 564 - SQL Injection: Hibernate vulnerability in GG Soft Software Services Inc. PaperWork allows Blind SQL Injection, SQL Injection. This issue affects PaperWork: from 6.1.0.9390 before 6.1.0.9398.


CVE ID: CVE-2025-10955 Severity: MEDIUM (CVSS 6.1) CWE: CWE-79 KEV (actively exploited): NO Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Netcad Software Inc. Netigma allows XSS Through HTTP Query Strings. This issue affects Netigma: from 6.3.5 before 6.3.5 V8.


CVE ID: CVE-2025-10914 Severity: HIGH (CVSS 7.6) CWE: CWE-79 KEV (actively exploited): NO Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Proliz Software Ltd. Co. OBS (Student Affairs Information System) allows Reflected XSS. This issue affects OBS (Student Affairs Information System): before V26.0401.


CVE ID: CVE-2025-10913 Severity: HIGH (CVSS 8.3) CWE: CWE-79 KEV (actively exploited): NO Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Saastech Cleaning and Internet Services Inc. TemizlikYolda allows Cross-Site Scripting (XSS). This issue affects TemizlikYolda: through 11022026. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.


CVE ID: CVE-2025-10912 Severity: MEDIUM (CVSS 5.4) CWE: CWE-639 KEV (actively exploited): NO Description: Authorization Bypass Through User-Controlled Key vulnerability in Saastech Cleaning and Internet Services Inc. TemizlikYolda allows Manipulating User-Controlled Variables. This issue affects TemizlikYolda: through 11022026. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.


CVE ID: CVE-2025-10876 Severity: MEDIUM (CVSS 5.3) CWE: CWE-79 KEV (actively exploited): NO Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Talent Software e-BAP Automation allows Cross-Site Scripting (XSS). This issue affects e-BAP Automation: from 1.8.96 before v.41815.


CVE ID: CVE-2025-10856 Severity: HIGH (CVSS 8.1) CWE: CWE-434 KEV (actively exploited): NO Description: Unrestricted Upload of File with Dangerous Type vulnerability in Solvera Software Services Trade Inc. Teknoera allows File Content Injection. This issue affects Teknoera: through 01102025.


CVE ID: CVE-2026-46243 Severity: HIGH (CVSS 7.1) CWE: CWE-20 KEV (actively exploited): NO Description: In the Linux kernel, the following vulnerability has been resolved: smb: client: reject userspace cifs.spnego descriptions cifs.spnego key descriptions contain authority-bearing fields such as pid, uid, creduid, and upcall_target that cifs.upcall treats as kernel-originating inputs. However, userspace can also create keys of this type through request_key(2) or add_key(2), allowing those fields to be supplied without CIFS origin. Only accept cifs.spnego descriptions while CIFS is using its private spnego_cred to request the key.


CVE ID: CVE-2026-46242 Severity: HIGH (CVSS 7.8) KEV (actively exploited): NO Description: In the Linux kernel, the following vulnerability has been resolved: eventpoll: fix ep_remove struct eventpoll / struct file UAF ep_remove() (via ep_remove_file()) cleared file->f_ep under file->f_lock but then kept using @file inside the critical section (is_file_epoll(), hlist_del_rcu() through the head, spin_unlock). A concurrent __fput() taking the eventpoll_release() fastpath in that window observed the transient NULL, skipped eventpoll_release_file() and ran to f_op->release / file_free(). For the epoll-watches-epoll case, f_op->release is ep_eventpoll_release() -> ep_clear_and_put() -> ep_free(), which kfree()s the watched struct eventpoll. Its embedded ->refs hlist_head is exactly where epi->fllink.pprev points, so the subsequent hlist_del_rcu()'s "*pprev = next" scribbles into freed kmalloc-192 memory. In addition, struct file is SLAB_TYPESAFE_BY_RCU, so the slot backing @file could be recycled by alloc_empty_file() -- reinitializing f_lock and f_ep -- while ep_remove() is still nominally inside that lock. The upshot is an attacker-controllable kmem_cache_free() against the wrong slab cache. Pin @file via epi_fget() at the top of ep_remove() and gate the critical section on the pin succeeding. With the pin held @file cannot reach refcount zero, which holds __fput() off and transitively keeps the watched struct eventpoll alive across the hlist_del_rcu() and the f_lock use, closing both UAFs. If the pin fails @file has already reached refcount zero and its __fput() is in flight. Because we bailed before clearing f_ep, that path takes the eventpoll_release() slow path into eventpoll_release_file() and blocks on ep->mtx until the waiter side's ep_clear_and_put() drops it. The bailed epi's share of ep->refcount stays intact, so the trailing ep_refcount_dec_and_test() in ep_clear_and_put() cannot free the eventpoll out from under eventpoll_release_file(); the orphaned epi is then cleaned up there. A successful pin also proves we are not racing eventpoll_release_file() on this epi, so drop the now-redundant re-check of epi->dying under f_lock. The cheap lockless READ_ONCE(epi->dying) fast-path bailout stays.


CVE ID: CVE-2026-45956 Severity: HIGH (CVSS 7.8) KEV (actively exploited): NO Description: In the Linux kernel, the following vulnerability has been resolved: drm/exynos: vidi: use priv->vidi_dev for ctx lookup in vidi_connection_ioctl() vidi_connection_ioctl() retrieves the driver_data from drm_dev->dev to obtain a struct vidi_context pointer. However, drm_dev->dev is the exynos-drm master device, and the driver_data contained therein is not the vidi component device, but a completely different device. This can lead to various bugs, ranging from null pointer dereferences and garbage value accesses to, in unlucky cases, out-of-bounds errors, use-after-free errors, and more. To resolve this issue, we need to store/delete the vidi device pointer in exynos_drm_private->vidi_dev during bind/unbind, and then read this exynos_drm_private->vidi_dev within ioctl() to obtain the correct struct vidi_context pointer.


CVE ID: CVE-2026-45955 Severity: HIGH (CVSS 7.1) KEV (actively exploited): NO Description: In the Linux kernel, the following vulnerability has been resolved: md/md-llbitmap: fix percpu_ref not resurrected on suspend timeout When llbitmap_suspend_timeout() times out waiting for percpu_ref to become zero, it returns -ETIMEDOUT without resurrecting the percpu_ref. The caller (md_llbitmap_daemon_fn) then continues to the next page without calling llbitmap_resume(), leaving the percpu_ref in a killed state permanently. Fix this by resurrecting the percpu_ref before returning the error, ensuring the page control structure remains usable for subsequent operations.


CVE ID: CVE-2025-11022 Severity: CRITICAL (CVSS 9.6) CWE: CWE-352 KEV (actively exploited): NO Description: Cross-Site Request Forgery (CSRF) vulnerability in Personal Project Panilux allows Cross Site Request Forgery. This CSRF vulnerability resulting in Command Injection has been identified. This issue affects Panilux: before v.0.10.0. NOTE: The vendor was contacted and responded that they deny ownership of the mentioned product.


CVE ID: CVE-2025-10970 Severity: CRITICAL (CVSS 9.8) CWE: CWE-89 KEV (actively exploited): NO Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Kolay Software Inc. Talentics allows Blind SQL Injection. This issue affects Talentics: through 20022026. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.


CVE ID: CVE-2025-62338 Severity: LOW (CVSS 3.3) KEV (actively exploited): NO Description: HCL BigFix Cloud Lifecycle Management is affected by lack of input validation. This low-level flaw allows unauthorized access and may lead to information exposure.


CVE ID: CVE-2018-1002206 Severity: MEDIUM (CVSS 5.5) CWE: CWE-22 Affected: cpe:2.3:a:adamhathcock:sharpcompress:*:*:*:*:*:*:*:* KEV (actively exploited): NO Description: SharpCompress before 0.21.0 is vulnerable to directory traversal, allowing attackers to write to arbitrary files via a ../ (dot dot slash) in a Zip archive entry that is mishandled during extraction. This vulnerability is also known as 'Zip-Slip'.


CVE ID: CVE-2026-37700 Severity: MEDIUM (CVSS 4.1) CWE: CWE-79 KEV (actively exploited): NO Description: Cross Site Scripting vulnerability in MaxSite CMS v.109.2 allows a remote attacker to obtain sensitive information via the Backend page file upload endpoint used by admin_page


CVE ID: CVE-2026-36603 Severity: HIGH (CVSS 8.1) CWE: CWE-306 KEV (actively exploited): NO Description: Mercusys AC12G (EU) V1 router with firmware AC12G(EU)_V1_200909 exposes 15 of 18 UPnP IGD actions without authentication on port 1900, including AddPortMapping and GetExternalIPAddress. UPnP is enabled by default through the admin interface, allowing any unauthenticated LAN device to create arbitrary port forwarding rules and access WAN traffic statistics.


CVE ID: CVE-2026-36602 Severity: MEDIUM (CVSS 4.3) CWE: CWE-200 KEV (actively exploited): NO Description: Mercusys AC12G (EU) V1 router with firmware AC12G(EU)_V1_200909 discloses kernel memory layout via the UPnP GetStatusInfo action. An unauthenticated attacker on the adjacent network can obtain a raw MIPS KSEG0 kernel pointer, revealing kernel memory layout and aiding further exploitation.


CVE ID: CVE-2026-34003 Severity: HIGH (CVSS 7.8) CWE: CWE-125 KEV (actively exploited): NO Description: A flaw was found in the X.Org X server's XKB key types request validation. A local attacker could send a specially crafted request to the X server, leading to an out-of-bounds memory access vulnerability. This could result in the disclosure of sensitive information or cause the server to crash, leading to a Denial of Service (DoS). In certain configurations, higher impact outcomes may be possible.


CVE ID: CVE-2026-34002 Severity: CRITICAL (CVSS 9.1) CWE: CWE-805 Affected: cpe:2.3:a:x.org:x_server:-:*:*:*:*:*:*:*, cpe:2.3:o:redhat:enterprise_linux:10.0:*:*:*:*:*:*:*, cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:*, cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*, cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:* KEV (actively exploited): NO Description: A flaw was found in the X.Org X server. This vulnerability, an out-of-bounds read, affects the XKB (X Keyboard Extension) modifier map handling. An attacker with access to the X11 server can exploit this by sending a malformed request, which causes the server to read beyond its intended memory boundaries. This can lead to the exposure of sensitive information or cause the server to crash, resulting in a denial of service.


CVE ID: CVE-2026-34001 Severity: HIGH (CVSS 7.8) CWE: CWE-825 KEV (actively exploited): NO Description: A flaw was found in the X.Org X server. This use-after-free vulnerability occurs in the XSYNC fence triggering logic, specifically within the miSyncTriggerFence() function. An attacker with access to the X11 server can exploit this without user interaction, leading to a server crash and potentially enabling memory corruption. This could result in a denial of service or further compromise of the system.


CVE ID: CVE-2026-34000 Severity: CRITICAL (CVSS 9.1) CWE: CWE-125 Affected: cpe:2.3:a:x.org:x_server:-:*:*:*:*:*:*:*, cpe:2.3:o:redhat:enterprise_linux:10.0:*:*:*:*:*:*:*, cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:*, cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*, cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:* KEV (actively exploited): NO Description: A flaw was found in the X.Org X server. This out-of-bounds read vulnerability in the XKB geometry processing, specifically within the `CheckSetGeom()` and `XkbAddGeomKeyAlias` functions, allows an attacker to read uninitialized or out-of-bounds memory. An attacker with a connection to the X11 server, either locally or remotely, can exploit this without user interaction. This could lead to the disclosure of memory contents or cause a denial of service by crashing the server.


CVE ID: CVE-2026-33999 Severity: HIGH (CVSS 7.8) CWE: CWE-191 KEV (actively exploited): NO Description: A flaw was found in the X.Org X server. This integer underflow vulnerability, specifically in the XKB compatibility map handling, allows an attacker with local or remote X11 server access to trigger a buffer read overrun. This can lead to memory-safety violations and potentially a denial of service (DoS) or other severe impacts.


CVE ID: CVE-2026-10022 Severity: HIGH (CVSS 7.5) CWE: CWE-843 Affected: cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*, cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* KEV (actively exploited): NO Description: Type Confusion in V8 in Google Chrome prior to 148.0.7778.216 allowed an attacker who convinced a user to install a malicious extension to execute arbitrary code inside a sandbox via a crafted Chrome Extension. (Chromium security severity: Medium)


CVE ID: CVE-2025-71273 Severity: MEDIUM (CVSS 5.5) CWE: CWE-401 Affected: cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* KEV (actively exploited): NO Description: In the Linux kernel, the following vulnerability has been resolved: wifi: rtw88: Use devm_kmemdup() in rtw_set_supported_band() Simplify the code by using device managed memory allocations. This also fixes a memory leak in rtw_register_hw(). The supported bands were not freed in the error path. Copied from commit 145df52a8671 ("wifi: rtw89: Convert rtw89_core_set_supported_band to use devm_*").


CVE ID: CVE-2026-41308 Severity: MEDIUM (CVSS 6.5) CWE: CWE-288 Affected: cpe:2.3:a:apnotic:password_pusher:*:*:*:*:*:*:*:* KEV (actively exploited): NO Description: Password Pusher is an open source application to communicate sensitive information over the web. Prior to versions 1.69.3 and 2.4.2, a security issue in OSS PasswordPusher allowed unauthenticated creation of file-type pushes through a generic JSON API create path under certain configurations. This could bypass the intended authentication boundary for file push creation. This issue has been patched in versions 1.69.3 and 2.4.2.


CVE ID: CVE-2024-7593 Severity: CRITICAL (CVSS 9.8) CWE: CWE-287, CWE-303 Affected: cpe:2.3:a:ivanti:virtual_traffic_manager:22.2:*:*:*:*:*:*:*, cpe:2.3:a:ivanti:virtual_traffic_manager:22.3:-:*:*:*:*:*:*, cpe:2.3:a:ivanti:virtual_traffic_manager:22.3:r2:*:*:*:*:*:*, cpe:2.3:a:ivanti:virtual_traffic_manager:22.5:r1:*:*:*:*:*:*, cpe:2.3:a:ivanti:virtual_traffic_manager:22.6:r1:*:*:*:*:*:* KEV (actively exploited): YES Description: Incorrect implementation of an authentication algorithm in Ivanti vTM other than versions 22.2R1 or 22.7R2 allows a remote unauthenticated attacker to bypass authentication of the admin panel. Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.


CVE ID: CVE-2026-3087 Severity: MEDIUM (CVSS 6.0) CWE: CWE-22 Affected: cpe:2.3:a:python:python:*:*:*:*:*:*:*:*, cpe:2.3:a:python:python:3.15.0:alpha1:*:*:*:*:*:*, cpe:2.3:a:python:python:3.15.0:alpha2:*:*:*:*:*:*, cpe:2.3:a:python:python:3.15.0:alpha3:*:*:*:*:*:*, cpe:2.3:a:python:python:3.15.0:alpha4:*:*:*:*:*:* KEV (actively exploited): NO Description: If `shutil.unpack_archive()` is given a ZIP archive with an absolute Windows path containing a drive (`C:\\...`) then the archive will be extracted outside the target directory which is different than other operating systems. Only Windows is affected by this vulnerability.


CVE ID: CVE-2026-43084 Severity: HIGH (CVSS 7.8) CWE: CWE-416 Affected: cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* KEV (actively exploited): NO Description: In the Linux kernel, the following vulnerability has been resolved: netfilter: nfnetlink_queue: make hash table per queue Sharing a global hash table among all queues is tempting, but it can cause crash: BUG: KASAN: slab-use-after-free in nfqnl_recv_verdict+0x11ac/0x15e0 [nfnetlink_queue] [..] nfqnl_recv_verdict+0x11ac/0x15e0 [nfnetlink_queue] nfnetlink_rcv_msg+0x46a/0x930 kmem_cache_alloc_node_noprof+0x11e/0x450 struct nf_queue_entry is freed via kfree, but parallel cpu can still encounter such an nf_queue_entry when walking the list. Alternative fix is to free the nf_queue_entry via kfree_rcu() instead, but as we have to alloc/free for each skb this will cause more mem pressure.


CVE ID: CVE-2024-0193 Severity: MEDIUM (CVSS 6.7) CWE: CWE-416 Affected: cpe:2.3:a:redhat:codeready_linux_builder:9.0:*:*:*:*:*:aarch64:*, cpe:2.3:a:redhat:codeready_linux_builder_for_eus:9.2:*:*:*:*:*:x64:*, cpe:2.3:a:redhat:codeready_linux_builder_for_eus:9.4:*:*:*:*:*:arm64:*, cpe:2.3:a:redhat:codeready_linux_builder_for_eus:9.4:*:*:*:*:*:x64:*, cpe:2.3:a:redhat:codeready_linux_builder_for_eus:9.6:*:*:*:*:*:arm64:* KEV (actively exploited): NO Description: A use-after-free flaw was found in the netfilter subsystem of the Linux kernel. If the catchall element is garbage-collected when the pipapo set is removed, the element can be deactivated twice. This can cause a use-after-free issue on an NFT_CHAIN object or NFT_OBJECT object, allowing a local unprivileged user with CAP_NET_ADMIN capability to escalate their privileges on the system.


CVE ID: CVE-2026-7251 Severity: CRITICAL (CVSS 9.3) CWE: CWE-259 KEV (actively exploited): NO Description: Eppendorf BioFlo 320 is vulnerable due to VNC server using a hard-coded password. If a remote attacker knows the network address of any BioFlo 320 model with remote access enabled, they can gain full control of the user interface by using this password. Once connected, the attacker would have full access to all control panel features for the BioFlo 320. VNC traffic is not encrypted.


CVE ID: CVE-2026-6074 Severity: CRITICAL (CVSS 9.3) CWE: CWE-35 KEV (actively exploited): NO Description: Intrado 911 Emergency Gateway (EGW) 5.x, 6.x, and 7.x contain a path traversal vulnerability in the download_debuglog_file.php endpoint used for Debug Logs downloads. An unauthenticated attacker can manipulate the name parameter to read arbitrary files outside the intended directory.


CVE ID: CVE-2026-25109 Severity: HIGH (CVSS 8.8) CWE: CWE-78 Affected: cpe:2.3:h:copeland:xweb_300d_pro:-:*:*:*:*:*:*:*, cpe:2.3:h:copeland:xweb_500b_pro:-:*:*:*:*:*:*:*, cpe:2.3:h:copeland:xweb_500d_pro:-:*:*:*:*:*:*:*, cpe:2.3:o:copeland:xweb_300d_pro_firmware:*:*:*:*:*:*:*:*, cpe:2.3:o:copeland:xweb_500b_pro_firmware:*:*:*:*:*:*:*:* KEV (actively exploited): NO Description: An OS command injection vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an authenticated attacker to achieve remote code execution on the system by injecting malicious input into the devices field when accessing the get setup route.


CVE ID: CVE-2026-20910 Severity: HIGH (CVSS 8.8) CWE: CWE-78 Affected: cpe:2.3:h:copeland:xweb_300d_pro:-:*:*:*:*:*:*:*, cpe:2.3:h:copeland:xweb_500b_pro:-:*:*:*:*:*:*:*, cpe:2.3:h:copeland:xweb_500d_pro:-:*:*:*:*:*:*:*, cpe:2.3:o:copeland:xweb_300d_pro_firmware:*:*:*:*:*:*:*:*, cpe:2.3:o:copeland:xweb_500b_pro_firmware:*:*:*:*:*:*:*:* KEV (actively exploited): NO Description: An OS command injection vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an authenticated attacker to achieve remote code execution on the system by injecting malicious input into the devices field of the firmware update action to achieve remote code execution.


CVE ID: CVE-2017-6034 Severity: CRITICAL (CVSS 9.8) CWE: CWE-287, CWE-294 Affected: cpe:2.3:h:schneider-electric:modbus:-:*:*:*:*:*:*:*, cpe:2.3:o:schneider-electric:modbus_firmware:-:*:*:*:*:*:*:* KEV (actively exploited): NO Description: An authentication bypass by capture-replay issue was discovered in Schneider Electric Modicon Modbus Protocol. Sensitive information is transmitted in cleartext in the Modicon Modbus protocol, which may allow an attacker to replay the following commands: run, stop, upload, and download.


CVE ID: CVE-2017-6030 Severity: MEDIUM (CVSS 6.5) CWE: CWE-331, CWE-343 Affected: cpe:2.3:h:schneider-electric:modicon_m221:-:*:*:*:*:*:*:*, cpe:2.3:h:schneider-electric:modicon_m241:-:*:*:*:*:*:*:*, cpe:2.3:h:schneider-electric:modicon_m251:-:*:*:*:*:*:*:*, cpe:2.3:o:schneider-electric:modicon_m221_firmware:*:*:*:*:*:*:*:*, cpe:2.3:o:schneider-electric:modicon_m241_firmware:*:*:*:*:*:*:*:* KEV (actively exploited): NO Description: A predictable value range from previous values issue was discovered in Schneider Electric Modicon PLCs Modicon M221, firmware versions prior to Version 1.5.0.0, Modicon M241, firmware versions prior to Version 4.0.5.11, and Modicon M251, firmware versions prior to Version 4.0.5.11. The affected products generate insufficiently random TCP initial sequence numbers that may allow an attacker to predict the numbers from previous values. This may allow an attacker to spoof or disrupt TCP connections.


CVE: CVE-2026-43073 Severity: MEDIUM (CVSS 5.5) Software: Linux Linux Kernel Exploit available: NO KEV: NO In the Linux kernel, the following vulnerability has been resolved: x86-64: rename misleadingly named '__copy_user_nocache()' function This function was a masterclass in bad naming, for various historical reasons. It claimed to be a non-cached user copy. It is literally _neither_ of those things. It's a specialty memory copy routine that uses non-temporal stores for the destination (but not the source), and that does exception handling for both source and destination accesses. Also note that while it works for unaligned targets, any unaligned parts (whether at beginning or end) will not use non-temporal stores, since only words and quadwords can be non-temporal on x86. The exception handling means that it _can_ be used for user space accesses, but not on its own - it needs all the normal "start user space access" logic around it. But typically the user space access would be the source, not the non-temporal destination. That was the original intention of this, where the destination was some fragile persistent memory target that needed non-temporal stores in order to catch machine check exceptions synchronously and deal with them gracefully. Thus that non-descriptive name: one use case was to copy from user space into a non-cached kernel buffer. However, the existing users are a mix of that intended use-case, and a couple of random drivers that just did this as a performance tweak. Some of those random drivers then actively misused the user copying version (with STAC/CLAC and all) to do kernel copies without ever even caring about the exception handling, _just_ for the non-temporal destination. Rename it as a first small step to actually make it halfway sane, and change the prototype to be more normal: it doesn't take a user pointer unless the caller has done the proper conversion, and the argument size is the full size_t (it still won't actually copy more than 4GB in one go, but there's also no reason to silently truncate the size argument in the caller). Finally, use this now sanely named function in the NTB code, which mis-used a user copy version (with STAC/CLAC and all) of this interface despite it not actually being a user copy at all.