CVE Explorer

Exact snapshot results

353,537 CVE records

CVE ID descending · no relevance ranking

CVE-2026-47725

nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. Prior to version 0.3.3, every /ui/* POST / PUT / PATCH / DELETE route processes the request as soon as the session cookie validates. SameSite=Lax on the session cookie prevents most cross-site form submits but does not protect: top-level form-submit navigations from third-party pages (some browsers still send Lax cookies on top-level POSTs); same-registrable-domain attackers (sibling-subdomain XSS, subdomai

PUBLISHED

Vendor: juev
Product: nebula-mesh
Provider severity: MEDIUM
Conflicts: 0

CVE-2026-47724

nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. Prior to version 0.3.4, the `/api/v1/*` route surface trusts the bearer token alone for authorisation on most endpoints. The codebase itself admits this at `internal/api/hosts.go:384`: "API trusts the bearer token for authorisation; per-CA ownership is enforced only in the Web layer." The Web UI gates state-changing routes through `loadAccessibleCA` (`internal/web/cas.go`); CA-management endpoints in `inter

PUBLISHED

Vendor: juev
Product: nebula-mesh
Provider severity: CRITICAL
Conflicts: 0

CVE-2026-47723

nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. Prior to version 0.3.1, none of the response paths in `internal/web/` or `internal/api/` set the standard browser-security headers. `grep` for `Content-Security-Policy`, `X-Frame-Options`, `Strict-Transport-Security`, `X-Content-Type-Options`, `Referrer-Policy` returns zero matches across the codebase. Version 0.3.1 fixes the issue.

PUBLISHED

Vendor: juev
Product: nebula-mesh
Provider severity: HIGH
Conflicts: 0

CVE-2026-47722

nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. Prior to version 0.3.2, `internal/configgen/generator.go:86,108,119` interpolates the operator-supplied `ListenHost` and `TunDevice` fields raw into a `text/template` that produces the agent's `config.yml`. `internal/web/advanced.go:20-35` accepts both with only `strings.TrimSpace` — no character or shape validation. Version 0.3.2 fixes the issue.

PUBLISHED

Vendor: juev
Product: nebula-mesh
Provider severity: HIGH
Conflicts: 0

CVE-2026-4772

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in TR7 Cyber Defense Inc. WAF-ASP allows Stored XSS. This issue affects WAF-ASP: from v1.0.324.900 before v1.4.0.117.

PUBLISHED

Vendor: TR7 Cyber Defense Inc.
Product: WAF-ASP
Provider severity: MEDIUM
Conflicts: 0

CVE-2026-47716

Bugsink is a self-hosted error tracking tool. Prior to 2.2.0, In affected versions, the issue list view authorizes access through the project in the URL, but applies the requested bulk action to the submitted issue IDs without also requiring those issues to belong to that project. This vulnerability is fixed in 2.2.0.

PUBLISHED

Vendor: bugsink
Product: bugsink
Provider severity: LOW
Conflicts: 0

CVE-2026-47715

Bugsink is a self-hosted error tracking tool. Prior to 2.2.0, Bugsink issue event pages accept a direct event identifier from the URL and, in affected versions, look up that event without also requiring it to belong to the issue in the URL. This is a project-boundary authorization issue: a logged-in user with access to one project can view another project’s event data through an issue they are allowed to access. The affected views include the stacktrace, details, and breadcrumbs pages for an iss

PUBLISHED

Vendor: bugsink
Product: bugsink
Provider severity: LOW
Conflicts: 0

CVE-2026-47714

libheif is a HEIF and AVIF file format decoder and encoder. In versions 1.21.2 and prior, the inline mask parsing code in `libheif/region.cc` contains an integer overflow. Both `width` and `height` are `unsigned int` (32-bit) values parsed from the HEIF file. Their product can exceed `UINT32_MAX`, wrapping to a small value before the division by 8. This causes an undersized buffer allocation, leading to out-of-bounds memory access when the mask data is later interpreted as a `width x height` bit

PUBLISHED

Vendor: strukturag
Product: libheif
Provider severity: MEDIUM
Conflicts: 0

CVE-2026-47713

AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting. Prior to 1.13.0, an approved mobile device token created in single-user mode can survive single-user -> multi-user migration even when the device record has userId = null. In multi-user mode, that stale token is still accepted by the mobile authentication middleware. Because no user is attached to the request, downstream mobile handlers fall back to unscoped data-access bra

PUBLISHED

Vendor: Mintplex-Labs
Product: anything-llm
Provider severity: LOW
Conflicts: 1

CVE-2026-47712

Dulwich is a pure-Python implementation of the Git file formats and protocols. Starting in version 0.24.0 and prior to version 1.2.5, dulwich.porcelain.format_patch(outdir=...) derives each patch filename from the commit's subject line. Prior to this fix, get_summary only replaced spaces with dashes - path separators (/, \), parent-directory components (..), and other filename-hostile characters (e.g. :) were preserved verbatim and passed straight into os.path.join(outdir, f"{i:04d}-{summary}.pa

PUBLISHED

Vendor: jelmer
Product: dulwich
Provider severity: LOW
Conflicts: 0

CVE-2026-47709

libheif is a HEIF and AVIF file format decoder and encoder. Versions prior to 1.22.0 crashes in the public C API `heif_image_handle_get_image_tiling()` when a malformed uncompressed HEIF image item has an associated `uncC` property but no associated `ispe` property. In debug builds this trips the `ispe && uncC` assertion in `ImageItem_uncompressed::get_heif_image_tiling()`. In a release/NDEBUG ASan build, the same file causes a null pointer read at address `0xa8`. Version 1.22.0 fixes the issue.

PUBLISHED

Vendor: strukturag
Product: libheif
Provider severity: MEDIUM
Conflicts: 0

CVE-2026-47708

MCP-for-Stata is an MCP server for Stata to integrate Stata into an agent. Prior to version 1.17.3, the `log_file_name` parameter in the `stata_do` API and CLI is directly interpolated into a Stata command string without sanitization. The security guard (`GuardValidator`) only scans the do-file content but does not validate this parameter. An attacker can inject arbitrary Stata commands (including `shell`, `python`, `erase`, etc.) by crafting a malicious `log_file_name` containing quotes, newlin

PUBLISHED

Vendor: SepineTam
Product: stata-mcp
Provider severity: CRITICAL
Conflicts: 0

CVE-2026-47707

Strawberry GraphQL is a library for creating GraphQL APIs. In versions 0.172.0 through0.315.6, the MaxAliasesLimiter extension in Strawberry fails to account for the multiplicative/amplification effect of FragmentSpreadNode. While it correctly counts static aliases within the AST it does not consider how many times a fragments internal aliases are expanded during execution. this allows an attacker to bypass alias limits and force the server to resolve and render a significantly higher number of

PUBLISHED

Vendor: strawberry-graphql
Product: strawberry
Provider severity: MEDIUM
Conflicts: 0

CVE-2026-47706

Strawberry GraphQL is a library for creating GraphQL APIs. In versions 0.71.0 through 0.315.6, the QueryDepthLimiter extension is vulnerable to an Application-level DOS due to a lack of cycle detection in fragment spreads. When a query contains circular fragment references the determine_depth function enters an infinite recursion, leading to a RecursionError and crashing the validation process. Version 0.315.7 patches the issue.

PUBLISHED

Vendor: strawberry-graphql
Product: strawberry
Provider severity: MEDIUM
Conflicts: 1

CVE-2026-47703

AdGuard Home is a network-wide software for blocking ads and tracking. Prior to 0.107.75, AdGuard Home's client-triggered DoQ forwarding path to a udp:// upstream reduced backend UDP DNS state by producing dns_id=0 or txid=0 and exposed a quoted-port ICMP source-port oracle, weakening DNS response matching for forwarded queries. This issue is fixed in version 0.107.75.

PUBLISHED

Vendor: AdguardTeam
Product: AdGuardHome
Provider severity: MEDIUM
Conflicts: 1

CVE-2026-4770

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in TR7 Cyber Defense Inc. Web Application Firewall allows DOM-Based XSS. This issue affects Web Application Firewall: from v1.0.42.239 before v1.4.0.117.

PUBLISHED

Vendor: TR7 Cyber Defense Inc.
Product: WAF-ASP
Provider severity: MEDIUM
Conflicts: 0

CVE-2026-47697

Shelf is a platform for tracking physical assets. Shelf is multi-tenant; data is isolated per organization (workspace). Prior to version 1.20.2, several endpoints accepted entity IDs from request input and `connect`-ed / read / updated them without verifying the IDs belonged to the caller's organization. An authenticated user in Org A who knew or obtained an ID belonging to Org B could act on Org B's data across organization boundaries (a cross-tenant IDOR). A loader-only restriction on personal

PUBLISHED

Vendor: Shelf-nu
Product: shelf.nu
Provider severity: HIGH
Conflicts: 0

CVE-2026-47696

WWBN AVideo is an open source video platform. In 29.0 and earlier, plugin/AuthorizeNet/processPayment.json.php credits the logged-in user's wallet based only on the attacker-controlled amount POST parameter. The endpoint contains a TODO for real Authorize.Net charging, hardcodes $paymentSuccess = true, and then calls YPTWallet::addBalance() without validating any Authorize.Net transaction, webhook signature, hosted payment token, nonce, or server-side payment record. This allows any logged-in us

PUBLISHED

Vendor: WWBN
Product: AVideo
Provider severity: HIGH
Conflicts: 0

CVE-2026-47695

CC: Tweaked is a mod for Minecraft which adds programmable computers, turtles, and more to the game. Prior to version 1.119.0, CC-Tweaked's HTTP API (`http.request`, `http.websocket`) blocks requests to private network ranges to prevent server-side request forgery (SSRF). This protection can be bypassed on IPv6-capable servers using NAT64 well-known prefix addresses (`64:ff9b::/96`). An attacker who can execute Lua code can reach any internal IPv4 service that the filter is intended to block, by

PUBLISHED

Vendor: cc-tweaked
Product: CC-Tweaked
Provider severity: HIGH
Conflicts: 0

CVE-2026-47694

WWBN AVideo is an open source video platform. In 29.0 and earlier, AVideo stores category descriptions from user input and later renders category_description as raw HTML in the Gallery view. A user who can create or edit categories can store JavaScript in a category description, which executes when another user views the affected Gallery/category page. This is a stored XSS in the category description field, separate from previously fixed XSS issues in video titles or comments.

PUBLISHED

Vendor: WWBN
Product: AVideo
Provider severity: MEDIUM
Conflicts: 0

CVE-2026-47693

Poweradmin is a web-based DNS administration tool for PowerDNS server. Versions prior to 4.2.4 and 4.3.3 are vulnerable to CSV Injection (Formula Injection) in its log export functionality. User-controlled data — specifically the username field — is written to exported CSV files without sanitizing formula trigger characters (=, +, -, @). When an administrator exports activity logs and opens the resulting CSV in a spreadsheet application (Microsoft Excel, LibreOffice Calc, Google Sheets), any for

PUBLISHED

Vendor: poweradmin
Product: poweradmin
Provider severity: MEDIUM
Conflicts: 0

CVE-2026-47692

Envoy is an open source edge and service proxy designed for cloud-native applications. From 1.34.0 until 1.35.13, 1.36.9, 1.37.5, and 1.38.3, PROXY Protocol v2 header generator emits TLVs beyond the maximum length of 65535 bytes, causing a mismatch between bytes written and the length field in the header. This can result in smuggled bytes on the upstream request. This vulnerability is fixed in 1.35.13, 1.36.9, 1.37.5, and 1.38.3.

PUBLISHED

Vendor: envoyproxy
Product: envoy
Provider severity: MEDIUM
Conflicts: 0

CVE-2026-47691

A flaw was found in Netty's `DnsResolveContext`. An attacker controlling an authoritative name server for a subdomain can exploit this vulnerability by providing crafted NS records that are insufficiently validated. This allows the attacker to poison the DNS cache for parent domains, bypassing standard bailiwick rules. Consequently, future DNS resolutions for the affected parent domain will use the poisoned cache, potentially redirecting users to malicious servers and leading to information disc

PUBLISHED

Vendor: Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, netty, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat
Product: OpenShift Serverless, Red Hat OpenShift Dev Spaces, Red Hat build of Apache Camel 4.18.1.P1 for Spring Boot 3.5.16, Red Hat build of Apache Camel 4 for Quarkus 3, Red Hat build of Apache Camel - HawtIO 4, Red Hat JBoss Enterprise Application Platform 8, OpenShift Serverless, Red Hat Build of Keycloak, Red Hat OpenShift AI (RHOAI), streams for Apache Kafka 3, Red Hat build of Apicurio Registry 3, Red Hat OpenShift AI (RHOAI), netty, Red Hat Build of Keycloak, Red Hat JBoss Enterprise Application Platform 7, Red Hat Build of Keycloak, Red Hat Build of Keycloak, Red Hat JBoss Enterprise Application Platform Expansion Pack, Streams for Apache Kafka 2.9.4, OpenShift Serverless, Red Hat OpenShift AI (RHOAI), Red Hat Fuse 7, Red Hat build of Debezium 3, OpenShift Serverless, OpenShift Serverless, OpenShift Serverless, OpenShift Serverless, Red Hat OpenShift AI (RHOAI), Red Hat Enterprise Linux AI (RHEL AI) 3, Red Hat build of Quarkus 3.33.2.SP1, Red Hat Enterprise Linux AI (RHEL AI) 3, Red Hat OpenShift AI (RHOAI), Red Hat Single Sign-On 7, OpenShift Serverless, Red Hat Build of Keycloak, Red Hat OpenShift Dev Spaces, Cryostat 4 on RHEL 9, Cryostat 4 on RHEL 9, OpenShift Serverless, Red Hat Data Grid 8.6.2, Red Hat OpenShift Dev Spaces, Red Hat OpenShift Dev Spaces, OpenShift Serverless, Cryostat 4 on RHEL 9, Red Hat OpenShift AI (RHOAI), Red Hat OpenShift AI (RHOAI), Red Hat OpenShift AI (RHOAI), Red Hat Build of Apache Camel 3.33 for Quarkus 3.33.2.SP1, Red Hat build of Quarkus 3.27.4.SP1, Red Hat Enterprise Linux AI (RHEL AI) 3
Provider severity: HIGH
Conflicts: 2

CVE-2026-47690

MeltanoHub is the source code for hub.meltano.com, the central place for Meltano plugins. Versions of the repo prior to commit 923820de8f64d753951fbbd54f7282a3d5f75173 were vulnerable to exfiltration of `GITHUB_TOKEN` with write permissions to the repository. The vulnerable workflow used pull_request_target, which runs in the context of the base repository with access to secrets. Commit 923820de8f64d753951fbbd54f7282a3d5f75173 fixes the issue. No known workarounds are available.

PUBLISHED

Vendor: meltano
Product: hub
Provider severity: HIGH
Conflicts: 1

CVE-2026-4769

Certain devices in the WAGO System I/O Field series activate an internal diagnostic capability during the initial startup sequence. This functionality is not formally documented and becomes accessible without authentication for a brief period in the early boot phase. During this window, an unauthenticated remote attacker can gain access to the internal system processes, resulting in full system compromise.

PUBLISHED

Vendor: WAGO, WAGO, WAGO, WAGO, WAGO, WAGO, WAGO, WAGO
Product: 0765-110x/0100-0000, 0765-420x/0100-0000, 0765-2101/0100-0000, 0765-450x/0100-0000, 0765-2102/0100-0000, 0765-120x/0100-0000, 0765-150x/0100-0000, 0765-410x/0100-0000
Provider severity: CRITICAL
Conflicts: 2

CVE-2026-47689

FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to versions 1.5.10.1832 and 1.6.0-beta.2313, the `buildRow()` method in `fogpage.class.php` substitutes data values into HTML table cell templates using `str_replace()` without any HTML escaping. An unauthenticated attacker who knows any registered host's MAC address can POST malicious inventory values (e.g. `sysproduct`, `sysserial`) to `/service/inventory.php`, which stores them in the database. When an a

PUBLISHED

Vendor: FOGProject
Product: fogproject
Provider severity: MEDIUM
Conflicts: 0

CVE-2026-47688

FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to versions 1.5.10.1832 and 1.6.0-beta.2313, the `clearAES` and `clearPMTasks` methods in `FOGPage` can be invoked by an unauthenticated attacker via a single HTTP GET request through the public `client` node endpoint. This allows remote wiping of host AES encryption credentials and deletion of all power management scheduled tasks, with no login, session, or CSRF token required. Versions 1.5.10.1832 and 1.6

PUBLISHED

Vendor: FOGProject
Product: fogproject
Provider severity: HIGH
Conflicts: 0

CVE-2026-47687

FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to versions 1.5.10.1832 and 1.6.0-beta.2313, the `selectForm()` helper in `fogpage.class.php` renders `<option>` labels using raw, unescaped user input. An unauthenticated attacker who knows any registered host's MAC address can POST a malicious `sysproduct` value to `/service/inventory.php`, which is stored in the database. When an administrator opens Reports > Inventory, the payload breaks out of the `<op

PUBLISHED

Vendor: FOGProject
Product: fogproject
Provider severity: HIGH
Conflicts: 0

CVE-2026-47685

FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to versions 1.5.10.1832 and 1.6.0-beta.2313, the unauthenticated inventory service endpoint (`/service/inventory.php`) persists client-supplied values without sanitization, and the Host Management Inventory page renders all static inventory fields into HTML without output encoding, allowing stored cross-site scripting that executes in any administrator's browser. Versions 1.5.10.1832 and 1.6.0-beta.2313 fix

PUBLISHED

Vendor: FOGProject
Product: fogproject
Provider severity: HIGH
Conflicts: 0

CVE-2026-47684

Sync-in Server is a secure, open-source platform for file storage, sharing, collaboration, and syncing. Prior to version 2.3.0, the private IP blocklist regex used in the URL download feature does not match IPv4-mapped IPv6 addresses (e.g. ::ffff:127.0.0.1), allowing SSRF protection to be bypassed on dual-stack systems. Version 2.3.0 fixes the issue.

PUBLISHED

Vendor: Sync-in
Product: server
Provider severity: HIGH
Conflicts: 0

CVE-2026-47676

Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.21, app.mount() strips the mount prefix from the incoming request path using the raw URL pathname, while route matching is performed against the percent-decoded path. This inconsistency causes the prefix to be stripped at the wrong position when the path contains percent-encoded multi-byte characters, resulting in the mounted sub-application receiving an incorrect path. This vulnerability is fixed

PUBLISHED

Vendor: honojs
Product: hono
Provider severity: MEDIUM
Conflicts: 1

CVE-2026-47675

Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.21, the serialize() function in hono/cookie validates domain and path options against characters that corrupt Set-Cookie header syntax (;, \r, \n), but does not apply the same validation to sameSite and priority. An application that passes user-controlled input into either option may produce a Set-Cookie response header containing attacker-chosen additional attributes. This vulnerability is fixed

PUBLISHED

Vendor: honojs
Product: hono
Provider severity: MEDIUM
Conflicts: 1

CVE-2026-47674

Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.21, the ip-restriction middleware (hono/ip-restriction) compares incoming IP addresses against configured deny and allow rules using string equality after partial normalization. Non-canonical IPv6 representations of an address already listed in a static rule — such as compressed forms, explicit-zero forms, or hex-notation IPv4-mapped addresses — do not match the normalized rule entry, causing the

PUBLISHED

Vendor: honojs
Product: hono
Provider severity: MEDIUM
Conflicts: 1

CVE-2026-47673

Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.21, the jwt and jwk middlewares do not verify that the Authorization header value uses theBearer scheme. Any two-part header value — regardless of the scheme name in the first position — proceeds to JWT verification. A request presenting a valid JWT under a non-Bearer scheme identifier (such as Basic or Token) is authenticated identically to a correctly formed Bearer request. This vulnerability is

PUBLISHED

Vendor: honojs
Product: hono
Provider severity: MEDIUM
Conflicts: 0

CVE-2026-47672

epa4all-client is the Java Client for epa4all / ePA 3.0 in the Telematik Infrastruktur. In 1.2.4 and earlier, any network-reachable caller can write arbitrary documents to any patient's electronic health record accessible by the institution's SMC-B card. In a misconfigured deployment (e.g., following the production Docker example in the README), this is exploitable from the local network without credentials.

PUBLISHED

Vendor: oviva-ag
Product: epa4all-client
Provider severity: MEDIUM
Conflicts: 0

CVE-2026-47671

Nhost is an open source Firebase alternative with GraphQL. In versions of Nhost CLI prior to 1.46.0, the hidden `nhost configserver` used by `nhost dev` exposes the Mimir GraphQL API with dummy authorization directives and permissive CORS. When a developer is running the local development environment, any process that can reach the developer's localhost service, including a web page loaded from an arbitrary origin, can query the configserver for local Nhost configuration and secrets and can muta

PUBLISHED

Vendor: nhost
Product: cli
Provider severity: MEDIUM
Conflicts: 0

CVE-2026-47670

DbGate is cross-platform database manager. Versions 7.1.8 and prior are vulnerable to authenticated Remote Code Execution (RCE). Any user with valid DbGate credentials can execute arbitrary OS commands as root by exploiting an unsanitized `functionName` parameter in the `/runners/load-reader` endpoint. The `require = null` mitigation is trivially bypassed via dynamic `import()`. Version 7.1.9 contains a patch.

PUBLISHED

Vendor: dbgate
Product: dbgate
Provider severity: CRITICAL
Conflicts: 1

CVE-2026-4767

Missing authentication for critical function vulnerability in TR7 Cyber Defense Inc. WAF-ASP allows Authentication Abuse. This issue affects WAF-ASP: from v1.0.324.900 before v1.4.0.117.

PUBLISHED

Vendor: TR7 Cyber Defense Inc.
Product: WAF-ASP
Provider severity: CRITICAL
Conflicts: 0

CVE-2026-47669

DbGate is cross-platform database manager. In versions 7.1.8 and prior, the `unzipDirectory()` function in `packages/api/src/shell/unzipDirectory.js` (line 27) does not validate that extracted file paths stay within the output directory. A malicious ZIP with `../` entries writes files anywhere on the filesystem. In the default Docker deployment, DbGate runs as root and the `none` auth provider issues JWT tokens without credentials via `POST /auth/login`, so this is exploitable by any network-adj

PUBLISHED

Vendor: dbgate
Product: dbgate
Provider severity: CRITICAL
Conflicts: 0

CVE-2026-47668

DbGate is cross-platform database manager. In versions 7.1.8 and prior, DbGate's JSON script runner (`POST /runners/start`) allows remote code execution via code injection in the `functionName` parameter of JSON script `assign` commands. The `functionName` value is interpolated directly into dynamically generated JavaScript source code via string concatenation. The generated code is then executed in a forked Node.js child process. Version 7.1.9 contains a patch.

PUBLISHED

Vendor: dbgate
Product: dbgate
Provider severity: CRITICAL
Conflicts: 1

CVE-2026-47667

CImg Library is a C++ library for image processing. Prior to version 4.0.0 in `_load_analyze()`, the header_size field is read as an `unsigned int` from the first 4 bytes of an Analyze/NIfTI file and passed directly to `new unsigned char[header_size]` without being bounded against the actual file size. A value up to ~4 GB is accepted. If the subsequent `fread` returns `short` as it will for any malformed file), the function throws a `CImgIOException` and the allocated buffer is never freed. A 6

PUBLISHED

Vendor: GreycLab
Product: CImg
Provider severity: HIGH
Conflicts: 1

CVE-2026-4766

The Easy Image Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Gallery shortcode post meta field in all versions up to, and including, 1.5.3. This is due to insufficient input sanitization and output escaping on user-supplied gallery shortcode values. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

PUBLISHED

Vendor: devrix
Product: Easy Image Gallery
Provider severity: MEDIUM
Conflicts: 0

CVE-2026-47657

HumHub is an Open Source Enterprise Social Network. In versions 1.13.0 through 1.18.2, a missing authorization check in the Space member management controller allowed any authenticated user to trigger the removal of all members from any Space, regardless of their own role or membership in that Space. Versions 1.13.0 through 1.18.2 are affected. The vulnerability has been patched in version 1.18.3, and all users are encouraged to upgrade to this version or later immediately. No known workaround i

PUBLISHED

Vendor: humhub
Product: humhub
Provider severity: HIGH
Conflicts: 0

CVE-2026-47656

Protection mechanism failure in Windows Boot Manager allows an authorized attacker to bypass a security feature locally.

PUBLISHED

Vendor: Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft
Product: Windows Server 2012 (Server Core installation), Windows Server 2019 (Server Core installation), Windows 11 Version 25H2, Windows Server 2016, Windows 10 Version 21H2, Windows 11 version 23H2, Windows Server 2019, Windows 10 Version 1809, Windows 10 Version 22H2, Windows 11 version 26H1, Windows Server 2025, Windows Server 2022, Windows Server 2025 (Server Core installation), Windows 11 Version 24H2, Windows Server 2012 R2 (Server Core installation), Windows Server 2012, Windows 11 Version 23H2, Windows Server 2016 (Server Core installation), Windows Server 2012 R2, Windows 10 Version 1607
Provider severity: HIGH
Conflicts: 1

CVE-2026-47655

Exposure of sensitive information to an unauthorized actor in Microsoft Graph allows an authorized attacker to disclose information over a network.

PUBLISHED

Vendor: Microsoft
Product: Microsoft Graph
Provider severity: MEDIUM
Conflicts: 0

CVE-2026-47654

Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network.

PUBLISHED

Vendor: Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft
Product: Windows Server 2019 (Server Core installation), Windows Server 2025, Windows Server 2019, Windows Server 2025 (Server Core installation), Windows Server 2022, Windows Server 2016, Windows Server 2016 (Server Core installation)
Provider severity: HIGH
Conflicts: 1

CVE-2026-47653

Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network.

PUBLISHED

Vendor: Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft
Product: Windows Server 2012 R2 (Server Core installation), Windows 10 Version 21H2, Windows Server 2012 (Server Core installation), Windows 10 Version 1809, Windows 11 Version 25H2, Windows 11 Version 23H2, Windows Server 2016, Windows 11 version 23H2, Windows Server 2022, Windows 10 Version 1607, Windows 11 version 26H1, Windows Server 2019, Windows 10 Version 22H2, Windows Server 2012, Windows Server 2016 (Server Core installation), Windows 11 Version 24H2, Windows Server 2025, Windows Server 2019 (Server Core installation), Windows Server 2012 R2, Windows Server 2025 (Server Core installation)
Provider severity: HIGH
Conflicts: 1

CVE-2026-47652

Heap-based buffer overflow in Windows Hyper-V allows an authorized attacker to execute code locally.

PUBLISHED

Vendor: Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft
Product: Windows 11 Version 24H2, Windows 11 version 23H2, Windows Server 2022, Windows 11 Version 23H2, Windows 11 Version 25H2, Windows Server 2025, Windows 11 version 26H1, Windows Server 2025 (Server Core installation)
Provider severity: HIGH
Conflicts: 1

CVE-2026-4765

Stored Cross-Site Scripting (XSS) vulnerability in the RD Station Conversas chat. The vulnerability resides in the ‘name’ parameter of the initialization process due to improper sanitization of user input. The vulnerability is not limited to self-exploitation: when a support agent joins the conversation, the malicious script also executes in their browser, increasing the impact. Successful exploitation of this vulnerability could allow an attacker to execute arbitrary JavaScript code within the

PUBLISHED

Vendor: RD Station Conversas
Product: Tallos Chat
Provider severity: MEDIUM
Conflicts: 0

CVE-2026-47648

Untrusted search path in Windows Storage allows an authorized attacker to elevate privileges locally.

PUBLISHED

Vendor: Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft
Product: Windows Server 2012, Windows 11 Version 25H2, Windows Server 2022, Windows 10 Version 21H2, Windows Server 2025 (Server Core installation), Windows 10 Version 1607, Windows Server 2016 (Server Core installation), Windows 11 Version 23H2, Windows 11 version 26H1, Windows Server 2012 R2, Windows Server 2012 (Server Core installation), Windows 11 Version 24H2, Windows Server 2025, Windows 11 version 23H2, Windows Server 2019, Windows Server 2016, Windows 10 Version 22H2, Windows Server 2019 (Server Core installation), Windows 10 Version 1809, Windows Server 2012 R2 (Server Core installation)
Provider severity: HIGH
Conflicts: 1