CVE-2026-25266
Memory corruption while processing IOCTL command when device is in power-save state.
PUBLISHED
- Vendor
- Qualcomm, Inc.
- Product
- Snapdragon
- Provider severity
- MEDIUM
- Conflicts
- 0
Data & Insights
CVE Explorer
Search one exact, source-linked CVE snapshot by CVE ID or explicit vendor and product tokens. Provider severity, KEV, conflicts, and stale state remain separate observations—not a Baitaphish risk rating.
Exact snapshot results
353,537 CVE records
CVE-2026-25260
Memory Corruption when accessing shared buffers without validation of concurrent user-mode input modifications.
PUBLISHED
- Vendor
- Qualcomm, Inc.
- Product
- Snapdragon
- Provider severity
- HIGH
- Conflicts
- 0
CVE-2026-2526
A vulnerability was found in Wavlink WL-WN579A3 up to 20210219. This impacts the function multi_ssid of the file /cgi-bin/wireless.cgi. Performing a manipulation of the argument SSID2G2 results in command injection. The attack may be initiated remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
PUBLISHED
- Vendor
- Wavlink
- Product
- WL-WN579A3
- Provider severity
- MEDIUM
- Conflicts
- 2
CVE-2026-25259
Memory corruption while processing multiple IOCTL command for escape operations.
PUBLISHED
- Vendor
- Qualcomm, Inc.
- Product
- Snapdragon
- Provider severity
- HIGH
- Conflicts
- 0
CVE-2026-25258
Memory corruption while processing IOCTL calls for escape operations.
PUBLISHED
- Vendor
- Qualcomm, Inc.
- Product
- Snapdragon
- Provider severity
- HIGH
- Conflicts
- 0
CVE-2026-25253
OpenClaw (aka clawdbot or Moltbot) before 2026.1.29 obtains a gatewayUrl value from a query string and automatically makes a WebSocket connection without prompting, sending a token value.
PUBLISHED
- Vendor
- OpenClaw
- Product
- OpenClaw
- Provider severity
- HIGH
- Conflicts
- 0
CVE-2026-2525
A vulnerability has been found in Free5GC up to 4.1.0. This affects an unknown function of the component PFCP UDP Endpoint. Such manipulation leads to denial of service. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
PUBLISHED
- Vendor
- n/a
- Product
- Free5GC
- Provider severity
- MEDIUM
- Conflicts
- 1
CVE-2026-25244
WebdriverIO is a test automation framework for unit, e2e and component testing using WebDriver, WebDriver BiDi and Appium. Versions below 9.24.0 contain a command injection vulnerability leading to remote code execution (RCE) in test orchestration. Git permits branch names containing shell metacharacters, and getGitMetadataForAISelection() interpolates these names directly into execSync() calls without sanitization. An attacker can exploit this by supplying a malicious repository (via testOrches
PUBLISHED
- Vendor
- Red Hat, webdriverio
- Product
- Red Hat Hardened Images, webdriverio
- Provider severity
- CRITICAL, HIGH
- Conflicts
- 3
CVE-2026-25243
A flaw was found in Redis. An authenticated attacker with permission to execute the RESTORE command can send a crafted serialized payload that may lead to an invalid memory access due to an improper validation of the serialized values. This flaw can cause the server to crash and may allow arbitrary code execution.
PUBLISHED
- Vendor
- Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, redis
- Product
- Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 8.8 Telecommunications Update Service, Red Hat Enterprise Linux 9.6 Extended Update Support, Red Hat Hardened Images, Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On, Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions, Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 8, Red Hat Hardened Images, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions, Red Hat Enterprise Linux 9.6 Extended Update Support, Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions, Red Hat Enterprise Linux 10.0 Extended Update Support, Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support, Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On, Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support, redis
- Provider severity
- HIGH
- Conflicts
- 3
CVE-2026-25242
Gogs is an open source self-hosted Git service. Versions 0.13.4 and below expose unauthenticated file upload endpoints by default. When the global RequireSigninView setting is disabled (default), any remote user can upload arbitrary files to the server via /releases/attachments and /issues/attachments. This enables the instance to be abused as a public file host, potentially leading to disk exhaustion, content hosting, or delivery of malware. CSRF tokens do not mitigate this attack due to same-o
PUBLISHED
- Vendor
- gogs
- Product
- gogs
- Provider severity
- MEDIUM
- Conflicts
- 0
CVE-2026-25241
PEAR is a framework and distribution system for reusable PHP components. Prior to version 1.33.0, an unauthenticated SQL injection in the /get/<package>/<version> endpoint allows remote attackers to execute arbitrary SQL via a crafted package version. This issue has been patched in version 1.33.0.
PUBLISHED
- Vendor
- pear
- Product
- pearweb
- Provider severity
- CRITICAL
- Conflicts
- 0
CVE-2026-25240
PEAR is a framework and distribution system for reusable PHP components. Prior to version 1.33.0, a SQL injection vulnerability can occur in user::maintains() when role filters are provided as an array and interpolated into an IN (...) clause. This issue has been patched in version 1.33.0.
PUBLISHED
- Vendor
- pear
- Product
- pearweb
- Provider severity
- MEDIUM
- Conflicts
- 0
CVE-2026-2524
A flaw has been found in Open5GS 2.7.6. The impacted element is the function mme_s11_handle_create_session_response of the component MME. This manipulation causes denial of service. The attack can be initiated remotely. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.
PUBLISHED
- Vendor
- n/a
- Product
- Open5GS
- Provider severity
- MEDIUM
- Conflicts
- 1
CVE-2026-25239
PEAR is a framework and distribution system for reusable PHP components. Prior to version 1.33.0, a SQL injection vulnerability in apidoc queue insertion can allow query manipulation if an attacker can influence the inserted filename value. This issue has been patched in version 1.33.0.
PUBLISHED
- Vendor
- pear
- Product
- pearweb
- Provider severity
- HIGH
- Conflicts
- 0
CVE-2026-25238
PEAR is a framework and distribution system for reusable PHP components. Prior to version 1.33.0, a SQL injection vulnerability in bug subscription deletion may allow attackers to inject SQL via a crafted email value. This issue has been patched in version 1.33.0.
PUBLISHED
- Vendor
- pear
- Product
- pearweb
- Provider severity
- CRITICAL
- Conflicts
- 0
CVE-2026-25237
PEAR is a framework and distribution system for reusable PHP components. Prior to version 1.33.0, use of preg_replace() with the /e modifier in bug update email handling can enable PHP code execution if attacker-controlled content reaches the evaluated replacement. This issue has been patched in version 1.33.0.
PUBLISHED
- Vendor
- pear
- Product
- pearweb
- Provider severity
- CRITICAL
- Conflicts
- 0
CVE-2026-25236
PEAR is a framework and distribution system for reusable PHP components. Prior to version 1.33.0, a SQL injection risk exists in karma queries due to unsafe literal substitution for an IN (...) list. This issue has been patched in version 1.33.0.
PUBLISHED
- Vendor
- pear
- Product
- pearweb
- Provider severity
- MEDIUM
- Conflicts
- 0
CVE-2026-25235
PEAR is a framework and distribution system for reusable PHP components. Prior to version 1.33.0, predictable verification hashes may allow attackers to guess verification tokens and potentially verify election account requests without authorization. This issue has been patched in version 1.33.0.
PUBLISHED
- Vendor
- pear
- Product
- pearweb
- Provider severity
- HIGH
- Conflicts
- 0
CVE-2026-25234
PEAR is a framework and distribution system for reusable PHP components. Prior to version 1.33.0, a SQL injection vulnerability in category deletion can allow an attacker with access to the category manager workflow to inject SQL via a category id. This issue has been patched in version 1.33.0.
PUBLISHED
- Vendor
- pear
- Product
- pearweb
- Provider severity
- MEDIUM
- Conflicts
- 0
CVE-2026-25233
PEAR is a framework and distribution system for reusable PHP components. Prior to version 1.33.0, logic bug in the roadmap role check allows non-lead maintainers to create, update, or delete roadmaps. This issue has been patched in version 1.33.0.
PUBLISHED
- Vendor
- pear
- Product
- pearweb
- Provider severity
- HIGH
- Conflicts
- 0
CVE-2026-25232
Gogs is an open source self-hosted Git service. Versions 0.13.4 and below have an access control bypass vulnerability which allows any repository collaborator with Write permissions to delete protected branches (including the default branch) by sending a direct POST request, completely bypassing the branch protection mechanism. This vulnerability in the DeleteBranchPost function eenables privilege escalation from Write to Admin level, allowing low-privilege users to perform dangerous operations
PUBLISHED
- Vendor
- gogs
- Product
- gogs
- Provider severity
- HIGH
- Conflicts
- 0
CVE-2026-25231
FileRise is a self-hosted web file manager / WebDAV server. Versions prior to 3.3.0, the application contains an unauthenticated file read vulnerability due to the lack of access control on the /uploads directory. Files uploaded to this directory can be accessed directly by any user who knows or can guess the file path, without requiring authentication. As a result, sensitive data could be exposed, and privacy may be breached. This vulnerability is fixed in 3.3.0.
PUBLISHED
- Vendor
- error311
- Product
- FileRise
- Provider severity
- HIGH
- Conflicts
- 1
CVE-2026-25230
FileRise is a self-hosted web file manager / WebDAV server. Prior to 3.3.0, an HTML Injection vulnerability allows an authenticated user to modify the DOM and add e.g. form elements that call certain endpoints or link elements that redirect the user on active interaction. This vulnerability is fixed in 3.3.0.
PUBLISHED
- Vendor
- error311
- Product
- FileRise
- Provider severity
- MEDIUM
- Conflicts
- 1
CVE-2026-2523
A vulnerability was detected in Open5GS up to 2.7.6. The affected element is the function smf_gn_handle_create_pdp_context_request of the file /src/smf/gn-handler.c of the component SMF. The manipulation results in reachable assertion. It is possible to launch the attack remotely. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet.
PUBLISHED
- Vendor
- n/a
- Product
- Open5GS
- Provider severity
- MEDIUM
- Conflicts
- 1
CVE-2026-25229
Gogs is an open source self-hosted Git service. Versions 0.13.4 and below have a broken access control vulnerability which allows authenticated users with write access to any repository to modify labels belonging to other repositories. The UpdateLabel function in the Web UI (internal/route/repo/issue.go) fails to verify that the label being modified belongs to the repository specified in the URL path, enabling cross-repository label tampering attacks. The vulnerability exists in the Web UI's lab
PUBLISHED
- Vendor
- gogs
- Product
- gogs
- Provider severity
- MEDIUM
- Conflicts
- 0
CVE-2026-25228
Signal K Server is a server application that runs on a central hub in a boat. Prior to 2.20.3, a path traversal vulnerability in SignalK Server's applicationData API allows authenticated users on Windows systems to read, write, and list arbitrary files and directories on the filesystem. The validateAppId() function blocks forward slashes (/) but not backslashes (\), which are treated as directory separators by path.join() on Windows. This enables attackers to escape the intended applicationData
PUBLISHED
- Vendor
- SignalK
- Product
- signalk-server
- Provider severity
- MEDIUM
- Conflicts
- 0
CVE-2026-25227
authentik is an open-source identity provider. From 2021.3.1 to before 2025.8.6, 2025.10.4, and 2025.12.4, when using delegated permissions, a User that has the permission Can view * Property Mapping or Can view Expression Policy is able to execute arbitrary code within the authentik server container through the test endpoint, which is intended to preview how a property mapping/policy works. authentik 2025.8.6, 2025.10.4, and 2025.12.4 fix this issue.
PUBLISHED
- Vendor
- goauthentik
- Product
- authentik
- Provider severity
- CRITICAL
- Conflicts
- 0
CVE-2026-25224
Fastify is a fast and low overhead web framework, for Node.js. Prior to version 5.7.3, a denial-of-service vulnerability in Fastify’s Web Streams response handling can allow a remote client to exhaust server memory. Applications that return a ReadableStream (or Response with a Web Stream body) via reply.send() are impacted. A slow or non-reading client can trigger unbounded buffering when backpressure is ignored, leading to process crashes or severe degradation. This issue has been patched in ve
PUBLISHED
- Vendor
- fastify
- Product
- fastify
- Provider severity
- LOW
- Conflicts
- 0
CVE-2026-25223
Fastify is a fast and low overhead web framework, for Node.js. Prior to version 5.7.2, a validation bypass vulnerability exists in Fastify where request body validation schemas specified by Content-Type can be completely circumvented. By appending a tab character (\t) followed by arbitrary content to the Content-Type header, attackers can bypass body validation while the server still processes the body as the original content type. This issue has been patched in version 5.7.2.
PUBLISHED
- Vendor
- Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, fastify, Red Hat, Red Hat
- Product
- Red Hat OpenShift Dev Spaces 3.27, Red Hat OpenShift AI 2.16, Red Hat Enterprise Linux AI (RHEL AI) 3, Red Hat Enterprise Linux AI (RHEL AI) 3, Red Hat OpenShift AI 2.25, fastify, Red Hat OpenShift AI (RHOAI), Red Hat OpenShift AI 2.25
- Provider severity
- HIGH
- Conflicts
- 2
CVE-2026-25222
PolarLearn is a free and open-source learning program. In 0-PRERELEASE-15 and earlier, a timing attack vulnerability in the sign-in process allows unauthenticated attackers to determine if a specific email address is registered on the platform. By measuring the response time of the login endpoint, an attacker can distinguish between valid and invalid email addresses. This occurs because the server only performs the computationally expensive Argon2 password hashing if the user exists in the datab
PUBLISHED
- Vendor
- polarnl
- Product
- PolarLearn
- Provider severity
- MEDIUM
- Conflicts
- 0
CVE-2026-25221
PolarLearn is a free and open-source learning program. In 0-PRERELEASE-15 and earlier, the OAuth 2.0 implementation for GitHub and Google login providers is vulnerable to Login Cross-Site Request Forgery (CSRF). The application fails to implement and verify the state parameter during the authentication flow. This allows an attacker to pre-authenticate a session and trick a victim into logging into the attacker's account. Any data the victim then enters or academic progress they make is stored on
PUBLISHED
- Vendor
- polarnl
- Product
- PolarLearn
- Provider severity
- LOW
- Conflicts
- 0
CVE-2026-25220
OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0, the Message Center accepts the URL parameter `show_all=yes` and passes it to `getPnotesByUser()`, which returns all internal messages (all users’ notes). The backend does not verify that the requesting user is an administrator before honoring `show_all=yes`. The "Show All" link is also visible to non-admin users. As a result, any authenticated user can view the entire
PUBLISHED
- Vendor
- openemr
- Product
- openemr
- Provider severity
- MEDIUM
- Conflicts
- 0
CVE-2026-2522
A security vulnerability has been detected in Open5GS up to 2.7.6. Impacted is an unknown function of the file /src/mme/esm-build.c of the component MME. The manipulation leads to memory corruption. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.
PUBLISHED
- Vendor
- n/a
- Product
- Open5GS
- Provider severity
- MEDIUM
- Conflicts
- 1
CVE-2026-25219
The `access_key` and `connection_string` connection properties were not marked as sensitive names in secrets masker. This means that user with read permission could see the values in Connection UI, as well as when Connection was accidentaly logged to logs, those values could be seen in the logs. Azure Service Bus used those properties to store sensitive values. Possibly other providers could be also affected if they used the same fields to store sensitive data. If you used Azure Service Bus con
PUBLISHED
- Vendor
- Apache Software Foundation
- Product
- Apache Airflow
- Provider severity
- MEDIUM
- Conflicts
- 0
CVE-2026-25212
An issue was discovered in Percona PMM before 3.7. Because an internal database user retains specific superuser privileges, an attacker with pmm-admin rights can abuse the "Add data source" feature to break out of the database context and execute shell commands on the underlying operating system.
PUBLISHED
- Vendor
- n/a
- Product
- n/a
- Provider severity
- CRITICAL
- Conflicts
- 1
CVE-2026-25211
Llama Stack (aka llama-stack) before 0.4.0rc3 does not censor the pgvector password in the initialization log.
PUBLISHED
- Vendor
- llamastack
- Product
- Llama Stack
- Provider severity
- LOW
- Conflicts
- 0
CVE-2026-25210
In libexpat before 2.7.4, the doContent function does not properly determine the buffer size bufSize because there is no integer overflow check for tag buffer reallocation.
PUBLISHED
- Vendor
- libexpat project, Siemens
- Product
- libexpat, RUGGEDCOM RST2428P
- Provider severity
- MEDIUM
- Conflicts
- 1
CVE-2026-2521
A weakness has been identified in Open5GS up to 2.7.6. This issue affects the function sgwc_s5c_handle_create_session_response of the component SGW-C. Executing a manipulation can lead to memory corruption. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
PUBLISHED
- Vendor
- n/a
- Product
- Open5GS
- Provider severity
- MEDIUM
- Conflicts
- 1
CVE-2026-25209
Out-of-bounds read vulnerability in Samsung Open Source Escargot allows Resource Leak Exposure.This issue affects Escargot: 97e8115ab1110bc502b4b5e4a0c689a71520d335.
PUBLISHED
- Vendor
- Samsung Open Source
- Product
- Escargot
- Provider severity
- MEDIUM
- Conflicts
- 0
CVE-2026-25208
Integer overflow vulnerability in Samsung Open Source Escargot allows Overflow Buffers.This issue affects Escargot: 97e8115ab1110bc502b4b5e4a0c689a71520d335.
PUBLISHED
- Vendor
- Samsung Open Source
- Product
- Escargot
- Provider severity
- HIGH
- Conflicts
- 0
CVE-2026-25207
Out-of-bounds write vulnerability in Samsung Open Source Escargot allows Overflow Buffers.This issue affects Escargot: 97e8115ab1110bc502b4b5e4a0c689a71520d335.
PUBLISHED
- Vendor
- Samsung Open Source
- Product
- Escargot
- Provider severity
- HIGH
- Conflicts
- 0
CVE-2026-25206
Out-of-bounds read vulnerability in Samsung Open Source Escargot allows Resource Leak Exposure.This issue affects Escargot: 97e8115ab1110bc502b4b5e4a0c689a71520d335.
PUBLISHED
- Vendor
- Samsung Open Source
- Product
- Escargot
- Provider severity
- MEDIUM
- Conflicts
- 0
CVE-2026-25205
Heap-based buffer overflow vulnerability in Samsung Open Source Escargot allows out-of-bounds write.This issue affects Escargot:commit hash 97e8115ab1110bc502b4b5e4a0c689a71520d335 .
PUBLISHED
- Vendor
- Samsung Open Source
- Product
- Escargot
- Provider severity
- HIGH
- Conflicts
- 0
CVE-2026-25204
Deserialization of untrusted data vulnerability in Samsung Open Source Escargot Java Script allows denial of service condition via process abort. This issue affects escarogt prior to commit hash 97e8115ab1110bc502b4b5e4a0c689a71520d335
PUBLISHED
- Vendor
- Samsung Open Source
- Product
- Escargot
- Provider severity
- MEDIUM
- Conflicts
- 1
CVE-2026-25203
Samsung MagicINFO 9 Server Incorrect Default Permissions Local Privilege Escalation Vulnerability This issue affects MagicINFO 9 Server: less than 21.1091.1.
PUBLISHED
- Vendor
- Samsung Electronics
- Product
- MagicINFO 9 Server
- Provider severity
- HIGH
- Conflicts
- 0
CVE-2026-25202
The database account and password are hardcoded, allowing login with the account to manipulate the database in MagicInfo9 Server.This issue affects MagicINFO 9 Server: less than 21.1090.1.
PUBLISHED
- Vendor
- Samsung Electronics
- Product
- MagicINFO 9 Server
- Provider severity
- CRITICAL
- Conflicts
- 0
CVE-2026-25201
An unauthenticated user can upload arbitrary files to execute remote code, leading to privilege escalation in MagicInfo9 Server. This issue affects MagicINFO 9 Server: less than 21.1090.1.
PUBLISHED
- Vendor
- Samsung Electronics
- Product
- MagicINFO 9 Server
- Provider severity
- HIGH
- Conflicts
- 0
CVE-2026-25200
A vulnerability in MagicInfo9 Server allows authorized users to upload HTML files without authentication, leading to Stored XSS, which can result in account takeover This issue affects MagicINFO 9 Server: less than 21.1090.1.
PUBLISHED
- Vendor
- Samsung Electronics
- Product
- MagicINFO 9 Server
- Provider severity
- CRITICAL
- Conflicts
- 0
CVE-2026-25199
Instances deployed via the Proxmox extension allow unauthorized access to instances belonging to other tenants. This issue affects Apache CloudStack: from 4.21.0.0 through 4.22.0.0. The Proxmox extension for CloudStack improperly uses a user-editable instance setting, proxmox_vmid, to associate CloudStack instances with Proxmox virtual machines. Because this value is not restricted or validated against tenant ownership and Proxmox VM IDs are predictable, a non-privileged attacker can mod
PUBLISHED
- Vendor
- Apache Software Foundation
- Product
- Apache CloudStack
- Provider severity
- CRITICAL
- Conflicts
- 0
CVE-2026-25198
web2py versions 2.27.1-stable+timestamp.2023.11.16.08.03.57 and prior contain an open redirect vulnerability. If this vulnerability is exploited, the user may be redirected to an arbitrary website when accessing a specially crafted URL. As a result, the user may become a victim of a phishing attack.
PUBLISHED
- Vendor
- web2py
- Product
- web2py
- Provider severity
- MEDIUM
- Conflicts
- 1