CVE Notify

Public

Can't Join? @cveNotify

18.5k Members

Updated: May 13, 2026 at 11:06 PM

CVE Notify

Alert on the latest CVEs Partner channel: @malwr

@cveNotify is a growing community focused on partner and alert and related topics

Ranking

Global Ranking

#456

Language Ranking

#45

Category Ranking

#23

-1

Participant Growth (Last 9 Days)

Total: 18.5K

24h growth: +0 0%

Latest Posts

CVE Notify

May 25, 2026, 09:00 AM

🚨 https://webmin.com/changelog/webmin-2.641-released/
Webmin before 2.641 contains a stored cross-site scripting vulnerability in the email template description field of the System and Server Status module that allows low-privileged authenticated attackers to execute arbitrary commands by injecting unsanitized input stored in save_tmpl.cgi and rendered unescaped in list_tmpls.cgi.

🎖

263

CVE Notify

May 25, 2026, 09:00 AM

🚨 https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33117
Improper authentication in Azure SDK allows an unauthorized attacker to bypass a security feature over a network.

🎖

261

CVE Notify

May 25, 2026, 09:00 AM

🚨 https://github.com/kovidgoyal/kitty/commit/e9661f0f3afb4e4dbffa509adfb3df3c9780ad34
Kitty is a cross-platform GPU based terminal. Versions 0.46.2 and below contain a heap buffer overflow in load_image_data() that allows any process which can write to the terminal's stdin to crash kitty immediately. The vulnerability is triggered by a single APC graphics protocol command with a PNG format declaration (f=100) whose payload exceeds twice the initial buffer capacity. The overflow is attacker-controlled in both length and content, causing DoS and potentially escalation to RCE itself. This issue has been fixed in version 0.47.0.

🎖

141

CVE Notify

May 25, 2026, 09:00 AM

🚨 https://github.com/kovidgoyal/kitty/commit/e9661f0f3afb4e4dbffa509adfb3df3c9780ad34
Kitty is a cross-platform GPU based terminal. In versions 0.46.2 and below, the handle_compose_command() function in kitty/graphics.c performs bounds validation on composition offsets using unsigned 32-bit arithmetic that is subject to integer wrapping, potentially leading to Heap Buffer Over-Read/Write. An attacker who can write escape sequences to a kitty terminal (e.g., via a malicious file, SSH login banner, or piped content) can supply crafted x_offset/y_offset values that pass the bounds check after wrapping but cause massive out-of-bounds heap memory access in compose_rectangles(). No user interaction is required. No non-default configuration is required. The attacker only needs the ability to produce output in a kitty terminal window. This issue has been fixed in version 0.47.0.

🎖

213

CVE Notify

May 25, 2026, 09:00 AM

🚨 https://nvd.nist.gov/vuln/detail/CVE-2026-24188
NVIDIA TensorRT contains a vulnerability where an attacker could cause an out-of-bounds write. A successful exploit of this vulnerability might lead to data tampering.

🎖

217

CVE Notify

May 25, 2026, 09:00 AM

🚨 https://git.kernel.org/stable/c/0ae91d8ab70922fb74c22c20bedcb69459579b1c
In the Linux kernel, the following vulnerability has been resolved:

io_uring/zcrx: fix page array leak

d9f595b9a65e ("io_uring/zcrx: fix leaking pages on sg init fail") fixed
a page leakage but didn't free the page array, release it as well.

🎖

CVE Notify

May 25, 2026, 09:00 AM

🚨 https://github.com/mlflow/mlflow/commit/8f9c8a53af90842944101eb8b7d60706822c81bc
In MLflow version 3.9.0, the MLflow Assistant feature introduced improper origin validation in its /ajax-api endpoints. This vulnerability allows a remote attacker to exploit cross-origin requests from a malicious webpage to interact with the MLflow Assistant running on a victim's local machine. By bypassing the loopback-only restriction, the attacker can modify the Assistant's configuration to enable full access, which in turn allows the execution of arbitrary commands via the Claude Code sub-agent. This issue is resolved in version 3.10.0.

🎖

115

CVE Notify

May 25, 2026, 09:00 AM

🚨 https://git.kernel.org/stable/c/7c54d3f5ebbc5982daaa004260242dc07ac943ea
In the Linux kernel, the following vulnerability has been resolved:

nvme-fc: release admin tagset if init fails

nvme_fabrics creates an NVMe/FC controller in following path:

nvmf_dev_write()
-> nvmf_create_ctrl()
-> nvme_fc_create_ctrl()
-> nvme_fc_init_ctrl()

nvme_fc_init_ctrl() allocates the admin blk-mq resources right after
nvme_add_ctrl() succeeds. If any of the subsequent steps fail (changing
the controller state, scheduling connect work, etc.), we jump to the
fail_ctrl path, which tears down the controller references but never
frees the admin queue/tag set. The leaked blk-mq allocations match the
kmemleak report seen during blktests nvme/fc.

Check ctrl->ctrl.admin_tagset in the fail_ctrl path and call
nvme_remove_admin_tag_set() when it is set so that all admin queue
allocations are reclaimed whenever controller setup aborts.

🎖

114

CVE Notify

May 25, 2026, 09:00 AM

🚨 https://git.kernel.org/stable/c/11f8311f69e4c361717371b4901ff92daeb76e9c
In the Linux kernel, the following vulnerability has been resolved:

gve: Fix stats report corruption on queue count change

The driver and the NIC share a region in memory for stats reporting.
The NIC calculates its offset into this region based on the total size
of the stats region and the size of the NIC's stats.

When the number of queues is changed, the driver's stats region is
resized. If the queue count is increased, the NIC can write past
the end of the allocated stats region, causing memory corruption.
If the queue count is decreased, there is a gap between the driver
and NIC stats, leading to incorrect stats reporting.

This change fixes the issue by allocating stats region with maximum
size, and the offset calculation for NIC stats is changed to match
with the calculation of the NIC.

🎖

CVE Notify

May 25, 2026, 09:00 AM

🚨 https://www.litespeedtech.com/products/litespeed-web-server/control-panel-support/cpanel
LiteSpeed User-End cPanel Plugin before 2.4.5 allows privilege escalation (possibly to root), as exploited in the wild in May 2026. Detection is best done via a command line of grep -rE "cpanel_jsonapi_func=redisAble" /var/cpanel/logs /usr/local/cpanel/logs/ 2>/dev/null in Bash. If you get no output, you have not been hit with exploitation of the vulnerability. If there is output, we recommend you examine the IP addresses in the list, determine if they are valid IP addresses, and if not, block them. To determine damage done, examine the system logs for use by the detected IP addresses. The issue is related to mishandling of Redis enable/disable features. The recommended minimum version is 2.4.7.

🎖

100

CVE Notify

May 10, 2026, 05:04 PM

🚨 https://codeastro.com/
A vulnerability has been found in CodeAstro Online Catering Ordering System 1.0. This affects an unknown function of the file /deleteorder.php. The manipulation of the argument ID leads to sql injection. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used.

🎖

CVE Notify

May 10, 2026, 05:04 PM

🚨 https://vuldb.com/submit/808794
A vulnerability was found in Dotouch XproUPF 2.0.0-release-088aa7c4. This impacts the function vlib_worker_loop in the library /usr/xpro/upf/tools/libs/ http://libvlib.so/ of the component UPF Process. The manipulation results in denial of service. The vendor was contacted early about this disclosure.

🎖

CVE Notify

May 10, 2026, 05:04 PM

🚨 https://github.com/php/php-src/security/advisories/GHSA-m33r-qmcv-p97q
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, when SoapServer is configured with SOAP_PERSISTENCE_SESSION, the handler object is persisted across requests via session storage. However, in the case SOAP requests results in an error, the persistance is handled incorrectly, resulting in freeing the object while keeping a pointer to it, which may lead to use-after-free. This may lead to memory corruption, information disclosure, or process crashes, with confidentiality, integrity, and availability impact on the vulnerable system.

🎖

CVE Notify

May 10, 2026, 05:04 PM

🚨 https://github.com/php/php-src/security/advisories/GHSA-74r9-qxhc-fx53
In PHP versions 8.4.* before 8.4.21 and 8.5.* before 8.5.6, when an encoding name containing an embedded NUL byte is passed to mb_convert_encoding() or related mbstring functions, the code incorrectly assumes that when strncasecmp() returns 0 it means the strings have the same length. This can lead to out-of-bounds read of global memory, potentially causing a crash or information disclosure or crash. Affected functions include mb_convert_encoding(), mb_detect_encoding(), mb_convert_variables(), and mb_detect_order(), as well as the mbstring.detect_order and mbstring.http_output INI settings.

🎖

CVE Notify

May 10, 2026, 05:04 PM

🚨 https://github.com/php/php-src/security/advisories/GHSA-4jhr-8w89-j733
In PHP versions 8.4.* before 8.4.21 and 8.5.* before 8.5.6, DOMNode::C14N() method may process the XML data incorrectly, causing a circular linked list in the data structure representing the XML document. This may cause subsequent processing of the XML document to enter infinite loop, causing denial of service in the processing application.

🎖

CVE Notify

May 10, 2026, 05:04 PM

🚨 https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution.

🎖

CVE Notify

May 10, 2026, 05:04 PM

🚨 https://github.com/php/php-src/security/advisories/GHSA-7qg2-v9fj-4mwv
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, 8.5.* before 8.5.6, due to improper sanitation of user data, it allows an attacker to compose an URL, which will cause the target to execute arbitrary JavaScript code (XSS) on the target's machine when the target is viewing the PHP-FPM status page.

🎖

CVE Notify

May 10, 2026, 05:04 PM

🚨 https://github.com/php/php-src/security/advisories/GHSA-m8rr-4c36-8gq4
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, some functions, including urldecode(), pass signed char to ctype functions (like isxdigit()). On the systems with default signed char and optimized table-lookup ctype functions - such as NetBSD - this can lead to accessing array with negative offset, which can trigger a denial of service.

🎖

CVE Notify

May 10, 2026, 05:04 PM

🚨 https://github.com/php/php-src/security/advisories/GHSA-wm6j-2649-pv75
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, a mismatch between encoding lists in Oniguruma and mbfl leads to  a NULL pointer dereference, resulting in a segmentation fault and denial of service. The vulnerability is exploitable when user-controlled input can influence the encoding passed to mb_regex_encoding().

🎖

CVE Notify

May 10, 2026, 05:04 PM

🚨 https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the PDO Firebird driver improperly handles NUL bytes when preparing SQL queries. During token-by-token query construction, a string token containing a NUL byte is copied via strncat(), which stops at the NUL byte, dropping the closing quote and causing subsequent SQL tokens to be interpreted as part of the string. This allows SQL injection when attacker-controlled values are quoted via PDO::quote() and embedded in SQL statements.

🎖

CVE Notify

Apr 28, 2026, 03:56 AM

🚨 https://github.com/auth0/nextjs-auth0/commit/98c36dc306970c2230ea1a32efef431d29b99978
The Auth0 Next.js SDK is a library for implementing user authentication in Next.js applications. In versions 4.12.0 through 4.17.1, simultaneous requests that trigger a nonce retry may cause the proxy cache fetcher to perform improper lookups for the token request results. Users are affected if their project uses both the vulnerable versions and the proxy handler /me/* and /my-org/* with DPoP enabled. This issue has been fixed in version 4.18.0.

🎖

CVE Notify

Apr 28, 2026, 03:56 AM

🚨 https://github.com/openfga/openfga/releases/tag/v1.14.0
OpenFGA is an authorization/permission engine built for developers. In versions 0.1.4 through 1.13.1, when OpenFGA is configured to use preshared-key authentication with the built-in playground enabled, the local server includes the preshared API key in the HTML response of the /playground endpoint. The /playground endpoint is enabled by default and does not require authentication. It is intended for local development and debugging and is not designed to be exposed to production environments. Only those who run OpenFGA with `--authn-method` preshared, with the playground enabled, and with the playground endpoint accessible beyond localhost or trusted networks are vulnerable. To remediate the issue, users should upgrade to OpenFGA v1.14.0, or disable the playground by running `./openfga run --playground-enabled=false.`

🎖

CVE Notify

Apr 28, 2026, 03:56 AM

🚨 https://dev.gnupg.org/T8211
Libgcrypt before 1.12.2 sometimes allows a heap-based buffer overflow and denial of service via crafted ECDH ciphertext to gcry_pk_decrypt.

🎖

CVE Notify

Apr 28, 2026, 03:56 AM

🚨 https://dev.gnupg.org/T8208
Libgcrypt before 1.12.2 mishandles Dilithium signing. Writes to a static array lack a bounds check but do not use attacker-controlled data.

🎖

CVE Notify

Apr 28, 2026, 03:56 AM

🚨 https://github.com/python-poetry/poetry/security/advisories/GHSA-73h3-mf4w-8647
Poetry is a dependency manager for Python. Prior to 2.3.4, the extractall() function in src/poetry/utils/ http://helpers.py:410/-426 extracts sdist tarballs without path traversal protection on Python versions where tarfile.data_filter is unavailable. Considering only Python versions which are still supported by Poetry, these are 3.10.0 - 3.10.12 and 3.11.0 - 3.11.4. This vulnerability is fixed in 2.3.4.

🎖

CVE Notify

Apr 28, 2026, 03:56 AM

🚨 https://helpx.adobe.com/security/products/magento/apsb25-88.html
Adobe Commerce versions 2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14, 2.4.4-p15 and earlier are affected by an Improper Input Validation vulnerability. A successful attacker can abuse this to achieve session takeover, increasing the confidentiality, and integrity impact to high. Exploitation of this issue does not require user interaction.

🎖

CVE Notify

Apr 28, 2026, 03:56 AM

🚨 https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0129410
HCL AION is affected by a vulnerability where internal filesystem paths may be exposed through application responses or system behaviour. Exposure of internal paths may reveal environment structure details which could potentially aid in further targeted attacks or information disclosure.

🎖

CVE Notify

Apr 28, 2026, 03:56 AM

🚨 https://github.com/p2r3/bareiron/
An out-of-bounds memory access (OOB) in p2r3 Bareiron commit 8e4d40 allows unauthenticated attackers to access sensitive information and cause a Denial of Service (DoS) via supplying a crafted packet.

🎖

CVE Notify

Apr 28, 2026, 03:56 AM

🚨 https://github.com/p2r3/bareiron
A write-what-where condition in p2r3 Bareiron commit 8e4d40 allows unauthenticated attackers to write arbitrary values to memory, enabling arbitrary code execution via a crafted packet.

🎖

CVE Notify

Apr 28, 2026, 03:56 AM

🚨 https://github.com/DCMTK/dcmtk/commit/edbb085e45788dccaf0e64d71534cfca925784b8
A security flaw has been discovered in OFFIS DCMTK up to 3.7.0. This impacts the function executeOnReception/executeOnEndOfStudy of the file dcmnet/apps/ http://storescp.cc/ of the component storescp. Performing a manipulation results in os command injection. Remote exploitation of the attack is possible. The patch is named edbb085e45788dccaf0e64d71534cfca925784b8. Applying a patch is the recommended action to fix this issue.

🎖

Showing 30 of 60 posts

Loading posts...

Rating

User Reviews (0)

No reviews yet. Be the first to share your experience!

Loading reviews...

Related Telegram Channels

Loading recommended channels...

CVE Notify

CVE Notify

Ranking

Participant Growth (Last 9 Days)

Latest Posts

Rating

User Reviews (0)

Related Telegram Channels

PocketOffer Notification

MRKT Jobs

Remote Support Jobs

Remote AI / Machine Learning / Data Jobs

Coin Bureau Insider

Remote Jobs in Canada

Remote Writing Jobs

𝐂𝐫𝐲𝐩𝐭𝐨 𝟏𝟎𝟎𝐗 𝐂𝐚𝐥𝐥𝐬 💯 🌐

Related Telegram Channels

PocketOffer Notification

MRKT Jobs

Remote Support Jobs

Remote AI / Machine Learning / Data Jobs

Coin Bureau Insider

Remote Jobs in Canada

Remote Writing Jobs

𝐂𝐫𝐲𝐩𝐭𝐨 𝟏𝟎𝟎𝐗 𝐂𝐚𝐥𝐥𝐬 💯 🌐

User Reviews (0)

Latest Posts