Tagged “cve.org”
CVEs tagged cve.org, newest first.
50134 CVEsRSS
CVE-2026-102692Critical· 9.1RIOT is an open-source microcontroller operating system designed for Internet of Things devices and other embedded systems
RIOT is an open-source microcontroller operating system designed for Internet of Things devices and other embedded systems. Prior to 2026.07, nanocoap accepts oversized CoAP Block2 option values without enforcing the 20-bit maximum block…
CVE-2026-62362Medium· 4.9PoCPeerBanHelper automatically blocks unwanted, leeching, and abnormal BitTorrent peers using customizable and cloud rules
PeerBanHelper automatically blocks unwanted, leeching, and abnormal BitTorrent peers using customizable and cloud rules. From 5.0.0 until 9.3.15, the /api/statistic/analysis/field endpoint accepts a crafted field query parameter from an …
CVE-2026-86047High· 7.7mariadb: mariadb: SQL injection via improper identifier quoting (CVE-2026-86047)
A flaw was found in MariaDB, which can lead to SQL injection and privilege escalation. The SHOW CREATE SERVER and SHOW CREATE USER commands, as well as the mariadb-dump utility, do not properly quote identifiers and values when serializing…
CVE-2026-85745Medium· 4.3MariaDB: Out-of-bound buffer read on in `ST_Area` of a multipolygon.
MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, ST_Area reads beyond the allocated buffer when processing invalid WKB for a MultiPolygon because the …
CVE-2026-106705High· 8.8ELADMIN (eladmin-mp) up to 2.7 contains an improper access control vulnerability in the role management module
ELADMIN (eladmin-mp) up to 2.7 contains an improper access control vulnerability in the role management module. The endpoint PUT /api/roles/menu (RoleController.updateRoleMenu) authorizes the request only by comparing the target role's l…
CVE-2026-92262High· 8.8PoCmariadb: MariaDB: Numerous issues caused by historical #mysql50# tablename encoding bypass. (CVE-2026-92262)
A flaw was found in MariaDB. An authenticated remote attacker can supply a crafted table name with the #mysql50# prefix, which bypasses normal filesystem encoding for table names. By accessing files under unencoded legacy names, the attack…
CVE-2026-97380High· 8.8MariaDB: GRANT PROXY with empty password incorrectly checks grantor's privileges
MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the GRANT PROXY statement treats an IDENTIFIED clause with an empty password as though authentication…
CVE-2026-86009High· 8.2PoCMailu: Domain managers can allow themselves to spoof on other hosted domains they should not control
Mailu is a mail server distributed as a set of Docker images. Prior to f05aeb8322e2f61096af6b089d61ba6f40587d96, domain managers can enable spoofing for hosted domains they do not control. A potentially malicious domain administrator ena…
CVE-2026-77474High· 7.1dcg: Exponential-time command-substitution preprocessing lets a crafted command hang dcg and bypass the guard via hook-timeout fail-open
destructive_command_guard (dcg) is a command-line safety tool that blocks destructive shell commands before AI coding agents run them. Prior to 0.6.6, nested or unclosed substitutions are recursively rescanned after an inner scan returns…
CVE-2026-57169Critical· 9.6Dockhand is a Docker management application
Dockhand is a Docker management application. Prior to 1.0.34, the in-browser container terminal endpoint /api/containers/<id>/exec does not enforce authentication on the WebSocket upgrade request. When an unauthenticated attacker has net…
CVE-2026-44977Critical· 9.0PoCcountly-server: Stored XSS in feedback upload enables app-admin to compromise global admin session context
countly-server is the server-side part of Countly, a product analytics solution. Prior to 24.05.50 and 25.03.44, plugins/star-rating/api/api.js allows a non-global application administrator to use uploadFeedbackFile to store attacker-con…
CVE-2026-41582High· 7.5PoCcountly-server: Unauthenticated Path Traversal via Public Image and Screenshot Routes Leads to Read Internal Files
countly-server is the server-side part of Countly, a product analytics solution. Prior to 24.05.50 and 25.03.44, public image and screenshot routes implemented in frontend/express/app.js, plugins/star-rating/frontend/app.js, and plugins/…
CVE-2026-57486High· 7.5PoCpupnp: NULL pointer dereference in ixmlNode_compare crashes on non-namespaced attributes
pupnp is an SDK for development of UPnP device and control point applications. Prior to 2.0.2, ixmlNode_compare in ixml/src/node.c passes the nullable nodeValue, namespaceURI, prefix, and localName fields directly to strcmp. Non-namespac…
CVE-2026-55836Medium· 6.8PoCOpen Zaak is an open-source data and services layer for Dutch case-oriented working
Open Zaak is an open-source data and services layer for Dutch case-oriented working. From 1.13.0 until 1.27.2, 1.28.2, and 1.29.0, _import_document_row in src/openzaak/components/documenten/tasks.py uses the attacker-controlled bestandsp…
CVE-2026-46471Medium· 5.5PoCAn issue was discovered in GStreamer gst-plugins-good before 1.28.2
An issue was discovered in GStreamer gst-plugins-good before 1.28.2. While parsing an MP4 file, the isomp4 plugin's qtdemux_parse_uuid function may read past the end of a heap-allocated buffer, allowing an attacker to disclose heap memor…
CVE-2026-102923Medium· 5.4PoCSparkyFitness is a self-hosted, AI-powered health and fitness tracker for families
SparkyFitness is a self-hosted, AI-powered health and fitness tracker for families. Prior to 1.6.0, SparkyFitnessServer/services/chatService.ts and SparkyFitnessServer/services/labelScanService.ts do not validate destinations supplied in…
CVE-2026-46472High· 7.5⚖ disputedAn issue was discovered in GStreamer gst-plugins-good before 1.28.2
An issue was discovered in GStreamer gst-plugins-good before 1.28.2. While parsing an MP4 file, the isomp4 plugin's qtdemux_parse_chnl function may read past the end of a global array, potentially leading to information disclosure.
CVE-2026-68906High· 8.7PoClibIEC61850: Infinite loop and out-of-bounds read in ACSE parseUserInformation when parsing a malformed AARE PDU
libIEC61850 is an open-source implementation of IEC 61850 client and server protocols including MMS, GOOSE, Sampled Values, and R-Session. Prior to 1.6.2, parseUserInformation in src/mms/iso_acse/acse.c checks len for zero before validat…
CVE-2026-92263High· 7.2PoCSparkyFitness: Authenticated OS command injection (host RCE) via backup-restore filename in POST /api/admin/backup/restore
SparkyFitness is a self-hosted, AI-powered health and fitness tracker for families. Prior to 1.6.0, the api/admin/backup/restore endpoint interpolates an uploaded filename into a shell command. An authenticated global administrator uploa…
CVE-2026-57446Medium· 5.3PoClibIEC61850 is an open-source implementation of IEC 61850 client and server protocols including MMS, GOOSE, Sampled Values, and R-Session
libIEC61850 is an open-source implementation of IEC 61850 client and server protocols including MMS, GOOSE, Sampled Values, and R-Session. From 1.6.1 until 1.6.2, a successful MMS ObtainFile operation closes MmsObtainFileTask::fileHandle…
CVE-2026-48741High· 7.5PoClibIEC61850: Remote NULL dereference in MMS Read alternate-access sub-array path leads to server-side DoS
libIEC61850 is an open-source implementation of IEC 61850 client and server protocols including MMS, GOOSE, Sampled Values, and R-Session. Prior to 1.6.2, alternateArrayAccess in src/mms/iso_mms/server/mms_read_service.c does not validat…
CVE-2026-57487High· 7.5libupnp: libupnp: Denial of Service via oversized chunked HTTP requests (CVE-2026-57487)
A flaw was found in libupnp. The HTTP parser fails to enforce configured message size limits when processing chunked transfer-encoded HTTP requests. A remote attacker can exploit this vulnerability by sending an excessively large chunked p…
CVE-2026-57488High· 7.1PoCpupnp: Integer truncation in HTTP Content-Length parsing enables request smuggling
pupnp is an SDK for development of UPnP device and control point applications. Prior to 2.0.2, raw_to_int in upnp/src/genlib/net/http/httpparser.c parses Content-Length with strtol and casts the resulting long to a 32-bit int before the …
CVE-2026-96425Medium· 5.5Incorrect Permission Assignment for Critical Resource in lomiri-download-manager
Incorrect DBus policy for lomiri-download-manager allows arbitrary user to run arbitrary command as root over DBus
CVE-2026-55862Medium· 6.5PoClibupnp: libupnp: Denial of Service via deeply nested XML (CVE-2026-55862)
A flaw was found in libupnp. Several Document Object Model (DOM) traversal functions process deeply nested XML structures using unbounded recursion. An unauthenticated attacker on the local network can exploit this flaw by sending a crafte…
CVE-2026-26846Critical· 9.8Buffer Overflow vulnerability in WEINVEIW CO.,LTD EBPro v.6.10.01.510_20251022 allows a remote attacker to execute arbitrary code via the UtilityManagerEx.exe component
Buffer Overflow vulnerability in WEINVEIW CO.,LTD EBPro v.6.10.01.510_20251022 allows a remote attacker to execute arbitrary code via the UtilityManagerEx.exe component
CVE-2026-96424High· 7.8Incorrect Permission Assignment for Critical Resource in lomiri-download-manager
Incorrect DBus policy for lomiri-upload-manager (part of lomiri-download-manager) allows arbitrary user to read arbitrary file as root over DBus
CVE-2026-55543High· 8.5PoCTuxGuitar is an open-source guitar tablature editor
TuxGuitar is an open-source guitar tablature editor. Prior to 2.1.0, an untrusted .tg file can set gervil.soundbank.path to reference an on-disk archive, including the .tg file itself, whose META-INF/services/javax.sound.midi.Soundbank e…
CVE-2026-95859High· 8.7libp2p-rust: Gossipsub GRAFT topics unbounded growth
libp2p-rust is the official Rust language implementation of the libp2p networking stack. Prior to 0.49.5, Gossipsub GRAFT control-message handling unconditionally adds attacker-supplied topic hashes to connected_peer.topics without confi…
CVE-2026-102941High· 7.5gomarkdown/markdown IsSafeURL panics on short URLs
The package github.com/gomarkdown/markdown is a Go library for parsing Markdown text and rendering as HTML. Prior to 0.0.0-20260724235538-61af6e1e6971, parser.IsSafeURL in parser/parser.go slices url[:nPath] before the len(url) >= nPath …