CVE watch

CVE-2026-105405 published: Rejected reason: This CVE ID has been rejected as a duplicate.

CVE-2026-105404 published: Rejected reason: This CVE ID has been rejected as a duplicate.

CVE-2026-105403 published: Rejected reason: This CVE ID has been rejected as a duplicate.

CVE-2026-105402 published: Rejected reason: This CVE ID has been rejected as a duplicate.

CVE-2026-105401 published: Rejected reason: This CVE ID has been rejected as a duplicate.

CVE-2026-105400 published: Rejected reason: This CVE ID has been rejected as a duplicate.

CVE-2026-105399 published: Rejected reason: This CVE ID has been rejected as a duplicate.

CVE-2026-105398 published: Rejected reason: This CVE ID has been rejected as a duplicate.

CVE-2026-105331 published: Local privilege escalation in Checkmk 2.5.0 before 2.5.0p10 allows a user with access to edit the Oracle Instant Client referenced by the agent plugin 'mk-oracle' to escalate their privileges if an agent has this plugin enabled.

CVE-2026-104634 published: Incorrect Type Conversion or Cast vulnerability in BeamMCP.Server in ScriptKittyOS beam_mcp allows an MCP client's JSON true, false and null tool arguments to reach the host's dispatch function as the strings "true", "false" and "nil". After BeamMCP.Schema....

CVE-2026-103663 published: Ollama is vulnerable to path traversal in the `/api/pull` endpoint due to insufficient validation of layer digests by the `digestToPath` function. An unauthenticated remote attacker can specify a path traversal sequence as a layer digest, causing a maliciou...

CVE-2026-102784 published: Joomla Extension - balbooa.com - CSRF in language installation feature Gridbox < 2.20.4.0 - PagesController uses a trait that validates the Joomla session token only when the HTTP method is POST. addLanguage does not require POST inside the action and reads...

CVE-2026-102783 published: Joomla Extension - balbooa.com - Path Traversal in image preview Gridbox < 2.20.4.0 - Gridbox contains the same prefix-only containment logic in its site UploaderHelper . The showImage action resolves a request-controlled path, calls that helper, and then r...

CVE-2026-107503 published: Unvalidated environments URL allows OAuth authorization code + PKCE verifier theft and account takeover via injected OIDC authority in Ditto Explorer in Eclipse Ditto Ditto Explorer [3.6.0,3.9.7] allows a craft link set an attacker-controlled OIDC authority...

CVE-2026-4894 published: A vulnerability has been identified regarding insufficient validation in the Frappe Cloud/ERPNext authentication process, which allows multiple email addresses to be accepted by manipulating the email field in the /api/method/press.api.account.signup endpoi...

CVE-2026-12260 published: SQL injection in the NetBoard CRM demo platform; specifically, the vulnerable component is the ‘user-name’ POST parameter in the ‘/module/auth/recovery.php’ endpoint. The parameter is vulnerable to blind attacks based on Boolean, error, time-based and UNION...

CVE-2026-93699 published: Argument injection in WP Toolkit for cPanel allows local users to execute arbitrary code as other accounts on the same server.

CVE-2026-87428 published: In Brocade ASCG before 3.5.0, a  local unauthorized user on the ASCG VM who can issue a request to the SANnav host network namespace can extract stored management credentials for onboarded SANnav instances and compromise connected Brocade SANnav servers or ...

CVE-2026-87426 published: An unauthenticated network-based attacker can query specific internal management endpoints on Brocade ASCG versions before 3.5.0 to enumerate the configuration details and state of managed Brocade Fabric OS (FOS) switches. This results in the unauthorized d...

CVE-2026-87425 published: An unauthenticated remote attacker can modify the TLS client trust store in Brocade ASCG versions before 3.5.0. By supplying an unauthorized Certificate Authority (CA) certificate to an unauthenticated management interface, the attacker can cause the system...