CVEs published by CERT.PL

CVEs published by CERT.PL (CVE Numbering Authority). 33 tracked.

• CVE-2026-66723 HIGH 7.0 MWDB Core versions >=2.2.0 and <2.19.0 contain a missing authorization vulnerability in the Remote Instances p
• CVE-2026-46593 HIGH 8.6 A SQL injection vulnerability has been identified in the PHP Jabbers - PHP Poll Script
• CVE-2026-56389 HIGH 8.6 DOWNGRADE GNU Bison allows for an execution of an arbitrary program during HTML report generation due to improper handli
• CVE-2026-46594 MEDIUM 5.1 A reflected cross-site scripting (XSS) vulnerability has been identified in the PHP Jabbers - PHP Poll Script
• CVE-2026-50641 HIGH 7.1 Streamsoft Business Intelligence (BI) stores users' passwords in plaintext form in the database This issue wa
• CVE-2026-66724 MEDIUM 5.3 MWDB Core versions >=2.0.0 and <2.19.0 contain a missing authorization vulnerability in the deprecated config
• CVE-2026-33385 MEDIUM 5.1 A Blind SQL injection vulnerability has been identified in Quick.CMS
• CVE-2026-56390 MEDIUM 6.3 DOWNGRADE GNU Bison improperly handles grammar‑defined output paths
• CVE-2026-50642 MEDIUM 4.8 diff‑so‑fancy does not properly sanitize non‑SGR terminal control sequences before outputting diff data
• CVE-2026-71392 MEDIUM 5.3 GNU Emacs for Android is vulnerable to an integer overflow in the sfnt_read_cmap_format_12() function in src/s
• CVE-2026-71393 MEDIUM 5.3 GNU Emacs for Android is vulnerable to an integer overflow in sfnt_read_name_table() in src/sfnt.c
• CVE-2026-71391 MEDIUM 5.3 GNU Emacs for Android contains an off-by-one error in the gvar table parser in src/sfnt.c
• CVE-2026-71394 MEDIUM 5.3 GNU Emacs for Android improperly validates the table header input in sfnt_read_table_directory() in src/sfnt.c
• CVE-2026-18478 MEDIUM 5.1 Magnolia CMS is vulnerable to Stored XSS in import functionality
• CVE-2026-66484 MEDIUM 4.6 GNU cpio contains a Path Traversal vulnerability in its tar archive extraction functionality
• CVE-2026-66485 MEDIUM 4.6 GNU cpio is vulnerable to an uncontrolled memory allocation in the make_path function at src/makepath.c
• CVE-2026-66486 MEDIUM 4.6 GNU cpio is vulnerable to improper encoding or escaping of output in its archive member listing functionality
• CVE-2026-18370 MEDIUM 4.8 entr is vulnerable to Heap-based buffer overflow in run_utility() function
• CVE-2025-30052 HIGH 8.8 The rsyncd service of the CGM CLININET is vulnerable to Authentication Bypass via IP spoofing
• CVE-2025-30047 CRITICAL 9.4 CGM CLININET is vulnerable to Remote Code Execution caused by deserialization of untrusted data
• CVE-2025-30050 CRITICAL 9.4 CGM CLININET is vulnerable to Code Injection in the RunCGI.pm component, which dynamically imports the module
• CVE-2025-30046 CRITICAL 9.0 In the CGM CLININET application server, multiple processes responsible for HL7 communication with external sys
• CVE-2025-30053 MEDIUM 6.9 The CGM CLININET application runs the cgm-updater process listening on an open network port without any authen
• CVE-2025-30049 HIGH 8.2 The CGM CLININET application stores user passwords as unsalted MD5 hashes. This issue was fixed in versions
• CVE-2025-30054 CRITICAL 9.3 CGM CLININET is vulnerable to local privilege escalation
• CVE-2025-30045 HIGH 8.6 CGM CLININET is vulnerable to Code Injection in the ConvExpr function, which processes Perl expressions into R
• CVE-2025-58403 MEDIUM 5.1 CGM CLININET is vulnerable to Reflected Cross-Site Scripting (XSS) due to improper neutralization of user-supp
• CVE-2025-30043 HIGH 7.1 CGM CLININET is vulnerable to Missing Authentication for Critical Function in the /DocManagment path
• CVE-2025-30051 MEDIUM 6.8 The CGM CLININET application stores the production database login and password, as well as RabbitMQ broker cre
• CVE-2026-16477 HIGH 8.4 CleanShot X for macOS insecurely deserializes untrusted data embedded in a .cleanshot project file (editable s
• CVE-2026-67279 MEDIUM 6.5 EXPLOITED UPGRADE Mikrotik RouterOS Improper Enforcement of Behavioral Workflow Vulnerability
• CVE-2026-67277 HIGH 8.2 EXPLOITED UPGRADE MikroTik RouterOS Missing Authentication for Critical Function Vulnerability
• CVE-2026-86060 CRITICAL 9.8 EXPLOITED UPGRADE MikroTik RouterOS Improper Neutralization of Argument Delimiters in a Command Vulnerability

← Back to latest CVEs