Tagged “cve.org”
CVEs tagged cve.org, newest first.
46495 CVEsRSS
CVE-2026-20564Medium· 6.2In Modem, there is a possible out of bounds write due to an incorrect bounds check
In Modem, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOL…
CVE-2026-20580Medium· 4.4In usb, there is a possible system crash due to use after free
In usb, there is a possible system crash due to use after free. This could lead to local denial of service if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS114…
CVE-2026-20583Medium· 4.4In usb, there is a possible system crash due to use after free
In usb, there is a possible system crash due to use after free. This could lead to local denial of service if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS114…
CVE-2026-20577Medium· 4.4In Modem, there is a possible permission bypass due to a permissions bypass
In Modem, there is a possible permission bypass due to a permissions bypass. This could lead to local denial of service if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patc…
CVE-2026-20590Medium· 4.4In display, there is a possible system crash due to a logic error
In display, there is a possible system crash due to a logic error. This could lead to local denial of service if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS…
CVE-2026-118052Medium· 6.8Module Manager loaders leave the manager mutex held when a module preamble's sizes overflow, blocking every later module operation
In Eclipse ThreadX versions 6.0.1 through 6.5.2.202603, the Module Manager loaders return an overflow error without releasing the Module Manager mutex when a module preamble declares a data or stack size that overflows the allocation ari…
CVE-2026-74993High· 7.5SQL Injection in Starnet Computer Systems' Inventory Tracking Application
Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Starnet Computer and Network Systems Inventory Tracking Application allows SQL Injection. This issue affects Inventory Tracking Applic…
CVE-2026-115653High· 7.0Cortex-M module ports save a preempted user-mode module thread's registers through its unchecked stack pointer in privileged mode
In Eclipse ThreadX versions 6.0.1 through 6.5.2.202603, the PendSV handler of the Cortex-M module ports saves a preempted user-mode module thread's registers in privileged mode at addresses taken from the thread's stack pointer, without …
CVE-2026-115654Medium· 6.9User-mode module can suspend, terminate, re-prioritise and abort the waits of threads it does not own
In Eclipse ThreadX versions 6.0.1 through 6.5.2.202603, the Module Manager's thread-control services do not check that a thread passed by a user-mode, memory-protected module belongs to that module. Any loaded module can suspend, resume,…
CVE-2026-106807NoneA denial-of-service vulnerability exists in open5GS v2.8.0 in the PFCP transaction handling path
A denial-of-service vulnerability exists in open5GS v2.8.0 in the PFCP transaction handling path. When the PFCP transaction or timer resource pool is exhausted, ogs_pfcp_xact_remote_create() returns NULL, but the failure is not handled p…
CVE-2026-2102Medium· 6.1XSS in wrensec-commons CREST framework HTTP binding via _mimeType parameter
wrensec-commons contains a reflected cross-site scripting (XSS) vulnerability in the CREST framework's HTTP binding. The HttpUtils.prepareResponse() method used the _mimeType request parameter to set the Content-Type response header with…
CVE-2026-109140High· 8.4Krill login-session tokens reuse their encryption nonce across restarts, so any user who can log in can forge an "admin" token
The vulnerability is that Krill encrypts every login-session token with a nonce built from a counter that is reset to 0 on every Krill restart, so the same (key, nonce) pair is used again after each restart.
CVE-2026-109142High· 8.4Krill treats a "local parent" as already-authenticated, letting a CA operator act as any child of any CA on the same server
When a CA's parent lives on the same Krill server: instead of building and verifying a signed CMS message, it runs the RFC 6492 provisioning exchange in-process and trusts the child identity (child_handle) that the caller put in the pare…
CVE-2026-109141High· 8.4Krill users restricted to one CA can make any other CA delegate its prefixes and publish ROAs for them via bulk import
The vulnerability gives a role that is restricted to a list of CAs (cas = [...]) its full permission set for every request that is not tied to a CA, including the bulk import endpoint POST /api/v1/bulk/cas/import. It adds a new child CA …
CVE-2026-99242Nonentfs: fix race between fallocate and mmap reads
In the Linux kernel, the following vulnerability has been resolved: ntfs: fix race between fallocate and mmap reads The fallocate implementation only takes invalidate_lock for punch hole, collapse range, and insert range operations. Fo…
CVE-2026-99241Nonentfs: take invalidate_lock in ntfs_filemap_page_mkwrite()
In the Linux kernel, the following vulnerability has been resolved: ntfs: take invalidate_lock in ntfs_filemap_page_mkwrite() ntfs_filemap_page_mkwrite() calls iomap_page_mkwrite() without holding mapping->invalidate_lock, so a concurr…
CVE-2026-120433High· 7.8Netpbm before 10.86.51, 11.02.30, and 11.15.08 picttoppm Stack Buffer Overflow via paintPoly
Netpbm before 10.86.51, 11.x before 11.02.30, and 11.03 before 11.15.08 contains a stack-based buffer overflow in the picttoppm paintPoly() function due to an unbounded polygon point count. Attackers can supply a crafted PICT file with a…
CVE-2026-120500Medium· 6.1An Otter Wiki before 2.26.2 Stored XSS via Math Code Block
An Otter Wiki before 2.26.2 contains a stored cross-site scripting vulnerability in OtterwikiMdRenderer.block_code that allows attackers who can edit pages, including anonymous users under the default configuration, to inject arbitrary s…
CVE-2026-120437Medium· 6.1Netpbm before 10.86.51, 11.02.30, and 11.15.08 Out-of-Bounds Read via tgatoppm
Netpbm before 10.86.51, 11.x before 11.02.30, and 11.03 before 11.15.08 contains an out-of-bounds read vulnerability in the tgatoppm converter's get_pixel() function that uses unchecked pixel values as color map indexes. Attackers can su…
CVE-2026-120441Medium· 5.3OwnTone Server through 29.3 SQL Injection via MPD sticker find Command
OwnTone Server through 29.3 contains an sql injection vulnerability in mpd_sticker_find() in src/mpd.c that allows unauthenticated remote attackers to inject SQL via the URI argument. Attackers can send a crafted 'sticker find song' comm…
CVE-2026-120429High· 7.1Camaleon CMS before 2.9.2 Missing Authorization via Admin::MediaController
Camaleon CMS before 2.9.2 contains a missing authorization vulnerability in Admin::MediaController that allows low-privileged authenticated users to bypass the role-based Media permission. Attackers can POST to /admin/media/upload to sto…
CVE-2026-120445High· 8.8madong-admin-saas through 5.1.4 Incorrect Authorization via /platformapi AccessTokenMiddleware
madong-admin-saas through 5.1.4 contains an incorrect authorization vulnerability in AccessTokenMiddleware that allows authenticated tenant users to access the platform management API in multi-tenant mode. Attackers can reuse a tenant lo…
CVE-2026-120425Medium· 6.5PoCChatify before 1.6.4 Pusher Authorization Bypass via /chat/auth Endpoint
Chatify before 1.6.4 contains an authorization bypass vulnerability in the Pusher channel authorization endpoint that allows authenticated users to subscribe to other users' private channels by supplying arbitrary channel names. Attacker…
CVE-2026-120491Medium· 5.4PoCWing FTP Server before 8.2.6 Stored XSS via nowpath in Legacy Activity Page
Wing FTP Server before 8.2.6 contains a stored cross-site scripting vulnerability that allows authenticated web-client users to inject script by sending a crafted nowpath parameter to webclient/makethumb.html. Attackers can break out of …
CVE-2026-120461High· 8.8Jpom through 2.11.12 Cross-Workspace Authorization Bypass via /node/ssh_command/batch
Jpom through 2.11.12 contains a cross-workspace authorization bypass in POST /node/ssh_command/batch that resolves command templates and SSH nodes by ID without workspace filtering. Authenticated users with SSH command execute permission…
CVE-2026-120457Medium· 5.3PoClibaec through 1.1.7 Out-of-Bounds Read via m_se_decode() Second Extension Decoder
libaec through 1.1.7 contains an out-of-bounds read vulnerability in m_se_decode() in src/decode.c that allows attackers to bypass a signed bounds check via an overlong fundamental sequence. Attackers can supply a crafted CCSDS 121.0/SZI…
CVE-2026-120453Low· 3.3PoCThe Sleuth Kit through 4.15.0 Heap Out-of-Bounds Read via HFS+ decmpfs Header
The Sleuth Kit through 4.15.0 contains a heap out-of-bounds read vulnerability in hfs_load_extended_attrs() in tsk/fs/hfs.c that reads the decmpfs header without checking attribute length. Attackers can supply a crafted HFS+ image with a…
CVE-2026-120449Medium· 5.3PoCOutline before 1.12.0 Improper Access Control via Public Document Shares
Outline before 1.12.0 contains an improper access control vulnerability that allows unauthenticated users to read unpublished documents because the share loader ignores unpublished status. Attackers holding an existing share link can que…
CVE-2026-16306Critical· 9.8CVE-2026-16306
Remote Code Execution in the `IModular.exe` URI handler in INFINITT Healthcare Co., Ltd. INFINITT PACS allows a remote unauthenticated attacker to invoke unintended application functionality and potentially execute arbitrary code via a c…
CVE-2026-120501Medium· 5.3An Otter Wiki 2.20.1 before 2.26.2 Repository File Disclosure via DataTable src
An Otter Wiki 2.20.1 before 2.26.2 contains a file disclosure vulnerability in the DataTable embedding that allows attackers who can edit pages, including anonymous users under the default configuration, to read repository-internal files…