CVEs published May 4, 2026
78,575 CVEs in 2026
It is a native application accessed locally, but it is also possible to enable remote access via the "WebCam Server" feature.
For a table already registered in a Polaris-managed catalog, changing only that property through an `ALTER TABLE`-style settings change (not a row-level `INSERT`, `SELECT`, `UPDATE`, or `DELETE`) bypasses…
Apache Polaris is supposed to issue short-lived GCS credentials that only work for one table's files, but a crafted namespace or table name can cause those credentials to work across the configured bucket…
Apache Polaris accepts literal `*` characters in namespace and table names.
Apache Polaris can issue broad temporary ("vended") storage credentials during staged table creation before the effective table location has been validated or durably reserved.
A privilege escalation vulnerability exists in the Web Interface functionality of GeoVision LPC2011/LPC2211 1.10.
An os command injection vulnerability exists in the DdnsSetting.cgi functionality of GeoVision LPC2011/LPC2211 1.10.
A critical IDOR vulnerability has been discovered in Comet Backup affecting all versions from 20.11.0 to 26.1.1 and 26.2.1.
A security flaw has been discovered in Totolink N300RH 3.2.4-B20220812.
A security flaw has been discovered in Totolink WA300 5.2cu.7112_B20190227.
Arelle before 2.39.10 contains an unauthenticated remote code execution vulnerability in the /rest/configure REST endpoint that accepts a plugins query parameter and forwards it to the plugin manager…
D-Link DIR-456U Hardware Revision A1 (End-of-Life, EOL) contains a hardcoded telnet backdoor.
D-Link DIR-600L Hardware Revision A1 (End-of-Life) contains a hardcoded telnet backdoor.
D-Link DIR-600L Hardware Revision B1 (End-of-Life) contains a hardcoded telnet backdoor.
D-Link DIR-605L Hardware Revision B2 (End-of-Life, EOL) contains a hardcoded telnet backdoor.
Nginx-ui exposes a backup restore endpoint (POST /api/restore) that is completely unauthenticated during the first 10 minutes after process startup on any fresh installation.
2.17.4, and 2.18.1, a flaw in the Oracle Database node's select operation allowed user-controlled input passed into the Limit field via expressions to be interpolated directly into the SQL query without…
A command injection vulnerability in the _extractLLM() function allows attackers to execute arbitrary shell commands on the server.
Arbitrary Class Instantiation via Model Manifest in Apache OpenNLP ExtensionLoader Versions Affected: before 1.9.5, before 2.5.9, before 3.0.0-M3 Description: The…
Vm2 is vulnerable to full sandbox escape with arbitrary code execution.
SuppressedError allows attackers to escape the sandbox and run arbitrary code.
VM2 suffers from a sandbox breakout vulnerability through the inspect function.
The fix for CVE-2023-37466 is insufficient and can be circumvented allowing attackers to write code which can escape from the VM2 sandbox and execute arbitrary commands on the host system.
VM2 suffers from a sandbox breakout vulnerability.
2.17.4, and 2.18.1, an unauthenticated attacker could register a malicious MCP OAuth client with a crafted client_name.
A stored XSS vulnerability in the note export flow can be escalated to remote code execution in the desktop app.
OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems.
OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems.
Buffer overflow due to incorrect authorization in PLC FW
IsPasswordMatch in backend/db/models.go falls back to a hard-coded bcrypt("null") placeholder whenever a user has no stored password.
An insufficient encryption vulnerability exists in the Device Authentication functionality of GeoVision GV-IP Device Utility 9.0.5.
WDR201A WiFi Extender (HW V2.1, FW LFMZX28040922V1.02) contains an OS command injection vulnerability in the firewall.cgi binary across five request handlers that apply insufficient input validation.
WDR201A WiFi Extender (HW V2.1, FW LFMZX28040922V1.02) contains an OS command injection vulnerability in the adm.cgi binary's reboot_time function that allows unauthenticated remote attackers to execute…
WDR201A WiFi Extender (HW V2.1, FW LFMZX28040922V1.02) contains an OS command injection vulnerability in the makeRequest.cgi binary that allows unauthenticated remote attackers to execute arbitrary shell…
WDR201A WiFi Extender (HW V2.1, FW LFMZX28040922V1.02) contains an OS command injection vulnerability in the internet.cgi binary that allows unauthenticated remote attackers to execute arbitrary shell…
WDR201A WiFi Extender (HW V2.1, FW LFMZX28040922V1.02) contains an OS command injection vulnerability in the wireless.cgi binary that allows unauthenticated remote attackers to execute arbitrary shell…
Ollama before 0.17.1 contains a heap out-of-bounds read vulnerability in the GGUF model loader.
XML External Entity (XXE) via Unsanitized Dictionary Parsing in Apache OpenNLP DictionaryEntryPersistor Versions Affected: before 2.5.9, before 3.0.0-M3 Description: The DictionaryEntryPersistor class…
A stack overflow vulnerability exists in the WebCam Server Login functionality of GeoVision GV-VMS V20 20.0.2.
A stack overflow vulnerability exists in the WebCam Server Login functionality of GeoVision GV-VMS V20 20.0.2.
A vulnerability was detected in Totolink N300RH 3.2.4-B20220812.
A security vulnerability has been detected in Totolink N300RH 3.2.4-B20220812.
A weakness has been identified in Totolink N300RH 3.2.4-B20220812.
A vulnerability was determined in Totolink WA300 5.2cu.7112_B20190227.
D-Link DIR-605L Hardware Revision A1 (End-of-Life, EOL) contains a hardcoded telnet backdoor.
2.17.4, and 2.18.1, the fix for GHSA-f3f2-mcxc-pwjx did not cover the Snowflake node or the legacy MySQL v1 node.
2.17.4, and 2.18.1, an authenticated user with permission to create or modify workflows containing a Python Code Node could escape the sandbox and achieve arbitrary code execution on the task runner container.
2.17.4, and 2.18.1, an authenticated user with permission to create or modify workflows could achieve global prototype pollution via the XML Node leading to RCE when combined with other nodes exploiting the…
2.17.4, and 2.18.1, a flaw in the xml2js library used to parse XML request bodies in n8n's webhook handler allowed prototype pollution via a crafted XML payload.
2.17.4, and 2.18.1, a flaw in the SeaTable node's row:search and row:get operations allowed user-controlled input to be concatenated directly into SQL query strings without escaping or parameterization.
NetBox versions 4.3.5 through 4.5.4 contain a remote code execution vulnerability in the RenderTemplateMixin.get_environment_params() method that allows authenticated users with exporttemplate or…
An escalation of privilege bug in various modules in Apache HTTP 2.4.66 and earlier allows local .htaccess authors to read files with the privileges of the httpd user.
Double Free and possible RCE vulnerability in Apache HTTP Server with the HTTP/2 protocol.
This could lead to remote (proximal/adjacent) code execution as the shell user with no additional execution privileges needed.
A guessable session cookie vulnerability exists in the Web Interface functionality of GeoVision LPC2011/LPC2211 1.10.
PPTAgent is vulnerable to arbitrary code execution via Python eval() of LLM-generated code with builtins in scope.
A flaw was found in the AAP gateway.
WDR201A WiFi Extender (HW V2.1, FW LFMZX28040922V1.02) contains a stack-based buffer overflow vulnerability in the firewall.cgi and makeRequest.cgi binaries that allows unauthenticated attackers to…
An unauthenticated bootstrap takeover exists in nginx-ui during the initial installation window exposed by POST /api/install.
An unauthenticated network attacker can claim the initial administrator account on a fresh nginx-ui instance during the first-run setup window.
OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems.
A path traversal vulnerability in the skill download (fetch) command allows attackers to write files to arbitrary locations on the filesystem.
Description: Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Atlas Apache Atlas exposes a DSL search endpoint that accepts user-supplied query strings.
phpBB before 3.3.16 is vulnerable to Host Header Injection that can lead to password rest link poisoning.
BusyBox before commit 42202bf contains a heap buffer overflow vulnerability in the DHCPv6 client (udhcpc6) DNS_SERVERS option handler in networking/udhcp/d6_dhcpc.c that allows network-adjacent attackers to…
Improper privilege management in the log rotation mechanism of the Skylight Workspace Config Service in Amazon WorkSpaces for Windows before 2.6.2034.0 allows a local non-admin authenticated user to place…
An issue in Lymphatus caesium-image-compressor All versions up to and including commit 02da2c6 allows a local attacker to execute arbitrary code via the shutdownMachine and putMachineToSleep functions in…
Memory Corruption when copying data from a freed source while executing performance counter deselect operation.
Boundary Community Edition and Boundary Enterprise (“Boundary”) workers are vulnerable to a denial-of-service condition during node enrollment TLS handshakes.
@fastify/accepts-serializer cached serializer-selection results keyed by the request Accept header without a size limit or eviction policy.
fast-uri decoded percent-encoded path separators and dot segments before applying dot-segment removal in its normalize() and equal() functions.
OOM Denial of Service via Unbounded Array Allocation in Apache OpenNLP AbstractModelReader Versions Affected: before 1.9.5 before 2.5.9 before 3.0.0-M3 Description: The AbstractModelReader methods…
2.17.4, and 2.18.1, the MCP OAuth client registration endpoint accepted unauthenticated requests and stored client data without adequate resource controls.
The dynamic-node-parameters endpoints did not verify whether the authenticated caller was authorized to use a supplied credential reference.
The remote read endpoint (/api/v1/read) does not validate the declared decoded length in a snappy-compressed request body before allocating memory.
The client_secret field in the Azure AD remote write OAuth configuration (storage/remote/azuread) was typed as string instead of Secret.
The Easy PayPal Events & Tickets plugin for WordPress before version 1.4 contains an information disclosure vulnerability in the QR code scanning endpoint that allows unauthenticated attackers to enumerate…
An out-of-bounds read in the ParseIP6Extended function (/bgp/bgp.go) of gobgp v4.3.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted BGP UPDATE message.
An integer underflow in FRRouting (FRR) stable/10.0 to stable/10.6 allows attackers to cause a Denial of Service (DoS) via supplying a crafted BGP UPDATE message.
Buffer Over-read vulnerability in Apache HTTP Server.
A heap buffer overflow vulnerability exists in the DTLS handshake fragment reassembly logic of GnuTLS.
Easy PayPal Events & Tickets plugin for WordPress before version 1.4 contains a hardcoded authentication bypass vulnerability in the QR code scanning functionality that allows unauthenticated remote…
A NULL pointer dereference in mod_dav_lock in Apache HTTP Server 2.4.66 and earlier may allow an attacker to crash the server with a malicious request.mod_dav_lock is not used internally by mod_dav or…
Conditional Fields for Contact Form 7 WordPress plugin through version 2.7.2 contains an uncontrolled resource consumption vulnerability in the Wpcf7cfMailParser class where the…
Multiple reflected cross-site scripting (xss) vulnerabilities exist in the Web Interface / ssi.cgi functionality of GeoVision LPC2011/LPC2211 1.10.
Multiple reflected cross-site scripting (xss) vulnerabilities exist in the Web Interface / ssi.cgi functionality of GeoVision LPC2011/LPC2211 1.10.
A vulnerability was determined in osrg GoBGP up to 4.3.0.
A vulnerability was found in osrg GoBGP up to 4.3.0.
A flaw has been found in funadmin up to 7.1.0-rc6.
A vulnerability was determined in Shandong Hoteam Software PDM Product Data Management System up to 8.3.9.
A flaw has been found in PrefectHQ prefect up to 3.6.13.
A weakness has been identified in MindsDB up to 26.01.
A security flaw has been discovered in YunaiV yudao-cloud up to 3.8.0.
OpenSTAManager version 2.10 and earlier contains an arbitrary file upload vulnerability in the module update functionality (modules/aggiornamenti/upload_modules.php)
Improper Control of Generation of Code ('Code Injection') vulnerability in Profelis Information and Consulting Trade and Industry Limited Company SambaBox allows OS Command Injection.
Detect-It-Easy prior to 3.21 contains a path traversal vulnerability that allows attackers to write arbitrary files to the filesystem by crafting malicious archive entries with relative traversal sequences…
This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege.
This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege.
This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege.
A flaw has been found in crocodilestick Calibre-Web-Automated up to 4.0.6.
A privilege escalation vulnerability exists in the Web Interface / ssi.cgi functionality of GeoVision LPC2011/LPC2211 1.10.
2.17.4, and 2.18.1, the /chat WebSocket endpoint used by the Chat Trigger node's Hosted Chat feature did not verify that an incoming connection was authorized to interact with the target execution.
2.17.4, and 2.18.1, an authenticated user with a valid API key scoped to variable:list could read variables from projects they are not a member of by supplying an arbitrary projectId query parameter to the…
The GetSettings API handler (api/settings/settings.go:24-65) serializes all settings structs to JSON and returns them to authenticated users.
An authenticated user can call GET /api/settings and retrieve sensitive configuration values, including node.secret.
The globalsettings Meteor publication returns all global settings without any admin or role check.
The PUT upload handler (httpserver/updown.go) lacks the CSRF token validation that was added to the POST upload handler during the CVE-2026-40883 fix.
Missing input validation in the MP_REACH_NLRI component of FRRouting (FRR) stable/10.0 to stable/10.6 allows authenticated attackers to cause a Denial of Service (DoS) via supplying a crafted UPDATE message.
HTTP response splitting vulnerability in multiple Apache HTTP Server modules with untrusted or compromised backend servers.
This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed.
This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed.
A vulnerability was detected in CodeCanyon Perfex CRM up to 3.4.1.
A vulnerability was identified in SourceCodester Web-based Pharmacy Product Management System 1.0.
A vulnerability was determined in CodeAstro Online Classroom 1.0.
A vulnerability was found in CodeAstro Online Classroom 1.0.
A vulnerability has been found in CodeAstro Online Classroom 1.0.
A flaw has been found in CodeAstro Online Classroom 1.0.
A vulnerability was detected in CodeAstro Online Classroom 1.0.
A security flaw has been discovered in puchunjie doc-tools-mcp 1.0.18.
A vulnerability was detected in code-projects BloodBank Managing System 1.0.
A security vulnerability has been detected in code-projects BloodBank Managing System 1.0.
A weakness has been identified in privsim mcp-test-runner 0.2.0.
A security flaw has been discovered in pixelsock directus-mcp 1.0.0.
A vulnerability was identified in ryanjoachim mcp-rtfm 0.1.0.
A vulnerability was found in PrefectHQ prefect up to 3.6.25.dev6.
A security vulnerability has been detected in Totolink WA300 5.2cu.7112_B20190227.
A weakness has been identified in Totolink WA300 5.2cu.7112_B20190227.
A vulnerability was identified in Totolink WA300 5.2cu.7112_B20190227.
A vulnerability was found in code-projects Gym Management System In PHP and Windows NT 1.0.
A vulnerability has been found in ravenwits mcp-server-arangodb up to 0.4.7.
A vulnerability was detected in crocodilestick Calibre-Web-Automated up to 4.0.6.
A security vulnerability has been detected in MindsDB up to 26.01.
2.17.4, and 2.18.1, the /mcp-oauth/register endpoint accepted OAuth client registrations without authentication, allowing arbitrary redirect_uri values to be registered.
There is an integer overflow vulnerability in the W*H*D size computation inside _load_pnm() that can bypass the memory allocation guard.
Using the method POST /api/files/upload, any unauthenticated user can upload an SVG file with XSS.
wCMS v.1.4 is vulnerable to Cross Site Scripting (XSS) when creating a new blog.
The bundled web UI uses Underscore template interpolation mode <%= ... %> for untrusted metadata fields.
Cross Site Scripting vulnerability in Pluck CMS before v.4.7.21dev allows a remote attacker to escalate privileges via the editpage.php and the sanitizePageContent function
The nb_colors field read from the BMP file header is used directly to compute an allocation size without validating it against the remaining file size.
Memory corruption while processing IOCTL command when device is in power-save state.
A vulnerability was identified in osrg GoBGP up to 4.3.0.
A vulnerability has been found in osrg GoBGP up to 4.3.0.
A vulnerability was detected in PrefectHQ prefect up to 3.6.21.
Improper restriction of XML external entity reference vulnerability in ILM Informatique jOpenDocument allows Data Serialization External Entities Blowup.
The Magic Export & Import WordPress plugin before 1.2.0 stores exported CSV files at a publicly accessible location, making it possible for any visitors to leak sensitive user information.
After a note-mark owner soft-deletes a public book, its notes and uploaded assets stay readable at /api/notes/{id}, /api/notes/{id}/content, the slug URL, and the asset endpoints.
Improper Null Termination, Out-of-bounds Read vulnerability in Apache HTTP Server.
Out-of-bounds Read vulnerability in mod_proxy_ajp of Apache HTTP Server.
A NULL pointer dereference in the mod_authn_socache in Apache HTTP Server 2.4.66 and earlier allows an unauthenticated remote user to crash a child process in a caching forward proxy configuration.
A prototype pollution vulnerability in the mailbox store module allows attackers to modify the behavior of all JavaScript objects by injecting malicious properties into Object.prototype.
A vulnerability has been found in PrefectHQ prefect up to 3.6.28.dev1.
Velociraptor versions prior to 0.76.4 contain a resource exhaustion vulnerability in the server's agent control channel.
Plaintext storage of a password vulnerability in ILM Informatique OpenConcerto allows Retrieve Embedded Sensitive Data.
A timing attack against mod_auth_digest in Apache HTTP Server 2.4.66 allows a bypass of Digest authentication by a remote attacker.
OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems.
There is an arbitrary file write vulnerability via `save_generated_slides`.
PPTAgent is vulnerable to arbitrary file write and directory creation via markdown_table_to_image.
The PlantUML Macro is vulnerable to Server-Side Request Forgery (SSRF).
Claude SDK for TypeScript provides access to the Claude API from server-side TypeScript or JavaScript applications.
A security vulnerability has been detected in Open5GS up to 2.7.7.
A weakness has been identified in Open5GS up to 2.7.7.
A security flaw has been discovered in Open5GS up to 2.7.7.
OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems.
Postfix before 3.8.16, 3.9 before 3.9.10, and 3.10 before 3.10.9 sometimes allows a buffer over-read and process crash via an enhanced status code that lacks text after the third number.
mutt before 2.3.2 has an infinite loop in data_object_to_stream in crypt-gpgme.c.
The imap_auth_gss security level is mishandled.
mutt before 2.3.2 does not check for '\0' in url_pct_decode.
mutt before 2.3.2 sometimes truncates the hash_passwd by one byte for IMAP auth_cram MD5 digest.
mutt before 2.3.2 sometimes uses strfcpy instead of memcpy for the IMAP auth_cram MD5 digest.
A security vulnerability has been detected in justdan96 tsMuxer up to 2.7.0.
A weakness has been identified in justdan96 tsMuxer up to 2.7.0.
mutt before 2.3.2 has a show_sig_summary NULL pointer dereference.
Incorrect Permission Assignment for Critical Resource vulnerability in ILM Informatique OpenConcerto allows Replace Binaries.