Threat database

CVE-2026-87911 is a reported vulnerability with minimal publicly available information. No technical details, affected versions, or patch information have been provided. There is no evidence of exploitation in the wild at this time.

CVE-2026-87912 and CVE-2026-87913 refer to missing S3 bucket ownership verification vulnerabilities in the AWS Security Agent plugin for aws-agents-for-devsecops and MCP Server. The vulnerabilities relate to improper validation of S3 bucket ownership, which could potentially lead to security issues. No specific affected versions or detailed technical information are provided. No known exploits are reported in the wild. No patch or remediation information is available at this time.

CVE-2026-85228 is an integer overflow vulnerability in the tensor buffer validation component of the Deep Java Library. The vulnerability could potentially lead to incorrect validation of tensor buffer sizes. No affected versions or detailed technical information are provided. There is no information about available patches or exploits in the wild.

CVE-2026-111943 is a key-generation flaw in the external certificate authority eMudhra/emSign that made intermediate CA private keys recoverable. Three root certificates—AAA Certificate Services, emSign Root TLS CA - G3, and emSign ECC Root CA - G3—were included in AWS trust bundles. This exposure allows soft-fail TLS clients to be vulnerable to man-in-the-middle attacks. AWS is actively removing these affected roots from their trust bundles. Customers using CloudFront custom origins or Application Load Balancer OIDC/JWT authentication should verify if their certificates chain to any of the affected roots and reissue certificates from a different CA before enforcement occurs.

CVE-2026-84942 is a stored cross-site scripting (XSS) vulnerability in OpenSearch Dashboards involving a bypass of the Vega expression function. The vulnerability allows malicious input to be stored and later executed in users' browsers. No affected versions or patch information are provided. There is no evidence of exploitation in the wild.

CVE-2026-85788 is identified as a vulnerability related to the awslabs mysql-mcp-server. No detailed technical information, affected versions, or patch status is provided in the available data.

NanaZip version 6.5 is affected by a denial-of-service (DoS) vulnerability. The issue allows an attacker to disrupt normal operation of the software, potentially causing it to crash or become unresponsive. No specific technical details or exploitation methods are provided.

A buffer overflow vulnerability exists in PCMan version 2.0.7. This vulnerability affects Windows XP Professional Service Pack 2 and Service Pack 3 environments. Exploit code is known but there is no indication of active exploitation in the wild. The severity is assessed as medium based on available information.

Langflow version 1.8.4 contains a critical vulnerability that allows path traversal leading to remote code execution (RCE). This flaw enables an attacker to execute arbitrary code on the affected system by exploiting improper handling of file paths.

An unauthenticated OS command injection vulnerability affects Linksys E1200 firmware versions 2.0.02 and 2.0.04 when directly connected to the LAN. This vulnerability allows an attacker to execute arbitrary operating system commands without authentication.

EasyAppointments version 1.5.1 is affected by a blind SQL injection vulnerability. This flaw allows an attacker to execute unauthorized SQL queries on the backend database without direct feedback, potentially leading to data exposure or manipulation. The vulnerability specifically impacts versions up to and including 1.5.1.

miniOrange version 5.4.3 contains an unauthenticated authentication bypass vulnerability. This flaw allows attackers to bypass authentication mechanisms without valid credentials, potentially gaining unauthorized access. The issue affects versions up to and including 5.4.3. No patch or remediation details are provided in the available data. The severity is assessed as critical due to the nature of authentication bypass.

A remote code execution (RCE) vulnerability has been identified in Grav CMS version 2.0.7. This vulnerability allows an attacker to execute arbitrary code on the affected system. No specific technical details or patch information are provided.

Payload CMS versions prior to 3.73.0 contain a blind SQL injection vulnerability in the processing of 'where' filters on JSON or RichText fields using the Drizzle database adapters. This vulnerability allows attacker-controlled JSON filter input to manipulate generated JSONPath expressions, potentially exposing sensitive data. Exploit code is publicly available demonstrating this issue on Payload CMS 3.72.0 with PostgreSQL 15.

Wolf CMS version 0.8.3.1 is affected by a remote code execution (RCE) vulnerability. This allows an attacker to execute arbitrary code on the affected system remotely. The vulnerability is critical in severity and affects versions up to and including 0.8.3.1.

Marimo version 0.20.4 is associated with a remote code execution (RCE) vulnerability identified as CVE-2026-39987. The available information is limited, with no detailed technical data or patch information provided.

Langflow versions prior to 1.10.0 contain a remote code execution (RCE) vulnerability identified as CVE-2026-9198. An exploit exists that leverages an API endpoint to obtain a superuser token and then executes arbitrary code on the target system. The exploit has been tested on Ubuntu 22.04.

Ghost_CMS versions from 0.7.2 up to and including 6.19.0 are affected by a remote code execution vulnerability identified as CVE-2026-29053. This vulnerability allows an attacker to execute arbitrary code remotely on affected systems. The issue is classified as critical severity. No patch or remediation information is provided in the available data. Exploit code is publicly known and categorized as an exploit. The affected platforms include Ubuntu 18.0.4 and Windows 10.

PodcastGenerator version 3.2.9 contains a stored Cross-Site Scripting (XSS) vulnerability in its Live Items functionality. An authenticated administrator can inject malicious JavaScript code into the TITLE, SHORT DESCRIPTION, or LONG DESCRIPTION fields of a Live Item. This payload is stored and executed when the Live Item is viewed both in the administrative interface and on the public Live Stream page. While administrative privileges are required to inject the payload, any unauthenticated user visiting the public Live Stream page can trigger the stored script execution.

A denial of service (DoS) vulnerability has been identified in EVerest version 2025.9.0. This issue could potentially allow an attacker to disrupt the availability of the affected software. No detailed technical information or exploit code is provided.