PatchTheCVECVEs published by CERT/CC
CVEs published by CERT/CC (CVE Numbering Authority). 17 tracked.
- CVE-2026-16504 CRITICAL 9.8 Deployment of the VPS.org one-click Zulip template deploys a hardcoded application signing key, a default data
- CVE-2026-16503 CRITICAL 9.1 Deployment of the VPS.org one-click Supabase template deploys a PostgreSQL instance that is published on all i
- CVE-2026-16771 HIGH 8.8 In firmware versions 2.7.7 and earlier, the Arris BGW210‑700 gateway fails to enforce any server‑side authenti
- CVE-2026-16751 MEDIUM 6.5 Authorization Bypass in the emergency recovery approval component in Ente Technologies Ente Museum Server allo
- CVE-2026-15657 MEDIUM 6.5 A vulnerability in the foreUP customer REST API allows any authenticated user to read cleartext payment-proces
- CVE-2026-15734 CRITICAL 9.8 A Server-Side Template Injection (SSTI) vulnerability in WGDashboard version 4.3.2 and earlier, allows authent
- CVE-2026-16637 MEDIUM 6.5 OPeNDAP Hyrax allows SSRF and credential disclosure via unvalidated HTTP redirects that bypass the AllowedHost
- CVE-2026-18497 HIGH 7.1 A heap-buffer-overflow vulnerability exists in the nothings stb TrueType library, up to version 1.26, that is
- CVE-2026-15430 MEDIUM 6.2 Improper access control in the IRP_MJ_WRITE command interface in Wellbia XIGNCODE3 xhunter2.sys, version 2026
- CVE-2026-18749 CRITICAL 9.8 The type=track branch authorises on _is_my_case(t_attach.case) only and never checks VinceTrackAttachment.shar
- CVE-2026-18744 MEDIUM 6.5 Any authenticated case participant can fetch any OTHER vendor's CaseStatement + per-vul CaseMemberStatus by su
- CVE-2026-6726 HIGH 7.9 An information leakage vulnerability was reported in the TCG TPM 2.0 reference code that could allow a local a
- CVE-2026-18750 MEDIUM 5.3 vinny/views.py: (ModifyEmailNotifications) IDOR: view fetches VinceCommEmail by raw pk from URL and toggles em
- CVE-2026-6727 MEDIUM 5.9 A timing side-channel vulnerability exists in the RSA OAEP decryption implementation
- CVE-2026-114463 HIGH n/a The webhook platform gateway in Nous Research Hermes Agent versions builds the session chat_id as webhook:{rou
- CVE-2026-82987 HIGH n/a There exists a screen capture endpoint in vCast media streaming service in ViewSonic ViewBoard unknown allows
- CVE-2026-107692 MEDIUM 4.8 The War Thunder game client transmits its authentication bearer token (auth_jwt) in the very first data packet