CVE-2026-12576
DVP80ES3 with Improper Enforcement of Message Integrity During Transmission in a Communication Channel vulnerability.
PUBLISHED
- Vendor
- deltaww
- Product
- DVP80ES3
- Provider severity
- HIGH
- Conflicts
- 0
Data & Insights
CVE Explorer
Search one exact, source-linked CVE snapshot by CVE ID or explicit vendor and product tokens. Provider severity, KEV, conflicts, and stale state remain separate observations—not a Baitaphish risk rating.
Exact snapshot results
353,537 CVE records
CVE-2026-12575
DVP80ES3 with Improper Resource Shutdown or Release vulnerability.
PUBLISHED
- Vendor
- deltaww
- Product
- DVP80ES3
- Provider severity
- HIGH
- Conflicts
- 0
CVE-2026-1257
The Administrative Shortcodes plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 0.3.4 via the 'slug' attribute of the 'get_template' shortcode. This is due to insufficient path validation on user-supplied input passed to the get_template_part() function. This makes it possible for authenticated attackers, with Contributor-level access and above, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those fil
PUBLISHED
- Vendor
- shazdeh
- Product
- Administrative Shortcodes
- Provider severity
- HIGH
- Conflicts
- 0
CVE-2026-12569
A critical remote code execution (RCE) vulnerability has been reported in PTC Windchill PDMlink and PTC FlexPLM. The vulnerability may be exploited through the deserialization of untrusted data. * This advisory also applies to all CPS versions * The identified vulnerability also impacts Windchill and FlexPLM releases prior to 11.0 M030
PUBLISHEDCISA KEV
- Vendor
- PTC, PTC
- Product
- FlexPLM, Windchill PDMLink
- Provider severity
- CRITICAL
- Conflicts
- 2
CVE-2026-12568
The postman_download module uses the workspace name field from the Postman API to construct the local directory path without sanitization. If a malicious workspace has a name containing path traversal characters, pathlib resolves the path outside the intended output directory, allowing an attacker to write arbitrary files to the user's system.
PUBLISHED
- Vendor
- Black Lantern Security
- Product
- BBOT
- Provider severity
- MEDIUM
- Conflicts
- 0
CVE-2026-12567
The github_workflows module constructs local directory paths from user-controlled repository names without validating for symlinks. A local attacker sharing the scan directory can plant a symlink at the predictable output path, causing workflow data to be written to an attacker-chosen location.
PUBLISHED
- Vendor
- Black Lantern Security
- Product
- BBOT
- Provider severity
- LOW
- Conflicts
- 0
CVE-2026-12566
The docker_pull module uses the realm parameter from a Docker registry's WWW-Authenticate response header as the authentication endpoint without validation. An attacker in a man-in-the-middle position between bbot and a Docker registry could modify this header to redirect the authentication request to an arbitrary endpoint, potentially leaking authentication tokens.
PUBLISHED
- Vendor
- Black Lantern Security
- Product
- BBOT
- Provider severity
- LOW
- Conflicts
- 0
CVE-2026-12565
The unarchive internal module's archive extraction commands perform no code-level validation on extracted file paths, relying entirely on the behavior of external tools (e.g. GNU tar) which varies by platform. While CVE-2025-10284 addressed git-specific RCE vectors, the underlying archive extraction path traversal was never fixed. On systems with GNU tar < 1.34 (Ubuntu 20.04, Debian Buster, CentOS 7, many Docker base images), a malicious archive can write files outside the intended extraction di
PUBLISHED
- Vendor
- Black Lantern Security
- Product
- BBOT
- Provider severity
- MEDIUM
- Conflicts
- 0
CVE-2026-12562
The RCU II+ and Multiload II+ are vulnerable to an unauthenticated service that exposes a debug interface granting full root-level access to the embedded system. This vulnerability stems from a network-accessible port running a Target Communications Framework (TCF) service that does not require any authentication, allowing an attacker to directly interact with the Linux environment that powers the device. Once connected, an attacker can freely view and modify the filesystem, manipulate ru
PUBLISHED
- Vendor
- Toptech Systems, Toptech Systems
- Product
- RCU II+, Multiload II+
- Provider severity
- HIGH
- Conflicts
- 2
CVE-2026-12560
The Editorial Rating – Product Review & Rating System plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'Link URL' Field in all versions up to, and including, 4.0.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The WordPress unfiltered_html capability exemption does no
PUBLISHED
- Vendor
- wpqode
- Product
- Editorial Rating – Product Review & Rating System
- Provider severity
- MEDIUM
- Conflicts
- 0
CVE-2026-12557
The Ninja Forms - File Uploads plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.3.29. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to read all plugin debug log entries stored in the wp_nf3_log table or permanently delete all rows from that table.
PUBLISHED
- Vendor
- SaturdayDrive
- Product
- Ninja Forms - File Uploads
- Provider severity
- MEDIUM
- Conflicts
- 0
CVE-2026-12549
The fix for CVE-2026-2443 was regressed by a subsequent rework commit that replaced specific overflow checks with a general signed comparison. When a client sends a Range request with a suffix length exceeding the content size, the resulting negative start value is not properly clamped, leading to malformed HTTP 206 responses and log flooding.
PUBLISHED
- Vendor
- Red Hat, Red Hat, Red Hat, Red Hat, Red Hat
- Product
- Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 10
- Provider severity
- MEDIUM
- Conflicts
- 1
CVE-2026-12548
A heap out-of-bounds read flaw was found in libsoup. When parsing multipart HTTP messages, an integer type mismatch between the caller and soup_headers_parse() can cause the length parameter to be incorrectly truncated, leading to a heap buffer over-read. A remote attacker could use this flaw to crash an application using libsoup or potentially disclose heap memory contents.
PUBLISHED
- Vendor
- Red Hat
- Product
- Red Hat Enterprise Linux 10
- Provider severity
- MEDIUM
- Conflicts
- 0
CVE-2026-12547
SoupAuthManager caches proxy authentication credentials without scoping them to the proxy authority (host:port). When the proxy configuration changes (e.g., via system settings or WPAD), cached Proxy-Authorization headers from the previous proxy are sent to the new proxy, leaking credentials.
PUBLISHED
- Vendor
- Red Hat
- Product
- Red Hat Enterprise Linux 10
- Provider severity
- LOW
- Conflicts
- 0
CVE-2026-1254
The Modula Image Gallery – Photo Grid & Video Gallery plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.13.6. This is due to the plugin not properly verifying that a user is authorized to modify specific posts before updating them via the REST API. This makes it possible for authenticated attackers, with contributor level access and above, to update the title, excerpt, and content of arbitrary posts by passing post IDs in the modulaImages field wh
PUBLISHED
- Vendor
- wpchill
- Product
- Modula Image Gallery – Photo Grid & Video Gallery
- Provider severity
- MEDIUM
- Conflicts
- 0
CVE-2026-12539
Docker Sandboxes (sbx) blocks ICMP egress with an authorizer applied only at network-creation time, and does not re-apply it to networks rebuilt from disk when the Docker daemon restarts, so a restart-surviving sandbox forwards ICMP to arbitrary hosts. A workload inside a sandbox, which the threat model treats as untrusted, can therefore defeat the documented ICMP egress block to perform network reconnaissance and exfiltrate data over an ICMP covert channel, regardless of the configured allowlis
PUBLISHED
- Vendor
- Docker
- Product
- Docker Sandboxes
- Provider severity
- MEDIUM
- Conflicts
- 1
CVE-2026-12537
Improper Neutralization used in an OS Command in the container launcher in Google Gemini CLI (versions prior to 0.39.1) and run-gemini-cli GitHub Action (versions prior to 0.1.22) on headless CI platforms allows an unprivileged attacker to achieve pre-sandbox host-level code execution a maliciously crafted .gemini/.env file.
PUBLISHED
- Vendor
- Google Cloud, Google Cloud
- Product
- Gemini CLI, run-gemini-cli GitHub Action
- Provider severity
- CRITICAL
- Conflicts
- 1
CVE-2026-12536
The Avada (Fusion) Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘Module Title’ parameter in all versions up to, and including, 3.15.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PUBLISHED
- Vendor
- themefusion
- Product
- Avada (Fusion) Builder
- Provider severity
- MEDIUM
- Conflicts
- 0
CVE-2026-12535
Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Formatter Field allows Object Injection. This issue affects Formatter Field versions: from 0.0.0 to 2.0.0.
PUBLISHED
- Vendor
- Drupal
- Product
- Formatter Field
- Provider severity
- CRITICAL
- Conflicts
- 0
CVE-2026-12530
Improper neutralization of argument delimiters in the install_packages() method in AWS Bedrock AgentCore Python SDK versions >= 1.1.3 and < 1.6.1 might allow a remote authenticated user to execute arbitrary commands within the Code Interpreter sandbox via crafted package name arguments. To mitigate this issue, users should upgrade to version 1.6.1.
PUBLISHED
- Vendor
- AWS
- Product
- bedrock-agentcore
- Provider severity
- HIGH
- Conflicts
- 1
CVE-2026-1253
The Group Chat & Video Chat by AtomChat plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'atomchat_update_auth_ajax' and 'atomchat_update_layout_ajax' functions in all versions up to, and including, 1.1.7. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update plugin options, including critical settings such as API keys, authentication keys, and layout configurations.
PUBLISHED
- Vendor
- atomchat
- Product
- Group Chat & Video Chat by AtomChat
- Provider severity
- MEDIUM
- Conflicts
- 0
CVE-2026-12529
A security vulnerability has been detected in SourceCodester CET Automated Grading System with AI Predictive Analytics 1.0. Affected is an unknown function of the file /index.php of the component Student Self-Registration Endpoint. The manipulation leads to improper access controls. Remote exploitation of the attack is possible.
PUBLISHED
- Vendor
- SourceCodester
- Product
- CET Automated Grading System with AI Predictive Analytics
- Provider severity
- HIGH, MEDIUM
- Conflicts
- 2
CVE-2026-12528
A flaw was found in 389 Directory Server in the __aclp__normalize_acltxt() function of aclparse.c. A malformed ACI (Access Control Instruction) string can trigger heap-buffer-overflow writes and reads during ACI parsing. The function fails to validate that the ACI keyword has sufficient length after whitespace stripping, leading to a 1-byte out-of-bounds write and subsequent out-of-bounds reads. An authenticated user with write access to the aci attribute could send a crafted ACI value to silent
PUBLISHED
- Vendor
- Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat
- Product
- Red Hat Enterprise Linux 8, Red Hat Directory Server 12, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 9, Red Hat Directory Server 11, Red Hat Directory Server 13, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 6
- Provider severity
- MEDIUM
- Conflicts
- 1
CVE-2026-12527
A broken authorization boundary in the RTSP media delivery pipeline of Shenzhen Liandian Communication Technology LTD V380 IP Camera firmware AppFHE1_V1.0.6.020230803 enables unauthenticated network actors to bypass the device’s credential-enforced live-view workflow and directly retrieve real-time video stream data.
PUBLISHED
- Vendor
- Shenzhen Liandian Communication Technology LTD
- Product
- V380 IP Camera / AppFHE1_V1.0.6.0
- Provider severity
- MEDIUM
- Conflicts
- 0
CVE-2026-12525
The Redux Framework WordPress plugin before 4.5.13 does not restrict which user meta keys can be written when saving custom profile fields, allowing users with at least the Subscriber role to escalate their privileges to Administrator by submitting a crafted value while updating their own profile, on sites where the Redux Framework WordPress plugin before 4.5.13's user-profile (Users extension) feature is enabled.
PUBLISHED
- Vendor
- Unknown
- Product
- Redux Framework
- Provider severity
- HIGH
- Conflicts
- 1
CVE-2026-12523
Summary Cloudflare quiche's HTTP/3 layer was discovered to be vulnerable to resource exhaustion (i.e., memory) by means of specially crafted HTTP/3 frames. Impact HTTP/3 defines multiple frame types to support HTTP message exchanges and connection management. Each frame has a length and a payload whose length depends on the frame type. quiche was found to be vulnerable when parsing some frame types to pre-allocating memory based on the declared length. An attacker would not need to sen
PUBLISHED
- Vendor
- Cloudflare
- Product
- quiche
- Provider severity
- HIGH
- Conflicts
- 0
CVE-2026-1252
The Events Listing Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Event URL' parameter in all versions up to, and including, 1.3.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PUBLISHED
- Vendor
- jackdewey
- Product
- Events Listing Widget
- Provider severity
- MEDIUM
- Conflicts
- 0
CVE-2026-12517
The Fediverse Embeds WordPress plugin before 1.5.8 does not validate the destination of the server-side request performed by an unauthenticated site-info endpoint before fetching it, allowing anonymous users (the gating nonce is exposed on public pages carrying an embed) to make the site request internal and private-network URLs and read back the parsed page metadata. This is a Server-Side Request Forgery.
PUBLISHED
- Vendor
- Unknown
- Product
- Fediverse Embeds
- Provider severity
- MEDIUM
- Conflicts
- 0
CVE-2026-12516
The Fediverse Embeds WordPress plugin before 1.5.8 does not validate the destination of the server-side request performed by an unauthenticated media-proxying endpoint, allowing anonymous users to make the site fetch arbitrary URLs, including internal and private-network addresses, and read back the response body. This results in a full-read Server-Side Request Forgery and open proxy.
PUBLISHED
- Vendor
- Unknown
- Product
- Fediverse Embeds
- Provider severity
- MEDIUM
- Conflicts
- 0
CVE-2026-12515
A flaw was found in Katello's of Red Hat Satellite. A content upload functionality where insufficient authorization checks in the ContentUploadsController allowed users with the edit_products permission to query content information for repositories outside the products they were authorized to manage. An authenticated attacker could exploit this issue to determine whether specific content exists within repositories that should otherwise be inaccessible. This issue does not allow unauthorized modi
PUBLISHED
- Vendor
- Red Hat, Red Hat, Red Hat
- Product
- Red Hat Satellite 6, Red Hat Hardened Images, Red Hat Satellite 6
- Provider severity
- MEDIUM
- Conflicts
- 1
CVE-2026-12512
The Quotes llama WordPress plugin before 3.1.6 does not properly sanitize and escape a user-supplied parameter before using it in a SQL query, allowing unauthenticated attackers to perform UNION-based SQL injection and read arbitrary data from the database, including password hashes.
PUBLISHED
- Vendor
- Unknown
- Product
- Quotes llama
- Provider severity
- HIGH
- Conflicts
- 1
CVE-2026-12511
The AI Engine WordPress plugin before 3.5.5 does not sanitize a user-supplied filename before using it to write a downloaded file, allowing authenticated users with editor-level access to write attacker-controlled bytes to an arbitrary location on the server via path traversal.
PUBLISHED
- Vendor
- Unknown
- Product
- AI Engine
- Provider severity
- HIGH
- Conflicts
- 0
CVE-2026-12510
The AI Engine WordPress plugin before 3.5.5 does not verify that a user owns the chatbot conversation referenced by a client-supplied identifier, allowing users with subscriber-level access to read other users' private conversations and take over their conversation records when the discussions feature is enabled.
PUBLISHED
- Vendor
- Unknown
- Product
- AI Engine
- Provider severity
- MEDIUM
- Conflicts
- 1
CVE-2026-1251
The SupportCandy – Helpdesk & Customer Support Ticket System plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.4.4 via the 'add_reply' function due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with subscriber-level access and above, to steal file attachments uploaded by other users by specifying arbitrary attachment IDs in the 'description_attachments' parameter, re-associating tho
PUBLISHED
- Vendor
- psmplugins
- Product
- SupportCandy – Helpdesk & Customer Support Ticket System
- Provider severity
- MEDIUM
- Conflicts
- 0
CVE-2026-12505
A flaw was found in the cifs-utils package where the cifs.upcall helper fails to securely drop its root privileges before looking up user information inside a user-controlled environment. A local, low privileged attacker can exploit this by using a crafted request_key payload to trick the root-owned helper into entering a custom environment (namespace) containing a malicious NSS module. This forces the system to load the attacker's controlled NSS Module and configuration, allowing them to execut
PUBLISHED
- Vendor
- Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat
- Product
- Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 9, Red Hat OpenShift Container Platform 4.22, Red Hat Enterprise Linux 7, Red Hat OpenShift Container Platform 4.22, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 10
- Provider severity
- HIGH
- Conflicts
- 1
CVE-2026-12504
Improper Authentication (CWE-287) in the PAM configuration in Loytec LIP-ME201C, L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.16 on LINX-A64 allows a local attacker to authenticate as a uid=0 account without a password and obtain a root shell via an `/etc/passwd` entry with an empty password field.
PUBLISHED
- Vendor
- Loytec, Loytec, Loytec, Loytec, Loytec, Loytec, Loytec, Loytec
- Product
- L-INX, L-PAD, L-VIS, L-GATE, L-DALI, LIP-ME20xC, L-IOB, L-ROC
- Provider severity
- HIGH
- Conflicts
- 2
CVE-2026-12503
Improper Link Resolution (CWE-59) in `/usr/bin/larm_starter` in Loytec L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.16 on LINX-A64 allows an authenticated `larmapp` attacker to make `/etc/passwd` writable by the `larmapp` group (leading to root privilege escalation) via a symlink attack on `/etc/lighttpd/ssl/server.pem`.
PUBLISHED
- Vendor
- Loytec, Loytec, Loytec, Loytec, Loytec, Loytec, Loytec, Loytec
- Product
- L-VIS, L-INX, LIP-ME20xC, L-DALI, L-GATE, L-IOB, L-PAD, L-ROC
- Provider severity
- CRITICAL
- Conflicts
- 1
CVE-2026-12502
Improper Privilege Management (CWE-269) in `/usr/bin/ltsudo` in Loytec LIP-ME201C, L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.16 on LINX-A64 allows a `superadmin`-group attacker to reset the password of any LARM user (including the `larmapp` service account) via the `set-passwd` subcommand.
PUBLISHED
- Vendor
- Loytec, Loytec, Loytec, Loytec, Loytec, Loytec, Loytec, Loytec
- Product
- L-GATE, L-DALI, LIP-ME20xC, L-VIS, L-INX, L-ROC, L-PAD, L-IOB
- Provider severity
- HIGH
- Conflicts
- 1
CVE-2026-12500
The WP Travel Engine WordPress plugin before 6.8.2 does not perform a capability check on an AJAX action that updates a WP Travel Engine WordPress plugin before 6.8.2 option, allowing unauthenticated users to overwrite a site-wide WP Travel Engine WordPress plugin before 6.8.2 option (the public nonce that gates the action is served to anonymous visitors).
PUBLISHED
- Vendor
- Unknown
- Product
- WP Travel Engine
- Provider severity
- HIGH
- Conflicts
- 1
CVE-2026-1250
The Court Reservation – Manage Your Court Bookings Online plugin for WordPress is vulnerable to generic SQL Injection via the ‘id’ parameter in all versions up to, and including, 1.10.11 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
PUBLISHED
- Vendor
- webmuehle
- Product
- Court Reservation – Manage Your Court Bookings Online
- Provider severity
- HIGH
- Conflicts
- 0
CVE-2026-12497
The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content WordPress plugin before 4.16.18 does not consistently enforce the role restriction configured on its front-end registration role-selection field. The set of roles offered to the visitor and the set of roles the registration handler accepts are derived by two different parsers, and for some valid ways of configuring the offered roles the handler ignores the restriction and falls back to acc
PUBLISHED
- Vendor
- Unknown
- Product
- Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content
- Provider severity
- HIGH
- Conflicts
- 1
CVE-2026-12496
Stored Cross-Site Scripting (CWE-79) in the OPC XML-DA server statistics in Loytec LIP-ME201C, L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.16 on LINX-A64 allows an unauthenticated remote attacker to execute arbitrary JavaScript in an administrator's browser (session hijacking, credential theft, device reconfiguration) via a crafted `User-Agent` header in a `POST /da` request.
PUBLISHED
- Vendor
- Loytec, Loytec, Loytec, Loytec, Loytec, Loytec, Loytec, Loytec
- Product
- L-GATE, L-PAD, L-INX, L-DALI, L-ROC, LIP-ME20xC, L-IOB, L-VIS
- Provider severity
- HIGH
- Conflicts
- 2
CVE-2026-12495
Denial-of-service (DoS) vulnerability due to a stack buffer overflow in the http_gdpr_decrypt function of the Mercusys MB115-4G device's web interface. An unauthenticated attacker could exploit this vulnerability by sending a specially crafted request to the /cgi/login endpoint, causing memory corruption and the httpd process to crash, resulting in a denial of service for the web administration service.
PUBLISHED
- Vendor
- Mercusys
- Product
- MB115-4G
- Provider severity
- MEDIUM
- Conflicts
- 0
CVE-2026-12493
The Clover Payment Gateway by Zaytech for WooCommerce WordPress plugin before 1.3.6 does not verify that an approved external payment record actually belongs to the WooCommerce order being completed, nor that the paid amount matches the order total, allowing unauthenticated users to mark arbitrary orders as paid by replaying a single genuinely-approved payment reference (for example one obtained from their own minimal purchase).
PUBLISHED
- Vendor
- Unknown
- Product
- Clover Payment Gateway by Zaytech for WooCommerce
- Provider severity
- HIGH
- Conflicts
- 1
CVE-2026-12492
The Happy Coders OTP Login for WooCommerce WordPress plugin before 2.8 does not verify that a one-time password was actually validated before authenticating a user based on a supplied identifier, allowing unauthenticated attackers to log in as any existing user, including administrators, as well as to create new accounts.
PUBLISHED
- Vendor
- Unknown
- Product
- Happy Coders OTP Login for WooCommerce
- Provider severity
- CRITICAL
- Conflicts
- 1
CVE-2026-12491
A flaw was found in vLLM, an open-source library for large language model inference. This vulnerability arises from improper handling of image metadata, specifically EXIF orientation and PNG transparency (tRNS) data, during image processing. When images are converted to RGB, transparency information may be implicitly discarded or remapped, leading to unexpected rendering of transparent pixels and distortion of input content. This can result in the model misinterpreting image content, potentially
PUBLISHED
- Vendor
- Red Hat, Red Hat, vllm-project, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat
- Product
- Red Hat Enterprise Linux AI (RHEL AI) 3, Red Hat AI Inference Server, vLLM, Red Hat OpenShift AI (RHOAI), Red Hat Enterprise Linux AI (RHEL AI) 3, Red Hat OpenShift AI (RHOAI), Red Hat OpenShift AI (RHOAI), Red Hat AI Inference Server, Red Hat AI Inference Server, Red Hat AI Inference Server, Red Hat OpenShift AI (RHOAI), Red Hat AI Inference Server, Red Hat OpenShift AI (RHOAI), Red Hat Enterprise Linux AI (RHEL AI) 3, Red Hat AI Inference Server, Red Hat AI Inference Server, Red Hat AI Inference Server, Red Hat OpenShift AI (RHOAI), Red Hat OpenShift AI (RHOAI), Red Hat Enterprise Linux AI (RHEL AI) 3, Red Hat Enterprise Linux AI (RHEL AI) 3, Red Hat AI Inference Server, Red Hat AI Inference Server, Red Hat OpenShift AI (RHOAI), Red Hat AI Inference Server, Red Hat Enterprise Linux AI (RHEL AI) 3, Red Hat Enterprise Linux AI (RHEL AI) 3, Red Hat AI Inference Server, Red Hat AI Inference Server
- Provider severity
- MEDIUM
- Conflicts
- 1
CVE-2026-12490
When a provide-xfr is given with a tls-auth-name, a secondary requesting a transfer should provide a client certificate with that name. However, no client certificate is needed when the request comes in over TLS over the regular tls-port (and not the tls-auth-port) or over over TCP over the regular port, when the other conditions of the provide-xfr rule match.
PUBLISHED
- Vendor
- NLnet Labs
- Product
- NSD
- Provider severity
- HIGH
- Conflicts
- 1
CVE-2026-1249
The MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar plugin for WordPress is vulnerable to Server-Side Request Forgery in versions 5.3 to 5.10 via the 'load_lyrics_ajax_callback' function. This makes it possible for authenticated attackers, with author level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
PUBLISHED
- Vendor
- sonaar
- Product
- MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar
- Provider severity
- MEDIUM
- Conflicts
- 0
CVE-2026-12488
A memory corruption vulnerability exists in the GV-Cloud functionality of GeoVision GV-VMS V20 20.0.2. A specially crafted network request can lead to a denial of service. An attacker can impersonate the legitimate server to trigger this vulnerability.
PUBLISHED
- Vendor
- GeoVision Inc.
- Product
- GeoVision
- Provider severity
- MEDIUM
- Conflicts
- 0
CVE-2026-12486
Multiple OS command injection vulnerabilities exist in the libNetSetObj.so functionality of GeoVision GV-I/O Box 4E 2.09. A specially crafted network packet can lead to command execution. An attacker can send a network request to trigger this vulnerability. `libNetSetObj.so` is an internal library used by various binaries on the device to configure the network stack (start and stop various services, configure IP, Netmask, gateway, dns, etc.) #### CNetSetObj::m_F_n_Set_IP_Addr command injecti
PUBLISHED
- Vendor
- GeoVision Inc.
- Product
- GV-I/O Box 4E
- Provider severity
- CRITICAL
- Conflicts
- 0