Tagged “cve.org”
CVEs tagged cve.org, newest first.
49927 CVEsRSS
CVE-2026-96582Medium· 4.9Out-of-bounds Read via Check-after-use in the USBX HID Report Descriptor Parser
A HID report descriptor is a sequence of items, each declaring in its header how many data bytes follow. The USBX host walks that sequence by advancing over each header and parsing the data behind it. The walk checked that an item fit…
CVE-2026-96406Medium· 4.9VIDEO class descriptor walk consumes device-controlled wTotalLength as its bound
A VideoStreaming interface reports the size of its whole class-specific descriptor block in the `wTotalLength` field of its input header. The USBX host recorded that figure and used it as the budget for walking the format, frame and fram…
CVE-2026-113394High· 7.4PoCDrayTek Vigor2960 mainfunction.cgi setSWMProfile path traversal
A vulnerability was identified in DrayTek Vigor2960 1.5.1.6 Revision 8218. Impacted is the function setSWMProfile of the file /cgi-bin/mainfunction.cgi. The manipulation of the argument setSWMProfile leads to path traversal. It is possib…
CVE-2026-74049Medium· 6.1⚖ disputedApache Tomcat: Jasper JSTL <c:redirect> plug-in implementation omits page abort (SKIP_PAGE)
Execution After Redirect (EAR) vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.26, from 10.1.0-M1 through 10.1.60, from 9.0.0.M1 through 9.0.122. The following versions were EOL at the …
CVE-2026-74048Medium· 6.5⚖ disputedApache Tomcat: OpenSSL-FFM FIPS failure does not prevent start-up
Not Failing Securely ('Failing Open') vulnerability in Apache Tomcat. If the OpenSSLLifecycleListener is configured to use FIPS mode but FIPS activation fails, Tomcat logs and error but continues to use JSSE in non-FIPS mode with the pro…
CVE-2026-113393Medium· 6.3PoCDrayTek Vigor2960 commonupload mainfunction.cgi unrestricted upload
A vulnerability was determined in DrayTek Vigor2960 1.5.1.6 Revision 8218. This issue affects some unknown processing of the file /cgi-bin/mainfunction.cgi of the component commonupload. Executing a manipulation of the argument upload_pa…
CVE-2026-80353High· 8.1⚖ disputedApache Tomcat: TOCTOU when setting specific permissions for Unix Domain Sockets - Fix for CVE-2026-65183 did not address APR connector
Time-of-check time-of-use (TOCTOU) race condition vulnerability in Apache Tomcat when creating unix domain sockets for the APR/Native connector allows an unauthorised local user to access the unix domain socket. The fix for CVE-2026-6518…
CVE-2026-105941High· 8.1Kroxylicious-kms-provider-azure-key-vault-kms: streams for apache kafka kroxylicious: azure key vault ssrf exfiltrates bearer token via untrusted edek vaultname
The Azure Key Vault KMS provider in Kroxylicious accepts an untrusted vaultName from wire-deserialized EDEK bytes without format validation, enabling SSRF that exfiltrates the proxy's Azure bearer token to an attacker-controlled host. To…
CVE-2026-88041High· 7.5Apache Tomcat: HTTP/2 trailer header cross-contamination
Incomplete cleanup vulnerability in Apache Tomcat allowed an trailer information from a previous request to leak into a subsequent request. This issue affects Apache Tomcat: from 11.0.0-M23 through 11.0.26, from 10.1.27 through 10.1.6…
CVE-2026-113395High· 7.4PoCDrayTek Vigor2960 swmconfigupload mainfunction.cgi cgiEscape path traversal
A security flaw has been discovered in DrayTek Vigor2960 1.5.1.6 Revision 8218. The affected element is the function cgiEscape of the file /cgi-bin/mainfunction.cgi of the component swmconfigupload. The manipulation of the argument multi…
CVE-2026-101296High· 8.1Apache Tomcat: JNDIRealm bind credential validation fails open for non-GSSAPI SASL mechanisms
A missing critical step in authentication vulnerability in Apache Tomcat when the JNDI realm was configured with with a non GSSAPI SASL authentication mechanism allowed attackers to authenticate without providing the correct password. …
CVE-2026-93446High· 7.5Apache Tomcat: Possible TLS 1.3 connection failures
Incomplete cleanup vulnerability in Apache Tomcat could cause TLS 1.3 connections to fail intermittently. This issue affects Apache Tomcat: from 11.0.0-M21 through 11.0.26, from 10.1.25 through 10.1.60, from 9.0.90 through 9.0.122. …
CVE-2026-101356Medium· 5.3⚖ disputedtomcat: tomcat: Information disclosure via incorrect object recycling in HTTP/2 processing (CVE-2026-101356)
A flaw was found in Apache Tomcat. Incorrect object recycling and reuse during the HTTP/2 processing of asynchronous servlets can cause requests and responses to be mixed up between different users. A remote attacker could exploit this vul…
CVE-2026-103119Medium· 4.8⚖ disputedtomcat: Apache Tomcat: Information disclosure via buffer under-read during non-blocking writes (CVE-2026-103119)
A flaw was found in Apache Tomcat. During large non-blocking write operations, a buffer under-read can cause an HTTP response body to be split between the current request and the subsequent request handled on the same connection. A remote …
CVE-2026-113396High· 7.4PoCDrayTek Vigor2960 Rename Table mainfunction.cgi rename_table command injection
A weakness has been identified in DrayTek Vigor2960 1.5.1.6 Revision 8218. The impacted element is the function rename_table of the file /cgi-bin/mainfunction.cgi of the component Rename Table Handler. This manipulation of the argument n…
CVE-2026-34484Medium· 6.7A Shell Privilege Escalation vulnerability in Nokia 1830 Global Express (GX)
Nokia 1830 Global Express GX is vulnerable to a local privilege escalation vulnerability which exists in the administrative shell interface. An authenticated local attacker with restricted shell access can exploit this vulnerability to b…
CVE-2026-113619High· 7.5Eclipse ioFog renders request templates before authentication
In Eclipse ioFog Controller versions 3.8.0 through 3.9.1, POST, PUT, and PATCH bodies on routes that enable template substitution are rendered by an uncapped Liquid engine before authentication and RBAC. The bearer check does not reject …
CVE-2026-34485High· 7.8A CLI ACL Bypass vulnerability in Nokia 1830 Global Express (GX)
Nokia 1830 Global Express (GX) is vulnerable to a CLI ACL Bypass vulnerability where a low-privileged authenticated attacker can bypass the SSH isolation mechanism and gain access to the underlying operating system shell via a custom SSH…
CVE-2026-113390Critical· 9.9PoCDrayTek Vigor2960 CGI mainfunction.cgi sub_182B0 os command injection
A flaw has been found in DrayTek Vigor2960 1.5.1.6 Revision 8218. Affected by this issue is the function sub_182B0 of the file /cgi-bin/mainfunction.cgi of the component CGI Interface. This manipulation of the argument usefile/usescript/…
CVE-2026-113620Critical· 9.8Eclipse ioFog operator WebSocket accepts an unverified JWT
In Eclipse ioFog Controller versions 3.8.0 through 3.9.1, operator WebSocket upgrades on the exec and log routes do not verify the bearer JWT. The payload is decoded and its groups or roles are used as RBAC subjects. A self-minted token …
CVE-2026-113391Critical· 9.9PoCDrayTek Vigor2960 Upload Endpoint mainfunction.cgi uploadlangs command injection
A vulnerability has been found in DrayTek Vigor2960 1.5.1.6 Revision 8218. This affects the function uploadlangs of the file /cgi-bin/mainfunction.cgi of the component Upload Endpoint. Such manipulation leads to command injection. The at…
CVE-2026-113389Critical· 9.9PoCDrayTek Vigor2960 CGI Process mainfunction.cgi set_table command injection
A vulnerability was detected in DrayTek Vigor2960 1.5.1.6 Revision 8218. Affected by this vulnerability is the function set_table of the file /cgi-bin/mainfunction.cgi of the component CGI Process. The manipulation of the argument sectio…
CVE-2026-43834High· 7.5A stack-based buffer overflow vulnerability in the logs settings functionality could allow an authenticated attacker to achieve code execution.
A stack-based buffer overflow vulnerability in the logs settings functionality could allow an authenticated attacker to achieve code execution.
CVE-2026-43835High· 8.6A vulnerability in the firmware upgrade functionality could allow an authenticated attacker to upload a forged firmware upgrade file, potentially compromising the device permanently.
A vulnerability in the firmware upgrade functionality could allow an authenticated attacker to upload a forged firmware upgrade file, potentially compromising the device permanently.
CVE-2026-11959Medium· 6.9Multiple vulnerabilities in FacturaScripts
Stored Cross-Site Scripting (XSS) in FacturaScripts, version 2025.61, caused by a lack of adequate validation or sanitisation of user input in the ‘city’ and ‘province’ fields in the ‘ListAlmacen’ endpoint. Successful exploitation of thi…
CVE-2026-43837High· 7.5A buffer overflow vulnerability in the password verification functionality could allow an attacker with guest authentication to achieve code execution.
A buffer overflow vulnerability in the password verification functionality could allow an attacker with guest authentication to achieve code execution.
CVE-2026-43836Critical· 9.3A vulnerability could allow an attacker to forge a packet to execute arbitrary commands with maximum privileges.
A vulnerability could allow an attacker to forge a packet to execute arbitrary commands with maximum privileges.
CVE-2026-113465Medium· 6.6Possible DOM XSS in SNS Web Administration Portal
It is possible to execute a DOM-based Cross-Site Scripting attack against Stormshield’s web administration panel. To exploit this vulnerability, an attacker would need to craft a URL containing a malicious script payload within a spec…
CVE-2026-11960Medium· 6.9Multiple vulnerabilities in FacturaScripts
Enumeration of unauthenticated users in FacturaScripts, version 2025.61. The application returns different responses when attempting to log in with a valid username compared to an invalid one. An unauthenticated attacker could systematic…
CVE-2026-101201Medium· 5.5qt5-qtbase: qt6-qt5compat: qt: Denial of Service via out-of-bounds read in QBinaryJson (CVE-2026-101201)
A flaw was found in Qt. An out-of-bounds read vulnerability can occur when parsing a binary file with a malformed header in the QBinaryJson::fromBinaryData() function. An attacker could exploit this flaw by convincing a user or application…