Latest Vulnerabilities

CVE ID :CVE-2026-75925 Published : Sept. 4, 2026, 10:17 p.m. | 15 minutes ago Description :Improper neutralization of CRLF sequences in IXON VPN Client before version 1.4.7 allows an attacker to execute commands as root or SYSTEM. Configuration values accepted by the local service are written to a file later consumed by a privileged subprocess, without line-ending sequences being neutralized, which allows additional directives to be introduced into that file. The configuration interface accepts changes without authenticating or verifying the origin of the requester. The injected configuration persists on disk across restarts of the client and the operating system, and the VPN connection continues to function normally, so there is no behavioral change visible to the user. Severity: 9.6 | CRITICAL Visit the link for more details, such as CVSS details, affected products, timeline, and more…

CVE ID :CVE-2026-86090 Published : Sept. 4, 2026, 10:17 p.m. | 15 minutes ago Description :ntopng before 6.7.260717 fails to perform authorization checks in the delete endpoints and recipients REST v2 handlers. Authenticated non-administrator users can issue POST requests to irreversibly delete all configured notification endpoints and recipients, silencing all alerts. Severity: 7.1 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more…

CVE ID :CVE-2026-76925 Published : Sept. 4, 2026, 10:17 p.m. | 15 minutes ago Description :A flaw was found in Flatpak. A Time-of-check to time-of-use (TOCTOU) race condition exists in the `org.freedesktop.Flatpak.SystemHelper` component. This vulnerability occurs because a privileged `chmod` operation executes before the OSTree repository validation within the `Deploy()` function. An attacker can exploit this timing window to redirect symlinks to arbitrary files, potentially leading to unauthorized file manipulation or information disclosure. Severity: 5.8 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more…

CVE ID :CVE-2026-77393 Published : Sept. 4, 2026, 10:17 p.m. | 15 minutes ago Description :In Ignition 8.1.53 and earlier, the Gateway “Create Project Role(s)” setting shipped blank, which permitted any authenticated user to create projects (if they can execute gateway scripts). Ignition 8.1.54 restricts project creation to Designer sessions and no longer relies on this setting. The 8.3 series is not affected. Severity: 8.8 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more…

CVE ID :CVE-2026-82684 Published : Sept. 4, 2026, 10:17 p.m. | 15 minutes ago Description :Tycon Systems TPDIN-Monitor-WEB3 versions 2.2.9 and prior are vulnerable to a Missing Authorization vulnerability. This could allow an attacker to extract system credentials, configurations, or flash contents. Severity: 8.6 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more…

CVE ID :CVE-2026-86091 Published : Sept. 4, 2026, 10:17 p.m. | 15 minutes ago Description :ntopng before 6.7.260717 fails to check user privileges in the pools bulk-delete endpoint, allowing authenticated non-administrators to delete all host pools and member bindings. Attackers can issue POST requests to the delete pools endpoint to irreversibly destroy every host pool, removing traffic policy bindings and visibility restrictions that may bypass security policies. Severity: 7.1 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more…

CVE ID :CVE-2026-46636 Published : Sept. 4, 2026, 10:17 p.m. | 15 minutes ago Description :Twig is a template language for PHP. From version 1.0.0 to before version 3.27.0, SecurityPolicy::checkMethodAllowed() unconditionally whitelists all method calls on instances of Twig\Markup. Twig\Markup is not final, so subclasses inherit the bypass. An application that passes an object of a Markup-derived class into a sandboxed template (typically to mark a chunk of HTML as safe) inadvertently exposes every public method of that subclass to template authors, regardless of the configured allowedMethods list. This issue has been patched in version 3.27.0. Severity: 8.7 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more…

CVE ID :CVE-2026-48019 Published : Sept. 4, 2026, 10:11 p.m. | 21 minutes ago Description :Laravel is a web application framework. Prior to versions 12.60.0 and 13.10.0, a CRLF injection vulnerability in Laravel’s email validation, in combination with how Symfony Mailer and Symfony Mime handle certain character sequences, may allow an unauthenticated attacker to interfere with outbound email processing in applications that send mail to user-supplied addresses. This issue has been patched in versions 12.60.0 and 13.10.0. Severity: 0.0 | NA Visit the link for more details, such as CVSS details, affected products, timeline, and more…

CVE ID :CVE-2026-85787 Published : Sept. 4, 2026, 9:17 p.m. | 1 hour, 15 minutes ago Description :An incomplete list of disallowed inputs in the SQL validation component in Amazon awslabs postgres-mcp-server before version 1.1.7 might allow an unauthenticated actor to modify data beyond the read-only scope by placing crafted SQL into the content that is submitted when an authenticated user interacts with the MCP server. To remediate this issue, users should upgrade to version 1.1.7 or above. Severity: 7.1 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more…

CVE ID :CVE-2026-85702 Published : Sept. 4, 2026, 9:17 p.m. | 1 hour, 15 minutes ago Description :A security vulnerability has been detected in ramon-victor freegpt-webui up to 098db3dfeb41555c2ca9269df0f13e10ec1c35dc. Affected is the function _conversation of the file server/backend.py of the component Backend Conversation API. Such manipulation of the argument model leads to missing authentication. The attack may be launched remotely. The exploit has been disclosed publicly and may be used. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version details for either affected or updated releases. This vulnerability only affects products that are no longer supported by the maintainer. Severity: 7.5 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more…

CVE ID :CVE-2026-85703 Published : Sept. 4, 2026, 9:17 p.m. | 1 hour, 15 minutes ago Description :A flaw has been found in ramon-victor freegpt-webui up to 098db3dfeb41555c2ca9269df0f13e10ec1c35dc. Affected by this issue is the function getJailbreak of the file server/backend.py of the component Jailbreak Mode. Executing a manipulation can lead to allocation of resources. The attack can be executed remotely. The exploit has been published and may be used. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable. This vulnerability only affects products that are no longer supported by the maintainer. Severity: 6.5 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more…

CVE ID :CVE-2026-85704 Published : Sept. 4, 2026, 9:17 p.m. | 1 hour, 15 minutes ago Description :A security flaw has been discovered in ramon-victor freegpt-webui up to 098db3dfeb41555c2ca9269df0f13e10ec1c35dc. This issue affects the function getJailbreak of the file server/config.py of the component Jailbreak Mode. The manipulation results in race condition. It is possible to launch the attack remotely. The attack requires a high level of complexity. The exploitability is assessed as difficult. The exploit has been released to the public and may be used for attacks. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. This vulnerability only affects products that are no longer supported by the maintainer. Severity: 3.7 | LOW Visit the link for more details, such as CVSS details, affected products, timeline, and more…

CVE ID :CVE-2026-82712 Published : Sept. 4, 2026, 9:17 p.m. | 1 hour, 15 minutes ago Description :Tycon Systems TPDIN-Monitor-WEB3 versions 2.2.9 and prior are vulnerable to a cross-site request forgery vulnerability. This could allow an attacker to perform state changing operations on the device. Severity: 8.8 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more…

CVE ID :CVE-2026-85701 Published : Sept. 4, 2026, 9:17 p.m. | 1 hour, 15 minutes ago Description :A vulnerability has been found in ramon-victor freegpt-webui up to 098db3dfeb41555c2ca9269df0f13e10ec1c35dc. This issue affects the function ChatCompletion.create of the file g4f/__init__.py of the component Authentication Check. Such manipulation leads to missing authentication. The attack may be performed from remote. The exploit has been disclosed to the public and may be used. This product utilizes a rolling release system for continuous delivery, and as such, version information for affected or updated releases is not disclosed. This vulnerability only affects products that are no longer supported by the maintainer. Severity: 5.5 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more…

CVE ID :CVE-2026-53769 Published : Sept. 4, 2026, 9:17 p.m. | 1 hour, 15 minutes ago Description :Avo is a framework to create admin panels for Ruby on Rails apps. From version 2.28.0 to before version 3.32.0, Avo’s direct attachment upload endpoint lacks server-side upload authorization and bypasses the documented field-level upload policy methods such as upload_{FIELD_ID}?. An authenticated Avo user who can reach the Avo attachment upload endpoint can replace or add attachment content, including binary content, filename, and content-type metadata, on a resolved record even when both update? and upload_? policies deny the operation. This primarily affects multi-role Avo Pro/Advanced-style deployments where non-administrator or restricted operator users can reach Avo and per-record or per-field operations are expected to be enforced by policies. This issue has been patched in version 3.32.0. Severity: 6.5 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more…

CVE ID :CVE-2026-50894 Published : Sept. 4, 2026, 9:17 p.m. | 1 hour, 15 minutes ago Description :easyadmin v2.0.2.2 is vulnerable to Unrestricted Upload of File with Dangerous Type in the background management interface which allows authenticated remote attackers to execute arbitrary code and gain server privileges via a crafted file upload. Severity: 0.0 | NA Visit the link for more details, such as CVSS details, affected products, timeline, and more…

CVE ID :CVE-2026-75438 Published : Sept. 4, 2026, 9:17 p.m. | 1 hour, 15 minutes ago Description :Buffer Overflow vulnerability in Open5GS v2.7.7 allows a remote attacker to cause a denial of service via the ogs_sbi_time_parse() function Severity: 0.0 | NA Visit the link for more details, such as CVSS details, affected products, timeline, and more…

CVE ID :CVE-2026-75439 Published : Sept. 4, 2026, 9:17 p.m. | 1 hour, 15 minutes ago Description :An issue in Free5GC v.4.2.2 allows a remote attacker to cause a denial of service via the UPF component Severity: 0.0 | NA Visit the link for more details, such as CVSS details, affected products, timeline, and more…

CVE ID :CVE-2026-77847 Published : Sept. 4, 2026, 9:17 p.m. | 1 hour, 15 minutes ago Description :Tycon Systems TPDIN-Monitor-WEB3 versions 2.2.9 and prior are vulnerable to a use of hard-coded credential vulnerability. This could allow an attacker to intercept sensitive information or credentials. Severity: 7.1 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more…

CVE ID :CVE-2026-79423 Published : Sept. 4, 2026, 9:17 p.m. | 1 hour, 15 minutes ago Description :An authenticated remote code execution (RCE) vulnerability in the admin_config.php component of seacms v13.6 allows attackers to execute arbitrary code via a crafted POST request. Severity: 0.0 | NA Visit the link for more details, such as CVSS details, affected products, timeline, and more…

CVE ID :CVE-2026-79426 Published : Sept. 4, 2026, 9:17 p.m. | 1 hour, 15 minutes ago Description :An arbitrary file deletion vulnerability in the /adminapi/file/video_data_save component of CRMEB v6.0.0 allows authenticated attackers to delete arbitrary files via crafted POST request. Severity: 0.0 | NA Visit the link for more details, such as CVSS details, affected products, timeline, and more…

CVE ID :CVE-2025-67066 Published : Sept. 4, 2026, 9:17 p.m. | 1 hour, 15 minutes ago Description :SQL Injection vulnerability in oasys sysoa version 1.0 allows a remote attacker to execute arbitrary code via the outtype parameter in the /outaddresspaging path Severity: 0.0 | NA Visit the link for more details, such as CVSS details, affected products, timeline, and more…

CVE ID :CVE-2022-26961 Published : Sept. 4, 2026, 9:17 p.m. | 1 hour, 15 minutes ago Description :Italtel NetMatch-S 5.0.0-20200703 allows Multiple Stored XSS under NP_IBCF-NATUP-01/NMSCI-WebGui/backup_restore.jsp and NP_IBCF-MIBER-03/NMSCI-WebGui/storage.jsp via the name parameter. A malicious user leveraging this vulnerability could inject arbitrary JavaScript. The malicious payload will then be triggered every time an authenticated user browses the page containing it. Severity: 0.0 | NA Visit the link for more details, such as CVSS details, affected products, timeline, and more…

CVE ID :CVE-2026-85786 Published : Sept. 4, 2026, 8:17 p.m. | 2 hours, 15 minutes ago Description :Improper handling of highly compressed data in Amazon ion-java before 1.12.1 might allow remote attackers to cause a denial of service via a crafted compressed Ion document that expands to an arbitrarily large size upon decompression due to insufficient coverage of the GZIP auto-decompression opt-out introduced for CVE-2026-75936. To remediate this issue, users should upgrade to version 1.12.1. Severity: 8.7 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more…

CVE ID :CVE-2026-85643 Published : Sept. 4, 2026, 8:17 p.m. | 2 hours, 15 minutes ago Description :A flaw has been found in code-projects Online Shopping System 1.0. Impacted is the function mysqli_query of the file admin/adduser.php. Executing a manipulation of the argument mobile can lead to sql injection. The attack may be performed from remote. The exploit has been published and may be used. Severity: 5.8 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more…