Baitaphish
Security intelligence
SearchLatest briefing
Data & Insights

CVE Explorer

Search one exact, source-linked CVE snapshot by CVE ID or explicit vendor and product tokens. Provider severity, KEV, conflicts, and stale state remain separate observations—not a Baitaphish risk rating.
Snapshot urn:baitaphish:cve-read-model-snapshot:v3:f2c3f72dcc196f8e7d63aa2d29709ad8b3fea39110eb2d563da5ce9b6fa9da89Released 2026-08-05T02:00:00Z
Exact snapshot results

353,537 CVE records

CVE ID descending · no relevance ranking

CVE-2026-49135

CodexBar prior to 0.32.0 contains an insecure temporary file handling vulnerability that allows local attackers to access sensitive credentials or tamper with build artifacts by exploiting predictable file paths in the release notarization workflow. Attackers with access to the same host can read the App Store Connect API key written to a fixed path, pre-create files or symbolic links at predictable locations to redirect writes to attacker-controlled destinations, or tamper with notarization arc

PUBLISHED
Vendor
steipete
Product
CodexBar
Provider severity
HIGH
Conflicts
2

CVE-2026-49134

CodexBar prior to 0.32.0 contains a privilege escalation vulnerability in the CLI installer that allows local attackers to execute arbitrary commands as root by exploiting a race condition in temporary file handling. The installer creates a temporary file with mktemp, writes a privileged shell payload into it, and executes it with administrator privileges via bash, allowing a same-user local process to rewrite the installer body before the administrator prompt is approved, causing attacker-contr

PUBLISHED
Vendor
steipete
Product
CodexBar
Provider severity
HIGH
Conflicts
1

CVE-2026-49133

Typemill before 2.24.0 contains a path traversal vulnerability that allows authenticated attackers with Author-level privileges to read arbitrary files outside the content directory by supplying traversal sequences in the path query parameter passed to Storage::getFile() with an empty folder argument. Attackers can bypass traversal-prevention controls in Storage::getFolderPath() to access sensitive files.

PUBLISHED
Vendor
typemill
Product
typemill
Provider severity
HIGH, MEDIUM
Conflicts
1

CVE-2026-49132

OPNsense before 26.1.9 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject arbitrary HTML or JavaScript by embedding payloads in the certificate description field via the trust certificate API. The unsanitized description value is persisted and later rendered in the Dashboard Certificates widget through Certificates.js, which interpolates the raw value into HTML attribute and text content sinks without encoding, causing injected scripts to execute i

PUBLISHED
Vendor
Deciso B.V.
Product
OPNsense
Provider severity
MEDIUM
Conflicts
1

CVE-2026-49131

OPNsense before 26.1.9 contains a stored cross-site scripting vulnerability that allows authenticated attackers with firewall rule management privileges to inject arbitrary HTML or JavaScript by embedding payloads in the firewall rule description field via the filter API endpoint. The unsanitized description value is persisted and later rendered through the default cell formatter in opnsense_bootgrid.js, which assigns raw cell content to innerHTML, causing injected scripts to execute in the brow

PUBLISHED
Vendor
Deciso B.V.
Product
OPNsense
Provider severity
MEDIUM
Conflicts
1

CVE-2026-49130

Music Player Daemon (MPD) before version 0.24.11 contains a CRLF injection vulnerability in the xspf_char_data function within the XSPF playlist plugin that allows attackers to embed literal CR/LF bytes in URI fields by supplying a malicious XSPF playlist with XML numeric character references. Attackers can inject forged key-value lines through the location field into MPD protocol responses including playlistinfo, currentsong, and listplaylist outputs, as well as the state file writer, by exploi

PUBLISHED
Vendor
MusicPlayerDaemon
Product
MPD
Provider severity
MEDIUM
Conflicts
1

CVE-2026-4913

Improper protection of an alternate path in Ivanti N-ITSM before version 2025.4 allows a remote authenticated attacker to retain access when their account has been disabled.

PUBLISHED
Vendor
Ivanti, Ivanti
Product
Neurons for ITSM (Cloud), Neurons for ITSM (On-Premise)
Provider severity
MEDIUM
Conflicts
1

CVE-2026-49129

Music Player Daemon (MPD) before version 0.24.11 contains a server-side request forgery vulnerability in CurlInputPlugin where CURLOPT_FOLLOWLOCATION is set without CURLOPT_REDIR_PROTOCOLS_STR, allowing unauthenticated attackers to bypass the http/https scheme restriction by causing a malicious HTTP server to redirect to non-HTTP protocols such as gopher, ftp, sftp, ldap, dict, rtmp, or rtsp. Attackers can trigger this vulnerability via MPD commands that initiate URL fetches, including add, read

PUBLISHED
Vendor
MusicPlayerDaemon
Product
MPD
Provider severity
MEDIUM
Conflicts
1

CVE-2026-49128

Music Player Daemon (MPD) before version 0.24.11 contains a path traversal vulnerability in LocalStorage::MapFSOrThrow and LocalStorage::MapUTF8 within the local storage plugin, where the on-disk path is constructed by joining the storage root with a user-supplied URI as plain strings without canonicalization, allowing '..' segments to survive into the resolved path and be flattened by the kernel at openat() time. An unauthenticated attacker can exploit this flaw using the listfiles command to e

PUBLISHED
Vendor
MusicPlayerDaemon
Product
MPD
Provider severity
HIGH
Conflicts
1

CVE-2026-49127

Music Player Daemon (MPD) before version 0.24.11 contains a stack buffer overflow vulnerability in the pcm_unpack_24be function in src/pcm/Pack.cxx that allows unauthenticated attackers to corrupt stack memory by triggering an off-by-one write in the PCM decoder plugin. Attackers can issue two MPD commands referencing a malicious HTTP audio source to cause the unpack loop to write 1366 entries into a 1365-entry buffer, overwriting four bytes past the array boundary with three attacker-controlled

PUBLISHED
Vendor
MusicPlayerDaemon
Product
MPD
Provider severity
HIGH
Conflicts
1

CVE-2026-49121

AI Tensor Engine for ROCm (AITER) through 0.1.14 contains an unauthenticated remote code execution vulnerability in the MessageQueue.recv() function within shm_broadcast.py that allows unauthenticated remote attackers to execute arbitrary code by sending a malicious pickle payload to a ZMQ SUB socket with no authentication, HMAC, or format validation. Attackers who can reach the writer XPUB endpoint on the cluster network or supply a forged Handle with an attacker-controlled remote_subscribe_add

PUBLISHED
Vendor
Red Hat, Red Hat, Red Hat, Red Hat, ROCm, Red Hat
Product
Red Hat OpenShift AI (RHOAI), Red Hat Enterprise Linux AI (RHEL AI) 3, Red Hat AI Inference Server, Red Hat AI Inference Server, aiter, Red Hat Enterprise Linux AI (RHEL AI) 3
Provider severity
CRITICAL, HIGH
Conflicts
2

CVE-2026-49120

Medplum before 5.1.14 contains a server-side request forgery vulnerability in the subscription worker that allows authenticated users to perform unauthorized internal network requests by creating FHIR Subscription resources with arbitrary endpoint URLs. Attackers can point subscription endpoints at internal addresses such as cloud instance metadata services, internal databases, or container orchestration endpoints to exfiltrate IAM credentials and patient health records via the POST body contain

PUBLISHED
Vendor
medplum
Product
medplum
Provider severity
HIGH, MEDIUM
Conflicts
1

CVE-2026-4912

The Media Cleaner: Clean your WordPress! plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 7.0.3. This is due to the `get_urls_from_html()` function using `DOMDocument::loadHTMLFile()` to fetch iframe source URLs with an insufficient hostname validation check that relies on a substring match against the site's server name. This makes it possible for authenticated attackers, with Administrator-level access and above, to make web requests to ar

PUBLISHED
Vendor
tigroumeow
Product
Media Cleaner: Clean your WordPress!
Provider severity
MEDIUM
Conflicts
0

CVE-2026-49119

Gradio before 6.16.0 contain a path traversal vulnerability in the FileExplorer component's preprocess() method that allows unauthenticated attackers to escape the configured root directory by supplying path segments containing directory traversal sequences or absolute paths. Attackers can provide crafted path segments that cause os.path.join to discard the root_dir prefix entirely, resulting in arbitrary file read or exposure of sensitive files outside the intended directory.

PUBLISHED
Vendor
gradio-app
Product
gradio
Provider severity
HIGH
Conflicts
1

CVE-2026-49113

Subscriber Arbitrary Code Execution in Cornerstone < 7.8.8 versions.

PUBLISHED
Vendor
THEMECO
Product
Cornerstone
Provider severity
HIGH
Conflicts
0

CVE-2026-49112

Unauthenticated Path Traversal in Shared Files <= 1.7.64 versions.

PUBLISHED
Vendor
Tammersoft
Product
Shared Files
Provider severity
HIGH
Conflicts
0

CVE-2026-49111

Incorrect Privilege Assignment vulnerability in ThemeGrill Masteriyo - LMS allows Privilege Escalation. This issue affects Masteriyo - LMS: from n/a through 2.2.0.

PUBLISHED
Vendor
ThemeGrill
Product
Masteriyo - LMS
Provider severity
HIGH
Conflicts
0

CVE-2026-49110

Unauthenticated Broken Authentication in Upsell Order Bump Offer for WooCommerce <= 3.1.4 versions.

PUBLISHED
Vendor
WP Swings
Product
Upsell Order Bump Offer for WooCommerce
Provider severity
HIGH
Conflicts
0

CVE-2026-4911

The Booking Package plugin for WordPress is vulnerable to Price Manipulation in versions up to, and including, 1.7.06 This is due to the intentForStripe() function passing user-controlled $_POST['amount'] directly to the Stripe PaymentIntent API without validation, and the commitStripe() function ignoring the server-calculated amount when confirming the payment. While the server correctly calculates the booking cost via getAmount() based on services, guests, taxes, and coupons, this calculated a

PUBLISHED
Vendor
masaakitanaka
Product
Booking Package
Provider severity
MEDIUM
Conflicts
0

CVE-2026-49109

Unauthenticated PHP Object Injection in Integration for Salesforce and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms <= 1.4.3 versions.

PUBLISHED
Vendor
crm perks
Product
Integration for Salesforce and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms
Provider severity
CRITICAL
Conflicts
0

CVE-2026-49108

Unauthenticated PHP Object Injection in Moderno < 1.43 versions.

PUBLISHED
Vendor
park_of_ideas
Product
Moderno
Provider severity
CRITICAL
Conflicts
0

CVE-2026-49107

Unauthenticated PHP Object Injection in Thrive Apprentice < 10.8.10.2 versions.

PUBLISHED
Vendor
Thrive Themes
Product
Thrive Apprentice
Provider severity
CRITICAL
Conflicts
0

CVE-2026-49106

Unauthenticated PHP Object Injection in Integration for Contact Form 7 and Constant Contact <= 1.1.6 versions.

PUBLISHED
Vendor
CRM Perks
Product
Integration for Contact Form 7 and Constant Contact
Provider severity
CRITICAL
Conflicts
0

CVE-2026-49105

Unauthenticated PHP Object Injection in WP Zendesk for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms <= 1.1.4 versions.

PUBLISHED
Vendor
CRM Perks
Product
WP Zendesk for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms
Provider severity
CRITICAL
Conflicts
0

CVE-2026-49104

Unauthenticated PHP Object Injection in Integration for Keap/infusionsoft and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms <= 1.2.1 versions.

PUBLISHED
Vendor
CRM Perks
Product
Integration for Keap/infusionsoft and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms
Provider severity
CRITICAL
Conflicts
0

CVE-2026-49103

Webmin before 2.640 does not safely construct a filename for saving of an attachment within the mailboxes component. This occurs in mailboxes/detachall.cgi.

PUBLISHED
Vendor
Webmin
Product
Webmin
Provider severity
CRITICAL
Conflicts
0

CVE-2026-49102

Webmin before 2.640 allows mailboxes/detach.cgi XSS via an SVG document attachment that is viewed in the mailboxes component, because image/svg+xml is used instead of a safe type (e.g., text/plain).

PUBLISHED
Vendor
Webmin
Product
Webmin
Provider severity
MEDIUM
Conflicts
0

CVE-2026-4910

A security vulnerability has been detected in Shenzhen Ruiming Technology Streamax Crocus up to 1.3.44. Affected is an unknown function of the file /RemoteFormat.do of the component Endpoint. Such manipulation of the argument State leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

PUBLISHED
Vendor
Shenzhen Ruiming Technology
Product
Streamax Crocus
Provider severity
HIGH, MEDIUM
Conflicts
2

CVE-2026-49099

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection'), Authorization Bypass Through User-Controlled Key vulnerability in Apache Camel Salesforce Component. The camel-salesforce producer resolves its operation parameters - the SOQL query, the SOSL search, the target SObject name and id, the Apex REST URL and method, and the Apex query parameters - from Exchange message headers, reading the header in preference to the value configured on the endpoint (

PUBLISHED
Vendor
Apache Software Foundation
Product
Apache Camel Salesforce
Provider severity
MEDIUM
Conflicts
1

CVE-2026-49098

Improper Input Validation, Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability in Apache Camel Kafka Component. The camel-kafka producer can override its configured target topic at runtime from the kafka.OVERRIDE_TOPIC Exchange header: KafkaProducer.evaluateTopic() returns the header value in preference to the topic configured on the endpoint. The control-header constants in KafkaConstants (for example OVERRIDE_TOPIC = kafka.OVERRIDE_

PUBLISHED
Vendor
Apache Software Foundation
Product
Apache Camel
Provider severity
MEDIUM
Conflicts
1

CVE-2026-49097

Improper Input Validation, Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability in Apache Camel IRC component. The camel-irc producer chooses the destination of an outgoing IRC message from the irc.sendTo Exchange header (the constant IrcConstants.IRC_SEND_TO, value irc.sendTo); when that header is present it overrides the channel list configured on the endpoint, and the message is sent only to the specified destination. This and the c

PUBLISHED
Vendor
Apache Software Foundation
Product
Apache Camel
Provider severity
MEDIUM
Conflicts
1

CVE-2026-49095

Improper Input Validation (CWE-20) in the Kibana Fleet agent policy management feature can lead to privilege escalation. An authenticated user with Fleet management privileges can manipulate agent policy configuration by injecting values into a configuration override mechanism that is not adequately validated. An attacker can cause Elastic Agents to be issued API keys with elevated Elasticsearch privileges, potentially granting unauthorized read and write access to sensitive Elasticsearch securi

PUBLISHED
Vendor
Elastic
Product
Kibana
Provider severity
HIGH
Conflicts
0

CVE-2026-49094

Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated user with viewer-level access can submit a request containing an oversized input value to an analytics collections management endpoint. Kibana will consume excessive CPU and memory resources while processing the request. This results in Kibana becoming unavailable to all users until the service is manually recovered.

PUBLISHED
Vendor
Elastic
Product
Kibana
Provider severity
MEDIUM
Conflicts
0

CVE-2026-49093

Server-Side Request Forgery (CWE-918) in Kibana can allow an authenticated user with connector management privileges to bypass the operator-configured connector allowlist, causing the Kibana server to issue outbound requests to destinations the egress controls were intended to block.

PUBLISHED
Vendor
Elastic
Product
Kibana
Provider severity
MEDIUM
Conflicts
0

CVE-2026-49092

Unintended Proxy or Intermediary ('Confused Deputy') (CWE-441) in Kibana can lead to unauthorized information exposure via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). Under certain conditions, a lower-privileged user can cause data from sources they are not authorized to access to be processed using another user's privileges.

PUBLISHED
Vendor
Elastic
Product
Kibana
Provider severity
MEDIUM
Conflicts
0

CVE-2026-49091

Improper Output Neutralization for Logs (CWE-117) in Kibana can lead to log injection via Log Injection-Tampering-Forging (CAPEC-93). An attacker can supply specially crafted input that is written to log files without proper neutralization. When the log files are subsequently viewed in a terminal that interprets control sequences, the injected content may alter the displayed log data.

PUBLISHED
Vendor
Elastic
Product
Kibana
Provider severity
HIGH
Conflicts
0

CVE-2026-49090

Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user can submit a specially crafted bulk request that causes sustained high CPU consumption, which can render the affected node unable to process requests.

PUBLISHED
Vendor
Elastic
Product
Elasticsearch
Provider severity
MEDIUM
Conflicts
0

CVE-2026-4909

A weakness has been identified in code-projects Exam Form Submission 1.0. This impacts an unknown function of the file /admin/update_s7.php. This manipulation of the argument sname causes cross site scripting. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks.

PUBLISHED
Vendor
code-projects
Product
Exam Form Submission
Provider severity
LOW, MEDIUM
Conflicts
2

CVE-2026-49088

Insertion of Sensitive Information into Log File (CWE-532) in Kibana can lead to information disclosure. When the optional application performance monitoring (APM) instrumentation is enabled, sensitive request header values could be recorded in application logs, where they may be accessible to operators with log access.

PUBLISHED
Vendor
Elastic
Product
Kibana
Provider severity
MEDIUM
Conflicts
0

CVE-2026-49087

Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user can submit a specially crafted bulk deletion request that causes excessive resource consumption, which may render Kibana unavailable.

PUBLISHED
Vendor
Elastic
Product
Kibana
Provider severity
MEDIUM
Conflicts
0

CVE-2026-49086

Improper Input Validation, Unintended Proxy or Intermediary ('Confused Deputy') vulnerability in Apache Camel DAPR component. The camel-dapr Dapr Pub/Sub consumer (DaprPubSubConsumer) copied two fields from each inbound CloudEvent - its Pub/Sub component name and its topic - into the CamelDaprPubSubName and CamelDaprTopic Exchange headers. These two headers are producer-direction routing headers: when the route republishes through a Dapr producer, DaprConfigurationOptionsProxy reads them back a

PUBLISHED
Vendor
Apache Software Foundation
Product
Apache Camel Dapr
Provider severity
MEDIUM
Conflicts
1

CVE-2026-49085

Unauthenticated PHP Object Injection in WP Insightly for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms <= 1.1.4 versions.

PUBLISHED
Vendor
CRM Perks
Product
WP Insightly for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms
Provider severity
CRITICAL
Conflicts
0

CVE-2026-49084

Unauthenticated SQL Injection in JetEngine < 3.8.9.1 versions.

PUBLISHED
Vendor
Jetimpex Inc.
Product
JetEngine
Provider severity
CRITICAL
Conflicts
0

CVE-2026-49083

Contributor Privilege Escalation in LatePoint <= 5.5.1 versions.

PUBLISHED
Vendor
LatePoint
Product
LatePoint
Provider severity
HIGH
Conflicts
0

CVE-2026-49082

Subscriber Sensitive Data Exposure in Chatway Live Chat &#8211; AI Chatbot, Customer Support, FAQ &amp; Helpdesk Customer Service &amp; Chat Buttons <= 1.4.8 versions.

PUBLISHED
Vendor
Chatway Live Chat
Product
Chatway Live Chat &#8211; AI Chatbot, Customer Support, FAQ &amp; Helpdesk Customer Service &amp; Chat Buttons
Provider severity
HIGH
Conflicts
0

CVE-2026-49081

Unauthenticated Broken Access Control in User Registration Stripe <= 1.3.12 versions.

PUBLISHED
Vendor
ThemeGrill
Product
User Registration Stripe
Provider severity
HIGH
Conflicts
0

CVE-2026-49080

Unauthenticated SQL Injection in wpDataTables <= 7.3.6 versions.

PUBLISHED
Vendor
TMS
Product
wpDataTables
Provider severity
CRITICAL
Conflicts
0

CVE-2026-4908

A security flaw has been discovered in code-projects Simple Laundry System 1.0. This affects an unknown function of the file /modstaffinfo.php of the component Parameter Handler. The manipulation of the argument userid results in sql injection. The attack may be performed from remote. The exploit has been released to the public and may be used for attacks.

PUBLISHED
Vendor
code-projects
Product
Simple Laundry System
Provider severity
HIGH, MEDIUM
Conflicts
2

CVE-2026-49079

Unauthenticated SQL Injection in JetSearch <= 3.5.17 versions.

PUBLISHED
Vendor
Jetimpex Inc.
Product
JetSearch
Provider severity
CRITICAL
Conflicts
0

CVE-2026-49078

Unauthenticated Other Vulnerability Type in WP Travel Engine <= 6.7.10 versions.

PUBLISHED
Vendor
WP Travel Engine
Product
WP Travel Engine
Provider severity
HIGH
Conflicts
0