Tagged “exploit-available”
CVEs tagged exploit-available, newest first.
8808 CVEsRSS
CVE-2026-111943Medium· 6.8PoCDistrust compromised intermediate certificates in crypto/x509
On most platforms, Go uses the given system root certificates. However, in some narrower cases, the system trust stores may not be updated without further action. To defend against the narrower set of cases that may remain affected, a de…
CVE-2026-113744Critical· 10.0PoCTenda AC19 httpd Web Management Service SetFirewallCfg formSetFirewallCfg stack-based overflow
A security vulnerability has been detected in Tenda AC19 16.03.10.07. The impacted element is the function formSetFirewallCfg of the file /goform/SetFirewallCfg of the component httpd Web Management Service. Such manipulation of the argu…
CVE-2026-113722High· 7.8PoCvirtualenv: Generated POSIX console launchers interpret destination paths as shell syntax
virtualenv: Generated POSIX console launchers interpret destination paths as shell syntax
CVE-2026-113724Medium· 4.5PoCvirtualenv: Deletion recovery can change a symlink target's mode
virtualenv: Deletion recovery can change a symlink target's mode
CVE-2026-113711High· 7.5PoCApostropheCMS: Unauthenticated resource exhaustion via pre-auth aposBigUpload processing in @apostrophecms/import-export
ApostropheCMS: Unauthenticated resource exhaustion via pre-auth aposBigUpload processing in @apostrophecms/import-export
CVE-2026-112958Medium· 5.4PoCApostropheCMS: Stored XSS via Unescaped Widget Style Attribute Serialization
ApostropheCMS: Stored XSS via Unescaped Widget Style Attribute Serialization
CVE-2026-112946Medium· 6.3PoCVite: Files outside `server.fs.allow` could be served when project paths match system paths on non-Windows machine
Vite: Files outside `server.fs.allow` could be served when project paths match system paths on non-Windows machine
CVE-2026-112951Medium· 5.4PoCApostropheCMS: Color field validation bypass allows stored XSS via HTML appended after rgb()/hsl() prefix
ApostropheCMS: Color field validation bypass allows stored XSS via HTML appended after rgb()/hsl() prefix
CVE-2026-112953Medium· 6.0PoCApostropheCMS: Exposure of Sensitive Information via predictable export filenames
ApostropheCMS: Exposure of Sensitive Information via predictable export filenames
CVE-2026-112900Critical· 9.2PoCPillow: Argument Injection in Ghostscript call, potentially leading into RCE
Pillow: Argument Injection in Ghostscript call, potentially leading into RCE
CVE-2026-112894High· 7.5PoCPillow: Quadratic-time DoS in PDF save_all (PdfParser.next_object_id)
Pillow: Quadratic-time DoS in PDF save_all (PdfParser.next_object_id)
CVE-2026-112390High· 7.5PoCPillow: Infinite loop in MIC n_frames when the embedded TIFF
Pillow: Infinite loop in MIC n_frames when the embedded TIFF
CVE-2026-112394Medium· 8.2PoCPillow: P;2L and P;4L decoders may read 1 to 3 bytes past the passed buffer size
Pillow: P;2L and P;4L decoders may read 1 to 3 bytes past the passed buffer size
CVE-2026-112393Critical· 9.2PoCPillow: Heap buffer overflow in _tiffWriteProc when saving TIFF to BytesIO
Pillow: Heap buffer overflow in _tiffWriteProc when saving TIFF to BytesIO
CVE-2026-112392High· 7.5PoCPillow: NULL dereference in ImagingExpand via rank filters on zero-size images
Pillow: NULL dereference in ImagingExpand via rank filters on zero-size images
CVE-2026-112405High· 7.5PoCPillow: NULL pointer dereference in Image.merge via an unvalidated band 0
Pillow: NULL pointer dereference in Image.merge via an unvalidated band 0
CVE-2026-112402High· 7.5PoCPillow: Double free in ImagingScaleAffine on calloc failure via Image.transform
Pillow: Double free in ImagingScaleAffine on calloc failure via Image.transform
CVE-2026-113735Low· 3.7PoCD-Link DCS-6501LH aoni_ipc mydlink_set_root_pwd weak credentials
A vulnerability was determined in D-Link DCS-6501LH 3.03.02. Affected by this vulnerability is the function mydlink_set_root_pwd of the file /mnt/mtd/aoni_ipc. Executing a manipulation can lead to use of weak credentials. The attack may …
CVE-2025-60494Medium· 5.5PoCA segmentation violation in the gf_props_equal_internal function (/filter_core/filter_props.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) via supplying a crafted data file.
A segmentation violation in the gf_props_equal_internal function (/filter_core/filter_props.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) via supplying a crafted data file.
CVE-2026-101678Medium· 4.3PoCVulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/J)
Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/J). The supported version that is affected is 26.7.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple…
CVE-2026-101767Critical· 9.8PoCVulnerability in the Oracle Application Object Library product of Oracle E-Business Suite (component: Core)
Vulnerability in the Oracle Application Object Library product of Oracle E-Business Suite (component: Core). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with …
CVE-2026-108518Low· 2.9PoCDBI versions before 1.656 for Perl crash via type confusion in dbi_profile when a database handle is destroyed under a Profile Path with an {attr} element
DBI versions before 1.656 for Perl crash via type confusion in dbi_profile when a database handle is destroyed under a Profile Path with an {attr} element. An {attr} element names a database handle attribute, which dbi_profile reads fro…
CVE-2026-113731Low· 3.3PoCdjust: Arbitrary absolute-path file read in the find_handlers_for_template MCP tool
djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. From 0.9.0 until 1.0.10, 1.1.7, 1.2.4, and 1.3.0rc8, the find_handlers_for_template MCP tool in python/djust/mcp/server.py acc…
CVE-2025-60475Medium· 5.5PoCA buffer overflow in the gf_ac4_parser_bs function (/media_tools/av_parsers.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) via supplying a crafted input.
A buffer overflow in the gf_ac4_parser_bs function (/media_tools/av_parsers.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) via supplying a crafted input.
CVE-2026-87861Critical· 9.1PoCcross-origin reuse of a Negotiate connection
When using ambient user credentials, an HTTP request directed to one origin may be dispatched over a connection previously authenticated via Negotiate for a different origin, leaving the request's intended credentials unused.
CVE-2026-86414Critical· 9.1PoCleaking host credentials to HTTP proxy
An HTTP proxy can trick libcurl into sending the origin's credentials (Basic password, or a Negotiate/Kerberos ticket) to the proxy itself, by answering the `CONNECT` tunnel request with 401 `WWW-Authenticate:` instead of the expected 40…
CVE-2026-87864High· 8.1PoCIMAP APPEND plus CRLF conversion command injection
Enabling `CURLOPT_CRLF` causes curl to advertise the raw input byte count in the `IMAP APPEND {N}` literal while transmitting line-ending expanded data. The server reads only $N$ bytes for the payload, causing the remaining overflow byte…
CVE-2026-87863High· 8.1PoCHSTS response erases persisted entries
An authenticated HTTPS origin can supply an HSTS `max-age` value that the parser accepts, but time serialization later fails to process. On 64-bit systems, extreme max-age values compute an absolute expiry within standard time integer li…
CVE-2026-87862High· 8.1PoCHSTS cache import drops longer-lived child
Importing a `includeSubDomains` parent HSTS entry before a longer-lived child entry, silently drops the child. Consequently, when the parent expires, the child's valid HSTS policy is lost, causing curl to issue unencrypted HTTP requests …
CVE-2026-92386High· 8.1PoCserver-set cookie aborts cookie jar load
When writing a long cookie name and value to a Netscape cookie jar, a remote HTTP server can make `curl` write a record that exceeds its line-length parsing limit. Consequently, any subsequent `curl` invocation reading from that same coo…