CVE Notifier

CVE-2026-26950 CWE-345 8.1

CVE-2026-26950

Dell SmartFabric Manager, versions prior to 2.2.1, contains an Insufficient Verification of Data Authenticity vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, lead…

cve.org Dell:SmartFabric · Manager 6 hari lalu

CVE-2026-87742 CWE-770 7.5

Quarkus-websockets-next: denial of service (oom) in quarkus-websockets-next via unbounded message buffering

A flaw was found in quarkus-websockets-next. This vulnerability allows a remote attacker to cause a Denial of Service (DoS) by streaming messages over a single connection faster than the application can process them. Due…

cve.org Red · Hat:Exploit · Intelligence 6 hari lalu

CVE-2026-54471 CWE-280 3.5

CVE-2026-54471

Dell SmartFabric Manager, versions prior to 2.2.1, contains an Improper Handling of Insufficient Permissions or Privileges vulnerability. A low privileged attacker with remote access could potentially exploit this vulner…

cve.org Dell:SmartFabric · Manager 6 hari lalu

CVE-2026-79752 CWE-89 N/A

CakePHP: Multiple methods in FunctionsBuilder vulnerable to SQL injection

CakePHP is a rapid development framework for PHP. Prior to 4.5.12, 4.6.5, 5.1.9, 5.2.14, and 5.3.7, FunctionsBuilder::cast, FunctionsBuilder::extract, FunctionsBuilder::datePart, and FunctionsBuilder::dateAdd in src/Data…

cve.org cakephp:cakephp 6 hari lalu

CVE-2026-61793 CWE-20 N/A

Nuxt OG Image has unauthenticated SSRF via `fonts[].path` URL parameter

Nuxt OG Image generates OG Images with Vue templates in Nuxt. From 6.0.2 until 6.7.0, nuxt-og-image exposes the unauthenticated /_og/d/** route when the documented defaults security.strict = false and security.secret = "…

cve.org nuxt-modules:og-image 6 hari lalu

CVE-2026-81447 CWE-295 6.8

CVE-2026-81447

Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains an Improper Certificate Validation vulnerability. An unauthenticated attacker with adjacent network access could potentially exploit this vulnera…

cve.org Dell:OpenManage · Server · Administrator 6 hari lalu

CVE-2026-63459 CWE-79 8.7

Vendure: Stored XSS in the Admin Dashboard via unsafe HTML-stripping (innerHTML) of entity descriptions

Vendure is an open-source headless commerce platform. Prior to 3.6.5, RichTextDescriptionCell in packages/dashboard/src/lib/components/shared/table-cell/order-table-cell-components.tsx attempts to strip markup by assigni…

cve.org vendurehq:vendure 6 hari lalu

CVE-2026-63461 CWE-200 5.3

Vendure: Shop API list queries can return non-public entities when filterOperator is OR

Vendure is an open-source headless commerce platform. Prior to 3.6.5, the public Shop API products, collections, and facets queries combine mandatory visibility guards with caller-supplied filters using the caller-contro…

cve.org vendurehq:vendure 6 hari lalu

CVE-2026-63472 CWE-287 9.1

Vendure: External-authentication account takeover: external login linked to a pre-existing account by email without verification

Vendure is an open-source headless commerce platform. Prior to 3.7.0, ExternalAuthenticationService.createCustomerAndUser in packages/core/src/service/helpers/external-authentication/external-authentication.service.ts se…

cve.org vendurehq:vendure 6 hari lalu

CVE-2026-63460 CWE-1333 7.5

Vendure: Unauthenticated ReDoS via `regex` filter on SQLite backends

Vendure is an open-source headless commerce platform. Prior to 3.6.5, the public Shop GraphQL API allows an unauthenticated caller to supply a catastrophically backtracking pattern through StringOperators.regex. packages…

cve.org vendurehq:vendure 6 hari lalu

CVE-2026-80356 CWE-200 7.3

CVE-2026-80356

Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains an Exposure of Sensitive Information to an Unauthorized Actor vulnerability. A low privileged attacker with local access could potentially exploi…

cve.org Dell:OpenManage · Server · Administrator 6 hari lalu

CVE-2026-71538 CWE-78 N/A

@cyclonedx/cyclonedx-npm: Shell Injection via Unsanitized --workspace Argument on Windows

@cyclonedx/cyclonedx-npm creates CycloneDX Software Bill of Materials from npm projects. Prior to version 6.0.0, the Windows fallback path in src/npmRunner.ts, used when npm_execpath does not provide the npm CLI path, ca…

cve.org CycloneDX:cyclonedx-node-npm 6 hari lalu