Tagged “exploit-available”
CVEs tagged exploit-available, newest first.
8808 CVEsRSS
CVE-2026-105270High· 8.7PoCUnbounded atom creation while parsing SAML messages in esaml allows atom table exhaustion
Allocation of Resources Without Limits or Throttling vulnerability in esaml_binding in dropbox esaml allows an unauthenticated attacker to exhaust the Erlang VM atom table and crash the node via a crafted SAMLResponse. esaml_binding:dec…
CVE-2026-114633Medium· 6.5PoCWWBN AVideo before 29.4.0 Incorrect Authorization via confirmDeleteUser.json.php
WWBN AVideo before 29.4.0 contains an incorrect authorization vulnerability that allows delegated Users Admin accounts to delete or modify administrator accounts. Attackers can submit requests to confirmDeleteUser.json.php or userAddNew.…
CVE-2026-114576Low· 3.7PoCLinksys RE6250 Web Management strcmp random values
A vulnerability has been found in Linksys RE6250 1.0.04.001. This affects the function strcmp of the component Web Management Interface. The manipulation of the argument session_id leads to insufficiently random values. The attack may be…
CVE-2026-114661High· 8.5PoCOpenRemote 1.2.0 before 1.31.0 Missing Authorization in Gateway Tunnel Endpoints
OpenRemote 1.2.0 before 1.31.0 contains a missing authorization vulnerability in GatewayServiceResource that allows any authenticated user to start, stop and query gateway tunnels without an administrative role. Attackers can send POST o…
CVE-2026-114577High· 7.3PoCoretnom23 php-travel-agency-system Insertion insert.php sql injection
A vulnerability was found in oretnom23 php-travel-agency-system. This vulnerability affects unknown code of the file admin/insert.php of the component Insertion Handler. The manipulation of the argument costomer_id/payment_type/amount/de…
CVE-2026-110264Critical· 10.0PoCInteger Overflow or Wraparound in GitLab
An issue has been discovered in GitLab CE/EE affecting all versions from 7.0 before 18.11.13, 19.0 before 19.0.10, 19.1 before 19.1.9, 19.2 before 19.2.9, 19.3 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, under certain…
CVE-2026-114575Critical· 10.0PoCTOTOLINK A950RG product.so UploadCustomModule command injection
A flaw has been found in TOTOLINK A950RG 4.1.2cu.5268_B20221104. Affected by this issue is the function UploadCustomModule of the file lib/cste_modules/product.so. Executing a manipulation of the argument FileMd5 can lead to command inje…
CVE-2026-96640High· 8.2PoCPillow PDF append accepts malformed shared page-tree DAG causing resource exhaustion
Pillow PDF append accepts malformed shared page-tree DAG causing resource exhaustion
CVE-2026-96641Medium· 6.5PoCPillow: Reachable undefined behavior in native integer operations, potentially leading to denial of service or logic integrity compromise
Pillow: Reachable undefined behavior in native integer operations, potentially leading to denial of service or logic integrity compromise
CVE-2026-96644High· 8.1PoCPillow: Heap over-read in WMF/EMF rendering via 16-bit dimension truncation (Windows builds)
Pillow: Heap over-read in WMF/EMF rendering via 16-bit dimension truncation (Windows builds)
CVE-2026-96778High· 7.7PoCPillow: Heap buffer overflow writing JPEG comment after ICC profile fills buffer
Pillow: Heap buffer overflow writing JPEG comment after ICC profile fills buffer
CVE-2026-111997Medium· 5.3PoCip-address: Address6 matches a zone identifier in quadratic time ahead of its length limit, allowing a single long string to stall the process
ip-address: Address6 matches a zone identifier in quadratic time ahead of its length limit, allowing a single long string to stall the process
CVE-2026-114574Medium· 4.3PoCmassCodeIO massCode Local HTTP Service index.ts information disclosure
A security vulnerability has been detected in massCodeIO massCode 5.10. Affected is an unknown function of the file src/main/api/index.ts of the component Local HTTP Service. Such manipulation leads to information disclosure. It is possi…
CVE-2026-114384Medium· 6.3PoCitsourcecode Online Cake Ordering System transactionsave.php sql injection
A security vulnerability has been detected in itsourcecode Online Cake Ordering System 1.0. Affected is an unknown function of the file /transactionsave.php. Such manipulation of the argument del leads to sql injection. The attack can be…
CVE-2026-114439High· 7.3PoCoretnom23 php-travel-agency-system Session session.php missing authentication
A vulnerability was determined in oretnom23 php-travel-agency-system. Affected by this issue is some unknown functionality of the file admin/session.php of the component Session Handler. Executing a manipulation of the argument user_id c…
CVE-2026-114441High· 7.3PoCoretnom23 php-travel-agency-system update.php sql injection
A weakness has been identified in oretnom23 php-travel-agency-system. This issue affects some unknown processing of the file admin/update.php. This manipulation of the argument action/full_name/visa_no/hiden/title/description/page_id/use…
CVE-2026-103090High· 8.8PoCUnauthenticated Biscuit Credential Disclosure via GET /enroll/status in Google OSS Agent Mesh (SAM)
Missing Authentication for Critical Function (CWE-306) and Insufficiently Protected Credentials (CWE-522) in the control plane enrollment status handler (HandleEnrollStatus at GET /enroll/status in internal/controlplane/server.go) in Goo…
CVE-2026-114440High· 7.3PoCoretnom23 php-travel-agency-system delete.php sql injection
A vulnerability was identified in oretnom23 php-travel-agency-system. This affects an unknown part of the file admin/delete.php. The manipulation of the argument costomer_id/ticket_id/payment_id/id/document_id/salary_id/emp_id/user_id le…
CVE-2026-114380Medium· 6.3PoCitsourcecode Online Cake Ordering System inserttrans.php sql injection
A vulnerability was found in itsourcecode Online Cake Ordering System 1.0. Impacted is an unknown function of the file /inserttrans.php. Performing a manipulation of the argument prcd results in sql injection. The attack is possible to b…
CVE-2026-96636Medium· 6.5PoCPillow: Decompression-bomb protection bypass via multi-frame seek() in MPO and DCX (MpoImageFile.seek / DcxImageFile.seek)
Pillow is a Python imaging library. Prior to 13.0.0, MpoImageFile.seek() and DcxImageFile.seek() reparse later MPO or DCX frames and replace self._size without rerunning Image._decompression_bomb_check(). A crafted multi-frame image can …
CVE-2026-114501Medium· 6.3PoCPillow: Arrow export leaks stale heap memory when PILLOW_ALIGNMENT > 1
Pillow is a Python imaging library. From 11.2.1 until 13.0.0, Arrow export assumes that an image's rows are tightly contiguous and exports from im->blocks[0].ptr even when PILLOW_ALIGNMENT makes aligned_linesize include row padding or an…
CVE-2026-114381Medium· 6.3PoCitsourcecode Online Cake Ordering System orderdetail.php sql injection
A vulnerability was determined in itsourcecode Online Cake Ordering System 1.0. The affected element is an unknown function of the file /orderdetail.php. Executing a manipulation of the argument ID can lead to sql injection. The attack m…
CVE-2026-91403Critical· 9.1PoC⚖ disputedVulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE)
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Supported versions that are affected are Oracle Java SE: 8u511, 8u511-perf, 11.0.33, 17.0.21, 21…
CVE-2026-114382Critical· 10.0PoCTOTOLINK EX200 lan.so cstecgi.cgi setStaticDhcpConfig stack-based overflow
A security flaw has been discovered in TOTOLINK EX200 5.2.3c.7200. This affects the function setStaticDhcpConfig of the file /cgi-bin/cstecgi.cgi of the component lan.so. The manipulation of the argument Comment results in stack-based bu…
CVE-2026-114383Critical· 10.0PoCTOTOLINK EX200 wireless.so cstecgi.cgi setWiFiAclAddConfig stack-based overflow
A weakness has been identified in TOTOLINK EX200 5.2.3c.7200. This impacts the function setWiFiAclAddConfig of the file /cgi-bin/cstecgi.cgi of the component wireless.so. This manipulation of the argument macAddress causes stack-based bu…
CVE-2026-114509Critical· 9.2PoCLaravel TokenGuard authentication bypass through non-string API credentials
Laravel is a web application framework. Prior to 12.68.0 and 13.29.0, TokenGuard configured as a standard token-based API guard does not reject a crafted non-string credential. Under affected MySQL or MariaDB configurations, the authenti…
CVE-2026-114138High· 7.5PoCDjango REST framework: Accept header with many large quoted parameters burns ~19s of CPU per request in content negotiation
Django REST framework is a toolkit for building Web APIs. Prior to 3.18.2, DefaultContentNegotiation.get_accept_list in rest_framework/negotiation.py accepts an unbounded number and aggregate size of Accept tokens, while select_renderer …
CVE-2026-114377Low· 3.8PoCleomoon-studios wiki-go Comment Deletion comments.go DeleteComment path traversal
A security vulnerability has been detected in leomoon-studios wiki-go up to 1.9.1. Affected by this issue is the function DeleteComment of the file internal/comments/comments.go of the component Comment Deletion Handler. The manipulation…
CVE-2026-114140High· 8.8PoCnbconvert: File write via path traversal in cell output filenames
The nbconvert tool, jupyter nbconvert, converts Jupyter notebooks to various other formats via Jinja templates. From 5.4.0 until 7.17.2, ExtractOutputPreprocessor in nbconvert/preprocessors/extractoutput.py joins the attacker-controlled …
CVE-2026-114378Medium· 6.3PoCitsourcecode Online Cake Ordering System deleteproduct.php sql injection
A vulnerability was detected in itsourcecode Online Cake Ordering System 1.0. This affects an unknown part of the file /deleteproduct.php. The manipulation of the argument ID results in sql injection. The attack may be launched remotely.…