CVE-2026-6527
ASN.1 PER protocol dissector crash in Wireshark 4.6.0 to 4.6.4 and 4.4.0 to 4.4.14 allows denial of service
PUBLISHED
- Vendor
- Wireshark Foundation
- Product
- Wireshark
- Provider severity
- MEDIUM
- Conflicts
- 0
Data & Insights
CVE Explorer
Search one exact, source-linked CVE snapshot by CVE ID or explicit vendor and product tokens. Provider severity, KEV, conflicts, and stale state remain separate observations—not a Baitaphish risk rating.
Exact snapshot results
353,537 CVE records
CVE-2026-6526
RTSP protocol dissector crash in Wireshark 4.6.0 to 4.6.4
PUBLISHED
- Vendor
- Wireshark Foundation
- Product
- Wireshark
- Provider severity
- MEDIUM
- Conflicts
- 0
CVE-2026-6525
IEEE 802.11 protocol dissector crash in Wireshark 4.6.0 to 4.6.4
PUBLISHED
- Vendor
- Wireshark Foundation
- Product
- Wireshark
- Provider severity
- MEDIUM
- Conflicts
- 0
CVE-2026-6524
MySQL protocol dissector crash in Wireshark 4.6.0 to 4.6.4 and 4.4.0 to 4.4.14 allows denial of service
PUBLISHED
- Vendor
- Wireshark Foundation
- Product
- Wireshark
- Provider severity
- MEDIUM
- Conflicts
- 0
CVE-2026-6523
GNW protocol dissector infinite loop in Wireshark 4.6.0 to 4.6.4 and 4.4.0 to 4.4.14 allows denial of service
PUBLISHED
- Vendor
- Wireshark Foundation
- Product
- Wireshark
- Provider severity
- MEDIUM
- Conflicts
- 0
CVE-2026-6522
RPKI-Router protocol dissector infinite loop in Wireshark 4.6.0 to 4.6.4 and 4.4.0 to 4.4.14 allows denial of service
PUBLISHED
- Vendor
- Wireshark Foundation
- Product
- Wireshark
- Provider severity
- MEDIUM
- Conflicts
- 0
CVE-2026-6521
OpenFlow v5 protocol dissector infinite loops in Wireshark 4.6.0 to 4.6.4 and 4.4.0 to 4.4.14 allows denial of service
PUBLISHED
- Vendor
- Wireshark Foundation
- Product
- Wireshark
- Provider severity
- MEDIUM
- Conflicts
- 0
CVE-2026-6520
OpenFlow v6 protocol dissector infinite loop in Wireshark 4.6.0 to 4.6.4 and 4.4.0 to 4.4.14 allows denial of service
PUBLISHED
- Vendor
- Wireshark Foundation
- Product
- Wireshark
- Provider severity
- MEDIUM
- Conflicts
- 0
CVE-2026-6519
MBIM protocol dissector infinite loop in Wireshark 4.6.0 to 4.6.4 and 4.4.0 to 4.4.14 allows denial of service
PUBLISHED
- Vendor
- Wireshark Foundation
- Product
- Wireshark
- Provider severity
- MEDIUM
- Conflicts
- 0
CVE-2026-6518
The CMP – Coming Soon & Maintenance Plugin by NiteoThemes plugin for WordPress is vulnerable to arbitrary file upload and remote code execution in all versions up to, and including, 4.1.16 via the `cmp_theme_update_install` AJAX action. This is due to the function only checking for the `publish_pages` capability (available to Editors and above) instead of `manage_options` (Administrators only), combined with a lack of proper validation on the user-supplied file URL and no verification of the dow
PUBLISHED
- Vendor
- niteo
- Product
- CMP – Coming Soon & Maintenance Plugin by NiteoThemes
- Provider severity
- HIGH
- Conflicts
- 0
CVE-2026-6517
Mattermost Desktop App versions <=6.1 5.5.13.0 fail to restrict the allow list of domains to which NTLM credentials were forwarded to in the Mattermost Desktop App which allows any user on a server without the image proxy enabled to intercept other users credentials via embedding an image that routes to an external web server. Mattermost Advisory ID: MMSA-2026-00651
PUBLISHED
- Vendor
- Mattermost
- Product
- Mattermost
- Provider severity
- MEDIUM
- Conflicts
- 0
CVE-2026-6516
Zohocorp ManageEngine ADAudit Plus versions before 8606 are affected by Unauthenticated Remote code execution due to the vulnerable agent API.
PUBLISHED
- Vendor
- Zohocorp
- Product
- ManageEngine ADAudit Plus
- Provider severity
- CRITICAL
- Conflicts
- 0
CVE-2026-6515
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 18.9.6, 18.10 before 18.10.4, and 18.11 before 18.11.1 that could have allowed a user to use invalidated or incorrectly scoped credentials to access Virtual Registries under certain conditions.
PUBLISHED
- Vendor
- GitLab
- Product
- GitLab
- Provider severity
- MEDIUM
- Conflicts
- 0
CVE-2026-6514
The InfusedWoo Pro plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 5.1.2 via the popup_submit. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
PUBLISHED
- Vendor
- Infused Addons
- Product
- InfusedWoo Pro
- Provider severity
- HIGH
- Conflicts
- 0
CVE-2026-6512
The InfusedWoo Pro plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 5.1.2. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to permanently delete arbitrary posts, pages, products, or orders, mass-delete all comments on any post, and change any post's status.
PUBLISHED
- Vendor
- Infused Addons
- Product
- InfusedWoo Pro
- Provider severity
- CRITICAL
- Conflicts
- 0
CVE-2026-6511
During an internal security assessment, a potential improper access control vulnerability was discovered in Lenovo Smart Connect for Windows that could allow a local authenticated user to access files owned by a different user on the same system.
PUBLISHED
- Vendor
- Lenovo
- Product
- Smart Connect
- Provider severity
- MEDIUM
- Conflicts
- 1
CVE-2026-65100
Apache Traffic Server updates the HTTP/2 HPACK dynamic table before confirming the header block encoded successfully, so an encode failure leaves the encoder out of sync with the peer decoder and corrupts subsequent header blocks on the connection. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.
PUBLISHED
- Vendor
- Apache Software Foundation
- Product
- Apache Traffic Server
- Provider severity
- MEDIUM
- Conflicts
- 1
CVE-2026-6510
The InfusedWoo Pro plugin for WordPress is vulnerable to privilege escalation via missing authorization in all versions up to, and including, 5.1.2. This is due to missing nonce verification and capability checks in the iwar_save_recipe() AJAX handler. This makes it possible for unauthenticated attackers to create a malicious automation recipe that pairs an HTTP post trigger with an auto-login action, allowing any unauthenticated visitor to visit a crafted URL and receive authentication cookies
PUBLISHED
- Vendor
- Infused Addons
- Product
- InfusedWoo Pro
- Provider severity
- CRITICAL
- Conflicts
- 0
CVE-2026-6509
Missing Authorization vulnerability in TUBITAK BILGEM Software Technologies Research Institute Pardus Update allows Privilege Escalation. This issue affects Pardus Update: from <=0.6.3 before 0.6.6.
PUBLISHED
- Vendor
- TUBITAK BILGEM Software Technologies Research Institute
- Product
- Pardus Update
- Provider severity
- HIGH
- Conflicts
- 0
CVE-2026-6508
Origin Validation Error vulnerability in TUBITAK BILGEM Software Technologies Research Institute Liderahenk allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Liderahenk: from 2.0.1 before 2.0.2.
PUBLISHED
- Vendor
- TUBITAK BILGEM Software Technologies Research Institute
- Product
- Liderahenk
- Provider severity
- CRITICAL
- Conflicts
- 0
CVE-2026-6507
A flaw was found in dnsmasq. A remote attacker could exploit an out-of-bounds write vulnerability by sending a specially crafted BOOTREPLY (Bootstrap Protocol Reply) packet to a dnsmasq server configured with the `--dhcp-split-relay` option. This can lead to memory corruption, causing the dnsmasq daemon to crash and resulting in a denial of service (DoS).
PUBLISHED
- Vendor
- Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat
- Product
- Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 9, Red Hat OpenShift Container Platform 4, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 6
- Provider severity
- HIGH
- Conflicts
- 1
CVE-2026-65069
Data::DisjointSet::Shared versions before 0.02 for Perl create a world-readable mmap backing file and open it without O_EXCL or O_NOFOLLOW. The segment is created in dsu.h with open(path, O_RDWR|O_CREAT, 0666). The mode is 0666, so under the default umask 022 the file is created mode 0644 (world-readable). O_NOFOLLOW is absent, so a symlink planted at the path is followed, and O_EXCL is absent, so the open silently uses a pre-planted file instead of failing. A "Shared" segment naturally lives
PUBLISHED
- Vendor
- EGOR
- Product
- Data::DisjointSet::Shared
- Provider severity
- MEDIUM
- Conflicts
- 1
CVE-2026-65068
Data::SpatialHash::Shared versions before 0.02 for Perl create a world-readable mmap backing file and open it without O_EXCL or O_NOFOLLOW. The segment is created in sphash.h with open(path, O_RDWR|O_CREAT, 0666). The mode is 0666, so under the default umask 022 the file is created mode 0644 (world-readable). O_NOFOLLOW is absent, so a symlink planted at the path is followed, and O_EXCL is absent, so the open silently uses a pre-planted file instead of failing. A "Shared" segment naturally liv
PUBLISHED
- Vendor
- EGOR
- Product
- Data::SpatialHash::Shared
- Provider severity
- LOW
- Conflicts
- 1
CVE-2026-65067
Data::Intern::Shared versions before 0.02 for Perl create a world-readable mmap backing file and open it without O_EXCL or O_NOFOLLOW. The segment is created in intern.h with open(path, O_RDWR|O_CREAT, 0666). The mode is 0666, so under the default umask 022 the file is created mode 0644 (world-readable). O_NOFOLLOW is absent, so a symlink planted at the path is followed, and O_EXCL is absent, so the open silently uses a pre-planted file instead of failing. A "Shared" segment naturally lives in
PUBLISHED
- Vendor
- EGOR
- Product
- Data::Intern::Shared
- Provider severity
- LOW
- Conflicts
- 1
CVE-2026-65066
Data::RingBuffer::Shared versions before 0.04 for Perl create a world-readable mmap backing file and open it without O_EXCL or O_NOFOLLOW. The segment is created in ring.h with open(path, O_RDWR|O_CREAT, 0666). The mode is 0666, so under the default umask 022 the file is created mode 0644 (world-readable). O_NOFOLLOW is absent, so a symlink planted at the path is followed, and O_EXCL is absent, so the open silently uses a pre-planted file instead of failing. A "Shared" segment naturally lives
PUBLISHED
- Vendor
- EGOR
- Product
- Data::RingBuffer::Shared
- Provider severity
- LOW
- Conflicts
- 1
CVE-2026-65065
Data::RoaringBitmap::Shared versions before 0.02 for Perl create a world-readable mmap backing file and open it without O_EXCL or O_NOFOLLOW. The segment is created in roaring.h with open(path, O_RDWR|O_CREAT, 0666). The mode is 0666, so under the default umask 022 the file is created mode 0644 (world-readable). O_NOFOLLOW is absent, so a symlink planted at the path is followed, and O_EXCL is absent, so the open silently uses a pre-planted file instead of failing. A "Shared" segment naturally
PUBLISHED
- Vendor
- EGOR
- Product
- Data::RoaringBitmap::Shared
- Provider severity
- MEDIUM
- Conflicts
- 1
CVE-2026-65064
Data::HashMap::Shared versions before 0.14 for Perl create a world-readable mmap backing file and open it without O_EXCL or O_NOFOLLOW. The segment is created in shm_generic.h with open(path, O_RDWR | O_CREAT | O_CLOEXEC, 0666). The mode is 0666, so under the default umask 022 the file is created mode 0644 (world-readable). O_NOFOLLOW is absent, so a symlink planted at the path is followed, and O_EXCL is absent, so the open silently uses a pre-planted file instead of failing. A "Shared" segmen
PUBLISHED
- Vendor
- EGOR
- Product
- Data::HashMap::Shared
- Provider severity
- LOW
- Conflicts
- 1
CVE-2026-65063
Data::RadixTree::Shared versions before 0.02 for Perl create a world-readable mmap backing file and open it without O_EXCL or O_NOFOLLOW. The segment is created in radix.h with open(path, O_RDWR|O_CREAT, 0666). The mode is 0666, so under the default umask 022 the file is created mode 0644 (world-readable). O_NOFOLLOW is absent, so a symlink planted at the path is followed, and O_EXCL is absent, so the open silently uses a pre-planted file instead of failing. A "Shared" segment naturally lives
PUBLISHED
- Vendor
- EGOR
- Product
- Data::RadixTree::Shared
- Provider severity
- LOW
- Conflicts
- 1
CVE-2026-65062
Data::SortedSet::Shared versions before 0.03 for Perl create a world-readable mmap backing file and open it without O_EXCL or O_NOFOLLOW. The segment is created in sortedset.h with open(path, O_RDWR|O_CREAT, 0666). The mode is 0666, so under the default umask 022 the file is created mode 0644 (world-readable). O_NOFOLLOW is absent, so a symlink planted at the path is followed, and O_EXCL is absent, so the open silently uses a pre-planted file instead of failing. A "Shared" segment naturally li
PUBLISHED
- Vendor
- EGOR
- Product
- Data::SortedSet::Shared
- Provider severity
- LOW
- Conflicts
- 1
CVE-2026-65061
Data::ReqRep::Shared versions before 0.05 for Perl create a world-readable mmap backing file and open it without O_EXCL or O_NOFOLLOW. The segment is created in reqrep.h with open(path, O_RDWR | O_CREAT, 0666), for both the request-reply and the integer-variant segments. The mode is 0666, so under the default umask 022 the file is created mode 0644 (world-readable). O_NOFOLLOW is absent, so a symlink planted at the path is followed, and O_EXCL is absent, so the open silently uses a pre-planted
PUBLISHED
- Vendor
- EGOR
- Product
- Data::ReqRep::Shared
- Provider severity
- LOW
- Conflicts
- 1
CVE-2026-6506
The InfusedWoo Pro plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 5.1.2. This is due to the infusedwoo_gdpr_upddata() function missing authorization and capability checks, as well as lacking restrictions on which user meta keys can be updated. This makes it possible for authenticated attackers, with subscriber-level access and above, to update their own wp_capabilities user meta to grant themselves Administrator role privileges.
PUBLISHED
- Vendor
- Infused Addons
- Product
- InfusedWoo Pro
- Provider severity
- HIGH
- Conflicts
- 0
CVE-2026-65058
Trezor Safe 3, Safe 5, and Safe 7 firmware contains a confirmation-binding flaw in the Ethereum sign_tx / sign_tx_eip1559 flow. For contract interactions, the device confirms only the initial calldata chunk while the signature commits to the full streamed calldata. An attacker could present calldata to a victim then supply a different tail that changes the signed transaction. Fixed in 70c9b0c.
PUBLISHED
- Vendor
- Trezor, Trezor, Trezor
- Product
- Safe 7, Safe 3, Safe 5
- Provider severity
- MEDIUM
- Conflicts
- 2
CVE-2026-65057
Keep (commit 91c75e0) contains a server-side request forgery vulnerability that allows unauthenticated attackers to make the backend issue arbitrary HTTP requests by supplying attacker-controlled host values to the unprotected healthcheck endpoint. Attackers can send a crafted JSON payload with a malicious host parameter to cause the backend to issue outbound requests to internal services or cloud metadata endpoints, enabling theft of cloud credentials and internal network reconnaissance.
PUBLISHED
- Vendor
- keephq
- Product
- keep
- Provider severity
- CRITICAL
- Conflicts
- 1
CVE-2026-65056
mcp-webresearch 0.1.7 contains a server-side request forgery vulnerability that allows attackers to access internal network services by supplying loopback, link-local, or cloud metadata addresses to the visit_page tool, which only validates the URL protocol without filtering private or reserved IP ranges. Attackers can steer the LLM-controlled URL argument through prompt injection to navigate the server's Playwright browser to internal endpoints such as cloud instance metadata services, causing
PUBLISHED
- Vendor
- mzxrai
- Product
- mcp-webresearch
- Provider severity
- HIGH
- Conflicts
- 1
CVE-2026-65055
Taiga 6.10.1 contains a missing authorization vulnerability that allows unauthenticated attackers to disclose the full member roster and internal workflow configuration of any private project by supplying a project ID to the filters_data API endpoints on UserStory, Task, Issue, and Epic viewsets. Attackers can send unauthenticated GET requests to the filters_data endpoints with sequential integer project IDs to enumerate private project membership details including user IDs, full names, and grav
PUBLISHED
- Vendor
- Taiga
- Product
- taiga-back
- Provider severity
- MEDIUM
- Conflicts
- 1
CVE-2026-65054
MediaCMS 8.2.0 contains an information disclosure vulnerability that allows authenticated users to expose private media metadata belonging to other users by adding arbitrary media tokens to their own playlist without access control checks. Attackers can issue a PUT request to the playlist API endpoint with a known media token to bypass state and ownership validation, then retrieve the playlist to read private media fields including title, description, view count, like count, file size, author us
PUBLISHED
- Vendor
- MediaCMS
- Product
- MediaCMS
- Provider severity
- HIGH, LOW
- Conflicts
- 1
CVE-2026-65052
Ninja Forms WordPress plugin version 3.14.8 and prior contains an improper input validation vulnerability that allows unauthenticated attackers to inject arbitrary numeric values into form calculations and payment totals by submitting values that do not match any configured option in ListSelect or ListRadio fields. Attackers can tamper with form submission payloads to the ajax submit endpoint, causing the get_calc_value() method to fail open and return attacker-controlled values, enabling manipu
PUBLISHED
- Vendor
- Saturday Drive
- Product
- Ninja Forms
- Provider severity
- HIGH
- Conflicts
- 1
CVE-2026-65051
Ninja Forms WordPress plugin version 3.14.8 contains a client-side enforcement of server-side security vulnerability that allows unauthenticated attackers to bypass all form validation by merging attacker-controlled field metadata over server-loaded form definitions before validation runs. Attackers can craft a malicious AJAX submission overriding field types, removing required flags, and disabling CAPTCHA checks through the nopriv AJAX endpoint to trigger form actions such as email notification
PUBLISHED
- Vendor
- Saturday Drive
- Product
- Ninja Forms
- Provider severity
- MEDIUM
- Conflicts
- 1
CVE-2026-65050
Ninja Forms WordPress plugin version 3.14.8 and prior contains a missing authorization vulnerability in the render callback of the `ninja-forms/submissions-table` Gutenberg block that allows authenticated attackers with Author-level privileges to expose stored form submissions to unauthenticated visitors by embedding the block with an arbitrary formID on a published post. Attackers can retrieve the signed bearer token injected into every page visitor's browser via `wp_localize_script` and use it
PUBLISHED
- Vendor
- Saturday Drive
- Product
- Ninja Forms
- Provider severity
- HIGH, MEDIUM
- Conflicts
- 1
CVE-2026-65049
Ninja Forms plugin version 3.14.8 and prior for WordPress Multisite contains an incorrect authorization vulnerability that allows a subsite Administrator to trigger network-wide deletion of all Ninja Forms data by exploiting a site-scoped capability check combined with unsafe multisite migration defaults. Attackers can send a crafted POST request to the admin-ajax.php endpoint with the nf_delete_all_data action and a per-site nonce to invoke migration routines that unconditionally iterate all bl
PUBLISHED
- Vendor
- Saturday Drive
- Product
- Ninja Forms
- Provider severity
- CRITICAL, HIGH
- Conflicts
- 1
CVE-2026-65048
Ninja Forms plugin for WordPress versions 3.10.4 through 3.14.9 contains an unauthenticated stored cross-site scripting vulnerability in the Repeatable Fieldset feature where parseSubmissionIndex() accepts arbitrary strings as submission indexes without numeric validation, and admin_form_element() interpolates the index directly into HTML without escaping. An unauthenticated attacker can submit a public form with a crafted repeater child key containing malicious script payloads, which execute in
PUBLISHED
- Vendor
- Saturday Drive
- Product
- Ninja Forms
- Provider severity
- CRITICAL
- Conflicts
- 1
CVE-2026-6504
The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'title_tag' parameter in all versions up to, and including, 1.7.1058 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PUBLISHED
- Vendor
- wproyal
- Product
- Royal Addons for Elementor – Addons and Templates Kit for Elementor
- Provider severity
- MEDIUM
- Conflicts
- 0
CVE-2026-65016
n8n versions before 1.123.64, 2.29.8, and 2.30.1 contain a privilege escalation vulnerability in Enterprise SSO instance-role provisioning. The provisioning path maps an IdP-asserted role claim to an n8n global role but does not prevent assignment of the global:owner role (unlike the token-exchange identity path, which rejects it). An SSO-authenticated user whose instance-role claim resolves to global:owner is provisioned as instance owner, gaining full administrative control over workflows, cre
PUBLISHED
- Vendor
- n8n-io, n8n-io, n8n-io
- Product
- n8n, n8n, n8n
- Provider severity
- HIGH
- Conflicts
- 1
CVE-2026-65015
n8n versions before 2.30.1 contain a privilege escalation vulnerability in the AI Agents feature where the node-execution tool lacks proper authorization checks. A Project Viewer user can escalate privileges by chatting with an agent that has node tools enabled, executing arbitrary nodes and accessing credential secrets without proper authorization verification.
PUBLISHED
- Vendor
- n8n-io, n8n-io
- Product
- n8n, n8n
- Provider severity
- HIGH
- Conflicts
- 1
CVE-2026-65014
n8n before 2.28.0 (and before 2.27.4 on the 2.27.x branch) registers the DELETE /${restEndpoint}/test-webhook/:id endpoint before authentication middleware is applied, allowing any unauthenticated network caller who knows a workflow ID to cancel that workflow's active test webhook registration. The impact is limited to disrupting in-progress test sessions; production webhooks, persistent workflow state, and stored data are not affected.
PUBLISHED
- Vendor
- n8n-io, n8n-io
- Product
- n8n, n8n
- Provider severity
- MEDIUM
- Conflicts
- 1
CVE-2026-65013
Onlook through 0.2.32, fixed in commit 423e2e9, contains a broken object level authorization vulnerability that allows authenticated attackers to access and manipulate other users' resources by supplying arbitrary UUID values to tRPC API procedures including project.get, member.remove, and chat.conversation.delete. Attackers can provide arbitrary projectId or conversationId values without authorization validation to read, modify, and delete other users' project data, members, and conversation hi
PUBLISHED
- Vendor
- onlook
- Product
- repo
- Provider severity
- HIGH
- Conflicts
- 1
CVE-2026-65012
InvokeAI before 6.13.7 contains an unauthenticated directory enumeration vulnerability in the GET /api/v2/models/scan_folder endpoint that accepts attacker-controlled scan_path parameters. Unauthenticated attackers can recursively enumerate arbitrary server filesystem directories and use HTTP response codes to determine file existence and readability, bypassing multi-user mode access controls.
PUBLISHED
- Vendor
- invoke-ai
- Product
- InvokeAI
- Provider severity
- MEDIUM
- Conflicts
- 1
CVE-2026-65011
Graylog2 Server before commit 46a2eeb contains a missing per-entity permission check in the POST /events/definitions/{definitionId}/duplicate endpoint that allows authenticated users to clone any event definition. Attackers with the low-privilege eventdefinitions:create capability can read private event definitions including detection queries, aggregation thresholds, grouping fields, schedules, and notification bindings by duplicating them.
PUBLISHED
- Vendor
- Graylog2
- Product
- graylog2-server
- Provider severity
- MEDIUM
- Conflicts
- 1
CVE-2026-65010
Datasets through 5.00, fixed in commit ad2d853, contains a symlink-following vulnerability in Extractor.extract() that allows local attackers to write arbitrary files by pre-planting symlinks at predictable output paths. Attackers can redirect archive extraction to arbitrary filesystem locations in shared-cache environments, enabling overwrite of sensitive files and potential privilege escalation or code execution.
PUBLISHED
- Vendor
- huggingface
- Product
- datasets
- Provider severity
- MEDIUM
- Conflicts
- 1
CVE-2026-6501
Improper restriction of XML external entity reference vulnerability in ILM Informatique jOpenDocument allows Data Serialization External Entities Blowup. This issue affects jOpenDocument: 1.5.
PUBLISHED
- Vendor
- ILM Informatique
- Product
- jOpenDocument
- Provider severity
- MEDIUM
- Conflicts
- 0