NewIntroducing ISO360 — our all-in-one ISO compliance platform
R4IM — Room for Improvement
Threat Intelligence

Live vulnerability advisories searchable in real time.

Search by CVE, vendor, product, or keyword. Filter by severity and exploitation status to surface what matters most to your stack.

Only want advisories for your stack? Get an email + ticket the moment a matching CVE drops.

Subscribe to advisories
Matching advisories
49815
Actively exploited
1709
Ransomware-linked
360
Shown on page
48

Tip: paste a CVE id (e.g. CVE-2024-3400) for a direct match, or search a vendor like "Cisco" or a keyword like "authentication bypass".

Latest advisories

Showing 48 of 49,815 matching advisories

Critical · 9.9CVE-2026-87719
Vulnerability advisory

GitLab has remediated an issue in GitLab EE affecting all versions from 18.3 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 th…

GitLab has remediated an issue in GitLab EE affecting all versions from 18.3 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that under certain conditions could allow an authenticated user with Duo Chat access to obtain Advanced Search instance configurations and sensitive credentials using a specially crafted GraphQL subscription argument to bypass serialization and perform server object lookup.

Modified Sep 12, 2026
View advisory & remediation
Critical · 10.0CVE-2026-85706
Vulnerability advisory· Exploited

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.7 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2…

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.7 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that, under certain conditions, an unauthenticated user could have read arbitrary files from the GitLab server due to improper path confinement and missing authentication enforcement in the repository commits API.

Patch deadline Sep 14, 2026
View advisory & remediation
Medium · 4.0CVE-2026-90467
Vulnerability advisory

aiosmtplib before 5.1.3 fails to properly validate email addresses supplied by callers, allowing attackers to inject ESMTP parameters int…

aiosmtplib before 5.1.3 fails to properly validate email addresses supplied by callers, allowing attackers to inject ESMTP parameters into MAIL FROM and RCPT TO command lines. Attackers can craft malicious addresses containing spaces and angle brackets to append parameters like AUTH, NOTIFY, or ORCPT to envelope commands, forging authenticated identities or forcing delivery notifications to third parties.

Modified Sep 12, 2026
View advisory & remediation
Medium · 5.4CVE-2026-89268
Vulnerability advisory

QloApps through 1.7.0 renders back-office list filter POST parameters into HTML input value attributes without escaping them in the list…

QloApps through 1.7.0 renders back-office list filter POST parameters into HTML input value attributes without escaping them in the list helper template. Attackers can induce authenticated users to submit crafted POST requests with malicious payloads to list controllers, executing arbitrary JavaScript in the victim's session to read administrative data and perform actions.

Modified Sep 12, 2026
View advisory & remediation
Medium · 4.3CVE-2026-89267
Vulnerability advisory

starlette-admin versions 0.16.1 through 0.17.1 fail to enforce the searchable_fields allowlist when configured as an empty list, allowing…

starlette-admin versions 0.16.1 through 0.17.1 fail to enforce the searchable_fields allowlist when configured as an empty list, allowing authenticated users to filter on non-searchable fields. Attackers can submit structured filter queries via the list API's where parameter to perform equality and comparison operations on excluded columns.

Modified Sep 12, 2026
View advisory & remediation
TrackedCVE-2026-87910
Vulnerability advisory

When tarfile extracts a link on a system that doesn't support links, it falls back to extracting a member from the archive.

When tarfile extracts a link on a system that doesn't support links, it falls back to extracting a member from the archive. In this case, the filter function is run twice: once for the extracted member, and once with name set to the location of the link. For one of the calls, the return value was ignored. Instead, the member should be skipped if either call returns None.

Modified Sep 12, 2026
View advisory & remediation
High · 8.2CVE-2026-89266
Vulnerability advisory

stb_vorbis through 1.22 contains a heap buffer overflow in start_decoder() where the codebook multiplicands allocation size is truncated…

stb_vorbis through 1.22 contains a heap buffer overflow in start_decoder() where the codebook multiplicands allocation size is truncated from size_t to int. Attackers can craft a malicious Ogg Vorbis file with large entries and dimensions values to trigger out-of-bounds writes, causing process crashes or heap corruption.

Modified Sep 12, 2026
View advisory & remediation
Medium · 4.3CVE-2026-87875
Vulnerability advisory

The cupsUTF32ToUTF8() function in CUPS's cups/transcode.c lacks a source-length bound and can read past the end of the source buffer, res…

The cupsUTF32ToUTF8() function in CUPS's cups/transcode.c lacks a source-length bound and can read past the end of the source buffer, resulting in a heap out-of-bounds read. This is reachable via SNMP supply-description parsing in backend/snmp-supplies.c with attacker-controlled content.

Modified Sep 12, 2026
View advisory & remediation
High · 8.8CVE-2026-86169
Vulnerability advisory

Axolotl before 0.19.0 contains a remote code execution vulnerability in the multipack patch path where trust_remote_code defaults to None…

Axolotl before 0.19.0 contains a remote code execution vulnerability in the multipack patch path where trust_remote_code defaults to None instead of False, causing the security guard to be bypassed. Attackers can execute arbitrary Python code by crafting a malicious Hugging Face model repository selected as base_model, which is loaded with hardcoded trust_remote_code=True during AutoModelForCausalLM.from_pretrained.

Modified Sep 12, 2026
View advisory & remediation
Medium · 6.3CVE-2026-90461
Vulnerability advisory

OpenStack Ironic through 38.0.0 may send a username and password to an unexpected remote host when Image Service is configured for HTTP(S…

OpenStack Ironic through 38.0.0 may send a username and password to an unexpected remote host when Image Service is configured for HTTP(S) Basic Authentication.

Modified Sep 11, 2026
View advisory & remediation
TrackedCVE-2026-90460
Vulnerability advisory

An issue was discovered in OpenStack Keystone before 29.0.3.

An issue was discovered in OpenStack Keystone before 29.0.3. Tokens obtained via delegated authentication methods (EC2 credentials, application credentials, OAuth1 access tokens, and trusts) are not blocked from creating, modifying, or deleting credentials via the /v3/credentials API. EC2-derived tokens can additionally read credential blobs, exposing TOTP MFA seeds and other secrets. Also, PATCH /v3/credentials does not validate the requested post-update project_id, allowing any delegated token to move a credential to an unauthorized project. All Keystone deployments using delegated authentication are affected.

Modified Sep 11, 2026
View advisory & remediation
TrackedCVE-2026-90457
Vulnerability advisory

The administrative password is hashed using a comparatively weak, fast algorithm for the credential store backing one authentication path…

The administrative password is hashed using a comparatively weak, fast algorithm for the credential store backing one authentication path, and the file containing that hash is written with permissions allowing it to be read by any local user. This is inconsistent with a separate, stronger hashing algorithm used for the same password on another authentication path. A party able to read this file, including a local user or a party with access to a configuration backup, could feasibly recover the underlying password through offline computation, compromising the administrative credential across every path that accepts it.

Modified Sep 11, 2026
View advisory & remediation
TrackedCVE-2026-90456
Vulnerability advisory

An example environment-configuration file for a bundled inventory-management component ships with a fixed, publicly-known administrative…

An example environment-configuration file for a bundled inventory-management component ships with a fixed, publicly-known administrative password. A deployment that copies this example file into active configuration without running the setup routine that regenerates credentials will expose that component's administrative interface to anyone aware of the default value.

Modified Sep 11, 2026
View advisory & remediation
TrackedCVE-2026-90455
Vulnerability advisory

A prior update that raised a bundled HTTP client library to a version remediating known vulnerabilities was later reverted, reintroducing…

A prior update that raised a bundled HTTP client library to a version remediating known vulnerabilities was later reverted, reintroducing the earlier, vulnerable version into a log-processing component. The only code path in that component using the library issues a request to a single fixed, trusted vendor URL at initialization and does not process attacker-controlled input through the library, limiting practical exploitability of the reintroduced version in this context.

Modified Sep 11, 2026
View advisory & remediation
TrackedCVE-2026-90454
Vulnerability advisory

A deployment mode intended to expose only read access to a bundled packet-analysis component's interface denies a list of write-capable r…

A deployment mode intended to expose only read access to a bundled packet-analysis component's interface denies a list of write-capable routes by pattern, but the pattern omits routes that modify tags attached to stored session records, and the proxy configuration otherwise permits the request method those routes use. This allows an authenticated user on a deployment intended to be read-only to add or remove tags on stored session records.

Modified Sep 11, 2026
View advisory & remediation
TrackedCVE-2026-90453
Vulnerability advisory

A file-upload handler redirects the authenticated client's browser to a URL taken directly from that same request's Referer header, witho…

A file-upload handler redirects the authenticated client's browser to a URL taken directly from that same request's Referer header, without validating it against the application's own origin. This allows an authenticated attacker to craft a request that causes another user's browser to be redirected to an arbitrary external destination after completing an upload.

Modified Sep 11, 2026
View advisory & remediation
TrackedCVE-2026-90452
Vulnerability advisory

Requests from the reverse proxy to the identity-provider service for token discovery, introspection, and credential exchange do not verif…

Requests from the reverse proxy to the identity-provider service for token discovery, introspection, and credential exchange do not verify the identity provider's server certificate. An attacker positioned on the network path between the proxy and the identity provider could impersonate the identity provider and issue forged authentication tokens accepted by the deployment.

Modified Sep 11, 2026
View advisory & remediation
TrackedCVE-2026-90451
Vulnerability advisory

An example environment-configuration file ships with a fixed, publicly-known secret value used to sign authentication cookies for a bundl…

An example environment-configuration file ships with a fixed, publicly-known secret value used to sign authentication cookies for a bundled packet-analysis component. A deployment that copies this example file into active configuration without running the setup routine that regenerates the value will use the known default, allowing an attacker aware of the default to forge valid authentication cookies for that component.

Modified Sep 11, 2026
View advisory & remediation
TrackedCVE-2026-90450
Vulnerability advisory

The application's role-authorization lookup defaults to granting access when a request handler's name is not present in its table of role…

The application's role-authorization lookup defaults to granting access when a request handler's name is not present in its table of role requirements, rather than defaulting to deny. Any request handler that is not explicitly registered in this table is reachable by any authenticated user regardless of their assigned role, and any newly added handler is fail-open by default until explicitly added to the table.

Modified Sep 11, 2026
View advisory & remediation
TrackedCVE-2026-90449
Vulnerability advisory

When a particular authentication mode is configured, the reverse proxy forwards requests for a bundled third-party administrative interfa…

When a particular authentication mode is configured, the reverse proxy forwards requests for a bundled third-party administrative interface directly to that interface without applying the gateway's own authentication requirement first. All access control for this administrative interface, which manages the credential store used to gate every other service in the deployment, is delegated entirely to that third-party interface's own login mechanism. Any authentication weakness in that bundled interface would compromise the credential store protecting the rest of the deployment.

Modified Sep 11, 2026
View advisory & remediation
TrackedCVE-2026-90448
Vulnerability advisory

A deployment mode intended to expose only read access to stored data proxies a set of application programming interface routes without re…

A deployment mode intended to expose only read access to stored data proxies a set of application programming interface routes without restricting which request methods are allowed. One such route accepts a request that creates or overwrites a stored record, including an attacker-chosen identifier, using the application's own elevated backend credentials. This allows an authenticated user on a deployment intended to be read-only to forge or overwrite stored records that should not be modifiable in that deployment mode.

Modified Sep 11, 2026
View advisory & remediation
TrackedCVE-2026-90447
Vulnerability advisory

A routing rule selects between two different authentication mechanisms for the same downstream service based on the value of a client-sup…

A routing rule selects between two different authentication mechanisms for the same downstream service based on the value of a client-supplied request header, rather than on any property the client cannot control. An authenticated user in possession of a shared service credential can set this header to route around the primary role-based authorization check and reach the alternate path's fixed, elevated role instead. This allows a low-privileged authenticated attacker who knows the shared credential to perform actions reserved for a higher-privileged role.

Modified Sep 11, 2026
View advisory & remediation
TrackedCVE-2026-90446
Vulnerability advisory

An application programming interface endpoint accepts a user-supplied value and interpolates it directly into the path of a backend reque…

An application programming interface endpoint accepts a user-supplied value and interpolates it directly into the path of a backend request to the underlying search and analytics data store, without restricting its contents. This allows an authenticated attacker to substitute an arbitrary backend path, causing the application's own elevated service credentials to be used against unintended internal endpoints. This could allow an attacker to enumerate or read internal configuration and administrative data from the backend data store that would otherwise be restricted.

Modified Sep 11, 2026
View advisory & remediation
TrackedCVE-2026-90445
Vulnerability advisory

An interface that accepts file uploads from authenticated users extracts the contents of uploaded archives without validating that extrac…

An interface that accepts file uploads from authenticated users extracts the contents of uploaded archives without validating that extracted file paths remain within the intended destination directory. This allows an authenticated attacker to craft an archive whose entries traverse outside the destination directory, causing the extraction process to write files to arbitrary locations with the privileges of that process. This could allow an attacker to inject fabricated records into the system's stored data or tamper with application configuration.

Modified Sep 11, 2026
View advisory & remediation
TrackedCVE-2026-90444
Vulnerability advisory

A file-transfer interface that requires valid credentials accepts attacker-controlled filenames without restricting shell metacharacters.

A file-transfer interface that requires valid credentials accepts attacker-controlled filenames without restricting shell metacharacters. An automated process later constructs and runs a system command using the uploaded file's name, allowing an authenticated attacker to embed and execute arbitrary operating system commands with the privileges of that process. This allows an attacker to read and modify ingested log data, and could provide a foothold for further movement within the internal network.

Modified Sep 11, 2026
View advisory & remediation
TrackedCVE-2026-90443
Vulnerability advisory

A web interface reflects a portion of the request URL into a script context and a hyperlink attribute without adequate encoding, and does…

A web interface reflects a portion of the request URL into a script context and a hyperlink attribute without adequate encoding, and does not require authentication to reach. This allows an unauthenticated network attacker to craft a link that, when visited by a user, executes arbitrary script in the context of the affected application and can redirect the user's browser to an arbitrary external site. Successful exploitation could allow an attacker to act with the compromised user's session privileges within the application.

Modified Sep 11, 2026
View advisory & remediation
High · 7.0CVE-2026-88924
Vulnerability advisory

A flaw was found in the admin backend of gvfs.

A flaw was found in the admin backend of gvfs. The privileged gvfsd-admin daemon changes the ownership of newly created private D-Bus sockets by calling the link-following chown() function on a pathname inside a user-controlled directory. A local attacker can exploit this via a Time-of-Check Time-of-Use (TOCTOU) race condition and exchange the socket pathname with a symbolic link pointing to an arbitrary root-owned file (such as /etc/pam.d/su). The daemon subsequently follows the symlink and changes the ownership of the targeted root-owned file to the attacker's user ID. This allows an authenticated local attacker to modify critical system files, leading to a full local privilege escalation to root.

Modified Sep 11, 2026
View advisory & remediation
Medium · 5.5CVE-2026-82001
adobe · acrobat

Acrobat Reader is affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service.

Acrobat Reader is affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service. An attacker could exploit this vulnerability to exhaust system resources, resulting in an application denial-of-service condition. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

Modified Sep 11, 2026
View advisory & remediation
Medium · 5.5CVE-2026-81982
adobe · acrobat

Acrobat Reader is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory.

Acrobat Reader is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to disclose sensitive information. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

Modified Sep 11, 2026
View advisory & remediation
Medium · 5.5CVE-2026-81977
adobe · acrobat

Acrobat Reader is affected by an Integer Underflow (Wrap or Wraparound) vulnerability that could lead to disclosure of sensitive memory.

Acrobat Reader is affected by an Integer Underflow (Wrap or Wraparound) vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to disclose sensitive information. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

Modified Sep 11, 2026
View advisory & remediation
Medium · 5.4CVE-2026-75740
adobe · experience manager

Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attack…

Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed.

Modified Sep 11, 2026
View advisory & remediation
Medium · 5.4CVE-2026-75735
adobe · experience manager

Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attack…

Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed.

Modified Sep 11, 2026
View advisory & remediation
Medium · 5.4CVE-2026-75729
adobe · experience manager

Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attack…

Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed.

Modified Sep 11, 2026
View advisory & remediation
Medium · 5.4CVE-2026-75722
adobe · experience manager

Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability.

Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in that a victim must visit a crafted webpage. Scope is changed.

Modified Sep 11, 2026
View advisory & remediation
Medium · 5.4CVE-2026-75716
adobe · experience manager

Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability.

Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in that a victim must visit a crafted webpage. Scope is changed.

Modified Sep 11, 2026
View advisory & remediation
Medium · 5.4CVE-2026-75706
adobe · experience manager

Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability.

Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in that a victim must visit a crafted webpage. Scope is changed.

Modified Sep 11, 2026
View advisory & remediation
Medium · 5.4CVE-2026-75683
adobe · experience manager

Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability.

Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in that a victim must visit a crafted webpage. Scope is changed.

Modified Sep 11, 2026
View advisory & remediation
Medium · 5.4CVE-2026-75677
adobe · experience manager

Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability.

Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in that a victim must visit a crafted webpage. Scope is changed.

Modified Sep 11, 2026
View advisory & remediation
Medium · 5.4CVE-2026-75661
adobe · experience manager

Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability.

Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in that a victim must visit a crafted webpage. Scope is changed.

Modified Sep 11, 2026
View advisory & remediation
Medium · 5.4CVE-2026-75642
adobe · experience manager

Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attack…

Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed.

Modified Sep 11, 2026
View advisory & remediation
Medium · 5.4CVE-2026-75635
adobe · experience manager

Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability.

Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in that a victim must visit a crafted webpage. Scope is changed.

Modified Sep 11, 2026
View advisory & remediation
Medium · 6.5CVE-2026-54258
Vulnerability advisory

ZoneMinder is a free, open source closed-circuit television software application.

ZoneMinder is a free, open source closed-circuit television software application. Versions prior to 1.36.39, 1.38.4, and 1.39.11 allow an authenticated low-privileged user with coarse `Events=View` and/or `Snapshots=View` permissions to directly fetch media for events belonging to monitors they are not allowed to access. The normal UI correctly hides the restricted monitor and its events, but direct event media views accept an arbitrary `eid` and stream media from the event path without enforcing the event/monitor-level ACL. This exposes private surveillance footage across monitor boundaries. Versions 1.36.39, 1.38.4, and 1.39.11 fix the issue.

Modified Sep 11, 2026
View advisory & remediation
Medium · 6.5CVE-2026-54248
Vulnerability advisory

Doco-CD is a GitOps continuous delivery tool that automatically deploys and updates Docker Compose projects/services and Swarm stacks.

Doco-CD is a GitOps continuous delivery tool that automatically deploys and updates Docker Compose projects/services and Swarm stacks. Prior to version 0.90.1, a trust-boundary flaw in OCI artifact verification allowed artifact-provided deployment config to influence the policy used to verify that same artifact. When global OCI signature verification was enabled via `OCI_TRUST_POLICY` (`enabled: true`), an attacker with write access to the configured OCI tag could publish an unsigned or improperly signed artifact containing `.doco-cd.yml` with `oci.verify: false`. This could cause signature verification to be bypassed and untrusted deployment content to be applied. This primarily impacts users deploying from OCI artifacts where deployment config is read from artifact contents (for example, poll/webhook flows without trusted inline deployment overrides). The issue is fixed by enforcing a strict trust boundary and no-downgrade behavior. First, artifact-contained `.doco-cd.yml` is treated as untrusted for OCI trust-policy override decisions. Second, if global `OCI_TRUST_POLICY.enabled` is `true`, per-deployment `oci.verify: false` cannot disable verification. Some workarounds are available. Do not source deployment config from untrusted OCI artifact contents. Use trusted inline `POLL_CONFIG.deployments` and avoid relying on artifact-contained trust-policy overrides. Restrict write/push permissions for OCI repositories/tags used by doco-cd. Prefer immutable digest pinning and protected release/tag workflows. Monitor for unexpected artifact digest changes and failed/suspicious verification events.

Modified Sep 11, 2026
View advisory & remediation
High · 7.4CVE-2026-54241
Vulnerability advisory

libde265 is an open source implementation of the h.265 video codec.

libde265 is an open source implementation of the h.265 video codec. Versions prior to 1.1.1 use signed 32-bit arithmetic to calculate the sample adaptive offset input-buffer size, allowing a crafted HEVC stream with large dimensions and 16-bit luma samples to cause an integer overflow, an undersized allocation, and an out-of-bounds heap read that may expose heap data in decoded output or crash the decoder. Version 1.1.1 contains a patch.

Modified Sep 11, 2026
View advisory & remediation
High · 7.4CVE-2026-54240
Vulnerability advisory

libde265 is an open source implementation of the h.265 video codec.

libde265 is an open source implementation of the h.265 video codec. Versions prior to 1.1.1 use signed 32-bit arithmetic to calculate pixel offsets, allowing a crafted HEVC stream with large image dimensions to trigger an integer overflow and cause out-of-bounds heap reads or writes, potentially disclosing data, corrupting memory, or crashing the decoder. Version 1.1.1 contains a patch.

Modified Sep 11, 2026
View advisory & remediation
Medium · 6.5CVE-2026-50018
Vulnerability advisory

Hoverfly is an open source API simulation tool.

Hoverfly is an open source API simulation tool. Prior to version 1.12.8, remote post-serve actions use `http.DefaultClient` without any timeout configuration. When the remote endpoint is unreachable or intentionally slow (accepts TCP connection but never responds), each triggered proxy request spawns a goroutine that blocks indefinitely on `http.DefaultClient.Do()`. An attacker can cause unbounded goroutine accumulation leading to memory exhaustion and process crash (OOM kill). Unlike local post-serve action execution, this requires no binary execution, only a URL pointing to a non-responsive endpoint. Version 1.12.8 patches the issue.

Modified Sep 11, 2026
View advisory & remediation
High · 7.5CVE-2026-50013
Vulnerability advisory

Hoverfly is an open source API simulation tool.

Hoverfly is an open source API simulation tool. Prior to version 1.12.8, when Hoverfly is running in Diff mode, the `AddDiff()` function writes to the shared `responsesDiff` map without any synchronization (no mutex). When multiple proxy requests are processed concurrently (the normal case for any proxy), the concurrent map writes trigger Go's built-in race detector which causes a `fatal error: concurrent map read and map write`, immediately killing the entire Hoverfly process. This is trivially exploitable by sending multiple simultaneous requests. Version 1.12.8 patches the issue.

Modified Sep 11, 2026
View advisory & remediation
TrackedCVE-2026-49992
Vulnerability advisory

Kimai is an open-source time tracking application.

Kimai is an open-source time tracking application. Versions prior to 2.58.0 contain authenticated cross-site request forgery issues in their default team creation shortcuts for projects, customers, and activities. These endpoints are exposed through `GET` routes and directly create or reuse a `Team`, add the current user as teamlead, and bind the target object to that team. As a result, an attacker can trick a logged-in user with the required permissions into visiting a malicious page and cause unauthorized changes to team, teamlead, and object-binding relationships. This is a real authorization-structure modification issue rather than a harmless UI shortcut. Version 2.58.0 patches the issue.

Modified Sep 11, 2026
View advisory & remediation

Need help remediating?

R4IM's SOC and offensive security teams can validate your exposure to any of these CVEs, prioritize by business impact, and ship verified fixes — typically within one patch cycle.

Talk to our security team