CVE-2026-28699
Gitea versions up to and including 1.26.1 allow OAuth2 access token scope enforcement to be bypassed through HTTP Basic authentication.
PUBLISHED
- Vendor
- Gitea
- Product
- Gitea Open Source Git Server
- Provider severity
- HIGH
- Conflicts
- 1
Data & Insights
CVE Explorer
Search one exact, source-linked CVE snapshot by CVE ID or explicit vendor and product tokens. Provider severity, KEV, conflicts, and stale state remain separate observations—not a Baitaphish risk rating.
Exact snapshot results
353,537 CVE records
CVE-2026-28698
Pronetiqs IntraVUE versions 3.2.1a14 and prior have an exposure of sensitive system information to an unauthorized control sphere vulnerability which could expose the underlying host/share filesystem.
PUBLISHED
- Vendor
- Pronetiqs
- Product
- Panduit Intravue
- Provider severity
- CRITICAL, HIGH
- Conflicts
- 1
CVE-2026-28697
Craft is a content management system (CMS). Prior to 4.17.0-beta.1 and 5.9.0-beta.1, an authenticated administrator can achieve Remote Code Execution (RCE) by injecting a Server-Side Template Injection (SSTI) payload into Twig template fields (e.g., Email Templates). By calling the craft.app.fs.write() method, an attacker can write a malicious PHP script to a web-accessible directory and subsequently access it via the browser to execute arbitrary system commands. This vulnerability is fixed in 4
PUBLISHED
- Vendor
- craftcms
- Product
- cms
- Provider severity
- CRITICAL
- Conflicts
- 0
CVE-2026-28696
Craft is a content management system (CMS). Prior to 4.17.0-beta.1 and 5.9.0-beta.1, the GraphQL directive @parseRefs, intended to parse internal reference tags (e.g., {user:1:email}), can be abused by both authenticated users and unauthenticated guests (if a Public Schema is enabled) to access sensitive attributes of any element in the CMS. The implementation in Elements::parseRefs fails to perform authorization checks, allowing attackers to read data they are not authorized to view. This vulne
PUBLISHED
- Vendor
- craftcms
- Product
- cms
- Provider severity
- HIGH
- Conflicts
- 0
CVE-2026-28695
Craft is a content management system (CMS). There is an authenticated admin RCE in Craft CMS 5.8.21 via Server-Side Template Injection using the create() Twig function combined with a Symfony Process gadget chain. The create() Twig function exposes Craft::createObject(), which allows instantiation of arbitrary PHP classes with constructor arguments. Combined with the bundled symfony/process dependency, this enables RCE. This bypasses the fix implemented for CVE-2025-57811 (patched in 5.8.7). Thi
PUBLISHED
- Vendor
- craftcms
- Product
- cms
- Provider severity
- HIGH
- Conflicts
- 0
CVE-2026-28693
A flaw was found in ImageMagick, a free and open-source software used for editing and manipulating digital images. An integer overflow vulnerability in the DIB (Device Independent Bitmap) coder component can be exploited by a remote attacker. By processing a specially crafted image file, this flaw may lead to an out-of-bounds read or write, potentially resulting in arbitrary code execution, privilege escalation, information disclosure, or a Denial of Service (DoS).
PUBLISHED
- Vendor
- Red Hat, Red Hat, ImageMagick
- Product
- Red Hat Enterprise Linux 7 Extended Lifecycle Support, Red Hat Enterprise Linux 6, ImageMagick
- Provider severity
- HIGH
- Conflicts
- 2
CVE-2026-28692
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-16 and 6.9.13-41, MAT decoder uses 32-bit arithmetic due to incorrect parenthesization resulting in a heap over-read. This vulnerability is fixed in 7.1.2-16 and 6.9.13-41.
PUBLISHED
- Vendor
- ImageMagick
- Product
- ImageMagick
- Provider severity
- MEDIUM
- Conflicts
- 0
CVE-2026-28691
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-16 and 6.9.13-41, an uninitialized pointer dereference vulnerability exists in the JBIG decoder due to a missing check. This vulnerability is fixed in 7.1.2-16 and 6.9.13-41.
PUBLISHED
- Vendor
- Red Hat, ImageMagick, Red Hat
- Product
- Red Hat Enterprise Linux 6, ImageMagick, Red Hat Enterprise Linux 7 Extended Lifecycle Support
- Provider severity
- HIGH
- Conflicts
- 2
CVE-2026-28690
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-16 and 6.9.13-41, a stack buffer overflow vulnerability exists in the MNG encoder. There is a bounds checks missing that could corrupting the stack with attacker-controlled data. This vulnerability is fixed in 7.1.2-16 and 6.9.13-41.
PUBLISHED
- Vendor
- ImageMagick
- Product
- ImageMagick
- Provider severity
- MEDIUM
- Conflicts
- 0
CVE-2026-2869
A vulnerability was identified in janet-lang janet up to 1.40.1. Affected by this vulnerability is the function janetc_varset of the file src/core/specials.c of the component handleattr Handler. The manipulation leads to out-of-bounds read. The attack can only be performed from a local environment. The exploit is publicly available and might be used. Upgrading to version 1.41.0 addresses this issue. The identifier of the patch is 2fabc80151a2b8834ee59cda8a70453f848b40e5. The affected component s
PUBLISHED
- Vendor
- janet-lang
- Product
- janet
- Provider severity
- LOW, MEDIUM
- Conflicts
- 2
CVE-2026-28689
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-16 and 6.9.13-41, domain="path" authorization is checked before final file open/use. A symlink swap between check-time and use-time bypasses policy-denied read/write. This vulnerability is fixed in 7.1.2-16 and 6.9.13-41.
PUBLISHED
- Vendor
- ImageMagick
- Product
- ImageMagick
- Provider severity
- MEDIUM
- Conflicts
- 1
CVE-2026-28688
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-16 and 6.9.13-41, a heap-use-after-free vulnerability exists in the MSL encoder, where a cloned image is destroyed twice. The MSL coder does not support writing MSL so the write capability has been removed. This vulnerability is fixed in 7.1.2-16 and 6.9.13-41.
PUBLISHED
- Vendor
- ImageMagick
- Product
- ImageMagick
- Provider severity
- MEDIUM
- Conflicts
- 0
CVE-2026-28687
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-16 and 6.9.13-41, a heap use-after-free vulnerability in ImageMagick's MSL decoder allows an attacker to trigger access to freed memory by crafting an MSL file. This vulnerability is fixed in 7.1.2-16 and 6.9.13-41.
PUBLISHED
- Vendor
- ImageMagick
- Product
- ImageMagick
- Provider severity
- MEDIUM
- Conflicts
- 0
CVE-2026-28686
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-16 and 6.9.13-41, A heap-buffer-overflow vulnerability exists in the PCL encode due to an undersized output buffer allocation. This vulnerability is fixed in 7.1.2-16 and 6.9.13-41.
PUBLISHED
- Vendor
- ImageMagick
- Product
- ImageMagick
- Provider severity
- MEDIUM
- Conflicts
- 1
CVE-2026-28685
Kimai is a web-based multi-user time-tracking application. Prior to version 2.51.0, "GET /api/invoices/{id}" only checks the role-based view_invoice permission but does not verify the requesting user has access to the invoice's customer. Any user with ROLE_TEAMLEAD (which grants view_invoice) can read all invoices in the system, including those belonging to customers assigned to other teams. This issue has been patched in version 2.51.0.
PUBLISHED
- Vendor
- kimai
- Product
- kimai
- Provider severity
- MEDIUM
- Conflicts
- 0
CVE-2026-28684
python-dotenv reads key-value pairs from a .env file and can set them as environment variables. Prior to version 1.2.2, `set_key()` and `unset_key()` in python-dotenv follow symbolic links when rewriting `.env` files, allowing a local attacker to overwrite arbitrary files via a crafted symlink when a cross-device rename fallback is triggered. Users should upgrade to v.1.2.2 or, as a workaround, apply the patch manually.
PUBLISHED
- Vendor
- theskumar
- Product
- python-dotenv
- Provider severity
- MEDIUM
- Conflicts
- 1
CVE-2026-28683
Gokapi is a self-hosted file sharing server with automatic expiration and encryption support. Prior to version 2.2.3, if a malicious authenticated user uploads SVG and creates a hotlink for it, they can achieve stored XSS. This issue has been patched in version 2.2.3.
PUBLISHED
- Vendor
- Forceu
- Product
- Gokapi
- Provider severity
- HIGH
- Conflicts
- 0
CVE-2026-28682
Gokapi is a self-hosted file sharing server with automatic expiration and encryption support. Prior to version 2.2.3, the upload status SSE implementation on /uploadStatus publishes global upload state to any authenticated listener and includes file_id values that are not scoped to the requesting user. This issue has been patched in version 2.2.3.
PUBLISHED
- Vendor
- Forceu
- Product
- Gokapi
- Provider severity
- MEDIUM
- Conflicts
- 1
CVE-2026-28681
Internet Routing Registry daemon version 4 is an IRR database server, processing IRR objects in the RPSL format. From version 4.4.0 to before version 4.4.5 and from version 4.5.0 to before version 4.5.1, an attacker can manipulate the HTTP Host header on a password reset or account creation request. The confirmation link in the resulting email can then point to an attacker-controlled domain. Opening the link in the email is sufficient to pass the token to the attacker, who can then use it on the
PUBLISHED
- Vendor
- irrdnet
- Product
- irrd
- Provider severity
- HIGH
- Conflicts
- 1
CVE-2026-28680
Ghostfolio is an open source wealth management software. Prior to version 2.245.0, an attacker can exploit the manual asset import feature to perform a full-read SSRF, allowing them to exfiltrate sensitive cloud metadata (IMDS) or probe internal network services. This issue has been patched in version 2.245.0.
PUBLISHED
- Vendor
- ghostfolio
- Product
- ghostfolio
- Provider severity
- CRITICAL
- Conflicts
- 0
CVE-2026-2868
The Gutenverse – Ultimate WordPress FSE Blocks Addons & Ecosystem plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'separatorIconSVG' parameter in versions up to, and including, 3.5.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PUBLISHED
- Vendor
- jegstudio
- Product
- Gutenverse – Ultimate WordPress FSE Blocks Addons & Ecosystem
- Provider severity
- MEDIUM
- Conflicts
- 0
CVE-2026-28679
Home-Gallery.org is a self-hosted open-source web gallery to browse personal photos and videos. Prior to version 1.21.0, when a user requests a download, the application does not verify whether the requested file is located within the media source directory, which can result in sensitive system files being downloadable as well. This issue has been patched in version 1.21.0.
PUBLISHED
- Vendor
- xemle
- Product
- home-gallery
- Provider severity
- HIGH
- Conflicts
- 0
CVE-2026-28677
OpenSift is an AI study tool that sifts through large datasets using semantic search and generative AI. Prior to version 1.6.3-alpha, the URL ingest pipeline accepted user-controlled remote URLs with incomplete destination restrictions. Although private/local host checks existed, missing restrictions for credentialed URLs, non-standard ports, and cross-host redirects left SSRF-class abuse paths in non-localhost deployments. This issue has been patched in version 1.6.3-alpha.
PUBLISHED
- Vendor
- OpenSift
- Product
- OpenSift
- Provider severity
- HIGH
- Conflicts
- 0
CVE-2026-28676
OpenSift is an AI study tool that sifts through large datasets using semantic search and generative AI. Prior to version 1.6.3-alpha, multiple storage helpers used path construction patterns that did not uniformly enforce base-directory containment. This created path-injection risk in file read/write/delete flows if malicious path-like values were introduced. This issue has been patched in version 1.6.3-alpha.
PUBLISHED
- Vendor
- OpenSift
- Product
- OpenSift
- Provider severity
- HIGH
- Conflicts
- 0
CVE-2026-28675
OpenSift is an AI study tool that sifts through large datasets using semantic search and generative AI. Prior to version 1.6.3-alpha, some endpoints returned raw exception strings to clients. Additionally, login token material was exposed in UI/rendered responses and token rotation output. This issue has been patched in version 1.6.3-alpha.
PUBLISHED
- Vendor
- OpenSift
- Product
- OpenSift
- Provider severity
- MEDIUM
- Conflicts
- 1
CVE-2026-28674
xiaoheiFS is a self-hosted financial and operational system for cloud service businesses. In versions up to and including 0.3.15, the `AdminPaymentPluginUpload` endpoint lets admins upload any file to `plugins/payment/`. It only checks a hardcoded password (`qweasd123456`) and ignores file content. A background watcher (`StartWatcher`) then scans this folder every 5 seconds. If it finds a new executable, it runs it immediately, resulting in RCE. Version 4.0.0 fixes the issue.
PUBLISHED
- Vendor
- danvei233
- Product
- xiaoheiFS
- Provider severity
- HIGH
- Conflicts
- 1
CVE-2026-28673
xiaoheiFS is a self-hosted financial and operational system for cloud service businesses. In versions up to and including 0.3.15, the standard plugin system allows admins to upload a ZIP file containing a binary and a `manifest.json`. The server trusts the `binaries` field in the manifest and executes the specified file without any validation of its contents or behavior, leading to Remote Code Execution (RCE). Version 0.4.0 fixes the issue.
PUBLISHED
- Vendor
- danvei233
- Product
- xiaoheiFS
- Provider severity
- HIGH
- Conflicts
- 1
CVE-2026-2867
A vulnerability was determined in itsourcecode Vehicle Management System 1.0. Affected is an unknown function of the file /billaction.php. Executing a manipulation of the argument ID can lead to sql injection. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized.
PUBLISHED
- Vendor
- itsourcecode
- Product
- Vehicle Management System
- Provider severity
- HIGH, MEDIUM
- Conflicts
- 2
CVE-2026-2865
A vulnerability was found in itsourcecode Agri-Trading Online Shopping System 1.0. This impacts an unknown function of the file admin/productcontroller.php of the component HTTP POST Request Handler. Performing a manipulation of the argument Product results in sql injection. The attack may be initiated remotely. The exploit has been made public and could be used.
PUBLISHED
- Vendor
- itsourcecode
- Product
- Agri-Trading Online Shopping System
- Provider severity
- HIGH, MEDIUM
- Conflicts
- 2
CVE-2026-2864
A vulnerability has been found in feng_ha_ha/megagao ssm-erp and production_ssm up to 4288d53bd35757b27f2d070057aefb2c07bdd097. This affects the function pictureDelete of the file PictureController.java. Such manipulation of the argument picName leads to path traversal. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. This product
PUBLISHED
- Vendor
- megagao, feng_ha_ha, megagao, feng_ha_ha
- Product
- production_ssm, production_ssm, ssm-erp, ssm-erp
- Provider severity
- MEDIUM
- Conflicts
- 2
CVE-2026-2863
A flaw has been found in feng_ha_ha/megagao ssm-erp and production_ssm up to 4288d53bd35757b27f2d070057aefb2c07bdd097. The impacted element is the function deleteFile of the file FileServiceImpl.java. This manipulation causes path traversal. The attack can be initiated remotely. The exploit has been published and may be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. This product is distributed
PUBLISHED
- Vendor
- megagao, feng_ha_ha, megagao, feng_ha_ha
- Product
- production_ssm, production_ssm, ssm-erp, ssm-erp
- Provider severity
- MEDIUM
- Conflicts
- 2
CVE-2026-2862
IBM Verify Identity Access Container 11.0 through 11.0.2 and IBM Security Verify Access Container 10.0 through 10.0.9.1 and IBM Verify Identity Access 11.0 through 11.0.2 and IBM Security Verify Access 10.0 through 10.0.9.1 IBM Security Verify could allow a remote attacker to access sensitive information due to an inconsistent interpretation of an HTTP request by a reverse proxy.
PUBLISHED
- Vendor
- IBM, IBM, IBM, IBM
- Product
- Verify Identity Access, Security Verify Access, Verify Identity Access Container, Security Verify Access Container
- Provider severity
- MEDIUM
- Conflicts
- 1
CVE-2026-28615
In Telecomm, there is a possible way to initiate an unauthorized phone call due to a permissions bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
PUBLISHED
- Vendor
- Product
- Android
- Provider severity
- CRITICAL
- Conflicts
- 1
CVE-2026-2861
A vulnerability was detected in Foswiki up to 2.1.10. The affected element is an unknown function of the component Changes/Viewfile/Oops. The manipulation results in information disclosure. It is possible to launch the attack remotely. The exploit is now public and may be used. Upgrading to version 2.1.11 is sufficient to fix this issue. The patch is identified as 31aeecb58b64/d8ed86b10e46. Upgrading the affected component is recommended.
PUBLISHED
- Vendor
- n/a
- Product
- Foswiki
- Provider severity
- MEDIUM
- Conflicts
- 2
CVE-2026-2860
A security vulnerability has been detected in feng_ha_ha/megagao ssm-erp and production_ssm up to 4288d53bd35757b27f2d070057aefb2c07bdd097. Impacted is an unknown function of the file EmployeeController.java. The manipulation leads to improper authorization. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases
PUBLISHED
- Vendor
- megagao, feng_ha_ha, feng_ha_ha, megagao
- Product
- ssm-erp, ssm-erp, production_ssm, production_ssm
- Provider severity
- MEDIUM
- Conflicts
- 3
CVE-2026-2859
Improper permission enforcement in Checkmk versions 2.4.0 before 2.4.0p23, 2.3.0 before 2.3.0p43, and 2.2.0 (EOL) allows unauthenticated users to enumerate existing hosts by observing different HTTP response codes in deploy_agent endpoint, which could lead to information disclosure.
PUBLISHED
- Vendor
- Checkmk GmbH
- Product
- Checkmk
- Provider severity
- MEDIUM
- Conflicts
- 0
CVE-2026-28587
In MmsSmsProvider of MmsSmsProvider.java, there is a possible way to retrieve sensitive information due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
PUBLISHED
- Vendor
- Product
- Android
- Provider severity
- CRITICAL
- Conflicts
- 1
CVE-2026-28586
In multiple functions of AppOpsService.java, there is a possible missing permission check due to a permissions bypass. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
PUBLISHED
- Vendor
- Product
- Android
- Provider severity
- LOW
- Conflicts
- 1
CVE-2026-28581
In fixInitiatingUserIfNecessary of CallIntentProcessor.java, there is a possible way to make an emergency call due to a logic error in the code. This could lead to local with null execution privileges needed. User interaction is null for exploitation.
PUBLISHED
- Vendor
- Product
- Android
- Provider severity
- MEDIUM
- Conflicts
- 1
CVE-2026-28580
In multiple functions, there is a possible desync in persistence due to an incorrect bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
PUBLISHED
- Vendor
- Product
- Android
- Provider severity
- HIGH
- Conflicts
- 1
CVE-2026-2858
A vulnerability was identified in wren-lang wren up to 0.4.0. This affects the function peekChar of the file src/vm/wren_compiler.c of the component Source File Parser. Such manipulation leads to out-of-bounds read. The attack needs to be performed locally. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.
PUBLISHED
- Vendor
- wren-lang
- Product
- wren
- Provider severity
- LOW, MEDIUM
- Conflicts
- 2
CVE-2026-28578
In multiple functions of DevicePolicyManagerService.java, there is a possible desync from persistence due to improper input validation. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.
PUBLISHED
- Vendor
- Product
- Android
- Provider severity
- MEDIUM
- Conflicts
- 1
CVE-2026-28577
In addWindow of WindowManagerService.java, there is a possible tapjacking issue due to a tapjacking/overlay attack. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
PUBLISHED
- Vendor
- Product
- Android
- Provider severity
- HIGH
- Conflicts
- 1
CVE-2026-28576
In Contacts Provider, there is a possible way to access the contacts database due to SQL injection. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
PUBLISHED
- Vendor
- Android
- Product
- Android
- Provider severity
- CRITICAL
- Conflicts
- 1
CVE-2026-28575
In PackageInstaller.Session#transfer of frameworks/base/services/core/java/com/android/server/pm/PackageInstallerSession.java, there is a possible memory exhaustion attack due to a logic error in the code. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.
PUBLISHED
- Vendor
- Product
- Android
- Provider severity
- CRITICAL
- Conflicts
- 1
CVE-2026-28573
In AndroidManifest.xml, there is a possible persistent denial of service due to a missing permission check. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.
PUBLISHED
- Vendor
- Product
- Android
- Provider severity
- CRITICAL
- Conflicts
- 1
CVE-2026-2857
A vulnerability was determined in D-Link DWR-M960 1.01.07. Affected by this issue is the function sub_423E00 of the file /boafrm/formPortFw of the component Port Forwarding Configuration Endpoint. This manipulation of the argument submit-url causes stack-based buffer overflow. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized.
PUBLISHED
- Vendor
- D-Link
- Product
- DWR-M960
- Provider severity
- HIGH
- Conflicts
- 2
CVE-2026-28564
Insufficient Session Expiration, Authentication Bypass by Capture-replay vulnerability in Apache IoTDB. REST Basic Authentication Accepts Stale Cached Credentials This issue affects Apache IoTDB: from 1.0.0 before 2.0.10. Users are recommended to upgrade to version 2.0.10, which fixes the issue.
PUBLISHED
- Vendor
- Apache Software Foundation
- Product
- Apache IoTDB
- Provider severity
- CRITICAL
- Conflicts
- 1
CVE-2026-28563
Apache Airflow versions 3.1.0 through 3.1.7 /ui/dependencies endpoint returns the full DAG dependency graph without filtering by authorized DAG IDs. This allows an authenticated user with only DAG Dependencies permission to enumerate DAGs they are not authorized to view. Users are recommended to upgrade to Apache Airflow 3.1.8 or later, which resolves this issue.
PUBLISHED
- Vendor
- Apache Software Foundation
- Product
- Apache Airflow
- Provider severity
- MEDIUM
- Conflicts
- 0
CVE-2026-28562
wpForo 2.4.14 contains an unauthenticated SQL injection vulnerability in Topics::get_topics() where the ORDER BY clause relies on ineffective esc_sql() sanitization on unquoted identifiers. Attackers exploit the wpfob parameter with CASE WHEN payloads to perform blind boolean extraction of credentials from the WordPress database.
PUBLISHED
- Vendor
- gVectors Team
- Product
- wpForo Forum
- Provider severity
- HIGH
- Conflicts
- 1