CVE Explorer

Exact snapshot results

353,537 CVE records

CVE ID descending · no relevance ranking

CVE-2026-45246

Summarize prior to 0.15.1 contains an insecure file permission vulnerability in the refresh-free configuration rewrite path that allows local users to read sensitive credentials by exploiting default filesystem permissions. When the refresh-free path rewrites the configuration file, it creates the replacement with default process umask permissions instead of preserving the original file permissions, exposing the config file containing API keys and provider credentials to other local users on sha

PUBLISHED

Vendor: steipete
Product: summarize
Provider severity: MEDIUM
Conflicts: 1

CVE-2026-45245

Summarize prior to 0.15.1 contains a vulnerability in the hover summary feature that allows malicious pages to dispatch synthetic mouseover events over attacker-controlled links, causing the extension to make authenticated daemon requests using stored tokens without verifying event trustworthiness. Attackers can place local or private-network URLs behind hoverable links to route authenticated requests through the daemon, potentially accessing sensitive internal endpoints when users interact with

PUBLISHED

Vendor: steipete
Product: summarize
Provider severity: HIGH, MEDIUM
Conflicts: 2

CVE-2026-45244

Summarize prior to 0.15.1 contains a missing authorization vulnerability that allows attackers to execute browser automation actions without per-call user approval when the extension automation feature is enabled. Attackers can influence the agent through malicious page or summary content to invoke enabled extension automation tools such as navigation or debugger-backed actions, bypassing the final user approval step when a user interacts with attacker-controlled content.

PUBLISHED

Vendor: steipete
Product: summarize
Provider severity: LOW, MEDIUM
Conflicts: 1

CVE-2026-45243

Summarize prior to 0.15.1 contains a missing authorization vulnerability in the content script window.postMessage bridge that allows malicious pages to perform unauthorized operations on automation artifacts. Attackers can simulate runtime messages with spoofed sender identifiers to list, read, create, overwrite, or delete automation artifacts scoped to the affected tab without proper authorization checks.

PUBLISHED

Vendor: steipete
Product: summarize
Provider severity: MEDIUM
Conflicts: 1

CVE-2026-45242

Summarize prior to 0.15.1 contains a path traversal vulnerability in the /v1/summarize daemon endpoint that allows authenticated callers to write files to arbitrary directories by supplying an absolute path or directory traversal sequence in the slidesDir request parameter. Attackers can exploit this to write slide_*.png and slides.json files to any writable directory and subsequently delete matching files at the specified location through repeat extraction.

PUBLISHED

Vendor: steipete
Product: summarize
Provider severity: HIGH
Conflicts: 1

CVE-2026-4524

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.9.1 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3 that could have allowed an authenticated user to access confidential issue content in public projects without proper authorization due to improper authorization checks.

PUBLISHED

Vendor: GitLab
Product: GitLab
Provider severity: MEDIUM
Conflicts: 0

CVE-2026-45233

HTMLy CMS through 3.1.1 contains a path traversal vulnerability that allows low-privileged authenticated attackers to relocate arbitrary files by supplying directory traversal sequences in the oldfile parameter at the admin autosave endpoint. Attackers can pass unsanitized traversal sequences directly to file_exists() and rename() functions in admin.php without canonicalization or directory boundary enforcement to cause unintended relocation of any file writable by the web server process to an a

PUBLISHED

Vendor: danpros
Product: htmly
Provider severity: HIGH
Conflicts: 1

CVE-2026-45232

Rsync versions before 3.4.3 contain an off-by-one out-of-bounds stack write vulnerability in the establish_proxy_connection() function in socket.c that allows network attackers to corrupt stack memory by sending a malformed HTTP proxy response. Attackers can exploit this by positioning themselves between the client and proxy or controlling the proxy server to send a response line of 1023 or more bytes without a newline terminator, causing a null byte to be written to an out-of-bounds stack addre

PUBLISHED

Vendor: RsyncProject
Product: rsync
Provider severity: LOW
Conflicts: 1

CVE-2026-45231

DumbAssets through 1.0.11 contains a stored cross-site scripting vulnerability in asset fields including name, description, modelNumber, serialNumber, and tags that are stored without server-side sanitization and rendered using innerHTML without client-side escaping. Attackers can create or update assets with HTML or JavaScript payloads via the asset API endpoints to execute arbitrary scripts in the browsers of users viewing the asset list, and with Content-Security-Policy disabled, the injected

PUBLISHED

Vendor: DumbWareio
Product: DumbAssets
Provider severity: MEDIUM
Conflicts: 1

CVE-2026-45230

DumbAssets through 1.0.11 contains a path traversal vulnerability in the POST /api/delete-file endpoint and filesToDelete array parameters that allows unauthenticated attackers to delete arbitrary files by supplying ../ sequences that bypass directory boundary validation. Attackers can exploit the optional and disabled-by-default authentication control to traverse outside the intended application directory and delete critical files such as server.js or package.json, causing complete denial of se

PUBLISHED

Vendor: DumbWareio
Product: DumbAssets
Provider severity: CRITICAL, HIGH
Conflicts: 1

CVE-2026-45229

Quark Drive before 0.8.5 contains a mass assignment vulnerability in the POST /update endpoint that allows authenticated attackers to overwrite administrator credentials by posting an arbitrary webui object to the config_data dictionary. Attackers can exploit insufficient deny-list filtering to permanently replace stored login credentials, lock out legitimate administrators, and gain persistent access to all configured tasks, cloud tokens, and notification services.

PUBLISHED

Vendor: Cp0204
Product: quark-auto-save
Provider severity: HIGH
Conflicts: 1

CVE-2026-45228

Quark Drive before 0.8.5 contains a stored cross-site scripting vulnerability in the System Configuration page where the template renders push_config key names using Vue.js's v-html directive without escaping. Authenticated attackers can inject HTML or JavaScript payloads as key names through the POST /update endpoint, which are persisted to disk and executed in the browsers of all authenticated users accessing the System Configuration tab, allowing session cookie exfiltration and arbitrary auth

PUBLISHED

Vendor: Cp0204
Product: quark-auto-save
Provider severity: MEDIUM
Conflicts: 1

CVE-2026-45227

Heym before 0.0.21 contains a sandbox escape vulnerability in the custom Python tool executor that allows authenticated workflow authors to bypass sandbox restrictions by using object-graph introspection primitives. Attackers can use Python introspection techniques to recover the unrestricted __import__ function, import blocked modules such as os and subprocess, and access inherited backend environment variables containing database credentials and encryption keys to execute arbitrary host comman

PUBLISHED

Vendor: heymrun
Product: heym
Provider severity: HIGH
Conflicts: 1

CVE-2026-45226

Heym before 0.0.21 contains an authorization bypass vulnerability in workflow execution that allows authenticated users to execute arbitrary workflows by referencing victim workflow UUIDs without proper access validation. Attackers can create workflows with execute nodes or agent subWorkflowIds pointing to victim workflow UUIDs to load and execute those workflows under attacker-controlled execution paths, exposing victim workflow outputs and triggering workflow nodes with unintended side effects

PUBLISHED

Vendor: heymrun
Product: heym
Provider severity: HIGH
Conflicts: 1

CVE-2026-45225

Heym before 0.0.21 contains a path traversal vulnerability in the file upload endpoint that allows authenticated users to write attacker-controlled files to arbitrary locations by supplying a crafted filename with traversal sequences. Attackers can exploit the unvalidated filename parameter in the upload_file() handler to bypass path restrictions and write, read, or delete files outside the intended storage directory.

PUBLISHED

Vendor: heymrun
Product: heym
Provider severity: HIGH
Conflicts: 1

CVE-2026-45224

Crabbox before 0.9.0 contains a path traversal vulnerability in the Islo provider's workspace path resolution that allows attackers to supply absolute or relative paths that resolve outside the intended /workspace directory. Attackers can craft a malicious .crabbox.yaml or crabbox.yaml file with traversal sequences to cause arbitrary file deletion and overwrite when sync.delete is enabled, as the workspace preparation logic executes rm -rf and mkdir -p operations on the resolved path without pro

PUBLISHED

Vendor: openclaw
Product: crabbox
Provider severity: HIGH, MEDIUM
Conflicts: 1

CVE-2026-45223

Crabbox before 0.9.0 contains an authentication bypass vulnerability in the coordinator user-token verification path where the verifyUserToken() function fails to reject payloads containing an admin claim, allowing attackers to escalate privileges. An attacker with access to the shared non-admin token can craft a user-token payload with admin: true, sign it using HMAC-SHA256, and present it to admin-only coordinator routes to gain full coordinator admin access including lease visibility, pool st

PUBLISHED

Vendor: openclaw
Product: crabbox
Provider severity: HIGH
Conflicts: 1

CVE-2026-45222

Summarize versions through 0.14.1, fixed in commit 0cfb0fb, creates the daemon configuration directory and file with default filesystem permissions that may be world-readable on Unix-like systems, allowing local attackers to read bearer tokens and API credentials stored in ~/.summarize/daemon.json. A local attacker can exploit these permissive permissions to read the daemon bearer token and persisted provider credentials, enabling unauthorized access to the daemon or recovery of sensitive API ke

PUBLISHED

Vendor: steipete
Product: summarize
Provider severity: MEDIUM
Conflicts: 1

CVE-2026-4522

Missing authentication for critical function vulnerability in HYPR Passwordless on Windows allows Credentials Interception. This issue affects HYPR Passwordless: before 11.1.1.

PUBLISHED

Vendor: HYPR
Product: Passwordless
Provider severity: MEDIUM
Conflicts: 0

CVE-2026-45218

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WP Travel WP Travel wp-travel allows Blind SQL Injection.This issue affects WP Travel: from n/a through <= 11.4.0.

PUBLISHED

Vendor: WP Travel
Product: WP Travel
Provider severity: HIGH
Conflicts: 0

CVE-2026-45217

Authentication Bypass Using an Alternate Path or Channel vulnerability in ThemeHigh Stripe Payment Gateway for WooCommerce allows Password Recovery Exploitation. This issue affects Stripe Payment Gateway for WooCommerce: from n/a through 5.0.7.

PUBLISHED

Vendor: ThemeHigh
Product: Stripe Payment Gateway for WooCommerce
Provider severity: MEDIUM
Conflicts: 0

CVE-2026-45216

Incorrect Privilege Assignment vulnerability in StoreApps Smart Manager allows Privilege Escalation. This issue affects Smart Manager: from n/a through 8.85.0.

PUBLISHED

Vendor: StoreApps
Product: Smart Manager
Provider severity: HIGH
Conflicts: 0

CVE-2026-45215

Insertion of Sensitive Information Into Sent Data vulnerability in Saad Iqbal WP EasyPay wp-easy-pay allows Retrieve Embedded Sensitive Data.This issue affects WP EasyPay: from n/a through <= 4.3.0.

PUBLISHED

Vendor: Saad Iqbal
Product: WP EasyPay
Provider severity: MEDIUM
Conflicts: 0

CVE-2026-45214

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Xpro Xpro Elementor Addons xpro-elementor-addons allows Blind SQL Injection.This issue affects Xpro Elementor Addons: from n/a through <= 1.5.1.

PUBLISHED

Vendor: Xpro
Product: Xpro Elementor Addons
Provider severity: HIGH
Conflicts: 0

CVE-2026-45213

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in RealMag777 BEAR woo-bulk-editor allows Blind SQL Injection.This issue affects BEAR: from n/a through <= 1.1.7.1.

PUBLISHED

Vendor: RealMag777
Product: BEAR
Provider severity: HIGH
Conflicts: 0

CVE-2026-45212

Missing Authorization vulnerability in Gabe Livan Asset CleanUp: Page Speed Booster wp-asset-clean-up allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Asset CleanUp: Page Speed Booster: from n/a through <= 1.4.0.3.

PUBLISHED

Vendor: Gabe Livan
Product: Asset CleanUp: Page Speed Booster
Provider severity: MEDIUM
Conflicts: 0

CVE-2026-45211

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Saad Iqbal APIExperts Square for WooCommerce woosquare allows Blind SQL Injection.This issue affects APIExperts Square for WooCommerce: from n/a through <= 4.7.1.

PUBLISHED

Vendor: Saad Iqbal
Product: APIExperts Square for WooCommerce
Provider severity: HIGH
Conflicts: 0

CVE-2026-45210

Missing Authorization vulnerability in Broadstreet Broadstreet Ads broadstreet allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Broadstreet Ads: from n/a through <= 1.52.2.

PUBLISHED

Vendor: Broadstreet
Product: Broadstreet Ads
Provider severity: MEDIUM
Conflicts: 0

CVE-2026-45209

Missing Authorization vulnerability in edward_plainview MyCryptoCheckout allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects MyCryptoCheckout: from n/a through 2.161.

PUBLISHED

Vendor: edward_plainview
Product: MyCryptoCheckout
Provider severity: HIGH
Conflicts: 0

CVE-2026-45208

A time-of-check time-of-use vulnerability in the Apex One/SEP agent could allow a local attacker to escalate privileges on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.

PUBLISHED

Vendor: Trend Micro, Inc., Trend Micro, Inc.
Product: TrendAI Apex One, TrendAI Apex One as a Service
Provider severity: HIGH
Conflicts: 1

CVE-2026-45207

An origin validation vulnerability in the Apex One/SEP agent could allow a local attacker to escalate privileges on affected installations. This is similar to CVE-2026-45206 but exists in a different process protection communication mechanism. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.

PUBLISHED

Vendor: Trend Micro, Inc., Trend Micro, Inc.
Product: TrendAI Apex One as a Service, TrendAI Apex One
Provider severity: HIGH
Conflicts: 1

CVE-2026-45206

An origin validation vulnerability in the Apex One/SEP agent could allow a local attacker to escalate privileges on affected installations. This is similar to CVE-2026-45207 but exists in a different process protection communication mechanism. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.

PUBLISHED

Vendor: Trend Micro, Inc., Trend Micro, Inc.
Product: TrendAI Apex One as a Service, TrendAI Apex One
Provider severity: HIGH
Conflicts: 1

CVE-2026-45205

Uncontrolled Recursion vulnerability in Apache Commons. When processing an untrusted configuration file, Commons Configuration will throw a StackOverflowError for YAML input with cycles. This issue affects Apache Commons: from 2.2 before 2.15.0. Users are recommended to upgrade to version 2.15.0, which fixes the issue.

PUBLISHED

Vendor: Apache Software Foundation
Product: Apache Commons Configuration
Provider severity: MEDIUM
Conflicts: 0

CVE-2026-45203

Kernel software installed and running inside a Host VM may post improper commands to the GPU Firmware to trigger a memory write outside the permitted range of memory for the host kernel. A TOCTOU bug existed where a malicious driver could modify values in memory after firmware validation but before use.

PUBLISHED

Vendor: Imagination Technologies
Product: Graphics DDK
Provider severity: HIGH
Conflicts: 0

CVE-2026-45196

Kernel software installed and running inside a Host VM may post improper commands to the GPU Firmware to trigger a GPU register access which can lead to privilege escalation.

PUBLISHED

Vendor: Imagination Technologies
Product: Graphics DDK
Provider severity: HIGH
Conflicts: 0

CVE-2026-45195

Kernel software installed and running inside a Host VM may post improper commands to the GPU Firmware to trigger a memory read or write outside the permitted range of memory for the host kernel. Addresses passed to the GPU Firmware can be used by the Firmware for more privileged memory accesses than are permitted by the system.

PUBLISHED

Vendor: Imagination Technologies
Product: Graphics DDK
Provider severity: HIGH
Conflicts: 0

CVE-2026-45192

A bug in the GET `/api/v2/connections/{connection_id}` REST API endpoint in Apache Airflow allowed an authenticated UI/API user with Connection-read permission to retrieve secrets stored in a Connection's `extra` JSON blob under field names not present in the redaction allowlist (`DEFAULT_SENSITIVE_FIELDS`) — for example, official Slack-provider credential field names were returned in plaintext. Affects deployments that store credentials in Connection `extra` blobs and grant Connection-read acce

PUBLISHED

Vendor: Apache Software Foundation
Product: Apache Airflow
Provider severity: MEDIUM
Conflicts: 0

CVE-2026-45191

Net::CIDR::Lite versions before 0.24 for Perl does not properly consider extraneous zero characters in CIDR mask values, which may allow IP ACL bypass. Mask forms like "/00" and "/01" pass validation and parse to the same prefix as their unpadded value. See also CVE-2026-45190.

PUBLISHED

Vendor: STIGTSP
Product: Net::CIDR::Lite
Provider severity: MEDIUM
Conflicts: 0

CVE-2026-45190

Net::CIDR::Lite versions before 0.24 for Perl does not properly validate IP address and CIDR mask inputs, which may allow IP ACL bypass. Inputs containing a trailing newline or non-ASCII digit characters pass the validators but are then re-encoded by the parser to a different address than the input string spelled. find() and bin_find() can match or miss addresses as a result. Example: my $cidr = Net::CIDR::Lite->new(); $cidr->add("::1\n/128"); $cidr->find("::1a"); # incorrectly returns

PUBLISHED

Vendor: STIGTSP
Product: Net::CIDR::Lite
Provider severity: MEDIUM
Conflicts: 0

CVE-2026-4519

A flaw was found in Python. The `webbrowser.open()` API, used to launch web browsers, does not properly sanitize input. This allows a remote attacker to craft a malicious URL containing leading dashes. When such a URL is opened, certain web browsers may interpret these dashes as command-line options, which could lead to unexpected behavior, information disclosure, or potentially arbitrary code execution, impacting the integrity of the system.

PUBLISHED

Vendor: Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Python Software Foundation, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat
Product: Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions, Red Hat Enterprise Linux 8.2 Advanced Update Support, Red Hat Enterprise Linux AI 3.3, Red Hat Enterprise Linux AI 3.3, Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support, Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On, Red Hat Enterprise Linux AI 3.3, Red Hat AI Inference Server 3.3, Red Hat Enterprise Linux 10.0 Extended Update Support, Red Hat Update Infrastructure 5, Red Hat AI Inference Server 3.2, Red Hat AI Inference Server 3.3, RHEL-8 based Middleware Containers, Red Hat Enterprise Linux 9.4 Extended Update Support, RHEL-8 based Middleware Containers, Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions, Red Hat Update Infrastructure 5, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat AI Inference Server 3.2, Red Hat Enterprise Linux 9, Red Hat Discovery 2, Red Hat Enterprise Linux 10, RHEL-8 based Middleware Containers, Red Hat Enterprise Linux 9.6 Extended Update Support, Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions, RHEL-8 based Middleware Containers, Red Hat Enterprise Linux AI 3.3, Red Hat Update Infrastructure 5, Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions, Red Hat Hardened Images, Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions, Red Hat Hardened Images, Red Hat Enterprise Linux 6 Extended Lifecycle Support - EXTENSION, Red Hat Enterprise Linux 8, RHEL-8 based Middleware Containers, Red Hat AI Inference Server 3.3, Red Hat Enterprise Linux 9.4 Extended Update Support, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions, Red Hat AI Inference Server 3.2, Red Hat Enterprise Linux 8.8 Telecommunications Update Service, Red Hat Enterprise Linux 8.6 Telecommunications Update Service, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 8.8 Telecommunications Update Service, Red Hat Enterprise Linux 8, Red Hat Update Infrastructure 5, Red Hat Enterprise Linux 7 Extended Lifecycle Support, Red Hat Enterprise Linux AI 3.3, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9.6 Extended Update Support, Red Hat Enterprise Linux AI 3.3, Red Hat Enterprise Linux AI 3.3, Red Hat AI Inference Server 3.3, Red Hat Hardened Images, CPython, Red Hat Enterprise Linux 9.4 Extended Update Support, Red Hat Enterprise Linux 9.6 Extended Update Support, Red Hat Enterprise Linux 9, RHEL-8 based Middleware Containers, RHEL-8 based Middleware Containers, Red Hat Enterprise Linux 7 Extended Lifecycle Support, Red Hat Hardened Images
Provider severity: HIGH
Conflicts: 3

CVE-2026-45188

Relative Path Traversal vulnerability in Apache Kvrocks. This issue affects Apache Kvrocks: from 1.0.0 through 2.15.0. Users are recommended to upgrade to version 2.16.0, which fixes the issue.

PUBLISHED

Vendor: Apache Software Foundation
Product: Apache Kvrocks
Provider severity: LOW
Conflicts: 0

CVE-2026-45187

Improper Authorization vulnerability in Apache OFBiz Webtools. This issue affects Apache OFBiz: before 24.09.06. Users are recommended to upgrade to version 24.09.06, which fixes the issue.

PUBLISHED

Vendor: Apache Software Foundation
Product: Apache OFBiz
Provider severity: MEDIUM
Conflicts: 0

CVE-2026-45186

In libexpat before 2.8.1, the computational complexity of attribute name collision checks allows a denial of service via moderately sized crafted XML input.

PUBLISHED

Vendor: Red Hat, Siemens, Red Hat, Red Hat, Red Hat, Red Hat, Siemens, Red Hat, Red Hat, Red Hat, Siemens, libexpat project, Red Hat, Red Hat, Red Hat, Siemens, Red Hat, Red Hat, Red Hat, Siemens
Product: Red Hat Update Infrastructure 5, SIMATIC S7-1500 CPU 1518-4 PN/DP MFP, Red Hat Enterprise Linux 7, Red Hat Update Infrastructure 5, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 6, SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP, Red Hat Enterprise Linux 10, Red Hat Discovery 2, Red Hat Enterprise Linux 9, SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP, libexpat, Red Hat Enterprise Linux 8, Red Hat JBoss Core Services 2.4.62.SP4, Red Hat Enterprise Linux 8, SIMATIC S7-1500 CPU 1518-4 PN/DP MFP, Red Hat Update Infrastructure 5, Red Hat Update Infrastructure 5, Red Hat Discovery 2, SIPLUS S7-1500 CPU 1518-4 PN/DP MFP
Provider severity: HIGH, LOW
Conflicts: 3

CVE-2026-45185

Exim before 4.99.3, in certain GnuTLS configurations, has a remotely reachable use-after-free in the BDAT body parsing path. It is triggered when a client sends a TLS close_notify mid-body during a CHUNKING transfer, followed by a final cleartext byte on the same TCP connection. This can lead to heap corruption. An unauthenticated network attacker exploiting this vulnerability could execute arbitrary code.

PUBLISHED

Vendor: Exim
Product: Exim
Provider severity: CRITICAL
Conflicts: 0

CVE-2026-45184

Kdenlive before 26.04.1 allows dangerous proxy parameters when an attacker-controlled project file is used.

PUBLISHED

Vendor: KDE
Product: Kdenlive
Provider severity: MEDIUM
Conflicts: 0

CVE-2026-45182

GrapheneOS before 2026050400 allows attackers to discover the real IP address of a VPN user as a consequence of a registerQuicConnectionClosePayload optimization, because an application can let system_server transmit UDP traffic on its behalf. This occurs when the "Block connections without VPN" and "Always-on VPN" settings are enabled.

PUBLISHED

Vendor: GrapheneOS
Product: GrapheneOS
Provider severity: LOW
Conflicts: 0

CVE-2026-45181

Hex-Rays IDA Pro 9.2 and 9.3 before 9.3sp2 does not block Clang dependency-file generation (via argument injection), which allows attackers to place their code into a plugins directory if the victim uses an attacker-supplied .i64 file.

PUBLISHED

Vendor: Hex-Rays
Product: IDA
Provider severity: MEDIUM
Conflicts: 0

CVE-2026-45180

Catalyst::Plugin::Statsd versions through 0.10.0 for Perl may leak session ids. If the communication channel to the statsd daemon is not secured (for example, by sending UDP packets to a host on another network), then users' session ids may be leaked. This may allow an attacker to use session ids as authentication tokens.

PUBLISHED

Vendor: RRWO
Product: Catalyst::Plugin::Statsd
Provider severity: HIGH
Conflicts: 0

CVE-2026-45179

Plack::Middleware::Statsd versions before 0.9.0 for Perl may leak user IP addresses. If the communication channel to the statsd daemon is not secured (for example, by sending UDP packets to a host on another network), then users' IP addresses may be leaked. Since version 0.9.0, the IP address is no longer logged to statsd unless configured. When configured, an HMAC signature of the IP address is logged instead.

PUBLISHED

Vendor: RRWO
Product: Plack::Middleware::Statsd
Provider severity: MEDIUM
Conflicts: 0

CVE-2026-45178

Idira Secrets Manager Self-Hosted versions 13.8.0 and lower exhibit improper access control within internal cluster endpoints. A remote, authenticated attacker possessing standard node-level credentials could leverage these endpoints to potentially retrieve unauthorized secrets or cause a denial of service (DoS). CyberArk Security Bulletin: CA26-20

PUBLISHED

Vendor: CyberArk Software, a Palo Alto Networks Company, CyberArk Software, a Palo Alto Networks Company, CyberArk Software, a Palo Alto Networks Company, CyberArk Software, a Palo Alto Networks Company
Product: Conjur Enterprise, Conjur Enterprise, Conjur Enterprise, Conjur Enterprise
Provider severity: HIGH
Conflicts: 1