Tagged “exploit-available”
CVEs tagged exploit-available, newest first.
7561 CVEsRSS
CVE-2026-114396High· 7.1PoCTrudesk through 1.2.11 MongoDB $where Injection via tickets search API
Trudesk through 1.2.11 contains a server-side JavaScript injection vulnerability that allows authenticated users to inject code into a MongoDB $where clause via the search parameter. Attackers can close the regular expression in GET /api…
CVE-2026-114395Medium· 4.3PoCTrudesk through 1.2.11 Authorization Bypass via /api/v1/messages/send
Trudesk through 1.2.11 contains an authorization bypass vulnerability in apiMessages.send that allows authenticated users to post messages as other users due to an incomplete CVE-2022-1931 fix. Attackers can supply arbitrary owner and cI…
CVE-2026-114397High· 7.4PoCTrudesk through 1.2.11 Missing Authentication on Debug Routes
Trudesk through 1.2.11 contains a missing authentication vulnerability in debug routes enabled whenever NODE_ENV is unset, letting unauthenticated attackers invoke them remotely. Attackers can call /debug/populatedb to delete all groups,…
CVE-2026-114401Medium· 5.3PoCTrudesk through 1.2.11 Username Enumeration via Regex Injection in /api/v1/login
Trudesk through 1.2.11 contains a regular expression injection vulnerability that allows unauthenticated attackers to enumerate usernames by submitting regex patterns to POST /api/v1/login. Attackers can send alternations or prefixes lik…
CVE-2026-114400Medium· 5.9PoCTrudesk through 1.2.11 Missing Authentication for Ticket Attachments via /uploads
Trudesk through 1.2.11 contains a missing authentication vulnerability that allows unauthenticated attackers to download private ticket attachments under /uploads. Because express.static serves the public/ directory before the hasAuth-gu…
CVE-2026-114402Medium· 4.3PoCTrudesk through 1.2.11 Path Traversal and Authorization Bypass via Profile Image Upload
Trudesk through 1.2.11 contains a path traversal and authorization bypass vulnerability in accountsController.uploadImage that allows authenticated users to overwrite other users' avatars via form-supplied _id and username fields. Attack…
CVE-2026-114403High· 8.1PoCPHPOffice PHPPresentation through 1.2.0 Deserialization via Reader\Serialized::load
PHPOffice PHPPresentation through 1.2.0 contains an insecure deserialization vulnerability that allows attackers to instantiate arbitrary PHP objects by supplying a crafted presentation file. Attackers can upload a ZIP containing PhpPres…
CVE-2026-114245High· 7.3PoCdhikshitha29 Insurance-Management-System Add New Admin Form Admin-Register-inc.php improper authorization
A weakness has been identified in dhikshitha29 Insurance-Management-System 91de5edda5baa109ad8e9baf03ce6a3ceda84183/125362cc21dca20d74091a4913a5096bb58dd837. Affected by this issue is some unknown functionality of the file /Admin/include…
CVE-2026-94300High· 8.1PoCConcurrent GSS-TSIG messages corrupt memory
Replaying GSS-TSIG signed UDP messages can result in memory corruption in "`named`". An attacker who can capture a previously signed UDP message can replay it while the negotiated TSIG key is still valid. By also sending crafted queries…
CVE-2026-97206High· 7.5PoCDNS-over-QUIC (DoQ) path-migration can lead to use-after-free on multi-threaded deployments.
NLnet Labs Unbound, 1.22.0 up to and including version 1.26.1, contains a DNS-over-QUIC (DoQ) lifetime bug reachable by a remote DoQ client under multi-threaded operation. A client-triggered QUIC path migration can enter stream/connectio…
CVE-2026-110899High· 7.1PoCWordPress Ninja Forms plugin <= 3.15.5 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kevin Stover Ninja Forms ninja-forms allows Stored XSS.This issue affects Ninja Forms: from n/a through 3.15.5.
CVE-2026-114040Low· 3.5PoCDT42 BerryNet Model Package Metadata dlmodelmgr.py DLModelManager.get_model_meta path traversal
A security vulnerability has been detected in DT42 BerryNet up to 3.10.2. The affected element is the function DLModelManager.get_model_meta of the file berrynet/dlmodelmgr.py of the component Model Package Metadata Handler. The manipula…
CVE-2026-114039Medium· 6.3PoCprojectworlds Advanced Library Management System report_search.php mysqli_query sql injection
A weakness has been identified in projectworlds Advanced Library Management System 1.0. Impacted is the function mysqli_query of the file report_search.php. Executing a manipulation of the argument dateto/datefrom can lead to sql injecti…
CVE-2026-92822Medium· 6.2PoCLibmodulemd: libmodulemd: unbounded recursion when parsing nested xmd yaml
A flaw was found in libmodulemd. When parsing module metadata, the xmd field is converted into nested GVariant values through recursive YAML mapping and sequence helpers without a recursion-depth or node-count limit. An attacker who can …
CVE-2026-71195Critical· 9.9PoCIn OpenStack Manila before 23.0.1, multiple Manila API operations on public shares do not verify that the caller owns the share
In OpenStack Manila before 23.0.1, multiple Manila API operations on public shares do not verify that the caller owns the share. The API controllers authorize operations against the caller's own project context, then load a foreign publi…
CVE-2026-93856Medium· 4.3PoCIn OpenStack Cinder through 29.0.0, cross-project information disclosure can occur in the Messages API
In OpenStack Cinder through 29.0.0, cross-project information disclosure can occur in the Messages API. A non-admin user with the project-scoped 'member' or 'reader' role making the Block Storage API v3.3 "List messages" call finds the n…
CVE-2026-113736Critical· 9.8PoCD-Link DHP-W610AV HNAP Login defaultvalue.xml login_prepare_hnap empty password
A vulnerability has been found in D-Link DHP-W610AV 1.02EUb03. The impacted element is the function login_prepare_hnap of the file etc/defnodes/defaultvalue.xml of the component HNAP Login. The manipulation of the argument Password leads…
CVE-2026-113737Medium· 5.5PoCR6410418 Jackrong-llm-finetuning-guide qwen_mtp_gguf_pipeline.py validate_indexed_tensors path traversal
A flaw has been found in R6410418 Jackrong-llm-finetuning-guide up to ef2b17f2798cd18cd85375080c35a58397ad0d09. This affects the function validate_indexed_tensors of the file qwen-mtp-gguf/scripts/qwen_mtp_gguf_pipeline.py. Executing a m…
CVE-2026-113738Medium· 6.3PoCR6410418 Jackrong-llm-finetuning-guide MTP weight_map qwen_mtp_gguf_pipeline.py extract_mtp_heads path traversal
A vulnerability has been found in R6410418 Jackrong-llm-finetuning-guide up to ef2b17f2798cd18cd85375080c35a58397ad0d09. This vulnerability affects the function extract_mtp_heads of the file qwen-mtp-gguf/scripts/qwen_mtp_gguf_pipeline.p…
CVE-2026-114046Medium· 6.5PoCFreeRDP 3.0.0 before 3.32.0 null-pointer dereference via emulated smartcard
FreeRDP 3.0.0 before 3.32.0 contains a null-pointer dereference in the smartcard emulation backend that accepts a null per-reader name in SCardGetStatusChange requests. A malicious RDP server can send a crafted reader-state entry with a …
CVE-2026-114042Medium· 6.5PoCFreeRDP 3.32.0 Use-After-Free via drdynvc Virtual Channel PDU
FreeRDP 3.32.0 contains a use-after-free vulnerability in the drdynvc channel that frees a pool-owned stream with the owned-stream deallocator when totalLength is smaller than the chunk size. A malicious RDP server can send a single well…
CVE-2026-114043Medium· 6.5PoCVulnerability in FreeRDP
FreeRDP before 3.32.1 contains a heap-based out-of-bounds read in WinPR's clipboard PNG-to-CF_DIB synthesis because winpr_read_png_from_buffer() allocates a bit-packed buffer for PNGs with bit depth below 8, while winpr_bitmap_write_buff…
CVE-2026-114048Low· 3.5PoCWWBN AVideo before 24.0 CSRF via Legacy Playlist and Video Endpoints
WWBN AVideo before 24.0 contains a cross-site request forgery vulnerability in legacy endpoints like playlistStatus.php that bypass the .json.php-only autoCSRFGuard() check. Attackers can lure logged-in users to a page with an auto-submi…
CVE-2026-114057Medium· 4.3PoCArcadeDB 26.2.1 before 26.10.1 Bolt SHOW DATABASES Information Disclosure
ArcadeDB from 26.2.1 before 26.10.1 contains a missing authorization vulnerability in the Bolt protocol handler that allows authenticated users to enumerate all database names. Attackers with credentials for any single database can issue…
CVE-2026-114056Medium· 4.3PoCArcadeDB from 26.8.1 before 26.10.1 Authorization Bypass via ALTER TYPE WITH
ArcadeDB from 26.8.1 before 26.10.1 contains an authorization bypass vulnerability that allows read-only users to modify edge type lightweight and unique schema flags without UPDATE_SCHEMA permission. Attackers can send a bare ALTER TYPE…
CVE-2026-114064Medium· 5.5PoCSnipe-IT before 8.7.0 SSRF Port Scanning via Webhook Testing Endpoint
Snipe-IT before 8.7.0 contains a server-side request forgery vulnerability in the webhook testing feature that allows super-admin users to probe internal network addresses, including loopback and RFC1918 ranges. Attackers can point webho…
CVE-2026-114059High· 7.5PoCArcadeDB before 26.10.1 RCE via Gremlin Groovy Engine Missing Authorization
ArcadeDB before 26.10.1 contains a remote code execution vulnerability that allows authenticated users, including read-only reader role holders, to execute Groovy code because GremlinQueryEngine.command() lacks scripting authorization ch…
CVE-2026-114058Medium· 4.3PoCArcadeDB from 26.2.1 before 26.10.1 Missing Authorization via Bolt Protocol
ArcadeDB from 26.2.1 before 26.10.1 contains a missing authorization vulnerability in the Bolt protocol handler that lets authenticated users read other databases' schema metadata. Attackers with credentials for one database can set the …
CVE-2026-114068High· 8.3PoCTrigger.dev before 4.6.0 Missing Authorization via Waitpoint Token Wait Endpoint
Trigger.dev before 4.6.0 contains a missing authorization vulnerability in the waitpoint token wait endpoint that allows authenticated attackers to block runs belonging to other organizations. Attackers holding any secret API key can sup…
CVE-2026-114067Medium· 6.5PoCTrigger.dev 4.5.0 before 4.6.2 Improper Authorization via snapshot-url Session Route
Trigger.dev 4.5.0 before 4.6.2 contains an improper authorization vulnerability in the PUT snapshot-url session endpoint that allows public session token holders to obtain presigned S3 write URLs. End users can overwrite their own sessio…