Authenticated

MISP Core `deleteSelection` Broken Access Control — Bulk Deletion of Foreign Event Reports & Sharing Groups (CVE-2026-56423) newCVE-2026-56423webHIGH 8.8Patched2026-07-27Langflow Responses API IDOR — Execute Another User's Flow (CVE-2026-55255) new KEVCVE-2026-55255webHIGH 8.4Patched2026-07-19Nagios XI 5.5.6–5.7.5 Authenticated OS Command Injection — Windows WMI Config Wizard (CVE-2021-25296) new KEV EPSS 72%CVE-2021-25296webHIGH 8.8Patched2026-07-11Nagios XI 5.5.6–5.7.5 Authenticated OS Command Injection — Switch Config Wizard (CVE-2021-25297) new KEV EPSS 57%CVE-2021-25297webHIGH 8.8Patched2026-07-11Nagios XI 5.5.6–5.7.5 Authenticated OS Command Injection — Cloud-VM Config Wizard (CVE-2021-25298) new KEV EPSS 75%CVE-2021-25298webHIGH 8.8Patched2026-07-11pgAdmin 4 Query Tool Authenticated eval() RCE (CVE-2025-2945) new EPSS 54%CVE-2025-2945webCRITICAL 9.9Patched2026-07-06Zyxel VMG3625-T50B Authenticated Command Injection to Root SSH Access (CVE-2026-1459) newCVE-2026-1459networkHIGHUnverified2026-07-05ZoneMinder — Second-Order SQL Injection via Event Rename (CVE-2026-27470) newCVE-2026-27470webHIGH 8.8Patched2026-07-05Wyze Cam Pan v3 / TUTK SDK — tutk_packet_alloc Heap Overflow (CVE-2026-38698) newCVE-2026-38698networkCRITICALUnverified2026-07-05Wing FTP Server Admin Session Poisoning via Lua loadfile() RCE (CVE-2026-44403) newCVE-2026-44403webHIGHPatched2026-07-05WeGIA Authenticated Error-Based SQL Injection Exploitation Helper (CVE-2026-23723) newCVE-2026-23723 / GHSA-xfmp-2hf9-gfjpwebHIGHPatched2026-07-05Weblate Arbitrary File Read via ssh-keyscan Host Argument Injection — CVE-2026-24126 newCVE-2026-24126webHIGH 6.5Patched2026-07-05Veno File Manager Path Traversal to Arbitrary File Read (CVE-2026-37066) newCVE-2026-37066webHIGHUnverified2026-07-05Veno File Manager Arbitrary PHP File Overwrite (CVE-2026-37068) newCVE-2026-37068webCRITICALUnverified2026-07-05Veno File Manager Arbitrary File Deletion (CVE-2026-37065) newCVE-2026-37065webHIGHUnverified2026-07-05Veno File Manager 4.4.9 — Authenticated Arbitrary File Read (CVE-2026-37070) newCVE-2026-37070webMEDIUMUnverified2026-07-05Veno File Manager 4.4.9 — Arbitrary File Rename to Privilege Escalation (CVE-2026-37071) newCVE-2026-37071webHIGHUnverified2026-07-05Tandoor Recipes Authenticated Local File Disclosure via Recipe Import (CVE-2026-25964) newCVE-2026-25964webMEDIUM 4.9Patched2026-07-05PbootCMS Authenticated RCE via sitecopyright Field (CVE-2026-36239) newCVE-2026-36239webCRITICALUnverified2026-07-05OpenWebUI "Tools" Unsandboxed exec() Remote Code Execution — CVE-2026-0766 new EPSS 26%CVE-2026-0766webHIGH 8.8Unverified2026-07-05OpenSTAManager Scadenzario Bulk Operations Error-Based SQL Injection — CVE-2026-24418 newCVE-2026-24418webHIGH 8.8Patched2026-07-05OpenSTAManager Prima Nota Error-Based SQL Injection — CVE-2026-24419 newCVE-2026-24419webHIGHPatched2026-07-05OpenSTAManager Global Search Amplified Time-Based Blind SQL Injection — CVE-2026-24417 newCVE-2026-24417webHIGHPatched2026-07-05OpenSTAManager Article Pricing Time-Based Blind SQL Injection — CVE-2026-24416 newCVE-2026-24416webHIGHPatched2026-07-05OpenRemote — Expression Injection RCE in Rules Engine (CVE-2026-39842) newCVE-2026-39842 / GHSA-7mqr-33rv-p3mpwebCRITICAL 10Patched2026-07-05OpenEMR EtherFax Module Authenticated Arbitrary File Read (CVE-2026-24849) newCVE-2026-24849webCRITICAL 6.5Patched2026-07-05Neo4j Bolt Transaction Metadata Log Injection (CVE-2026-1337) newCVE-2026-1337networkLOWUnverified2026-07-05LiteLLM Guardrail Custom-Code Sandbox Escape to Root RCE (CVE-2026-40217) new EPSS 15%CVE-2026-40217webCRITICAL 8.8Patched2026-07-05LatePoint Calendar Booking Plugin Contributor-to-Administrator Privilege Escalation (CVE-2026-49083) newCVE-2026-49083webHIGH 8.8Unverified2026-07-05Krayin CRM — TinyMCE Upload Unrestricted File Upload to RCE (CVE-2026-38526) newCVE-2026-38526webCRITICALUnverified2026-07-05ITFlow Time-Based Blind SQL Injection via agent/ajax.php expires Parameter (CVE-2026-54597) newCVE-2026-54597webHIGHUnverified2026-07-05ITFlow SQL Injection via recurring_invoice_frequency (CVE-2026-54596) newCVE-2026-54596webHIGHUnverified2026-07-05Hustle (WordPress Popup) Authenticated Arbitrary File Upload via Module Import (CVE-2026-0911) newCVE-2026-0911webHIGHUnverified2026-07-05Group-Office TNEF Attachment Handler OS Command Injection (CVE-2026-25512) new EPSS 19%CVE-2026-25512webCRITICAL 9.4Patched2026-07-05Group-Office PHP Deserialization Remote Code Execution (CVE-2026-34838) newCVE-2026-34838webCRITICALPatched2026-07-05Gogs Wiki Arbitrary File Deletion via Path Traversal (CVE-2026-24135) newCVE-2026-24135webHIGH 7.5Patched2026-07-05Gogs Organization-Name Path Traversal to RCE via Git Hooks — CVE-2026-52813 newCVE-2026-52813webINFOPatched2026-07-05EspoCRM Authenticated RCE via Formula ACL Bypass + Attachment Path Traversal — CVE-2026-33656 newCVE-2026-33656webCRITICALPatched2026-07-05EspoCRM 9.3.3 Stored HTML Injection in Email Notifications — CVE-2026-33657 newCVE-2026-33657webMEDIUMPatched2026-07-05EspoCRM 9.3.3 Authenticated SSRF via Alternative IPv4 Loopback Notation — CVE-2026-33534 newCVE-2026-33534webMEDIUMPatched2026-07-05EGroupware Nextmatch Filter Authenticated SQL Injection (CVE-2026-22243) newCVE-2026-22243webCRITICALPatched2026-07-05Dolibarr selectobject.php Authenticated Local File Inclusion (CVE-2026-34036) newCVE-2026-34036webMEDIUMPatched2026-07-05Dolibarr ERP/CRM OS Command Injection via MAIN_ODT_AS_PDF (CVE-2026-23500) newCVE-2026-23500 / GHSA-w5j3-8fcr-h87wwebCRITICALPatched2026-07-05DbGate `loadReader` `functionName` Injection RCE (CVE-2026-48017) newCVE-2026-48017 / GHSA-hv83-ggc4-v385webHIGH 8.8Patched2026-07-05Chamilo LMS Authenticated RCE via Unrestricted File Upload — CVE-2026-29041 newCVE-2026-29041webHIGH 8.8Patched2026-07-05Casdoor Authenticated Path Traversal to Arbitrary File Write (CVE-2026-6815) newCVE-2026-6815webHIGHUnverified2026-07-05Cacti Authenticated OS Command Injection via Host Notes Variable (CVE-2026-39949) newCVE-2026-39949webHIGHPatched2026-07-05BoidCMS — Authenticated File Upload to RCE via Template Injection (CVE-2026-39387) newCVE-2026-39387webHIGHPatched2026-07-05Bludit CMS API Unrestricted File Upload to RCE (CVE-2026-25099) newCVE-2026-25099webHIGHPatched2026-07-05Apache Superset Authenticated SQL Injection via sqlExpression/where Bypass — CVE-2026-23980 newCVE-2026-23980webMEDIUM 6.5Patched2026-07-05Apache NiFi 2.8.0 — EXECUTE_CODE Permission Bypass to Groovy RCE (CVE-2026-39816) newCVE-2026-39816webCRITICALPatched2026-07-05Cisco Catalyst SD-WAN Manager Arbitrary File Write (CVE-2026-20262) new KEV EPSS 28%CVE-2026-20262networkMEDIUM 6.5Unverified2026-07-01Authenticated Command Injection in LiteLLM MCP Test Endpoints (CVE-2026-42271) new KEV EPSS 84%CVE-2026-42271webHIGH 8.7Patched2026-07-01