Author name: UNDERCODE

CVE-2026-44798 affects Nautobot, a popular Network Source of Truth and Automation Platform, specifically versions prior to 2.4.33 and 3.1.2. The

Intro CVE-2026-48864 is a heap buffer overflow vulnerability discovered in libsolv, a library used for solving package dependencies. The flaw

The vulnerability arises from a missing UTS 46 revision 33 validity check in the Punycode decoding routine of the `symfony/polyfill-intl-idn`

The root cause of CVE-2026-48923 lies in the Jenkins AppSpider Plugin, specifically in versions 1.0.17 and earlier. The plugin includes

Intro CVE-2026-44318 affects free5GC, an open‑source 5G core network implementation. The vulnerability resides in the BSF (Binding Support Function) component,

The Mailjet mailer bridge and the LOX24 SMS notifier bridge both ship webhook request parsers used to authenticate and decode

OpenBao’s cross-namespace lease revocation vulnerability (CVE-2026-45808) arises from missing namespace checks in legacy API endpoints. OpenBao namespaces are designed to

Intro (How CVE-2026-44437 works): Angular SSR (Server-Side Rendering) trusts the `X-Forwarded-Prefix` HTTP header when the application is deployed behind a

To defend against namespace hijacking achieved through update/patch operations on namespaces, Capsule uses a ValidatingWebhookConfiguration to intercept changes to namespace

Intro CVE-2026-48925 is a cross-site request forgery (CSRF) vulnerability present in the Jenkins GitHub Integration Plugin version 0.7.3 and earlier.

Intro CVE-2026-44471 affects gitoxide, a Rust implementation of git, versions prior to 0.21.1. The vulnerability allows a maliciously crafted tree

CVE-2026-44320 allows an unauthenticated attacker to bypass the OAuth2/bearer‑token authorization boundary on the Network Exposure Function (NEF) `/nnef‑callback` route group.

How CVE-2026-41178 Works The vulnerability exists in the baggage header parsing logic of the OpenTelemetry Go SDK. The issue was

Intro CVE-2026-44373 affects Nitro, a next-generation server toolkit, prior to version 3.0.260429-beta. The vulnerability allows an attacker to bypass proxy

A source‑code audit of the `trestle/core/remote/cache.py` module uncovered three distinct security flaws. Finding 1, tracked as CVE‑2026‑46380, is a Server‑Side Request

CVE-2026-48920 is a high‑severity information disclosure vulnerability in the Jenkins Email Extension Plugin, all versions up to and including 1933.v45cec755423f.

The CVE-2026-48919 vulnerability resides in the Jenkins Active Directory Plugin (version 2.41 and prior) due to how it handles LDAP

CVE-2026-44321 is a critical vulnerability discovered in free5GC, an open-source 5G core network implementation. The flaw resides in the Session

CVE-2025-13096 is an XML External Entity (XXE) injection vulnerability affecting IBM Business Automation Workflow containers and traditional deployments. The root

Intro free5GC is an open‑source implementation of the 5G core network. Prior to version 4.2.2, the NEF component exposes a

CVE-2026-44319 describes a denial-of-service vulnerability in free5GC, an open-source 5G core network implementation. The flaw resides in the Network Exposure

CVE-2026-48922 is a path traversal flaw in the Jenkins Credentials Binding Plugin (versions ≤720.v3f6decef43ea_). The plugin fails to properly sanitize

The CVE-2026-8495 stems from a missing authorization check in the Drupal Date iCal module (versions prior to 4.0.15). This module

How the mentioned CVE works: The vulnerability exists due to insecure handling of temporary file paths in FastNetMon Community Edition

The vulnerability resides in the Drupal module “Translate Drupal with GTranslate” (gtranslate) versions prior to 3.0.5. It stems from a

The vulnerability resides in the Alt-Svc header parser within src/hackney_altsvc.erl. When the HTTP client receives a response, it calls `parse_and_cache/3`

How the mentioned CVE works: In FastNetMon Community Edition through 1.2.9, the function `allocate_buffer()` inside `src/packet_storage.hpp` computes memory allocation using

How the mentioned CVE works The vulnerability exists in Twenty CRM versions 1.7.7 through 1.16.7 due to unsanitized user input

How CVE-2026-45361 works Apache Airflow’s `google-provider` package includes a hook named `ComputeEngineSSHHook` for establishing SSH connections from Airflow workers to

How the vulnerability works (technical details) CVE-2026-47070 is a sensitive data exposure flaw in the hackney HTTP client for Erlang/Elixir,

The CVE-2026-8491 vulnerability resides in the Drupal Node View Permissions module. This module is designed to restrict access to node

How the mentioned CVE works The vulnerability exists in the logout endpoint of the SimpleSAMLphp casserver module (CAS 1.0/2.0 compliant

The vulnerability resides in the `process_netflow_v9_options_template()` function within the `src/netflow_plugin/netflow_v9_collector.cpp` file. When FastNetMon receives a NetFlow v9 Options Template FlowSet,

How the mentioned CVE works The vulnerability exists in Traccar’s `DeviceResource.uploadImage` endpoint. Prior to version 6.13.0, this method authorizes the

How the mentioned CVE works (CVE-2026-41315): The vulnerability exists in mdserver-web versions 0.18.0 through 0.18.4 due to missing authentication on

The vulnerability resides in the `gdi_CacheToSurface` function of FreeRDP versions before 3.26.0. When an RDP client processes a `CacheToSurface` order

The vulnerability exists in Twenty CRM versions 1.18.0 and earlier due to insecure file serving endpoints (/files/ and /file/:fileFolder/:id). When

The vulnerability exists in the BGP NLRI decoder of FastNetMon Community Edition versions up to 1.2.9. The function decode_bgp_subnet_encoding_ipv4_raw() inside

This vulnerability stems from improper input validation and sanitization within the `com_finder` component of Joomla CMS. It occurs when the

The vulnerability stems from missing authorization checks in two critical API endpoints: the device bulk actions and the device update

The vulnerability arises because NVIDIA Isaac Launchable for Linux transmits sensitive information (e.g., API tokens, robot credentials, configuration data) in

The vulnerability exists in the `wisp.serve_static` function, which processes file paths for static file serving. The function sanitizes the request

How CVE-2025-13755 Works CVE-2025-13755 is an information disclosure vulnerability in IBM Db2. The vulnerability lies in how the database engine

The vulnerability arises from improper output escaping in Joomla’s com_contenthistory component, which handles version comparisons and restoration of content. The

How CVE-2025-7024 Works CVE-2025-7024 is a vulnerability in Airbus PSS TETRA Connectivity Server (TCS) version 7.0 running on Windows Server

The vulnerability resides in Joomla’s multilingual associations component (com_associations), which fails to properly escape user-supplied output before rendering it in

The vulnerability resides in Joomla’s `com_tags` component, which handles tag listings. The application does not properly validate user-controlled input that

⚙️ How CVE-2026-42901 Works The flaw centers on the Agent ID Administrator role in Microsoft Entra ID, intended for managing

How CVE-2026-23663 works: The vulnerability resides in Azure Entra ID (formerly Azure Active Directory) due to improper privilege management. An

How the mentioned CVE works (missing rate limiting – CWE-307): The vulnerability exists because the authentication endpoint POST /auth/token in

The vulnerability exists in the columnConfigAction endpoint of the CustomReportsBundle. An attacker with reports_config permission sends a crafted JSON configuration

The vulnerability resides in `TranslationController.php` (lines 565-593) of the Pimcore admin bundle. The endpoint `POST /admin/translation/translations` accepts a JSON `filter`

How CVE-2026-8835 works: The vulnerability resides in the Administration Server component of IBM HTTP Server (IHS) versions 8.5 and 9.0.

The vulnerability resides in the Scheduler Task Handler within the Joomla CMS backend. It stems from an improper access check

How the CVE works: AutoGPT deploys AI agents in Docker containers. The execution process writes logs to stdout/stderr, which Docker

How the CVE works The vulnerability exists in Concrete CMS versions 9.5.0 and below due to a missing permission check

How the mentioned CVE works (technical details) The vulnerability resides in the Linux kernel’s `skb_try_coalesce()` function, which merges packet buffer

The vulnerability exists in the i40e network driver within the Linux kernel. The issue occurs in a tracepoint assigned to

CVE-2025-0108 is an authentication bypass vulnerability in the PAN-OS management web interface. It affects PAN-OS versions 10.2, 11.1, 11.2, and

How the CVE Works CVE-2026-34926 is a relative path traversal vulnerability (CWE-23) in the on-premise version of Trend Micro Apex

The vulnerability (CVE-2026-20182) exists in the peering authentication mechanism of Cisco Catalyst SD-WAN Controller (formerly vSmart) and Cisco Catalyst SD-WAN

This is a denial-of-service (DoS) vulnerability in the Microsoft Defender Antimalware Platform, identified as CVE-2026-45498 with a CVSS 3.x score

The vulnerability stems from CWE-20: Improper Input Validation. Ivanti Endpoint Manager Mobile (EPMM) fails to properly validate user-supplied input in

The vulnerability resides in the io_uring zcrx (zero-copy receive) component of the Linux kernel. When initializing a scatter‑gather (sg) list

The vulnerability exists in the Linux kernel’s PF_KEY (RFC 2367) implementation, specifically in export paths that handle IPv6 socket addresses.

The vulnerability resides in the MLflow Assistant feature introduced in version 3.9.0. The Assistant’s `/ajax-api` endpoints failed to implement proper

The vulnerability arises from a missing bounds check in TensorRT’s tensor processing routines during model optimization or execution. When parsing

When a process uses vfork() or the CLONE_VM flag, the kernel’s Memory Management Context ID (MMCID) logic must properly fix

The vulnerability stems from how TP-Link Archer C7 v5 and v5.8 routers handle administrator login authentication. When a user logs

The vulnerability stems from inadequate protection of sensitive data within the local storage mechanisms of Dell PowerFlex Manager versions 4.6.2

The vulnerability exists in Kitty terminal versions 0.46.2 and below within the load_image_data() function, which processes graphics protocol commands. An

How the CVE works: This vulnerability resides in the way Parse Server processes the `X-Parse-Client-Version` header and `_ClientVersion` JSON body

The vulnerability arises because `createAlertRule` and `createService` accept `FailTriggerTasks` and `RecoverTriggerTasks` arrays without validating that the referenced cron task IDs

How the mentioned CVE works: The vulnerability stems from incorrect role-based access control. Nezha dashboard defines two roles: RoleAdmin (0)

The vulnerability exists because the WebSocket endpoint `/api/v1/ws/server` uses an optional authentication middleware but fails to enforce per‑server ownership or

The library version 2.6.9 and later fixed a Server-Side Request Forgery (SSRF) vulnerability present in earlier versions (before 2.6.9). The

The distributed pixel cache server (magick -distribute-cache) listens on a TCP port and forks a child process to handle each

The vulnerability arises from three missing safeguards in the gossipsub implementation for Node.js. First, `defaultDecodeRpcLimits.maxSubscriptions = Infinity` allows an unbounded

The CVE‑2026‑46635 vulnerability exists in Twig’s sandbox component and allows an attacker to bypass the property allowlist via the `column`

How the CVE Works The vulnerability resides in how Boxlite extracts OCI image layers. When a malicious OCI image is

The vulnerability exists because Twig’s `spaceless` filter is registered with the `is_safe => [‘html’]` flag. This flag tells Twig’s auto-escaping

The vulnerability stems from an incomplete fix for a previous sandbox bypass issue (CVE-2024-45411/GHSA-6j75-5wfj-gh66). The original fix added an explicit

The original vulnerability, tracked as GHSA-5592-p365-24xh (CVE-2026-40169) , was a heap buffer overflow (write) in the YAML and JSON encoders

The CVE arises from a flaw in the `PasskeyEncipherImage` method of ImageMagick (affecting its .NET wrappers via Magick.NET). ImageMagick scrambles

How the CVE works: The vulnerability resides in js-cookie’s internal `assign()` helper (src/assign.mjs). This function copies properties from source objects

How the CVE works: The ajax_lookup endpoint in application.py handles GET requests for autocomplete lookups on model fields. Unlike all

How CVE-2026-46678 Works (Incomplete Fix of CVE-2026-25580) The original CVE-2026-25580 (fixed in v1.56.0) allowed SSRF via force_download=’allow-local’, letting attackers reach