Archive
August 2026
Vulnerabilities first published in this month (UTC), newest first.
5,333 results · Clear filters · Feed
-
High 7.5
Improper input validation in the HandleUpdate function (/sbi/parameter_provision.go) of free5gc v4.0.1 allows attackers…
-
High 7.5
An issue in the CreateUEContext handler component of free5gc v4.1.0 allows attackers to cause a Denial of Service (DoS)…
-
High 7.5
An integer overflow in the /nnrf-disc/v1/nf-instances component of open5gs v2.7.6 allows attackers to cause a Denial of…
-
High 7.5
A reachable assertion vulnerability in the /nsmf-pdusession/v1/sm-contexts component of Open5GS v2.7.6 allows attackers…
-
High 7.5
An issue in free5gc v4.0.1 allows attackers to cause a Denial of Service (DoS) when parsing crafted SUCI data during UE…
-
High 7.5
Improper Input Validation in the HTTPModifySubscription handler of free5gc v4.0.1 allows attackers to cause a Denial of…
-
High 7.5
An issue in the NGAP handler of free5gc v4.0.1 allows attackers to cause a Denial of Service (DoS) via a crafted NAS PD…
-
High 7.5
An issue in the HandleGetSharedData function of free5gc v4.0.1 allows attackers to cause a Denial of Service (DoS) via …
-
High 7.5
A NULL pointer dereference in the CDR processing path of free5gc v4.0.1 allows attackers to cause a Denial of Service (…
-
High 7.5
A NULL pointer dereference in the UDMC registration handler component of free5gc v4.0.1 allows attackers to cause a Den…
-
High 7.5
A vulnerability in pentestgpt/core/langfuse.py in PentestGPT 1.0.0 allows remote attackers to disclose sensitive user t…
-
High 7.5
An integer overflow in the SMF component of Open5GS v2.7.6 allows attackers to cause a Denial of Service (DoS) via supp…
-
High 8.1CVE-2026-37068 Public exploit
Arbitrary file write in /vfm-admin/index.php?section=translations&action=update in Veno File Manager Project 4.4.9 allo…
-
High 7.5
ccoap 77f55c4b466e99327c24ace8a2913d3ba7e2ccd5 lcontains a vulnerability in the option parsing logic that causes a segm…
-
High 7.5
A null pointer dereference vulnerability exists in the server-side session management logic of ccoap 77f55c4b466e99327c…
-
High 7.5
ccoap 77f55c4b466e99327c24ace8a2913d3ba7e2ccd5 contains a null pointer dereference vulnerability in the coap_server_han…
-
High 7.5
ccoap 77f55c4b466e99327c24ace8a2913d3ba7e2ccd5 contains a null pointer dereference vulnerability in the coap_dump_msg()…
-
High 8.8
An issue was discovered in luci-app-https-dns-proxy on OpenWrt PR #15 (< 2026-01-17). The setInitAction function in /us…
-
High 7.5
ccoap 77f55c4b466e99327c24ace8a2913d3ba7e2ccd5 contains a vulnerability in the option parsing logic that causes a segme…
-
High 7.3
ddfourtwo sentry-selfhosted-mcp raw_sentry_api server-side request forgery
A security flaw has been discovered in ddfourtwo sentry-selfhosted-mcp 0.4.0. The affected element is an unknown function of the component raw_sentry_api. The manipulation of the argument endpoint results in server-side request forgery. It is possible to laun…
-
High 7.5
Predictable cache directory location allows local ONNX model substitution in Spring AI
A local attacker on a multi-user host can pre-create the deterministic cache path and plant a malicious ONNX model file. Spring AI 2.0.0 Spring AI 1.1.0 - 1.1.8 Spring AI 1.0.0 - 1.0.9
-
High 7.5
Unbounded recursion over attacker-controlled PDF outline tree in Spring AI PDF Document Reader
Analyzing a PDF with a deeply nested or cyclic table of contents can cause a StackOverflowError in the ingestion thread. Spring AI 2.0.0 Spring AI 1.1.0 - 1.1.8 Spring AI 1.0.0 - 1.0.9
-
High 7.1
In OpenStack Keystone before 29.0.3, any authenticated user holding role:reader on any project can list every project-s…
-
High 8.7
Penpot: Stored XSS via comment content, innerHTML renders unsanitized HTML
Penpot is an open-source design and prototyping platform. In versions up to and including 2.14.3, Penpot is vulnerable to stored cross-site scripting through file comments, whose content is stored as raw text and rendered into the page with innerHTML without …
-
High 7.6
Penpot: Stored XSS via custom font family name injected into a @font-face style rule
Penpot is an open-source design and prototyping platform. In versions up to and including 2.14.3, Penpot is vulnerable to stored cross-site scripting through custom font family names, which are interpolated into a @font-face CSS rule and injected into the pag…
-
High 7.3
SourceCodester Simple Online Food Ordering System ajax.php login2 sql injection
A vulnerability has been found in SourceCodester Simple Online Food Ordering System 1.0. This affects an unknown function of the file /admin/ajax.php?action=login2. The manipulation of the argument email leads to sql injection. It is possible to initiate the …
-
High 7.7
Pterodactyl Wings SFTP write path does not enforce disk quota, allowing node-wide disk exhaustion
Wings is the server control plane for the Pterodactyl game-server management panel. In versions up to and including 1.13.2, the SFTP write path does not enforce a server's disk quota during a transfer, allowing a tenant with SFTP write access to a single serv…
-
High 8.6
LibreNMS: Remote Code Execution by Signal Alert Transportation Module
LibreNMS is a network monitoring system. In versions from 21.6.0 up to 26.5.0, the Signal alert transport is vulnerable to command injection because the signal-cli path and the Recipient field of an alert transport entry are insufficiently escaped before bein…
-
High 7.4
LimeSurvey Community Edition 7.0.5 - Reflected XSS in user activation confirmation endpoint
LimeSurvey Community Edition 7.0.5+260623 contains an authenticated reflected Cross-Site Scripting vulnerability in the user activation confirmation endpoint. The action query parameter is copied into the response and inserted into a hidden input attribute wi…
-
High 7.2
LimeSurvey Community Edition 7.0.5 - Stored XSS in quota message rendering
LimeSurvey Community Edition 7.0.5 contains a stored cross-site scripting vulnerability in the survey quota creation workflow. An authenticated low-privileged user who can create and manage their own survey can store malicious JavaScript in a quota message. T…
-
High 7.1
SeaweedFS: Authenticated S3 object-scope bypass in PutObjectAcl allows overwriting a different object with the same basename
SeaweedFS is a distributed storage system for files and blobs. In versions prior to 4.40, an authenticated S3 principal with permissions scoped to a nested object key can overwrite a different object outside that scope by calling PutObjectAcl on the key it is…
-
High 7.3
itsourcecode Payroll System CRUD Operation ajax.php delete missing authentication
A flaw has been found in itsourcecode Payroll System 1.0. The impacted element is the function create/read/update/delete of the file ajax.php of the component CRUD Operation Handler. Executing a manipulation of the argument action can lead to missing authenti…
-
High 8.1CVE-2026-43621 Public exploit
Simple Machines Forum < 2.1.7 Authorization Confusion via Profile::load()
Simple Machines Forum (SMF) through 2.1.7, fixed in commit 6f0dc61, contains an authorization state-confusion vulnerability in the profile loader that allows authenticated low-privileged users to gain administrator access by supplying multiple values for the …
-
High 8.1
SeaweedFS: SFTP path ACL literal prefix match permits cross-tenant file read and overwrite
SeaweedFS is a distributed storage system for files and blobs. In versions from 3.88 through 4.39, the SFTP server evaluates configured path permissions with a literal string-prefix comparison, so a user scoped to a path is also granted the same access to any…
-
High 8.5
A vulnerability allowing a low-privileged user to capture the NTLM credentials of the Reporter service account.
-
High 8.7CVE-2026-65647 Public exploit
Improper symlink resolution before file access in Plesk allows remote authenticated users to execute arbitrary code as …
-
High 8.6
Insecure direct object reference in Plesk 18.0.79.7 and earlier or 18.0.80 through 18.0.80.3, allows remote authenticat…
-
High 8.7
SeaweedFS S3 OIDC Bearer authentication bypasses IAM role trust policy
SeaweedFS is a distributed storage system for files and blobs. In versions 4.39 and earlier, the S3 API accepts an external OIDC JWT sent directly in the Authorization header and maps it to an IAM role without enforcing that role's trust policy, so a federate…
-
High 7.6
SeaweedFS: Authenticated Cross-Prefix IDOR in Filer TUS Handler Enables Arbitrary Write to Tenant-Forbidden Paths
SeaweedFS is a distributed storage system for files and blobs. In version 4.39, the filer's TUS resumable-upload handler checks JWT allowed_prefixes scoping only when a session is created, letting a low-privilege tenant hijack another tenant's upload session …
-
High 8.4
LimeSurvey 7.0.5 - Stored XSS in Survey Menu Entries
LimeSurvey Community Edition 7.0.5 contains a stored cross-site scripting vulnerability in the Survey Menu Entries administration page. An authenticated user with the global settings:read permission can create a survey menu entry containing attacker-controlle…