VulDB Recent Entries

A vulnerability classified as problematic has been found in Netty up to 4.1.135.Final/4.2.15.Final. Affected by this issue is some unknown functionality of the component SpdyFrameCodec. Performing a manipulation results in allocation of resources. This vulnerability is cataloged as CVE-2026-55833. It is possible to initiate the attack remotely. There is no exploit available.

A vulnerability described as problematic has been identified in Netty up to 4.1.135.Final/4.2.15.Final. Affected by this vulnerability is an unknown functionality of the component SPDY SETTINGS decoder. Such manipulation leads to heap-based buffer overflow. This vulnerability is listed as CVE-2026-55831. The attack may be performed from remote. There is no available exploit.

A vulnerability marked as problematic has been reported in FreeRDP up to 3.27.x. Affected is an unknown function of the component CLI parser. This manipulation causes improper certificate validation. This vulnerability is tracked as CVE-2026-64624. The attack is possible to be carried out remotely. No exploit exists.

A vulnerability labeled as critical has been found in AgenticMail. This impacts an unknown function of the component api/core. The manipulation results in improper input validation. This vulnerability is identified as CVE-2026-47255. The attack can be executed remotely. There is not any exploit available.

A vulnerability identified as critical has been detected in WWBN AVideo. This affects an unknown function of the component Encoder. The manipulation of the argument downloadURL leads to server-side request forgery. This vulnerability is referenced as CVE-2026-64626. Remote exploitation of the attack is possible. No exploit is available.

A vulnerability categorized as critical has been discovered in AgenticMail. The impacted element is the function GET /api/agenticmail/tasks/pending of the file /api/agenticmail/tasks/pending of the component Task Management. Executing a manipulation of the argument assignee can lead to authorization bypass. The identification of this vulnerability is CVE-2026-57494. The attack may be launched remotely. There is no exploit available.

A vulnerability was found in Trilby Media Grav CMS scheduler-webhook Plugin up to 1.1.3/2.0.8. It has been rated as critical. The affected element is an unknown function of the component webhook token validation. Performing a manipulation results in Remote Code Execution. This vulnerability was named CVE-2026-57852. The attack may be initiated remotely. There is no available exploit.

A vulnerability was found in BKDDFS shamefile up to 0.1.6. It has been declared as problematic. Impacted is an unknown function of the file shamefile.yaml of the component shame next. Such manipulation of the argument shamefile.yaml leads to path traversal. This vulnerability is uniquely identified as CVE-2026-47144. Local access is required to approach this attack. No exploit exists.

A vulnerability was found in WWBN AVideo up to 28.x. It has been classified as problematic. This issue affects the function execAsync of the file on_publish.php of the component Live plugin. This manipulation causes os command injection. This vulnerability is handled as CVE-2026-64625. The attack can be initiated remotely. There is not any exploit available.

A vulnerability was found in agenticmail claudecode, codex, core and openclaw and classified as critical. This vulnerability affects unknown code of the component Mail Handler. The manipulation of the argument from/subject/preview results in permission issues. This vulnerability is known as CVE-2026-57495. It is possible to launch the attack remotely. No exploit is available.

A vulnerability has been found in FlareSolverr up to 3.4.6 and classified as critical. This affects an unknown part of the component API. The manipulation leads to server-side request forgery. This vulnerability is traded as CVE-2026-51031. It is possible to initiate the attack remotely. There is no exploit available.

A vulnerability, which was classified as problematic, was found in fuint Member Marketing System up to 1.0. Affected by this issue is some unknown functionality of the file ClientMessageController of the component ClientMessageController. Executing a manipulation can lead to cross site scripting. This vulnerability appears as CVE-2026-51025. The attack may be performed from remote. There is no available exploit.

A vulnerability, which was classified as very critical, has been found in Allwinner SJ4000-Air up to 1.4C. Affected by this vulnerability is an unknown functionality of the component FEX file Handler. Performing a manipulation results in privilege escalation. This vulnerability is reported as CVE-2026-52656. The attack is possible to be carried out remotely. No exploit exists.

A vulnerability classified as problematic was found in always-further nono up to 0.54.x. Affected is an unknown function of the component landlock. Such manipulation leads to sandbox issue. This vulnerability is documented as CVE-2026-47128. The attack needs to be performed locally. There is not any exploit available.

A vulnerability classified as problematic has been found in Brainstormforce Spectra Legacy Plugin up to 2.19.28 on WordPress. This impacts an unknown function of the component uagb image. This manipulation causes cross site scripting. This vulnerability is registered as CVE-2026-12900. Remote exploitation of the attack is possible. No exploit is available.

A vulnerability described as critical has been identified in safishamsi GRAPHIFY up to 0.4.29. This affects the function validate_url/safe_fetch/_build_opener/_fetch_html/_download_binary. The manipulation results in privilege escalation. This vulnerability is cataloged as CVE-2026-51385. The attack may be launched remotely. There is no exploit available.

A vulnerability marked as problematic has been reported in Vercel @ai-sdk and harness-opencode up to 1.0.28. The impacted element is an unknown function of the file host-tool-mcp.mjs of the component Relay. The manipulation leads to improper authorization. This vulnerability is listed as CVE-2026-64651. The attack must be carried out locally. There is no available exploit.

A vulnerability labeled as critical has been found in Vercel harness-codex up to 1.0.28. The affected element is an unknown function of the component Relay. Executing a manipulation can lead to improper authorization. This vulnerability is tracked as CVE-2026-64650. The attack can be launched remotely. No exploit exists.

A vulnerability identified as critical has been detected in Tenda TX9 22.03.02.20. Impacted is the function update_dev_name of the file /goform/SetOnlineDevName of the component goform. Performing a manipulation results in denial of service. This vulnerability is identified as CVE-2024-51316. The attack can be initiated remotely. There is not any exploit available.

A vulnerability categorized as very critical has been discovered in Tenda TX9 22.03.02.20. This issue affects the function sub_425964 of the file /goform/SetOnlineDevName of the component goform. Such manipulation leads to stack-based buffer overflow. This vulnerability is referenced as CVE-2024-51315. It is possible to launch the attack remotely. No exploit is available.