CVE-2026-19593 | Critical | 9.8 | 2026-09-01 | OpenAI Codex Desktop for Windows and macOS automatically inspected Git metadata and working-tree status when a user opened a workspace. If the workspace contai… |
CVE-2026-19592 | High | 7.3 | 2026-09-01 | OpenAI Codex CLI for Windows, macOS, and Linux and Codex Desktop for Windows and macOS automatically collected Git repository metadata without disabling the re… |
CVE-2026-16708 | High | 8.3 | 2026-08-14 | IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote attacker to obtain sensitive information due to external control of system configuration. |
CVE-2026-19884 | | | 2026-08-14 | In Eclipse Theia versions up to and including 1.69.0, opening a folder starts source control integration without requiring the user to trust the folder first… |
CVE-2026-73661 | | | 2026-08-13 | FreePBX is an open source IP PBX. Prior to 16.0.47 and 17.0.30, the FreePBX Framework module permits a crafted backup to restore the hidden AUTHTYPE setting wi… |
CVE-2026-66065 | | | 2026-08-03 | Ouroboros is a local-first runtime for AI coding agents that records their actions and applies user-defined policies to constrain behavior. Versions prior to 0… |
CVE-2026-56567 | Medium | 5.1 | 2026-07-31 | HCL iControl v4.3.0 was affected by Security Misconfiguration vulnerabilities. It involves the public exposure of internal configuration files due to improper… |
CVE-2026-46485 | High | 8.2 | 2026-07-15 | Dashy is a self-hostable personal dashboard. Prior to 4.0.8, Dashy deployments using OIDC can allow unauthenticated users or non-admin authenticated users to w… |
CVE-2026-44768 | Medium | 4.1 | 2026-07-14 | SAP CRM WebClient UI allows an attacker to inject and execute malicious scripts in the context of the application due to the absence of a Content Security Poli… |
CVE-2026-0418 | Medium | 4.5 | 2026-06-09 | Insufficient configuration management in the listed devices allows authenticated administrators connected to the local network
to tamper with the system. |
CVE-2026-46399 | | | 2026-06-05 | HAX CMS helps manage microsite universe with PHP or NodeJs backends. The PHP version of HAX CMS prior to version 26.0.0 has an authenticated file overwrite vul… |
CVE-2026-1784 | High | 8.8 | 2026-06-02 | The Route OpenShift resource allows to define routes to make pods reachable at a subdomain through HAProxy. It was found that the checks performed on the spec… |
CVE-2019-25716 | Medium | 6.5 | 2026-06-01 | Dräger Infinity Delta, Delta XL, and Kappa patient monitors contain a denial-of-service vulnerability that allows remote attackers to cause the monitor to rebo… |
CVE-2026-45087 | Critical | 10.0 | 2026-05-27 | Dalfox is a powerful open-source XSS scanner and utility focused on automation. Prior to 2.13.0, when dalfox is started in REST API server mode (dalfox server)… |
CVE-2026-44417 | High | 7.5 | 2026-05-22 | The fix for CVE-2025-48913: Apache CXF: Untrusted JMS configuration can lead to RCE was not complete, meaning that another path in the code might lead to code… |
CVE-2026-44774 | Critical | 9.9 | 2026-05-15 | Traefik is an HTTP reverse proxy and load balancer. Prior to 2.11.46, 3.6.17, and 3.7.1, Traefik's Kubernetes Gateway API provider allows a tenant with HTTPRou… |
CVE-2026-41489 | High | 8.8 | 2026-05-11 | Pi-hole is a DNS sinkhole that protects devices from unwanted content without installing any client-side software. From 6.0 to before Core 6.4.2 and FTL 6.6.1… |
CVE-2026-43531 | High | 7.3 | 2026-05-05 | OpenClaw before 2026.4.9 contains an environment variable injection vulnerability allowing malicious workspace .env files to set runtime-control variables. Att… |
CVE-2026-41384 | High | 7.8 | 2026-04-28 | OpenClaw before 2026.3.24 contains an environment variable injection vulnerability in the CLI backend runner that allows attackers to inject malicious environm… |
CVE-2026-41176 | Critical | 9.8 | 2026-04-23 | Rclone is a command-line program to sync files and directories to and from different cloud storage providers. The RC endpoint `options/set` is exposed without… |
CVE-2026-41294 | High | 8.6 | 2026-04-21 | OpenClaw before 2026.3.28 loads the current working directory .env file before trusted state-dir configuration, allowing environment variable injection. Attack… |
CVE-2026-0232 | Medium | 4.4 | 2026-04-13 | A problem with a protection mechanism in the Palo Alto Networks Cortex XDR agent on Windows allows a local Windows administrator to disable the agent. This iss… |
CVE-2026-35650 | High | 7.5 | 2026-04-10 | OpenClaw before 2026.3.22 contains an environment variable override handling vulnerability that allows attackers to bypass the shared host environment policy t… |
CVE-2026-33092 | High | 7.8 | 2026-04-10 | Local privilege escalation due to improper handling of environment variables. The following products are affected: Acronis True Image OEM (macOS) before build… |
CVE-2026-22750 | High | 7.5 | 2026-04-10 | When configuring SSL bundles in Spring Cloud Gateway by using the configuration property spring.ssl.bundle, the configuration was silently ignored and the defa… |
CVE-2026-30817 | Medium | 5.7 | 2026-04-08 | An external configuration control vulnerability in the OpenVPN module of TP-Link AX53 v1.0 allows an authenticated adjacent attacker to read arbitrary files wh… |
CVE-2026-30816 | Medium | 5.7 | 2026-04-08 | An external control of configuration vulnerability in the OpenVPN module of TP-Link AX53 v1.0 allows an authenticated adjacent attacker to read arbitrary file… |
CVE-2026-22177 | Medium | 6.1 | 2026-03-18 | OpenClaw versions prior to 2026.2.21 fail to filter dangerous process-control environment variables from config env.vars, allowing startup-time code execution… |
CVE-2026-21422 | Low | 3.4 | 2026-03-04 | Dell PowerScale OneFS, versions 9.10.0.0 through 9.13.1.0, contains an external control of system or configuration setting vulnerability. A high privileged att… |
CVE-2026-27203 | High | 8.3 | 2026-02-21 | eBay API MCP Server is an open source local MCP server providing AI assistants with comprehensive access to eBay's Sell APIs. All versions are vulnerable to En… |
CVE-2025-13091 | Medium | 4.3 | 2026-02-19 | The Shopire theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the shopire_admin_install_plugin() func… |
CVE-2026-22708 | Critical | 9.8 | 2026-01-14 | Cursor is a code editor built for programming with AI. Prior to 2.3, hen the Cursor Agent is running in Auto-Run Mode with Allowlist mode enabled, certain shel… |
CVE-2026-0495 | Medium | 5.1 | 2026-01-13 | SAP Fiori App Intercompany Balance Reconciliation allows an attacker with high privileges to send uploaded files to arbitrary emails which could enable effect… |
CVE-2025-64726 | | | 2025-11-13 | Socket Firewall is an HTTP/HTTPS proxy server that intercepts package manager requests and enforces security policies by blocking dangerous packages. Socket Fi… |
CVE-2025-62527 | High | 7.1 | 2025-10-20 | Taguette is an open source qualitative research tool. An issue has been discovered in Taguette versions prior to 1.5.0. It was possible for an attacker to requ… |
CVE-2025-43792 | Medium | 5.3 | 2025-09-15 | Remote staging in Liferay Portal 7.4.0 through 7.4.3.105, and older unsupported versions, and Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4, 7.4 GA throug… |
CVE-2025-41452 | | | 2025-08-22 | Post-authenticated external control of system web interface configuration setting vulnerability in Danfoss AK-SM8xxA Series prior to 4.3.1, which could allow f… |
CVE-2025-8283 | Low | 3.7 | 2025-07-28 | A vulnerability was found in the netavark package, a network stack for containers used with Podman. Due to dns.podman search domain being removed, netavark may… |
CVE-2025-27889 | Low | 3.4 | 2025-07-10 | Wing FTP Server before 7.4.4 does not properly validate and sanitize the url parameter of the downloadpass.html endpoint, allowing injection of an arbitrary li… |
CVE-2025-30512 | Medium | 6.5 | 2025-04-15 | Unauthenticated attackers can send configuration settings to device and possible perform physical actions remotely (e.g., on/off). |
CVE-2025-27253 | Medium | 6.1 | 2025-03-10 | A CWE-15 "External Control of System or Configuration Setting" in GE Vernova UR IED family devices from version 7.0 up to 8.60 allows an attacker to provide in… |
CVE-2025-0425 | | | 2025-02-18 | Via the GUI of the "bestinformed Infoclient", a low-privileged user is by default able to change the server address of the "bestinformed Server" to which this… |
CVE-2024-11166 | | | 2025-01-22 | For TCAS II systems using transponders compliant with MOPS earlier than RTCA DO-181F, an attacker can impersonate a ground station and issue a Comm-A Identity… |
CVE-2024-39800 | Critical | 9.1 | 2025-01-14 | Multiple external config control vulnerabilities exists in the openvpn.cgi openvpn_server_setup() functionality of Wavlink AC3000 M33A8.V5030.210505. A special… |
CVE-2024-39799 | Critical | 9.1 | 2025-01-14 | Multiple external config control vulnerabilities exists in the openvpn.cgi openvpn_server_setup() functionality of Wavlink AC3000 M33A8.V5030.210505. A special… |
CVE-2024-39798 | Critical | 9.1 | 2025-01-14 | Multiple external config control vulnerabilities exists in the openvpn.cgi openvpn_server_setup() functionality of Wavlink AC3000 M33A8.V5030.210505. A special… |
CVE-2024-39795 | Critical | 9.1 | 2025-01-14 | Multiple external config control vulnerabilities exist in the nas.cgi set_nas() proftpd functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted… |
CVE-2024-39794 | Critical | 9.1 | 2025-01-14 | Multiple external config control vulnerabilities exist in the nas.cgi set_nas() proftpd functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted… |
CVE-2024-39793 | Critical | 9.1 | 2025-01-14 | Multiple external config control vulnerabilities exist in the nas.cgi set_nas() proftpd functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted… |
CVE-2024-39790 | Critical | 9.1 | 2025-01-14 | Multiple external config control vulnerabilities exist in the nas.cgi set_ftp_cfg() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTT… |
CVE-2024-39789 | Critical | 9.1 | 2025-01-14 | Multiple external config control vulnerabilities exist in the nas.cgi set_ftp_cfg() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTT… |
CVE-2024-39788 | Critical | 9.1 | 2025-01-14 | Multiple external config control vulnerabilities exist in the nas.cgi set_ftp_cfg() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTT… |
CVE-2024-39602 | Critical | 9.1 | 2025-01-14 | An external config control vulnerability exists in the nas.cgi set_nas() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request c… |
CVE-2024-39280 | Critical | 9.1 | 2025-01-14 | An external config control vulnerability exists in the nas.cgi set_smb_cfg() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP reque… |
CVE-2024-38666 | Critical | 9.1 | 2025-01-14 | An external config control vulnerability exists in the openvpn.cgi openvpn_client_setup() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially craft… |
CVE-2024-54097 | High | 7.3 | 2024-12-12 | Security vulnerability in the HiView module
Impact: Successful exploitation of this vulnerability may affect feature implementation and integrity. |
CVE-2024-51544 | High | 8.2 | 2024-12-05 | Service Control vulnerabilities allow access to service restart requests and vm configuration settings.
Affected products:
ABB ASPECT - Enterprise v3.08.02… |
CVE-2024-51543 | High | 8.2 | 2024-12-05 | Information Disclosure vulnerabilities allow access to application configuration information.
Affected products:
ABB ASPECT - Enterprise v3.08.02;
NEXUS Se… |
CVE-2024-50358 | High | 7.2 | 2024-11-26 | A CWE-15 "External Control of System or Configuration Setting" was discovered affecting the following devices manufactured by Advantech: EKI-6333AC-2G (<= 1.6… |
CVE-2024-10979 | High | 8.8 | 2024-11-14 | Incorrect control of environment variables in PostgreSQL PL/Perl allows an unprivileged database user to change sensitive process environment variables (e.g. P… |
CVE-2024-21583 | Medium | 4.1 | 2024-07-19 | Versions of the package github.com/gitpod-io/gitpod/components/server/go/pkg/lib before main-gha.27122; versions of the package github.com/gitpod-io/gitpod/com… |
CVE-2024-4326 | Critical | 9.8 | 2024-05-16 | A vulnerability in parisneo/lollms-webui versions up to 9.3 allows remote attackers to execute arbitrary code. The vulnerability stems from insufficient protec… |
CVE-2023-6154 | High | 7.8 | 2024-04-01 | A configuration setting issue in seccenter.exe as used in Bitdefender Total Security, Bitdefender Internet Security, Bitdefender Antivirus Plus, Bitdefender An… |
CVE-2024-23639 | Medium | 5.1 | 2024-02-09 | Micronaut Framework is a modern, JVM-based, full stack Java framework designed for building modular, easily testable JVM applications with support for Java, Ko… |
CVE-2023-50252 | High | 8.3 | 2023-12-12 | php-svg-lib is an SVG file parsing / rendering library. Prior to version 0.5.1, when handling `<use>` tag that references an `<image>` tag, it merges the attri… |
CVE-2023-46764 | Medium | 5.3 | 2023-11-08 | Unauthorized startup vulnerability of background apps. Successful exploitation of this vulnerability may cause background apps to start maliciously. |
CVE-2023-46248 | Critical | 9.0 | 2023-10-31 | Cody is an artificial intelligence (AI) coding assistant. The Cody AI VSCode extension versions 0.10.0 through 0.14.0 are vulnerable to Remote Code Execution u… |
CVE-2023-43323 | Medium | 6.5 | 2023-09-28 | mooSocial 3.1.8 is vulnerable to external service interaction on post function. When executed, the server sends a HTTP and DNS request to external server. The… |
CVE-2023-4704 | Medium | 4.9 | 2023-09-01 | External Control of System or Configuration Setting in GitHub repository instantsoft/icms2 prior to 2.16.1-git. |
CVE-2023-3321 | High | 7.0 | 2023-07-24 |
A vulnerability exists by allowing low-privileged users to read and update the data in various directories used by the Zenon system. An attacker could exploit… |
CVE-2023-32349 | High | 8.0 | 2023-05-22 |
Version 00.07.03.4 and prior of Teltonika’s RUT router firmware contain a packet dump utility that contains proper validation for filter parameters. However… |
CVE-2023-32076 | Medium | 5.5 | 2023-05-10 | in-toto is a framework to protect supply chain integrity. The in-toto configuration is read from various directories and allows users to configure the behavior… |
CVE-2021-27406 | High | 8.8 | 2022-10-14 | An attacker can take leverage on PerFact OpenVPN-Client versions 1.4.1.0 and prior to send the config command from any application running on the local host ma… |
CVE-2022-41582 | High | 7.5 | 2022-10-14 | The security module has configuration defects.Successful exploitation of this vulnerability may affect system availability. |
CVE-2021-38453 | Critical | 9.1 | 2021-10-22 | Some API functions allow interaction with the registry, which includes reading values as well as data modification. |
CVE-2021-31338 | High | 7.8 | 2021-08-19 | A vulnerability has been identified in SINEMA Remote Connect Client (All versions < V3.0 SP1). Affected devices allow to modify configuration settings over an… |
CVE-2021-3707 | Medium | 5.5 | 2021-08-16 | D-Link router DSL-2750U with firmware vME1.16 or prior versions is vulnerable to unauthorized configuration modification. An unauthenticated attacker on the lo… |