exploit

CVE-2026-21363 is a NULL Pointer Dereference vulnerability affecting Adobe Substance 3D Painter versions 11.1.2 and earlier. The vulnerability exists within

CVE-2026-31807 details a reflected Cross-site Scripting (XSS) vulnerability in SiYuan, a personal knowledge management system, versions prior to 3.5.10. The

A high-severity integrity bypass vulnerability, identified as CVE-2026-31839, existed in Striae’s digital confirmation workflow prior to version 3.0.0 . Striae

The vulnerability stems from incorrect default permissions (CWE-276) within .NET 10.0 on Linux systems. During the packaging process of .NET

The vulnerability, identified as CVE-2025-70238, is a stack-based buffer overflow found in the D-Link DIR-513 router running firmware version 1.10.

Parse Server versions prior to 8.6.33 and 9.6.0-alpha.7 contain a vulnerability in the Multi-Factor Authentication (MFA) implementation. When MFA via

The vulnerability exists in the challenge-based authentication for the local gRPC client API used by Anytype Desktop and Anytype-CLI. The

The vulnerability exists in the Craft CMS conditions system, specifically within the `BaseElementSelectConditionRule::getElementIds()` method. This method passes user-controlled string input

The vulnerability resides in how Adobe Substance3D Painter versions 11.1.2 and earlier handle specific file structures during the parsing process.

This vulnerability is a vertical privilege escalation flaw in Umbraco CMS. It occurs because the application fails to properly enforce

PinchTab is a standalone HTTP server that gives AI agents direct control over a Chrome browser. Prior to version 0.7.7,

CVE-2026-27274 is a high-severity vulnerability affecting Adobe Substance 3D Stager versions 3.1.7 and earlier. This flaw is classified as an

The vulnerability is a stored Cross-Site Scripting (XSS) issue found in the Craft CMS control panel. It resides in the

The vulnerability exists in Shescape versions prior to 2.1.10 because the `escape()` function fails to escape square brackets ([ and

How the CVE Works: The vulnerability resides in Quill versions prior to v0.7.1, specifically in the function that fetches Apple

The vulnerability lies in the `/verificationEmailRequest` endpoint of Parse Server. When email verification is enabled (verifyUserEmails: true), the endpoint’s behavior

The CVE-2025-70250 vulnerability is a stack-based buffer overflow residing in the D-Link DIR-513 router specifically on firmware version 1.10. The

CVE-2026-27218 is a NULL Pointer Dereference vulnerability found in Adobe Substance 3D Painter versions 11.1.2 and earlier . This type

Substance 3D – Painter versions 11.1.2 and earlier are affected by a NULL Pointer Dereference vulnerability (CWE-476) that could lead

Quill is a tool for signing and notarizing macOS binaries from any platform . During the Apple notarization process, it

The vulnerability stems from three combined issues in Argo Workflows’ handling of `podSpecPatch` when `templateReferencing: Strict` is enabled. First, the

CVE-2026-27216 is a vulnerability affecting Adobe Substance 3D Painter, a popular 3D texturing software . The issue is classified as

CVE-2025-70243 is a critical stack-based buffer overflow vulnerability discovered in the D-Link DIR-513 router running firmware version v1.10. The issue

CVE-2026-27215 is a vulnerability found in Adobe Substance 3D Painter versions 11.1.2 and earlier. It is classified as a NULL

The vulnerability, identified as CVE-2026-29777, exists in Traefik’s Kubernetes Gateway provider. It stems from improper neutralization of special elements used

CVE-2026-27214 is a NULL Pointer Dereference vulnerability affecting Adobe Substance 3D Painter versions 11.1.2 and earlier. This flaw occurs when

The vulnerability, identified as CVE-2026-26130, is a Denial of Service (DoS) flaw residing in ASP.NET Core, a cross-platform framework for

How the mentioned CVE works: The vulnerability resides in Shopware’s legacy app registration flow that uses HMAC-based authentication. During the

The D-Link DIR-513 router, specifically version 1.10, utilizes the Boa web server to handle administrative web interface requests . This

CVE-2026-21365 is an out-of-bounds read vulnerability affecting Adobe Substance 3D Painter versions 11.1.2 and earlier . This memory exposure issue

The vulnerability resides in the Store API login endpoint (POST /store-api/account/login). When a login attempt is made, the `AccountService::getCustomerByLogin()` method

The vulnerability, identified as CVE-2026-26127, is a denial of service flaw residing in .NET 9.0 and .NET 10.0, specifically within

Three chained vulnerabilities in @siteboon/claude-code-ui allow unauthenticated remote code execution (RCE). The chain begins with an insecure default JWT secret

The vulnerability, present in Chartbrew versions prior to 4.8.3, is an unauthenticated SQL injection flaw in the handling of date-type

In versions prior to 4.8.1, Chartbrew suffered from an Insecure Direct Object Reference (IDOR) vulnerability during chart operations. The application

Prior to version 4.8.4, Chartbrew contained a vulnerability in its project logo upload functionality. The application failed to validate the

How CVE-2026-27603 Works: This vulnerability resides in the Chartbrew API, specifically the endpoint /project/:project_id/chart/:chart_id/filter. Chartbrew versions prior to 4.8.4 failed

CVE-2026-25887 is a pre-authentication Remote Code Execution vulnerability in Chartbrew versions prior to 4.8.1, specifically within the MongoDB dataset query

The vulnerability CVE-2026-3815 is a critical buffer overflow found in the UTT HiPER 810G gigabit router, specifically in firmware versions

The vulnerability, identified as CVE-2026-3814, is a critical buffer overflow found in the UTT HiPER 810G router firmware up to

The vulnerability, discovered by Gai Tanaka, exists in the MQTT module of Apache ActiveMQ . It stems from improper validation

The vulnerability CVE-2026-3385 resides in the `resolveLocal` function within `src/vm/wren_compiler.c` of the wren-lang interpreter, affecting versions up to 0.4.0. The

How CVE-2026-25888 Works: CVE-2026-25888 is a critical vulnerability in Chartbrew versions prior to 4.8.1 that allows remote code execution through

CVE-2025-26399 is a critical unauthenticated remote code execution vulnerability in SolarWinds Web Help Desk (WHD) stemming from insecure deserialization within

The vulnerability, present in specific WebAuthn library implementations like those found in Quarkus, arises from a flawed origin validation process

The CVE-2024-12345 vulnerability arises from the improper handling of SVG files in FileBrowser when the nohtml configuration option is enabled.

The vulnerability in OneUptime v10.0.20 arises from the server trusting a client‑controlled HTTP header, is-multi-tenant-query. In CommonAPI.ts, the presence of

The vulnerability resides in the JIT compilation engine, which is fully exposed via the Foreign Function Interface (CFFI). Due to

The vulnerability allows any low-privileged, authenticated project user to achieve remote code execution on the OneUptime Probe server. The root

The `resend-verification-code` endpoint in OneUptime versions prior to 8.0.5567 contains an authorization gap that allows any authenticated user to trigger

The linkdave HTTP server, up to version 1.2.4, fails to enforce any authentication mechanism on its REST and WebSocket endpoints.

The CVE-2026-30913 vulnerability resides in the `flarum/nicknames` extension for the Flarum forum software . When enabled, this extension allows registered

The vulnerability resides in the `ensureChromeExtensionRelayServer` function within OpenClaw versions from 2026.1.14-1 to before 2026.2.12 . The core issue is

In version 1.18.0 of the open-source enterprise social network HumHub, a cross-site scripting (XSS) vulnerability was identified within the application’s

CVE-2026-29076 is a denial of service vulnerability in the cpp-httplib library, a C++11 header-only HTTP/HTTPS library. The vulnerability resides in

CVE-2026-28394 is a denial of service vulnerability found in OpenClaw versions prior to 2026.2.15, specifically within the `web_fetch` tool. The

An unauthenticated attacker can crash the Parse Server process or bypass Cloud Function dispatch by exploiting how the server resolves

The vulnerability, identified as CVE-2026-28802, resides in the Authlib library, a Python framework used for building OAuth and OpenID Connect

CVE-2026-28472 is a critical vulnerability in OpenClaw versions prior to 2026.2.2, residing in the gateway’s WebSocket connection handshake. The flaw

The vulnerability, identified as CVE-2026-2751, is a Blind SQL Injection flaw located in the Service Dependencies deletion feature of Centreon

A malicious client can exploit a Regular Expression Denial of Service (ReDoS) vulnerability in Parse Server by subscribing to a

CVE-2026-28222 is a stored Cross-site Scripting (XSS) vulnerability found in Wagtail, an open-source content management system built on Django. The

CVE-2026-28223 is a stored cross-site scripting (XSS) vulnerability residing in the `wagtail.contrib.simple_translation` module . The issue occurs because the module

The vulnerability, identified as CVE-2026-26017 and patched in CoreDNS version 1.14.2, is a logical flaw in the default plugin execution

The vulnerability stems from a flaw in how Parse Server scans incoming request payloads against the `requestKeywordDenylist` . This security

A bug in Astro’s image pipeline, affecting versions 9.0.0 through 9.5.3, allows attackers to bypass `image.domains` and `image.remotePatterns` restrictions. This

The vulnerability arises from a flaw in the `_has_sneaky_javascript()` method within the `lxml_html_clean` library (versions prior to 0.4.4). This method

The vulnerability, identified as CVE-2026-3089, resides in the Actual Sync Server, a budgeting synchronization backend. It affects all versions prior

CVE-2026-22850 is a high-severity SQL injection vulnerability in the Koko Analytics plugin for WordPress versions prior to 2.1.3 . The

The vulnerability exists in the auth0/node-jws library, a JSON Web Signature implementation for Node.js. Affected versions are 3.2.2 and earlier,

CVE-2025-59904 is a Stored Cross-Site Scripting (XSS) vulnerability found in Kubysoft, a cloud-based ERP platform . The flaw resides specifically

The reflected Cross-Site Scripting (XSS) vulnerability, identified as CVE-2025-59905, resides in the Kubysoft ERP platform. It specifically exists within the

CVE-2026-28469 is a critical vulnerability in OpenClaw versions prior to 2026.2.14, specifically within the Google Chat monitor component . The

The vulnerability resides in CoreDNS’s loop detection plugin, designed to prevent infinite forwarding loops by generating a unique secret query

The vulnerability stems from the HTML cleaning library `lxml_html_clean` failing to remove the “ tag in its default configuration. The

The vulnerability stems from how LiquidJS handles file inclusions through the layout, render, and `include` tags . These tags are

The vulnerability stems from the `/api/4/config` REST API endpoint, which returns the entire parsed Glances configuration file (glances.conf) without any

A stored Cross-Site Scripting (XSS) vulnerability exists in FileBrowser, identified as CVE-2025-52902, affecting versions prior to v2.33.7 . The vulnerability

A vulnerability exists in the wireless encryption handling of Wi-Fi transmissions within HPE Aruba Networking AOS. The flaw allows a

The vulnerability exists in the event participation logic within modules/events/events_function.php. At line 47, the parameter `user_uuid` is retrieved from the

OpenClaw’s `system.run` allowlist analysis failed to respect POSIX shell comment semantics when determining allow-always persistence entries . In `security=allowlist` mode,

An OS command injection vulnerability exists in Copeland XWEB Pro version 1.12.1 and prior. The flaw resides in the “devices”

The vulnerability is a privilege escalation flaw in the publish service of SiYuan Note . It allows a low-privilege publish

Chamilo LMS prior to version 1.11.34 is vulnerable to an authenticated remote code execution attack due to improper validation of

CVE-2026-24517 is an OS command injection vulnerability affecting Copeland XWEB Pro versions 1.12.1 and prior. The vulnerability exists because the

An OS command injection vulnerability, identified as CVE-2026-25109, exists in Copeland XWEB Pro versions up to 1.12.1. The vulnerability resides

The vulnerability resides in the `fetchWithSsrFGuard` function, which is designed to make HTTP requests with security considerations. In affected versions,

CVE-2026-28288 is an information disclosure vulnerability in the open-source LLM application development platform, Dify . The flaw exists in versions

CVE-2026-23812 is a medium-severity vulnerability in HPE access points where an attacker connecting as a standard wired or wireless client

In OpenClaw versions up to 2026.3.2, a critical flaw in authorization scope enforcement allowed authenticated gateway clients with `operator.write` privileges

The vulnerability stems from the `ConfigWriter::cleanUpString()` function in AzuraCast, located in `backend/src/Radio/Backend/Liquidsoap/ConfigWriter.php` around line 1345 . This function is intended

CVE-2025-55208 is a Stored Cross-Site Scripting (XSS) vulnerability found in Chamilo LMS versions prior to 1.11.34. The vulnerability resides in

The vulnerability exists in OpenClaw’s HTTP hook handler, which manages incoming webhook requests at the `/hooks/` endpoint. The handler incorrectly

A vulnerability exists in the packet processing logic of certain HPE Access Points. An authenticated attacker can craft and transmit

The vulnerability stems from improper sanitization of user-supplied image URLs within the Frappe framework. An attacker can inject malicious JavaScript

The vulnerability stems from inconsistent account scoping in the `/allowlist … –store` command. When a user with a selected channel

The vulnerability in HPE’s client isolation mechanism allows attackers to bypass Layer 2 (L2) communication restrictions between clients. This enables

An OS command injection vulnerability exists in XWEB Pro version 1.12.1 and prior, specifically within the firmware update route. The

The vulnerability resides in how `system.run` handles environment variable overrides. The functions `sanitizeSystemRunEnvOverrides` and `sanitizeHostExecEnv` in `src/infra/host-env-security.ts` were designed to

CVE-2026-25111 is an OS command injection vulnerability found in Copeland XWEB Pro versions up to 1.12.1 . The issue resides