Latest CVEs

CVE-2026-47211 - Ouroboros: Remote Code Execution via Untrusted Project-Directory .env
Published: Mon, 03 Aug 2026 20:01:03 +0000
CVE ID :CVE-2026-47211
Published : Aug. 3, 2026, 8:01 p.m. | 20 minutes ago
Description :Ouroboros is a local-first runtime for AI coding agents that records their actions and applies user-defined policies to constrain behavior. In versions prior to 0.39.0, if a user clones a malicious repository and runs Ouroboros commands within that directory, it can lead to arbitrary code execution and potential system takeover. The vulnerability stems from Ouroboros loading the .env file from the current working directory. Execution-affecting environment variables such as OUROBOROS_CLI_PATH, OPENCODE_CLI_PATH, and other backend selectors are accepted directly from this local .env. An attacker can include a malicious script in the repository and point the CLI path variable to it (e.g., OUROBOROS_CLI_PATH=./malicious_script.sh). When the user executes a command like ouroboros init or any command that instantiates the adapter, the malicious script is executed instead of the intended CLI. This issue has been fixed in version 0.39.0.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE-2026-18644 - danpros HTMLy Delete Username Endpoint htmly.php unlink path traversal
Published: Mon, 03 Aug 2026 20:00:10 +0000
CVE ID :CVE-2026-18644
Published : Aug. 3, 2026, 8 p.m. | 21 minutes ago
Description :A vulnerability was identified in danpros HTMLy up to 3.1.1. Affected by this issue is the function unlink of the file /system/htmly.php of the component Delete Username Endpoint. Such manipulation of the argument File leads to path traversal. The attack can be launched remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE-2026-68981 - Apache NiFi: Uncontrolled Resource Consumption through Decompression of HTTP Requests
Published: Mon, 03 Aug 2026 19:59:58 +0000
CVE ID :CVE-2026-68981
Published : Aug. 3, 2026, 7:59 p.m. | 21 minutes ago
Description :Apache NiFi 1.5.0 through 2.10.0 support gzip-encoded HTTP requests for the application REST API using a Jersey encoding filter. The framework enforced a configurable maximum request size on the compressed payload rather than the decompressed output, allowing a malicious client to send crafted requests that could consume excessive amounts of memory. Upgrading to Apache NiFi 2.11.0 is the recommended mitigation, which relocates response compression to Jetty Server and disables decompression of gzip-encoded HTTP requests.
Severity: 8.8 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE-2026-69198 - ip-address: a CIDR suffix on the parsed address suppresses special-use classification and can bypass SSRF and trust-boundary checks
Published: Mon, 03 Aug 2026 19:59:05 +0000
CVE ID :CVE-2026-69198
Published : Aug. 3, 2026, 7:59 p.m. | 22 minutes ago
Description :ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. From 10.1.1 until 10.2.2, every special-use classification method is built on isInSubnet, which short-circuits to false whenever the address's own subnet mask is shorter than the reference range's mask. That mask comes verbatim from the CIDR suffix on the parsed input, so appending a suffix such as /0 suppresses classification entirely: isLoopback(), isPrivate(), isLinkLocal(), isCGNAT(), isMulticast(), isUnspecified(), isBroadcast(), isULA(), and getType() all report an internal address as unremarkable, while correctForm() and address still return the real internal target. An application that builds a network trust-boundary decision on these checks, for example a filter intended to block Server-Side Request Forgery, or SSRF, may therefore treat an internal target as external and allow the request. The underlying bit comparison is correct, and mask(n) already returns the first n bits of the full parsed address independently of subnetMask; the defect is solely that the containment guard sits in the classification path. This issue is fixed in version 10.2.2.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE-2026-68980 - Apache NiFi: Authorization Bypass for Parameter Context Asset Deletion
Published: Mon, 03 Aug 2026 19:58:56 +0000
CVE ID :CVE-2026-68980
Published : Aug. 3, 2026, 7:58 p.m. | 22 minutes ago
Description :Apache NiFi 2.0.0 through 2.10.0 support creating, reading, and deleting Assets associated with Parameter Contexts through the REST API. The framework authorizes asset deletion against the owning Parameter Context using the supplied Parameter Context Identifier and Asset Identifier. The framework performed authorized based on the supplied Parameter Context Identifier without verifying the requested Identifier against the stored Identifier. Apache NiFi installations that do not implement different levels of authorization across Parameter Contexts are not subject to this vulnerability, because the framework enforces write permissions as the security boundary. Upgrading to Apache NiFi 2.11.0 is the recommended mitigation, which verifies Parameter Context ownership of the requested Asset before deletion using the same strategy applied to Asset read operations.
Severity: 2.3 | LOW
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE-2026-62354 - Apache NiFi: Incorrect Authorization for Parameter Context Validation Requests
Published: Mon, 03 Aug 2026 19:57:44 +0000
CVE ID :CVE-2026-62354
Published : Aug. 3, 2026, 7:57 p.m. | 23 minutes ago
Description :Authorization handling for Parameter Context validation requests in Apache NiFi 1.10.0 through 2.10.0 allows clients with read access to submit proposed Parameter values. The proposed values override current configuration, enabling users with read access to invoke predefined component validation methods with alternative settings. Apache NiFi installations that do not implement different levels of authorization for viewing and modifying Parameter Context configuration are not subject to this vulnerability. Upgrading to Apache NiFi 2.11.0 is the recommended mitigation, requiring write access to submit Parameter Context validation requests.
Severity: 7.7 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE-2026-69192 - ip-address: Address4 decodes leading-zero octets as decimal while resolvers decode them as octal, allowing SSRF and trust-boundary bypass
Published: Mon, 03 Aug 2026 19:56:13 +0000
CVE ID :CVE-2026-69192
Published : Aug. 3, 2026, 7:56 p.m. | 25 minutes ago
Description :ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.3.1, Address4 accepts an octet written with a leading zero and decodes it as decimal, while the WHATWG URL host parser, inet_aton, and getaddrinfo all decode a leading zero as octal. The library and the network stack therefore disagree about which host a string names. new Address4('012.0.0.1') reports correctForm() of 12.0.0.1 and isPrivate() of false, but fetch('http://012.0.0.1/') connects to 10.0.0.1. An application that builds a network trust-boundary decision on these checks, for example a filter intended to block Server-Side Request Forgery, or SSRF, will classify an internal target as external and allow the request. The defect is in the parse gate rather than in any one classifier, so every consumer of Address4 inherits it: isPrivate(), isLoopback(), isLinkLocal(), isCGNAT(), isInSubnet(), isHostInSubnet(), and correctForm() are all computed from the mis-decoded octets. This issue is fixed in version 10.3.1.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE-2026-68979 - Apache NiFi: Missing Authorization for Components Referenced by Parameter Context Updates
Published: Mon, 03 Aug 2026 19:56:11 +0000
CVE ID :CVE-2026-68979
Published : Aug. 3, 2026, 7:56 p.m. | 25 minutes ago
Description :Apache NiFI 1.10.0 through 2.10.0 provide a Parameter Context update REST API method that does not enforce authorization checking on components referencing Parameter values. Updating a Parameter Context can change parameter values that affect referencing components, but framework authorization was limited to read and write privileges on the Parameter Context itself. As a result of the missing authorization, an authenticated user authorized to modify a Parameter Context, but not authorized on referencing components, could alter Parameter values affecting those components. In deployments where a Parameter value contains executable scripting content, updating a Parameter can result in code execution during automatic component validation, without starting the referencing component. The impact was limited to stopped components by existing verification checks, and the issue applies only to deployments that use component-level authorization policies. Upgrading to Apache NiFi 2.11.0 is the recommended mitigation, which aligns the Parameter Context update method authorization with other methods, adding authorization checking on affected components.
Severity: 5.9 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE-2026-58139 - DuckDB AWS Extension Security Policy Bypass via load_aws_credentials Procedure
Published: Mon, 03 Aug 2026 19:45:31 +0000
CVE ID :CVE-2026-58139
Published : Aug. 3, 2026, 7:45 p.m. | 36 minutes ago
Description :The DuckDB AWS extension for DuckDB contains a security policy bypass vulnerability that allows any database user with SQL execution permissions to extract plaintext AWS credentials by calling the load_aws_credentials function with the redact_secret parameter set to false, circumventing the database-wide allow_unredacted_secrets=false policy. Attackers can invoke this single function to retrieve the underlying AWS credential chain including access_key_id, secret_access_key, session_token, and region in plaintext, which are immediately valid against AWS APIs and particularly impactful in managed environments where pg_duckdb is preloaded and an AWS credential chain such as IMDSv2, IRSA, ECS task role, or EC2 instance role is reachable.
Severity: 6.5 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE-2026-18641 - Sangfor Operation and Maintenance Security Management System Login Endpoint portal_login com.sbr.fort.foreignDP.DpLoginController os command injection
Published: Mon, 03 Aug 2026 19:45:10 +0000
CVE ID :CVE-2026-18641
Published : Aug. 3, 2026, 7:45 p.m. | 36 minutes ago
Description :A vulnerability was determined in Sangfor Operation and Maintenance Security Management System up to 3.0.13. Affected by this vulnerability is the function com.sbr.fort.foreignDP.DpLoginController of the file /fort/portal_login of the component Login Endpoint. This manipulation causes os command injection. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE-2026-18654 - Disabled SSH host key verification in Amazon AWS CLI EMR helper commands
Published: Mon, 03 Aug 2026 19:38:51 +0000
CVE ID :CVE-2026-18654
Published : Aug. 3, 2026, 7:38 p.m. | 42 minutes ago
Description :Key exchange without entity authentication in the EMR SSH helper commands in Amazon AWS CLI before 1.45.28 and AWS CLI v2 before 2.35.3 might allow man-in-the-middle attackers to intercept SSHsessions and file transfers via network positioning between the client and the EMR cluster endpoint. To remediate this issue, users should upgrade to AWS CLI v1 1.45.28 or later, or AWS CLI v2 2.35.3 or later.
Severity: 6.9 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE-2026-18632 - langgenius dify Jinja2 jinja2_transformer.py jinja2.Template special elements used in a template engine
Published: Mon, 03 Aug 2026 19:30:08 +0000
CVE ID :CVE-2026-18632
Published : Aug. 3, 2026, 7:30 p.m. | 51 minutes ago
Description :A security flaw has been discovered in langgenius dify up to 1.14.2. This issue affects the function jinja2.Template of the file api/core/helper/code_executor/jinja2/jinja2_transformer.py of the component Jinja2 Handler. The manipulation results in improper neutralization of special elements used in a template engine. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE-2026-59913 - Dell Display and Peripheral Manager Privilege Escalation Vulnerability
Published: Mon, 03 Aug 2026 19:16:48 +0000
CVE ID :CVE-2026-59913
Published : Aug. 3, 2026, 7:16 p.m. | 1 hour, 4 minutes ago
Description :Dell Display and Peripheral Manager (DDPM Mac), versions prior to 2.3.0.1005, contain a Missing Authentication for Critical Function vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of privileges.
Severity: 7.8 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE-2026-59912 - Dell Display and Peripheral Manager Improper Access Control Vulnerability
Published: Mon, 03 Aug 2026 19:16:48 +0000
CVE ID :CVE-2026-59912
Published : Aug. 3, 2026, 7:16 p.m. | 1 hour, 4 minutes ago
Description :Dell Display and Peripheral Manager (DDPM Mac), versions prior to 2.3.0.1005, contain an Improper Access Control vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of privileges and arbitrary code execution.
Severity: 7.8 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE-2026-38447 - osTicket API Key Cryptographic Weakness
Published: Mon, 03 Aug 2026 19:16:46 +0000
CVE ID :CVE-2026-38447
Published : Aug. 3, 2026, 7:16 p.m. | 1 hour, 4 minutes ago
Description :osTicket 1.18.3 generates API keys using a predictable construction based on MD5 hashing. The use of MD5, combined with predictable inputs such as the current timestamp and client IP address, significantly reduces entropy. An attacker can approximate the key generation time and brute-force the key space within a feasible time window.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE-2026-38446 - osTicket Stored Cross-Site Scripting
Published: Mon, 03 Aug 2026 19:16:46 +0000
CVE ID :CVE-2026-38446
Published : Aug. 3, 2026, 7:16 p.m. | 1 hour, 4 minutes ago
Description :A stored cross-site scripting (XSS) vulnerability exists in osTicket 1.18.3 due to improper sanitization of the thread entry title field. User-controlled input in the title is stored without adequate HTML escaping and later rendered in multiple staff-facing templates without proper output encoding. An attacker can inject arbitrary JavaScript by submitting a crafted ticket reply or email with a malicious subject line.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE-2026-38444 - osTicket Stored Cross-Site Scripting
Published: Mon, 03 Aug 2026 19:16:46 +0000
CVE ID :CVE-2026-38444
Published : Aug. 3, 2026, 7:16 p.m. | 1 hour, 4 minutes ago
Description :osTicket v1.18.3 is vulnerable to Stored Cross-Site Scripting (XSS) via the email From-header display name. The value is extracted without sanitization in include/class.mailparse.php and stored raw in the poster field of ost_thread_entry. When an unauthenticated attacker sends a reply email to an existing ticket from an unregistered address with an XSS payload in the From display name.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE-2026-18616 - GL-iNet GL-MT3000 wg-server.so Native Plugin glc server.set_peer command injection
Published: Mon, 03 Aug 2026 19:16:45 +0000
CVE ID :CVE-2026-18616
Published : Aug. 3, 2026, 7:16 p.m. | 1 hour, 4 minutes ago
Description :A vulnerability was identified in GL-iNet GL-MT3000 up to 4.4.5. The impacted element is the function server.set_peer of the file /cgi-bin/glc of the component wg-server.so Native Plugin. The manipulation of the argument public_key leads to command injection. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure and confirmed the existence of the vulnerability.
Severity: 10.0 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE-2026-18615 - GL-iNet GL-MT3000 wg-server.so Native Plugin glc wg-server.generate_publickey command injection
Published: Mon, 03 Aug 2026 19:16:45 +0000
CVE ID :CVE-2026-18615
Published : Aug. 3, 2026, 7:16 p.m. | 1 hour, 4 minutes ago
Description :A vulnerability was determined in GL-iNet GL-MT3000 up to 4.4.5. The affected element is the function wg-server.generate_publickey of the file /cgi-bin/glc of the component wg-server.so Native Plugin. Executing a manipulation of the argument private_key can lead to command injection. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure and confirmed the existence of the vulnerability.
Severity: 10.0 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE-2026-18614 - GL-iNet GL-MT3000 s2s.so Native Plugin glc s2s.enable_echo_server command injection
Published: Mon, 03 Aug 2026 19:16:45 +0000
CVE ID :CVE-2026-18614
Published : Aug. 3, 2026, 7:16 p.m. | 1 hour, 4 minutes ago
Description :A vulnerability was found in GL-iNet GL-MT3000 up to 4.4.5. Impacted is the function s2s.enable_echo_server of the file /cgi-bin/glc of the component s2s.so Native Plugin. Performing a manipulation of the argument port results in command injection. The attack may be initiated remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure and confirmed the existence of the vulnerability.
Severity: 10.0 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE-2025-15631 - Weak Credential Storage in TP-Link Omada Devices
Published: Mon, 03 Aug 2026 19:16:41 +0000
CVE ID :CVE-2025-15631
Published : Aug. 3, 2026, 7:16 p.m. | 1 hour, 5 minutes ago
Description :A cryptographic weakness exists in affected Omada devices where site credentials are protected using a legacy hashing algorithm that does not provide sufficient protection. An attacker who obtains access to stored credential data may be able to recover valid credentials to gain unauthorized access to affected devices or management environments.
Severity: 5.7 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE-2025-15630 - Device Provisioning Race Condition in TP-Link Omada Adoption Workflow
Published: Mon, 03 Aug 2026 19:16:40 +0000
CVE ID :CVE-2025-15630
Published : Aug. 3, 2026, 7:16 p.m. | 1 hour, 5 minutes ago
Description :A race condition exists in the cloud-based Omada device adoption process when an attacker may be able to interact with the adoption workflow before a legitimate device completes registration, resulting in provisioning information being delivered to an attacker. Successful exploitation may allow disclosure of provisioning information intended for a legitimate device.
Severity: 5.8 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE-2025-15629 - Weak Session Key Generation in TP-Link Omada Adoption Protocol
Published: Mon, 03 Aug 2026 19:16:40 +0000
CVE ID :CVE-2025-15629
Published : Aug. 3, 2026, 7:16 p.m. | 1 hour, 5 minutes ago
Description :A cryptographic weakness exists in the Omada adoption protocol where session encryption keys used to protect communications between controllers and managed devices may be predictable due to insufficient entropy in session key generation. An attacker who successfully intercepts adoption-related communications may be able to recover session encryption keys and decrypt affected communications.
Severity: 6.9 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE-2025-15628 - Hardcoded Certificates in TP-Link Omada Device Communications
Published: Mon, 03 Aug 2026 19:16:40 +0000
CVE ID :CVE-2025-15628
Published : Aug. 3, 2026, 7:16 p.m. | 1 hour, 5 minutes ago
Description :Affected Omada devices rely on embedded certificates that are shared across deployments to establish trust between controllers and managed devices. An attacker who obtains the embedded certificates may be able to impersonate trusted controllers or devices and intercept affected communications.
Severity: 8.2 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE-2025-15627 - Hardcoded Cryptographic Keys in TP-Link Omada Adoption Protocol Authentication
Published: Mon, 03 Aug 2026 19:16:40 +0000
CVE ID :CVE-2025-15627
Published : Aug. 3, 2026, 7:16 p.m. | 1 hour, 5 minutes ago
Description :A cryptographic weakness exists in the Omada adoption protocol.  The protocol relies on hard-coded cryptographic keys to establish trust and protect authentication exchanges between controllers and managed devices during device adoption. An attacker may be able to impersonate trusted controllers or managed devices and gain access to sensitive adoption-related communications.
Severity: 6.9 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...