Zero-Day & Vulnerability Intelligence Hub
Echtzeit-Tracking mit EPSS Exploit-Wahrscheinlichkeiten, Angriffsvektor-Decodern und KI-Patch-Anleitungen.
📊 Historien-Charts — Criticals-Trend · Vendors · EPSS-Verteilung
| Tier | CVEs | Anteil |
|---|---|---|
| ≥90 % | 720 | 0,2 % |
| ≥50 % | 3.224 | 0,9 % |
| ≥10 % | 22.097 | 6,0 % |
| <10 % | 345.333 | 93,0 % |
BlockStrap / CVE-2026-103849: Unauthenticated RCE via Two-Stage Directive Processing in Magento and Adobe Commerce
1. Basic Information Article Name: BlockStrap: Magento and Adobe Commerce RCE (CVE-2026-103849) Published By: Sansec Publication Date: 2026-10-15 Updated Date: None Original Source: Sansec Related Sources: Adobe Security Bulletin APSB26-153
Langflow CVE-2026-105740: RCE via Authenticated MCP Stdio, 2,023 Exploitation Attempts Observed
1. Basic Information Article Name: CVE-2026-105740 Exploitation Observed — langflow Source: Previdian Published Date: 2026-10-05 Updated Date: 2026-10-17 Original: Previdian Related Sources: Langflow Security Advisory GHSA-7w94-79vh-5mr2, S
BeyondTrust CVE-2026-102764: ARMORY CASTLE Exploits Zero-Day to Deploy SAWFLY and BARECLAW
1. Overview Report Title: ARMORY CASTLE Exploits BeyondTrust Source: Google Threat Intelligence Group Publication Date: 2026-10-15 Updated Date: None Original Source: Google Threat Intelligence Group Related Sources: BeyondTrust Security Ad
CVE-2026-104246 | Contact Form 7 Signature Addon Plugin up to 4.2.2 on WordPress signature path traversal (EUVD-2026-103250)
A vulnerability categorized as problematic has been discovered in Contact Form 7 Signature Addon Plugin up to 4.2.2 on WordPress. This impacts an unknown function. Such manipulation of the argument signature leads to path traversal. This vu
CVE-2026-92433 | Patreon Plugin up to 1.9.x on WordPress cross-site request forgery (EUVD-2026-103251)
A vulnerability has been found in Patreon Plugin up to 1.9.x on WordPress and classified as problematic. The impacted element is an unknown function. The manipulation leads to cross-site request forgery. This vulnerability is documented as
CVE-2026-92431 | Patreon Plugin up to 1.9.x on WordPress authorization (EUVD-2026-103252)
A vulnerability classified as problematic was found in Patreon Plugin up to 1.9.x on WordPress. This issue affects some unknown processing. Such manipulation leads to missing authorization. This vulnerability is listed as CVE-2026-92431. Th
CVE-2026-92432 | Patreon Plugin up to 1.9.x on WordPress redirect (EUVD-2026-103253)
A vulnerability, which was classified as problematic, has been found in Patreon Plugin up to 1.9.x on WordPress. Impacted is an unknown function. Performing a manipulation results in open redirect. This vulnerability is cataloged as CVE-202
CVE-2026-104122 | Ukr-To-Lat Plugin up to 1.3.5 on WordPress term name sql injection (EUVD-2026-103254)
A vulnerability marked as critical has been reported in Ukr-To-Lat Plugin up to 1.3.5 on WordPress. Affected by this issue is some unknown functionality. The manipulation of the argument term name leads to sql injection. This vulnerability
CVE-2026-103376 | PeachPay Plugin up to 1.120.69 on WordPress information disclosure (EUVD-2026-103255)
A vulnerability was found in PeachPay Plugin up to 1.120.69 on WordPress. It has been declared as problematic. The impacted element is an unknown function. The manipulation results in information disclosure. This vulnerability is known as C
CVE-2026-110527 | WP User Manager Plugin up to 2.9.19 on WordPress access control (EUVD-2026-103257)
A vulnerability described as problematic has been identified in WP User Manager Plugin up to 2.9.19 on WordPress. This affects an unknown part. The manipulation results in improper access controls. This vulnerability is identified as CVE-20
CVE-2026-106470 | WP Data Access Plugin up to 5.5.87 on WordPress server-side request forgery (EUVD-2026-103256)
A vulnerability, which was classified as critical, was found in WP Data Access Plugin up to 5.5.87 on WordPress. The affected element is an unknown function. Executing a manipulation can lead to server-side request forgery. This vulnerabili
CVE-2026-81344 | DynamiApps ACF Frontend Admin Plugin up to 3.29.13 on WordPress deserialization (EUVD-2026-103259)
A vulnerability was found in DynamiApps ACF Frontend Admin Plugin up to 3.29.13 on WordPress. It has been rated as problematic. This affects an unknown function. This manipulation causes deserialization. This vulnerability is handled as CVE
CVE-2026-81343 | DynamiApps ACF Frontend Admin Plugin up to 3.29.13 on WordPress authorization (EUVD-2026-103258)
A vulnerability identified as critical has been detected in DynamiApps ACF Frontend Admin Plugin up to 3.29.13 on WordPress. Affected is an unknown function. Performing a manipulation results in missing authorization. This vulnerability was
CVE-2026-97314 | ThirstyAffiliates Plugin up to 3.12.0 on WordPress information disclosure (EUVD-2026-103260)
A vulnerability labeled as problematic has been found in ThirstyAffiliates Plugin up to 3.12.0 on WordPress. Affected by this vulnerability is an unknown functionality. Executing a manipulation can lead to information disclosure. The identi
Hackers Exploit Critical Collabora Online Flaw to Backdoor Nextcloud Servers
Hackers are exploiting a critical flaw in the Collabora Online Built-in CODE Server app for Nextcloud, with users reporting web shells on compromised servers. Tracked as CVE-2026-110447, the vulnerability allows remote attackers to run oper
CVE-2026-88115 | Microsoft Windows up to Server 2025 NFS out-of-bounds (EUVD-2026-100092)
A vulnerability was found in Microsoft Windows up to Server 2025. It has been declared as very critical. This issue affects some unknown processing of the component NFS. Such manipulation leads to out-of-bounds read. This vulnerability is r
CVE-2026-83639 | Microsoft Windows up to Server 2025 Sensor Data Service buffer overflow (EUVD-2026-99931)
A vulnerability marked as very critical has been reported in Microsoft Windows. Impacted is an unknown function of the component Sensor Data Service. Performing a manipulation results in buffer overflow. This vulnerability was named CVE-202
CVE-2026-80092 | Microsoft Identity Web privileges management (EUVD-2026-102953)
A vulnerability, which was classified as critical, has been found in Microsoft Identity Web. The affected element is an unknown function. The manipulation leads to improper privilege management. This vulnerability is listed as CVE-2026-8009
CVE-2026-70123 | Microsoft Windows up to Server 2025 Graphics integer overflow (EUVD-2026-99169)
A vulnerability, which was classified as very critical, was found in Microsoft Windows. Impacted is an unknown function of the component Graphics Component. Such manipulation leads to integer overflow. This vulnerability is referenced as CV
CVE-2026-85338 | Microsoft Windows up to Server 2025 Graphics out-of-bounds (EUVD-2026-99474)
A vulnerability was found in Microsoft Windows up to Server 2025. It has been declared as very critical. Impacted is an unknown function of the component Graphics Component. Such manipulation leads to out-of-bounds read. This vulnerability
CVE-2026-102209 | Microsoft Windows 11 26H1 Graphics heap-based overflow (EUVD-2026-100363)
A vulnerability classified as very critical has been found in Microsoft Windows 11 26H1. Impacted is an unknown function of the component Graphics Component. The manipulation leads to heap-based buffer overflow. This vulnerability is listed
CVE-2026-100215 | Microsoft Windows up to Server 2025 Graphics buffer overflow (EUVD-2026-100373)
A vulnerability was found in Microsoft Windows. It has been declared as critical. The affected element is an unknown function of the component Graphics Component. Such manipulation leads to buffer overflow. This vulnerability is uniquely id
CVE-2026-88101 | Microsoft Windows up to Server 2025 IME improper authorization (EUVD-2026-99585)
A vulnerability, which was classified as very critical, was found in Microsoft Windows. Affected by this vulnerability is an unknown functionality of the component IME. Executing a manipulation can lead to improper authorization. This vulne
Telegram Desktop Security Flaw (2026): How to Fix It
Key TakeawaysA security flaw in Telegram Desktop, identified as CVE-2026-107181, allowed attackers to steal files and possibly take over accounts by exploiting a crafted link. It affected versions before 7.2.9, where Telegram Desktop could
CVE-2026-93895 | IBM WebSphere Application Server Liberty up to 26.0.0.10 gRPC Service access control (EUVD-2026-100497)
A vulnerability, which was classified as critical, has been found in IBM WebSphere Application Server Liberty up to 26.0.0.10. This impacts an unknown function of the component gRPC Service. The manipulation leads to improper access control
CVE-2026-11713 | IBM WebSphere Application Server up to 26.0.0.9 restConnector-2.0 privileges management (EUVD-2026-100491)
A vulnerability classified as critical was found in IBM WebSphere Application Server up to 26.0.0.9. Affected by this issue is some unknown functionality of the component restConnector-2.0. Such manipulation leads to improper privilege mana
CVE-2026-97381 | LegacyUpdate Legacy Update up to 1.13.1 ActiveX control IsPermitted privileges management (EUVD-2026-100662)
A vulnerability classified as problematic was found in LegacyUpdate Legacy Update up to 1.13.1. Affected is the function IsPermitted of the component ActiveX control. The manipulation results in improper privilege management. This vulnerabi
CVE-2026-95633 | Adobe Content Credentials Rust SDK improper authorization (EUVD-2026-100732)
A vulnerability categorized as problematic has been discovered in Adobe Content Credentials Rust SDK, C2PA Tool and Content Credentials JS SDK. This vulnerability affects unknown code. Such manipulation leads to improper authorization. This
CVE-2026-100118 | Adobe C2PA Tool certificate validation (EUVD-2026-100722)
A vulnerability described as problematic has been identified in Adobe C2PA Tool, Content Credentials JS SDK and Content Credentials Rust SDK. The affected element is an unknown function. Executing a manipulation can lead to improper certifi
CVE-2026-100113 | Adobe Content Credentials Rust SDK input validation (EUVD-2026-100721)
A vulnerability was found in Adobe Content Credentials Rust SDK, C2PA Tool and Content Credentials JS SDK. It has been rated as problematic. Affected by this issue is some unknown functionality. The manipulation leads to improper input vali
CVE-2026-100123 | Adobe C2PA Tool certificate validation (EUVD-2026-100734)
A vulnerability was found in Adobe C2PA Tool, Content Credentials JS SDK and Content Credentials Rust SDK and classified as problematic. Affected by this issue is some unknown functionality. Executing a manipulation can lead to improper cer
CVE-2026-103294 | Adobe Content Credentials Rust SDK certificate validation (EUVD-2026-100741)
A vulnerability has been found in Adobe Content Credentials Rust SDK, C2PA Tool and Content Credentials JS SDK and classified as problematic. This impacts an unknown function. Performing a manipulation results in improper certificate valida
CVE-2026-50215 | Akamai Guardicore Platform Agent up to 7.3 Windows WFP packet-capture driver use after free (EUVD-2026-100805)
A vulnerability classified as problematic has been found in Akamai Guardicore Platform Agent up to 7.3. This vulnerability affects unknown code of the component Windows WFP packet-capture driver. Performing a manipulation results in use aft
CVE-2026-111854 | Tektronix 3 MDO up to 1.21.0 SCPI FILESystem Command Interface path traversal (EUVD-2026-103207)
A vulnerability labeled as critical has been found in Tektronix 3 MDO up to 1.21.0. Impacted is an unknown function of the component SCPI FILESystem Command Interface. The manipulation results in path traversal. This vulnerability is identi
CVE-2026-111853 | Tektronix 3 Series MDO up to 1.21.0 SCPI FILESystem:MOUNT:DRIve SCPI command handler os command injection (EUVD-2026-103206)
A vulnerability identified as very critical has been detected in Tektronix 3 Series MDO up to 1.21.0. This issue affects the function FILESystem:MOUNT:DRIve SCPI command handler of the component SCPI. The manipulation leads to os command in
CVE-2026-111855 | Tektronix 3 MDO up to 1.21.0 Web Management Interface path traversal (EUVD-2026-103208)
A vulnerability marked as problematic has been reported in Tektronix 3 MDO up to 1.21.0. The affected element is an unknown function of the component Web Management Interface. This manipulation causes path traversal. This vulnerability is t
CVE-2026-84869: a ScreenConnect client bypass and the spread that followed it
CVE-2026-84869: the ScreenConnect client flaw and the worm-like spread that followed ConnectWise published an advisory for CVE-2026-84869 on 3 September 2026 and shipped the fix in ScreenConnect 26.6.5 on 8 September. CISA added the vulnera
CVE-2026-111823 | Mage OSS through 0.9.80 before 76c4f46 can proceed with session creation upon encountering an unknown OAuth provider.
Mage OSS through 0.9.80 before 76c4f46 can proceed with session creation upon encountering an unknown OAuth provider.
CVE-2026-89096 | A flaw was found in nfs-utils. An unauthenticated remote attacker can trigger a Denial of Service (DoS) by sending repeated state notification requests to an exposed rpc.statd service. The service fails to properly release memory allocated during callback processing, leading to continuous memory growth. Sustained requests can exhaust system resources, eventually causing the service to degrade or crash.
A flaw was found in nfs-utils. An unauthenticated remote attacker can trigger a Denial of Service (DoS) by sending repeated state notification requests to an exposed rpc.statd service. The service fails to properly release memory allocated
CVE-2026-89088 | A flaw was found in parted. A heap-based buffer overflow exists in libparted's file system resizing logic when handling FAT16 volumes. By convincing a user or administrator to resize a specially crafted FAT16 file system image with malformed directory metadata, an attacker can trigger an oversized read into a fixed-size memory buffer. This issue causes memory corruption, resulting in an application crash and a denial of service (DoS).
A flaw was found in parted. A heap-based buffer overflow exists in libparted's file system resizing logic when handling FAT16 volumes. By convincing a user or administrator to resize a specially crafted FAT16 file system image with malforme
CVE-2026-89085 | A flaw was found in parted. A heap-based buffer overflow can occur when processing a specially crafted FAT32 filesystem due to an integer calculation error during buffer allocation. A local attacker could exploit this by enticing a user or automated service to open a malicious filesystem image, resulting in an application crash leading to a Denial of Service (DoS) or potential memory corruption.
A flaw was found in parted. A heap-based buffer overflow can occur when processing a specially crafted FAT32 filesystem due to an integer calculation error during buffer allocation. A local attacker could exploit this by enticing a user or
CVE-2026-111802 | A flaw was found in Nautilus. When a removable drive or disk image is unmounted or ejected, Nautilus prompts the user to empty the trash without verifying whether the trash directory paths are symbolic links. An attacker can exploit this flaw by tricking a user into mounting a crafted storage volume and confirming the prompt to empty the trash, leading to the arbitrary deletion of files accessible to that user.
A flaw was found in Nautilus. When a removable drive or disk image is unmounted or ejected, Nautilus prompts the user to empty the trash without verifying whether the trash directory paths are symbolic links. An attacker can exploit this fl
CVE-2026-17591 | A flaw was found in libarchive. An attacker can cause a Denial of Service (DoS) or potential information disclosure due to a use-after-free vulnerability, which occurs when a program reads memory that has already been released. This issue arises when the archive_entry_copy_mac_metadata() function deallocates an internal buffer before completing a data copy. An attacker who can supply input to an application utilizing this function can trigger the flaw to cras
A flaw was found in libarchive. An attacker can cause a Denial of Service (DoS) or potential information disclosure due to a use-after-free vulnerability, which occurs when a program reads memory that has already been released. This issue a
CVE-2026-111044 | Sunshine is a self-hosted game stream host for Moonlight. From 2026.329.165800 until 2026.906.222525, Sunshine accepted any client certificate that chained to a stored paired-client certificate, but it did not require the presented certificate to be the exact enabled paired identity. Certificate text was also compared without canonicalizing equivalent PEM encodings. A previously paired client that retains its private key can present an alternate certificate
Sunshine is a self-hosted game stream host for Moonlight. From 2026.329.165800 until 2026.906.222525, Sunshine accepted any client certificate that chained to a stored paired-client certificate, but it did not require the presented certific
CVE-2026-62438 | A flaw was found in GIMP. An attacker can cause a Denial of Service (DoS) or potentially disclose sensitive memory contents by convincing a user to open or preview a specially crafted Bohemia Interactive (PAA) texture file. Due to an integer overflow when calculating image dimensions during file decompression, the application allocates an undersized memory buffer. Subsequent processing reads memory past the buffer boundary, terminating the plug-in process une
A flaw was found in GIMP. An attacker can cause a Denial of Service (DoS) or potentially disclose sensitive memory contents by convincing a user to open or preview a specially crafted Bohemia Interactive (PAA) texture file. Due to an intege
CVE-2026-62439 | A flaw was found in GIMP. An integer overflow occurs in the file-pvr plug-in when calculating memory buffer sizes for image dimensions. By tricking a user into opening or previewing a specially crafted PowerVR (.pvr) file, an attacker can trigger a heap-based buffer overflow, potentially leading to arbitrary code execution or a Denial of Service (DoS) via an application crash.
A flaw was found in GIMP. An integer overflow occurs in the file-pvr plug-in when calculating memory buffer sizes for image dimensions. By tricking a user into opening or previewing a specially crafted PowerVR (.pvr) file, an attacker can t
CVE-2026-108372 | Open and provider-neutral, LoopX is a lightweight state kernel and local-first control plane for loop engineering. From version 0.0.1 until 0.4.5, `loopx serve-status` in `loopx/status_server.py` uses `StatusRequestHandler._send_json()` and `do_OPTIONS()` to send `Access-Control-Allow-Origin: *` for unauthenticated responses on predictable loopback ports. A remote attacker can cause an operator who visits attacker-controlled web content to issue cross-origin
Open and provider-neutral, LoopX is a lightweight state kernel and local-first control plane for loop engineering. From version 0.0.1 until 0.4.5, `loopx serve-status` in `loopx/status_server.py` uses `StatusRequestHandler._send_json()` and
CVE-2026-49410 | OpenHuman is an open-source agent harness available as a desktop application and Rust library. Versions before 0.56.0 allow cross-site request forgery against the unauthenticated GET /auth/telegram loopback callback because telegram_auth_handler consumes an attacker-supplied one-time Telegram login token and passes the returned JWT to credentials::ops::store_session without validating browser fetch metadata or the request origin. An attacker with an OpenHuman
OpenHuman is an open-source agent harness available as a desktop application and Rust library. Versions before 0.56.0 allow cross-site request forgery against the unauthenticated GET /auth/telegram loopback callback because telegram_auth_ha
CVE-2026-96627 | Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to 2.6.0, UpdateUser in backend/api/handlers/users.go sets PasswordHash for any target without comparing caller and target privilege. A holder of delegated users:update permission can submit a password change for the global administrator, replace the administrator password, and authenticate as that account, resulting in complete global administrator account takeover. T
Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to 2.6.0, UpdateUser in backend/api/handlers/users.go sets PasswordHash for any target without comparing caller and target privilege. A holder of de
CVE-2026-68498 | StreamReadConstraints.maxNameLength (default 50,000 characters) is intended to bound how much memory a single JSON Object property name can consume while being parsed, independently of the much larger maxStringLength (default 100,000,000 characters) that bounds ordinary string values. For parsers built over character input — Reader, String or char[] sources, all served by ReaderBasedJsonParser — that bound is not applied while the name is being accumulated. T
StreamReadConstraints.maxNameLength (default 50,000 characters) is intended to bound how much memory a single JSON Object property name can consume while being parsed, independently of the much larger maxStringLength (default 100,000,000 ch
CVE-2026-96628 | Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to 2.11.0, AuthMiddleware.managerAuth accepts X-Arcane-Agent-Token credentials and the environment-token branch calls next before the AdminRequired option is evaluated. An attacker with a valid X-Arcane-Agent-Token can request /api/debug/pprof/* through a route protected by WithAdminRequired because EnvironmentPermissionSet is installed and the request continues withou
Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to 2.11.0, AuthMiddleware.managerAuth accepts X-Arcane-Agent-Token credentials and the environment-token branch calls next before the AdminRequired
CVE-2026-96626 | Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to 2.5.0, UpdateRegistry and TestRegistry in backend/api/services/container_registry_service.go allow the registry URL to change while preserving the stored encrypted token. When a holder of registries:update and registries:test repoints a generic registry URL without supplying a replacement token, TestRegistry decrypts the preserved token and RegistryLogin sends it to
Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to 2.5.0, UpdateRegistry and TestRegistry in backend/api/services/container_registry_service.go allow the registry URL to change while preserving th
CVE-2026-96542 | Incorrect permission assignment (CWE-732) in the standalone installer for EA Javelin Anticheat (versions 1.0.14329371, 1.0.14547437, 1.0.14789537, and 1.0.14940698) on Windows allows a local non-administrative user to elevate privileges to NT AUTHORITY\SYSTEM by modifying the EAAntiCheatService service configuration and executable path. This vulnerability requires non-standard manual execution of the standalone installer and does not affect standard game inst
Incorrect permission assignment (CWE-732) in the standalone installer for EA Javelin Anticheat (versions 1.0.14329371, 1.0.14547437, 1.0.14789537, and 1.0.14940698) on Windows allows a local non-administrative user to elevate privileges to
CVE-2026-64862 | Frappe HR is an open-source human resources management solution (HRMS). Prior to 15.58.3 and 16.4.3, HRMS PWA API endpoints for employee data do not consistently authorize employee-specific PWA API requests. An authenticated user requests records associated with another employee. The user can request records associated with another employee through PWA API endpoints. Successful exploitation can access sensitive HR data belonging to other employees. This issue
Frappe HR is an open-source human resources management solution (HRMS). Prior to 15.58.3 and 16.4.3, HRMS PWA API endpoints for employee data do not consistently authorize employee-specific PWA API requests. An authenticated user requests r
CVE-2026-55796 | Frappe HR is an open-source human resources management solution (HRMS). Prior to 15.60.3 and 16.7.1, the Salary Payments via ECS report constructs report conditions with unsafe SQL string interpolation. An authenticated HR user supplies crafted Salary Payments via ECS report filter values. The affected Salary Payments via ECS report allows the user to inject SQL through report filter values. Successful exploitation can access sensitive database records. This
Frappe HR is an open-source human resources management solution (HRMS). Prior to 15.60.3 and 16.7.1, the Salary Payments via ECS report constructs report conditions with unsafe SQL string interpolation. An authenticated HR user supplies cra
CVE-2026-108373 | ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.118.0 and 16.27.0, certain endpoints in the Sales Person-wise Transaction Summary report fail to enforce proper authorization checks. When a role-limited authenticated user requests the affected financial report, the query can query financial transaction rows without applying the requesting user's document permission match conditions. This allows the user to read financial data
ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.118.0 and 16.27.0, certain endpoints in the Sales Person-wise Transaction Summary report fail to enforce proper authorization checks. When a role-limited authe
CVE-2026-108374 | ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.121.0 and 16.34.0, certain endpoints for status modification fail to enforce proper authorization checks. A low-privileged authenticated user can invoke state-changing whitelisted methods without required write, submit, cancel, document, or role checks. This allows the user to modify data beyond the user's permitted role. This issue is fixed in versions 15.121.0 and 16.34.0.
ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.121.0 and 16.34.0, certain endpoints for status modification fail to enforce proper authorization checks. A low-privileged authenticated user can invoke state-
CVE-2026-102834 | JavaCV provides Java interfaces to OpenCV, FFmpeg, and other multimedia libraries. Prior to 1.5.14, IPCameraFrameGrabber doubles a 32-bit buffer capacity without checking for overflow or bounding the parsed Content-Length. An application consumes an MJPEG response from a malicious camera endpoint or a tampered plaintext stream. The source can return an oversized Content-Length header in an MJPEG stream. Successful exploitation can trap the frame-grabbing thr
JavaCV provides Java interfaces to OpenCV, FFmpeg, and other multimedia libraries. Prior to 1.5.14, IPCameraFrameGrabber doubles a 32-bit buffer capacity without checking for overflow or bounding the parsed Content-Length. An application co
CVE-2026-96620 | Claude Agent SDK is a Python SDK for Claude Code. Prior to 0.2.121, the resume option is passed to the Claude CLI as a separate token without validation, so a dash-leading value is parsed as an independent CLI flag. An attacker can inject the --mcp-config flag to define a stdio MCP server, causing arbitrary command execution at CLI startup outside the SDK permission controls. The issue is exploitable when an application passes untrusted input as the session I
Claude Agent SDK is a Python SDK for Claude Code. Prior to 0.2.121, the resume option is passed to the Claude CLI as a separate token without validation, so a dash-leading value is parsed as an independent CLI flag. An attacker can inject t
CVE-2026-30971 | ZoneMinder is a free, open source closed-circuit television software application. Prior to 1.39.2, 1.38.2, and 1.36.40, ZoneMinder interpolates an unvalidated monitor Device field into shell commands in PHP and Perl control paths when an authenticated user with monitor-create or monitor-edit permission saves a Local monitor whose Device Path contains shell metacharacters and the monitor control or startup path runs. In this attack mechanism, the stored Device
ZoneMinder is a free, open source closed-circuit television software application. Prior to 1.39.2, 1.38.2, and 1.36.40, ZoneMinder interpolates an unvalidated monitor Device field into shell commands in PHP and Perl control paths when an au