CVE-2026-89186: Schwachstellen-Eintrag (NVD)
Use of Cache Containing Sensitive Information in ZenHive mpp allows a shared HTTP cache to store a paid response and serve it to clients that never paid.
MPP.Plug.verify_credential in lib/mpp/plug.ex sets payment-receipt and cache-control: private on the connection before the wrapped application runs, and registers no register_before_send/2 callback. Plug.Conn.put_resp_header/3 replaces an existing header, so a mounting application that sets its own cache-control on the paid resource (for example public, max-age=3600) silently overrides the private the library relies on, and a CDN or reverse proxy can then store the paid 200 together with its Payment-Receipt and serve both to unpaid clients. The library-level guarantee is therefore defeatable by the application it protects. For the same reason a downstream non-2xx response still carried Payment-Receipt, issuing a receipt for a response that delivered no resource.
This issue affects mpp: from 0.1.0 before 0.16.2.
Zero-Day & Vulnerability Intelligence Hub
Echtzeit-Tracking mit EPSS Exploit-Wahrscheinlichkeiten, Angriffsvektor-Decodern und KI-Patch-Anleitungen.
📊 Historien-Charts — Criticals-Trend · Vendors · EPSS-Verteilung
| Tier | 2026-08-29 | 2026-09-16 |
|---|---|---|
| ≥90 % | 4 | 0 |
| ≥50 % | 4 | 0 |
| ≥10 % | 3 | 0 |
| <10 % | 304 | 300 |
CVE-2022-44180 | Tenda AC18 15.03.05.19 addWifiMacFilter buffer overflow (EUVD-2022-47130)
A vulnerability marked as critical has been reported in Tenda AC18 15.03.05.19. This impacts the function addWifiMacFilter. Performing a manipulation results in buffer overflow. This vulnerability was named CVE-2022-44180. The attack needs
CVE-2022-44178 | Tenda AC18 15.03.05.19 formWifiWpsOOB buffer overflow (EUVD-2022-47128)
A vulnerability labeled as critical has been found in Tenda AC18 15.03.05.19. This affects the function formWifiWpsOOB. Such manipulation leads to buffer overflow. This vulnerability is uniquely identified as CVE-2022-44178. The attack can
CVE-2022-44177 | Tenda AC18 15.03.05.19 formWifiWpsStart buffer overflow (EUVD-2022-47127)
A vulnerability was found in Tenda AC18 15.03.05.19 and classified as critical. This affects the function formWifiWpsStart. Such manipulation leads to buffer overflow. This vulnerability is documented as CVE-2022-44177. The attack requires
CVE-2022-44176 | Tenda AC18 15.03.05.19 fromSetRouteStatic buffer overflow (EUVD-2022-47126)
A vulnerability has been found in Tenda AC18 15.03.05.19 and classified as critical. Affected by this issue is the function fromSetRouteStatic. This manipulation causes buffer overflow. This vulnerability is registered as CVE-2022-44176. Th
CVE-2022-44175 | Tenda AC18 15.03.05.19 formSetMacFilterCfg buffer overflow (EUVD-2022-47125)
A vulnerability, which was classified as critical, was found in Tenda AC18 15.03.05.19. Affected by this vulnerability is the function formSetMacFilterCfg. The manipulation results in buffer overflow. This vulnerability is cataloged as CVE-
CVE-2022-44174 | Tenda AC18 15.03.05.05 formSetDeviceName buffer overflow (EUVD-2022-47124)
A vulnerability, which was classified as critical, has been found in Tenda AC18 15.03.05.05. Affected is the function formSetDeviceName. The manipulation leads to buffer overflow. This vulnerability is listed as CVE-2022-44174. The attack m
CVE-2022-44172 | Tenda AC18 15.03.05.19 R7WebsSecurityHandler buffer overflow (EUVD-2022-47122)
A vulnerability classified as critical was found in Tenda AC18 15.03.05.19. This impacts the function R7WebsSecurityHandler. Executing a manipulation can lead to buffer overflow. This vulnerability is tracked as CVE-2022-44172. The attack i
CVE-2022-44171 | Tenda AC18 15.03.05.19 form_fast_setting_wifi_set buffer overflow (EUVD-2022-47121)
A vulnerability classified as critical has been found in Tenda AC18 15.03.05.19. This affects the function form_fast_setting_wifi_set. Performing a manipulation results in buffer overflow. This vulnerability is identified as CVE-2022-44171.
CVE-2022-44169 | Tenda AC15 15.03.05.18 formSetVirtualSer buffer overflow (EUVD-2022-47119)
A vulnerability classified as critical has been found in Tenda AC15 15.03.05.18. Impacted is the function formSetVirtualSer. This manipulation causes buffer overflow. This vulnerability is tracked as CVE-2022-44169. The attack is only possi
CVE-2026-85013 | environment-modules Bash completion module names os command injection (Nessus ID 346025)
A vulnerability labeled as problematic has been found in environment-modules. The impacted element is an unknown function of the component Bash completion. Such manipulation of the argument module names leads to os command injection. This v
CVE-2026-59251 | Erlang OTP Certificate Path Validation pubkey_policy_tree.erl allocation of resources (Nessus ID 346027)
A vulnerability identified as problematic has been detected in Erlang OTP. Affected by this issue is the function pubkey_policy_tree:add_leaves/2/pubkey_policy_tree:add_leaf_siblings/2 of the file lib/public_key/src/pubkey_policy_tree.erl o
CVE-2026-73584 | SBLIM sblim-sfcb File temp file (Nessus ID 346028)
A vulnerability classified as very critical has been found in SBLIM sblim-sfcb. This impacts an unknown function of the component File Handler. Performing a manipulation results in insecure temporary file. This vulnerability is cataloged as
CVE-2026-58227 | Erlang OTP prior 27.3.4.15/28.5.0.4/29.0.4 Certificate ssl_certificate:handle_incomplete_chain/5 resource consumption (Nessus ID 346027)
A vulnerability was found in Erlang OTP. It has been classified as problematic. This vulnerability affects the function ssl_certificate:handle_incomplete_chain/5 of the component Certificate. The manipulation leads to resource consumption.
CVE-2026-73583 | sblim-sfcb IPC deserialization (Nessus ID 346028)
A vulnerability described as very critical has been identified in sblim-sfcb. This affects an unknown function of the component IPC. Such manipulation leads to deserialization. This vulnerability is listed as CVE-2026-73583. The attack may
Acronis Discloses Actively Exploited Privilege Escalation Bug in Its cPanel Backup Plugin
Acronis has confirmed that attackers are actively exploiting a high-severity security flaw in its backup plugin for cPanel and WebHost Manager (WHM), urging system administrators to install available patches without delay. The vulnerabili
CVE-2026-0141 | Google Android RtcpAppPacket.cpp decodeAppPacket out-of-bounds
A vulnerability, which was classified as critical, has been found in Google Android. This vulnerability affects the function decodeAppPacket of the file RtcpAppPacket.cpp. This manipulation causes out-of-bounds read. This vulnerability is t
CVE-2026-0144 | Google Android AocAudioCodec.cpp denial of service
A vulnerability, which was classified as critical, was found in Google Android. The impacted element is an unknown function of the file AocAudioCodec.cpp. Executing a manipulation can lead to denial of service. This vulnerability is tracked
CVE-2026-0130 | Google Android decodeRtcpChunk heap-based overflow
A vulnerability identified as critical has been detected in Google Android. Impacted is the function RtcpChunk::decodeRtcpChunk. The manipulation leads to heap-based buffer overflow. This vulnerability is uniquely identified as CVE-2026-013
CVE-2026-0134 | Google Android kernel Factory Reset recovery_ui.cpp information disclosure
A vulnerability has been found in Google Android kernel and classified as critical. This affects an unknown part of the file recovery_ui.cpp of the component Factory Reset Handler. This manipulation causes information disclosure. This vulne
CVE-2026-0158 | Google Android Camera permission
A vulnerability was found in Google Android. It has been classified as critical. This affects an unknown part of the component Camera. Performing a manipulation results in permission issues. This vulnerability is cataloged as CVE-2026-0158.
CVE-2026-0145 | Google Android keymint permission
A vulnerability has been found in Google Android and classified as critical. Affected by this vulnerability is an unknown functionality of the component keymint. This manipulation causes permission issues. This vulnerability is tracked as C
CVE-2026-0142 | Google Android avb_rsa.c iavb_parse_key_data out-of-bounds
A vulnerability, which was classified as critical, has been found in Google Android. This impacts the function iavb_parse_key_data of the file avb_rsa.c. The manipulation leads to out-of-bounds read. This vulnerability is referenced as CVE-
CVE-2026-0129 | Google Android decodeByePacket information disclosure
A vulnerability categorized as critical has been discovered in Google Android. This issue affects the function RtcpByePacket::decodeByePacket. Executing a manipulation can lead to information disclosure. This vulnerability is handled as CVE
CVE-2026-25550 | Seagull BarTender 2010/BarTender 2016/BarTender 2019 NET Remoting Service BtSystem.Service.exe WebClient missing authentication
A vulnerability, which was classified as critical, was found in Seagull BarTender 2010, BarTender 2016 and BarTender 2019. This affects the function WebClient of the file BtSystem.Service.exe of the component NET Remoting Service. The manip
CVE-2026-0136 | Google Android out-of-bounds
A vulnerability, which was classified as critical, has been found in Google Android. The affected element is an unknown function. Performing a manipulation results in out-of-bounds read. This vulnerability is identified as CVE-2026-0136. Th
CVE-2026-0157 | Google Android decodeRtcpHeader out-of-bounds
A vulnerability identified as critical has been detected in Google Android. Affected by this vulnerability is the function RtcpHeader::decodeRtcpHeader. Performing a manipulation results in out-of-bounds read. This vulnerability is known as
CVE-2026-0155 | Google Android ReadByteBuffer out-of-bounds
A vulnerability categorized as critical has been discovered in Google Android. Affected is the function ImsMediaBitReader::ReadByteBuffer. Such manipulation leads to out-of-bounds read. This vulnerability is traded as CVE-2026-0155. The att
CVE-2026-0140 | Google Android RtpPacket::decodePacket integer overflow
A vulnerability classified as critical was found in Google Android. This affects the function RtpPacket::decodePacket. The manipulation results in integer overflow. This vulnerability is identified as CVE-2026-0140. The attack can be execut
CVE-2026-76871 | Netcore NR255-V 1.5.130703 VPN Service mod_vpn_remote/plan.json information disclosure (CNNVD-2026-99798201)
A vulnerability described as problematic has been identified in Netcore NR255-V 1.5.130703. This affects an unknown part of the file mod_vpn_remote/plan.json of the component VPN Service. The manipulation results in information disclosure.
CVE-2026-56889 | Google Android kernel integer overflow (CNNVD-2026-99896098)
A vulnerability was found in Google Android kernel. It has been declared as critical. This affects an unknown function. Such manipulation leads to integer overflow. This vulnerability is uniquely identified as CVE-2026-56889. Local access i
CVE-2026-91990 | TornadoWeb Tornado up to 6.5.7 Multipart parse_multipart_form_data denial of service (CNNVD-2026-99924038)
A vulnerability, which was classified as problematic, has been found in TornadoWeb Tornado up to 6.5.7. This affects the function parse_multipart_form_data of the component Multipart Handler. Performing a manipulation results in denial of s
CVE-2026-58710 | Google Android Film Grain Decoding film_grain_dec.cc DecodeFilmGrainParams out-of-bounds write (CNNVD-2026-99990992)
A vulnerability categorized as very critical has been discovered in Google Android. Affected by this issue is the function DecodeFilmGrainParams of the file film_grain_dec.cc of the component Film Grain Decoding. Executing a manipulation ca
Check Point Vulnerability Lets Remote Hackers Gain Root Access Without Authentication
Check Point has released an urgent security fix for CVE-2026-91843, a critical stack-based buffer overflow that could let an unauthenticated remote attacker execute arbitrary code with root privileges on vulnerable security management and l
CVE-2026-73946 | Oracle Access Manager 12.2.1.4.0/14.1.2.1.0 Authentication Engine privileges management (EUVD-2026-79525)
A vulnerability was found in Oracle Access Manager 12.2.1.4.0/14.1.2.1.0. It has been classified as very critical. Affected by this vulnerability is an unknown functionality of the component Authentication Engine. Performing a manipulation
CVE-2026-73948 | Oracle WebCenter Portal 12.2.1.4.0/14.1.2.0.0 Composer privileges management (EUVD-2026-79302)
A vulnerability identified as critical has been detected in Oracle WebCenter Portal 12.2.1.4.0/14.1.2.0.0. This issue affects some unknown processing of the component Composer. This manipulation causes improper privilege management. The ide
CVE-2026-92401 | ChangeWeDer crm up to c07bd4c97141521af6475034bc58523beed51bbd improper authentication (EUVD-2026-80876)
A vulnerability classified as critical has been found in ChangeWeDer crm up to c07bd4c97141521af6475034bc58523beed51bbd. This vulnerability affects the function top.upstudy.crm.utils.LoginUserUtil.releaseUserIdFromCookie. The manipulation l
CVE-2026-73945 | Oracle Access Manager 12.2.1.4.0/14.1.2.1.0 Authentication Engine privileges management (EUVD-2026-79524)
A vulnerability marked as very critical has been reported in Oracle Access Manager 12.2.1.4.0/14.1.2.1.0. Affected by this vulnerability is an unknown functionality of the component Authentication Engine. The manipulation leads to improper
CVE-2026-73943 | Oracle Identity Manager 12.2.1.4.0/14.1.2.1.0 OIM Legacy UI improper authorization (EUVD-2026-79522)
A vulnerability was found in Oracle Identity Manager 12.2.1.4.0/14.1.2.1.0. It has been declared as problematic. This affects an unknown part of the component OIM Legacy UI. The manipulation results in improper authorization. This vulnerabi
CVE-2026-89026: Issabel-Framework offen für Remote-OS-Kommandos
LONDON (IT BOLTWISE) – Eine kritische Schwachstelle im Issabel-Framework (CVE-2026-89026, bis zu 9,8 im CVSS v3.1) wird aktiv ausgenutzt. Angreifer umgehen die Authentifizierung über eine hart codierte HS256-JWT-Signatur, um gültige Bearer-
CVE-2026-92568 | MLRun up to 1.11.0 WebhookNotification handler server-side request forgery (EUVD-2026-80814)
A vulnerability was found in MLRun up to 1.11.0. It has been classified as critical. Affected by this vulnerability is an unknown functionality of the component WebhookNotification handler. The manipulation leads to server-side request forg
CVE-2026-92566 | datageartech DataGear up to 6.0.0 Http Endpoint server-side request forgery (EUVD-2026-80812)
A vulnerability was found in datageartech DataGear up to 6.0.0 and classified as critical. Affected is an unknown function of the component Http Endpoint. Executing a manipulation can lead to server-side request forgery. This vulnerability
CVE-2026-92567 | TDuckCloud tduck-survey-form up to 5.0 /user/form/data/update authorization (EUVD-2026-80813)
A vulnerability marked as problematic has been reported in TDuckCloud tduck-survey-form up to 5.0. This vulnerability affects unknown code of the file /user/form/data/update. Performing a manipulation results in authorization bypass. This v
CVE-2026-92569 | opengoofy Hippo4j up to 1.5.0 ThreadPoolController clientAddress server-side request forgery (EUVD-2026-80815)
A vulnerability was found in opengoofy Hippo4j up to 1.5.0. It has been declared as problematic. Affected by this issue is some unknown functionality of the component ThreadPoolController. The manipulation of the argument clientAddress resu
CVE-2026-92570 | yogeshojha reNgine up to 2.2.0 GetFileContents API endpoint authorization (EUVD-2026-80816)
A vulnerability classified as problematic was found in yogeshojha reNgine up to 2.2.0. The affected element is the function GetFileContents of the component GetFileContents API endpoint. The manipulation results in authorization bypass. Thi
CVE-2026-92381 | PbootCMS up to 3.2.22 Template Rendering ContentController.php decode_string Title cross site scripting (Issue 69 / EUVD-2026-80820)
A vulnerability was found in PbootCMS up to 3.2.22. It has been rated as problematic. This affects the function decode_string of the file apps/admin/controller/content/ContentController.php of the component Template Rendering. This manipula
CVE-2026-92383 | PbootCMS up to 3.2.24 User Management UserController.php mod cross-site request forgery (Issue 70 / EUVD-2026-80832)
A vulnerability categorized as problematic has been discovered in PbootCMS up to 3.2.24. This vulnerability affects the function UserController::del/UserController::mod of the file apps/admin/controller/system/UserController.php of the comp
CVE-2026-31153 | Bynder 0.1.394 cross site scripting
A vulnerability classified as problematic was found in Bynder 0.1.394. This vulnerability affects unknown code. Executing a manipulation can lead to cross site scripting. This vulnerability is registered as CVE-2026-31153. It is possible to
CVE-2026-59243 | Apache Airflow FAB Provider up to 3.7.2 Azure AD OAuth Login signature verification
A vulnerability was found in Apache Airflow FAB Provider up to 3.7.2. It has been classified as critical. This vulnerability affects unknown code of the component Azure AD OAuth Login. Performing a manipulation results in improper verificat
CVE-2026-59245 | Apache Airflow up to 3.7.1 FAB Auth Manager resource_name dag_id permission
A vulnerability was found in Apache Airflow up to 3.7.1 and classified as problematic. This affects the function resource_name of the component FAB Auth Manager. Such manipulation of the argument dag_id leads to permission issues. This vuln
CVE-2026-49486 | Apache Airflow up to 3.15.0 FTP Provider FTPSHook.get_conn cleartext transmission
A vulnerability was found in Apache Airflow up to 3.15.0. It has been classified as problematic. The affected element is the function FTPSHook.get_conn of the component FTP Provider. Performing a manipulation results in cleartext transmissi
CVE-2026-58704 | Google Android Cellular Modem permission
A vulnerability was found in Google Android and classified as very critical. Affected by this vulnerability is an unknown functionality of the component Cellular Modem. Such manipulation leads to permission issues. This vulnerability is uni
CVE-2026-92239 | Mozilla Thunderbird up to 140.15/155 out-of-bounds (Nessus ID 346179)
A vulnerability was found in Mozilla Thunderbird up to 140.15/155. It has been declared as critical. This affects an unknown function. The manipulation results in out-of-bounds read. This vulnerability is identified as CVE-2026-92239. The a
CVE-2026-92238 | Mozilla Thunderbird up to 140.15 memory corruption (Nessus ID 346179)
A vulnerability was found in Mozilla Thunderbird up to 140.15. It has been classified as critical. The impacted element is an unknown function. The manipulation leads to memory corruption. This vulnerability is referenced as CVE-2026-92238.
CVE-2026-92240 | Mozilla Thunderbird up to 140.15/155 IMAP Response Parser out-of-bounds (Nessus ID 346179)
A vulnerability described as critical has been identified in Mozilla Thunderbird up to 140.15/155. Affected by this vulnerability is an unknown functionality of the component IMAP Response Parser. Executing a manipulation can lead to out-of
CVE-2022-44168 | Tenda AC15 15.03.05.18 fromSetRouteStatic buffer overflow (EUVD-2022-47118)
A vulnerability described as critical has been identified in Tenda AC15 15.03.05.18. This issue affects the function fromSetRouteStatic. The manipulation results in buffer overflow. This vulnerability is identified as CVE-2022-44168. The at
CVE-2022-44167 | Tenda AC15 15.03.05.18 formSetPPTPServer buffer overflow (EUVD-2022-47117)
A vulnerability marked as critical has been reported in Tenda AC15 15.03.05.18. This vulnerability affects the function formSetPPTPServer. The manipulation leads to buffer overflow. This vulnerability is referenced as CVE-2022-44167. The at
CVE-2022-44163 | Tenda AC21 16.03.08.15 formSetMacFilterCfg buffer overflow (EUVD-2022-47113)
A vulnerability labeled as critical has been found in Tenda AC21 16.03.08.15. This affects the function formSetMacFilterCfg. Executing a manipulation can lead to buffer overflow. The identification of this vulnerability is CVE-2022-44163. T
Notfall-Patch von Microsoft: Dringende <b>Windows</b>-Updates beheben schwere <b>Server</b>-Fehler
Die neuen Notfall-Patches stehen nun für Windows 10, Windows 11 sowie für die betroffenen Windows-Server-Versionen über den Microsoft Update-Katalog ... Weiterlesen
Notfall-Patch von Microsoft: Dringende <b>Windows</b>-Updates beheben schwere <b>Server</b>-Fehler
Nun reagiert der Software-Riese mit ungeplanten Notfall-Patches für Windows und Windows Server. Unabhängig und kostenlos dank Ihres Klicks ... Weiterlesen
CVE-2022-44158 | Tenda AC21 16.03.08.15 set_device_name buffer overflow (EUVD-2022-47108)
A vulnerability identified as critical has been detected in Tenda AC21 16.03.08.15. Affected by this issue is the function set_device_name. Performing a manipulation results in buffer overflow. This vulnerability was named CVE-2022-44158. T