Reserved but Public CVEs

CVE-2026-60004 is a critical remote code execution vulnerability in Gitea's diffpatch feature affecting versions 1.17 through 1.27.0. The vulnerable path is the repository diffpatch API, which applies attacker-supplied patch content inside a temporary bare clone using Git apply with index-related options and, on Git 2.32 or later, a three-way merge fallback. By submitting crafted patch content twice, an attacker can trigger an add/add collision during Git's merge handling and cause a file to be written into the bare repository's hooks directory as an active Git hook. Because the temporary clone is bare, the repository root is treated as Git's directory, so a hook written there becomes executable during subsequent Git index operations. When the hook is triggered, arbitrary shell commands execute with the privileges of the Gitea service account.

CVE-2026-60004First seen Jul 29, 2026

CVE-2026-53921 is a critical stack-based buffer overflow in OpenWrt's odhcpd service, specifically in the DHCPv6 Identity Association reply serialization path. The flaw is described as involving a fixed 512-byte stack buffer that can be overrun when odhcpd processes crafted DHCPv6 REQUEST packets and appends reply data without sufficient remaining-capacity checks. Available reporting indicates the vulnerable code path is associated with older odhcpd versions containing the DHCPv6 handling functions dhcpv6_ia_handle_IAs() and build_ia(). Under attacker-controlled IA option layouts, odhcpd can write beyond the allocated stack buffer while constructing a DHCPv6 reply. Because odhcpd runs with root privileges by default on affected OpenWrt systems, successful exploitation can result in severe compromise.

CVE-2026-53921First seen Jun 30, 2026

CVE-2026-59774 is a critical arbitrary file-read vulnerability in the markup rendering functionality of Gitea and Forgejo. The flaw is triggered through the Org-mode renderer used by the markup endpoint for repository content rendering. Affected implementations initialize the go-org library without overriding its default ReadFile callback, allowing Org-mode #+INCLUDE directives to resolve and read absolute paths from the server filesystem. As a result, an attacker can submit crafted Org-mode markup to the repository markup rendering endpoint and cause the application to include the contents of local files in the rendered response. Reported affected versions include Gitea 1.22.1 through 1.27.0, fixed in 1.27.1, and Forgejo 7.0 through 15.0.5 and 16.0.0 through 16.0.1, fixed in 15.0.6 and 16.0.2.

CVE-2026-59774First seen Aug 4, 2026

CVE-2026-10797 is a legacy flaw in the Linux shim UEFI bootloader, affecting old Microsoft-signed shim builds primarily based on version 0.9 and earlier. The vulnerability lies in shim's certificate-based revocation logic for second-stage PE bootloaders: an Authenticode-signed PE binary stores signature length information in two separate structures, and vulnerable shim code reads the signature size from the wrong PE structure during revocation checking while using different data during signature verification. By tampering with the second-stage bootloader's WIN_CERTIFICATE header, an attacker can cause shim to compare dbx or MokListX revocation entries against bogus certificate data instead of the bootloader's actual signature. This allows a revoked or otherwise blocked second-stage boot component to pass the revocation check while still being accepted as signed. In practice, the flaw undermines UEFI Secure Boot trust decisions in environments that continue to trust old Microsoft-signed shim binaries.

CVE-2026-10797First seen Jun 14, 2026

CVE-2025-70951First seen Apr 3, 2026

CVE-2026-25262 is a memory corruption vulnerability in Qualcomm's Primary Bootloader/BootROM environment, specifically in handling of the Sahara protocol used by Emergency Download Mode (EDL). The flaw is classified as a write-what-where condition and arises from insufficient validation while processing crafted ELF content or chunks of a service program delivered during the EDL workflow. Because the vulnerable code executes in the boot chain before the operating system loads and before normal user security controls are enforced, a successful attacker can perform arbitrary memory writes at a highly privileged stage of device startup. The issue affects multiple Qualcomm chip families, including MDM9x07, MDM9x45, MDM9x65, MSM8909, MSM8916, MSM8952, and SDX50. The vulnerability resides in immutable BootROM code on already shipped devices.

CVE-2026-25262First seen Apr 27, 2026

CVE-2026-44772 is a critical code injection vulnerability in SAP Manufacturing Integration and Intelligence (SAP MII), affecting XMII and MII_ADMIN versions 15.4 and 15.5. The issue is associated with a vulnerable servlet that allows a low-privileged attacker to submit specially crafted input, causing the application to retrieve and process attacker-controlled content from an external source. This unsafe processing path can be leveraged to inject and execute arbitrary commands on the underlying host. The flaw was addressed by SAP Security Note 3765948 and is rated CVSS 9.9.

CVE-2026-44772First seen Aug 11, 2026

CVE-2026-52824 is a critical vulnerability in Kimai affecting versions up to and including 2.57.0. The flaw stems from use of an insecure, publicly known default value for the Symfony APP_SECRET in vulnerable deployments, particularly the official Docker image, and potentially other installations that retained the shipped default secret. Because Kimai relies on APP_SECRET as Symfony’s kernel secret to generate and validate HMAC-signed security artifacts, an unauthenticated attacker who knows the default secret can forge trusted values such as remember-me cookies, login link signatures, password reset links, and CSRF-related tokens. This can allow authentication bypass and account takeover when the attacker can identify a target account and the target is not protected by active two-factor authentication. The issue was fixed in Kimai 2.58.0 by removing the hard-coded default secret and generating a random APP_SECRET during initialization when one is not explicitly supplied.

CVE-2026-52824First seen Jul 14, 2026

CVE-2026-54330 is an improper verification of cryptographic signatures vulnerability in Ceph RADOS Gateway (RGW) affecting the SigV4 request verification path for presigned PUT requests. RGW verifies only the headers explicitly listed in the X-Amz-SignedHeaders element of the SigV4 request and fails to reject additional unsigned x-amz-* headers. As a result, an attacker in possession of a valid presigned PUT URL can append arbitrary x-amz-* headers that are not covered by the signature, and RGW will still accept and apply them. This breaks the security assumptions of AWS Signature Version 4 by allowing request semantics to be altered after signing, granting capabilities beyond those intended by the signer.

CVE-2026-54330First seen Aug 19, 2026

CVE-2026-39944 is an improper verification of a cryptographic signature vulnerability in Ceph RADOS Gateway (RGW) STS session token handling. The flaw affects RGW deployments where STS support is enabled and stems from the use of the same unauthenticated AES-128-CBC token handling design implicated in CephX issues, without integrity protection for the token contents. Because the session tokens lack effective integrity guarantees, a party in possession of a valid STS token can tamper with token data and bypass the intended trust model for token validation. In affected Ceph releases prior to 20.2.4 and 19.2.6, this can be leveraged to escalate privileges within RGW up to administrative level.

CVE-2026-39944First seen Aug 19, 2026

The provided content identifies CVE-2026-38264 as a Linux kernel vulnerability in the nvme-tcp subsystem, described by SUSE as "nvme-tcp: sanitize request list handling." It is referenced in cumulative SUSE kernel security advisories affecting products including SUSE Linux Enterprise Server 16.0, SUSE Linux Micro 6.2, SUSE Linux Micro Extras 6.2, and related package sets built from kernel version 6.12.0-160000.6.1. No further technical root-cause detail, vulnerable function name, trigger condition, or upstream commit information is provided in the supplied content beyond the fact that the fix sanitizes request list handling in nvme-tcp.

CVE-2026-38264First seen Jun 27, 2026

CVE-2025-30156 is an authentication bypass vulnerability in CephX, Ceph’s authentication mechanism, caused by a broken cryptographic design. CephX used AES-CBC without authentication and with a hardcoded initialization vector, a vulnerability class analogous to historical flaws in legacy Kerberos designs. This construction permits identical plaintext blocks to yield identical ciphertext patterns and lacks integrity protection, enabling CBC bit-flipping attacks. An attacker who has compromised a CephX entity or recovered its shared secret from Ceph network traffic can tamper with CephX tickets and alter permissions without detection. The flaw can also enable inference about plaintext from ciphertext structure. Patched Ceph releases replace the vulnerable construction with AES-256-CTS-HMAC-SHA384-192 and introduce a new CephX key type to support the corrected design.

CVE-2025-30156First seen Aug 19, 2026

CVE-2026-50152 is an improper authorization vulnerability in the Ceph Monitor subscription handler. The flaw allows a CephX-authenticated user that has monitor read capabilities to send a crafted monitor subscription request and retrieve the entire Monitor config-key store, rather than being limited to authorized data. Exposed material can include highly sensitive cluster secrets stored by Ceph components and management tooling, including encryption-related secrets and orchestration credentials. The issue affects Ceph releases prior to 20.2.4 and 19.2.6.

CVE-2026-50152First seen Aug 19, 2026

CVE-2026-48273 is a critical eval injection vulnerability in Adobe ColdFusion caused by improper neutralization of directives in dynamically evaluated code. The flaw affects ColdFusion 2025 and 2023 prior to the vendor-fixed releases and allows attacker-controlled input to reach dynamically evaluated code paths in a way that can be interpreted and executed by the application. Available reporting indicates exploitation requires low-level privileges, making this an authenticated attack path rather than a purely unauthenticated remote vector. Successful exploitation can result in arbitrary code execution within the ColdFusion environment and may enable execution of attacker-supplied code on the underlying server.

CVE-2026-48273First seen Aug 11, 2026

CVE-2026-18576 is a high-severity authentication bypass vulnerability in N-able N-central, the vendor’s remote monitoring and management platform. The flaw has been described as an authentication bypass using an alternate path or channel and affects N-central versions prior to 2026.3, with reporting indicating impact through at least version 2026.1 before subsequent fixes. Successful exploitation allows an unauthenticated attacker to hijack or take over administrative accounts. The initial vendor patch was incomplete, and attackers were able to continue exploiting the issue until an emergency hotfix was released.

CVE-2026-18576First seen Aug 3, 2026

CVE-2026-13136 is a critical authorization flaw in Synology MailPlus Server on DiskStation Manager (DSM). The vulnerability is associated with CWE-863 (Incorrect Authorization) and allows a remote attacker to access functionality without authentication over the network. Successful exploitation can enable arbitrary file read and arbitrary file write operations and can also be used to trigger denial-of-service conditions. The issue affects MailPlus Server deployments on DSM 7.3, 7.2.2, and 7.2.1 prior to the fixed releases identified by Synology.

CVE-2026-13136First seen Jun 27, 2026

CVE-2026-57155 is a critical vulnerability in OPNsense fixed in version 26.7. The flaw affects GeoIP-related functionality exposed through the Web API, where insufficient validation of a user-supplied URL or file path allows path traversal during GeoIP data handling. An authenticated administrator can abuse the GeoIP alias import mechanism to cause arbitrary file creation or overwrite in attacker-controlled filesystem locations while the operation runs with root privileges. By placing a crafted configuration file in a privileged location processed by the system, the attacker can escalate from administrative access in the application to execution of shell commands as root on the underlying firewall appliance.

CVE-2026-57155First seen Jul 1, 2026

CVE-2026-12184 is a high-impact vulnerability in PHP’s HTTP stream wrapper implementation. The flaw is triggered during HTTP connection handling when Transport Layer Security initialization fails. In the vulnerable logic, PHP closes and resets the internal stream object after the TLS setup failure, but subsequent cleanup code continues to operate as though the stream object remains valid. This results in unsafe operations on a null reference and can crash the PHP process handling the request. The issue affects PHP versions earlier than 8.3.32, 8.4.21, and 8.5.6.

CVE-2026-12184First seen Jul 6, 2026

CVE-2026-3865 is a path traversal vulnerability in the Kubernetes CSI Driver for SMB. The flaw is caused by insufficient validation of the attacker-controlled subDir component embedded in the PersistentVolume volumeHandle used by the SMB CSI driver. The driver treated the volume identifier as a composite string, parsed the subdirectory field from it, and used path-joining logic to construct filesystem paths for operations on the backing SMB share without ensuring the resolved path remained confined to the intended managed subdirectory. By supplying traversal sequences in the volumeHandle, an attacker with permission to create PersistentVolume objects could cause the driver to escape the designated storage boundary. The vulnerable behavior is particularly exposed during cleanup and deletion workflows, where the driver may operate on unintended directories on the SMB server. Affected versions are CSI Driver for SMB releases prior to v1.20.1.

CVE-2026-3865First seen Apr 11, 2026

CVE-2026-20140 is a high-severity local privilege escalation vulnerability affecting Splunk Enterprise for Windows. The flaw arises from unsafe DLL resolution during Splunk service startup, allowing DLL search-order hijacking. A low-privileged local attacker who can place a malicious DLL in a location that is searched during service initialization may cause the Splunk service to load attacker-controlled code. Because the service starts with elevated privileges on Windows, successful exploitation can result in execution as NT AUTHORITY\SYSTEM. The issue affects Windows deployments only and does not impact non-Windows installations. Reported affected versions include Splunk Enterprise for Windows 10.0.0 through 10.0.2, 9.4.0 through 9.4.7, 9.3.0 through 9.3.8, and 9.2.0 through 9.2.11.

CVE-2026-20140First seen Feb 20, 2026

CVE-2024-28080 is an authentication bypass vulnerability in Gitblit’s SSH service. The flaw is in Gitblit’s integration with Apache MINA SSHD, specifically its handling of multi-stage public-key authentication. During the initial public-key authentication stage, Gitblit’s SshKeyAuthenticator.authenticate method stores authenticated user state in the ServerSession-backed SshDaemonClient by calling client.setUser(user) and client.setKey(key) as soon as the supplied public key matches a configured key for the requested username, before proof-of-possession of the corresponding private key has been verified. If signature generation or verification does not complete successfully, the session can still retain that user state. Gitblit’s UsernamePasswordAuthenticator.authenticate method then returns success early when client.getUser() is not null, causing subsequent password authentication to succeed even with an arbitrary or empty password. As a result, an attacker can impersonate a user on the SSH transport without the victim’s private key or password, provided the attacker knows a valid username and one of that user’s configured public keys. The issue reportedly affects Gitblit versions prior to 1.10.0 with public-key SSH authentication enabled.

CVE-2024-28080First seen Mar 18, 2026

CVE-2026-62356 is a memory corruption vulnerability in Redis caused by an incorrectly calculated buffer size while loading RDB data. The flaw occurs during RDB parsing/loading and can result in writes beyond the bounds of a heap-allocated buffer. This is a classic heap-based out-of-bounds write condition triggered by malformed or maliciously crafted RDB input. Because the vulnerable condition arises during deserialization/loading of database state, successful exploitation may destabilize the process and, depending on allocator behavior and surrounding memory layout, may create a path toward code execution.

CVE-2026-62356First seen Aug 17, 2026

CVE-2026-59270 is a critical vulnerability in Spring Security’s embedded UnboundID LDAP server implementation, specifically applications using UnboundIdContainer directly or via Spring Boot embedded LDAP auto-configuration. The flaw arises because UnboundIdContainer unconditionally registers an administrative LDAP credential while also binding the LDAP listener to all available network interfaces. When the embedded LDAP service is reachable from an attacker-controlled network location, a remote unauthenticated attacker can authenticate using the well-known administrative bind distinguished name and obtain administrative access to the in-memory LDAP directory. This can expose or alter directory content used for authentication, authorization, role mapping, and related application behavior.

CVE-2026-59270First seen Aug 21, 2026

CVE-2024-31884 is an improper certificate validation flaw in Ceph’s Pybind-based handling of secure mail connections. When Ceph invokes Python SSL-enabled mail client constructors such as imaplib.IMAP4_SSL or smtplib.SMTP_SSL through Pybind, no certificate validation context is passed to those constructors. As a result, the server X.509 certificate is not properly validated and Ceph may accept any certificate presented by the remote mail server. This breaks the trust guarantees expected from TLS and exposes Ceph-integrated mail workflows to interception. The issue is classified as CWE-295.

CVE-2024-31884First seen Jan 21, 2026

CVE-2026-65094 is a high-severity vulnerability in NVIDIA VIRTIO-Net for BlueField affecting BlueField DPUs and ConnectX networking platforms. The flaw is a CWE-123 write-what-where condition in the BlueField-3 Virtio-Net implementation. A low-privileged virtual machine user can send a crafted message that causes unintended arbitrary memory writes within the Virtio-Net component. Because the bug enables attacker-controlled modification of memory, successful exploitation can result in code execution within the Virtio-Net scope and may affect resources beyond the initially exposed component in virtualized or multi-tenant deployments.

CVE-2026-65094First seen Jul 28, 2026