Tagged “exploit-available”
CVEs tagged exploit-available, newest first.
8808 CVEsRSS
CVE-2026-112264High· 7.8PoCBentoML through 1.4.39 Dockerfile Instruction Injection via docker.env Keys
BentoML through 1.4.39 contains a Dockerfile instruction injection vulnerability that allows attackers to add arbitrary build instructions by embedding newlines in docker.env mapping keys rendered by the legacy base.j2 template. Attacker…
CVE-2026-112269Medium· 6.5PoCSGLang through 0.5.22 Memory Exhaustion via Unauthenticated Mooncake Decode Registrations
SGLang through 0.5.22 with the Mooncake disaggregation backend accepts unauthenticated decode registration messages on the Prefill rank ZMQ PULL socket, allowing denial of service. Network-adjacent attackers can send many registrations w…
CVE-2026-112268Medium· 6.3PoCsglang-router through 0.3.2 Authorization Bypass via Mesh HA Management Routes
sglang-router (sgl-model-gateway) through 0.3.2 contains an authorization bypass vulnerability that allows holders of the data-plane API key to access mesh HA management routes because /ha/* endpoints skip control-plane Admin role checks…
CVE-2026-112273Medium· 5.3PoClibtins through 4.6 Heap Out-of-Bounds Read via DNS::compose_name
libtins through 4.6 contains a heap out-of-bounds read vulnerability in DNS::compose_name in src/dns.cpp that allows remote attackers to read past the packet buffer by sending a label ending exactly at the packet end. Attackers can deliv…
CVE-2026-112272Medium· 5.5PoClibdisplay-info 0.4.0 Heap Out-of-Bounds Read via DisplayID v2 Parser
Libdisplay-info 0.4.0 contains a heap out-of-bounds read vulnerability in the DisplayID v2 section parser in displayid2.c that allows attackers to read past the EDID buffer via oversized data block lengths. Attackers can supply a crafted…
CVE-2026-112277Medium· 6.5PoCrdesktop through 1.9.0 Heap Out-of-Bounds Read via process_plane
rdesktop through 1.9.0 contains a heap out-of-bounds read vulnerability in process_plane() in bitmap.c that allows malicious RDP servers to crash clients by sending malformed 32 bpp compressed bitmaps. Attackers can declare a large bitma…
CVE-2026-112274Low· 3.7PoClibtins through 4.6 Out-of-Bounds Read via DNS::soa_record::init
libtins through 4.6 contains an out-of-bounds read vulnerability in DNS::soa_record::init that allows remote attackers to read past buffer bounds by supplying SOA data lacking NUL terminators. Attackers can feed raw SOA RDATA without a z…
CVE-2026-112283Medium· 5.5PoClibbluray through 1.5.1 Uncontrolled Memory Allocation via _parse_extent_start_points
VideoLAN libbluray through 1.5.1 contains an uncontrolled memory allocation vulnerability in _parse_extent_start_points() in clpi_parse.c that trusts the num_point field without bounds checking. Attackers can supply a crafted .clpi file …
CVE-2026-112279Medium· 6.5PoCrdesktop through 1.9.0 Heap Out-of-Bounds Read via process_bmpcache2
rdesktop through 1.9.0 contains a heap out-of-bounds read vulnerability in process_bmpcache2() in orders.c that allows malicious RDP servers to crash clients via crafted revision-2 bitmap cache orders. Attackers can send an uncompressed …
CVE-2026-112278Medium· 6.5PoCrdesktop through 1.9.0 Heap Out-of-Bounds Read via process_raw_bmpcache
rdesktop through 1.9.0 contains a heap out-of-bounds read vulnerability in process_raw_bmpcache() in orders.c that allows malicious RDP servers to crash clients. Attackers can send a raw bitmap cache order declaring large width, height, …
CVE-2026-112284Low· 3.3PoClibaribcaption 1.1.0 through 1.1.2 Out-of-Bounds Read via DecoderImpl::HandleGLGR
libaribcaption 1.1.0 through 1.1.2 contains a global out-of-bounds read in DecoderImpl::HandleGLGR() that reads past the 78-entry kLatinSpecialTable without an upper bound check. Attackers can supply crafted captions designating the Lati…
CVE-2026-112282Medium· 5.5PoCVideoLAN libbluray through 1.5.1 Out-of-Bounds Read via clpi_access_point
VideoLAN libbluray through 1.5.1 contains an out-of-bounds read vulnerability in clpi_access_point() that allows attackers to crash applications by supplying a ClipInfo file with an empty EP-map fine table. Attackers can place a crafted …
CVE-2026-112289Medium· 5.4PoCKoalixcrm through 1.14.0 Stored XSS via Task Title in Django Admin
Koalixcrm through 1.14.0 contains a stored cross-site scripting vulnerability that allows staff users to inject script by storing malicious task titles rendered unescaped by Task.link_to_task(). Attackers can embed HTML or script that ex…
CVE-2026-112146High· 7.4PoCD-Link E15/M32/R15/R32 MQTT Broker passwd hard-coded credentials
A vulnerability was detected in D-Link E15, M32, R15 and R32. This issue affects some unknown processing of the file /etc/emDaemon/passwd of the component MQTT Broker. The manipulation results in hard-coded credentials. It is possible to…
CVE-2026-112271Medium· 5.5PoClibdisplay-info through 0.4.0 Heap Out-of-Bounds Read via DisplayID v1 Parser
libdisplay-info through 0.4.0 contains a heap out-of-bounds read vulnerability in the DisplayID v1 section parser in displayid.c that occurs when a data block's declared length exceeds the section. Attackers can supply a crafted EDID fro…
CVE-2026-112147Medium· 5.3PoCai-genius-automations octoally index.ts information disclosure
A vulnerability was found in ai-genius-automations octoally up to 1.0.87. The impacted element is an unknown function of the file server/src/index.ts. Performing a manipulation of the argument path results in information disclosure. The …
CVE-2026-112276Medium· 6.1PoCNetpbm through 11.16.00 Heap Out-of-Bounds Read via rasttopnm Colormap
Netpbm through 11.16.00 contains a heap out-of-bounds read vulnerability in rasttopnm that allows attackers to read heap memory by supplying Sun rasterfiles with short colormaps. Attackers can craft colormapped rasterfiles with pixel byt…
CVE-2026-112281Medium· 6.1PoClibaribb24 through 1.0.3 Stack Buffer Overflow via decoder_handle_csi
libaribb24 (aribb24) through 1.0.3 contains a stack-based buffer overflow vulnerability in decoder_handle_csi() in src/decoder.c that allows attackers to write past a fixed 256-entry array by supplying unbounded CSI parameter bytes. Atta…
CVE-2026-112266Medium· 5.9PoCSGLang through 0.5.22 Cross-Request Abort via rid Prefix Matching
SGLang through 0.5.22 contains a denial of service vulnerability that allows API clients to abort other users' in-flight generation requests by supplying a short client-controlled rid. Attackers can submit streaming /generate requests wi…
CVE-2026-112141High· 7.3PoCsatya-vinay Events-Management-System Registration-Edit doedit.php mysqli_query sql injection
A vulnerability was determined in satya-vinay Events-Management-System up to 437c77ceb69bf9fe2e3f4f46f7871b83f425383a. Affected is the function mysqli_query of the file doedit.php of the component Registration-Edit Handler. This manipula…
CVE-2026-112142High· 7.3PoCsatya-vinay Events-Management-System Registration-Delete dodelete.php sql injection
A vulnerability was identified in satya-vinay Events-Management-System up to 437c77ceb69bf9fe2e3f4f46f7871b83f425383a. Affected by this vulnerability is an unknown functionality of the file dodelete.php of the component Registration-Dele…
CVE-2026-112143High· 7.3PoCsatya-vinay Events-Management-System missing authentication
A security flaw has been discovered in satya-vinay Events-Management-System up to 437c77ceb69bf9fe2e3f4f46f7871b83f425383a. Affected by this issue is some unknown functionality. Performing a manipulation results in missing authentication…
CVE-2026-79985High· 7.4PoCApache Camel: camel-smb resolved the remote path of a polled file from the name reported in the server directory listing without constraining it to the directory being polled, so a listing entry containing traversal segments could be moved outside
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache Camel SMB component. This issue affects Apache Camel: from 4.2.0 before 4.18.5, from 4.19.0 before 4.22.1. The Camel remote-file…
CVE-2026-79984High· 7.4PoCApache Camel: camel-mina-sftp resolved the remote path of a polled file from the name reported in the server directory listing without constraining it to the directory being polled, so a listing entry containing traversal segments could be moved outside
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache Camel Mina SFTP component. This issue affects Apache Camel: from 4.18.0 before 4.18.5, from 4.19.0 before 4.22.1. The Camel remo…
CVE-2026-80312High· 8.2PoCApache Camel: Camel-OAuth Authentication Bypass via Fail-Open Processors
Improper Authentication vulnerability in Apache Camel OAuth component. This issue affects Apache Camel: from 4.11.0 before 4.18.5, from 4.19.0 before 4.22.1. The camel-oauth processors that guard a route did not stop the exchange w…
CVE-2026-79986High· 7.4PoCApache Camel: camel-azure-files resolved the remote path of a polled file from the name reported in the server directory listing without constraining it to the directory being polled, so a listing entry containing traversal segments could be moved outside
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache Camel Azure Files component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. The Camel rem…
CVE-2026-83531High· 8.8PoCApache Camel: Camel-Dynamic-Router Control Endpoint Compiles Predicate Expressions Supplied by Control Messages
Improper Control of Generation of Code ('Code Injection'), Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection') vulnerability in Apache Camel. This issue affects Apache…
CVE-2026-80343High· 8.2PoCApache Camel: Camel-Netty-HTTP Security Constraint Bypass via Case-Sensitive Context-Path Matching
Improper Handling of Case Sensitivity vulnerability in Apache Camel Netty HTTP component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. The camel-netty-http security constraint compared the r…
CVE-2026-84176Medium· 6.5PoCApache Camel: Camel-Platform-HTTP-Vertx Cross-Origin Credential Exposure via Wildcard Origin Reflection
Permissive Cross-domain Policy with Untrusted Domains vulnerability in Apache Camel Platform HTTP Vertx component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. createCorsHandler() set Access-…
CVE-2026-80344High· 8.2PoCorg.apache.camel/camel-as2: Apache Camel AS2: Server-Side Request Forgery via unvalidated receipt destination (CVE-2026-80344)
A flaw was found in Apache Camel's AS2 (Applicability Statement 2) component. A remote attacker can trigger Server-Side Request Forgery (SSRF) by sending a message that specifies an arbitrary destination address for asynchronous delivery r…