Zero-Day & Vulnerability Intelligence Hub
Echtzeit-Tracking mit EPSS Exploit-Wahrscheinlichkeiten, Angriffsvektor-Decodern und KI-Patch-Anleitungen.
📊 Historien-Charts — Criticals-Trend · Vendors · EPSS-Verteilung
| Tier | CVEs | Anteil |
|---|---|---|
| ≥90 % | 720 | 0,2 % |
| ≥50 % | 3.223 | 0,9 % |
| ≥10 % | 22.115 | 6,0 % |
| <10 % | 342.373 | 92,9 % |
CVE-2026-98382 | Linux Kernel up to 7.3-rc4 BPF drivers/net/veth.c __bpf_offload_dev_match null pointer dereference (EUVD-2026-95537 / WID-SEC-2026-3822)
A vulnerability was found in Linux Kernel up to 6.6.157/6.12.111/6.18.54/7.2.8/7.3-rc4. It has been classified as very critical. This issue affects the function __bpf_offload_dev_match of the file drivers/net/veth.c of the component BPF. Pe
CVE-2026-98381 | Linux Kernel up to 7.3-rc4 veth drivers/net/veth.c veth_set_channels xdp_prog memory corruption (EUVD-2026-95536 / WID-SEC-2026-3822)
A vulnerability was found in Linux Kernel up to 7.3-rc4 and classified as very critical. This vulnerability affects the function veth_set_channels of the file drivers/net/veth.c of the component veth. Such manipulation of the argument xdp_p
CVE-2026-98379 | Linux Kernel up to 7.3-rc4 ip6t_rpfilter ip6t_rpfilter.c rpfilter_mt null pointer dereference (EUVD-2026-95534 / WID-SEC-2026-3822)
A vulnerability identified as critical has been detected in Linux Kernel up to 7.3-rc4. This affects the function rpfilter_mt of the file net/ipv6/netfilter/ip6t_rpfilter.c of the component ip6t_rpfilter. This manipulation causes null point
CVE-2026-98378 | Linux Kernel up to 7.3-rc4 Link Iterator kernel/bpf/syscall.c bpf_link_put use after free (EUVD-2026-95533 / WID-SEC-2026-3822)
A vulnerability was found in Linux Kernel up to 7.3-rc4. It has been declared as very critical. Impacted is the function bpf_link_put of the file kernel/bpf/syscall.c of the component Link Iterator. Executing a manipulation can lead to use
CVE-2026-98377 | Linux Kernel up to 6.12.111/6.18.54/7.2.8/7.3-rc4 vlan __vlan_insert_inner_tag information disclosure (EUVD-2026-95532 / WID-SEC-2026-3822)
A vulnerability has been found in Linux Kernel up to 6.12.111/6.18.54/7.2.8/7.3-rc4 and classified as problematic. This affects the function __vlan_insert_inner_tag of the component vlan. This manipulation causes information disclosure. Thi
CVE-2026-97791 | Apache CXF up to 3.6.12/4.1.8/4.2.3 STSTokenValidator information disclosure (WID-SEC-2026-3824)
A vulnerability, which was classified as problematic, was found in Apache CXF up to 3.6.12/4.1.8/4.2.3. This affects the function STSTokenValidator. The manipulation results in information disclosure. This vulnerability is known as CVE-2026
CVE-2026-97468 | Apache CXF up to 3.6.12/4.1.8/4.2.3 Security Token Service Cache STSTokenValidator.hashCode improper authentication (WID-SEC-2026-3824)
A vulnerability was found in Apache CXF up to 3.6.12/4.1.8/4.2.3. It has been rated as critical. This affects the function STSTokenValidator.hashCode of the component Security Token Service Cache. The manipulation leads to improper authenti
CVE-2026-86463 | Apache CXF up to 3.6.12/4.1.8/4.2.3 Query Parser resource consumption (WID-SEC-2026-3824)
A vulnerability classified as problematic has been found in Apache CXF up to 3.6.12/4.1.8/4.2.3. Impacted is an unknown function of the component Query Parser. Performing a manipulation results in resource consumption. This vulnerability is
CVE-2026-79650 | Apache CXF up to 3.6.12/4.1.8/4.2.3 OIDC relying-party component state redirect (WID-SEC-2026-3824)
A vulnerability was found in Apache CXF up to 3.6.12/4.1.8/4.2.3. It has been classified as problematic. Affected by this vulnerability is an unknown functionality of the component OIDC relying-party component. Performing a manipulation of
CVE-2026-78384 | Apache CXF up to 3.6.12/4.1.8/4.2.3 Compression Utils CompressionUtils.inflate resource consumption (WID-SEC-2026-3824)
A vulnerability was found in Apache CXF up to 3.6.12/4.1.8/4.2.3. It has been declared as problematic. Affected by this issue is the function CompressionUtils.inflate of the component Compression Utils. Executing a manipulation can lead to
CVE-2026-73179 | Apache CXF up to 3.6.12/4.1.8/4.2.3 JPA OAuth2 Authorization Code Grant Provider race condition (WID-SEC-2026-3824)
A vulnerability classified as problematic was found in Apache CXF up to 3.6.12/4.1.8/4.2.3. The affected element is an unknown function of the component JPA OAuth2 Authorization Code Grant Provider. Executing a manipulation can lead to race
CVE-2026-108039 | Apache CXF up to 3.6.12/4.1.8/4.2.3 StaxUtils denial of service (WID-SEC-2026-3824)
A vulnerability has been found in Apache CXF up to 3.6.12/4.1.8/4.2.3 and classified as problematic. This impacts an unknown function of the component StaxUtils. This manipulation causes denial of service. This vulnerability is handled as C
CVE-2026-107938 | Apache CXF up to 3.6.12/4.1.8/4.2.3 cxf-rt-transports-http-netty-client certificate validation (WID-SEC-2026-3824)
A vulnerability described as problematic has been identified in Apache CXF up to 3.6.12/4.1.8/4.2.3. This issue affects some unknown processing of the component cxf-rt-transports-http-netty-client. Such manipulation leads to improper certif
CVE-2026-107937 | Apache CXF up to 3.6.12/4.1.8/4.2.3 Parser denial of service (WID-SEC-2026-3824)
A vulnerability was found in Apache CXF up to 3.6.12/4.1.8/4.2.3 and classified as problematic. Affected is an unknown function of the component Parser. Such manipulation leads to denial of service. This vulnerability is uniquely identified
CVE-2026-100227 | Apache CXF up to 3.6.12/4.1.8/4.2.3 JAX-RS XML Signature Interceptors data authenticity (WID-SEC-2026-3824)
A vulnerability, which was classified as critical, has been found in Apache CXF up to 3.6.12/4.1.8/4.2.3. The impacted element is the function XmlSigInHandler/XmlSigInInterceptor/XmlSecInInterceptor of the component JAX-RS XML Signature Int
CVE-2026-98375 | Linux Kernel up to 7.3-rc6 netfront handle_incoming_queue information disclosure (EUVD-2026-95525 / WID-SEC-2026-3826)
A vulnerability was found in Linux Kernel up to 7.3-rc6. It has been rated as problematic. This vulnerability affects the function handle_incoming_queue of the component netfront. Performing a manipulation results in information disclosure.
CVE-2019-8906 | libmagic 5.35 readelf.c do_core_note out-of-bounds (ID 277708 / BID-107137)
A vulnerability was found in libmagic 5.35. It has been declared as critical. This affects the function do_core_note of the file readelf.c. Executing a manipulation can lead to out-of-bounds read. This vulnerability is registered as CVE-201
CVE-2019-12086 | Oracle JD Edwards EnterpriseOne Tools 9.2 Monitoring/Diagnostics SEC information disclosure (Nessus ID 236644 / ID 176941)
A vulnerability labeled as critical has been found in Oracle JD Edwards EnterpriseOne Tools 9.2. This issue affects some unknown processing of the component Monitoring/Diagnostics SEC. Executing a manipulation can lead to information disclo
CVE-2018-14719 | FasterXML jackson-databind up to 2.9.6 Deserialization blaze-ds-opt/blaze-ds-core deserialization (RHSA-2019:0782 / Nessus ID 121251)
A vulnerability labeled as critical has been found in FasterXML jackson-databind up to 2.9.6. This affects the function blaze-ds-opt/blaze-ds-core of the component Deserialization. Executing a manipulation can lead to deserialization. The i
CVE-2018-12022 | Oracle Clusterware 12.1.0.2.0 TFA Collector deserialization (ID 176909 / BID-107585)
A vulnerability was found in Oracle Clusterware 12.1.0.2.0. It has been classified as critical. This affects an unknown function of the component TFA Collector. This manipulation causes deserialization. This vulnerability is tracked as CVE-
Why API Gateways Keep Failing Authentication: Lessons From Cisco ISE CVE-2026-76460
Why API Gateways Keep Failing Authentication: Lessons From Cisco ISE CVE-2026-76460 A maximum severity score is rare enough to draw attention, and CVE-2026-76460 earned it. The flaw in Cisco Identity Services Engine combined unauthenticated
CVE-2026-97396 | Retainful Email Marketing for WooCommerce Plugin up to 1.0.10 on WordPress data cross site scripting (EUVD-2026-96280)
A vulnerability described as problematic has been identified in Retainful Email Marketing for WooCommerce Plugin up to 1.0.10 on WordPress. This affects an unknown part. Executing a manipulation of the argument data can lead to cross site s
CVE-2026-96765 | WPO365 Plugin up to 44.1 on WordPress id_token cross site scripting (EUVD-2026-96281)
A vulnerability was found in WPO365 Plugin up to 44.1 on WordPress and classified as problematic. Impacted is an unknown function. Such manipulation of the argument id_token leads to cross site scripting. This vulnerability is listed as CVE
CVE-2026-104803 | whyun WPCOM Member Plugin up to 1.7.27 on WordPress Social Login Callback weapp_new_user uuid/code improper authentication (EUVD-2026-96279)
A vulnerability marked as critical has been reported in whyun WPCOM Member Plugin up to 1.7.27 on WordPress. This impacts the function weapp_new_user of the component Social Login Callback Handler. This manipulation of the argument uuid/cod
CVE-2026-96653 | WP Directory Kit Plugin up to 1.5.9 on WordPress Profile Field update_listings_user_editor display_name sql injection (EUVD-2026-96283)
A vulnerability was found in WP Directory Kit Plugin up to 1.5.9 on WordPress. It has been rated as critical. This affects the function WdkCachedUserEditor::update_listings_user_editor of the component Profile Field. The manipulation of the
CVE-2026-100178 | WPAdverts Plugin up to 2.3.4 on WordPress adverts_location cross site scripting (EUVD-2026-96282)
A vulnerability, which was classified as problematic, was found in WPAdverts Plugin up to 2.3.4 on WordPress. This vulnerability affects unknown code. The manipulation of the argument adverts_location results in cross site scripting. This v
CVE-2026-104728 | rubengc AutomatorWP Plugin up to 5.8.4 on WordPress authorization (EUVD-2026-96284)
A vulnerability classified as problematic has been found in rubengc AutomatorWP Plugin up to 5.8.4 on WordPress. Affected by this vulnerability is an unknown functionality. Performing a manipulation results in authorization bypass. This vul
CVE-2026-102774 | BrainstormForce SureDash Plugin up to 1.12.1 on WordPress Post Content cross site scripting (EUVD-2026-96285)
A vulnerability classified as problematic was found in BrainstormForce SureDash Plugin up to 1.12.1 on WordPress. Affected by this issue is some unknown functionality of the component Post Content. Executing a manipulation can lead to cross
CVE-2026-104759 | WPO365 Plugin up to 44.1 on WordPress Deprecated Parser process_openidconnect_token id_token authentication replay (EUVD-2026-96286)
A vulnerability identified as critical has been detected in WPO365 Plugin up to 44.1 on WordPress. The impacted element is the function Id_Token_Service_Deprecated::process_openidconnect_token of the component Deprecated Parser. The manipul
CVE-2026-102291 | meum Kirki Plugin up to 6.3.1 on WordPress Shortcode Execution replace_content display_name command injection (EUVD-2026-96287)
A vulnerability labeled as critical has been found in meum Kirki Plugin up to 6.3.1 on WordPress. This affects the function TheFrontend::replace_content of the component Shortcode Execution. The manipulation of the argument display_name res
CVE-2026-97340 | meFusion Avada up to 7.16.1 on WordPress Author Page get_markup cross site scripting (EUVD-2026-96288)
A vulnerability was found in meFusion Avada up to 7.16.1 on WordPress. It has been declared as problematic. The impacted element is the function Fusion_Social_Icon::get_markup of the component Author Page. Executing a manipulation of the ar
CVE-2026-93746 | WebToffee PDF Invoices Packing Slips Delivery Notes & Shipping Labels Plugin print_document_from_the_mail_link resource injection (EUVD-2026-96289)
A vulnerability categorized as problematic has been discovered in WebToffee PDF Invoices Packing Slips Delivery Notes &amp; Shipping Labels Plugin up to 5.0.2 on WordPress. This impacts the function print_document_from_the_mail_link. Th
CVE-2026-103478 | codename065 Premium Packages Plugin up to 7.2.6 on WordPress phone/state/taxid/email cross site scripting (EUVD-2026-96290)
A vulnerability was found in codename065 Premium Packages Plugin up to 7.2.6 on WordPress. It has been classified as problematic. The affected element is an unknown function. Performing a manipulation of the argument phone/state/taxid/email
CVE-2026-93951 | Bracketweb Zeinet Plugin up to 1.0.0 on WordPress cross site scripting (EUVD-2026-96291)
A vulnerability classified as problematic has been found in Bracketweb Zeinet Plugin up to 1.0.0 on WordPress. This vulnerability affects unknown code. The manipulation leads to cross site scripting. This vulnerability is uniquely identifie
CVE-2026-40345 | RebeccaStevens deepmerge-ts up to 7.x stack-based overflow (WID-SEC-2026-3831)
A vulnerability categorized as problematic has been discovered in RebeccaStevens deepmerge-ts up to 7.x. This affects the function deepmerge/deepmergeCustom/deepmergeInto/deepmergeIntoCustom. The manipulation results in stack-based buffer o
CVE-2018-14718 | Oracle JDeveloper 12.1.3.0.0/12.2.1.3.0 jackson-databind deserialization (ID 176635 / BID-106601)
A vulnerability, which was classified as critical, has been found in Oracle JDeveloper 12.1.3.0.0/12.2.1.3.0. This affects an unknown function of the component jackson-databind. This manipulation causes deserialization. This vulnerability a
CVE-2018-12120 | Node.js up to 6.14.x Debugger --debug=localhost 7pk security (Nessus ID 119511 / ID 172114)
A vulnerability described as critical has been identified in Node.js up to 6.14.x. Affected is an unknown function of the component Debugger. Executing a manipulation of the argument --debug=localhost can lead to 7pk security features. This
CVE-2018-12116 | Node.js up to 6.14.x/8.13.x HTTP Request request smuggling (Nessus ID 119511 / ID 172114)
A vulnerability marked as critical has been reported in Node.js up to 6.14.x/8.13.x. This impacts an unknown function of the component HTTP Request Handler. Performing a manipulation results in http request smuggling. This vulnerability is
CVE-2018-1000880 | libarchive 3.2.0 archive_read_support_format_warc.c warc_read Archive double free (USN-3859-1 / Nessus ID 119893)
A vulnerability has been found in libarchive 3.2.0 and classified as problematic. The impacted element is the function warc_read of the file libarchive/archive_read_support_format_warc.c. The manipulation as part of Archive leads to double
CVE-2018-1000879 | libarchive 3.3.0 libarchive/archive_acl.c archive_acl_from_text_l null pointer dereference (FEDORA-2019-0233ec0ff3 / ID 277759)
A vulnerability, which was classified as problematic, was found in libarchive 3.3.0. The affected element is the function archive_acl_from_text_l of the file libarchive/archive_acl.c. Executing a manipulation can lead to null pointer derefe
CVE-2026-108259 | Tina is a headless content management system. Prior to 3.0.0, @tinacms/cli reads Git branch values from VERCEL_GIT_COMMIT_REF, GITHUB_BRANCH, or HEAD, incorporates the raw value into the API URL, and interpolates that URL into JavaScript string literals in packages/@tinacms/cli/src/next/codegen/index.ts and packages/@tinacms/cli/src/next/codegen/codegen/plugin.ts. A crafted Git-valid branch name containing a quote can terminate the generated string and injec
Tina is a headless content management system. Prior to 3.0.0, @tinacms/cli reads Git branch values from VERCEL_GIT_COMMIT_REF, GITHUB_BRANCH, or HEAD, incorporates the raw value into the API URL, and interpolates that URL into JavaScript st
CVE-2026-107845 | Contao is an Open Source CMS. From version 4.0.0 until 5.3.50 and 5.7.12, an unauthenticated visitor can submit a comment whose email or website metadata is rendered without sufficient attribute and URL encoding by listComments() in comments-bundle/contao/dca/tl_comments.php. When a backend user opens the Comments module, attacker-controlled script can execute in the Contao backend origin under that user's session. Unpublished comments remain visible to mode
Contao is an Open Source CMS. From version 4.0.0 until 5.3.50 and 5.7.12, an unauthenticated visitor can submit a comment whose email or website metadata is rendered without sufficient attribute and URL encoding by listComments() in comment
CVE-2026-107841 | pacioli provides least-privilege governance and a governed agent broker for ERPNext. From version 0.9.6 until version 0.10.0, the pacioli-guard document-layer consent gate allows nested cancellation operations to ride any consent established by an enclosing governed act without checking whether the marker authorizes cancellation. A credential with API Key Scope.require_consent can submit a caller-controlled Sales Invoice or other supported document under a v
pacioli provides least-privilege governance and a governed agent broker for ERPNext. From version 0.9.6 until version 0.10.0, the pacioli-guard document-layer consent gate allows nested cancellation operations to ride any consent establishe
CVE-2026-108096 | Improper authorization in the query resolvers generated by @aws-amplify/graphql-index-transformer in AWS Amplify API Category before 3.1.2 might allow an authenticated remote user to read records owned by other users of the same application via crafted queries. This issue has been addressed in @aws-amplify/graphql-index-transformer 3.1.2 https://www.npmjs.com/package/@aws-amplify/graphql-index-transformer/v/3.1.2 (included in @aws-amplify/data-construct
Improper authorization in the query resolvers generated by @aws-amplify/graphql-index-transformer in AWS Amplify API Category before 3.1.2 might allow an authenticated remote user to read records owned by other users of the same application
CVE-2026-107840 | yopass is a service for securely sharing secrets, passwords, and files. Prior to version 14.7.0, the Prometheus metrics middleware in pkg/server/server.go uses the attacker-controlled r.Method value directly as the method label for yopass_http_requests_total and yopass_http_request_duration_seconds. Because the catch-all route accepts arbitrary HTTP method tokens, an unauthenticated remote attacker can submit many unique methods and create metric series that
yopass is a service for securely sharing secrets, passwords, and files. Prior to version 14.7.0, the Prometheus metrics middleware in pkg/server/server.go uses the attacker-controlled r.Method value directly as the method label for yopass_h
CVE-2026-107836 | RIOT is an open-source microcontroller operating system designed for Internet of Things devices and other embedded systems. In 2026.07 and earlier, the nanoCoAP client function nanocoap_sock_get_slice() in sys/net/application_layer/nanocoap/sock.c accepts a Block2 response when _block_cb() sees the expected block number without also verifying that the server-controlled szx and derived offset match the requested block geometry. A malicious CoAP server can ret
RIOT is an open-source microcontroller operating system designed for Internet of Things devices and other embedded systems. In 2026.07 and earlier, the nanoCoAP client function nanocoap_sock_get_slice() in sys/net/application_layer/nanocoap
CVE-2026-107835 | OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. Prior to 3.8.1, internal/cookies.ParseCookies in internal/cookies/cookies.go handles boundary ASCII control characters and control-only or empty cookie names differently from several backend cookie parsers. An unauthenticated attacker can craft a Cookie header so Coraza indexes or drops a cookie under a different name or value from the backend application, causing rules tar
OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. Prior to 3.8.1, internal/cookies.ParseCookies in internal/cookies/cookies.go handles boundary ASCII control characters and control-only or empty cookie na
CVE-2026-107833 | OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.0, ProcessResponse in internal/bodyprocessors/json.go passes the ignoreJSONRecursionLimit value of -1 to readJSON, while the recursive guard only stops at zero. A network attacker who can cause an application protected by Coraza to return deeply nested JSON can make response-body processing perform quadratic work, consuming one CPU core for seconds per
OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.0, ProcessResponse in internal/bodyprocessors/json.go passes the ignoreJSONRecursionLimit value of -1 to readJSON, while the recursiv
CVE-2026-107826 | OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.1, readJSON in internal/bodyprocessors/json.go can stop its bounded flattening walk after reaching SecArgumentsLimit or the byte budget and then call gjson.Valid on the complete raw body. An unauthenticated attacker can submit shallow values followed by an extremely deeply nested JSON tail that was not visited by the bounded walk, causing gjson.Valid to
OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.1, readJSON in internal/bodyprocessors/json.go can stop its bounded flattening walk after reaching SecArgumentsLimit or the byte budg
CVE-2026-107821 | MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB insufficiently validated counts, offsets, lengths, and field boundaries in FRM metadata while opening binary FRM files. An attacker able to place a crafted FRM file in the data directory could trigger out-of-bounds reads or writes, crash the server, or potentially execute code. This issue is fixed in versions 10.6.28
MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB insufficiently validated counts, offsets, lengths, and field boundaries in FRM metadata while op
CVE-2026-107819 | MariaDB Connector/C is a C and C++ client library for connecting applications to MariaDB and MySQL databases. From 3.4.1 until 3.4.10, the MariaDB Connector/C libmariadb Zero-Configuration SSL authentication-switch logic checked certificate trust failure but did not reject a TLS hostname verification mismatch before selecting a non-hashing authentication plugin. An active man-in-the-middle attacker with a valid certificate for another hostname could request
MariaDB Connector/C is a C and C++ client library for connecting applications to MariaDB and MySQL databases. From 3.4.1 until 3.4.10, the MariaDB Connector/C libmariadb Zero-Configuration SSL authentication-switch logic checked certificate
CVE-2026-55797 | Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From 2.11.0 until 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2, the Argo CD repo-server is vulnerable to command injection when it clones, tests, or fetches an SSH Git repository configured with a proxy URL. The proxy host and port are embedded in an SSH ProxyCommand that is executed through a shell without neutralizing shell metacharacters. A user who can create or update a repository or repos
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From 2.11.0 until 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2, the Argo CD repo-server is vulnerable to command injection when it clones, tests, or fetches an SSH Git reposi
CVE-2026-75597 | pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev101, the `/web/<path:filename>` route in `src/pyload/webui/app/blueprints/app_blueprint.py` renders Jinja2 templates without any authentication requirement. Every equivalent direct route (`/logs`, `/settings`, `/queue`, `/dashboard`, etc.) is protected by `@login_required`, but the underlying templates for all of these pages are accessible unauthenticated via this endpoin
pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev101, the `/web/` route in `src/pyload/webui/app/blueprints/app_blueprint.py` renders Jinja2 templates without any authentication requirement. Every equ
CVE-2026-108160 | AstronRPA through 1.1.6 contains a download of code without integrity check vulnerability that allows network attackers to deliver malicious updates by abusing the desktop client's auto-update mechanism. Attackers positioned between the client and server can serve a malicious update manifest and NSIS installer, which electron-updater installs without signature verification, executing code as the desktop user.
AstronRPA through 1.1.6 contains a download of code without integrity check vulnerability that allows network attackers to deliver malicious updates by abusing the desktop client's auto-update mechanism. Attackers positioned between the cli
CVE-2026-108157 | Pingvin Share X from 0.19.0 before 1.22.0 contains an improper authentication vulnerability that allows remote unauthenticated attackers to take over accounts by abusing automatic OAuth email linking in OAuthService.signUp(). Attackers can register a victim's unverified email on an enabled OAuth/OIDC provider, exploiting the missing email_verified check in GenericOidcProvider, to sign in as the victim including administrators while bypassing TOTP.
Pingvin Share X from 0.19.0 before 1.22.0 contains an improper authentication vulnerability that allows remote unauthenticated attackers to take over accounts by abusing automatic OAuth email linking in OAuthService.signUp(). Attackers can
CVE-2016-20098 | Moderator Toolbox (reddit-moderator-toolbox) before 4.0.14 contains a stored cross-site scripting vulnerability in the removalreasons module, which inserts subreddit toolbox wiki fields into popup HTML without encoding. Attackers who can edit the toolbox wiki page can plant JavaScript in fields like pmsubject, header, or reason titles to act with moderators' Reddit sessions.
Moderator Toolbox (reddit-moderator-toolbox) before 4.0.14 contains a stored cross-site scripting vulnerability in the removalreasons module, which inserts subreddit toolbox wiki fields into popup HTML without encoding. Attackers who can ed
CVE-2026-107814 | MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB RPM packages created the dedicated mysql service account with the database data directory as its home directory. A database user with the FILE privilege could write startup dot-files such as .bash_profile into $HOME, and those files could execute when an administrator opened a login shell for the mysql account. Debia
MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB RPM packages created the dedicated mysql service account with the database data directory as its
CVE-2026-107813 | Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, the api/cluster router exposes node and namespace mutation operations and cluster-wide Nginx reload or restart operations with AuthRequired but without RequireSecureSession. An authenticated OTP-enabled user possessing a stolen or persisted JWT can therefore perform node CRUD, read or replace node credentials, change namespaces, and invoke nodes/reload_nginx or nodes/restart_n
Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, the api/cluster router exposes node and namespace mutation operations and cluster-wide Nginx reload or restart operations with AuthRequired but without Requi
CVE-2026-107812 | Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, the self-upgrade mechanism validates a downloaded binary only with a same-origin digest obtained from the same upgrade mirror. A compromised mirror or network attacker able to alter both responses can supply a malicious executable and matching digest. An operator-triggered upgrade is required, and the application installs and runs the attacker-controlled code in the Nginx UI p
Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, the self-upgrade mechanism validates a downloaded binary only with a same-origin digest obtained from the same upgrade mirror. A compromised mirror or networ
CVE-2026-107783 | Insertion of sensitive information into log file in AWS Tools for PowerShell before 5.0.306 might allow local users to recover an IAM user's cleartext AWS Management Console password from command output and log artifacts. To remediate this issue, users should upgrade to version 5.0.306 or later. After upgrading, review PowerShell transcripts and log stores for previously disclosed passwords and rotate any affected IAM console passwords.
Insertion of sensitive information into log file in AWS Tools for PowerShell before 5.0.306 might allow local users to recover an IAM user's cleartext AWS Management Console password from command output and log artifacts. To remediate th