Zero-Day & Vulnerability Intelligence Hub
Echtzeit-Tracking mit EPSS Exploit-Wahrscheinlichkeiten, Angriffsvektor-Decodern und KI-Patch-Anleitungen.
📊 Historien-Charts — Criticals-Trend · Vendors · EPSS-Verteilung
| Tier | CVEs | Anteil |
|---|---|---|
| ≥90 % | 720 | 0,2 % |
| ≥50 % | 3.224 | 0,9 % |
| ≥10 % | 22.123 | 6,0 % |
| <10 % | 343.410 | 92,9 % |
Your MCP Server Is the Attack Surface Now
Your MCP Server Is the Attack Surface Now October 2026 has been the worst month yet for Model Context Protocol security. Not because attackers discovered something new, but because they keep rediscovering the same flaws in server after serv
CVE-2026-78850 | Infor Matomo 5.11.2 SiteContentDetector information disclosure (EUVD-2026-102185)
A vulnerability was found in Infor Matomo 5.11.2. It has been rated as problematic. This issue affects some unknown processing of the component SiteContentDetector. This manipulation causes information disclosure. This vulnerability is hand
CVE-2026-110736 | godotengine Godot Engine up to 4.7.2 optimized translation loader optimized_translation.cpp get_message out-of-bounds (EUVD-2026-101289)
A vulnerability was found in godotengine Godot Engine up to 4.7.2. It has been declared as problematic. Impacted is the function OptimizedTranslation::get_message of the file core/string/optimized_translation.cpp of the component optimized
CVE-2026-85634 | Red Hat Fuse ContentRepositoryImpl ContentRepositoryImpl.copyExplodedContent path traversal (EUVD-2026-102164)
A vulnerability was found in Red Hat Fuse, JBoss Enterprise Application Platform, JBoss Enterprise Application Platform Expansion Pack and Single Sign-On. It has been classified as problematic. This affects the function ContentRepositoryImp
CVE-2026-78851 | Grav up to 2.0.6 GravExtension.php mediaDirFunc path traversal (EUVD-2026-102184)
A vulnerability was found in Grav up to 2.0.6 and classified as problematic. Affected by this issue is the function mediaDirFunc of the file GravExtension.php. Executing a manipulation can lead to path traversal. This vulnerability appears
CVE-2026-111096 | JetBrains TeamCity prior 2026.2/2026.1.4/2025.11.8 Build Log cross site scripting (EUVD-2026-102149)
A vulnerability was found in JetBrains TeamCity and classified as problematic. This impacts an unknown function of the component Build Log. Such manipulation leads to cross site scripting. This vulnerability is traded as CVE-2026-111096. Th
CVE-2026-97712 | Sonatype Nexus Repository up to 3.96.x privileges management (EUVD-2026-102155)
A vulnerability classified as critical has been found in Sonatype Nexus Repository up to 3.96.x. The impacted element is an unknown function. The manipulation leads to improper privilege management. This vulnerability is listed as CVE-2026-
CVE-2026-100351 | getkin kin-openapi up to 0.146.x Validation openapi3filter.ValidationHandler access control (EUVD-2026-102160)
A vulnerability was found in getkin kin-openapi up to 0.146.x. It has been declared as critical. Affected by this vulnerability is the function openapi3filter.ValidationHandler of the component Validation Handler. Executing a manipulation c
CVE-2022-46601 | TRENDnet TEW755AP 1.13B01 icp_setbg_img setbg_num stack-based overflow (EUVD-2022-49405)
A vulnerability identified as critical has been detected in TRENDnet TEW755AP 1.13B01. This vulnerability affects the function icp_setbg_img. The manipulation of the argument setbg_num leads to stack-based buffer overflow. This vulnerabilit
CVE-2022-46600 | TRENDnet TEW755AP 1.13B01 set_sta_enrollee_pin_24g wps_sta_enrollee_pin stack-based overflow (EUVD-2022-49404)
A vulnerability categorized as critical has been discovered in TRENDnet TEW755AP 1.13B01. This affects the function set_sta_enrollee_pin_24g. Executing a manipulation of the argument wps_sta_enrollee_pin can lead to stack-based buffer overf
CVE-2022-46599 | TRENDnet TEW755AP 1.13B01 icp_setlogo_img setlogo_num stack-based overflow (EUVD-2022-49403)
A vulnerability was found in TRENDnet TEW755AP 1.13B01. It has been rated as critical. Affected by this issue is the function icp_setlogo_img. Performing a manipulation of the argument setlogo_num results in stack-based buffer overflow. Thi
CVE-2026-97667 | Sonatype Nexus Repository up to 3.96.x Browse User Interface cross site scripting (EUVD-2026-102154)
A vulnerability marked as problematic has been reported in Sonatype Nexus Repository up to 3.96.x. Impacted is an unknown function of the component Browse User Interface. Performing a manipulation results in cross site scripting. This vulne
CVE-2026-73179 | Apache CXF up to 3.6.12/4.1.8/4.2.3 JPA OAuth2 Authorization Code Grant Provider race condition (EUVD-2026-95695 / WID-SEC-2026-3824)
A vulnerability classified as problematic was found in Apache CXF up to 3.6.12/4.1.8/4.2.3. The affected element is an unknown function of the component JPA OAuth2 Authorization Code Grant Provider. Executing a manipulation can lead to race
CVE-2026-97666 | Sonatype Nexus Repository up to 3.96.x ExtDirect Endpoint information disclosure (EUVD-2026-102153)
A vulnerability identified as problematic has been detected in Sonatype Nexus Repository up to 3.96.x. This vulnerability affects unknown code of the component ExtDirect Endpoint. This manipulation causes information disclosure. The identif
CVE-2026-97665 | Sonatype Nexus Repository up to 3.96.x NuGet Components improper authorization (EUVD-2026-102152)
A vulnerability labeled as problematic has been found in Sonatype Nexus Repository up to 3.96.x. This issue affects some unknown processing of the component NuGet Components. Such manipulation leads to improper authorization. This vulnerabi
CVE-2026-78384 | Apache CXF up to 3.6.12/4.1.8/4.2.3 Compression Utils CompressionUtils.inflate resource consumption (EUVD-2026-95696 / WID-SEC-2026-3824)
A vulnerability was found in Apache CXF up to 3.6.12/4.1.8/4.2.3. It has been declared as problematic. Affected by this issue is the function CompressionUtils.inflate of the component Compression Utils. Executing a manipulation can lead to
Silent Lynx nutzt WinRAR-Fehler für Reverse-Shell-Zugriff in CIS-Regierungen
LONDON (IT BOLTWISE) – Ein Angreifer namens Silent Lynx soll über mehrere Jahre gezielt Regierungsorganisationen im CIS-Raum kompromittiert haben. In der aktuellen Vorgehensweise kombiniert das Cluster Makro-Dokumente, PS2EXE-Downloader und
CVE-2026-101942 | Juniper Junos OS/Junos OS Evolved Routing Protocol Daemon denial of service (WID-SEC-2026-3976)
A vulnerability identified as critical has been detected in Juniper Junos OS and Junos OS Evolved. This affects an unknown function of the component Routing Protocol Daemon. Performing a manipulation results in denial of service. This vulne
CVE-2026-101941 | Juniper Junos OS/Junos OS Evolved RPD null pointer dereference (WID-SEC-2026-3976)
A vulnerability labeled as critical has been found in Juniper Junos OS and Junos OS Evolved. This impacts an unknown function of the component RPD. Executing a manipulation can lead to null pointer dereference. This vulnerability is registe
CVE-2026-101940 | Juniper Networks Junos OS/Junos OS Evolved RPD null pointer dereference (WID-SEC-2026-3976)
A vulnerability categorized as critical has been discovered in Juniper Networks Junos OS and Junos OS Evolved. The impacted element is an unknown function of the component RPD. Such manipulation leads to null pointer dereference. This vulne
CVE-2026-101939 | Juniper Junos OS/Junos OS Evolved RPD null pointer dereference (WID-SEC-2026-3976)
A vulnerability labeled as critical has been found in Juniper Junos OS and Junos OS Evolved. This vulnerability affects unknown code of the component RPD. The manipulation results in null pointer dereference. This vulnerability is reported
CVE-2026-101938 | Juniper Networks Junos OS/Junos OS Evolved srxpfe integer underflow (WID-SEC-2026-3976)
A vulnerability was found in Juniper Networks Junos OS and Junos OS Evolved. It has been declared as critical. Impacted is an unknown function of the component srxpfe. The manipulation results in integer underflow. This vulnerability is ide
CVE-2026-101937 | Juniper Networks Junos OS up to 26.2R1-S1 srxpfe signed conversion (WID-SEC-2026-3976)
A vulnerability was found in Juniper Networks Junos OS up to 26.2R1-S1. It has been rated as critical. The affected element is an unknown function of the component srxpfe. This manipulation causes signed to unsigned conversion error. This v
CVE-2026-101936 | Juniper Networks Junos OS up to 26.2R1-S1 srxpfe assertion (WID-SEC-2026-3976)
A vulnerability was found in Juniper Networks Junos OS up to 26.2R1-S1. It has been classified as critical. This issue affects some unknown processing of the component srxpfe. The manipulation leads to reachable assertion. This vulnerabilit
CVE-2026-103226 | Artifex Ghostscript up to 10.07.0 Pdfwrite gdevpsfx.c type1_callsubr stack-based overflow (Bug 709672)
A vulnerability marked as critical has been reported in Artifex Ghostscript up to 10.07.0. Affected is the function type1_callsubr of the file devices/vector/gdevpsfx.c of the component Pdfwrite. The manipulation leads to stack-based buffer
CVE-2019-8457 | Oracle Berkeley DB up to 18.1 Data Store out-of-bounds (Nessus ID 236583 / ID 197482)
A vulnerability was found in Oracle Berkeley DB up to 18.1. It has been classified as problematic. Affected by this issue is some unknown functionality of the component Data Store. The manipulation leads to out-of-bounds read. This vulnerab
CVE-2019-5443 | cURL up to 7.65.1 OpenSSL Engine C:/usr/local/ code injection (BID-108881)
A vulnerability marked as critical has been reported in cURL up to 7.65.1. This affects an unknown function of the file C:/usr/local/ of the component OpenSSL Engine Handler. Performing a manipulation results in code injection. This vulnera
CVE-2019-12904 | Libgcrypt 1.8.4 AES cryptographic issue
A vulnerability identified as critical has been detected in Libgcrypt 1.8.4. Affected by this vulnerability is an unknown functionality of the component AES. Performing a manipulation results in cryptographic issues. This vulnerability is c
CVE-2019-12900 | Oracle Database Server up to 19c bzip2 out-of-bounds write (Nessus ID 210436)
A vulnerability was found in Oracle Database Server 11.2.0.4/12.1.0.2/12.2.0.1/18c/19c. It has been classified as critical. This vulnerability affects unknown code of the component bzip2. This manipulation causes out-of-bounds write. The id
CVE-2018-20843 | Oracle Hospitality RES 3700 up to 5.7.6 LibExpat denial of service (Nessus ID 213995)
A vulnerability classified as critical has been found in Oracle Hospitality RES 3700 up to 5.7.6. The affected element is an unknown function of the component LibExpat. Performing a manipulation results in denial of service. This vulnerabil
CVE-2026-109613 | Frappe ERPNext up to 15.120.x/16.33.x access control (EUVD-2026-98007)
A vulnerability categorized as problematic has been discovered in Frappe ERPNext up to 15.120.x/16.33.x. Impacted is an unknown function. Executing a manipulation can lead to improper access controls. The identification of this vulnerabilit
CVE-2026-21589 | Atlassian Bamboo Data Center path traversal (EUVD-2026-92807 / WID-SEC-2026-3755)
A vulnerability, which was classified as problematic, was found in Atlassian Bamboo Data Center, Bamboo Server, Bitbucket Data Center, Bitbucket Server, Confluence Data Center, Confluence Server, Crowd Data Center, Crowd Server, Crucible Da
CVE-2026-16436 | Mitsubishi Electric GENESIS up to 11.03/10.97.3 Password Recovery password recovery (EUVD-2026-101939)
A vulnerability was found in Mitsubishi Electric GENESIS, GENESIS32, GENESIS64, Hyper Historian, ICONICS Suite, IoTWorX, MC Works64, MobileHMI, BizViz and AnalytiX up to 11.03/10.97.3. It has been declared as critical. Affected by this vuln
CVE-2026-109621 | Frappe ERPNext up to 15.119.x/16.22.x authorization (EUVD-2026-98012)
A vulnerability classified as problematic has been found in Frappe ERPNext up to 15.119.x/16.22.x. Affected is an unknown function. Performing a manipulation results in authorization bypass. This vulnerability is cataloged as CVE-2026-10962
CVE-2026-100349 | kin-openapi is a Go project for handling OpenAPI files. Prior to 0.146.0, openapi3filter.ValidateResponse passes a nil response header schema to decodeValue when an OpenAPI document declares the header with content instead of schema. The document passes validation, but every response validation for the affected operation dereferences the nil schema and panics even when the response does not contain the declared header. Applications that ingest an untrusted s
kin-openapi is a Go project for handling OpenAPI files. Prior to 0.146.0, openapi3filter.ValidateResponse passes a nil response header schema to decodeValue when an OpenAPI document declares the header with content instead of schema. The do
CVE-2026-100350 | kin-openapi is a Go project for handling OpenAPI files. From 0.145.0 until 0.146.0, openapi3filter repeatedly calls regexp.MustCompile for the same parameter-name regular expression inside the per-query-key loop in urlValuesDecoder.DecodeObject used to decode a deepObject query parameter. An unauthenticated remote client can send an affected endpoint a request containing many unrelated query keys, causing ValidateRequest to perform work and allocations propo
kin-openapi is a Go project for handling OpenAPI files. From 0.145.0 until 0.146.0, openapi3filter repeatedly calls regexp.MustCompile for the same parameter-name regular expression inside the per-query-key loop in urlValuesDecoder.DecodeOb
CVE-2026-92982 | A flaw was found in Ansible Operator Plugins. A low-privileged Kubernetes user can exploit a Jinja2 template injection vulnerability by crafting malicious custom resource (CR) specification values. These values are processed by Ansible without proper sanitization, allowing embedded Jinja2 expressions to be executed within the operator pod. This can lead to arbitrary code execution and privilege escalation, granting the attacker control over the operator's ser
A flaw was found in Ansible Operator Plugins. A low-privileged Kubernetes user can exploit a Jinja2 template injection vulnerability by crafting malicious custom resource (CR) specification values. These values are processed by Ansible with
CVE-2026-100347 | kin-openapi is a Go project for handling OpenAPI files. Prior to 0.145.0, openapi3filter.ValidationHandler uses the routers/legacy router, which passes an unsupported or non-canonical HTTP method for an existing static path to openapi3.PathItem.GetOperation. The default branch of GetOperation panics before authentication runs, so an unauthenticated remote client can repeatedly send methods such as PROPFIND or lowercase get to abort connections and generate s
kin-openapi is a Go project for handling OpenAPI files. Prior to 0.145.0, openapi3filter.ValidationHandler uses the routers/legacy router, which passes an unsupported or non-canonical HTTP method for an existing static path to openapi3.Path
CVE-2026-100348 | kin-openapi is a Go project for handling OpenAPI files. Prior to 0.145.0, openapi3.Loader can dereference a nil SchemaRef.Value while resolving a self-referential additionalProperties JSON Reference such as a schema that points to its own additionalProperties member. Loading an attacker-controlled OpenAPI document through LoadFromData, LoadFromFile, or LoadFromURI reaches resolveComponent before document validation and can panic the loading process. Resolved
kin-openapi is a Go project for handling OpenAPI files. Prior to 0.145.0, openapi3.Loader can dereference a nil SchemaRef.Value while resolving a self-referential additionalProperties JSON Reference such as a schema that points to its own a
CVE-2026-110958 | A vulnerability was found in Wavlink WN530HG4B M30HG4B_V260724. The impacted element is an unknown function of the file api.cgi. The manipulation results in heap-based buffer overflow. It is possible to launch the attack remotely. The exploit has been made public and could be used. Upgrading to version 2026-09-24-841a51c6d5_tclinux.bin is sufficient to resolve this issue. The affected component should be upgraded. The vendor confirms: "We confirm the finding
A vulnerability was found in Wavlink WN530HG4B M30HG4B_V260724. The impacted element is an unknown function of the file api.cgi. The manipulation results in heap-based buffer overflow. It is possible to launch the attack remotely. The explo
CVE-2026-97394 | kin-openapi is a Go project for handling OpenAPI files. From 0.136.0 until 0.143.0, openapi3filter accepts OpenAPI 3.1 array schemas without an items keyword and then dereferences the nil Schema.Items value while decoding application/x-www-form-urlencoded or multipart/form-data request bodies, response headers, and other array parameter surfaces. A remote unauthenticated client can reach an affected operation with a nonempty request or matching response and d
kin-openapi is a Go project for handling OpenAPI files. From 0.136.0 until 0.143.0, openapi3filter accepts OpenAPI 3.1 array schemas without an items keyword and then dereferences the nil Schema.Items value while decoding application/x-www-
CVE-2026-45452 | Use of Externally-Controlled format string vulnerability in Unitronics Unitronics UniStream Pro/UniLogic. This issue affects Unitronics UniStream Pro/UniLogic: Unitronics UniStream Pro versions only (B10 / C10) – UniLogic versions prior to 1.41.329.
Use of Externally-Controlled format string vulnerability in Unitronics Unitronics UniStream Pro/UniLogic. This issue affects Unitronics UniStream Pro/UniLogic: Unitronics UniStream Pro versions only (B10 / C10) – UniLogic versions prior to
CVE-2026-71490 | OPNsense is a FreeBSD based firewall and routing platform. Prior to 26.1.11, OPNsense\Core\ACL::hasPrivilege() appends a directly assigned comma-separated <priv> value as one string and then uses an exact comparison when checking user-config-readonly. A user directly assigned both a component write privilege and user-config-readonly can therefore be treated as lacking the read-only restriction, and MVC APIs protected by throwReadOnly() can persist configurati
OPNsense is a FreeBSD based firewall and routing platform. Prior to 26.1.11, OPNsense\Core\ACL::hasPrivilege() appends a directly assigned comma-separated value as one string and then uses an exact comparison when checking user-config-read
CVE-2026-45451 | : Improper Authentication vulnerability in Unitronics Unitronics UniStream Pro/UniLogic. This issue affects Unitronics UniStream Pro/UniLogic: Unitronics UniStream Pro versions only (B10 / C10) – UniLogic versions prior to 1.41.329.
: Improper Authentication vulnerability in Unitronics Unitronics UniStream Pro/UniLogic. This issue affects Unitronics UniStream Pro/UniLogic: Unitronics UniStream Pro versions only (B10 / C10) – UniLogic versions prior to 1.41.329.
CVE-2026-63442 | OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, the unauthenticated WebGUI login usernamefld accepts carriage-return and line-feed characters that survive LOG_AUTH processing through syslog-ng-lockout.conf into the syslog-ng program destination feeding lockout_handler. The consumer's readline() processing treats an injected fragment as a separate authentication event and selects the first syntactically valid IP address fro
OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, the unauthenticated WebGUI login usernamefld accepts carriage-return and line-feed characters that survive LOG_AUTH processing through syslog-ng-lockout.co
CVE-2026-45450 | : Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in Unitronics Unitronics UniStream Pro/UniLogic. This issue affects Unitronics UniStream Pro/UniLogic: Unitronics UniStream Pro versions only (B10 / C10) – UniLogic versions prior to 1.41.329.
: Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in Unitronics Unitronics UniStream Pro/UniLogic. This issue affects Unitronics UniStream Pro/UniLogic: Unitronics UniStream Pro versions only (B10 / C1
CVE-2026-58390 | OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, the OpenVPN connection-status dashboard widget in src/opnsense/www/js/widgets/OpenVPNClients.js and the connection-status view place a client common_name into data-common-name attributes without quote-safe encoding. Exploitation requires an OpenVPN server configured with username-as-common-name and RADIUS or LDAP authentication, plus the ability to provision or self-register
OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, the OpenVPN connection-status dashboard widget in src/opnsense/www/js/widgets/OpenVPNClients.js and the connection-status view place a client common_name i
CVE-2026-58394 | OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, src/www/system_advanced_admin.php reads certificate records into $a_cert but omits that array from legacy_html_escape_form_data() before rendering each certificate descr value in the SSL Certificate selector. The certificate description accepts HTML metacharacters, allowing a user with the page-system-certmanager privilege to store markup that executes when another user opens
OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, src/www/system_advanced_admin.php reads certificate records into $a_cert but omits that array from legacy_html_escape_form_data() before rendering each cer
CVE-2026-109449 | In Symfony Expression Language versions prior to 5.4.54, 6.4.48, 7.4.21, and 8.1.9, the parser of the ExpressionLanguage component built its node tree with no bound on its depth. An expression made of tens of thousands of nested unary operators, array literals, binary operators or property accesses crashed the PHP process, while the tree was being freed. #[Assert\ExpressionSyntax] passes the validated value to ExpressionLanguage::lint(), so an application
In Symfony Expression Language versions prior to 5.4.54, 6.4.48, 7.4.21, and 8.1.9, the parser of the ExpressionLanguage component built its node tree with no bound on its depth. An expression made of tens of thousands of nested unary opera
CVE-2026-45449 | : Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Unitronics Unitronics UniStream Pro/UniLogic. This issue affects Unitronics UniStream Pro/UniLogic: Unitronics UniStream Pro versions only (B10 / C10) – UniLogic versions prior to 1.41.329.
: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Unitronics Unitronics UniStream Pro/UniLogic. This issue affects Unitronics UniStream Pro/UniLogic: Unitronics UniStream Pro vers
CVE-2026-58395 | OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, the safe-delete path reached through ApiMutableModelControllerBase::delBase() interpolates an unvalidated safe-delete token from the request URL into an XPath expression over config.xml before confirming that the token is a valid identifier. A user holding any one affected module privilege can send a crafted token to one of 21 affected delete endpoints covering Traffic Shaper
OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, the safe-delete path reached through ApiMutableModelControllerBase::delBase() interpolates an unvalidated safe-delete token from the request URL into an XP
CVE-2026-57155 | OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, the Firewall Alias GeoIP importer's process_zip() and process_gzip() paths in src/opnsense/scripts/filter/lib/alias/geoip.py use an unvalidated CSV country_code value to construct output filenames below /usr/local/share/GeoIP/alias. A user with Firewall Alias Edit privilege can configure an attacker-controlled GeoIP source URL and supply an archive whose country code traverse
OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, the Firewall Alias GeoIP importer's process_zip() and process_gzip() paths in src/opnsense/scripts/filter/lib/alias/geoip.py use an unvalidated CSV country
CVE-2026-58391 | OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, Firewall Rules and NAT views place stored category names and alias descriptions into HTML title attributes in filter_rule.volt and nat_rule.volt without quote-safe encoding. The response layer uses ENT_NOQUOTES, so a double quote survives and closes the attribute, allowing an event-handler attribute to be added to the existing span. A user with Firewall Categories or Firewall
OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, Firewall Rules and NAT views place stored category names and alias descriptions into HTML title attributes in filter_rule.volt and nat_rule.volt without qu
CVE-2026-53582 | OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.10, the Trust module stores attacker-controlled certificate authority and certificate refid values and interpolates them into XPath expressions in src/opnsense/mvc/app/models/OPNsense/Trust/FieldTypes/CAsField.php and src/opnsense/mvc/app/models/OPNsense/Trust/FieldTypes/CertificatesField.php. A user with CA Manager or Certificate Manager privileges can submit a crafted refid and
OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.10, the Trust module stores attacker-controlled certificate authority and certificate refid values and interpolates them into XPath expressions in src/opnsense
CVE-2026-75505 | EspoCRM is an open source customer relationship management application. Prior to 10.0.2, an authenticated user with mass-update permission can supply a known attachment identifier to the mass-update functionality. The mass-update processor duplicates the attachment without checking whether the caller can read it, bypassing record-level and field-level restrictions and exposing the file contents through the copied attachment. Obtaining a valid attachment ident
EspoCRM is an open source customer relationship management application. Prior to 10.0.2, an authenticated user with mass-update permission can supply a known attachment identifier to the mass-update functionality. The mass-update processor
CVE-2026-77460 | EspoCRM is an open source customer relationship management application. Prior to 10.0.3, a user with email-template edit access and mass-email sending access can reference restricted record fields in a template because the renderer stops filtering those fields when per-user ACL application is disabled. The same behavior affects group email auto-replies when a regular user can edit the selected template, even though an administrator controls the group email. R
EspoCRM is an open source customer relationship management application. Prior to 10.0.3, a user with email-template edit access and mass-email sending access can reference restricted record fields in a template because the renderer stops fi
CVE-2026-109413 | In Symfony YAML prior to versions 5.4.54, 6.4.45, 7.4.18, and 8.1.6, Yaml\Parser::lexInlineStructure() recursed through lexInlineMapping() and lexInlineSequence() for every { and [ of an inline collection, without entering the nesting level that the rest of the parser bounds with maxNestingLevel. A document made of deeply nested inline collections, such as [[[[...]]]], exhausted the stack while it was being lexed: depending on the PHP version and its stack s
In Symfony YAML prior to versions 5.4.54, 6.4.45, 7.4.18, and 8.1.6, Yaml\Parser::lexInlineStructure() recursed through lexInlineMapping() and lexInlineSequence() for every { and [ of an inline collection, without entering the nesting level
CVE-2026-63130 | EspoCRM is an open source customer relationship management application. Prior to 9.3.10, an authenticated administrator can provide crafted input to the administrative Label Manager. Insufficient path validation allows traversal outside the intended directory and permits reading, modifying, creating, or deleting JSON files accessible to the application, subject to filesystem permissions and server configuration. This issue is fixed in version 9.3.10.
EspoCRM is an open source customer relationship management application. Prior to 9.3.10, an authenticated administrator can provide crafted input to the administrative Label Manager. Insufficient path validation allows traversal outside the
CVE-2026-79843 | A corrupted file may cause out-of-bounds read in HPE NonStop SQL/MX EXE under certain conditions, potentially leading to information disclosure, process termination, CPU halt, or data corruption.
A corrupted file may cause out-of-bounds read in HPE NonStop SQL/MX EXE under certain conditions, potentially leading to information disclosure, process termination, CPU halt, or data corruption.
CVE-2026-59994 | EspoCRM is an open source customer relationship management application. Prior to 9.3.9, an unauthenticated remote attacker can send an email to a monitored group or IMAP address, including an email-to-Case address, and place arbitrary HTML in its plain-text body. EspoCRM stores that body and renders it without escaping in Email Received stream notification emails sent to users following the related record, allowing HTML injection and, in mail clients that exe
EspoCRM is an open source customer relationship management application. Prior to 9.3.9, an unauthenticated remote attacker can send an email to a monitored group or IMAP address, including an email-to-Case address, and place arbitrary HTML