CVE Vulnerabilities - 28 August 2026

The web interface of Kubeflow Pipelines versions earlier than 2.17 can be tricked into sending requests to any internal address without checking the caller's identity. This could let an attacker read ...

The GiveWP donation plugin for WordPress can be fooled by specially crafted information, allowing an attacker to insert malicious instructions that run on your site. This could give them control over ...

Versions 1.0.0 through 1.11.1 of IBM Langflow allow someone who has a regular account to make the software run any command on the server. This can let an attacker take control of the machine that host...

The IBM Application Runtime Expert for i includes a graphical interface that can be tricked by someone on the network, even without logging in. That attacker could act as another user and obtain highe...

If you use Pimcore versions older than the latest releases, a user who can log in and has permission to work with objects can trick the system into creating PHP code inside its data‑object classes. Th...

Older versions of the Yamcs mission control software could insert user‑provided search strings into Java code without proper escaping. An attacker could include a quote in the pattern to inject and ru...

Versions of free5GC up to 4.2.2 let anyone with access to the internal API add false network function records without proper validation. These bogus entries are stored and later returned to other comp...

Versions 1.0.0 through 1.11.1 of IBM Langflow OSS do not properly restrict access to a public interface that allows one system to talk to another. This gap could let a remote attacker send specially c...

The default setup of JFrog Artifactory lets anyone on the network log in without credentials and gain full administrative control. This could let attackers change settings, delete data, or install mal...

Versions of Argo Rollouts dashboard up to 1.10.0 listen on every network address and do not require a login or other checks. Because of this, anyone on the same network can start, stop, restart, or al...

The router’s web interface lets anyone send a specially crafted request and see the administrator’s login name. This makes it easier for attackers to plan further attacks against your network. Apply t...

The TOTOLINK T6 device running version 4.1.5cu.748 allows anyone on the network to send a special MQTT message that forces the router to restart. This can cause temporary loss of connectivity and inte...

Older versions of the Yamcs mission control system let a specially crafted web request add malicious configuration data. That data can cause Yamcs to start a process that runs any command it wants, us...

Redpanda versions up to 26.2.2 open their administrative interface to the whole network and do not require a password by default. This means anyone who can reach the server can add or remove broker ac...

The web management console of PaperCut MF and PaperCut NG can be accessed without a login under certain conditions, allowing outsiders to alter system configurations. This could lead to unintended cha...

The ai‑maestro software version 0.24.17 contains a flaw in a function that handles session termination. An attacker who can send specially crafted data could cause the system to run any operating‑syst...

The grpc-gateway library version 2.28.0 accepts the X-HTTP-Method-Override header without checking which methods are allowed. An attacker can send a POST request that changes the request method to any...

The SOY CMS website software can be tricked into processing malicious data, which may cause it to run any code the attacker wants. This code would run with the same rights as the web server, potential...

WordPress sites that use the WPMU DEV Dashboard plugin version 5.0.1 or earlier are at risk. Because of a flaw in how the plugin validates login requests, someone without credentials can trick the sys...

The qede network driver in the Linux kernel sometimes checks the size of a data list after it has already accessed that list, which can let it read memory it shouldn't. This could cause system instabi...

The built‑in Linux driver for MediaTek network cards can cause the system to stop working if a special network‑polling feature is turned on. The driver passes the wrong piece of information to a funct...

A part of the Linux operating system that handles virtual network traffic (VXLAN) could accidentally use memory that has been released when the system changes the route for a packet. This can cause th...

The Linux kernel’s IPVS component could copy a special one‑packet flag from a destination to synced connections that were created before the destination existed. This may cause old connection records ...

A bug in the Linux kernel’s network bridge code could cause it to treat a zero counter as 255, leading to it read data from the wrong place in memory. This could happen only with an unusually malforme...

The Linux operating system’s traffic‑shaping component (fq_codel) can mistakenly tell the system that a queue is empty when it still holds a packet. This can lead to the parent network class being tur...