42 CVEs tracked today. 1 Critical, 9 High, 17 Medium, 15 Low.
-
CVE-2026-44895
CRITICAL
CVSS 9.2
Unauthenticated remote access to GitLab API operations via gitlab-mcp-server's SSE transport allows attackers to execute all 86 exposed GitLab management tools-including repository deletion, file modification, and configuration changes-using the operator's Personal Access Token. When configured with USE_SSE=true (a documented feature), the Node.js server binds to 0.0.0.0 with wildcard CORS headers, enabling both network-adjacent attackers and malicious web pages to invoke destructive operations without credentials. Public exploit code demonstrates the attack path from initial SSE connection through authenticated GitLab API calls. Patch version 0.6.0 addresses the authentication bypass per GitHub advisory GHSA-8jr5-6gvj-rfpf.
Authentication Bypass
Node.js
Gitlab
-
CVE-2026-44983
HIGH
CVSS 7.3
Integer overflow in Rust crate smallbitvec allows heap buffer overflow through safe API calls when capacity values approach usize::MAX. The vulnerability affects versions 1.0.1 through 2.6.0 and enables memory corruption without requiring unsafe code blocks, violating Rust's memory safety guarantees. Publicly available exploit code exists with working proof-of-concept demonstrating ASAN-detectable heap corruption. CVSS 7.3 reflects local attack vector, but the vulnerability is notable because it breaks Rust's core safety model by achieving undefined behavior through safe APIs alone.
Buffer Overflow
Heap Overflow
-
CVE-2026-44966
HIGH
CVSS 8.3
Prototype pollution in Velocity.js npm package versions <=2.1.5 allows remote attackers to modify Object.prototype through malicious #set directives in templates, enabling denial of service or potential remote code execution when template content is attacker-controlled. Publicly available exploit code exists. EPSS data unavailable, but the low attack complexity (CVSS AC:L), network attack vector (AV:N), and no authentication requirement (PR:N) combined with published POC code indicate elevated risk for applications rendering untrusted Velocity templates.
RCE
Denial Of Service
Prototype Pollution
-
CVE-2026-42562
HIGH
CVSS 8.3
Privilege escalation in Plainpad versions prior to 1.1.1 allows any authenticated user to immediately grant themselves administrator privileges via a single HTTP PUT request to the user update endpoint. The vulnerability stems from the API directly accepting the admin parameter from user input without verifying the requesting user's existing privilege level. Affected instances enable low-privilege accounts to bypass authorization controls and access admin-only functionality with no special conditions beyond basic authentication. No public exploit code or active exploitation confirmed at time of analysis, though exploitation requires minimal technical skill given the straightforward attack vector (CVSS AV:N/AC:L/PR:L).
PHP
Privilege Escalation
-
CVE-2026-41705
HIGH
CVSS 8.6
Filter-expression injection in Spring AI's MilvusVectorStore allows remote unauthenticated attackers to manipulate vector database queries by injecting malicious filter expressions through unsanitized document IDs. Affects Spring AI 1.0.0-1.0.6 and 1.1.0-1.1.5. VMware has released patches in versions 1.0.7 and 1.1.6. CVSS 8.6 (High) with network attack vector and no privileges required. No active exploitation confirmed (not in CISA KEV) and no public POC identified at time of analysis.
Java
Code Injection
-
CVE-2026-8208
HIGH
CVSS 8.9
Local file inclusion in Gibbon school management system versions prior to v30.0.01 enables remote code execution when authenticated users with Teacher or higher privileges manipulate the report archive directory setting to force interpretation of a malicious ZIP file as PHP code. The vulnerability compromises the underlying web server. Project Black Security Services disclosed this flaw with a detailed proof-of-concept, and the vendor released patch v30.0.01 marking it as low severity since it requires administrative access. EPSS data not available, but the high CVSS 8.9 score reflects the critical post-compromise impact despite the high privilege requirement.
PHP
Information Disclosure
LFI
-
CVE-2026-8207
HIGH
CVSS 7.0
SQL injection in Gibbon education platform versions prior to v30.0.01 enables authenticated users with Teacher privileges or higher to execute arbitrary SQL queries through the Tracking/graphing module. Exploitation allows unauthorized read and write access to the underlying database. Project Black Security Services has published detailed exploit documentation demonstrating the attack. While vendor release notes classify this as 'low severity, accessible to admin users only,' the CVSS 7.0 score and authenticated Teacher-level access requirement indicate moderate risk for multi-tenant or compromised-account scenarios.
PHP
SQLi
-
CVE-2026-6665
HIGH
CVSS 8.1
Stack overflow in PgBouncer before 1.25.2 enables malicious PostgreSQL backend servers to trigger remote code execution via SCRAM authentication nonce manipulation. The flaw stems from incorrect strlcat() return value checking during SCRAM client-final-message construction. Remote unauthenticated exploitation is possible (CVSS 8.1, AV:N/PR:N) but requires high attack complexity - specifically, the attacker must control or compromise the backend PostgreSQL server PgBouncer connects to. No public exploit identified at time of analysis; EPSS and KEV data not available in this assessment.
Buffer Overflow
Stack Overflow
-
CVE-2026-6664
HIGH
CVSS 7.5
Remote denial-of-service in PgBouncer versions before 1.25.2 allows unauthenticated attackers to crash the connection pooler by sending a malformed SCRAM authentication packet that triggers an integer overflow in network packet parsing code. The vulnerability bypasses boundary checks in authentication handling, enabling complete service disruption of database connection pooling. EPSS data not available, no confirmed active exploitation (not in CISA KEV), but the unauthenticated remote attack vector (CVSS AV:N/AC:L/PR:N) presents significant risk for internet-exposed PostgreSQL infrastructure.
Denial Of Service
Integer Overflow
-
CVE-2026-3828
HIGH
CVSS 7.2
Authenticated remote command execution in discontinued Hikvision DS-3E series switches (DS-3E1310P-SI, DS-3E1318P-SI, DS-3E1326P-SI) allows high-privilege users to execute arbitrary operating system commands by sending specially crafted network packets with malicious payloads due to insufficient input validation. The vulnerability carries a CVSS score of 7.2 with network attack vector and low complexity, though exploitation requires high-privilege credentials. Products were discontinued in December 2023, suggesting limited patch support and potential long-term exposure for deployed devices.
Command Injection
Hikvision
-
CVE-2026-45184
MEDIUM
CVSS 6.5
Kdenlive before version 26.04.1 permits arbitrary command execution through dangerous proxy parameters embedded in attacker-controlled project files. When a victim opens a malicious .kdenlive project file, the application processes untrusted proxy settings without sufficient validation, enabling code execution with the privileges of the user running Kdenlive. This requires user interaction (opening a file) but poses significant risk in contexts where project files are shared or downloaded from untrusted sources.
Information Disclosure
-
CVE-2026-45181
MEDIUM
CVSS 6.5
Hex-Rays IDA Pro 9.2 and 9.3 before 9.3sp2 allows local code injection through argument injection in Clang dependency-file generation, enabling attackers to place malicious code into the plugins directory when a victim opens an attacker-supplied .i64 file. The vulnerability requires local access and user interaction (opening a malicious file) but grants high integrity and confidentiality impact. No public exploit code or CISA KEV status has been confirmed at the time of analysis.
Code Injection
-
CVE-2026-44897
MEDIUM
CVSS 6.1
Cross-site scripting (XSS) in mistune's HTMLRenderer.heading() allows injection of arbitrary HTML attributes when custom heading_id callbacks return unsanitized heading text. The vulnerability occurs because the id attribute value is concatenated directly into the HTML tag without escaping, enabling attackers who control heading content to break out of the id= attribute and inject event handlers or other malicious attributes. Exploitation requires a caller-supplied heading_id callback that derives IDs from heading text - the most common real-world pattern used by documentation generators like MkDocs, Sphinx, and Jekyll. Publicly available proof-of-concept demonstrates mouse-over triggered JavaScript execution via onmouseover attribute injection.
XSS
Python
Apple
-
CVE-2026-44458
MEDIUM
CVSS 4.3
CSS declaration injection in Hono's JSX server-side renderer allows remote attackers to inject arbitrary CSS declarations via untrusted `style` object values or property names, enabling visual manipulation, outbound CSS requests to attacker hosts, and UI hijacking. Affects Hono versions before 4.12.18 when rendering JSX server-side with user-controlled style object inputs. No JavaScript execution or HTML breakout possible; impact limited to CSS scope.
Code Injection
-
CVE-2026-44457
MEDIUM
CVSS 5.3
Hono's Cache Middleware incorrectly caches responses marked with Vary: Authorization or Vary: Cookie headers, allowing cached responses intended for one authenticated user to be served to subsequent requests from different users. This information disclosure vulnerability affects Hono versions prior to 4.12.18 when the middleware is deployed on endpoints returning user-specific data without also setting Cache-Control: private. No special attack complexity is required - remote unauthenticated attackers can trigger the vulnerability through sequential requests to affected endpoints.
Information Disclosure
-
CVE-2026-32683
MEDIUM
CVSS 5.3
EZVIZ App versions using legacy cloud feature modules with outdated API interfaces allow attackers to eavesdrop on network traffic and disclose sensitive video data. The vulnerability requires adjacent network access and high exploitation complexity, but affects all EZVIZ App versions until patched. Attackers can obtain video transmission data without authentication or user interaction by intercepting unencrypted or weakly encrypted API communications.
Information Disclosure
-
CVE-2026-8209
MEDIUM
CVSS 6.9
Denial of service in Gibbon versions before v30.0.01 via path traversal during ZIP file extraction allows authenticated users with Teacher or higher privileges to trigger file deletion and application unavailability. The vulnerability exploits improper handling of malicious ZIP archives, where failed extraction attempts result in unintended deletion of PHP application files. This requires elevated privileges within the application and network access to the vulnerable endpoint.
PHP
Path Traversal
-
CVE-2026-8198
MEDIUM
CVSS 5.3
Unauthenticated attackers can bypass REST API authentication in the Logtivity plugin (versions up to 3.3.6) via a logic flaw in the verifyAuthorization method, allowing direct access to the /wp-json/logtivity/v1/options endpoint and disclosure of sensitive configuration including the logtivity_site_api_key. This key can be leveraged to impersonate the affected WordPress site in API calls to the Logtivity service. CVSS 5.3 (low confidentiality impact) reflects information disclosure severity; no active exploitation in CISA KEV at time of analysis.
WordPress
Authentication Bypass
Information Disclosure
-
CVE-2026-8187
MEDIUM
CVSS 6.9
Denial of service in Open5GS User Plane Function (UPF) up to version 2.7.7 allows remote, unauthenticated attackers to exhaust server resources through manipulation of GTPv1-U packet handling in the _gtpv1_u_recv_cb function. The vulnerability enables resource consumption attacks against 5G core network infrastructure without requiring authentication or user interaction. Vendor notification occurred via GitHub issue #4492 but has not received developer response or a released patch.
Denial Of Service
-
CVE-2026-8186
MEDIUM
CVSS 6.9
Out-of-bounds read in Open5GS up to version 2.7.7 allows remote attackers to trigger information disclosure via manipulation of the ogs_sbi_client_send_via_scp_or_sepp function in lib/sbi/client.c during Service-Based Interface (SBI) communication. The vulnerability exploits improper bounds checking when extracting paths from URIs, affecting the Network Function (NF) component. CVSS 6.9 (network-accessible, low complexity, no privileges required) with availability impact. Upstream patch commit d5bc487fcf9ea87d2b03f2ef95123af344773bfb available.
Buffer Overflow
Information Disclosure
-
CVE-2026-8185
MEDIUM
CVSS 5.3
Missing authentication in UGREEN CM933 1.1.59.4319 administrative interface allows unauthenticated local network attackers to manipulate an unknown function, potentially gaining unauthorized access with limited confidentiality, integrity, and availability impact. No public exploit code has been identified, and the vendor has committed to a fix in late April.
Authentication Bypass
-
CVE-2026-7652
MEDIUM
CVSS 5.3
LatePoint plugin for WordPress versions up to 5.5.0 allows unauthenticated attackers to perform account takeover of non-super-admin WordPress users by exploiting a weak password recovery mechanism in the guest booking flow. The vulnerability chains two flaws: the plugin's save_connected_wordpress_user() function updates WordPress user emails via wp_update_user() without ownership verification, and the guest booking flow permits email overwrites through phone-based customer merging without authentication. Attackers can overwrite a target user's email address and then trigger WordPress's standard password reset to gain full account access. No public exploit code has been identified at time of analysis, but exploitation requires only that the plugin be configured with WordPress user integration enabled, phone-based contact merging enabled, and customer authentication disabled.
WordPress
Information Disclosure
-
CVE-2026-6667
MEDIUM
CVSS 4.3
PgBouncer before version 1.25.2 fails to properly restrict the KILL_CLIENT admin command to authorized users, allowing any user with access to the administration console to terminate client connections. The vulnerability affects all PgBouncer versions before 1.25.2 and requires prior authentication to the admin console, limiting the real-world risk despite the authorization bypass. CVSS 4.3 reflects low availability impact but highlights a privilege escalation within authenticated contexts.
Authentication Bypass
-
CVE-2026-6666
MEDIUM
CVSS 5.9
PgBouncer before version 1.25.2 crashes when a backend PostgreSQL server sends an error response lacking an SQLSTATE field, enabling denial of service against connection pooling infrastructure. The vulnerability requires an attacker to control or compromise a PostgreSQL backend server or intercept server responses on the network, making exploitation conditional on non-default network topology or server compromise. CVSS score of 5.9 reflects high availability impact but limited attack surface due to medium complexity (AC:H).
Denial Of Service
Null Pointer Dereference
-
CVE-2026-1749
MEDIUM
CVSS 6.8
Unauthenticated attackers can bypass access controls in HikCentral Professional to obtain administrative permissions, enabling unauthorized management and configuration of security infrastructure. The vulnerability requires network access and non-trivial complexity but grants high-impact confidentiality and scope expansion across affected deployments. No public exploit code has been identified, though Hikvision has released a security advisory confirming the issue.
Authentication Bypass
-
CVE-2025-15634
MEDIUM
CVSS 5.3
A missing authorization vulnerability in HCL BigFix WebUI allows an authenticated user without proper permissions to view sensitive environmental information via direct URL access to the unauthorized page.
Authentication Bypass
-
CVE-2025-15633
MEDIUM
CVSS 5.3
An improper authorization vulnerability in HCL BigFix WebUI allows an authenticated user without Master Operator privileges to access internal data (site names, versions, and configuration variables) and bypass privilege requirements via unprotected endpoints lacking adequate security headers.
Authentication Bypass
-
CVE-2026-45182
LOW
CVSS 2.2
GrapheneOS versions before 2026050400 leak the real IP address of VPN users through a registerQuicConnectionClosePayload optimization that allows applications to request system_server transmit UDP traffic on their behalf, bypassing VPN confinement when both 'Block connections without VPN' and 'Always-on VPN' are enabled. This information disclosure affects users relying on VPN privacy protections and requires local access with user interaction to trigger, resulting in a CVSS 2.2 score despite the privacy-sensitive nature of IP address leakage.
Information Disclosure
-
CVE-2026-44459
LOW
CVSS 3.8
Improper validation of NumericDate claims (exp, nbf, iat) in hono/utils/jwt allows crafted JWT tokens with malformed time-based claims to silently bypass expiration and validity checks. This affects applications using Hono versions prior to 4.12.18. Exploitation requires the attacker to control token issuance or possess the signing key - unauthenticated remote exploitation is not possible. The vulnerability stems from combined short-circuiting logic that fails to reject non-finite, falsy, or non-numeric claim values as required by RFC 7519.
Authentication Bypass
-
CVE-2026-8213
LOW
CVSS 1.9
Heap-based buffer overflow in OSGeo GDAL's Grid File Handler (GDSDfldsrch function in frmts/hdf4/hdf-eos/GDapi.c) affects versions up to 3.13.0dev-4, allowing authenticated local attackers to cause memory corruption through malformed HDF4 grid files. The vulnerability results from unsafe string manipulation that fails to validate metadata field list format before performing memory operations. Publicly available exploit code exists; vendor-released patch available in version 3.13.0RC1.
Buffer Overflow
-
CVE-2026-8212
LOW
CVSS 1.9
Heap-based buffer overflow in GDAL's HDF4-EOS SWSDfldsrch function (frmts/hdf4/hdf-eos/SWapi.c) allows local authenticated attackers to cause memory corruption through manipulation of malformed HDF4 files. The vulnerability stems from unsafe string manipulation that fails to validate metadata field list format before stripping quotes, enabling out-of-bounds writes. Affects GDAL up to version 3.13.0dev-4; patch available in version 3.13.0RC1. Publicly available exploit code exists.
Buffer Overflow
Heap Overflow
-
CVE-2026-8211
LOW
CVSS 2.0
Code injection in codelibs Fess up to 15.5.1 allows remote attackers with high privileges to execute arbitrary code via manipulation of the content argument in the AdminDesignAction.java JSP file handler. Publicly available exploit code exists for this vulnerability, and the vendor has not responded to early disclosure notification.
RCE
Java
Code Injection
-
CVE-2026-8210
LOW
CVSS 1.9
Command injection in aandrew-me tgpt up to version 2.11.1 allows local authenticated attackers to execute arbitrary commands via the helper.Update function in helper.go. The vulnerability requires local file system access and an authenticated user context but results in only limited confidentiality impact. Public exploit code exists, though the vendor has not responded to early disclosure attempts, leaving affected users without an official patch.
Command Injection
Apple
-
CVE-2026-8196
LOW
CVSS 2.9
Authentication bypass in JeecgBoot 3.9.1 mLogin endpoint allows remote attackers to circumvent login controls via manipulation of an unspecified function in LoginController.java, resulting in unauthorized access with confidentiality impact. The vulnerability has high attack complexity and difficult exploitability, but publicly available exploit code exists and the vendor has not responded to disclosure.
Authentication Bypass
Java
-
CVE-2026-8195
LOW
CVSS 2.1
Stored cross-site scripting (XSS) in JeecgBoot up to version 3.9.1 allows remote attackers to inject malicious scripts via SVG file handling in the CommonController component, requiring user interaction to trigger payload execution. The vulnerability has publicly available exploit code and affects the system's integrity through stored script injection, with a CVSS score of 2.1 reflecting low severity due to user interaction requirement and limited impact scope.
XSS
Java
-
CVE-2026-8194
LOW
CVSS 2.1
Cross-site request forgery in osTicket up to version 1.18.3 allows remote attackers to bypass CSRF token validation by manipulating the _method parameter via GET requests, enabling unauthorized state-changing operations without user interaction beyond clicking a malicious link. The vulnerability exploits improper HTTP method emulation in the Dispatcher component and has publicly available proof-of-concept code; a vendor patch is available.
PHP
CSRF
-
CVE-2026-8193
LOW
CVSS 2.1
Server-side request forgery in Akaunting 3.1.21 allows authenticated attackers to manipulate the Invoice PDF Rendering component via the config/dompdf.php file, enabling arbitrary HTTP requests from the server to internal or external systems. The vulnerability has CVSS score 2.1 with low severity impact across confidentiality, integrity, and availability; however, publicly available exploit code exists and the vendor did not respond to early disclosure, increasing real-world exploitation risk despite low CVSS metrics.
PHP
SSRF
-
CVE-2026-8192
LOW
CVSS 2.1
Wavlink NU516U1 M16U1_V240425 is vulnerable to remote OS command injection through the wzdap function in /cgi-bin/adm.cgi, where the EncrypType and wl_Pass parameters are passed unsanitized to system commands. An authenticated remote attacker can manipulate these arguments to execute arbitrary commands with the privileges of the web server process. Exploit code is publicly available (CVSS 6.3, EPSS probability indicated by E:P vector).
Command Injection
-
CVE-2026-8191
LOW
CVSS 2.1
Remote OS command injection in Wavlink NU516U1 M16U1_V240425 allows authenticated remote attackers to execute arbitrary system commands via the skiplist1/skiplist2 parameters in the wifi_region function of /cgi-bin/adm.cgi. The vulnerability is remotely exploitable with low complexity, affects confidentiality and integrity, and has publicly available exploit code.
Command Injection
-
CVE-2026-8190
LOW
CVSS 2.1
OS command injection in Wavlink NU516U1 M16U1_V240425 allows authenticated remote attackers to execute arbitrary system commands via unsanitized WAN configuration parameters (ppp_username, ppp_passwd, rwan_ip, rwan_mask, rwan_gateway) in the /cgi-bin/adm.cgi wan function. Publicly available exploit code exists and the vendor has been notified.
Command Injection
-
CVE-2026-8189
LOW
CVSS 2.1
Remote authenticated command injection in Wavlink NU516U1 M16U1_V240425 allows authenticated attackers to execute arbitrary OS commands via manipulation of wlan_bssid, sel_Automode, or sel_EncrypTyp parameters in the wzdrepeater function at /cgi-bin/adm.cgi. CVSS 6.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P) with public exploit code available; vendor was notified early of this disclosure.
Command Injection
-
CVE-2026-8188
LOW
CVSS 2.1
OS command injection in Wavlink NU516U1 M16U1_V240425 allows authenticated remote attackers to execute arbitrary commands via the change_wifi_password function in /cgi-bin/adm.cgi by manipulating the wl_channel, wl_Pass, or EncrypType parameters. Publicly available exploit code exists, and the vendor has been notified of the vulnerability.
Command Injection