CVE Explorer

Exact snapshot results

353,537 CVE records

CVE ID descending · no relevance ranking

CVE-2026-23755

D-Link D-View 8 versions 2.0.1.107 and below contain an uncontrolled search path vulnerability in the installer. When executed with elevated privileges via UAC, the installer attempts to load version.dll from its execution directory, allowing DLL preloading. An attacker can supply a malicious version.dll alongside the legitimate installer so that, when a victim runs the installer and approves the UAC prompt, attacker-controlled code executes with administrator privileges. This can lead to full s

PUBLISHED

Vendor: D-Link
Product: D-View 8
Provider severity: HIGH
Conflicts: 0

CVE-2026-23754

D-Link D-View 8 versions 2.0.1.107 and below contain an improper access control vulnerability in backend API endpoints. Any authenticated user can supply an arbitrary user_id value to retrieve sensitive credential data belonging to other users, including super administrators. The exposed credential material can be reused directly as a valid authentication secret, allowing full impersonation of the targeted account. This results in complete account takeover and full administrative control over th

PUBLISHED

Vendor: D-Link
Product: D-View 8
Provider severity: HIGH
Conflicts: 0

CVE-2026-23753

GFI HelpDesk before 4.99.9 contains a stored cross-site scripting vulnerability in the language management functionality where the charset POST parameter is passed directly to SWIFT_Language::Create() without HTML sanitization and subsequently rendered unsanitized by View_Language.RenderGrid(). An authenticated administrator can inject arbitrary JavaScript through the charset field when creating or editing a language, and the payload executes in the browser of any administrator viewing the Langu

PUBLISHED

Vendor: GFI Software
Product: HelpDesk
Provider severity: MEDIUM
Conflicts: 1

CVE-2026-23752

GFI HelpDesk before 4.99.9 contains a stored cross-site scripting vulnerability in the template group creation and editing functionality that allows authenticated administrators to inject arbitrary JavaScript by manipulating the companyname POST parameter without HTML sanitization. Attackers can inject malicious scripts through the companyname field that execute in the browsers of any administrator viewing the Templates > Groups page.

PUBLISHED

Vendor: GFI Software
Product: HelpDesk
Provider severity: MEDIUM
Conflicts: 1

CVE-2026-23751

Kofax Capture, now referred to as Tungsten Capture, version 6.0.0.0 (other versions may be affected) exposes a deprecated .NET Remoting HTTP channel on port 2424 via the Ascent Capture Service that is accessible without authentication and uses a default, publicly known endpoint identifier. An unauthenticated remote attacker can exploit .NET Remoting object unmarshalling techniques to instantiate a remote System.Net.WebClient object and read arbitrary files from the server filesystem, write attac

PUBLISHED

Vendor: Tungsten Automation
Product: Tungsten Capture (formerly Kofax Capture)
Provider severity: CRITICAL
Conflicts: 2

CVE-2026-23750

Golioth Pouch version 0.1.0, prior to commit 1b2219a1, contains a heap-based buffer overflow in BLE GATT server certificate handling. server_cert_write() allocates a heap buffer of size CONFIG_POUCH_SERVER_CERT_MAX_LEN when receiving the first fragment, then appends subsequent fragments using memcpy() without verifying that sufficient capacity remains. An adjacent BLE client can send unauthenticated fragments whose combined size exceeds the allocated buffer, causing a heap overflow and crash; in

PUBLISHED

Vendor: Golioth
Product: Pouch
Provider severity: HIGH
Conflicts: 1

CVE-2026-2375

The App Builder – Create Native Android & iOS Apps On The Flight plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 5.5.10. This is due to the `verify_role()` function in `AuthTrails.php` explicitly whitelisting the `wcfm_vendor` role alongside `subscriber` and `customer`, and assigning it directly via `wp_insert_user()` without integrating with WCFM Marketplace's vendor approval workflow. This makes it possible for unauthenticated attackers to regis

PUBLISHED

Vendor: appcheap
Product: App Builder – Create Native Android & iOS Apps On The Flight
Provider severity: MEDIUM
Conflicts: 0

CVE-2026-23749

Golioth Firmware SDK version 0.19.1 prior to 0.22.0, fixed in commit 0e788217, contain an out-of-bounds read due to improper null termination of a blockwise transfer path. blockwise_transfer_init() accepts a path whose length equals CONFIG_GOLIOTH_COAP_MAX_PATH_LEN and copies it using strncpy() without guaranteeing a trailing NUL byte, leaving ctx->path unterminated. A later strlen() on this buffer (in golioth_coap_client_get_internal()) can read past the end of the allocation, resulting in a cr

PUBLISHED

Vendor: Golioth
Product: Firmware SDK
Provider severity: LOW
Conflicts: 1

CVE-2026-23748

Golioth Firmware SDK version 0.10.0 prior to 0.22.0, fixed in commit d7f55b38, contain an out-of-bounds read in LightDB State string parsing. When processing a string payload, a payload_size value less than 2 can cause a size_t underflow when computing the number of bytes to copy (nbytes). The subsequent memcpy() reads past the end of the network buffer, which can crash the device. The condition is reachable from on_payload, and golioth_payload_is_null() does not block payload_size==1. A malicio

PUBLISHED

Vendor: Golioth
Product: Firmware SDK
Provider severity: LOW, MEDIUM
Conflicts: 1

CVE-2026-23747

Golioth Firmware SDK version 0.10.0 prior to 0.22.0, fixed in commit 48f521b, contain a stack-based buffer overflow in Payload Utils. The golioth_payload_as_int() and golioth_payload_as_float() helpers copy network-supplied payload data into fixed-size stack buffers using memcpy() with a length derived from payload_size. The only length checks are guarded by assert(); in release builds, the asserts are compiled out and memcpy() may copy an unbounded payload_size. Payloads larger than 12 bytes (i

PUBLISHED

Vendor: Golioth
Product: Firmware SDK
Provider severity: LOW, MEDIUM
Conflicts: 1

CVE-2026-23746

Entrust Instant Financial Issuance (IFI) On Premise software (formerly referred to as CardWizard) versions 5.x, prior to 6.10.5, and prior to 6.11.1 contain an insecure .NET Remoting exposure in the SmartCardController service (DCG.SmartCardControllerService.exe). The service registers a TCP remoting channel with unsafe formatter/settings that permit untrusted remoting object invocation. A remote, unauthenticated attacker who can reach the remoting port can invoke exposed remoting objects to rea

PUBLISHED

Vendor: Entrust Corporation
Product: Instant Financial Issuance (IF)
Provider severity: CRITICAL
Conflicts: 1

CVE-2026-23745

A flaw was found in the node-tar library. This vulnerability allows an attacker to craft malicious archives that, when extracted, can bypass intended security restrictions. This leads to arbitrary file overwrite and symlink poisoning, potentially allowing unauthorized modification of files on the system.

PUBLISHED

Vendor: Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, isaacs, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat
Product: Red Hat Quay 3, Network Observability (NETOBSERV) 1.11.1, Red Hat Enterprise Linux 9, Red Hat 3scale API Management Platform 2, Red Hat Ansible Automation Platform 2, Red Hat JBoss Enterprise Application Platform 8, Red Hat Enterprise Linux 9, Multicluster Engine for Kubernetes, Red Hat 3scale API Management Platform 2, Red Hat OpenShift GitOps, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, OpenShift Lightspeed, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 8, Red Hat Trusted Artifact Signer 1.2, Red Hat Enterprise Linux 9, Red Hat Process Automation 7, Red Hat OpenShift AI 3.3, Red Hat 3scale API Management Platform 2, Red Hat Connectivity Link 1, node-tar, Red Hat OpenShift AI (RHOAI), Red Hat Enterprise Linux 8, Red Hat 3scale API Management Platform 2, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux AI (RHEL AI) 3, Red Hat Advanced Cluster Management for Kubernetes 2, Red Hat OpenShift AI 2.25, Red Hat 3scale API Management Platform 2, OpenShift Serverless, Red Hat build of Apache Camel - HawtIO 4, Red Hat Trusted Artifact Signer 1.3, Red Hat Enterprise Linux 9, Logging Subsystem for Red Hat OpenShift, Red Hat Hardened Images, Red Hat OpenShift Dev Spaces 3.27, OpenShift Pipelines, Red Hat Enterprise Linux 10, Red Hat 3scale API Management Platform 2, Red Hat Enterprise Linux 6, Red Hat JBoss Enterprise Application Platform 7, Red Hat Enterprise Linux 8, Red Hat Fuse 7, Red Hat Enterprise Linux 10, Red Hat 3scale API Management Platform 2, Node HealthCheck Operator, Red Hat 3scale API Management Platform 2, Red Hat Migration Toolkit 1.8, Red Hat Enterprise Linux 10, Red Hat AMQ Broker 7, Red Hat Openshift Data Foundation 4, Red Hat Enterprise Linux 7, Red Hat Single Sign-On 7, Red Hat OpenShift Container Platform 4, Cryostat 4, Red Hat Enterprise Linux 9, Multicluster Engine for Kubernetes, Red Hat Satellite 6, Red Hat 3scale API Management Platform 2, Red Hat Openshift Data Foundation 4, Red Hat Developer Hub, Red Hat JBoss Enterprise Application Platform Expansion Pack, Red Hat OpenShift Container Platform 4, Confidential Compute Attestation, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9
Provider severity: HIGH
Conflicts: 3

CVE-2026-23744

MCPJam inspector is the local-first development platform for MCP servers. Versions 1.4.2 and earlier are vulnerable to remote code execution (RCE) vulnerability, which allows an attacker to send a crafted HTTP request that triggers the installation of an MCP server, leading to RCE. Since MCPJam inspector by default listens on 0.0.0.0 instead of 127.0.0.1, an attacker can trigger the RCE remotely via a simple HTTP request. Version 1.4.3 contains a patch.

PUBLISHED

Vendor: MCPJam
Product: inspector
Provider severity: CRITICAL
Conflicts: 0

CVE-2026-23743

Discourse is an open source discussion platform. In versions prior to 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0, permalinks pointing to access-restricted resources (private topics, categories, posts, or hidden tags) were redirecting users to URLs containing the resource slug, even when the user didn't have access to view the resource. This leaked potentially sensitive information (e.g., private topic titles) via the redirect Location header and the 404 page's search box. This issue is patched in

PUBLISHED

Vendor: discourse
Product: discourse
Provider severity: MEDIUM
Conflicts: 0

CVE-2026-23742

Skipper is an HTTP router and reverse proxy for service composition. The default skipper configuration before 0.23.0 was -lua-sources=inline,file. The problem starts if untrusted users can create lua filters, because of -lua-sources=inline , for example through a Kubernetes Ingress resource. The configuration inline allows these user to create a script that is able to read the filesystem accessible to the skipper process and if the user has access to read the logs, they an read skipper secrets.

PUBLISHED

Vendor: zalando
Product: skipper
Provider severity: HIGH
Conflicts: 1

CVE-2026-23741

Asterisk is an open source private branch exchange and telephony toolkit. Prior to versions 20.7-cert9, 20.18.2, 21.12.1, 22.8.2, and 23.2.2, the asterisk/contrib/scripts/ast_coredumper runs as root, as noted by the NOTES tag on line 689 of the ast_coredumper file. The script will source the contents of /etc/asterisk/ast_debug_tools.conf, which resides in a folder that is writeable by the asterisk user:group. Due to the /etc/asterisk/ast_debug_tools.conf file following bash semantics and it bein

PUBLISHED

Vendor: asterisk
Product: asterisk
Provider severity: NONE
Conflicts: 0

CVE-2026-23740

Asterisk is an open source private branch exchange and telephony toolkit. Prior to versions 20.7-cert9, 20.18.2, 21.12.1, 22.8.2, and 23.2.2, when ast_coredumper writes its gdb init and output files to a directory that is world-writable (for example /tmp), an attacker with write permission(which is all users on a linux system) to that directory can cause root to execute arbitrary commands or overwrite arbitrary files by controlling the gdb init file and output paths. This issue has been patched

PUBLISHED

Vendor: asterisk
Product: asterisk
Provider severity: HIGH, NONE
Conflicts: 1

CVE-2026-2374

The Login No Captcha reCAPTCHA plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `$_SERVER['PHP_SELF']` superglobal in all versions up to, and including, 1.8.0. This is due to the `authenticate()` function storing the unsanitized output of `basename($_SERVER['PHP_SELF'])` in the `login_nocaptcha_error` WordPress option when a login attempt is made from a non-standard login page (e.g., xmlrpc.php). The `admin_notices()` function then echoes this stored value directly into

PUBLISHED

Vendor: robertpeake
Product: Login No Captcha reCAPTCHA
Provider severity: HIGH
Conflicts: 0

CVE-2026-23739

Asterisk is an open source private branch exchange and telephony toolkit. Prior to versions 20.7-cert9, 20.18.2, 21.12.1, 22.8.2, and 23.2.2, the ast_xml_open() function in xml.c parses XML documents using libxml with unsafe parsing options that enable entity expansion and XInclude processing. Specifically, it invokes xmlReadFile() with the XML_PARSE_NOENT flag and later processes XIncludes via xmlXIncludeProcess().If any untrusted or user-supplied XML file is passed to this function, it can all

PUBLISHED

Vendor: asterisk
Product: asterisk
Provider severity: LOW
Conflicts: 0

CVE-2026-23738

Asterisk is an open source private branch exchange and telephony toolkit. Prior to versions 20.7-cert9, 20.18.2, 21.12.1, 22.8.2, and 23.2.2, user supplied/control values for Cookies and any GET variable query Parameter are directly interpolated into the HTML of the page using ast_str_append. The endpoint at GET /httpstatus is the potential vulnerable endpoint relating to asterisk/main /http.c. This issue has been patched in versions 20.7-cert9, 20.18.2, 21.12.1, 22.8.2, and 23.2.2.

PUBLISHED

Vendor: asterisk
Product: asterisk
Provider severity: LOW
Conflicts: 0

CVE-2026-23737

seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities. In versions 1.4.0 and below, improper input handling in the JSON deserialization component can lead to arbitrary JavaScript code execution. Exploitation is possible via overriding constant value and error deserialization, allowing indirect access to unsafe JS evaluation. At minimum, attackers need the ability to perform 4 separate requests on the same function, and partial knowledge of

PUBLISHED

Vendor: lxsmnsyc
Product: seroval
Provider severity: HIGH
Conflicts: 0

CVE-2026-23736

seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities. In versions 1.4.0 and below, due to improper input validation, a malicious object key can lead to prototype pollution during JSON deserialization. This vulnerability affects only JSON deserialization functionality. This issue is fixed in version 1.4.1.

PUBLISHED

Vendor: lxsmnsyc
Product: seroval
Provider severity: HIGH
Conflicts: 0

CVE-2026-23735

GraphQL Modules is a toolset of libraries and guidelines dedicated to create reusable, maintainable, testable and extendable modules out of your GraphQL server. From 2.2.1 to before 2.4.1 and 3.1.1, when 2 or more parallel requests are made which trigger the same service, the context of the requests is mixed up in the service when the context is injected via @ExecutionContext(). ExecutionContext is often used to pass authentication tokens from incoming requests to services loading data from back

PUBLISHED

Vendor: graphql-hive
Product: graphql-modules
Provider severity: HIGH
Conflicts: 0

CVE-2026-23734

XWiki Platform is a generic wiki platform. Versions prior to 18.1.0-rc-1, 17.10.3, 17.4.9, and 16.10.17 allow access to read configuration files by using URLs such as http://localhost:8080/bin/ssx/Main/WebHome?resource=/../../WEB-INF/xwiki.cfg&minify=false, leading to Path Traversal. The vulnerability is can be exploited via resources parameter the ssx and jsx endpoints by using leading slashes. This issue has been patched in 18.1.0-rc-1, 17.10.3, 17.4.9, 16.10.17.

PUBLISHED

Vendor: xwiki
Product: xwiki-commons
Provider severity: CRITICAL
Conflicts: 0

CVE-2026-23733

LobeChat is an open source chat application platform. Prior to version 2.0.0-next.180, a stored Cross-Site Scripting (XSS) vulnerability in the Mermaid artifact renderer allows attackers to execute arbitrary JavaScript within the application context. This XSS can be escalated to Remote Code Execution (RCE) by leveraging the exposed `electronAPI` IPC bridge, allowing attackers to run arbitrary system commands on the victim's machine. Version 2.0.0-next.180 patches the issue.

PUBLISHED

Vendor: lobehub
Product: lobe-chat
Provider severity: MEDIUM
Conflicts: 0

CVE-2026-23732

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.21.0, FastGlyph parsing trusts `cbData`/remaining length and never validates against the minimum size implied by `cx/cy`. A malicious server can trigger a client‑side global buffer overflow, causing a crash (DoS). Version 3.21.0 contains a patch for the issue.

PUBLISHED

Vendor: FreeRDP
Product: FreeRDP
Provider severity: MEDIUM
Conflicts: 0

CVE-2026-23731

WeGIA is a web manager for charitable institutions. Prior to 3.6.2, The web application is vulnerable to clickjacking attacks. The WeGIA application does not send any defensive HTTP headers related to framing protection. In particular, X-Frame-Options is missing andContent-Security-Policy with frame-ancestors directive is not configured. Because of this, an attacker can load any WeGIA page inside a malicious HTML document, overlay deceptive elements, hide real buttons, or force accidental intera

PUBLISHED

Vendor: LabRedesCefetRJ
Product: WeGIA
Provider severity: MEDIUM
Conflicts: 0

CVE-2026-23730

WeGIA is a web manager for charitable institutions. Prior to 3.6.2, an Open Redirect vulnerability was identified in the /WeGIA/controle/control.php endpoint of the WeGIA application, specifically through the nextPage parameter when combined with metodo=listarTodos and nomeClasse=ProdutoControle. The application fails to validate or restrict the nextPage parameter, allowing attackers to redirect users to arbitrary external websites. This can be abused for phishing attacks, credential theft, malw

PUBLISHED

Vendor: LabRedesCefetRJ
Product: WeGIA
Provider severity: MEDIUM
Conflicts: 0

CVE-2026-2373

The Royal Addons for Elementor – Addons and Templates Kit for Elementor plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.7.1049 via the get_main_query_args() function due to insufficient restrictions on which posts can be included. This makes it possible for unauthenticated attackers to extract contents of non-public custom post types, such as Contact Form 7 submissions or WooCommerce coupons.

PUBLISHED

Vendor: wproyal
Product: Royal Addons for Elementor – Addons and Templates Kit for Elementor
Provider severity: MEDIUM
Conflicts: 0

CVE-2026-23729

WeGIA is a web manager for charitable institutions. Prior to 3.6.2, an Open Redirect vulnerability was identified in the /WeGIA/controle/control.php endpoint of the WeGIA application, specifically through the nextPage parameter when combined with metodo=listarDescricao and nomeClasse=ProdutoControle. The application fails to validate or restrict the nextPage parameter, allowing attackers to redirect users to arbitrary external websites. This can be abused for phishing attacks, credential theft,

PUBLISHED

Vendor: LabRedesCefetRJ
Product: WeGIA
Provider severity: MEDIUM
Conflicts: 0

CVE-2026-23728

WeGIA is a web manager for charitable institutions. Prior to 3.6.2, an Open Redirect vulnerability was identified in the /WeGIA/controle/control.php endpoint of the WeGIA application, specifically through the nextPage parameter when combined with metodo=listarTodos and nomeClasse=DestinoControle. The application fails to validate or restrict the nextPage parameter, allowing attackers to redirect users to arbitrary external websites. This can be abused for phishing attacks, credential theft, malw

PUBLISHED

Vendor: LabRedesCefetRJ
Product: WeGIA
Provider severity: MEDIUM
Conflicts: 0

CVE-2026-23727

WeGIA is a web manager for charitable institutions. Prior to 3.6.2, an Open Redirect vulnerability was identified in the /WeGIA/controle/control.php endpoint of the WeGIA application, specifically through the nextPage parameter when combined with metodo=listarTodos and nomeClasse=TipoSaidaControle. The application fails to validate or restrict the nextPage parameter, allowing attackers to redirect users to arbitrary external websites. This can be abused for phishing attacks, credential theft, ma

PUBLISHED

Vendor: LabRedesCefetRJ
Product: WeGIA
Provider severity: MEDIUM
Conflicts: 0

CVE-2026-23726

WeGIA is a web manager for charitable institutions. Prior to 3.6.2, An Open Redirect vulnerability was identified in the /WeGIA/controle/control.php endpoint of the WeGIA application, specifically through the nextPage parameter when combined with metodo=listarTodos and nomeClasse=TipoEntradaControle. The application fails to validate or restrict the nextPage parameter, allowing attackers to redirect users to arbitrary external websites. This can be abused for phishing attacks, credential theft,

PUBLISHED

Vendor: LabRedesCefetRJ
Product: WeGIA
Provider severity: MEDIUM
Conflicts: 0

CVE-2026-23725

WeGIA is a web manager for charitable institutions. Prior to 3.6.2, a Stored Cross-Site Scripting (XSS) vulnerability was identified in the html/pet/adotantes/cadastro_adotante.php and html/pet/adotantes/informacao_adotantes.php endpoint of the WeGIA application. The application does not sanitize user-controlled input before rendering it inside the Adopters Information table, allowing persistent JavaScript injection. Any user who visits the page will have the payload executed automatically. This

PUBLISHED

Vendor: LabRedesCefetRJ
Product: WeGIA
Provider severity: MEDIUM
Conflicts: 0

CVE-2026-23724

WeGIA is a web manager for charitable institutions. Prior to 3.6.2, a Stored Cross-Site Scripting (XSS) vulnerability was identified in the html/atendido/cadastro_ocorrencia.php endpoint of the WeGIA application. The application does not sanitize user-controlled data before rendering it inside the “Atendido” selection dropdown. This vulnerability is fixed in 3.6.2.

PUBLISHED

Vendor: LabRedesCefetRJ
Product: WeGIA
Provider severity: MEDIUM
Conflicts: 0

CVE-2026-23723

WeGIA is a web manager for charitable institutions. Prior to 3.6.2, an authenticated SQL Injection vulnerability was identified in the Atendido_ocorrenciaControle endpoint via the id_memorando parameter. This flaw allows for full database exfiltration, exposure of sensitive PII, and potential arbitrary file reads in misconfigured environments. This vulnerability is fixed in 3.6.2.

PUBLISHED

Vendor: LabRedesCefetRJ
Product: WeGIA
Provider severity: HIGH
Conflicts: 0

CVE-2026-23722

WeGIA is a Web Manager for Charitable Institutions. Prior to 3.6.2, a Reflected Cross-Site Scripting (XSS) vulnerability was discovered in the WeGIA system, specifically within the html/memorando/insere_despacho.php file. The application fails to properly sanitize or encode user-supplied input via the id_memorando GET parameter before reflecting it into the HTML source (likely inside a <script> block or an attribute). This allows unauthenticated attackers to inject arbitrary JavaScript or HTML i

PUBLISHED

Vendor: LabRedesCefetRJ
Product: WeGIA
Provider severity: CRITICAL
Conflicts: 0

CVE-2026-23721

OpenProject is an open-source, web-based project management software. When using groups in OpenProject to manage users, the group members should only be visible to users that have the View Members permission in any project that the group is also a member of. Prior to versions 17.0.1 and 16.6.5, due to a failed permission check, if a user had the View Members permission in any project, they could enumerate all Groups and view which other users are part of the group. The issue has been fixed in Op

PUBLISHED

Vendor: opf
Product: openproject
Provider severity: MEDIUM
Conflicts: 0

CVE-2026-23720

A vulnerability has been identified in Simcenter Femap (All versions < V2512), Simcenter Nastran (All versions < V2512). The affected applications contains an out of bounds read vulnerability while parsing specially crafted NDB files. This could allow an attacker to execute code in the context of the current process.

PUBLISHED

Vendor: Siemens, Siemens
Product: Simcenter Nastran, Simcenter Femap
Provider severity: HIGH
Conflicts: 2

CVE-2026-23719

A vulnerability has been identified in Simcenter Femap (All versions < V2512), Simcenter Nastran (All versions < V2512). The affected application is vulnerable to heap-based buffer overflow while parsing specially crafted NDB files. This could allow an attacker to execute code in the context of the current process.

PUBLISHED

Vendor: Siemens, Siemens
Product: Simcenter Femap, Simcenter Nastran
Provider severity: HIGH
Conflicts: 2

CVE-2026-23718

PUBLISHED

Vendor: Siemens, Siemens
Product: Simcenter Nastran, Simcenter Femap
Provider severity: HIGH
Conflicts: 2

CVE-2026-23717

A vulnerability has been identified in Simcenter Femap (All versions < V2512), Simcenter Nastran (All versions < V2512). The affected applications contains an out of bounds read vulnerability while parsing specially crafted XDB files. This could allow an attacker to execute code in the context of the current process.

PUBLISHED

Vendor: Siemens, Siemens
Product: Simcenter Femap, Simcenter Nastran
Provider severity: HIGH
Conflicts: 2

CVE-2026-23716

A vulnerability has been identified in Simcenter Femap (All versions < V2512), Simcenter Nastran (All versions < V2512). The affected applications contains an out of bounds read vulnerability while parsing specially crafted XDB files. This could allow an attacker to execute code in the context of the current process.

PUBLISHED

Vendor: Siemens, Siemens
Product: Simcenter Nastran, Simcenter Femap
Provider severity: HIGH
Conflicts: 2

CVE-2026-23715

A vulnerability has been identified in Simcenter Femap (All versions < V2512), Simcenter Nastran (All versions < V2512). The affected applications contains an out of bounds write vulnerability while parsing specially crafted XDB files. This could allow an attacker to execute code in the context of the current process.

PUBLISHED

Vendor: Siemens, Siemens
Product: Simcenter Femap, Simcenter Nastran
Provider severity: HIGH
Conflicts: 2

CVE-2026-2371

The Greenshift – animation and page builder blocks plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 12.8.3. This is due to missing authorization and post status validation in the `gspb_el_reusable_load()` AJAX handler. The handler accepts an arbitrary `post_id` parameter and renders the content of any `wp_block` post without checking `current_user_can('read_post', $post_id)` or verifying the post status. Combined with the nonce being ex

PUBLISHED

Vendor: wpsoul
Product: Greenshift – animation and page builder blocks
Provider severity: MEDIUM
Conflicts: 0

CVE-2026-23708

A improper authentication vulnerability in Fortinet FortiSOAR PaaS 7.6.0 through 7.6.3, FortiSOAR PaaS 7.5.0 through 7.5.2, FortiSOAR on-premise 7.6.0 through 7.6.3, FortiSOAR on-premise 7.5.0 through 7.5.2 may allow an unauthenticated attacker to bypass authentication via replaying captured 2FA request. The attack requires being able to intercept and decrypt authentication traffic and precise timing to replay the request before token expiration, which raises the attack complexity.

PUBLISHED

Vendor: Fortinet, Fortinet
Product: FortiSOAR on-premise, FortiSOAR PaaS
Provider severity: MEDIUM
Conflicts: 1

CVE-2026-23704

A non-administrative user can upload malicious files. When an administrator or the product accesses that file, an arbitrary script may be executed on the administrator's browser. Note that Movable Type 7 series and 8.4 series, which are End-of-Life (EOL), are affected by the vulnerability as well.

PUBLISHED

Vendor: Six Apart Ltd., Six Apart Ltd., Six Apart Ltd., Six Apart Ltd., Six Apart Ltd., Six Apart Ltd.
Product: Movable Type (Cloud Edition), Movable Type Premium (Cloud Edition), Movable Type Premium (Advanced Edition) (Software Edition), Movable Type Advanced (Software Edition), Movable Type Premium (Software Edition), Movable Type (Software Edition)
Provider severity: MEDIUM
Conflicts: 2

CVE-2026-23703

The installer of FinalCode Client provided by Digital Arts Inc. contains an incorrect default permissions vulnerability. A non-administrative user may execute arbitrary code with SYSTEM privilege.

PUBLISHED

Vendor: Digital Arts Inc., Digital Arts Inc.
Product: FinalCode Ver.6 series, FinalCode Ver.5 series
Provider severity: HIGH
Conflicts: 2

CVE-2026-23702

An OS command injection vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an authenticated attacker to achieve remote code execution on the system by sending malicious input injected into the server username field of the import preconfiguration action in the API V1 route.

PUBLISHED

Vendor: Copeland, Copeland, Copeland
Product: Copeland XWEB 500D PRO, Copeland XWEB 300D PRO, Copeland XWEB 500B PRO
Provider severity: HIGH
Conflicts: 1

CVE-2026-2370

A flaw was found in GitLab CE/EE. An authenticated user with minimal workspace permissions could exploit an improper authorization check within Jira Connect installations to obtain installation credentials and impersonate the GitLab application. This vulnerability could lead to unauthorized access and control over the GitLab app.

PUBLISHED

Vendor: Red Hat, Red Hat, Red Hat, GitLab
Product: OpenShift Pipelines, Red Hat OpenShift Container Platform 4, Red Hat OpenShift Container Platform 4, GitLab
Provider severity: HIGH
Conflicts: 2