cve.new

Create and share CVE reports with the right team, or explore published vulnerabilities, affected versions, and available fixes.

[cve.new @cvedotnew]

CVE-2026-109469 · CRITICAL · CVSS 10.0

Entra Device Registration is vulnerable to elevation of privilege through authorization bypass. An attacker with network access can exploit a user-controlled key.

CVSS 3.1 · microsoft
https://t.co/gtAVUupANA

[cve.new @cvedotnew]

CVE-2026-17392 · CRITICAL · CVSS 9.9

IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 may allow a remote authenticated attacker to gain unauthorized administrative access due to LDAP injection.

CVSS 3.1 · ibm
https://t.co/cbK8WBXA01

[cve.new @cvedotnew]

CVE-2026-17399 · CRITICAL · CVSS 9.9

IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 may allow a remote authenticated attacker to execute arbitrary code due to insufficient validation of uploaded content.

CVSS 3.1 · ibm
https://t.co/98lkgQGaP8

[cve.new @cvedotnew]

CVE-2026-123958 · CRITICAL · CVSS 9.9

A vulnerability was identified in TOTOLINK CA300-PoE 6.2c.884. The affected element is the function setLanConfig of the file /cgi-bin/cstecgi.cgi.

CVSS 3.0 · VulDB
https://t.co/q1UaKWaRIP

[cve.new @cvedotnew]

CVE-2026-123966 · CRITICAL · CVSS 10.0

Tenda AC19 version 16.03.10.07 has a heap-based buffer overflow vulnerability in the saveParentControlInfo function, allowing remote attacks via the deviceId argument.

CVSS 2.0 · VulDB
https://t.co/4e0j9PHpwI

[cve.new @cvedotnew]

CVE-2026-123960 · CRITICAL · CVSS 9.9

A weakness has been identified in TOTOLINK CA300-PoE 6.2c.884. This affects the function setWanConfig of the file /cgi-bin/cstecgi.cgi.

CVSS 3.0 · VulDB
https://t.co/GNPbAxYFAS

[cve.new @cvedotnew]

CVE-2026-123961 · CRITICAL · CVSS 9.9

TOTOLINK CA300-PoE firmware version 6.2c.884 has a buffer overflow weakness in the setWiFiBasicConfig function of cstecgi.cgi, potentially initiated remotely through the KeyStr argument.

CVSS 3.0 · VulDB
https://t.co/6DrsyTiDPG

[cve.new @cvedotnew]

CVE-2026-123957 · CRITICAL · CVSS 9.9

TOTOLINK CA300-PoE firmware version 6.2c.884 has a buffer overflow weakness in the setIpQosRules function of cstecgi.cgi, potentially allowing remote attacks via the ipStart argument.

CVSS 3.0 · VulDB
https://t.co/ncLqTVWjl5

[cve.new @cvedotnew]

CVE-2026-17402 · CRITICAL · CVSS 9.9

IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 may allow a remote authenticated attacker to execute arbitrary commands due to OS command injection.

CVSS 3.1 · ibm
https://t.co/u7gqAwDe1g

[cve.new @cvedotnew]

CVE-2026-17410 · CRITICAL · CVSS 9.9

IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to access and modify other tenants' portal data due to improper neutralization of…

CVSS 3.1 · ibm
https://t.co/oR4Xvi7dFX

[cve.new @cvedotnew]

CVE-2026-85295 · CRITICAL · CVSS 9.8

Chartbrew versions prior to 5.2.3 are vulnerable to full account takeover via JWTs accepted under default CB_SECRET.

CVSS 3.1 · GitHub_M
https://t.co/6AOx2ZPPjP

[cve.new @cvedotnew]

CVE-2026-59104 · CRITICAL · CVSS 9.8

UgCS server before 6.2 contains an authentication bypass in the HCI protocol login handler (LoginHandler) exposed on TCP port 3334.

CVSS 3.1 · ENISA
https://t.co/tbutw69UP6

[cve.new @cvedotnew]

CVE-2026-71495 · CRITICAL · CVSS 10.0

Wanderer is a self-hosted trail database for saving and sharing adventures.

CVSS 3.1 · GitHub_M
https://t.co/0JjBKBqawm

[cve.new @cvedotnew]

https://t.co/kdlZrAj6zy

[cve.new @cvedotnew]

CVE-2026-122193 · CRITICAL · CVSS 9.9

Trusted Remote Execution (REX) before 2026-07-28 has an OS command injection weakness, potentially allowing authenticated remote users to execute arbitrary commands as root.

CVSS 3.1 · AMZN
https://t.co/0wC3TgPQ2J

[cve.new @cvedotnew]

CVE-2026-123488 · CRITICAL · CVSS 9.8

Craft CMS 4.0.0 before 4.18.9 and 5.0.0 before 5.11.2 contains an unauthenticated SQL injection vulnerability in the element search endpoint because the attribute parameter is concatenated into…

CVSS 3.1 · VulnCheck
https://t.co/UVveVzQR0b

[cve.new @cvedotnew]

CVE-2026-59105 · CRITICAL · CVSS 9.8

Jumis versions before TJ7.0.141.36 use a deterministically derived password for the Tilde_JumisAdmin SQL Server login, which can be computed offline by anyone able to reach the server.

CVSS 3.1 · ENISA
https://t.co/ENNfjF0URG

[cve.new @cvedotnew]

CVE-2026-107622 · CRITICAL · CVSS 9.8

The BuddyForms plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.10.5 via a form-type confusion attack through the `bf_post_type` parameter.

CVSS 3.1 · Wordfence
https://t.co/NaviheHkF8

[cve.new @cvedotnew]

CVE-2026-118423 · CRITICAL · CVSS 10.0

WP Libre Form 1.5.0.1 has an unauthenticated file upload weakness, potentially allowing code execution. The plugin does not validate uploaded file types. Impact is uncertain.

CVSS 3.1 · WPScan
https://t.co/8eqBAIRK95

[cve.new @cvedotnew]

CVE-2026-71550 · CRITICAL · CVSS 9.9

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application.

CVSS 3.1 · GitHub_M
https://t.co/iAhNRpxab2