CVE Vulnerabilities - 15 July 2026

NocoBase's in-app messaging feature allows attackers to inject malicious SQL code. This could potentially give an attacker control over a database and allow them to execute unauthorized commands. To f...

The 9router software exposes unauthenticated API endpoints that can be used to execute arbitrary OS commands without any prerequisites or credentials. This vulnerability exists because the authenticat...

A security issue in NocoBase's notification plugin could allow an authenticated user to execute malicious code on the database. This could lead to unauthorized access and data theft. NocoBase has rele...

An attacker can exploit a flaw in the Snowflake database connection to write malicious files on the Metabase server. This can lead to unauthorized code execution, potentially compromising the server. ...

The iperf authentication module is vulnerable to a buffer overflow, which could allow an attacker to execute malicious code. This affects users who run iperf, especially in network testing and benchma...

A vulnerability in Wazuh Manager before version 5.0.0-beta3 allows an enrolled agent to delete or alter data in the SIEM system. This could lead to deleted alerts, tampered data, or other security inf...

The axios library used in some Root applications contains a security flaw that could allow an attacker to run malicious code on your server. This could happen if an attacker injects malicious data int...

Wekan, an open source project management tool, allows attackers to execute commands on the server by uploading a malicious avatar with special characters. This can lead to unauthorized access and syst...

Wekan's avatar upload feature allows hackers to execute server commands if they upload a file with malicious characters. This is a security risk because it could allow hackers to take control of your ...

In multi-tenant n8n-MCP deployments, an authenticated tenant could access and delete other tenants' workflow backup data. This is fixed in version 2.56.1. To protect your data, upgrade to the latest v...

DataEase's data visualization and analysis tool had a security issue that could allow attackers to create fake user accounts with access to sensitive data. This is a concern because it could lead to u...

Penpot, a design tool, had a security weakness that allowed a registered user to take over any non-blocked account by using an invitation token. This meant that an attacker could gain access to sensit...

The axios package for Root:npm allows an attacker to access sensitive data without needing a valid login. This issue affects users of Root's npm package and has been fixed in a newer version, which sh...

An attacker can gain full access to any Wekan account, including admin accounts, by sending a fake IP address. This can happen if you're using Wekan's header-login feature with trusted IP addresses. T...

A security issue exists in LiteLLM 1.18.10 that could allow an attacker to execute malicious code on your server with the same permissions as the LiteLLM process. This can happen if an attacker is abl...

A publicly accessible management interface in xszyou Fay 4.3.1 can be exploited by an attacker to run unauthorized server commands. This allows the attacker to take control of the server, which could ...

Attackers can trick users into opening a malicious webpage, giving them control over the system. This is a serious security risk because it allows attackers to take control of your computer and steal ...

A security issue in the Tenda AC10 v3 router's firmware (version V03.03.16.09) could allow hackers to shut down the router or take control of it. This affects anyone using this router, and it's essent...

9router's default secret is hardcoded and publicly known, allowing unauthorized users to access the dashboard and API if the server's JWT secret is not set. This vulnerability affects many public 9rou...

A security issue affects Pegatron's Tdelo64.sys driver, which allows unauthorized access to sensitive hardware features. This could be exploited by an attacker on the same local network, potentially c...

The Oracle E-Business Suite's Payments component has a vulnerability in its File Transmission feature. This means an attacker with internet access can potentially take control of the Payments system, ...

The AVideo YPTSocket plugin has a security flaw that allows an attacker to inject malicious code into the website's content, potentially affecting administrators viewing the online-users panel. This c...

An attacker can inject malicious code into the OpenWrt admin interface, potentially allowing them to steal sensitive information or take control of the device. This is fixed in version 25.12.5. Users ...

If you're using an outdated version of the @better-auth/sso plugin, an attacker can access your server by tricking your system into making unauthorized requests. This can happen even if the attacker d...

Grav users are at risk of account takeover if an attacker sends a fake password reset email with a link to a server they control. This can happen if an attacker sends a malicious request to the Grav A...