Tagged “cve.org”
CVEs tagged cve.org, newest first.
46493 CVEsRSS
CVE-2026-115215High· 8.7NetX Secure DTLS server allocates a session for each new source before the cookie exchange and never reclaims it, so spoofed datagrams exhaust the session pool
In Eclipse ThreadX NetX Duo versions 6.0 through 6.5.2.202603a, the NetX Secure DTLS server allocates a session from its fixed session pool for the first datagram from any unrecognised address and port, before the cookie exchange, and ne…
CVE-2026-115403High· 8.2NULL pointer dereference in the BSD raw IPv6 send path when the destination table is full
In Eclipse ThreadX NetX Duo versions 6.0 through 6.5.2.202603a, built with BSD raw socket and IPv6 support, the IPv6 raw send path uses the destination-table entry it adds without checking that the add succeeded. When the destination tab…
CVE-2026-116635Medium· 6.1Improper limitation of a pathname to a restricted directory in the deployment status component of the AWS Serverless MCP Server
Improper limitation of a pathname to a restricted directory in the deployment status component of the AWS Serverless MCP Server (aws-serverless-mcp-server) before v0.2.1 might allow an actor who can influence the MCP agent to read the co…
CVE-2026-86596Critical· 9.8PoCs2Member <= 260927 - Unauthenticated Remote Code Execution via 'item_name' IPN Parameter
The s2Member plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, <= 260927 via the 'item_name' parameter parameter. This is due to insufficient sanitization in strip_php_tags_deep(), which on…
CVE-2026-105475High· 8.7Improper neutralization of a NUL byte in cPanel allows remote attackers to read any mail account's calendar and contact data.
Improper neutralization of a NUL byte in cPanel allows remote attackers to read any mail account's calendar and contact data.
CVE-2026-103310Medium· 5.3PayHere Payment Gateway 2.4.0 - 2.4.5 - Unauthenticated Payment Bypass via Unverified Payment Notification
The PayHere Payment Gateway WordPress plugin from 2.4.0 through 2.4.5 does not verify the authenticity of payment notifications when the merchant secret is unset, which is the default state, allowing unauthenticated attackers to forge a …
CVE-2026-58873High· 8.4In addDragDropListener of WindowManagerService.java, there is a possible permission bypass due to a missing permission check
In addDragDropListener of WindowManagerService.java, there is a possible permission bypass due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interacti…
CVE-2026-116768High· 7.1Missing length validation in Absolute Secure Access
CVE-2026-116768 is a missing length validation vulnerability in Secure Access servers prior to 14.61. Authenticated attackers can cause a persistent denial of service when connecting for the first time.
CVE-2026-113687Critical· 9.8Apache Syncope: RCE via ProcessGroovyMethodsSandbox bypass
Improper isolation or compartmentalization vulnerability in Apache Syncope. An administrator with adequate entitlements for Implementations can create a malicious Groovy class running untrusted code on a separate Thread, thus bypassin…
CVE-2026-113511Critical· 9.1Apache Syncope: Delegated administration boundaries can be bypassed for Realm update
Authorization bypass through User-Controlled key vulnerability in Apache Syncope. A delegated administrator can relocate a Realm subtree across administrative realm boundaries without permission for the destination This issue affects …
CVE-2026-110535High· 8.8Apache Syncope: AuthProfile value escalation via self-service update
Improper Privilege Management vulnerability in Apache Syncope. AuthProfile self-updates allow non-admin users to configure impersonation for WA surrogate authentication. This issue affects Apache Syncope: from 3.0.12 through 3.0.16, f…
CVE-2026-109083Critical· 9.8Apache Syncope: Remote Code Execution via Flowable JUEL expression
Improper isolation or compartmentalization vulnerability in Apache Syncope. An administrator with adequate entitlements can import arbitrary BPMN process definitions via the REST API and then start the process. When a BPMN process conta…
CVE-2026-29508High· 8.8PoCReadyMedia 1.3.0 - 1.3.3 Stack Buffer Overflow via DFF Parser
ReadyMedia (formerly MiniDLNA) versions 1.3.0 through 1.3.3 contain a stack-based buffer overflow vulnerability that allows remote attackers to corrupt stack memory by crafting a malicious DFF audio file with an oversized PROP chunk size…
CVE-2026-91895High· 7.1Dell Alienware Command Center (AWCC), versions prior to 6.14.54.0, contain an Incorrect Default Permissions vulnerability
Dell Alienware Command Center (AWCC), versions prior to 6.14.54.0, contain an Incorrect Default Permissions vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Information T…
CVE-2026-119737High· 7.8PoCAmlogic pppoe_wrapper Command Injection via AF_UNIX Socket
The pppoe_wrapper vendor daemon from the Amlogic Android SDK, as shipped on Nexbox A95X (Amlogic S905/S905X) TV boxes, contains a command injection vulnerability that allows local attackers to execute arbitrary commands as root by sendin…
CVE-2026-120503Low· 3.3EchoHS GeekezBrowser Public API status information disclosure
A vulnerability was detected in EchoHS GeekezBrowser up to 1.7.2/1.8.0. This affects an unknown part of the file /api/status of the component Public API. The manipulation results in information disclosure. The attack requires a local app…
CVE-2026-116767High· 7.1Improper input handling in Secure Access servers
CVE-2026-116767 is an improper input handling vulnerability in Secure Access servers prior to 14.61. Authenticated attackers can cause a persistent denial of service.
CVE-2026-58930High· 7.8An unprivileged application can exploit a lack of package/signature validation in SystemUI's `RemoteQCController` when resolving a hardcoded `content://` URI
An unprivileged application can exploit a lack of package/signature validation in SystemUI's `RemoteQCController` when resolving a hardcoded `content://` URI. This allows the attacker to squat on a specific authority if the legitimate pa…
CVE-2026-58927Medium· 6.7The vulnerability is a Use-After-Free (UAF) in the EVS AIDL HAL, arising from a data race on an unsynchronized `std::weak_ptr` within `EvsEnumerator::openCamera()`
The vulnerability is a Use-After-Free (UAF) in the EVS AIDL HAL, arising from a data race on an unsynchronized `std::weak_ptr` within `EvsEnumerator::openCamera()`. Specifically, concurrent calls from a privileged UID (e.g., `AID_AUTOMOT…
CVE-2026-49903Medium· 5.3The `ClusterRenderingService.dump()` method, accessible to processes holding `android.permission.DUMP` and `android.permission.PACKAGE_USAGE_STATS`, acts as a confused deputy
The `ClusterRenderingService.dump()` method, accessible to processes holding `android.permission.DUMP` and `android.permission.PACKAGE_USAGE_STATS`, acts as a confused deputy. It allows attackers to write arbitrary values to `Settings.Gl…
CVE-2026-58924High· 7.5The vulnerability is a heap out-of-bounds read in the EVS HAL's `getStreamList()` method
The vulnerability is a heap out-of-bounds read in the EVS HAL's `getStreamList()` method. An attacker can craft a `CameraDesc.metadata` byte array, which is parsed without validation, leading to an out-of-bounds read at an attacker-contr…
CVE-2026-58925High· 7.8The report details a heap Use-After-Free (UAF) vulnerability within the `android.hardware.automotive.evs-default` HAL service, stemming from unsynchronized access to an `std::unordered_map`
The report details a heap Use-After-Free (UAF) vulnerability within the `android.hardware.automotive.evs-default` HAL service, stemming from unsynchronized access to an `std::unordered_map`. An unprivileged application with access to the…
CVE-2026-116766High· 8.3Improper input handling in Secure Access server
CVE-2026-116766 is an improper input handling vulnerability in the Secure Access server versions between 13.0 and prior to 14.61. Attackers can cause a persistent denial of service of the server.
CVE-2026-28645Medium· 6.8In onStrongAuthRequiredChanged of UsbService.java, there is a possible unauthenticated enabling of USB data due to a logic error in the code
In onStrongAuthRequiredChanged of UsbService.java, there is a possible unauthenticated enabling of USB data due to a logic error in the code. This could lead to physical escalation of privilege with no additional execution privileges nee…
CVE-2026-16305High· 7.8CVE-2026-16305
Local privilege escalation in `SmartUpdate.exe` and `SmartExecute.exe` in INFINITT Healthcare Co., Ltd. INFINITT PACS allows a local low-privileged attacker to execute arbitrary commands with administrator privileges via modification of …
CVE-2026-116769Critical· 9.3Authentication bypass in Secure Access Servers
CVE-2026-116769 is an authentication bypass vulnerability in Secure Access servers starting with version 13.0 and prior to 14.61. Attackers can modify security settings of a client via the server.
CVE-2026-97718Critical· 9.4CSRF in Secure Access Server v14.60
CVE-2026-97718 Is a cross-site request forgery vulnerability in version 14.60 of the Secure Access server. Because of a bypassed security control, an attacker can cause an admin to create an account under their control.
CVE-2026-65059High· 7.5Furl versions through 3.15 for Perl allow memory exhaustion via unbounded decompression of HTTP responses
Furl versions through 3.15 for Perl allow memory exhaustion via unbounded decompression of HTTP responses. Furl inflates a response body sent with a gzip, x-gzip or deflate Content-Encoding and appends the output to the response string …
CVE-2026-59048Medium· 4.0In rb_cpu_init of trace.c, there is a possible out-of-bounds read due to an incorrect bounds check
In rb_cpu_init of trace.c, there is a possible out-of-bounds read due to an incorrect bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploi…
CVE-2026-59022Medium· 4.0In multiple functions of MediaProvider.java, there is a possible permission bypass due to a logic error in the code
In multiple functions of MediaProvider.java, there is a possible permission bypass due to a logic error in the code. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not …