Tagged “exploit-available”
CVEs tagged exploit-available, newest first.
8644 CVEsRSS
CVE-2026-115970High· 7.3PoCTravisun Opptrix Import Endpoint import code injection
A vulnerability has been found in Travisun Opptrix 0.4.0. This impacts an unknown function of the file /api/system-update/import of the component Import Endpoint. Such manipulation leads to code injection. It is possible to launch the at…
CVE-2026-115971Medium· 5.3PoCTravisun Opptrix preParsing handler webhook Buffer.concat denial of service
A vulnerability was found in Travisun Opptrix 0.4.0. Affected is the function Buffer.concat of the file /api/channels/webhook/ of the component preParsing handler. Performing a manipulation results in denial of service. The attack can be…
CVE-2026-115969High· 7.3PoCTravisun Opptrix Schedule API setup command injection
A flaw has been found in Travisun Opptrix 0.4.0. This affects an unknown function of the file /api/auth/setup of the component Schedule API. This manipulation causes command injection. It is possible to initiate the attack remotely. The …
CVE-2026-116010Medium· 4.3PoCRosarioSIS before 12.9.1 Missing Authorization in Teacher Save Handlers
RosarioSIS before 12.9.1 contains a missing authorization vulnerability that allows authenticated teachers to write records for students outside their course period by supplying arbitrary student IDs. Attackers can modify the st_arr, val…
CVE-2026-116011High· 7.5PoCCrow before 1.3.4 Denial of Service via Deeply Nested JSON in crow::json::load()
Crow before 1.3.4 contains an uncontrolled recursion vulnerability in crow::json::load() that allows remote unauthenticated attackers to crash the server by sending deeply nested JSON. Attackers can send a request body with thousands of …
CVE-2026-116012Low· 3.6PoCGhidra before 12.2 Integer Truncation in PackedDecode::skipAttribute Decompiler Parser
Ghidra before 12.2 contains a numeric truncation vulnerability in PackedDecode::skipAttribute and skipAttributeRemaining in marshal.cc that stores 64-bit string lengths in 32-bit variables. Attackers can supply a crafted packed stream, s…
CVE-2026-116016High· 7.1PoCyudao-cloud through 2026.09 Data Permission Bypass via data-permission-enable Header
yudao-cloud through 2026.09 contains an authorization bypass vulnerability that allows authenticated users to evade row-level data scope restrictions by sending a data-permission-enable header set to false. Attackers can add this header …
CVE-2026-116018Medium· 4.3PoCONEARMY community-platform before 2.165.2 IDOR via notification read endpoint
ONEARMY community-platform before 2.165.2 contains an insecure direct object reference vulnerability that allows authenticated users to mark other users' notifications as read via POST /api/notifications/:id/read. Attackers can iterate s…
CVE-2026-112866Critical· 9.3PoCWordPress Product Filter by WBW plugin <= 3.4.6 - SQL Injection vulnerability
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPFactory Product Filter by WBW woo-product-filter allows Blind SQL Injection.This issue affects Product Filter by WBW: from n/a throug…
CVE-2026-115802Medium· 4.3PoCInternScience InternAgent LoRA Loading experiment.py train inclusion of functionality from untrusted control sphere
A weakness has been identified in InternScience InternAgent 1.5.0. This affects the function train of the file tasks/AutoChem/code/experiment.py of the component LoRA Loading. This manipulation of the argument base_model_name_or_path cau…
CVE-2026-115801Medium· 5.3PoCKakao khaiii JSON Config File Linear.cpp open out-of-bounds
A security flaw has been discovered in Kakao khaiii up to 0.4. The impacted element is the function khaiii::nn::Linear::open of the file src/main/cpp/khaiii/nn/Linear.cpp of the component JSON Config File Handler. The manipulation of the…
CVE-2026-83813Low· 3.1PoCTwisted: DNS Response Spoofing in twisted.names Due to Missing Source Address Validation
Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 26.10.0rc1, twisted.names.dns.DNSDatagramProtocol accepts a UDP DNS response for a pending query when its 16-bit transaction ID matches but d…
CVE-2026-58202High· 8.3PoCOpenReception: Confirmation-email links built from the request Host enable pending-account takeover via `POST /api/auth/resend-confirmation`
OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 2.0.0, the account-confirmation link in emails is built from the request Host header, with no allowlist. The una…
CVE-2026-75524Medium· 5.4PoCOpenReception: race condition in add-to-tunnel and create-new-client allows overlapping appointments for one agent
OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 2.2.2, an attacker overbooks an agent, placing multiple appointments into a single time slot that the system is …
CVE-2026-115800Medium· 5.3PoCUbiquitousLearning mllm Convertor __init__.py load_model path traversal
A vulnerability was identified in UbiquitousLearning mllm up to 2.0.2. The affected element is the function load_model of the file pymllm/mobile/convertor/__init__.py of the component Convertor. The manipulation of the argument shard_fil…
CVE-2026-75525Medium· 5.3PoCOpenReception: unauthenticated ML-KEM key injection into the staff-crypto recipient directory in any tenant
OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. In versions 2.1.0 and prior, an unauthenticated attacker can store an arbitrary ML-KEM-768 public key under any existing user's i…
CVE-2026-115886Medium· 6.5PoCMLflow: SSRF on unauthenticated MLflow servers via third-party scorer kwargs in the scorer invoke, register, and GenAI evaluate endpoints
MLflow is an open source AI engineering platform for agents, large language models, and machine learning models. From 3.12.0rc0 until 3.17.0, the scorer invoke, register, and GenAI evaluate endpoints, including unauthenticated POST /ajax…
CVE-2026-115887High· 7.5PoCgraphql-scalars PhoneNumber scalar is vulnerable to regular expression denial of service
GraphQL Scalars is a library of custom GraphQL scalars for creating precise type-safe GraphQL schemas. From 1.24.1 until 2.0.1, GraphQLPhoneNumber in src/scalars/PhoneNumber.ts uses ambiguous nested digit quantifiers that backtrack expon…
CVE-2026-115893Critical· 9.9PoCWasmtime: Cranelift backend on aarch64 can jump to incorrect target on large Wasm `br_table` instruction
Wasmtime is a runtime for WebAssembly. Prior to 36.0.19, 48.0.7, and 49.0.4, the Cranelift compiler backend on aarch64 can compile a Wasm br_table instruction with more than approximately 256,000 targets so that it has an incorrect condi…
CVE-2026-115889Critical· 9.9PoCWasmtime: Bit-packing in Cranelift compiler causes silent overflow and miscompilation
Wasmtime is a runtime for WebAssembly. Prior to 36.0.19 and 43.0.0, the Cranelift compiler backend bit-packs SSA value indices in a way that can silently overflow in release builds when compiling a sufficiently large or specially crafted…
CVE-2026-115895High· 8.8PoCHappy DOM: Incomplete fix for CVE-2026-33943: unsanitized import alias leads to host code execution
Happy DOM is a JavaScript implementation of a web browser without its graphical user interface. From 17.0.0 until 21.0.4, packages/happy-dom/src/module/ECMAScriptModuleCompiler.ts accepts a named ESM import alias without validating that …
CVE-2026-115877Medium· 5.4PoCTwisted: HTTP Request Smuggling in twisted.web via a Bare CR or LF in a Header Value
Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 26.10.0rc1, twisted.web.http.HTTPChannel.headerReceived rejects a NUL byte in an HTTP header value but accepts a bare carriage return or bare…
CVE-2026-115796Medium· 4.3PoCTenda F6 Web Management cross-site request forgery
A security flaw has been discovered in Tenda F6 12.02.01.73. This impacts an unknown function of the component Web Management Interface. Performing a manipulation results in cross-site request forgery. The attack may be initiated remotel…
CVE-2026-115797Low· 3.7PoCTenda F6 Web Management cleartext transmission
A weakness has been identified in Tenda F6 12.02.01.73. Affected is an unknown function of the component Web Management Interface. Executing a manipulation of the argument ecos_pw can lead to cleartext transmission of sensitive informati…
CVE-2026-115774Medium· 4.9PoCTwisted: Denial of Service in the Twisted IMAP4 Server via a Negative Literal Size in SEARCH
Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 26.10.0rc1, twisted.mail.imap4.IMAP4Server reaches twisted.mail.imap4.parseNestedParens with a negative literal size in an authenticated SEAR…
CVE-2026-115775High· 8.7PoCTwisted: Unauthenticated Remote Denial of Service in the Twisted words domish XML Element Stream via an Unbounded Element Tree
Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 26.10.0rc1, the twisted.words.xish.domish ExpatElementStream parser allows an unauthenticated remote peer to keep a container element open wh…
CVE-2026-50787High· 7.5PoCe-SIC Livre (esiclivre) v0.2.2 and earlier contains an uncontrolled resource consumption vulnerability in restrito/inc/captcha.php
e-SIC Livre (esiclivre) v0.2.2 and earlier contains an uncontrolled resource consumption vulnerability in restrito/inc/captcha.php. The application uses user-supplied parameters (l, a, tf, ql) without validation to generate CAPTCHA image…
CVE-2026-52356High· 8.8PoCAn OS command injection vulnerability in the /htdocs/web/diagnostic.php endpoint of D-Link DAP1160L A1_FW101WWb04 allows attackers to execute arbitrary commands via injecting arbitrary shell metacharacters.
An OS command injection vulnerability in the /htdocs/web/diagnostic.php endpoint of D-Link DAP1160L A1_FW101WWb04 allows attackers to execute arbitrary commands via injecting arbitrary shell metacharacters.
CVE-2026-115810High· 7.7PoCTandoor Recipes before 2.7.0 SSRF via Pestle Importer Image URL
Tandoor Recipes before 2.7.0 contains a server-side request forgery vulnerability in the Pestle importer that allows authenticated low-privileged users to force the server to issue GET requests to arbitrary internal or external hosts by …
CVE-2026-106071Low· 3.6PoCA flaw in Node.js Permission Model filesystem enforcement can grant access to paths that do not match a wildcard `--allow-fs-read` or `--allow-fs-write` rule. When the requested path is shorter than the prefix of a wildcard grant, the r…
A flaw in Node.js Permission Model filesystem enforcement can grant access to paths that do not match a wildcard `--allow-fs-read` or `--allow-fs-write` rule. When the requested path is shorter than the prefix of a wildcard grant, the r…