CVE Explorer

Exact snapshot results

353,537 CVE records

CVE ID descending · no relevance ranking

CVE-2026-40575

A flaw was found in OAuth2 Proxy. When configured with `--reverse-proxy` and either `--skip-auth-regex` or `--skip-auth-route`, the proxy may trust a client-supplied `X-Forwarded-Uri` header. An unauthenticated remote attacker can exploit this by spoofing the header, leading to an authentication bypass. This allows unauthorized access to protected routes without a valid session.

PUBLISHED

Vendor: oauth2-proxy, Red Hat
Product: oauth2-proxy, Red Hat Ceph Storage 9
Provider severity: CRITICAL, HIGH
Conflicts: 3

CVE-2026-40574

OAuth2 Proxy is a reverse proxy that provides authentication using OAuth2 providers. Prior to 7.15.2, an authorization bypass exists in OAuth2 Proxy as part of the email_domain enforcement option. An attacker may be able to authenticate with an email claim such as attacker@evil.com@company.com and satisfy an allowed domain check for company.com, even though the claim is not a valid email address. The issue ONLY affects deployments that rely on email_domain restrictions and accept email claim val

PUBLISHED

Vendor: oauth2-proxy
Product: oauth2-proxy
Provider severity: MEDIUM
Conflicts: 0

CVE-2026-40572

NovumOS is a custom 32-bit operating system written in Zig and x86 Assembly. In versions prior to 0.24, Syscall 15 (MemoryMapRange) allows Ring 3 user-mode processes to map arbitrary virtual address ranges into their address space without validating against forbidden regions, including critical kernel structures such as the IDT, GDT, TSS, and page tables. A local attacker can exploit this to modify kernel interrupt handlers, resulting in privilege escalation from user mode to kernel context. Thi

PUBLISHED

Vendor: MinecAnton209
Product: NovumOS
Provider severity: CRITICAL
Conflicts: 0

CVE-2026-40571

NamelessMC is website software for Minecraft servers. In version 2.2.4, `core/classes/Misc/ProfilePostReactionContext.php` only verifies that the wall post exists and does not enforce blocked/private-profile visibility. This means that authenticated low-privileged users can add reactions to private or blocking profile posts. Version 2.2.5 contains a patch.

PUBLISHED

Vendor: NamelessMC
Product: Nameless
Provider severity: MEDIUM
Conflicts: 0

CVE-2026-40570

FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.213, the `load_customer_info` action in `POST /conversation/ajax` returns complete customer profile data to any authenticated user without verifying mailbox access. An attacker only needs a valid email address to retrieve all customer PII. Version 1.8.213 fixes the issue.

PUBLISHED

Vendor: freescout-help-desk
Product: freescout
Provider severity: MEDIUM
Conflicts: 1

CVE-2026-4057

The Download Manager plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the `makeMediaPublic()` and `makeMediaPrivate()` functions in all versions up to, and including, 3.3.51. This is due to the functions only checking for `edit_posts` capability without verifying post ownership via `current_user_can('edit_post', $id)`, and the destructive operations executing before the admin-level check in `mediaAccessControl()`. This makes it possible

PUBLISHED

Vendor: codename065
Product: Download Manager
Provider severity: MEDIUM
Conflicts: 0

CVE-2026-40569

FreeScout is a free self-hosted help desk and shared mailbox. Versions prior to 1.8.213 have a mass assignment vulnerability in the mailbox connection settings endpoints of FreeScout (`connectionIncomingSave()` at `app/Http/Controllers/MailboxesController.php:468` and `connectionOutgoingSave()` at line 398). Both methods pass `$request->all()` directly to `$mailbox->fill()` without any field allowlisting, allowing an authenticated admin to overwrite any of the 32 fields in the Mailbox model's `$

PUBLISHED

Vendor: freescout-help-desk
Product: freescout
Provider severity: CRITICAL
Conflicts: 1

CVE-2026-40568

FreeScout is a free self-hosted help desk and shared mailbox. Versions prior to 1.8.213 have a stored cross-site scripting (XSS) vulnerability in the mailbox signature feature. The sanitization function `Helper::stripDangerousTags()` (`app/Misc/Helper.php:568`) uses an incomplete blocklist of only four HTML tags (`script`, `form`, `iframe`, `object`) and does not remove event handler attributes. When a mailbox signature is saved via `MailboxesController::updateSave()` (`app/Http/Controllers/Mail

PUBLISHED

Vendor: freescout-help-desk
Product: freescout
Provider severity: HIGH
Conflicts: 1

CVE-2026-40567

FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.213, an unauthenticated attacker can inject arbitrary HTML into outgoing emails generated by FreeScout by sending an email with a crafted From display name. The name is stored in the database without sanitization and rendered unescaped into outgoing reply emails via the `{%customer.fullName%}` signature variable. This allows embedding phishing links, tracking pixels, and spoofed content inside legitimate support e

PUBLISHED

Vendor: freescout-help-desk
Product: freescout
Provider severity: MEDIUM
Conflicts: 0

CVE-2026-40566

FreeScout is a free self-hosted help desk and shared mailbox. Versions prior to 1.8.213 have a Server-Side Request Forgery (SSRF) vulnerability in the IMAP/SMTP connection test functionality of FreeScout's `MailboxesController`. Three AJAX actions `fetch_test` (line 731), `send_test` (line 682), and `imap_folders` (line 773) in `app/Http/Controllers/MailboxesController.php` pass admin-configured `in_server`/`in_port` and `out_server`/`out_port` values directly to `fsockopen()` via `Helper::che

PUBLISHED

Vendor: freescout-help-desk
Product: freescout
Provider severity: MEDIUM
Conflicts: 0

CVE-2026-40565

FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.213, FreeScout's linkify() function in app/Misc/Helper.php converts plain-text URLs in email bodies into HTML anchor tags without escaping double-quote characters (") in the URL. HTMLPurifier (called first via getCleanBody()) preserves literal " characters in text nodes. linkify() then wraps URLs including those " chars inside an unescaped href="..." attribute, breaking out of the href and injecting arbitrary HTML

PUBLISHED

Vendor: freescout-help-desk
Product: freescout
Provider severity: MEDIUM
Conflicts: 0

CVE-2026-40564

Files or Directories Accessible to External Parties, Server-Side Request Forgery (SSRF) vulnerability in Apache Flink Kubernetes Operator. The FlinkSessionJob jarURI is currently not validated so that it points to user-owned files or addresses. This lets a user with CR create permissions read files from the operator pod's filesystem and pull content from any backing store reachable through Flink's pluggable filesystem layer and access them through the submitted Flink job. Furthermore for fetch

PUBLISHED

Vendor: Apache Software Foundation
Product: Apache Flink Kubernetes Operator
Provider severity: MEDIUM
Conflicts: 1

CVE-2026-40563

Description: Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Atlas Apache Atlas exposes a DSL search endpoint that accepts user-supplied query strings. Attacker can alter Gremlin traversal logic within grammar-allowed characters to access unintended data Affect Version: This issue affects Apache Atlas: from 0.8 through 2.4.0. For the affect version >= 2.0, vulnerability is only when Atlas is deployed with below non-default configuration. atlas.dsl.execu

PUBLISHED

Vendor: Apache Software Foundation
Product: Apache Atlas
Provider severity: HIGH
Conflicts: 0

CVE-2026-40562

Gazelle versions through 0.49 for Perl allows HTTP Request Smuggling via Improper Header Precedence. Gazelle incorrectly prioritizes "Content-Length" over "Transfer-Encoding: chunked" when both headers are present in an HTTP request. Per RFC 7230 3.3.3, Transfer-Encoding must take precedence. An attacker could exploit this to smuggle malicious HTTP requests via a front-end reverse proxy.

PUBLISHED

Vendor: KAZEBURO
Product: Gazelle
Provider severity: HIGH
Conflicts: 0

CVE-2026-40561

Starlet versions through 0.31 for Perl allows HTTP Request Smuggling via Improper Header Precedence. Starlet incorrectly prioritizes "Content-Length" over "Transfer-Encoding: chunked" when both headers are present in an HTTP request. Per RFC 7230 3.3.3, Transfer-Encoding must take precedence. An attacker could exploit this to smuggle malicious HTTP requests via a front-end reverse proxy.

PUBLISHED

Vendor: KAZUHO
Product: Starlet
Provider severity: MEDIUM
Conflicts: 0

CVE-2026-40560

Starman versions before 0.4018 for Perl allows HTTP Request Smuggling via Improper Header Precedence. Starman incorrectly prioritizes "Content-Length" over "Transfer-Encoding: chunked" when both headers are present in an HTTP request. Per RFC 7230 3.3.3, Transfer-Encoding must take precedence. An attacker could exploit this to smuggle malicious HTTP requests via a front-end reverse proxy.

PUBLISHED

Vendor: MIYAGAWA
Product: Starman
Provider severity: HIGH
Conflicts: 0

CVE-2026-4056

The User Registration & Membership plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the Content Access Rules REST API endpoints in versions 5.0.1 through 5.1.4. This is due to the `check_permissions()` method only checking for `edit_posts` capability instead of an administrator-level capability. This makes it possible for authenticated attackers, with Contributor-level access and above, to list, create, modify, toggle, duplicate, and de

PUBLISHED

Vendor: wpeverest
Product: User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder
Provider severity: MEDIUM
Conflicts: 0

CVE-2026-40557

Improper Certificate Validation via Global SSL Context Downgrade in Apache Storm Prometheus Reporter Versions Affected: from 2.6.3 to 2.8.6 Description: In production deployments where an administrator enables storm.daemon.metrics.reporter.plugin.prometheus.skip_tls_validation (by default it is disabled) intending to affect only the Prometheus reporter, the undocumented global side effect creates an attack surface across every TLS-protected communication channel in the Storm daemon. The

PUBLISHED

Vendor: Apache Software Foundation
Product: Apache Storm Prometheus Reporter
Provider severity: MEDIUM
Conflicts: 0

CVE-2026-40553

Buffer overflow vulnerability has been found in "extension/readdir.c" program file of gawk (ftype() routine). This issue could be used to crash the program and potentially to achieve code execution, although the latter has not been confirmed to be feasible. It affects gawk in versions 5.4.0 and below.

PUBLISHED

Vendor: GNU
Product: gawk
Provider severity: MEDIUM
Conflicts: 0

CVE-2026-40552

mpGabinet is vulnerable to Remote Command Execution. An authorized user with access to the application and direct access to the backend database can achieve system command execution by uploading an attachment and modifying its storage path in the database to reference an attacker-controlled remote network resource. Alternatively, it is possible to use a previously uploaded file and change its reference. When the application processes the attachment, and a user tries to open it, the referenced re

PUBLISHED

Vendor: BinSoft
Product: mpGabinet
Provider severity: MEDIUM
Conflicts: 0

CVE-2026-40551

mpGabinet performs client-side authentication. An attacker with access to any application instance connected to the backend server can bypass the login verification process by manipulating the application binary and authenticate as an arbitrary user. This issue affects mpGabinet version 23.12.19 and below.

PUBLISHED

Vendor: BinSoft
Product: mpGabinet
Provider severity: HIGH
Conflicts: 0

CVE-2026-40550

mpGabinet is vulnerable to Privilege Escalation due to excessive database privileges assigned to the user used by the application. An attacker with access to any running application instance connected to the backend server can extract database credentials from the application’s memory by inspecting the running process. While ability to retrieve credentials from memory is expected behavior, the exposed credentials grant administrative access to the database, exceeding the privileges required for

PUBLISHED

Vendor: BinSoft
Product: mpGabinet
Provider severity: MEDIUM
Conflicts: 0

CVE-2026-4055

Mattermost versions 11.5.x <= 11.5.1 fail to validate team-level run_create permission against the target team when creating a playbook run which allows an authenticated team member to create runs in teams where they lack permission via specifying a different team ID in the run creation API request. Mattermost Advisory ID: MMSA-2026-00629

PUBLISHED

Vendor: Mattermost
Product: Mattermost
Provider severity: MEDIUM
Conflicts: 0

CVE-2026-40549

SOPlanning is vulnerable to Cross‑Site Request Forgery (CSRF) in groupe_save create, modify and delete endpoints. An attacker can craft a malicious website that, when visited by an authenticated user, automatically sends a forged GET or POST request to the application. This issue affects SOPlanning version 1.55 and below.

PUBLISHED

Vendor: SOPlanning
Product: SOPlanning
Provider severity: MEDIUM
Conflicts: 0

CVE-2026-40548

SOPlanning does not verify uploaded file extension. An authenticated attacker with access to the backup functionality can upload a crafted ZIP archive containing a legitimate user.csv file alongside a malicious file, which is extracted on the server. When combined with CVE-2026-40547 (Path Traversal), the malicious file (e.g., a PHP script) can be placed in a web-accessible location and executed via the browser. This issue affects SOPlanning version 1.55 and below.

PUBLISHED

Vendor: SOPlanning
Product: SOPlanning
Provider severity: MEDIUM
Conflicts: 0

CVE-2026-40547

SOPlanning is vulnerable to Path Traversal in backup endpoints. Authenticated remote attacker is able to exploit a vulnerable endpoint and construct payloads that allow reading and executing files previously added through the backup functionality. Critically, due to CVE-2026-40543 (Missing Authorization), any backup file can be read by any (unauthorized) user. This issue affects SOPlanning version 1.55 and below.

PUBLISHED

Vendor: SOPlanning
Product: SOPlanning
Provider severity: MEDIUM
Conflicts: 0

CVE-2026-40546

SOPlanning is vulnerable to SQL Injection across multiple endpoints and parameters. Attacker with low privileges can inject arbitrary SQL commands, potentially gaining full control over the database. This issue affects SOPlanning version 1.55 and below.

PUBLISHED

Vendor: SOPlanning
Product: SOPlanning
Provider severity: HIGH
Conflicts: 0

CVE-2026-40545

SOPlanning is vulnerable to Reflected XSS via the taches parameter. An attacker can craft a malicious URL which, when opened by authenticated victim, results in arbitrary JavaScript execution in the victim’s browser. This issue affects SOPlanning version 1.55 and below.

PUBLISHED

Vendor: SOPlanning
Product: SOPlanning
Provider severity: MEDIUM
Conflicts: 0

CVE-2026-40544

SOPlanning is vulnerable to Stored Cross-Site Scripting (XSS) via /process/upload_backup endpoint. An authenticated attacker with access to the backup functionality can upload a crafted ZIP archive containing a malicious user.csv file with embedded JavaScript. The injected code is executed in the victim’s browser when a user clicks the Edit button for the malicious backup. This issue affects SOPlanning version 1.55 and below.

PUBLISHED

Vendor: SOPlanning
Product: SOPlanning
Provider severity: MEDIUM
Conflicts: 0

CVE-2026-40543

SOPlanning does not enforce authorization for backup functionalities. An unauthenticated attacker can directly query backup-related endpoints and retrieve backup archives containing user databases with usernames and password hashes, as well as the config.csv file, which includes additional sensitive information. This issue affects SOPlanning version 1.55 and below.

PUBLISHED

Vendor: SOPlanning
Product: SOPlanning
Provider severity: HIGH
Conflicts: 0

CVE-2026-40542

Missing critical step in authentication in Apache HttpClient 5.6 allows an attacker to cause the client to accept SCRAM-SHA-256 authentication without proper mutual authentication verification. Users are recommended to upgrade to version 5.6.1, which fixes this issue.

PUBLISHED

Vendor: Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Apache Software Foundation, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat
Product: Red Hat JBoss Enterprise Application Platform 8, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 8, Red Hat JBoss Enterprise Application Platform Expansion Pack, Migration Toolkit for Applications 8, Red Hat JBoss Enterprise Application Platform Expansion Pack, Red Hat build of Apicurio Registry 3, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 9, Red Hat OpenShift AI (RHOAI), Migration Toolkit for Applications 8, Red Hat build of Apache Camel - HawtIO 4, Red Hat Enterprise Linux 8, Red Hat JBoss Enterprise Application Platform 7, OpenShift Serverless, Red Hat JBoss Web Server 6, Red Hat JBoss Enterprise Application Platform 7, Red Hat JBoss Core Services, Red Hat JBoss Enterprise Application Platform Expansion Pack, OpenShift Serverless, Red Hat Enterprise Linux 8, OpenShift Developer Tools and Services, streams for Apache Kafka 2, Red Hat Enterprise Linux 8, Red Hat build of Apache Camel for Spring Boot 4, Red Hat build of Apache Camel 4 for Quarkus 3, Red Hat OpenShift Dev Spaces, Cryostat 4, OpenShift Serverless, Red Hat build of Apache Camel for Spring Boot 4, Red Hat AMQ Broker 7, Red Hat Fuse 7, Red Hat Offline Knowledge Portal, OpenShift Developer Tools and Services, Red Hat JBoss Web Server 5, Red Hat Enterprise Linux 8, OpenShift Serverless, Red Hat Enterprise Linux 10, Red Hat Single Sign-On 7, Red Hat JBoss Enterprise Application Platform 7, Red Hat Satellite 6, Red Hat JBoss Core Services, Red Hat JBoss Web Server 5, Red Hat JBoss Enterprise Application Platform 8, Red Hat build of Apicurio Registry 2, Red Hat Fuse 7, Red Hat build of Quarkus, streams for Apache Kafka 3, OpenShift Developer Tools and Services, Red Hat Enterprise Linux 7, Red Hat Satellite 6, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 9, Red Hat build of OptaPlanner 8, Red Hat Enterprise Linux 8, Red Hat Lightspeed for Runtimes Operator, Red Hat JBoss Enterprise Application Platform Expansion Pack, Red Hat Enterprise Linux 9, Red Hat build of Debezium 3, Red Hat Enterprise Linux 9, Red Hat AMQ Clients, Red Hat Certificate System 10, Red Hat Fuse 7, Red Hat Satellite 6, Apache HttpClient, Red Hat Satellite 6, OpenShift Developer Tools and Services, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 9, OpenShift Serverless, Red Hat JBoss Enterprise Application Platform 8, Red Hat JBoss Enterprise Application Platform 7, Red Hat Satellite 6, OpenShift Serverless, Red Hat OpenShift Dev Spaces, Red Hat Data Grid 8, Red Hat Enterprise Linux 7, Red Hat Process Automation 7, Red Hat Data Grid 8, Red Hat Enterprise Linux 9, Red Hat Fuse 7, Red Hat JBoss Enterprise Application Platform 8, Red Hat build of Apache Camel 4 for Quarkus 3, Red Hat Enterprise Linux 7, Red Hat OpenShift AI (RHOAI)
Provider severity: HIGH
Conflicts: 2

CVE-2026-4054

Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13, 11.4.x <= 11.4.3 Fail to validate the response body of proxied images, which allows a remote attacker to enact client-side DoS via an SVG file served from an attacker-controlled origin under a non-SVG Content-Type header (e.g. image/png) embedded in an og:image meta tag or Markdown image link.. Mattermost Advisory ID: MMSA-2026-00630

PUBLISHED

Vendor: Mattermost
Product: Mattermost
Provider severity: MEDIUM
Conflicts: 0

CVE-2026-4053

Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13 fail to enforce the PostEditTimeLimit on non-message post fields which allows an authenticated user to modify post file attachments, props, and pin status after the edit window has expired via the post patch and update API endpoints.. Mattermost Advisory ID: MMSA-2026-00631

PUBLISHED

Vendor: Mattermost
Product: Mattermost
Provider severity: LOW
Conflicts: 0

CVE-2026-40529

CMS ALAYA provided by KANATA Limited contains an SQL injection vulnerability. Information stored in the database may be obtained or altered by an attacker with access to the administrative interface.

PUBLISHED

Vendor: KANATA Limited
Product: CMS ALAYA
Provider severity: MEDIUM
Conflicts: 1

CVE-2026-40528

OpenSC before 0.27.0, fixed in commit 0358817, contains a stack and heap buffer overrun vulnerability in the do_key_value() function in src/pkcs15init/profile.c that allows attackers to corrupt memory by supplying a crafted profile configuration file. During pkcs15-init invocation, a key value entry beginning with '=' followed by more than sizeof(keybuf) characters is copied into keybuf via memcpy without a length check, causing both stack and heap buffer overruns.

PUBLISHED

Vendor: OpenSC
Product: OpenSC
Provider severity: LOW
Conflicts: 2

CVE-2026-40527

radare2 prior to commit bc5a890 contains a command injection vulnerability in the afsv/afsvj command path where crafted ELF binaries can embed malicious r2 command sequences as DWARF DW_TAG_formal_parameter names. Attackers can craft a binary with shell commands in DWARF parameter names that execute when radare2 analyzes the binary with aaa and subsequently runs afsvj, allowing arbitrary shell command execution through the unsanitized parameter interpolation in the pfq command string.

PUBLISHED

Vendor: radareorg
Product: radare2
Provider severity: HIGH
Conflicts: 1

CVE-2026-40525

OpenViking prior to version 0.3.9 contains an authentication bypass vulnerability in the VikingBot OpenAPI HTTP route surface where the authentication check fails open when the api_key configuration value is unset or empty. Remote attackers with network access to the exposed service can invoke privileged bot-control functionality without providing a valid X-API-Key header, including submitting attacker-controlled prompts, creating or using bot sessions, and accessing downstream tools, integratio

PUBLISHED

Vendor: volcengine
Product: OpenViking
Provider severity: CRITICAL
Conflicts: 1

CVE-2026-40524

FrontAccounting before 2.4.20 contains a SQL injection vulnerability in the get_gl_transactions() function where the filter_type parameter is concatenated directly into a SQL IN() clause without parameterization. Attackers with SA_GLANALYTIC permission can inject arbitrary SQL by supplying a closing parenthesis followed by malicious conditions to extract sensitive journal entry data through boolean-based blind SQL injection with reliable response size differentials.

PUBLISHED

Vendor: FrontAccounting
Product: FrontAccounting
Provider severity: HIGH
Conflicts: 1

CVE-2026-40523

FrontAccounting before 2.4.20 contains a SQL injection vulnerability in the Audit Trail report handler that allows authenticated attackers with SA_GLANALYTIC permission to execute arbitrary SQL queries by injecting malicious code into the PARAM_2 and PARAM_3 POST parameters. Attackers can exploit time-based blind SQL injection through SLEEP() functions that are amplified across JOIN result sets to cause denial of service by exhausting database connections, or extract arbitrary database content t

PUBLISHED

Vendor: FrontAccounting
Product: FrontAccounting
Provider severity: HIGH
Conflicts: 1

CVE-2026-40522

FrontAccounting before 2.4.20 contains a SQL injection vulnerability in the Bank Statement report handler that allows authenticated attackers to extract arbitrary database data by injecting UNION SELECT payloads into the PARAM_0 POST parameter. Attackers can supply malicious SQL syntax through the unparameterized WHERE clause to retrieve sensitive information including usernames, password hashes, and email addresses from the users table, rendered into PDF report output.

PUBLISHED

Vendor: FrontAccounting
Product: FrontAccounting
Provider severity: HIGH
Conflicts: 2

CVE-2026-40521

FrontAccounting before 2.4.20 contains a path traversal vulnerability in the attachment upload handler that allows authenticated attackers to execute arbitrary code by uploading files with traversal sequences in the unique_name parameter. Attackers can supply path traversal sequences ../../../shell.php to write files outside the intended attachments directory into the web root, and by uploading PHP files without extension validation, achieve remote code execution as the web server user.

PUBLISHED

Vendor: FrontAccounting
Product: FrontAccounting
Provider severity: HIGH
Conflicts: 1

CVE-2026-40520

FreePBX api module version 17.0.8 and prior contain a command injection vulnerability in the initiateGqlAPIProcess() function where GraphQL mutation input fields are passed directly to shell_exec() without sanitization or escaping. An authenticated user with a valid bearer token can send a GraphQL moduleOperations mutation with backtick-wrapped commands in the module field to execute arbitrary commands on the underlying host as the web server user.

PUBLISHED

Vendor: FreePBX
Product: api
Provider severity: HIGH
Conflicts: 1

CVE-2026-40519

Nginx Proxy Manager versions 2.9.14 through 2.15.1, fixed in commit a5db5ed, contain an authenticated remote code execution vulnerability via OS command injection in the setupCertbotPlugins() function in backend/setup.js, allowing attackers with certificates:manage permission to execute arbitrary commands by storing a malicious payload in the dns_provider_credentials field. The user-controlled dns_provider_credentials value is interpolated directly into a shell command executed via child_process

PUBLISHED

Vendor: NginxProxyManager
Product: nginx-proxy-manager
Provider severity: HIGH
Conflicts: 1

CVE-2026-40518

ByteDance DeerFlow before commit 2176b2b contains a path traversal and arbitrary file write vulnerability in bootstrap-mode custom-agent creation where the agent name validation is bypassed. Attackers can supply traversal-style values or absolute paths as the agent name to influence directory creation and write files outside the intended custom-agent directory, potentially achieving arbitrary file write on the system subject to filesystem permissions.

PUBLISHED

Vendor: bytedance
Product: deer-flow
Provider severity: HIGH
Conflicts: 1

CVE-2026-40517

radare2 prior to 6.1.4 contains a command injection vulnerability in the PDB parser's print_gvars() function that allows attackers to execute arbitrary commands by crafting a malicious PDB file with newline characters in symbol names. Attackers can inject arbitrary radare2 commands through unsanitized symbol name interpolation in the flag rename command, which are then executed when a user runs the idp command against the malicious PDB file, enabling arbitrary OS command execution through radare

PUBLISHED

Vendor: radareorg
Product: radare2
Provider severity: HIGH
Conflicts: 1

CVE-2026-40516

OpenHarness before commit bd4df81 contains a server-side request forgery vulnerability in the web_fetch and web_search tools that allows attackers to access private and localhost HTTP services by manipulating tool parameters without proper validation of target addresses. Attackers can influence an agent session to invoke these tools against loopback, RFC1918, link-local, or other non-public addresses to read response bodies from local development services, cloud metadata endpoints, admin panels,

PUBLISHED

Vendor: HKUDS
Product: OpenHarness
Provider severity: HIGH
Conflicts: 1

CVE-2026-40515

OpenHarness before commit bd4df81 contains a permission bypass vulnerability that allows attackers to read sensitive files by exploiting incomplete path normalization in the permission checker. Attackers can invoke the built-in grep and glob tools with sensitive root directories that are not properly evaluated against configured path rules, allowing disclosure of sensitive local file content, key material, configuration files, or directory contents despite configured path restrictions.

PUBLISHED

Vendor: HKUDS
Product: OpenHarness
Provider severity: HIGH
Conflicts: 1

CVE-2026-40514

SmarterTools SmarterMail builds prior to 9610 contain a cryptographic weakness in the file and email sharing endpoints that use DES-CBC encryption with keys and initialization vectors derived from System.Random seeded with insufficient entropy, reducing the seed space to approximately 19,000 possible values. An unauthenticated attacker can use the attachment download endpoint as an oracle to determine the seed in use and derive encryption keys and initialization vectors to forge sharing tokens f

PUBLISHED

Vendor: SmarterTools Inc.
Product: SmarterMail
Provider severity: HIGH, MEDIUM
Conflicts: 1

CVE-2026-40510

OpenSC before 0.27.0-rc1, fixed in commit 3f24f0b, contains a stack buffer overflow vulnerability in piv_process_history() in src/libopensc/card-piv.c that allows physically present attackers to trigger memory corruption by presenting a crafted PIV smart card or USB device returning a URL field longer than 118 bytes in the Key History Object ASN.1 response.

PUBLISHED

Vendor: OpenSC
Product: OpenSC
Provider severity: LOW
Conflicts: 1

CVE-2026-4051

IBM Engineering Lifecycle Management 7.0.3, 7.1.0, and 7.2.0 could allow an attacker with administrative privileges to execute remote code due to exposed method that is not properly restricted.

PUBLISHED

Vendor: IBM
Product: Engineering Lifecycle Management
Provider severity: HIGH
Conflicts: 0