Baitaphish
Security intelligence
SearchLatest briefing
Data & Insights

CVE Explorer

Search one exact, source-linked CVE snapshot by CVE ID or explicit vendor and product tokens. Provider severity, KEV, conflicts, and stale state remain separate observations—not a Baitaphish risk rating.
Snapshot urn:baitaphish:cve-read-model-snapshot:v3:f2c3f72dcc196f8e7d63aa2d29709ad8b3fea39110eb2d563da5ce9b6fa9da89Released 2026-08-05T02:00:00Z
Exact snapshot results

353,537 CVE records

CVE ID descending · no relevance ranking

CVE-2026-9813

FlowIntel up to version 3.3.0 contains a server-side request forgery (SSRF) vulnerability in the external reference URL probe functionality in app/case/task.py. An attacker who can submit an external reference URL can cause the application server to issue an HTTP HEAD request to an attacker-specified destination. Due to insufficient validation of the URL scheme and resolved destination address, affected versions may allow requests to loopback, link-local, private, reserved, or other restricted n

PUBLISHED
Vendor
flowintel
Product
flowintel
Provider severity
MEDIUM
Conflicts
0

CVE-2026-9811

A stored Cross-Site Scripting (XSS) vulnerability exists in the project selector component of Mautic 7. When rendering selection menus for associating projects with system entities, the application fails to sanitize project names returned via AJAX before injecting them into the DOM as option fields. An authenticated user with permissions to create projects can exploit this to store a malicious script payload in the project's name. When another administrative user subsequently opens an entity edi

PUBLISHED
Vendor
Not asserted
Product
Not asserted
Provider severity
MEDIUM
Conflicts
0

CVE-2026-9810

The AI Copilot WordPress plugin before 1.5.4 does not bind OAuth access tokens to a WordPress user, and accepts any valid token as an administrator session, allowing unauthenticated attackers who complete the public OAuth flow to execute privileged MCP tools as an administrator, including arbitrary user creation and role escalation.

PUBLISHED
Vendor
Unknown
Product
AI Copilot
Provider severity
CRITICAL
Conflicts
1

CVE-2026-9809

A stored Cross-Site Scripting (XSS) vulnerability exists in the Projects component of Mautic 7. When displaying project tags and popovers on administrative detail views (such as campaigns, emails, or forms), user-supplied project names are rendered without proper sanitization. An authenticated user with permissions to create or edit projects can exploit this to inject malicious script payloads. When an administrative user views an entity associated with a compromised project and hovers over its

PUBLISHED
Vendor
Not asserted
Product
Not asserted
Provider severity
HIGH
Conflicts
0

CVE-2026-9808

An authorization bypass vulnerability exists in the Mautic 7 API v2 endpoints (utilizing API Platform). Under certain conditions, roles configured with owner-scope restrictions (such as `viewown` or `editown`) are not properly enforced. This allows low-privilege authenticated API users to bypass ownership-logic controls and access or modify resources belonging to other users.

PUBLISHED
Vendor
Not asserted
Product
Not asserted
Provider severity
HIGH
Conflicts
0

CVE-2026-9807

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.9 before 18.10.7, 18.11 before 18.11.4, and 19.0 before 19.0.1 that under certain conditions could have allowed a blocked Project Access Token to continue accessing private resources due to incorrect authorization enforcement.

PUBLISHED
Vendor
GitLab
Product
GitLab
Provider severity
MEDIUM
Conflicts
0

CVE-2026-9806

A stored cross-site scripting (XSS) vulnerability exists in the notification panel of CTI Transmute in versions prior to the patched release. Notification messages containing user-controlled convert names were rendered in the notification bell dropdown using innerHTML without adequate sanitization. An attacker able to create or influence a convert name that is included in a notification could inject arbitrary JavaScript, which would execute in the browser of an authenticated user when they opene

PUBLISHED
Vendor
misp
Product
cti-transmute
Provider severity
MEDIUM
Conflicts
0

CVE-2026-9804

A flaw was found in KubeVirt's virt-exportserver component. An attacker with specific namespace-level access can exploit a path traversal vulnerability in the VMExport directory endpoint. By placing a symbolic link (symlink) within an exported filesystem Persistent Volume Claim (PVC) that points outside its designated mount root, the attacker can read arbitrary files from the exporter pod's filesystem. This leads to information disclosure, potentially exposing sensitive data.

PUBLISHED
Vendor
Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat
Product
Red Hat OpenShift Virtualization 4, Red Hat Container Native Virtualization 4.19, Red Hat Container Native Virtualization 4.21, Red Hat Container Native Virtualization 4.2, Red Hat Container Native Virtualization 4.18, Red Hat Container Native Virtualization 4.19, Red Hat OpenShift Virtualization 4, Red Hat Container Native Virtualization 4.20, Red Hat Container Native Virtualization 4.17, Red Hat Container Native Virtualization 4.21, Red Hat Container Native Virtualization 4.18, Red Hat Container Native Virtualization 4.17
Provider severity
HIGH
Conflicts
1

CVE-2026-9803

A flaw was found in Keycloak's ClientRegistrationAuth component. A remote unauthenticated attacker can exploit this vulnerability by sending a specially crafted POST request with a malformed 'Authorization: Bearer' header to any client registration endpoint. This can lead to an ArrayIndexOutOfBoundsException, causing the server to return an HTTP 500 error and resulting in a Denial of Service (DoS) for the affected service.

PUBLISHED
Vendor
Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat
Product
Red Hat build of Keycloak 26.4, Red Hat build of Keycloak 26.6, Red Hat build of Keycloak 26.4, Red Hat build of Keycloak 26.4.13, Red Hat build of Keycloak 26.6, Red Hat build of Keycloak 26.4, Red Hat build of Keycloak 26.6, Red Hat build of Keycloak 26.6.3
Provider severity
MEDIUM
Conflicts
1

CVE-2026-9802

A flaw was found in Keycloak. When revokeRefreshToken=true is enabled and persistent session storage is in use, a server restart can reset internal timing mechanisms. This allows a remote attacker, who has previously captured a user's refresh token, to replay that token even after it has been revoked. Successful exploitation grants the attacker unauthorized access to the victim's account, potentially leading to information disclosure or privilege escalation.

PUBLISHED
Vendor
Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat
Product
Red Hat build of Keycloak 26.4, Red Hat build of Keycloak 26.6, Red Hat build of Keycloak 26.4.13, Red Hat build of Keycloak 26.4, Red Hat build of Keycloak 26.4, Red Hat build of Keycloak 26.6, Red Hat build of Keycloak 26.6, Red Hat build of Keycloak 26.6.3
Provider severity
MEDIUM
Conflicts
1

CVE-2026-9801

A flaw was found in Keycloak. A remote attacker with high privileges, such as a realm administrator configuring a malicious Lightweight Directory Access Protocol (LDAP) server or an attacker compromising an upstream LDAP server, could exploit this vulnerability. By sending a malformed LDAP password policy response during a password authentication request, the attacker can trigger an OutOfMemoryError. This causes the Keycloak Java Virtual Machine (JVM) to terminate, leading to a denial of service

PUBLISHED
Vendor
Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat
Product
Red Hat build of Keycloak 26.6, Red Hat build of Keycloak 26.4, Red Hat build of Keycloak 26.4.13, Red Hat build of Keycloak 26.4, Red Hat build of Keycloak 26.6, Red Hat build of Keycloak 26.4, Red Hat build of Keycloak 26.6, Red Hat build of Keycloak 26.6.3
Provider severity
MEDIUM
Conflicts
1

CVE-2026-9800

A flaw was found in Keycloak Policy Enforcer. This vulnerability allows any authenticated user to bypass all authorization policies, including role, scope, and User-Managed Access (UMA) permission checks. By including the configured access-denied page path within a request URL, either as a path segment or a query parameter, an attacker can gain unauthorized access to protected resources.

PUBLISHED
Vendor
Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat
Product
Red Hat build of Keycloak 26.4, Red Hat build of Keycloak 26.4, Red Hat JBoss Enterprise Application Platform Expansion Pack, Red Hat build of Keycloak 26.4.13, Red Hat build of Keycloak 26.6, Red Hat build of Keycloak 26.6, Red Hat build of Keycloak 26.6, Red Hat build of Keycloak 26.4, Red Hat build of Quarkus, Red Hat build of Keycloak 26.6.4, Red Hat Single Sign-On 7, Red Hat build of Keycloak 26.6.4, Red Hat build of Keycloak 26.4, Red Hat build of Keycloak 26.4, Red Hat build of Keycloak 26.6, Red Hat build of Keycloak 26.6, Red Hat Single Sign-On 7, Red Hat JBoss Enterprise Application Platform Expansion Pack, Red Hat build of Keycloak 26.6, Red Hat build of Keycloak 26.4, Red Hat build of Keycloak 26.4.13, Red Hat build of Quarkus
Provider severity
HIGH
Conflicts
1

CVE-2026-9799

A flaw was found in org.keycloak.authorization. An authenticated user with a granted User-Managed Access (UMA) permission ticket for one resource can exploit this by using a specific permission request prefix to bypass per-resource access control. This allows the user to gain unauthorized access to all resources of that type within the same resource server, even if they do not have a ticket for those specific resources. This vulnerability requires the resource server to be configured in PERMISSI

PUBLISHED
Vendor
Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat
Product
Red Hat build of Keycloak 26.4, Red Hat build of Keycloak 26.6, Red Hat build of Keycloak 26.4, Red Hat build of Keycloak 26.6, Red Hat build of Keycloak 26.4, Red Hat build of Keycloak 26.4.13, Red Hat build of Keycloak 26.6.4, Red Hat build of Keycloak 26.6
Provider severity
MEDIUM
Conflicts
1

CVE-2026-9798

A flaw was found in Keycloak, an open-source identity and access management solution. When a user account is temporarily locked due to repeated failed login attempts, an attacker with valid client credentials can exploit the Client-Initiated Backchannel Authentication (CIBA) flow to bypass this brute-force protection. This allows continued authentication attempts and token issuance even when the account should be locked, potentially enabling further unauthorized access attempts.

PUBLISHED
Vendor
Red Hat
Product
Red Hat Build of Keycloak
Provider severity
MEDIUM
Conflicts
0

CVE-2026-9796

A flaw was found in Keycloak. An authenticated administrator with the `manage-clients` role can exploit a Time-of-check to time-of-use (TOCTOU) vulnerability in the name-based admin role checks. This allows the attacker to escalate their privileges to `realm-admin` for all users within the realm, granting them extensive control over the system. The composite role relationship persists even after the attacker's own permissions are revoked and across system reboots.

PUBLISHED
Vendor
Red Hat
Product
Red Hat Build of Keycloak
Provider severity
MEDIUM
Conflicts
0

CVE-2026-9795

A flaw was found in Keycloak's Fine-Grained Admin Permissions (FGAPv2) feature. An administrator with limited client management permissions can exploit this vulnerability to assign any realm role, including highly privileged roles, to a client's scope mapping. This bypasses intended security controls, allowing the injected role to be projected into a user's authentication token when they access the modified client. This could lead to unauthorized privilege escalation within the Keycloak realm.

PUBLISHED
Vendor
Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat
Product
Red Hat build of Keycloak 26.6, Red Hat build of Keycloak 26.4, Red Hat build of Keycloak 26.6, Red Hat build of Keycloak 26.4, Red Hat build of Keycloak 26.6, Red Hat build of Keycloak 26.4, Red Hat build of Keycloak 26.4, Red Hat build of Keycloak 26.6.4, Red Hat build of Keycloak 26.6, Red Hat build of Keycloak 26.4, Red Hat build of Keycloak 26.4, Red Hat build of Keycloak 26.6, Red Hat build of Keycloak 26.4.13, Red Hat build of Keycloak 26.6.4, Red Hat build of Keycloak 26.6, Red Hat build of Keycloak 26.4.13
Provider severity
HIGH
Conflicts
1

CVE-2026-9794

A flaw was found in Keycloak. A remote, unauthenticated attacker can exploit this vulnerability by sending specially crafted SOAP requests to the SAML ECP (Security Assertion Markup Language Enhanced Client or Proxy) endpoint with varying client IDs. By observing distinct faultstrings in the responses, the attacker can determine the client's protocol type, leading to information disclosure.

PUBLISHED
Vendor
Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat
Product
Red Hat build of Keycloak 26.6, Red Hat build of Keycloak 26.4.13, Red Hat build of Keycloak 26.4, Red Hat build of Keycloak 26.4, Red Hat build of Keycloak 26.6, Red Hat build of Keycloak 26.6, Red Hat build of Keycloak 26.4, Red Hat build of Keycloak 26.6.3
Provider severity
MEDIUM
Conflicts
1

CVE-2026-9793

A flaw was found in Keycloak. When a JSON Web Encryption (JWE) encrypted request object is submitted, Keycloak may incorrectly process unsigned claims if the decrypted content is raw JSON, bypassing the configured signature policy. This allows a remote attacker to submit unauthorized claims, leading to a compromise of data integrity within the OpenID Connect (OIDC) authorization flow. While a redirect URI allowlist acts as a compensating control, this vulnerability violates OIDC Core and Financi

PUBLISHED
Vendor
Red Hat
Product
Red Hat Build of Keycloak
Provider severity
MEDIUM
Conflicts
0

CVE-2026-9792

A flaw was found in Keycloak's Client Policies, specifically within the `org.keycloak.protocol.oidc` component. When certain condition providers (client-type, client-roles, client-attributes, client-scopes) are used to enforce security restrictions, the `reject-ropc-grant` executor is silently bypassed. This allows an unauthenticated remote attacker to obtain tokens via a Resource Owner Password Credentials (ROPC) grant, even when a policy is explicitly configured to block it. This bypass can le

PUBLISHED
Vendor
Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat
Product
Red Hat build of Keycloak 26.6, Red Hat build of Keycloak 26.6.3, Red Hat build of Keycloak 26.4.13, Red Hat build of Keycloak 26.4, Red Hat build of Keycloak 26.4, Red Hat build of Keycloak 26.4, Red Hat build of Keycloak 26.6, Red Hat build of Keycloak 26.6
Provider severity
MEDIUM
Conflicts
1

CVE-2026-9791

A flaw was found in Keycloak. An authenticated user with existing organization membership can exploit this flaw by accessing user-facing APIs, such as the account API or by requesting an OpenID Connect (OIDC) token with the 'organization' scope. This allows organization metadata to be disclosed in tokens, even after an administrator has explicitly disabled the Organizations feature, potentially leading to incorrect authorization decisions by resource servers.

PUBLISHED
Vendor
Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat
Product
Red Hat build of Keycloak 26.6.3, Red Hat build of Keycloak 26.4, Red Hat build of Keycloak 26.4.13, Red Hat build of Keycloak 26.6, Red Hat build of Keycloak 26.4, Red Hat build of Keycloak 26.6, Red Hat build of Keycloak 26.4, Red Hat build of Keycloak 26.6
Provider severity
MEDIUM
Conflicts
1

CVE-2026-9789

A Local Privilege Escalation (LPE) vulnerability affects Acer NitroSense software versions prior to 3.01.3052. The vulnerability stems from the the PSAdminAgent service, which creates a Named Pipe with a weak Access Control List (ACL). This allows any authenticated local user to connect and send commands. Because the service does not check the caller's privileges before running file deletion commands, a low-privileged local user can exploit this to delete arbitrary files with system authority.

PUBLISHED
Vendor
Acer
Product
NitrorSense V3
Provider severity
HIGH
Conflicts
1

CVE-2026-9787

Quest NetVault Backup NVBULogDaemon Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Quest NetVault Backup. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the processing of NVBULogDaemon JSON-RPC messages. The issue results from the lack of proper validation of a user-supplied string bef

PUBLISHED
Vendor
Quest
Product
NetVault Backup
Provider severity
HIGH
Conflicts
0

CVE-2026-9786

Quest NetVault Backup NVBUDashboard SQL Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Quest NetVault Backup. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the processing of NVBUDashboard JSON-RPC messages. The issue results from the lack of proper validation of a user-supplied string before

PUBLISHED
Vendor
Quest
Product
NetVault Backup
Provider severity
HIGH
Conflicts
0

CVE-2026-9785

Quest NetVault Backup NVBULibrarySlot SQL Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Quest NetVault Backup. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the processing of NVBULibrarySlot JSON-RPC messages. The issue results from the lack of proper validation of a user-supplied string bef

PUBLISHED
Vendor
Quest
Product
NetVault Backup
Provider severity
HIGH
Conflicts
0

CVE-2026-9784

Quest NetVault Backup NVBULibraryPort SQL Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Quest NetVault Backup. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the processing of NVBULibraryPort JSON-RPC messages. The issue results from the lack of proper validation of a user-supplied string bef

PUBLISHED
Vendor
Quest
Product
NetVault Backup
Provider severity
HIGH
Conflicts
0

CVE-2026-9783

Quest NetVault Backup NVBURemovableMedia SQL Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Quest NetVault Backup. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the processing of NVBURemovableMedia JSON-RPC messages. The issue results from the lack of proper validation of a user-supplied stri

PUBLISHED
Vendor
Quest
Product
NetVault Backup
Provider severity
HIGH
Conflicts
0

CVE-2026-9782

Quest NetVault Backup NVBUDeviceDrive SQL Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Quest NetVault Backup. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the processing of NVBUDeviceDrive JSON-RPC messages. The issue results from the lack of proper validation of a user-supplied string bef

PUBLISHED
Vendor
Quest
Product
NetVault Backup
Provider severity
HIGH
Conflicts
0

CVE-2026-9781

Quest NetVault Backup NVBURASDevice SQL Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Quest NetVault Backup. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the processing of NVBURASDevice JSON-RPC messages. The issue results from the lack of proper validation of a user-supplied string before

PUBLISHED
Vendor
Quest
Product
NetVault Backup
Provider severity
HIGH
Conflicts
0

CVE-2026-9780

Quest NetVault Backup addclient3 Cross-Site Scripting Authentication Bypass Vulnerability. This vulnerability allows remote attackers to bypass authentication on affected installations of Quest NetVault Backup. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the addclient3 webpage. The issue results from the lack of proper validation of user-supplied data, which can lead to the in

PUBLISHED
Vendor
Quest
Product
NetVault Backup
Provider severity
HIGH
Conflicts
0

CVE-2026-9779

ATEN Unizon doCryptoHugeFileToFile Improper Verification of Cryptographic Signature Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of ATEN Unizon. Authentication is required to exploit this vulnerability. The specific flaw exists within the updateWar method. The issue results from an incorrect implementation of cryptographic signature verification. An attacker can leverage this vulnerability to execute code in

PUBLISHED
Vendor
ATEN
Product
Unizon
Provider severity
HIGH
Conflicts
0

CVE-2026-9778

ATEN Unizon ImportDeviceList Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of ATEN Unizon. Authentication is required to exploit this vulnerability. The specific flaw exists within the ImportDeviceList method. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the c

PUBLISHED
Vendor
ATEN
Product
Unizon
Provider severity
HIGH
Conflicts
0

CVE-2026-9777

ATEN Unizon restoreDB Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of ATEN Unizon. Authentication is required to exploit this vulnerability. The specific flaw exists within the restoreDB method. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of SYST

PUBLISHED
Vendor
ATEN
Product
Unizon
Provider severity
HIGH
Conflicts
0

CVE-2026-9776

ATEN Unizon writeFileToHttpServletResponse Directory Traversal Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of ATEN Unizon. Authentication is not required to exploit this vulnerability. The specific flaw exists within the writeFileToHttpServletResponse method. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage th

PUBLISHED
Vendor
ATEN
Product
Unizon
Provider severity
HIGH
Conflicts
0

CVE-2026-9775

ATEN Unizon uploadSSL Directory Traversal Arbitrary File Deletion Vulnerability. This vulnerability allows remote attackers to delete arbitrary files on affected installations of ATEN Unizon. Authentication is required to exploit this vulnerability. The specific flaw exists within the uploadSSL method. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to delete files or create a denial-o

PUBLISHED
Vendor
ATEN
Product
Unizon
Provider severity
MEDIUM
Conflicts
0

CVE-2026-9774

ATEN Unizon updateLicense Directory Traversal Arbitrary File Deletion Vulnerability. This vulnerability allows remote attackers to delete arbitrary files on affected installations of ATEN Unizon. Authentication is required to exploit this vulnerability. The specific flaw exists within the updateLicense method. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to delete files or create a

PUBLISHED
Vendor
ATEN
Product
Unizon
Provider severity
MEDIUM
Conflicts
0

CVE-2026-9773

Unraid Web Server ToggleState Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Unraid. Authentication is required to exploit this vulnerability. The specific flaw exists within ToggleState.php. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of th

PUBLISHED
Vendor
Unraid
Product
Unraid
Provider severity
HIGH
Conflicts
0

CVE-2026-9772

Unraid Web Server FileUpload Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Unraid. Authentication is required to exploit this vulnerability. The specific flaw exists within FileUpload.php. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of the

PUBLISHED
Vendor
Unraid
Product
Unraid
Provider severity
HIGH
Conflicts
0

CVE-2026-9770

Kasa EC71 v4 and EC70 v4 firmware contains a static cryptographic private key stored in a read-only filesystem that is shared across devices.  An attacker with access to the firmware image can extract the embedded key.  Successful exploitation may allow an unauthenticated attacker on the same network to use this key in the web management service, compromising the confidentiality of encrypted communications. This may enable passive decryption of traffic or active man-in-the-middle (MITM

PUBLISHED
Vendor
TP-Link Systems Inc., TP-Link Systems Inc.
Product
Kasa EC71 v4, Kasa EC70 v4
Provider severity
HIGH
Conflicts
1

CVE-2026-9765

Note: The CVE and blog post don't exist because we determined this is actually a cloud-only issue. Access Controls are “Broken” when a user can access resources they are not authorized to access. An attacker can bypass any access control mechanisms in a web application, and gain unauthorized access to resources that are not available with their permissions. Broken access control can allow attackers to: Access resources only accessible to certain users, thus allowing unauthorized access to dat

PUBLISHED
Vendor
Grafana
Product
Grafana IRM
Provider severity
HIGH
Conflicts
0

CVE-2026-9762

IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.4 is vulnerable to remote code execution when jdbc url is under user control.

PUBLISHED
Vendor
IBM
Product
Db2
Provider severity
HIGH
Conflicts
0

CVE-2026-9759

ROHC protocol dissector crash in Wireshark 4.6.0 to 4.6.5 and 4.4.0 to 4.4.15 allows denial of service

PUBLISHED
Vendor
Wireshark Foundation
Product
Wireshark
Provider severity
MEDIUM
Conflicts
0

CVE-2026-9758

Improper comparison with the certificates trusted list in S2OPC allows an attacker well-formed untrusted certificate to be considered trusted

PUBLISHED
Vendor
Systerel
Product
S2OPC
Provider severity
HIGH
Conflicts
0

CVE-2026-9757

The GEO my WP plugin for WordPress is vulnerable to SQL Injection via the 'swlatlng' and 'nelatlng' parameters in all versions up to, and including, 4.5.5 The parameters are read from $_SERVER['QUERY_STRING'] via parse_str() (bypassing WordPress's wp_magic_quotes protection, which only covers $_POST/$_GET/$_COOKIE/$_REQUEST), then each is split on ',' via explode() and the resulting fragments are interpolated directly into a SQL BETWEEN clause in gmw_get_locations_within_boundaries_sql() without

PUBLISHED
Vendor
ninjew
Product
GEO my WP
Provider severity
HIGH
Conflicts
0

CVE-2026-9756

The GenerateBlocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Headline Block 'linkMetaFieldType' Dynamic Link Attribute in all versions up to, and including, 2.2.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. A contributor-level attacker can store a JavaScript pa

PUBLISHED
Vendor
edge22
Product
GenerateBlocks
Provider severity
MEDIUM
Conflicts
0

CVE-2026-9754

An authenticated user with the read role may read limited amounts of uninitialized stack memory via specially-crafted issuances of the filemd5 command

PUBLISHED
Vendor
MongoDB
Product
MongoDB
Provider severity
HIGH, MEDIUM
Conflicts
1

CVE-2026-9753

The $_internalApplyOplogUpdate aggregation pipeline stage can be used to execute a document diff containing a malformed binary diff to return memory out-of-bounds or crash the server. $_internalApplyOplogUpdate can be executed by any authenticated user with access to the aggregate command.

PUBLISHED
Vendor
MongoDB
Product
MongoDB Server
Provider severity
HIGH
Conflicts
1

CVE-2026-9752

An authorized user could trigger a server crash by running a query with a 2dsphere index on a field that stores a GeoJSON GeometryCollection containing a Polygon with a strict-winding CRS. Strict-winding polygons are intentionally unsupported for indexing, but the guard that rejects them does not inspect members of a GeometryCollection, allowing the unsafe path to be reached which ends with an ensuing null-pointer dereference.

PUBLISHED
Vendor
MongoDB
Product
MongoDB Server
Provider severity
HIGH, MEDIUM
Conflicts
1

CVE-2026-9751

The ldapQueryPassword parameter, when set through the runtime setParameter command, will log the new password to the mongod.log file in plain text.

PUBLISHED
Vendor
MongoDB
Product
MongoDB Server
Provider severity
MEDIUM
Conflicts
1

CVE-2026-9750

An authenticated user can cause a MongoDB server to crash or return incorrect results by creating documents that interfere with internal metadata processing during query execution. This stems from insufficient separation between user-controlled document fields and internal metadata in certain execution paths.

PUBLISHED
Vendor
MongoDB
Product
MongoDB Server
Provider severity
HIGH, MEDIUM
Conflicts
1

CVE-2026-9749

This issue can occur when running an aggregation pipeline that uses the internal $exchange stage configured with key-range partitioning and order-preserving delivery. If a single key range produces enough documents to fill its exchange buffer (that is, many results are routed to the same consumer), the server reaches the code path where a full per-consumer buffer is detected but the internal "high watermark" for that key range is not updated as intended.

PUBLISHED
Vendor
MongoDB
Product
MongoDB Server
Provider severity
HIGH, MEDIUM
Conflicts
1