CVE Explorer

Exact snapshot results

353,537 CVE records

CVE ID descending · no relevance ranking

CVE-2026-30496

The Optoma CinemaX P2 projector (firmware TVOS-04.24.010.04.01, Android 8.0.0) exposes an HTTP API on TCP port 2345 that allows full unauthenticated remote control of the device. The API supports both reading configuration (74 endpoints) and writing/modifying settings including volume, mute, brightness, power, network protocols enable/disable (including TELNET), display modes, and other projector functions. Any device on the same network can control the projector without authentication.

PUBLISHED

Vendor: n/a
Product: n/a
Provider severity: CRITICAL
Conflicts: 1

CVE-2026-30495

The Optoma CinemaX P2 projector (firmware TVOS-04.24.010.04.01, Android 8.0.0) exposes Android Debug Bridge (ADB) on TCP port 5555 over the network without requiring authentication. The device is configured with ro.adb.secure=0, which disables RSA key verification. Additionally, a functional su binary exists at /system/xbin/su that grants root privileges without authentication. An attacker on the same network can connect to the device via ADB, obtain a shell, and escalate to root privileges, gai

PUBLISHED

Vendor: n/a
Product: n/a
Provider severity: HIGH
Conflicts: 1

CVE-2026-3049

A vulnerability was detected in horilla-opensource horilla up to 1.0.2. This issue affects the function get of the file horilla_generics/global_search.py of the component Query Parameter Handler. The manipulation of the argument prev_url results in open redirect. The attack can be executed remotely. The exploit is now public and may be used. Upgrading to version 1.0.3 is capable of addressing this issue. The patch is identified as 730b5a44ff060916780c44a4bdbc8ced70a2cd27. The affected component

PUBLISHED

Vendor: horilla-opensource
Product: horilla
Provider severity: MEDIUM
Conflicts: 1

CVE-2026-30480

A Local File Inclusion (LFI) vulnerability in the NFSen module (nfsen.inc.php) of LibreNMS 22.11.0-23-gd091788f2 allows authenticated attackers to include arbitrary PHP files from the server filesystem via path traversal sequences in the nfsen parameter.

PUBLISHED

Vendor: n/a
Product: n/a
Provider severity: MEDIUM
Conflicts: 1

CVE-2026-3048

An authenticated administrator who configures or tests LDAP connectivity in Sonatype Nexus Repository Manager versions 3.0.0 through 3.91.1 may be able to initiate unintended server-side connections when interacting with a malicious LDAP server.

PUBLISHED

Vendor: Sonatype
Product: Nexus Repository
Provider severity: MEDIUM
Conflicts: 1

CVE-2026-30479

A Dynamic-link Library Injection vulnerability in OSGeo Project MapServer before v8.0 allows attackers to execute arbitrary code via a crafted executable.

PUBLISHED

Vendor: n/a
Product: n/a
Provider severity: CRITICAL
Conflicts: 1

CVE-2026-30478

A Dynamic-link Library Injection vulnerability in GatewayGeo MapServer for Windows version 5 allows attackers to escalate privileges via a crafted executable.

PUBLISHED

Vendor: n/a
Product: n/a
Provider severity: HIGH
Conflicts: 1

CVE-2026-3047

A flaw was found in org.keycloak.broker.saml. When a disabled Security Assertion Markup Language (SAML) client is configured as an Identity Provider (IdP)-initiated broker landing target, it can still complete the login process and establish a Single Sign-On (SSO) session. This allows a remote attacker to gain unauthorized access to other enabled clients without re-authentication, effectively bypassing security restrictions.

PUBLISHED

Vendor: Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat
Product: Red Hat build of Keycloak 26.2, Red Hat build of Keycloak 26.2, Red Hat build of Keycloak 26.4, Red Hat build of Keycloak 26.4.10, Red Hat build of Keycloak 26.2.14, Red Hat build of Keycloak 26.2.14, Red Hat build of Keycloak 26.2, Red Hat build of Keycloak 26.4, Red Hat build of Keycloak 26.2, Red Hat build of Keycloak 26.4, Red Hat build of Keycloak 26.4, Red Hat build of Keycloak 26.2, Red Hat build of Keycloak 26.4, Red Hat build of Keycloak 26.4.10, Red Hat build of Keycloak 26.2, Red Hat build of Keycloak 26.4
Provider severity: HIGH
Conflicts: 1

CVE-2026-30463

Daylight Studio FuelCMS v1.5.2 was discovered to contain a SQL injection vulnerability via the /controllers/Login.php component.

PUBLISHED

Vendor: n/a
Product: n/a
Provider severity: HIGH
Conflicts: 1

CVE-2026-30462

A path traversal vulnerability in the Blocks module of Daylight Studio FuelCMS v1.5.2 allows attackers to execute a directory traversal.

PUBLISHED

Vendor: n/a
Product: n/a
Provider severity: MEDIUM
Conflicts: 1

CVE-2026-30461

Daylight Studio FuelCMS v1.5.2 was discovered to contain an authenticated remote code execution (RCE) vulnerability via the /controllers/Installer.php and the function add_git_submodule.

PUBLISHED

Vendor: n/a
Product: n/a
Provider severity: HIGH
Conflicts: 1

CVE-2026-30460

Daylight Studio FuelCMS v1.5.2 was discovered to contain an authenticated remote code execution (RCE) vulnerability in the Blocks module.

PUBLISHED

Vendor: n/a
Product: n/a
Provider severity: HIGH
Conflicts: 1

CVE-2026-3046

A security vulnerability has been detected in itsourcecode E-Logbook with Health Monitoring System for COVID-19 1.0. This vulnerability affects unknown code of the file /check_profile_old.php. The manipulation of the argument profile_id leads to sql injection. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used.

PUBLISHED

Vendor: itsourcecode
Product: E-Logbook with Health Monitoring System for COVID-19
Provider severity: HIGH, MEDIUM
Conflicts: 2

CVE-2026-30459

An issue in the Forgot Password feature of Daylight Studio FuelCMS v1.5.2 allows unauthenticated attackers to obtain the password reset token of a victim user via a crafted link placed in a valid e-mail message.

PUBLISHED

Vendor: n/a
Product: n/a
Provider severity: HIGH
Conflicts: 1

CVE-2026-30458

An issue in Daylight Studio FuelCMS v1.5.2 allows attackers to exfiltrate users' password reset tokens via a mail splitting attack.

PUBLISHED

Vendor: n/a
Product: n/a
Provider severity: CRITICAL
Conflicts: 1

CVE-2026-30457

An issue in the /parser/dwoo component of Daylight Studio FuelCMS v1.5.2 allows attackers to execute arbitrary code via crafted PHP code.

PUBLISHED

Vendor: n/a
Product: n/a
Provider severity: CRITICAL
Conflicts: 1

CVE-2026-30452

Textpattern CMS 4.9.0 contains a Broken Access Control vulnerability in the article management system that allows authenticated users with low privileges to modify articles owned by users with higher privileges. By manipulating the article ID parameter during the duplicate-and-save workflow in textpattern/include/txp_article.php, an attacker can bypass authorization checks and overwrite content belonging to other users.

PUBLISHED

Vendor: n/a
Product: n/a
Provider severity: MEDIUM
Conflicts: 1

CVE-2026-3045

The Appointment Booking Calendar — Simply Schedule Appointments plugin for WordPress is vulnerable to unauthorized access of sensitive data in all versions up to and including 1.6.9.29. This is due to two compounding weaknesses: (1) a non-user-bound `public_nonce` is exposed to unauthenticated users through the public `/wp-json/ssa/v1/embed-inner` REST endpoint, and (2) the `get_item()` method in `SSA_Settings_Api` relies on `nonce_permissions_check()` for authorization (which accepts the public

PUBLISHED

Vendor: croixhaug
Product: Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin
Provider severity: HIGH
Conflicts: 0

CVE-2026-3044

A vulnerability has been found in Tenda AC8 16.03.34.06. This affects the function webCgiGetUploadFile of the file /cgi-bin/UploadCfg of the component Httpd Service. The manipulation of the argument boundary leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.

PUBLISHED

Vendor: Tenda
Product: AC8
Provider severity: HIGH
Conflicts: 2

CVE-2026-3043

A flaw has been found in itsourcecode Event Management System 1.0. The impacted element is an unknown function of the file /admin/navbar.php. Executing a manipulation of the argument page can lead to cross site scripting. The attack may be performed from remote. The exploit has been published and may be used.

PUBLISHED

Vendor: itsourcecode
Product: Event Management System
Provider severity: MEDIUM
Conflicts: 2

CVE-2026-3042

A vulnerability was detected in itsourcecode Event Management System 1.0. The affected element is an unknown function of the file /admin/index.php. Performing a manipulation of the argument ID results in sql injection. The attack is possible to be carried out remotely. The exploit is now public and may be used.

PUBLISHED

Vendor: itsourcecode
Product: Event Management System
Provider severity: HIGH, MEDIUM
Conflicts: 2

CVE-2026-3041

A security vulnerability has been detected in xingfuggz BaykeShop up to 1.3.20. Impacted is an unknown function of the file src/baykeshop/contrib/article/templates/baykeshop/sidebar/custom.html of the component Article Sidebar Module. Such manipulation of the argument sidebar.content leads to cross site scripting. The attack can be executed remotely. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responde

PUBLISHED

Vendor: xingfuggz
Product: BaykeShop
Provider severity: LOW, MEDIUM
Conflicts: 2

CVE-2026-30405

An issue in GoBGP gobgpd v.4.2.0 allows a remote attacker to cause a denial of service via the NEXT_HOP path attribute

PUBLISHED

Vendor: n/a
Product: n/a
Provider severity: HIGH
Conflicts: 1

CVE-2026-30404

The backend database management connection test feature in wgcloud v3.6.3 has a server-side request forgery (SSRF) vulnerability. This issue can be exploited to make the server send requests to probe the internal network, remotely download malicious files, and perform other dangerous operations.

PUBLISHED

Vendor: n/a
Product: n/a
Provider severity: HIGH
Conflicts: 1

CVE-2026-30403

There is an arbitrary file read vulnerability in the test connection function of backend database management in wgcloud v3.6.3 and before, which can be used to read any file on the victim's server.

PUBLISHED

Vendor: n/a
Product: n/a
Provider severity: HIGH
Conflicts: 1

CVE-2026-30402

An issue in wgcloud v.2.3.7 and before allows a remote attacker to execute arbitrary code via the test connection function

PUBLISHED

Vendor: n/a
Product: n/a
Provider severity: CRITICAL
Conflicts: 1

CVE-2026-3040

A vulnerability was identified in DrayTek Vigor 300B up to 1.5.1.6. This affects the function cgiGetFile of the file /cgi-bin/mainfunction.cgi/uploadlangs of the component Web Management Interface. The manipulation of the argument File leads to os command injection. The attack may be initiated remotely. The exploit is publicly available and might be used. The vendor confirms that "300B is EoL, and this is an authenticated vulnerability. We don't plan to fix it." This vulnerability only affects p

PUBLISHED

Vendor: DrayTek
Product: Vigor 300B
Provider severity: MEDIUM
Conflicts: 2

CVE-2026-3039

BIND servers that are configured to use TKEY-based authentication via GSS-API tokens are vulnerable to excessive memory consumption when receiving and processing maliciously-constructed packets. Typically these servers will be found in Active Directory integrated DNS deployments and/or Kerberos-secured DNS environments. This issue affects BIND 9 versions 9.0.0 through 9.16.50, 9.18.0 through 9.18.48, 9.20.0 through 9.20.22, 9.21.0 through 9.21.21, 9.9.3-S1 through 9.16.50-S1, 9.18.11-S1 through

PUBLISHED

Vendor: Red Hat, ISC, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat
Product: Red Hat Enterprise Linux 9, BIND 9, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 8, Red Hat OpenShift Container Platform 4, Red Hat Enterprise Linux 10, Red Hat Hardened Images
Provider severity: HIGH
Conflicts: 2

CVE-2026-3038

The rtsock_msg_buffer() function serializes routing information into a buffer. As a part of this, it copies sockaddr structures into a sockaddr_storage structure on the stack. It assumes that the source sockaddr length field had already been validated, but this is not necessarily the case, and it's possible for a malicious userspace program to craft a request which triggers a 127-byte overflow. In practice, this overflow immediately overwrites the canary for the rtsock_msg_buffer() stack fra

PUBLISHED

Vendor: FreeBSD
Product: FreeBSD
Provider severity: HIGH
Conflicts: 0

CVE-2026-3037

An OS command injection vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an authenticated attacker to achieve remote code execution on the system by modifying malicious input injected into the MBird SMS service URL and/or code via the utility route which is later processed during system setup, leading to remote code execution.

PUBLISHED

Vendor: Copeland, Copeland, Copeland
Product: Copeland XWEB 300D PRO, Copeland XWEB 500B PRO, Copeland XWEB 500D PRO
Provider severity: HIGH
Conflicts: 1

CVE-2026-30368

A client-side authorization flaw in Lightspeed Classroom v5.1.2.1763770643 allows unauthenticated attackers to impersonate users by bypassing integrity checks and abusing client-generated authorization tokens, leading to unauthorized control and monitoring of student devices.

PUBLISHED

Vendor: Lightspeed
Product: Lightspeed Classroom
Provider severity: MEDIUM
Conflicts: 0

CVE-2026-30364

CentSDR commit e40795 was discovered to contain a stack overflow in the "Thread1" function.

PUBLISHED

Vendor: n/a
Product: n/a
Provider severity: HIGH
Conflicts: 1

CVE-2026-30363

flipperzero-firmware commit ad2a80 was discovered to contain a stack overflow in the "Main" function.

PUBLISHED

Vendor: n/a
Product: n/a
Provider severity: HIGH
Conflicts: 1

CVE-2026-30352

A remote code execution (RCE) vulnerability in the /devserver/start endpoint of leonvanzyl autocoder commit 79d02a allows attackers to execute arbitrary code via providing a crafted command parameter.

PUBLISHED

Vendor: n/a
Product: n/a
Provider severity: CRITICAL
Conflicts: 1

CVE-2026-30351

A path traversal vulnerability in the UI/static component of leonvanzyl autocoder commit 79d02a allows attackers to read arbitrary files via sending crafted URL path containing traversal sequences.

PUBLISHED

Vendor: n/a
Product: n/a
Provider severity: HIGH
Conflicts: 1

CVE-2026-30350

An issue in the /store/items/search endpoint of Agent Protocol server commit e9a89f allows attackers to cause a Denial of Service (DoS) via a crafted POST request.

PUBLISHED

Vendor: n/a
Product: n/a
Provider severity: HIGH
Conflicts: 1

CVE-2026-30346

An open redirect in the /api/google/authorize endpoint of hunvreus DevPush v0.3.2 allows attackers to redirect users to malicious sites via supplying a crafted URL.

PUBLISHED

Vendor: n/a
Product: n/a
Provider severity: MEDIUM
Conflicts: 1

CVE-2026-30345

A zip slip vulnerability in the Admin import functionality of CTFd v3.8.1-18-gdb5a18c4 allows attackers to write arbitrary files outside the intended directories via supplying a crafted import.

PUBLISHED

Vendor: n/a
Product: n/a
Provider severity: HIGH
Conflicts: 1

CVE-2026-3034

The OoohBoi Steroids for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the _ob_spacerat_link, _ob_bbad_link, and _ob_teleporter_link URL parameters in all versions up to, and including, 2.1.24. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user clicks on the injected element.

PUBLISHED

Vendor: sagarpatel124
Product: OoohBoi Steroids for Elementor
Provider severity: MEDIUM
Conflicts: 0

CVE-2026-30332

A Time-of-Check to Time-of-Use (TOCTOU) race condition vulnerability in Balena Etcher for Windows prior to v2.1.4 allows attackers to escalate privileges and execute arbitrary code via replacing a legitimate script with a crafted payload during the flashing process.

PUBLISHED

Vendor: n/a
Product: n/a
Provider severity: HIGH
Conflicts: 1

CVE-2026-30314

Ridvay Code's command auto-approval module contains a critical OS command injection vulnerability that renders its whitelist security mechanism completely ineffective. The system relies on fragile regular expressions to parse command structures; while it attempts to intercept dangerous operations, it fails to account for standard Shell command substitution Ridvay Code (specifically$(...)and backticks ...). An attacker can construct a command such as git log --grep="$(malicious_command)", forcing

PUBLISHED

Vendor: n/a
Product: n/a
Provider severity: CRITICAL
Conflicts: 1

CVE-2026-30313

DSAI-Cline's command auto-approval module contains a critical OS command injection vulnerability that renders its whitelist security mechanism completely ineffective. The system relies on string-based parsing to validate commands; while it intercepts dangerous operators such as ;, &&, ||, |, and command substitution patterns, it fails to account for raw newline characters embedded within the input. An attacker can construct a payload by embedding a literal newline between a whitelisted command a

PUBLISHED

Vendor: n/a
Product: n/a
Provider severity: CRITICAL
Conflicts: 1

CVE-2026-30312

PUBLISHED

Vendor: n/a
Product: n/a
Provider severity: CRITICAL
Conflicts: 1

CVE-2026-30311

PUBLISHED

Vendor: n/a
Product: n/a
Provider severity: CRITICAL
Conflicts: 1

CVE-2026-30310

In its design for automatic terminal command execution, Sixth offers two options: Execute safe commands and Execute all commands. The description for the former states that commands determined by the model to be safe will be automatically executed, whereas if the model judges a command to be potentially destructive, it still requires user approval. However, this design is highly susceptible to prompt injection attacks. An attacker can employ a generic template to wrap any malicious command and m

PUBLISHED

Vendor: n/a
Product: n/a
Provider severity: CRITICAL
Conflicts: 1

CVE-2026-3031

Image::EPEG versions through 0.15 for Perl embeds an unsupported version of the Epeg library. Image::EPEG includes Epeg 0.9.0 that was last updated in 2004. Epeg is a fast JPEG thumbnail library that was once part of the Englightenment Project.

PUBLISHED

Vendor: TOKUHIROM
Product: Image::EPEG
Provider severity: CRITICAL
Conflicts: 0

CVE-2026-30309

InfCode's terminal auto-execution module contains a critical command filtering vulnerability that renders its blacklist security mechanism completely ineffective. The predefined blocklist fails to cover native high-risk commands in Windows PowerShell (such as powershell), and the matching algorithm lacks dynamic semantic parsing unable to recognize string concatenation, variable assignment, or double-quote interpolation in Shell syntax. Malicious commands can bypass interception through simple s

PUBLISHED

Vendor: n/a
Product: n/a
Provider severity: HIGH
Conflicts: 1

CVE-2026-30308

In its design for automatic terminal command execution, HAI Build Code Generator offers two options: Execute safe commands and Execute all commands. The description for the former states that commands determined by the model to be safe will be automatically executed, whereas if the model judges a command to be potentially destructive, it still requires user approval. However, this design is highly susceptible to prompt injection attacks. An attacker can employ a generic template to wrap any mali

PUBLISHED

Vendor: n/a
Product: n/a
Provider severity: CRITICAL
Conflicts: 1

CVE-2026-30307

Roo Code's command auto-approval module contains a critical OS command injection vulnerability that renders its whitelist security mechanism completely ineffective. The system relies on fragile regular expressions to parse command structures; while it attempts to intercept dangerous operations, it fails to account for standard Shell command substitution Roo Code (specifically$(...)and backticks ...). An attacker can construct a command such as git log --grep="$(malicious_command)", forcing Syntx

PUBLISHED

Vendor: n/a
Product: n/a
Provider severity: CRITICAL
Conflicts: 1

CVE-2026-30306

In its design for automatic terminal command execution, SakaDev offers two options: Execute safe commands and execute all commands. The description for the former states that commands determined by the model to be safe will be automatically executed, whereas if the model judges a command to be potentially destructive, it still requires user approval. However, this design is highly susceptible to prompt injection attacks. An attacker can employ a generic template to wrap any malicious command and

PUBLISHED

Vendor: n/a
Product: n/a
Provider severity: CRITICAL
Conflicts: 1