Free 30-min security demo - Explore the products, deployment and workflows that fit your team Book Now
In-depth technical analysis of recently disclosed vulnerabilities in open-source software. Every post includes the vulnerable code, the fix, real-world impact, and how SAST catches it.
CVE-2026-19979 exposes a WebDAV authorization bypass in 17 GL.iNet router models, allowing remote attackers to access restricted filesystem paths.
CVE-2026-74791: Scriban's TemplateContext.Reset() fails to clear CachedTemplates, enabling cross-request template leakage in multi-tenant applications.
CVE-2026-19821 is a remotely exploitable stack buffer overflow in Tenda AC12 firmware 15.03.06.23 that allows attackers to achieve arbitrary code execution.
CVE-2026-72831 is a broken object-level authorization flaw in Grav's Flex Objects plugin that lets low-privilege admins hijack super-admin accounts.
CVE-2026-19788: A stack-based buffer overflow in Tenda AC1206 firmware 15.03.06.23 allows remote attackers to execute arbitrary code via the devName parameter.
CVE-2026-19790: A remotely exploitable stack-based buffer overflow in Tenda G0's httpd interface allows attackers to execute arbitrary code.
CVE-2026-73615: A quote-stripping mismatch in Network-AI lets attackers bypass SandboxPolicy blocklists to execute arbitrary dangerous commands.
CVE-2026-73625: GitPython before 3.1.54 allows RCE via kwarg value smuggling that bypasses check_unsafe_options, enabling arbitrary OS command execution.
CVE-2026-57858 is a stored XSS flaw in Cal.com's BookingPageTagManager letting event owners inject scripts into public booking pages.
CVE-2026-73031 is a stored XSS flaw in telegram-search where unsanitized message content passed to v-html enables zero-click JavaScript execution across all.
CVE-2026-71966 is an authenticated command injection in CyberPanel 2.4.3's remote backup feature, enabling full OS takeover via crafted API responses.
CVE-2026-72778 is an authenticated RCE in Craft CMS control panel where JSON-encoded condition configs bypass sanitization, enabling OS command execution.
CVE-2026-69118: Authenticated SSTI in Cachet ≤2.4.1 allows arbitrary PHP execution via malicious incident templates, enabling full server compromise.
CVE-2026-71965: Authenticated RCE in CyberPanel 2.4.3 lets attackers write arbitrary SSH keys to /root/.ssh/authorized_keys via the remote backup feature.
CVE-2026-19342 exposes a critical authentication bypass in Task Management System 1.0, allowing remote attackers to gain unauthorized access via SQL injection.
CVE-2026-19343 is a HIGH-severity SQL injection in Task Management System 1.0's AdminLogin.php, enabling unauthenticated remote database compromise.
CVE-2026-19341: A remotely exploitable stack-based buffer overflow in UTT HiPER 1200GW firmware via the EncryptionMode parameter, rated CVSS 8.8 High.
CVE-2026-67620: Flowise ≤3.1.4 SSRF flaw lets attackers bypass metadata endpoint deny-lists to steal OCI and Alibaba Cloud credentials.
CVE-2026-19211 exposes a critical SQL injection flaw in SourceCodester Photo Share Website 1.0's signup endpoint, enabling remote data exfiltration.
CVE-2026-19231 exposes a critical SQL injection flaw in SourceCodester Simple Doctors Appointment System 1.0.
CVE-2026-43629: A heap buffer overflow in llama.cpp's KV cache restore path enables heap corruption and potential code execution via malicious state files.
CVE-2026-53983: Unauthenticated blind SSRF in Ground Station <0.6.0 lets attackers reach internal services and cloud metadata endpoints with no credentials.
CVE-2026-58080: Eclipse Milo's OpcUaServerConfig.copy() silently drops the RoleMapper, bypassing role-permission checks for anonymous OPC UA clients.
CVE-2026-70617: Missing authorization in Spacebar Server allows any authenticated user to join arbitrary group DMs, read history, and post messages.
CVE-2026-18895 is a remotely exploitable stack-based buffer overflow in UTT HiPER 1250GW routers that can lead to full device compromise.
CVE-2026-70619: Missing admin authorization in Odysseus lets any authenticated user hijack the embedding backend, exfiltrating all AI-processed data.
CVE-2026-18641 is a remotely exploitable OS command injection in Sangfor OMS up to 3.0.13, enabling full system compromise via the login endpoint.
CVE-2026-67598: Emlog Pro disables TLS certificate verification in ai.php, enabling MitM attackers to steal LLM API keys and inject malicious AI responses.
CVE-2026-67336: better-auth before 1.6.11 allows unsigned JWT tokens and plain PKCE in OIDC and MCP plugins, enabling token forgery and auth code interception.
CVE-2026-67356 is a critical privilege escalation in ArcadeDB where JavaScript triggers execute with unrestricted host access, enabling admin user creation.
CVE-2026-67325: GitPython's incomplete blocklist allows attackers to bypass unsafe-option guards via abbreviated git long-options.
CVE-2026-67343 exposes ArcadeDB's cluster token in plaintext via the server API, enabling privilege escalation to root and full administrative takeover.
CVE-2026-66416: Leantime 3.6.2 omits Laravel's VerifyCsrfToken middleware globally, enabling unauthenticated attackers to forge state-changing requests as any.
CVE-2026-67351 is a high-severity authentication context confusion flaw in Serendipity CMS allowing privilege escalation from Editor to Administrator.
CVE-2026-67595: Obfuscated JavaScript embedded in VaahCMS OTP email templates enables keylogging, C2 communication, and DOM scraping in affected browsers.
CVE-2026-18107: A CRIU rseq race lets a container process hijack parasite injection to spoof credentials, gaining elevated capabilities on restore.
CVE-2026-57510 exposes a broken object-level authorization flaw in SuperPlane's gRPC handlers, enabling cross-tenant data access and workflow disruption.
CVE-2026-17523 is a Linux kernel flaw allowing unprivileged local users to execute arbitrary kernel code and gain root privileges - CVSS 7.8 HIGH.
CVE-2026-63720: datamodel-code-generator before 0.70.0 allows RCE via unsanitized customBasePath values injected into generated Python import statements.
CVE-2025-71408 is a high-severity eval injection in NLTK's collocations module allowing arbitrary Python code execution via CLI arguments.
CVE-2026-66033: A pre-authentication integer underflow in libssh2's AES-GCM cipher path lets a rogue SSH server crash any connecting client.
CVE-2026-65702: A path traversal flaw in Vanna's FileSystemConversationStore lets unauthenticated attackers write and read arbitrary files on the server.
CVE-2026-65917: CyberPanel's incremental-backup handlers let authenticated users hijack or delete any tenant's backups via sequential IDs.
CVE-2024-58353 exposes Cal.com ≤4.7.15 to stored XSS through unsanitized booking question labels rendered via dangerouslySetInnerHTML in public booking views.
CVE-2024-58355 is a stored XSS in Cal.com through 4.7.15 letting attackers inject JavaScript via booking-question labels.
CVE-2026-64624: FreeRDP's RDP file parser exposes the full CLI surface to untrusted input, enabling RCE, cert bypass, and filesystem exfiltration.
CVE-2026-65056: SSRF in mcp-webresearch 0.1.7 lets attackers access cloud metadata and internal services via prompt injection into the visit_page tool.
CVE-2026-63090 is a heap-based buffer overflow in ProFTPD's mod_sftp module enabling authenticated RCE - a critical risk for internet-facing FTP servers.
CVE-2026-63735: SurrealDB before 3.2.0 fails to validate namespace/database scope in custom API routes, enabling cross-tenant data access.
CVE-2024-58366 exposes a format string vulnerability in SurrealDB's rquickjs bindings, enabling memory reads or RCE for authenticated scripting users.
CVE-2026-11826 is a heap-based buffer overflow in OpenPLC v3's getData() enabling heap corruption and denial of service.
CVE-2023-54366: SurrealDB defaulted table permissions to FULL instead of NONE, exposing all tables to unrestricted read/write.
CVE-2024-58362 is a critical deserialization flaw in SurrealDB's RPC API allowing unauthenticated attackers to inject and execute arbitrary subqueries.
CVE-2026-62231: Grav API plugin ignores key scopes, letting a read-only API key perform full administrative operations. CVSS 8.1 HIGH.
CVE-2026-62234: Grav CMS webhook dispatch allows file://, dict://, and gopher:// protocols, enabling authenticated SSRF and local file read.
CVE-2026-62202 is a high-severity privilege escalation in OpenClaw's isolated cron jobs, allowing lower-trust callers to bypass denied execution controls.
CVE-2026-63085 is an authorization bypass in Axelor Open Platform 8.x letting authenticated users escalate to admin via nested saves.
CVE-2026-46640: A code injection flaw in Twig 3.15-3.25 allows attackers to inject raw PHP via dynamic macro attribute syntax, enabling RCE.
CVE-2026-57996: A missing authorization guard in phpMyFAQ's user/add API lets delegated admins create SuperAdmin accounts, enabling full instance takeover.
CVE-2026-15691: Stack-based buffer overflow in Tenda BE12 Pro 16.03.66.23 via fromSafeClientFilter allows unauthenticated RCE over the network.
CVE-2026-15694 exposes a remotely exploitable stack-based buffer overflow in Tenda BE12 Pro firmware, enabling unauthenticated RCE on affected routers.
CVE-2026-49970 is a path traversal flaw in Laravel-Mediable's sanitizePath() that lets attackers write files to arbitrary server locations, enabling RCE.
CVE-2026-61876: Stored XSS in OpenWrt LuCI via unsanitized DHCPv6 FQDN hostnames lets adjacent attackers hijack admin sessions.
CVE-2026-15483: A remotely exploitable stack buffer overflow in TRENDnet TEW-821DAP 1.12B01 allows attackers to achieve RCE via a crafted nslookup request.
CVE-2026-15484 is a remote stack buffer overflow in TRENDnet TEW-821DAP 1.12B01 firmware that allows unauthenticated RCE via the tools_nslookup endpoint.
CVE-2026-15480 is a remotely exploitable stack-based buffer overflow in TRENDnet TEW-635BRM routers, enabling unauthenticated RCE on EOL devices.
CVE-2026-15481 is a critical command injection flaw in TRENDnet TEW-635BRM firmware allowing unauthenticated RCE via the ipoa_ipaddr argument.
CVE-2025-30007: Authenticated OS command injection in HestiaCP's DNS record handling lets low-privilege users execute arbitrary commands as root.
CVE-2026-54329: A mass assignment flaw in Snipe-IT's Accessories API lets low-privileged users write records across company boundaries, scoring CVSS 8.5.
CVE-2026-58459: gpsd's gpsprof tool allows attackers who control GPS device subtype values to execute arbitrary shell commands via unsanitized gnuplot titles.
CVE-2026-59937: pypdf before 6.14.0 allows denial of service via crafted PDFs with malformed cross-reference streams causing unbounded recovery loops.
CVE-2026-59257 is a SQL injection flaw in n8n's legacy MySQL v1 node that allows attackers to execute arbitrary SQL via expression interpolation.
CVE-2026-60104: Bitwarden Server authorization bypass lets a low-privileged org member steal another user's vault key and take over their account.
CVE-2026-54765 is a filter-merging flaw in Traefik's Kubernetes Gateway API provider allowing cross-tenant header injection via shared backends.
CVE-2026-60102 allows authenticated attackers to execute arbitrary OS commands through malicious filenames in Horde VFS before 3.0.1.
CVE-2024-6387 (regreSSHion) is a signal handler race in OpenSSH sshd allowing unauthenticated root RCE on glibc Linux. Detection and patch guidance.
CVE-2024-21626 (Leaky Vessels) is a runc container escape via a leaked /proc/self/cwd file descriptor, letting attackers access the host filesystem.
CVE-2023-50585 is a stack overflow in Tenda A18 v15.13.07.09 formSetDeviceName, allowing unauthenticated remote code execution via the devName parameter.
CVE-2023-50643 lets attackers execute arbitrary code in Evernote for macOS 10.68.2 via an unsafe Electron RunAsNode configuration. CVSS 9.8 critical.
CVE-2023-49235 is an OS command injection in TRENDnet TV-IP1314PI cameras via unsafe popen() and weak debug filtering, enabling unauthenticated RCE.
CVE-2023-51126 is a command injection in FLIR AX8 thermal cameras up to firmware 1.46.16, enabling RCE via unsanitized input to the res.php endpoint.
CVE-2023-7220 is a critical stack buffer overflow in the Totolink NR1800X loginAuth function, enabling remote code execution without authentication.
CVE-2023-7221 is a critical buffer overflow in the Totolink T6 HTTP POST login handler, enabling unauthenticated remote code execution. CVSS 9.8.
CVE-2023-31446 is a command injection flaw in Cassia Gateway firmware; the unsanitized queueUrl parameter gives unauthenticated attackers root RCE.
CVE-2024-21646 is an integer overflow in the Azure uAMQP C library when parsing crafted binary type data, enabling RCE in dependent AMQP clients.
CVE-2023-49237 is an OS command injection in the TRENDnet TV-IP1314PI language pack handler; unfiltered URL parameters allow unauthenticated RCE.
CVE-2024-21650 is a critical RCE in XWiki Platform user registration; unsanitized first and last name fields let attackers execute arbitrary code.
CVE-2023-49236 exploits unvalidated sscanf input in TRENDnet TV-IP1314PI, enabling remote code execution through malicious RTSP scale parameters.
CVE-2024-0321 is a critical stack-based buffer overflow in GPAC prior to v2.3-DEV enabling remote code execution through malformed media files.
CVE-2024-22087 is a stack buffer overflow in Pico HTTP Server URI handling, allowing unauthenticated remote code execution via oversized request paths.
CVE-2024-22051 is an integer overflow in CommonMarker's GFM table parser causing heap corruption and potential RCE via oversized marker rows.
CVE-2023-51277 is a macOS entitlement flaw in Jupyter Notebook Viewer before 0.1.6 allowing unauthorized task access and privilege escalation.
CVE-2024-22086 is a stack buffer overflow in Cherry HTTP server URI parsing, enabling unauthenticated remote code execution via malformed requests.
CVE-2024-22088 is a use-after-free in Lotos WebServer buffer management; long URIs trigger mishandled realloc calls, enabling remote code execution.
CVE-2023-50921 is a pre-auth privilege escalation in GL.iNet routers via the add_user API endpoint, affecting 12 models on firmware 4.3.7 through 4.5.0.
CVE-2023-46308 is a prototype pollution flaw in Plotly.js before 2.25.2; plot API calls can manipulate __proto__ to enable arbitrary code execution.
CVE-2024-21623 exposes critical expression injection vulnerability in OTClient's SonarCloud workflow, enabling remote command execution and secret exfiltration.
No vulnerabilities match your filter.
Offensive360 SAST detects the vulnerability patterns documented here, plus thousands more - across 60+ programming languages. See what's hiding in your source code.
