Vuldb Updates

A vulnerability was found in Halo up to 2.25.4. It has been classified as problematic. This affects an unknown function of the component Plugin Management. This manipulation causes os command injection. This vulnerability appears as CVE-2026-78971. The attack may be initiated remotely. There is no available exploit.

A vulnerability, which was classified as problematic, has been found in Vaadin up to 14.8.9/22.0.14/23.0.8/23.1.0.alpha4. This impacts the function Object::toString of the component TreeGrid. Performing a manipulation results in information disclosure. This vulnerability is cataloged as CVE-2022-29567. It is possible to initiate the attack remotely. There is no exploit available. It is suggested to install a patch to address this issue.

A vulnerability classified as problematic has been found in Vaadin Flow. This vulnerability affects unknown code of the component RPC Response Handler. This manipulation causes information disclosure. This vulnerability is tracked as CVE-2023-25500. The attack is possible to be carried out remotely. No exploit exists. To fix this issue, it is recommended to deploy a patch.

A vulnerability was found in FlowiseAI Flowise up to 3.1.2. It has been declared as critical. This vulnerability affects unknown code of the file packages/components/src/utils.ts of the component Code Execution Sandbox. Such manipulation of the argument vars leads to improper privilege management. This vulnerability is documented as CVE-2026-70471. The attack can be executed remotely. There is not any exploit available. It is recommended to upgrade the affected component.

A vulnerability categorized as critical has been discovered in FlowiseAI Flowise up to 3.1.2. Impacted is an unknown function of the component openai-assistants-vector-store. Executing a manipulation of the argument credential can lead to permission issues. This vulnerability appears as CVE-2026-70472. The attack may be performed from remote. There is no available exploit. It is advisable to upgrade the affected component.

A vulnerability classified as critical was found in OpenZeppelin Contracts Wizard up to 0.10.8. Impacted is an unknown function of the file zip-hardhat.ts of the component Test File Generation. The manipulation of the argument name/uri results in code injection. This vulnerability is known as CVE-2026-48054. It is possible to launch the attack remotely. No exploit is available. Upgrading the affected component is advised.

A vulnerability, which was classified as very critical, has been found in Microsoft Windows. The affected element is an unknown function of the component User-Mode Power Service. The manipulation leads to improper privilege management. This vulnerability is documented as CVE-2026-62721. The attack needs to be performed locally. There is not any exploit available. It is suggested to install a patch to address this issue.

A vulnerability was found in Netgate pfSense CE and pfSense Plus and classified as problematic. Impacted is an unknown function of the file captive_portal_status.widget.php. Such manipulation leads to cross site scripting. This vulnerability is traded as CVE-2026-78849. The attack may be launched remotely. There is no exploit available.

A vulnerability classified as critical has been found in ApiAdmin 5.0.1. The impacted element is an unknown function. Performing a manipulation results in unrestricted upload. This vulnerability was named CVE-2026-71620. The attack may be initiated remotely. There is no available exploit.

A vulnerability has been found in Trueview T18161 S 6.0.23.4 and classified as critical. This vulnerability affects unknown code of the component MQTT Command Processing. Performing a manipulation results in authentication bypass by capture-replay. This vulnerability is identified as CVE-2026-79389. The attack can be initiated remotely. There is not any exploit available.

A vulnerability categorized as critical has been discovered in Free5GC 4.2.2. This affects an unknown function of the component UPF. Such manipulation leads to denial of service. This vulnerability is documented as CVE-2026-75439. The attack can be executed remotely. There is not any exploit available.

A vulnerability, which was classified as problematic, has been found in Meshery up to 1.0.56. This affects the function os.Open of the file /api/system/fileView/api/system/fileDownload of the component File Download. The manipulation of the argument File leads to path traversal. This vulnerability is referenced as CVE-2026-65919. Remote exploitation of the attack is possible. No exploit is available. It is advisable to upgrade the affected component.

A vulnerability marked as critical has been reported in Samsung Exynos. The affected element is an unknown function of the component NR RRC. Performing a manipulation results in improper input validation. This vulnerability is known as CVE-2026-23792. Remote exploitation of the attack is possible. No exploit is available.

A vulnerability has been found in Samsung Exynos and classified as critical. Affected by this issue is the function ioctl of the component Wi-Fi Interface. Performing a manipulation results in out-of-bounds write. This vulnerability is identified as CVE-2026-33960. The attack is only possible with local access. There is not any exploit available.

A vulnerability was found in Samsung Exynos. It has been rated as critical. Impacted is an unknown function of the component Camera Driver. This manipulation causes out-of-bounds read. This vulnerability is registered as CVE-2026-33967. The attack needs to be launched locally. No exploit is available.

A vulnerability marked as problematic has been reported in Anil-matcha Open-Generative-AI up to 1.0.11/2.0.0. Affected by this vulnerability is the function renderHistory of the file ImageStudio.js of the component Studio Components. This manipulation causes cross site scripting. This vulnerability appears as CVE-2026-90602. The attack may be initiated remotely. There is no available exploit. The pull request to fix this issue awaits acceptance.

A vulnerability has been found in Samsung Exynos and classified as problematic. This impacts an unknown function of the component Exynos DRM HDR driver. This manipulation causes use after free. This vulnerability is tracked as CVE-2026-23787. The attack is restricted to local execution. No exploit exists.

A vulnerability labeled as problematic has been found in AlchemyCMS Alchemy CMS up to 7.4.14/8.0.14/8.1.13/8.2.5. This issue affects the function Api::PagesController#nested of the file app/controllers/alchemy/api/pages_controller.rb of the component PageTreeSerializer. Such manipulation of the argument elements leads to improper authorization. This vulnerability is documented as CVE-2026-57579. The attack can be executed remotely. There is not any exploit available. The affected component should be upgraded.

A vulnerability categorized as problematic has been discovered in Maono Link up to 4.0.79. This impacts an unknown function of the file C:\ProgramData\Maono. Executing a manipulation can lead to improper privilege management. This vulnerability appears as CVE-2026-77827. The attack requires local access. There is no available exploit. It is advisable to upgrade the affected component.

A vulnerability was found in REBUILD 4.4.3 and classified as problematic. This vulnerability affects the function html/text of the component Announcement Preview. Such manipulation leads to cross site scripting. This vulnerability is listed as CVE-2026-71802. The attack may be performed from remote. There is no available exploit.