Reserved but Public CVEs

CVE-2026-51990 is a critical remote-code-execution chain affecting the Windows version of Tencent Sogou Input Method. Its custom sgbiz protocol handler validated the requested application component but failed to validate attacker-controlled command-line arguments. An attacker could use those arguments to invoke the product's skin-marketplace webview and navigate it to an arbitrary attacker-controlled HTTPS page. The webview used an obsolete Chromium 80-based CEF component configured without Chromium sandboxing and with web-security protections disabled. This enabled exploitation of the separately known V8 flaw CVE-2021-38003 from the attacker-controlled page, resulting in code execution.

CVE-2026-51990First seen Sep 10, 2026

CVE-2026-59346 is a critical integer-overflow vulnerability in the VMXNET3 virtual network adapter implementation in VMware Workstation and VMware Fusion. A local administrator in an affected guest virtual machine configured with a VMXNET3 adapter can exploit the flaw to execute code on the underlying host, crossing the guest-to-host isolation boundary. It affects Workstation and Fusion 25H2 and 26H1 releases prior to 26H1u1.

CVE-2026-59346First seen Sep 3, 2026

CVE-2026-53921 is a critical stack-based buffer overflow in OpenWrt's odhcpd service, specifically in the DHCPv6 Identity Association reply serialization path. The flaw is described as involving a fixed 512-byte stack buffer that can be overrun when odhcpd processes crafted DHCPv6 REQUEST packets and appends reply data without sufficient remaining-capacity checks. Available reporting indicates the vulnerable code path is associated with older odhcpd versions containing the DHCPv6 handling functions dhcpv6_ia_handle_IAs() and build_ia(). Under attacker-controlled IA option layouts, odhcpd can write beyond the allocated stack buffer while constructing a DHCPv6 reply. Because odhcpd runs with root privileges by default on affected OpenWrt systems, successful exploitation can result in severe compromise.

CVE-2026-53921First seen Jun 30, 2026

CVE-2026-59347 is a stack-based buffer-overflow vulnerability in the Host-Guest File System (HGFS) component of VMware Workstation and VMware Fusion. HGFS provides guest-host file-sharing functionality. An attacker with local administrative privileges in an affected guest virtual machine can exploit the flaw to execute code in the context of that virtual machine's host-side VMX process, crossing the guest-host isolation boundary. Affected releases include VMware Workstation and VMware Fusion 25H2 and 26H1 prior to 26H1u1.

CVE-2026-59347First seen Sep 3, 2026

CVE-2026-59774 is a critical arbitrary file-read vulnerability in the markup rendering functionality of Gitea and Forgejo. The flaw is triggered through the Org-mode renderer used by the markup endpoint for repository content rendering. Affected implementations initialize the go-org library without overriding its default ReadFile callback, allowing Org-mode #+INCLUDE directives to resolve and read absolute paths from the server filesystem. As a result, an attacker can submit crafted Org-mode markup to the repository markup rendering endpoint and cause the application to include the contents of local files in the rendered response. Reported affected versions include Gitea 1.22.1 through 1.27.0, fixed in 1.27.1, and Forgejo 7.0 through 15.0.5 and 16.0.0 through 16.0.1, fixed in 15.0.6 and 16.0.2.

CVE-2026-59774First seen Aug 4, 2026

CVE-2026-59944 is a path-traversal vulnerability in Composer package binary-path processing. A malicious or compromised dependency can declare a package binary that resolves through a symbolic link to a file outside the dependency's installed package directory. Vulnerable Composer versions can follow that link during installation, change permissions on the external target, and create a runnable command in the project's vendor binary directory that references it. The flaw bypasses earlier validation that rejected literal traversal segments because validation did not safely account for symlink resolution or restored dependency metadata. Composer fixed the issue by verifying that each declared binary resolves within its installed package directory and skipping invalid external targets.

CVE-2026-59944First seen Aug 27, 2026

CVE-2026-10797 is a legacy flaw in the Linux shim UEFI bootloader, affecting old Microsoft-signed shim builds primarily based on version 0.9 and earlier. The vulnerability lies in shim's certificate-based revocation logic for second-stage PE bootloaders: an Authenticode-signed PE binary stores signature length information in two separate structures, and vulnerable shim code reads the signature size from the wrong PE structure during revocation checking while using different data during signature verification. By tampering with the second-stage bootloader's WIN_CERTIFICATE header, an attacker can cause shim to compare dbx or MokListX revocation entries against bogus certificate data instead of the bootloader's actual signature. This allows a revoked or otherwise blocked second-stage boot component to pass the revocation check while still being accepted as signed. In practice, the flaw undermines UEFI Secure Boot trust decisions in environments that continue to trust old Microsoft-signed shim binaries.

CVE-2026-10797First seen Jun 14, 2026

CVE-2026-44772 is a critical code injection vulnerability in SAP Manufacturing Integration and Intelligence (SAP MII), affecting XMII and MII_ADMIN versions 15.4 and 15.5. A vulnerable servlet accepts specially crafted input that causes SAP MII to retrieve and process attacker-controlled content from an external source. This processing can be abused to inject code and execute arbitrary commands on the underlying host. SAP assigned the issue a CVSS score of 9.9.

CVE-2026-44772First seen Aug 11, 2026

CVE-2026-25262 is a CWE-123 write-what-where vulnerability in Qualcomm Primary Bootloader BootROM code, specifically in validation of service-program chunks handled through the Sahara protocol in Emergency Download Mode (EDL). Crafted ELF input supplied during the EDL workflow can cause arbitrary data to be written to attacker-selected memory locations before the operating system and its access controls load. The issue affects Qualcomm MDM9x07, MDM9x45, MDM9x65, MSM8909, MSM8916, MSM8952, and SDX50 chip families.

CVE-2026-25262First seen Apr 27, 2026

CVE-2025-70951First seen Apr 3, 2026

CVE-2026-88765 is a high-severity buffer overflow vulnerability in the Unicode conversion wrapper in GitLab Enterprise Edition. Processing a specially crafted Git project export can trigger the overflow during Advanced Search indexing, potentially allowing an authenticated attacker to execute code remotely. The vulnerability has a CVSS score of 8.5.

CVE-2026-88765First seen Sep 11, 2026

CVE-2026-52682 is an uncontrolled resource-consumption vulnerability in PowerDNS Authoritative Server, PowerDNS Recursor, and dnsdist. Processing a specially crafted DNS packet from a malicious DNS server can cause excessive memory and CPU consumption, resulting in a denial-of-service condition. Affected releases include Authoritative Server 4.9.16, 5.0.6, and 5.1.3; Recursor 5.2.12, 5.3.9, and 5.4.4; and dnsdist 1.9.15, 2.0.7, and 2.1.0.

CVE-2026-52682First seen Aug 6, 2026

The provided content identifies CVE-2026-38264 as a Linux kernel vulnerability in the nvme-tcp subsystem, described by SUSE as "nvme-tcp: sanitize request list handling." It is referenced in cumulative SUSE kernel security advisories affecting products including SUSE Linux Enterprise Server 16.0, SUSE Linux Micro 6.2, SUSE Linux Micro Extras 6.2, and related package sets built from kernel version 6.12.0-160000.6.1. No further technical root-cause detail, vulnerable function name, trigger condition, or upstream commit information is provided in the supplied content beyond the fact that the fix sanitizes request list handling in nvme-tcp.

CVE-2026-38264First seen Jun 27, 2026

CVE-2026-84388 is a critical improper-authentication vulnerability in the Fortinet Privileged Access Agent Chrome extension used with FortiPAM. The extension's trusted-server handling could allow an arbitrary website to become trusted, while its externally reachable messaging accepted requests broadly and did not reliably reject an invalid non-JWT access token. An attacker-controlled website could invoke the extension and supply a malicious privileged-session configuration without valid authentication. The supplied configuration could alter the browser proxy for the session, open an attacker-selected tab, and enable screen recording of that tab for transmission to an attacker-controlled server. The vulnerability is rated CVSS 9.1.

CVE-2026-84388First seen Sep 9, 2026

CVE-2026-65094 is a CWE-123 write-what-where vulnerability in the NVIDIA BlueField-3 Virtio-Net implementation, affecting NVIDIA Networking BlueField/ConnectX VIRTIO-Net deployments. A virtual-machine user can send a crafted message that causes data to be written to unintended memory locations. The resulting arbitrary-write condition can lead to code execution within the Virtio-Net scope. CVE-2025-33209 was withdrawn and replaced by this identifier.

CVE-2026-65094First seen Jul 28, 2026

CVE-2026-18576 is a high-severity authentication bypass vulnerability in N-able N-central, the vendor’s remote monitoring and management platform. The flaw has been described as an authentication bypass using an alternate path or channel and affects N-central versions prior to 2026.3, with reporting indicating impact through at least version 2026.1 before subsequent fixes. Successful exploitation allows an unauthenticated attacker to hijack or take over administrative accounts. The initial vendor patch was incomplete, and attackers were able to continue exploiting the issue until an emergency hotfix was released.

CVE-2026-18576First seen Aug 3, 2026

CVE-2026-13136 is a critical authorization flaw in Synology MailPlus Server on DiskStation Manager (DSM). The vulnerability is associated with CWE-863 (Incorrect Authorization) and allows a remote attacker to access functionality without authentication over the network. Successful exploitation can enable arbitrary file read and arbitrary file write operations and can also be used to trigger denial-of-service conditions. The issue affects MailPlus Server deployments on DSM 7.3, 7.2.2, and 7.2.1 prior to the fixed releases identified by Synology.

CVE-2026-13136First seen Jun 27, 2026

CVE-2026-57155 is a critical vulnerability in OPNsense fixed in version 26.7. The flaw affects GeoIP-related functionality exposed through the Web API, where insufficient validation of a user-supplied URL or file path allows path traversal during GeoIP data handling. An authenticated administrator can abuse the GeoIP alias import mechanism to cause arbitrary file creation or overwrite in attacker-controlled filesystem locations while the operation runs with root privileges. By placing a crafted configuration file in a privileged location processed by the system, the attacker can escalate from administrative access in the application to execution of shell commands as root on the underlying firewall appliance.

CVE-2026-57155First seen Jul 1, 2026

CVE-2026-61837First seen Sep 10, 2026

CVE-2026-67418 is an input-validation vulnerability in RabbitMQ's MQTT 5.0 message handling. A PUBLISH message containing a property that is inapplicable to PUBLISH operations can cause RabbitMQ to disconnect subscribers whose subscriptions match the published topic, rather than isolating or rejecting the malformed publication appropriately.

CVE-2026-67418First seen Aug 19, 2026

CVE-2026-67421 is a medium-severity stored HTML injection vulnerability in RabbitMQ Management OAuth error handling. Insufficient output encoding of OAuth-related error data allows attacker-controlled HTML to be retained and later rendered in the RabbitMQ Management user interface.

CVE-2026-67421First seen Aug 19, 2026

CVE-2026-67420 is a low-severity authorization persistence vulnerability in RabbitMQ's OAuth2 functionality. OAuth credential refresh can retain runtime authorization tags after those tags have been revoked, causing the refreshed credential context to continue reflecting permissions that should no longer be granted. The issue is resolved in RabbitMQ 3.13.19, 4.0.24, 4.1.15, 4.2.10, and 4.3.5.

CVE-2026-67420First seen Aug 19, 2026

CVE-2026-9672 is a vulnerability in libgd2, the GD graphics-creation and manipulation library. Processing a malformed GIF image can trigger the flaw. The issue affects software packages incorporating libgd, including GD-related packages on Amazon Linux and PHP releases that bundle or depend on the affected library.

CVE-2026-9672First seen Jul 31, 2026

CVE-2026-53613 is a time-of-check-time-of-use race condition in util-linux libmount during mount operations. A local attacker can race the handling of a mount target path and redirect that path between validation and use, potentially causing a privileged mount-related operation to act on an unintended location. The issue affects util-linux releases prior to 2.42.2 and 2.41.5.

CVE-2026-53613First seen Aug 14, 2026

First seen Mar 18, 2026