STACKFLAG

Every critical CVE (CVSS 9+), explained in plain English - what it is, how bad it is, and what to do about it. Too many to follow? Exactly. That is why we built https://stackflag.com - track only the vulnerabilities that affect your stack. #CVE #infosec

CVE-2026-58256 - grr The GRR reservation system lets administrators set up an LDAP connection. If an attacker controls the LDAP server and the admin enters crafted settings, PHP code can be injected and… Too many irrelevant or confusing CVEs? Use stackflag.com #grr #jeromedevome #CVE #infosec

CVE-2026-57197 - asterisk Versions of Asterisk before the latest releases may stop working if they try to play a specially-crafted OGG/Speex audio file. An attacker who can place such a file on the system… Too many irrelevant or confusing CVEs? Use stackflag.com #asterisk #Debian14 #CVE #infosec

CVE-2026-112352 Versions of Sunhillo SureLine earlier than 9.1.5 can be tricked into accepting a fake login cookie. An attacker on the network could guess common usernames and gain the same access as any logged‑in user,… Too many irrelevant or confusing CVEs? Use stackflag.com #CVE #infosec

CVE-2026-108142 - backup and replication The CDP Coordinator service in Veeam Backup & Replication can be reached by anyone on the network without proving their identity, allowing them to bypass normal permission… Too many irrelevant or confusing CVEs? Use stackflag.com #veeam #CVE #infosec

CVE-2026-104353 - adobe campaign classic Adobe Campaign Classic can be tricked into running commands that the attacker supplies, even without any user interaction. A low‑privilege attacker could cause the system to… Too many irrelevant or confusing CVEs? Use stackflag.com #adobe #CVE #infosec

CVE-2026-105489 - adobe campaign classic Adobe Campaign Classic can be tricked into running unwanted commands when it processes specially crafted input. A low‑privilege attacker could exploit this without any user… Too many irrelevant or confusing CVEs? Use stackflag.com #adobe #CVE #infosec

CVE-2026-105781 - adobe campaign classic Adobe Campaign Classic can be tricked into running database commands that were not intended. This could let an attacker access or change data and take control of user accounts… Too many irrelevant or confusing CVEs? Use stackflag.com #adobe #CVE #infosec

CVE-2026-104354 - adobe campaign classic Adobe Campaign Classic can be tricked by a user with high-level rights into running commands they choose. Because no user interaction is needed, an insider could execute… Too many irrelevant or confusing CVEs? Use stackflag.com #adobe #CVE #infosec

CVE-2026-108015 - notes client A group of certificates that HCL Notes Client relies on were issued with secret codes that have been stolen. Since the client trusts those certificates, a network… Too many irrelevant or confusing CVEs? Use stackflag.com #notesclient #hclsoftware #CVE #infosec

CVE-2026-108014 - domino server The private keys for several eMudhra certificates have been stolen, which means the trust those certificates provide for HCL Domino Server's outbound network… Too many irrelevant or confusing CVEs? Use stackflag.com #dominoserver #hclsoftware #CVE #infosec

CVE-2026-48360 - adobe connect desktop app The Adobe Connect desktop and Android applications can be tricked into running malicious code if a user opens a specially crafted web link. This could let an attacker execute… Too many irrelevant or confusing CVEs? Use stackflag.com #adobe #CVE #infosec

CVE-2026-116863 - newsletters The Newsletters plugin for WordPress (versions up to 4.18.2) can be tricked into performing actions on behalf of a logged‑in user without their consent. An attacker could… Too many irrelevant or confusing CVEs? Use stackflag.com #newsletters #tribulant #CVE #infosec

CVE-2026-112710 - fireware os The authentication component of WatchGuard Fireware OS that talks to an Active Directory server can be tricked by a specially crafted response. An attacker who can see or… Too many irrelevant or confusing CVEs? Use stackflag.com #firewareos #watchguard #CVE #infosec

CVE-2026-103594 - fireware os WatchGuard's Fireware OS may mishandle WireGuard configuration data. If an attacker can intercept and modify the cloud‑gateway messages, they could cause the device to… Too many irrelevant or confusing CVEs? Use stackflag.com #firewareos #watchguard #CVE #infosec

CVE-2026-112709 - fireware os The Fireware OS authentication service on WatchGuard devices can be tricked by a malformed response from a compromised or intercepted Active Directory server. This could… Too many irrelevant or confusing CVEs? Use stackflag.com #firewareos #watchguard #CVE #infosec

CVE-2026-35002 - agno Versions of Agno before 2.3.24 let a specially crafted input control a function that runs arbitrary code, so an attacker could take over the application. This affects any Agno… Too many irrelevant or confusing CVEs? Use stackflag.com #agno #agnoteam #pip #CVE #infosec

CVE-2026-117603 Versions of Electrum before 4.7.2 allow the Nostr Wallet Connect feature to ignore the daily spending cap. A malicious client could make multiple payment requests that slip past the check and drain more money… Too many irrelevant or confusing CVEs? Use stackflag.com #CVE #infosec

CVE-2026-48705 - monai Anyone on the network can send a specially crafted medical image file to a MONAIlabel server and make it stop working or produce incorrect AI predictions. The problem comes… Too many irrelevant or confusing CVEs? Use stackflag.com #monai #monaiconsortium #pip #CVE #infosec

CVE-2026-117601 Versions of the Electrum Bitcoin wallet before 4.8.3 do not correctly check the digital signatures on transactions that are still waiting in the network's memory pool. A rogue server can swap a just‑sent… Too many irrelevant or confusing CVEs? Use stackflag.com #CVE #infosec

CVE-2026-27975 - ajenti The Ajenti server management panel for Linux and BSD could be accessed by anyone on the network, allowing them to run any commands on the server. This could let an attacker take control of… Too many irrelevant or confusing CVEs? Use stackflag.com #ajenti #pip #CVE #infosec

CVE-2026-65145 The NVIDIA NeMo Agent Toolkit does not properly verify a user's identity, so an attacker could access it without logging in. This could let the attacker run their own code, steal or change data, and disrupt the… Too many irrelevant or confusing CVEs? Use stackflag.com #CVE #infosec

CVE-2026-115216 - eclipse iofog Versions of the Eclipse ioFog Operator between 3.8.0 and 3.9.1 do not check the security certificates when they talk to the Controller or an external login… Too many irrelevant or confusing CVEs? Use stackflag.com #eclipseiofog #eclipsefoundation #CVE #infosec

CVE-2026-117532 - core Versions of REDAXO core from 5.3.0 up to 5.21.3 let unauthenticated users create fake login tokens and gain back‑end access, including the ability to run code. This is possible through a… Too many irrelevant or confusing CVEs? Use stackflag.com #core #redaxo #CVE #infosec

CVE-2026-82116 - hirdb server version 10 Several versions of Hitachi's HiRDB database server do not check whether a user is logged in before allowing access to a critical function. This could let an outsider execute… Too many irrelevant or confusing CVEs? Use stackflag.com #hitachi #CVE #infosec

CVE-2026-82120 - hirdb server version 10 Several versions of Hitachi's HiRDB database server may allow data to be written beyond the allocated memory space. This can lead to a crash or let an attacker run… Too many irrelevant or confusing CVEs? Use stackflag.com #hitachi #CVE #infosec

CVE-2026-82122 - hirdb server version 10 Certain versions of Hitachi HiRDB Server (9 and 10, including 32‑bit and additional‑function editions) contain a flaw that can cause the program to write beyond its intended… Too many irrelevant or confusing CVEs? Use stackflag.com #hitachi #CVE #infosec

CVE-2026-76936 - jp1/automatic job management system 3 - manager The manager component of Hitachi's JP1 Automatic Job Management System 3 (versions before 13-50-31) has a coding error that could let an attacker cause… Too many irrelevant or confusing CVEs? Use stackflag.com #hitachi #CVE #infosec

CVE-2026-76938 - jp1/automatic job management system 3 - manager Versions of JP1 Job Management System 3 Manager released before 13-50-31 allow someone to skip the login step and gain access to the system. An… Too many irrelevant or confusing CVEs? Use stackflag.com #hitachi #CVE #infosec

CVE-2026-76934 - jp1/automatic job management system 3 - manager Versions of JP1 Automatic Job Management System 3 Manager and Agent prior to 13-50-31 contain a defect that lets an attacker overflow a memory buffer… Too many irrelevant or confusing CVEs? Use stackflag.com #hitachi #CVE #infosec

CVE-2026-116811 Versions of OpenPanel older than 3.0.0 contain a flaw that lets a user with write permission execute their own code on the server. This could allow the attacker to read or change data and affect other users.… Too many irrelevant or confusing CVEs? Use stackflag.com #CVE #infosec

CVE-2026-116748 - transmission Versions of Transmission from 4.0.0 through 4.1.2 leak the anti‑CSRF session token to any web page that contacts the program. A malicious site could read the token and then tell… Too many irrelevant or confusing CVEs? Use stackflag.com #transmission #CVE #infosec

CVE-2026-76932 - jp1/automatic job management system 3 - manager The manager and agent components of Hitachi's JP1 Automatic Job Management System 3 (versions before 13‑50‑31) contain a coding error that could let a… Too many irrelevant or confusing CVEs? Use stackflag.com #hitachi #CVE #infosec

CVE-2026-86577 - jp1/integrated management 3 - manager Versions of Hitachi JP1 Integrated Management 3, Automatic Job Management System 3 (manager, agent, and minimal edition) and JP1/Base before their latest patches… Too many irrelevant or confusing CVEs? Use stackflag.com #hitachi #CVE #infosec

CVE-2026-86575 - jp1/integrated management 3 - manager Several JP1 management and job control components are vulnerable to a memory error that could let an attacker run their own programs on the server. This affects… Too many irrelevant or confusing CVEs? Use stackflag.com #hitachi #CVE #infosec

CVE-2026-102788 - gridbox extension for joomla The Gridbox extension for Joomla lets anyone modify a URL parameter on product list pages, causing the system to run unauthorized database commands. This could allow attackers to… Too many irrelevant or confusing CVEs? Use stackflag.com #CVE #infosec

CVE-2023-37920 - certifi The Python certifi library, used by several applications, can be tricked into accepting fraudulent security certificates, potentially exposing data to eavesdropping or tampering.… Too many irrelevant or confusing CVEs? Use stackflag.com #certifi #netapp #pip #CVE #infosec

CVE-2026-92885 - qode membership The Qode Membership add‑on for WordPress can be tricked into signing in anyone without checking their Facebook credentials. An error in the code means the safety… Too many irrelevant or confusing CVEs? Use stackflag.com #qodemembership #qodethemes #CVE #infosec

CVE-2026-18450 - x12spi The management controller in Supermicro X12SPI servers does not properly check that IPMI commands are protected with integrity and encryption. An attacker who can intercept an active… Too many irrelevant or confusing CVEs? Use stackflag.com #x12spi #smci #CVE #infosec

CVE-2022-22817 - pillow The Pillow package used for handling images may execute harmful code if it processes a specially crafted picture. This risk affects any system that uses Pillow, such as Python… Too many irrelevant or confusing CVEs? Use stackflag.com #pillow #debian #pip #CVE #infosec

CVE-2021-34552 - pillow The Python Pillow image library used in many Linux distributions and Python projects can be tricked into executing malicious code when it processes specially crafted image files.… Too many irrelevant or confusing CVEs? Use stackflag.com #pillow #python #pip #CVE #infosec

CVE-2026-77053 - boneio The boneIO device runs its web management interface openly, letting anyone on the network change settings, shut it down, or control attached hardware. Upgrade to version 1.6.0 or re-flash older… Too many irrelevant or confusing CVEs? Use stackflag.com #boneio #CVE #infosec

CVE-2026-77052 - boneio The boneio home‑automation device serves a Node‑RED interface without requiring a login. Because the admin API can install flows that execute system commands, anyone on the same network could… Too many irrelevant or confusing CVEs? Use stackflag.com #boneio #CVE #infosec

CVE-2026-116747 - kener The Kener software versions before 4.1.10 use a built‑in secret key when no custom key is set. Because of this, anyone who knows an admin email can create a valid login cookie and… Too many irrelevant or confusing CVEs? Use stackflag.com #kener #rajnandan1 #CVE #infosec

CVE-2026-116508 - a950rg The router’s web interface has a bug that can be triggered by sending a specially crafted request, causing the device to overflow its memory. An attacker could take control of the… Too many irrelevant or confusing CVEs? Use stackflag.com #a950rg #totolink #CVE #infosec

CVE-2026-116504 - a950rg The A950RG router running version 4.1.2 can be tricked into running unwanted commands when an attacker supplies a crafted file name during a cloud firmware upgrade. Because the… Too many irrelevant or confusing CVEs? Use stackflag.com #a950rg #totolink #CVE #infosec

CVE-2026-116505 - a950rg The A950RG router running version 4.1.2cu.5268_B20221104 can be tricked into running unauthorized commands when an attacker supplies a crafted MAC address to the device information… Too many irrelevant or confusing CVEs? Use stackflag.com #a950rg #totolink #CVE #infosec

CVE-2026-116506 - a950rg The router’s firewall component can be tricked into running unauthorized commands when an attacker sends specially crafted data. Because the flaw can be exploited over the network,… Too many irrelevant or confusing CVEs? Use stackflag.com #a950rg #totolink #CVE #infosec

CVE-2026-110720 - tooling Versions of Consul‑k8s from 0.42.0 onward can mistakenly allow someone in one Kubernetes namespace to act with higher rights in another namespace. This could let an attacker get… Too many irrelevant or confusing CVEs? Use stackflag.com #tooling #hashicorp #CVE #infosec

CVE-2026-10757 - arcgis server ArcGIS Server versions up to 12.1 on Windows or Linux may let a user who can reach the service send specially crafted requests that execute database commands they shouldn’t.… Too many irrelevant or confusing CVEs? Use stackflag.com #arcgisserver #esri #CVE #infosec

CVE-2026-102649 - burrito The Burrito service that runs Terraform jobs could be called by anyone if its webhook secret is missing or empty. An attacker could send fake messages and cause the system to… Too many irrelevant or confusing CVEs? Use stackflag.com #burrito #padokteam #CVE #infosec