Baitaphish
Security intelligence
SearchLatest briefing
Data & Insights

CVE Explorer

Search one exact, source-linked CVE snapshot by CVE ID or explicit vendor and product tokens. Provider severity, KEV, conflicts, and stale state remain separate observations—not a Baitaphish risk rating.
Snapshot urn:baitaphish:cve-read-model-snapshot:v3:f2c3f72dcc196f8e7d63aa2d29709ad8b3fea39110eb2d563da5ce9b6fa9da89Released 2026-08-05T02:00:00Z
Exact snapshot results

353,537 CVE records

CVE ID descending · no relevance ranking

CVE-2026-42445

NanaZip is an open source file archive. From 5.0.1252.0 to before 6.0.1698.0, an uncontrolled recursion vulnerability exists in the UFS/UFS2 filesystem image parser in NanaZip. The function GetAllPaths recurses into subdirectories without any depth limit or visited-inode tracking. A crafted UFS image with a deep directory tree or an inode cycle causes stack exhaustion, crashing the NanaZip process. This vulnerability is fixed in 6.0.1698.0.

PUBLISHED
Vendor
M2Team
Product
NanaZip
Provider severity
LOW
Conflicts
0

CVE-2026-42444

NanaZip is an open source file archive. From 5.0.1252.0 to before 6.0.1698.0, a denial-of-service vulnerability exists in the littlefs filesystem image parser in NanaZip. The handler's Open method reads BlockCount directly from the attacker-controlled superblock without any validation against the actual file size or any upper-bound ceiling, then iterates BlockCount times, allocating a file-path entry per iteration. A crafted 44-byte littlefs image with BlockCount = 0xFFFFFFFF causes ~4 billion h

PUBLISHED
Vendor
M2Team
Product
NanaZip
Provider severity
LOW
Conflicts
0

CVE-2026-42443

NanaZip is an open source file archive. From 5.0.1252.0 to before 6.0.1698.0, an integer divide-by-zero exists in the UFS/UFS2 filesystem image parser in NanaZip. The vulnerability is triggered when opening a crafted UFS image where the superblock field fs_ipg (inodes per cylinder group) is set to zero. The parser uses this attacker-controlled value as a divisor without validation, causing an immediate hardware trap and process crash. This vulnerability is fixed in 6.0.1698.0.

PUBLISHED
Vendor
M2Team
Product
NanaZip
Provider severity
LOW
Conflicts
0

CVE-2026-42442

NanaZip is an open source file archive. From 5.0.1252.0 to before 6.0.1698.0, a null-pointer dereference exists in the UFS/UFS2 filesystem image parser in NanaZip. The vulnerability is triggered when opening a crafted UFS image where the root inode (inode 2) is set to IFLNK (symlink) instead of IFDIR (directory). The parser unconditionally treats the root inode as a directory without checking its type, and when the symlink has an embedded target (small di_size), the directory data buffer is zero

PUBLISHED
Vendor
M2Team
Product
NanaZip
Provider severity
LOW
Conflicts
0

CVE-2026-42440

OOM Denial of Service via Unbounded Array Allocation in Apache OpenNLP AbstractModelReader  Versions Affected:  before 1.9.5 before 2.5.9 before 3.0.0-M3  Description: The AbstractModelReader methods getOutcomes(), getOutcomePatterns(), and getPredicates() each read a 32-bit signed integer count field from a binary model stream and pass that value directly to an array allocation (new String[numOutcomes], new int[numOCTypes][], new String[NUM_PREDS]) without validating that the value is non

PUBLISHED
Vendor
Red Hat, Red Hat, Apache Software Foundation, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat
Product
Red Hat OpenShift AI (RHOAI), Red Hat Fuse 7, Apache OpenNLP, Red Hat OpenShift AI (RHOAI), Red Hat Fuse 7, Red Hat OpenShift AI (RHOAI), Red Hat JBoss Enterprise Application Platform Expansion Pack, Red Hat Data Grid 8
Provider severity
HIGH
Conflicts
2

CVE-2026-42439

OpenClaw before 2026.4.10 contains a server-side request forgery policy bypass vulnerability in the browser tabs action select and close routes. Attackers can bypass configured browser SSRF policy protections by exploiting the /tabs/action endpoint to perform unauthorized tab navigation operations.

PUBLISHED
Vendor
OpenClaw
Product
OpenClaw
Provider severity
HIGH, MEDIUM
Conflicts
1

CVE-2026-42438

OpenClaw versions 2026.4.9 before 2026.4.10 contain a sender policy bypass vulnerability in the outbound host-media attachment read helper that allows unauthorized local file disclosure. Attackers with denied read access via toolsBySender or group policy can trigger host-media attachment loading to bypass sender and group-scoped authorization boundaries and retrieve readable local files through the outbound media path.

PUBLISHED
Vendor
OpenClaw
Product
OpenClaw
Provider severity
HIGH, MEDIUM
Conflicts
1

CVE-2026-42437

OpenClaw versions 2026.4.9 before 2026.4.10 contain a denial of service vulnerability in the voice-call realtime WebSocket path that accepts oversized frames without proper validation. Remote attackers can send oversized WebSocket frames to cause service unavailability for deployments exposing the voice-call realtime WebSocket path.

PUBLISHED
Vendor
OpenClaw
Product
OpenClaw
Provider severity
HIGH
Conflicts
1

CVE-2026-42436

OpenClaw before 2026.4.14 contains an improper access control vulnerability in browser snapshot, screenshot, and tab routes that fail to consistently validate the final browser target after navigation. Authenticated callers can bypass SSRF restrictions to expose internal or disallowed page content by exploiting route-driven navigation without proper policy re-validation.

PUBLISHED
Vendor
OpenClaw
Product
OpenClaw
Provider severity
HIGH, MEDIUM
Conflicts
1

CVE-2026-42435

OpenClaw versions from 2026.2.22 before 2026.4.12 contain an insufficient shell-wrapper detection vulnerability allowing attackers to inject environment variable assignments at the argv level. Attackers can bypass exec preflight handling to manipulate high-risk shell variables like SHELLOPTS and PS4, affecting execution semantics and security controls.

PUBLISHED
Vendor
OpenClaw
Product
OpenClaw
Provider severity
HIGH
Conflicts
1

CVE-2026-42434

OpenClaw versions 2026.4.5 before 2026.4.10 contain a sandbox escape vulnerability allowing sandboxed agents to override exec routing by specifying host=node. Attackers can bypass sandbox boundaries and route execution to remote nodes instead of intended sandbox paths.

PUBLISHED
Vendor
OpenClaw
Product
OpenClaw
Provider severity
HIGH
Conflicts
1

CVE-2026-42433

OpenClaw before 2026.4.10 contains an authorization bypass vulnerability allowing operator.write message-tool paths to access Matrix profile persistence requiring admin-level authority. Attackers can exploit insufficient access controls to mutate persistent profile configuration through non-owner message-tool runs.

PUBLISHED
Vendor
OpenClaw
Product
OpenClaw
Provider severity
HIGH, MEDIUM
Conflicts
1

CVE-2026-42432

OpenClaw before 2026.4.8 contains a privilege escalation vulnerability allowing previously paired nodes to reconnect with exec-capable commands without the operator.admin scope requirement. Attackers can bypass re-pairing authentication to execute privileged commands on the local assistant system.

PUBLISHED
Vendor
OpenClaw
Product
OpenClaw
Provider severity
HIGH
Conflicts
1

CVE-2026-42431

OpenClaw before 2026.4.8 contains a security bypass vulnerability in node.invoke(browser.proxy) that allows mutation of persistent browser profiles. Attackers can exploit this path to circumvent the browser.request persistent profile-mutation guard and modify browser configurations.

PUBLISHED
Vendor
OpenClaw
Product
OpenClaw
Provider severity
HIGH
Conflicts
1

CVE-2026-42430

OpenClaw before 2026.4.8 contains a server-side request forgery vulnerability in Playwright redirect handling that allows attackers to bypass strict SSRF checks. Attackers can exploit request-time navigation to reach private targets that should be restricted by browser SSRF protections.

PUBLISHED
Vendor
OpenClaw
Product
OpenClaw
Provider severity
MEDIUM
Conflicts
1

CVE-2026-4243

A weakness has been identified in La Nacion App 10.2.25 on Android. This impacts an unknown function of the file source/app/lanacion/clublanacion/BuildConfig.java of the component app.lanacion.activity. Executing a manipulation of the argument API_KEY_WEBSOCKET_CV can lead to unprotected storage of credentials. The attack can only be executed locally. A high complexity level is associated with this attack. The exploitability is said to be difficult. The exploit has been made available to the pub

PUBLISHED
Vendor
n/a
Product
La Nacion App
Provider severity
LOW
Conflicts
2

CVE-2026-42429

OpenClaw before 2026.4.8 contains a privilege escalation vulnerability in the gateway plugin HTTP authentication mechanism that escalates identity-bearing operator.read requests to runtime operator.write permissions. Attackers can exploit this by sending read-scoped requests through the gateway auth route to gain unauthorized write access to runtime operations.

PUBLISHED
Vendor
OpenClaw
Product
OpenClaw
Provider severity
HIGH, MEDIUM
Conflicts
1

CVE-2026-42428

OpenClaw versions before 2026.4.8 fail to enforce integrity verification on downloaded plugin archives. Attackers can install malicious or tampered plugin packages without detection, compromising the local assistant environment.

PUBLISHED
Vendor
OpenClaw
Product
OpenClaw
Provider severity
HIGH
Conflicts
1

CVE-2026-42427

OpenClaw before 2026.4.8 contains a remote code execution vulnerability caused by missing environment variable denylist entries for HGRCPATH, CARGO_BUILD_RUSTC_WRAPPER, RUSTC_WRAPPER, and MAKEFLAGS. Attackers can inject malicious build tool environment variables to influence host exec commands and achieve arbitrary code execution.

PUBLISHED
Vendor
OpenClaw
Product
OpenClaw
Provider severity
MEDIUM
Conflicts
1

CVE-2026-42426

OpenClaw before 2026.4.8 contains an improper authorization vulnerability where the node.pair.approve method accepts operator.write scope instead of the narrower operator.pairing scope, allowing unprivileged users to approve node pairing. Attackers with operator.write permissions can bypass pairing approval restrictions to gain unauthorized access to exec-capable nodes.

PUBLISHED
Vendor
OpenClaw
Product
OpenClaw
Provider severity
HIGH
Conflicts
1

CVE-2026-42425

OpenKM 6.3.12 contains an unrestricted SQL execution vulnerability that allows authenticated administrative users to execute arbitrary SQL statements against the application database via the DatabaseQuery interface. Attackers can submit malicious SQL queries through the qs parameter to the /admin/DatabaseQuery endpoint to extract sensitive data including usernames and password hashes from the OKM_USER table, modify permissions, or delete database records.

PUBLISHED
Vendor
Openkm, Openkm
Product
OpenKM Professional Edition, OpenKM Community Edition
Provider severity
HIGH
Conflicts
2

CVE-2026-42424

OpenClaw before 2026.4.8 treats shared reply MEDIA paths as trusted, allowing crafted references to trigger cross-channel local file exfiltration. Attackers can exploit this by crafting malicious shared reply MEDIA references to cause another channel to read local file paths as trusted generated media.

PUBLISHED
Vendor
OpenClaw
Product
OpenClaw
Provider severity
MEDIUM
Conflicts
1

CVE-2026-42423

OpenClaw before 2026.4.8 contains an approval-timeout fallback mechanism that bypasses strictInlineEval explicit-approval requirements on gateway and node exec hosts. Attackers can exploit this timeout fallback to execute inline eval commands that should require explicit user approval, circumventing the intended security boundary.

PUBLISHED
Vendor
OpenClaw
Product
OpenClaw
Provider severity
HIGH
Conflicts
1

CVE-2026-42422

OpenClaw before 2026.4.8 contains a role bypass vulnerability in the device.token.rotate function that allows minting tokens for unapproved roles. Attackers can bypass device role-upgrade pairing to preserve or mint roles and scopes that had not undergone intended approval.

PUBLISHED
Vendor
OpenClaw
Product
OpenClaw
Provider severity
HIGH
Conflicts
1

CVE-2026-42421

OpenClaw before 2026.4.8 contains a session management vulnerability where existing WebSocket sessions survive shared gateway token rotation. Attackers can maintain unauthorized access to WebSocket connections after token rotation by exploiting the failure to disconnect existing shared-token sessions.

PUBLISHED
Vendor
OpenClaw
Product
OpenClaw
Provider severity
LOW, MEDIUM
Conflicts
1

CVE-2026-42420

OpenClaw before 2026.4.8 contains improper input validation in base64 decode paths that allocate memory before enforcing decoded-size limits. Attackers can exploit multiple code paths to cause memory exhaustion or denial of service through crafted base64-encoded input.

PUBLISHED
Vendor
OpenClaw
Product
OpenClaw
Provider severity
MEDIUM
Conflicts
1

CVE-2026-4242

A security flaw has been discovered in BabyChakra Pregnancy & Parenting App up to 5.4.3.0 on Android. This affects an unknown function of the file file app/babychakra/babychakra/Configuration.java of the component app.babychakra.babychakra. Performing a manipulation of the argument SEGMENT_WRITE_KEY results in unprotected storage of credentials. The attack needs to be approached locally. The complexity of an attack is rather high. The exploitability is reported as difficult. The exploit has been

PUBLISHED
Vendor
BabyChakra
Product
Pregnancy & Parenting App
Provider severity
LOW
Conflicts
2

CVE-2026-42412

Missing Authorization vulnerability in weDevs WP User Frontend allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects WP User Frontend: from n/a through 4.3.1.

PUBLISHED
Vendor
weDevs
Product
WP User Frontend
Provider severity
MEDIUM
Conflicts
0

CVE-2026-42411

Unauthenticated Broken Authentication in CloudSecure WP Security <= 1.4.7 versions.

PUBLISHED
Vendor
XServer
Product
CloudSecure WP Security
Provider severity
HIGH
Conflicts
0

CVE-2026-42410

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CodexThemes TheGem Theme Elements (for Elementor) allows DOM-Based XSS.This issue affects TheGem Theme Elements (for Elementor): from n/a before 5.12.1.1.

PUBLISHED
Vendor
CodexThemes
Product
TheGem Theme Elements (for Elementor)
Provider severity
MEDIUM
Conflicts
0

CVE-2026-4241

A vulnerability was identified in itsourcecode College Management System 1.0. The impacted element is an unknown function of the file /admin/time-table.php. Such manipulation of the argument course_code leads to sql injection. The attack can be launched remotely. The exploit is publicly available and might be used.

PUBLISHED
Vendor
itsourcecode
Product
College Management System
Provider severity
MEDIUM
Conflicts
2

CVE-2026-42409

When an HTTP/2 profile and an iRule containing the HTTP::redirect or HTTP::respond command are configured on a virtual server, undisclosed requests can cause the Traffic Management Microkernel (TMM) process to terminate.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

PUBLISHED
Vendor
F5, F5, F5, F5
Product
BIG-IP Next SPK, BIG-IP, BIG-IP Next CNF, BIG-IP Next for Kubernetes
Provider severity
HIGH
Conflicts
2

CVE-2026-42408

When BIG-IP DNS is provisioned, a vulnerability exists in an undisclosed TMOS Shell (tmsh) command that may allow a highly privileged authenticated attacker to view sensitive information.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

PUBLISHED
Vendor
F5
Product
BIG-IP
Provider severity
MEDIUM
Conflicts
1

CVE-2026-42406

A vulnerability exists in BIG-IP and BIG-IQ systems where a highly privileged, authenticated attacker with at least the Certificate Manager role can modify configuration objects that allow running arbitrary commands.     Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

PUBLISHED
Vendor
F5, F5
Product
BIG-IQ, BIG-IP
Provider severity
HIGH, MEDIUM
Conflicts
2

CVE-2026-42404

Apache Neethi does not impose any restrictions on URIs when manually fetching remote policy references through the PolicyReference API. When an application explicitly calls the API to retrieve a policy from a remote URI, an outbound request is made for arbitrary protocols and internal IP adddresses. From 3.2.2, only http or https URIs are allowed, and link-local/multicast/any-local addresses are forbidden. Users are recommended to upgrade to version 3.2.2, which fixes this issue.

PUBLISHED
Vendor
Apache Software Foundation
Product
Apache Neethi
Provider severity
MEDIUM
Conflicts
0

CVE-2026-42403

Apache Neethi does not properly detect circular references in policy definitions. When a WS-Policy document contains circular policy references (where Policy A references Policy B which references Policy A), the policy normalization process can enter an infinite loop or cause excessive recursion, leading to a stack overflow or application hang. An attacker can craft malicious policy documents with circular references to cause a Denial of Service condition Users are recommended to upgrade to ver

PUBLISHED
Vendor
Apache Software Foundation
Product
Apache Neethi
Provider severity
HIGH
Conflicts
0

CVE-2026-42402

Apache Neethi is vulnerable to a Denial of Service attack through algorithmic complexity in policy normalization. Specially crafted WS-Policy documents can trigger an exponential Cartesian cross-product expansion during the normalization process, causing unbounded memory allocation that exhausts the JVM heap. This occurs when the normalization process generates an excessive number of policy alternatives without bounds, leading to runtime memory exhaustion. Users should upgrade to 3.2.2 which li

PUBLISHED
Vendor
Apache Software Foundation
Product
Apache Neethi
Provider severity
HIGH
Conflicts
0

CVE-2026-42401

Improper Neutralization of Input During Web Page Generation (CWE-79) in Kibana can lead to stored HTML injection. A user with write access to an Elasticsearch index could persist crafted markup which, when subsequently rendered through an affected Kibana view by another user, was not sufficiently sanitized. Successful exploitation could result in unauthorized UI manipulation and outbound network requests issued from the viewing user's browser session.

PUBLISHED
Vendor
Elastic
Product
Kibana
Provider severity
MEDIUM
Conflicts
0

CVE-2026-42400

Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated user can send a specially crafted compressed request payload that is processed prior to authorization checks, causing excessive memory and CPU resource consumption that can result in a Kibana instance becoming unresponsive or crashing.

PUBLISHED
Vendor
Elastic
Product
Kibana
Provider severity
MEDIUM
Conflicts
0

CVE-2026-4240

A vulnerability was determined in Open5GS up to 2.7.6. The affected element is the function smf_gx_cca_cb/smf_gy_cca_cb/smf_s6b_aaa_cb/smf_s6b_sta_cb of the component CCA Handler. This manipulation causes denial of service. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. Upgrading to version 2.7.7 is sufficient to fix this issue. Patch name: 80eb484a6ab32968e755e628b70d1a9c64f012ec. Upgrading the affected component is recommended.

PUBLISHED
Vendor
n/a
Product
Open5GS
Provider severity
MEDIUM
Conflicts
1

CVE-2026-42399

Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated low-privileged user can cause Kibana to consume exponentially increasing amounts of memory by submitting a specially crafted Timelion visualization expression containing deeply chained function calls. The resulting data structure grows without bound, exhausting available memory and causing the Kibana service to crash and become unavailable to all users.

PUBLISHED
Vendor
Elastic
Product
Kibana
Provider severity
MEDIUM
Conflicts
0

CVE-2026-42398

Server-Side Request Forgery (CWE-918) in Kibana allows authenticated users with connector management privileges to bypass the operator-configured connection allowlist. By configuring a Webhook connector with a crafted target, an attacker can cause Kibana to issue outbound requests to destinations that the egress restriction controls were intended to block.

PUBLISHED
Vendor
Elastic
Product
Kibana
Provider severity
HIGH
Conflicts
0

CVE-2026-42397

Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user can submit a specially crafted request to affected Entity Analytics endpoints containing an oversized input value that causes excessive resource consumption, which may render Kibana unavailable.

PUBLISHED
Vendor
Elastic
Product
Kibana
Provider severity
MEDIUM
Conflicts
0

CVE-2026-42396

Insufficient Validation of Member Zone Data May Cause Catalog Zone Transfer to Fail

PUBLISHED
Vendor
PowerDNS
Product
Authoritative
Provider severity
MEDIUM
Conflicts
1

CVE-2026-42390

An invalid zone might pass ZONEMD validation while it should not. This is only relevant if ZoneToCache is configured with ZONEMD validation.

PUBLISHED
Vendor
PowerDNS
Product
Recursor
Provider severity
MEDIUM
Conflicts
1

CVE-2026-4239

A vulnerability was found in Lagom WHMCS Template up to 2.3.7. Impacted is an unknown function of the component Datatables. The manipulation results in improperly controlled modification of object prototype attributes. It is possible to launch the attack remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.

PUBLISHED
Vendor
Lagom
Product
WHMCS Template
Provider severity
LOW, MEDIUM
Conflicts
2

CVE-2026-42389

This fix provides extra hardening for the 5.4.x branch by doing extra validation of incoming answers from authoritative servers.

PUBLISHED
Vendor
PowerDNS
Product
Recursor
Provider severity
MEDIUM
Conflicts
1

CVE-2026-42388

Incomplete validation of the SOA record present in a catalog zone might lead to a crash.

PUBLISHED
Vendor
PowerDNS
Product
Recursor
Provider severity
MEDIUM
Conflicts
1

CVE-2026-42387

A malicious authoritative server can send a crafted zone via the ZoneToCache function that leads to a crash of the Recursor due to insuffcient input validation.

PUBLISHED
Vendor
PowerDNS
Product
Recursor
Provider severity
MEDIUM
Conflicts
1

CVE-2026-42386

Unauthenticated SQL Injection in Order Delivery Date for WooCommerce <= 4.5.1 versions.

PUBLISHED
Vendor
tychesoftwares
Product
Order Delivery Date for WooCommerce
Provider severity
CRITICAL
Conflicts
0