FXBIA/cve-intelligence-stream huggingface dataset:
CVE ID: CVE-2025-7347 Severity: HIGH (CVSS 8.8) CWE: CWE-639 KEV (actively exploited): NO Description: Authorization Bypass Through User-Controlled Key vulnerability in Dinibh Puzzle Software Solutions Dinibh Patrol Tracking System allows Exploitation of Trusted Identifiers. This issue affects Dinibh Patrol Tracking System: through 10022026. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVE ID: CVE-2025-7047 Severity: MEDIUM (CVSS 5.4) CWE: CWE-862 Affected: cpe:2.3:a:utarit:soliclub:*:*:*:*:*:android:*:* KEV (actively exploited): NO Description: Missing Authorization vulnerability in Utarit Informatics Services Inc. SoliClub allows Privilege Abuse. This issue affects SoliClub: before 5.3.7.
CVE ID: CVE-2025-7016 Severity: CRITICAL (CVSS 9.8) CWE: CWE-284 Affected: cpe:2.3:a:akinsoft:qr_menu:*:*:*:*:*:*:*:* KEV (actively exploited): NO Description: Improper Access Control vulnerability in Akın Software Computer Import Export Industry and Trade Ltd. QR Menu allows Authentication Abuse. This issue affects QR Menu: before s1.05.12.
CVE ID: CVE-2025-7015 Severity: CRITICAL (CVSS 9.8) CWE: CWE-384 Affected: cpe:2.3:a:akinsoft:qr_menu:*:*:*:*:*:*:*:* KEV (actively exploited): NO Description: Session Fixation vulnerability in Akın Software Computer Import Export Industry and Trade Ltd. QR Menu allows Session Fixation. This issue affects QR Menu: before s1.05.12.
CVE ID: CVE-2025-7014 Severity: HIGH (CVSS 8.8) CWE: CWE-384 Affected: cpe:2.3:a:qrmenumpro:menu_panel:29012026:*:*:*:*:*:*:* KEV (actively exploited): NO Description: Session Fixation vulnerability in QR Menu Pro Smart Menu Systems Menu Panel allows Session Hijacking. This issue affects Menu Panel: through 29012026. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVE ID: CVE-2025-7013 Severity: CRITICAL (CVSS 9.8) CWE: CWE-639 Affected: cpe:2.3:a:qrmenumpro:menu_panel:*:*:*:*:*:*:*:* KEV (actively exploited): NO Description: Authorization Bypass Through User-Controlled Key vulnerability in QR Menu Pro Smart Menu Systems Menu Panel allows Exploitation of Trusted Identifiers. This issue affects Menu Panel: through 29012026. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVE ID: CVE-2025-6967 Severity: HIGH (CVSS 8.7) CWE: CWE-698 KEV (actively exploited): NO Description: Execution After Redirect (EAR) vulnerability in Sarman Soft Software and Technology Services Industry and Trade Ltd. Co. CMS allows JSON Hijacking (aka JavaScript Hijacking), Authentication Bypass. This issue affects CMS: through 10022026. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVE ID: CVE-2025-6924 Severity: MEDIUM (CVSS 5.4) CWE: CWE-79 KEV (actively exploited): NO Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Talent Software e-BAP Automation allows Reflected XSS. This issue affects e-BAP Automation: before 42957.
CVE ID: CVE-2025-6923 Severity: MEDIUM (CVSS 5.4) CWE: CWE-79 KEV (actively exploited): NO Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Talent Software UNIS allows Reflected XSS. This issue affects UNIS: before 42957.
CVE ID: CVE-2025-6919 Severity: CRITICAL (CVSS 9.8) CWE: CWE-89 KEV (actively exploited): NO Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Cats Information Technology Software Development Technologies Aykome License Tracking System allows SQL Injection. This issue affects Aykome License Tracking System: before Version dated 06.10.2025.
CVE ID: CVE-2025-6918 Severity: CRITICAL (CVSS 9.8) CWE: CWE-89 KEV (actively exploited): NO Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Ncvav Virtual PBX Software allows SQL Injection. This issue affects Virtual PBX Software: before 09.07.2025.
CVE ID: CVE-2025-6830 Severity: CRITICAL (CVSS 9.8) CWE: CWE-89 KEV (actively exploited): NO Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Xpoda Türkiye Information Technology Inc. Password Module allows SQL Injection. This issue affects Password Module: through 11022026.
CVE ID: CVE-2025-6575 Severity: MEDIUM (CVSS 6.1) CWE: CWE-79 Affected: cpe:2.3:a:dolusoft:omaspot:*:*:*:*:*:*:*:* KEV (actively exploited): NO Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Dolusoft Omaspot allows Reflected XSS. This issue affects Omaspot: before 12.09.2025.
CVE ID: CVE-2025-6520 Severity: CRITICAL (CVSS 9.8) CWE: CWE-89 KEV (actively exploited): NO Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Abis Technology BAPSIS allows Blind SQL Injection. This issue affects BAPSIS: before 202510271606.
CVE ID: CVE-2025-6397 Severity: HIGH (CVSS 8.6) CWE: CWE-79 KEV (actively exploited): NO Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Ankara Hosting Website Design Website Software allows Reflected XSS. This issue affects Website Software: through 03022026. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVE ID: CVE-2025-6396 Severity: MEDIUM (CVSS 6.1) CWE: CWE-79 KEV (actively exploited): NO Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Webbeyaz Website Design Website Software allows Cross-Site Scripting (XSS). This issue affects Website Software: through 2025.07.14.
CVE ID: CVE-2025-6175 Severity: HIGH (CVSS 7.2) CWE: CWE-93 KEV (actively exploited): NO Description: Improper Neutralization of CRLF Sequences ('CRLF Injection') vulnerability in DECE Software Geodi allows HTTP Request Splitting. This issue affects Geodi: before GEODI Setup 9.0.146.
CVE ID: CVE-2025-6060 Severity: MEDIUM (CVSS 5.4) CWE: CWE-79 KEV (actively exploited): NO Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in DECE Software Geodi allows Cross-Site Scripting (XSS). This issue affects Geodi: before GEODI Setup 9.0.146.
CVE ID: CVE-2025-5997 Severity: HIGH (CVSS 8.8) CWE: CWE-648 KEV (actively exploited): NO Description: Incorrect Use of Privileged APIs vulnerability in Beamsec PhishPro allows Privilege Abuse. This issue affects PhishPro: before 7.5.4.2.
CVE ID: CVE-2025-5681 Severity: MEDIUM (CVSS 6.5) CWE: CWE-639 KEV (actively exploited): NO Description: Authorization Bypass Through User-Controlled Key vulnerability in Turtek Software Eyotek allows Exploitation of Trusted Identifiers. This issue affects Eyotek: before 23.06.2025.
CVE ID: CVE-2025-5519 Severity: MEDIUM (CVSS 6.5) CWE: CWE-201 KEV (actively exploited): NO Description: Insertion of Sensitive Information Into Sent Data vulnerability in ArgusTech BILGER allows Choosing Message Identifier. This issue affects BILGER: before 2.4.6.
CVE ID: CVE-2025-5518 Severity: MEDIUM (CVSS 6.5) CWE: CWE-639 KEV (actively exploited): NO Description: Authorization Bypass Through User-Controlled Key vulnerability with user privileges in ArgusTech BILGER allows Exploitation of Trusted Identifiers. This issue affects BILGER: before 2.4.6.
CVE ID: CVE-2025-5329 Severity: CRITICAL (CVSS 9.8) CWE: CWE-89 KEV (actively exploited): NO Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Martcode Software Inc. Delta Course Automation allows SQL Injection. This issue affects Delta Course Automation: through 04022026. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVE ID: CVE-2025-5319 Severity: CRITICAL (CVSS 9.8) CWE: CWE-89 KEV (actively exploited): NO Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Emit Informatics and Communication Technologies Industry and Trade Ltd. Co. DIGITA Efficiency Management System allows SQL Injection. This issue affects DIGITA Efficiency Management System: through 03022026. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVE ID: CVE-2025-5261 Severity: HIGH (CVSS 7.5) CWE: CWE-639 KEV (actively exploited): NO Description: Authorization Bypass Through User-Controlled Key vulnerability in Pik Online Yazılım Çözümleri A.Ş. Pik Online allows Exploitation of Trusted Identifiers. This issue affects Pik Online: before 3.1.5.
CVE ID: CVE-2025-5260 Severity: HIGH (CVSS 8.6) CWE: CWE-918 KEV (actively exploited): NO Description: Server-Side Request Forgery (SSRF) vulnerability in Pik Online Yazılım Çözümleri A.Ş. Pik Online allows Server Side Request Forgery. This issue affects Pik Online: before 3.1.5.
CVE ID: CVE-2025-5254 Severity: MEDIUM (CVSS 6.1) CWE: CWE-79 KEV (actively exploited): NO Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Kron Technologies Kron PAM allows Stored XSS. This issue affects Kron PAM: before 3.7.
CVE ID: CVE-2025-5253 Severity: MEDIUM (CVSS 6.5) CWE: CWE-770 KEV (actively exploited): NO Description: Allocation of Resources Without Limits or Throttling vulnerability in Kron Technologies Kron PAM allows HTTP DoS. This issue affects Kron PAM: before 3.7.
CVE ID: CVE-2025-5243 Severity: CRITICAL (CVSS 10.0) CWE: CWE-434, CWE-78 KEV (actively exploited): NO Description: Unrestricted Upload of File with Dangerous Type, Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in SMG Software Information Portal allows Code Injection, Upload a Web Shell to a Web Server, Code Inclusion. This issue affects Information Portal: before 13.06.2025.
CVE ID: CVE-2026-8035 Severity: MEDIUM (CVSS 6.9) CWE: CWE-476 Affected: cpe:2.3:a:ni:ni-pal:*:*:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*, cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*, cpe:2.3:o:ni:linux_real-time:-:*:*:*:*:*:*:* KEV (actively exploited): NO Description: Improper input validation in the NI-PAL kernel driver may allow a local authenticated user to cause a denial of service by triggering a crash due to a NULL pointer dereference. This vulnerability affects NI-PAL 26.3.0 and prior versions on Windows and Linux.
CVE ID: CVE-2026-8036 Severity: HIGH (CVSS 8.4) CWE: CWE-1285 Affected: cpe:2.3:a:ni:ni-pal:*:*:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*, cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*, cpe:2.3:o:ni:linux_real-time:-:*:*:*:*:*:*:* KEV (actively exploited): NO Description: Improper input validation in NI-PAL may allow a local authenticated user to access arbitrary system memory, potentially leading to privilege escalation. This vulnerability affects NI-PAL 26.3.0 and prior versions on Windows and Linux.
CVE ID: CVE-2026-41234 Severity: HIGH (CVSS 7.6) CWE: CWE-74 KEV (actively exploited): NO Description: Froxlor is open source server administration software. Prior to version 2.3.7, the `DomainZones.add` API endpoint does not sanitize newline characters in TXT record content. An authenticated customer with DNS editing enabled can inject newlines into TXT record values, which break out of the record line in the generated BIND zone file. This enables injection of arbitrary BIND directives (`$INCLUDE`, `$GENERATE`) and arbitrary DNS records (A, MX, CNAME) into the zone file written to disk by the DNS rebuild cron. This is an incomplete fix for CVE-2026-30932 (GHSA-x6w6-2xwp-3jh6), which patched the same newline injection for LOC, RP, SSHFP, and TLSA record types but did not patch TXT records. Version 2.3.7 contains an updated patch.
CVE ID: CVE-2026-41235 Severity: HIGH (CVSS 8.6) CWE: CWE-863 KEV (actively exploited): NO Description: Froxlor is open source server administration software. Version 2.3.6 lets administrators configure `system.available_shells` as the approved shell list that customers may assign to FTP users. However, the server-side FTP account handlers do not enforce that whitelist when processing add or edit requests. As a result, an authenticated customer with shell delegation enabled can submit an arbitrary shell such as `/bin/bash` even when the panel UI only offers more restricted choices. In deployments that use the default `nssextrausers` integration, the attacker-controlled shell is then propagated into the system account database, leading to real host shell access. Version 2.3.7 fixes the issue.
CVE ID: CVE-2026-41236 Severity: HIGH (CVSS 8.8) CWE: CWE-59 KEV (actively exploited): NO Description: Froxlor is open source server administration software. Version 2.3.6 contains a symlink-following flaw in the root-owned SSH key synchronization path used for customer FTP users. The provisioning code appends public keys to `~/.ssh/authorized_keys` under a customer-controlled home directory without verifying that the target path is not a symbolic link. If an attacker controls a shell-enabled customer account and can modify files inside the assigned home directory, the attacker can replace `~/.ssh/authorized_keys` with a symlink to `/root/.ssh/authorized_keys`. When Froxlor's privileged cron task later synchronizes SSH keys, it appends the attacker-supplied key into root's authorized key file, resulting in root SSH access. Version 2.3.7 contains a patch.
CVE ID: CVE-2026-20245 Severity: HIGH (CVSS 7.8) CWE: CWE-116 KEV (actively exploited): NO Description: A vulnerability in the CLI of Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, could allow an authenticated, local attacker to execute arbitrary commands as root by supplying a crafted file to the affected system. This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by uploading a crafted file to the affected system. A successful exploit could allow the attacker to perform command injection attacks on an affected system and elevate their privileges as the root user. To exploit this vulnerability, the attacker must have netadmin privileges on the affected system. This would require valid credentials or exploitation of or . Cisco is not aware of successful exploitation by other methods. Cisco has observed limited cases where the exploitation of this bug resulted in a configuration change pushed to edge devices. Cisco recommends that customers upgrade to the fixed software that is documented in the that was published on May 14, 2026, and verify the configuration of the edge devices.
CVE ID: CVE-2026-11005 Severity: UNKNOWN CWE: CWE-125 KEV (actively exploited): NO Description: Out of bounds read in ANGLE in Google Chrome on Windows prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Medium)
CVE ID: CVE-2026-11007 Severity: UNKNOWN CWE: CWE-20 KEV (actively exploited): NO Description: Insufficient validation of untrusted input in WebView in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
CVE ID: CVE-2026-11008 Severity: UNKNOWN CWE: CWE-20 KEV (actively exploited): NO Description: Insufficient validation of untrusted input in WebAppInstalls in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
CVE ID: CVE-2026-11011 Severity: UNKNOWN KEV (actively exploited): NO Description: Insufficient policy enforcement in Password Manager in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. (Chromium security severity: Medium)
CVE ID: CVE-2026-11013 Severity: UNKNOWN CWE: CWE-20 KEV (actively exploited): NO Description: Insufficient validation of untrusted input in Network in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Medium)
CVE ID: CVE-2026-11014 Severity: UNKNOWN KEV (actively exploited): NO Description: Insufficient policy enforcement in Extensions in Google Chrome prior to 149.0.7827.53 allowed an attacker who convinced a user to install a malicious extension to bypass site isolation via a crafted Chrome Extension. (Chromium security severity: Medium)
CVE ID: CVE-2026-11015 Severity: UNKNOWN CWE: CWE-125 KEV (actively exploited): NO Description: Out of bounds read in WebGPU in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. (Chromium security severity: Medium)
CVE ID: CVE-2026-11016 Severity: UNKNOWN CWE: CWE-20 KEV (actively exploited): NO Description: Insufficient validation of untrusted input in Network in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to bypass same origin policy via a crafted HTML page. (Chromium security severity: Medium)
CVE ID: CVE-2026-11017 Severity: UNKNOWN KEV (actively exploited): NO Description: Inappropriate implementation in Link Preview in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to bypass navigation restrictions via a crafted HTML page. (Chromium security severity: Medium)
CVE ID: CVE-2026-11018 Severity: UNKNOWN KEV (actively exploited): NO Description: Insufficient policy enforcement in Actor in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. (Chromium security severity: Medium)
CVE ID: CVE-2026-11019 Severity: UNKNOWN KEV (actively exploited): NO Description: Inappropriate implementation in Payments in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to perform domain spoofing via a crafted HTML page. (Chromium security severity: Medium)
CVE ID: CVE-2026-11020 Severity: UNKNOWN KEV (actively exploited): NO Description: Inappropriate implementation in Extensions in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted XML file. (Chromium security severity: Medium)
CVE ID: CVE-2026-11021 Severity: UNKNOWN CWE: CWE-20 KEV (actively exploited): NO Description: Insufficient validation of untrusted input in GPU in Google Chrome on Windows prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)
CVE ID: CVE-2026-11022 Severity: UNKNOWN CWE: CWE-20 KEV (actively exploited): NO Description: Insufficient validation of untrusted input in DevTools in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to bypass same origin policy via a crafted HTML page. (Chromium security severity: Medium)
CVE ID: CVE-2026-11023 Severity: UNKNOWN CWE: CWE-20 KEV (actively exploited): NO Description: Inappropriate implementation in WebAppInstalls in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to bypass same origin policy via a crafted HTML page. (Chromium security severity: Medium)
CVE ID: CVE-2026-11024 Severity: UNKNOWN CWE: CWE-121 KEV (actively exploited): NO Description: Stack buffer overflow in Skia in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to potentially exploit stack corruption via a crafted HTML page. (Chromium security severity: Medium)
CVE ID: CVE-2026-11025 Severity: UNKNOWN KEV (actively exploited): NO Description: Insufficient policy enforcement in Navigation in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker to bypass content security policy via a crafted HTML page. (Chromium security severity: Medium)
CVE ID: CVE-2026-11029 Severity: UNKNOWN CWE: CWE-20 KEV (actively exploited): NO Description: Insufficient validation of untrusted input in Drag and Drop in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)
CVE ID: CVE-2026-11121 Severity: UNKNOWN CWE: CWE-20 KEV (actively exploited): NO Description: Insufficient validation of untrusted input in Skia in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
CVE ID: CVE-2026-11122 Severity: UNKNOWN KEV (actively exploited): NO Description: Inappropriate implementation in Keyboard in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via a crafted HTML page. (Chromium security severity: Medium)
CVE ID: CVE-2026-11123 Severity: UNKNOWN CWE: CWE-457 KEV (actively exploited): NO Description: Uninitialized Use in ANGLE in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Medium)
CVE ID: CVE-2026-11124 Severity: UNKNOWN CWE: CWE-122 KEV (actively exploited): NO Description: Integer overflow in Skia in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)
CVE ID: CVE-2026-11126 Severity: UNKNOWN CWE: CWE-20 KEV (actively exploited): NO Description: Inappropriate implementation in DevTools in Google Chrome prior to 149.0.7827.53 allowed an attacker who convinced a user to install a malicious extension to leak cross-origin data via a crafted Chrome Extension. (Chromium security severity: Medium)
CVE ID: CVE-2026-11127 Severity: UNKNOWN KEV (actively exploited): NO Description: Inappropriate implementation in WebAPKs in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker to perform domain spoofing via a crafted WebAPK. (Chromium security severity: Medium)
CVE ID: CVE-2026-11128 Severity: UNKNOWN CWE: CWE-20 KEV (actively exploited): NO Description: Inappropriate implementation in Web Share in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who convinced a user to engage in specific UI gestures to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
CVE ID: CVE-2026-11228 Severity: MEDIUM (CVSS 4.3) CWE: CWE-451 KEV (actively exploited): NO Description: Inappropriate implementation in File Input in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)
CVE ID: CVE-2026-11232 Severity: MEDIUM (CVSS 5.4) CWE: CWE-451 KEV (actively exploited): NO Description: Inappropriate implementation in TabGroups in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to perform UI spoofing via malicious network traffic. (Chromium security severity: Low)
CVE ID: CVE-2026-11233 Severity: MEDIUM (CVSS 4.7) CWE: CWE-20 KEV (actively exploited): NO Description: Insufficient policy enforcement in FoldableAPIs in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to bypass same origin policy via a crafted HTML page. (Chromium security severity: Low)
CVE ID: CVE-2026-11234 Severity: MEDIUM (CVSS 4.3) CWE: CWE-693 KEV (actively exploited): NO Description: Inappropriate implementation in FoldableAPIs in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. (Chromium security severity: Low)
CVE ID: CVE-2026-11236 Severity: HIGH (CVSS 8.3) CWE: CWE-602 KEV (actively exploited): NO Description: Insufficient policy enforcement in Web Bluetooth in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Low)
CVE ID: CVE-2026-11237 Severity: HIGH (CVSS 8.3) CWE: CWE-20 KEV (actively exploited): NO Description: Insufficient validation of untrusted input in Media in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)
CVE ID: CVE-2026-11309 Severity: MEDIUM (CVSS 4.3) CWE: CWE-346 KEV (actively exploited): NO Description: Insufficient policy enforcement in History in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)
CVE ID: CVE-2023-5502 Severity: HIGH (CVSS 8.2) CWE: CWE-287 KEV (actively exploited): NO Description: On affected platforms running Arista EOS with 802.1x authentication configured on the access/trunk ports, and routing enabled on the access VLAN of the ports, a malicious supplicant may be able to bypass the requirement to perform 802.1x authentication.
CVE ID: CVE-2024-27890 Severity: HIGH (CVSS 7.2) CWE: CWE-306 KEV (actively exploited): NO Description: Affected platforms running Arista EOS with OpenConfig configured, a gNMI Set request can be run when it should have been rejected. This can result in unexpected configuration being applied to the switch.
CVE ID: CVE-2024-27891 Severity: MEDIUM (CVSS 6.9) CWE: CWE-284 KEV (actively exploited): NO Description: On affected platforms running Arista EOS with MACsec and egress ACLs configured on the same interfaces, the ACL policies may not be enforced for packets egressing on those ports. This can cause outgoing packets to incorrectly be allowed or denied.
CVE ID: CVE-2024-27892 Severity: HIGH (CVSS 7.2) CWE: CWE-306 KEV (actively exploited): NO Description: Affected platforms running Arista EOS with OpenConfig configured, a gNMI Set request can be run when it should have been rejected. This can result in unexpected configuration being applied to the switch.
CVE ID: CVE-2025-8873 Severity: HIGH (CVSS 8.7) CWE: CWE-1286 KEV (actively exploited): NO Description: On affected platforms running Arista EOS with IPsec configured, a specially crafted packet can cause the dataplane to stop processing all IPsec traffic. The control plane may detect this condition, and attempt to reset the IPsec processing pipeline. After reset traffic may not resume being processed. There is no impact to non-IPsec traffic or to IPsec traffic not originating or terminating on the system. This issue was reported by an Arista customer.
CVE ID: CVE-2026-10940 Severity: HIGH (CVSS 8.3) CWE: CWE-362 KEV (actively exploited): NO Description: Race in Codecs in Google Chrome on Windows prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
CVE ID: CVE-2026-10941 Severity: HIGH (CVSS 8.8) CWE: CWE-125, CWE-787 KEV (actively exploited): NO Description: Out of bounds memory access in Skia in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
CVE ID: CVE-2026-10942 Severity: HIGH (CVSS 7.8) CWE: CWE-20 KEV (actively exploited): NO Description: Inappropriate implementation in UI in Google Chrome on Windows prior to 149.0.7827.53 allowed a local attacker to perform privilege escalation via a malicious file. (Chromium security severity: High)
CVE ID: CVE-2026-10943 Severity: HIGH (CVSS 8.8) CWE: CWE-416 KEV (actively exploited): NO Description: Use after free in WebRTC in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
CVE ID: CVE-2026-10945 Severity: HIGH (CVSS 8.8) CWE: CWE-416 KEV (actively exploited): NO Description: Use after free in PDF in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who convinced a user to engage in specific UI gestures to execute arbitrary code inside a sandbox via a crafted PDF file. (Chromium security severity: High)
CVE ID: CVE-2026-10946 Severity: HIGH (CVSS 7.5) CWE: CWE-122 KEV (actively exploited): NO Description: Heap buffer overflow in Media in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who convinced a user to engage in specific UI gestures to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
CVE ID: CVE-2026-10947 Severity: HIGH (CVSS 8.8) CWE: CWE-416 KEV (actively exploited): NO Description: Use after free in WebRTC in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
CVE ID: CVE-2026-10948 Severity: HIGH (CVSS 8.8) CWE: CWE-416 KEV (actively exploited): NO Description: Use after free in WebRTC in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
CVE ID: CVE-2026-10949 Severity: HIGH (CVSS 8.3) CWE: CWE-122 KEV (actively exploited): NO Description: Heap buffer overflow in Video in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
CVE ID: CVE-2026-10952 Severity: HIGH (CVSS 8.8) CWE: CWE-416 KEV (actively exploited): NO Description: Use after free in Chrome for iOS in Google Chrome on iOS prior to 149.0.7827.53 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
CVE ID: CVE-2026-10953 Severity: HIGH (CVSS 8.3) CWE: CWE-416 KEV (actively exploited): NO Description: Use after free in Core in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
CVE ID: CVE-2026-10954 Severity: HIGH (CVSS 8.8) CWE: CWE-416 KEV (actively exploited): NO Description: Use after free in Actor in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
CVE ID: CVE-2026-10956 Severity: HIGH (CVSS 8.8) CWE: CWE-416 KEV (actively exploited): NO Description: Use after free in MimeHandlerView in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
CVE ID: CVE-2026-11230 Severity: HIGH (CVSS 8.8) CWE: CWE-416 KEV (actively exploited): NO Description: Use after free in Extensions in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Low)
CVE ID: CVE-2026-11235 Severity: HIGH (CVSS 8.8) CWE: CWE-20 KEV (actively exploited): NO Description: Insufficient policy enforcement in Compositing in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Low)
CVE ID: CVE-2026-11279 Severity: HIGH (CVSS 8.8) CWE: CWE-125 KEV (actively exploited): NO Description: Out of bounds read in DevTools in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Low)
CVE ID: CVE-2026-11296 Severity: HIGH (CVSS 7.5) CWE: CWE-269 KEV (actively exploited): NO Description: Inappropriate implementation in ImageCapture in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to perform privilege escalation via a crafted HTML page. (Chromium security severity: Low)
CVE ID: CVE-2026-11303 Severity: HIGH (CVSS 8.8) CWE: CWE-416 KEV (actively exploited): NO Description: Use after free in PDFium in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted PDF file. (Chromium security severity: Low)
CVE ID: CVE-2026-11305 Severity: HIGH (CVSS 8.8) CWE: CWE-416 KEV (actively exploited): NO Description: Use after free in PDFium in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted PDF file. (Chromium security severity: Low)
CVE ID: CVE-2026-11306 Severity: HIGH (CVSS 8.8) CWE: CWE-416 KEV (actively exploited): NO Description: Use after free in PDFium in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted PDF file. (Chromium security severity: Low)
CVE ID: CVE-2026-11307 Severity: HIGH (CVSS 8.8) CWE: CWE-416 KEV (actively exploited): NO Description: Use after free in PDFium in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted PDF file. (Chromium security severity: Low)
CVE ID: CVE-2026-42824 Severity: MEDIUM (CVSS 6.5) CWE: CWE-77 KEV (actively exploited): NO Description: Improper neutralization of special elements used in a command ('command injection') in M365 Copilot allows an unauthorized attacker to disclose information over a network.
CVE ID: CVE-2026-45497 Severity: HIGH (CVSS 7.7) CWE: CWE-77 KEV (actively exploited): NO Description: Improper neutralization of special elements used in a command ('command injection') in Microsoft Copilot allows an authorized attacker to execute code over a network.
CVE ID: CVE-2026-47644 Severity: MEDIUM (CVSS 6.5) CWE: CWE-74 KEV (actively exploited): NO Description: Improper neutralization of special elements in output used by a downstream component ('injection') in Copilot Chat (Microsoft Edge) allows an unauthorized attacker to disclose information over a network.
CVE ID: CVE-2026-47655 Severity: MEDIUM (CVSS 6.5) CWE: CWE-200 KEV (actively exploited): NO Description: Exposure of sensitive information to an unauthorized actor in Microsoft Graph allows an authorized attacker to disclose information over a network.
CVE ID: CVE-2026-10732 Severity: MEDIUM (CVSS 5.6) CWE: CWE-29 KEV (actively exploited): NO Description: All versions of the package decompress are vulnerable to Arbitrary File Write via Archive Extraction (Zip Slip) when extracting a ZIP archive containing two entries with the same path - the first being a symlink to an arbitrary target and the second being a regular file - the file content is written through the symlink to the target location outside the output directory. This is due to the microtask processing order that checks readlink for the second file before resolving symlink for the first file. An attacker can write arbitrary file on the host filesystem potentially leading to remote code execution by providing a specially crafted ZIP archive. Note: This bypasses all existing path traversal protections including preventWritingThroughSymlink, added as a part of the fix for [CVE-2020-12265](https://security.snyk.io/vuln/SNYK-JS-DECOMPRESS-557358).
CVE ID: CVE-2026-21032 Severity: MEDIUM (CVSS 6.9) KEV (actively exploited): NO Description: Improper export of android application components in SmartHomeWidgetReceiver of Samsung Assistant prior to version 9.3.14 allows local attacker to execute arbitrary script.
CVE ID: CVE-2026-21033 Severity: MEDIUM (CVSS 6.9) KEV (actively exploited): NO Description: Improper export of android application components in ExpressHomeWidgetReceiver of Samsung Assistant prior to version 9.3.14 allows local attacker to execute arbitrary script.
CVE ID: CVE-2026-21034 Severity: MEDIUM (CVSS 4.8) KEV (actively exploited): NO Description: Improper export of android application components in Samsung Auto prior to version 3.1.2.61 in Android 15 and 3.2.0.38 in Android 16 allows local attacker to change audio configuration.
CVE ID: CVE-2026-21035 Severity: MEDIUM (CVSS 6.5) KEV (actively exploited): NO Description: Improper input validation in Samsung Plus TV prior to version 1.0.28.6 allows remote attackers to access sensitive information.
CVE ID: CVE-2026-21036 Severity: MEDIUM (CVSS 6.3) KEV (actively exploited): NO Description: Improper authorization in Samsung Internet prior to version 30.0.0.39 allows local attackers to access sensitive information.
CVE ID: CVE-2026-21037 Severity: MEDIUM (CVSS 6.9) KEV (actively exploited): NO Description: Improper input validation in Samsung Members prior to version 5.8.01.5 allows local attackers to access arbitrary URL and launch arbitrary activity with Samsung Members privilege.
CVE ID: CVE-2026-21038 Severity: MEDIUM (CVSS 5.9) KEV (actively exploited): NO Description: Improper input validation in Samsung Android USB Driver for Windows prior to version 1.9.5.0 allows local attacker to access out-of-bounds memory.
CVE ID: CVE-2026-8914 Severity: HIGH (CVSS 8.4) CWE: CWE-95 KEV (actively exploited): NO Description: In Teltonika Networks RUTOS devices, running versions 7.22 through 7.23.2 and TSWOS devices running versions 1.09 through 1.09.1, due to unsafe calls to an eval function in rpc-profile, a vulnerability exists where a lower privileged user could perform command injection as the root user.
CVE ID: CVE-2026-50591 Severity: MEDIUM (CVSS 5.4) CWE: CWE-79 KEV (actively exploited): NO Description: In Znuny LTS before 6.5.21 and Znuny before 7.3.3, XSS can occur via stored user preferences.
CVE ID: CVE-2026-50592 Severity: MEDIUM (CVSS 6.4) CWE: CWE-79 KEV (actively exploited): NO Description: In Znuny LTS before 6.5.21 and Znuny before 7.3.3, there is reflected XSS in AdminCommunicationLog (aka the communication log administration view).
CVE ID: CVE-2026-11330 Severity: LOW (CVSS 2.0) CWE: CWE-327, CWE-328 KEV (actively exploited): NO Description: A weakness has been identified in thedotmack claude-mem up to 11.0.1. The affected element is the function computeObservationContentHash of the file src/services/sqlite/observations/store.ts of the component Observation Content Hash Handler. This manipulation causes use of weak hash. The attack can only be executed locally. The attack's complexity is rated as high. The exploitability is described as difficult. Upgrading to version 12.0.0 is sufficient to fix this issue. Patch name: f32fda8b35e9fe9329f87da65c31149362a03f97. It is suggested to upgrade the affected component.
CVE ID: CVE-2026-50230 Severity: MEDIUM (CVSS 5.1) CWE: CWE-79 KEV (actively exploited): NO Description: Lyrion Music Server 9.2.0 contains an unauthenticated reflected cross-site scripting vulnerability in the server.log endpoint that allows attackers to inject arbitrary HTML and JavaScript code through the search parameter. Attackers can craft malicious URLs with JavaScript payloads in the search parameter to execute code in users' browsers within the context of the affected application.
CVE ID: CVE-2026-50231 Severity: MEDIUM (CVSS 5.1) CWE: CWE-79 KEV (actively exploited): NO Description: Lyrion Music Server 9.2.0 contains an unauthenticated stored cross-site scripting vulnerability in the log viewer that allows attackers to inject malicious scripts by exploiting unescaped template variables. Attackers can inject XSS payloads through search, lines, and path query parameters or by crafting values that get logged such as URLs, User-Agent headers, stream titles, or player names to execute arbitrary scripts in users' browsers.
CVE ID: CVE-2026-50232 Severity: MEDIUM (CVSS 5.1) CWE: CWE-79 KEV (actively exploited): NO Description: Lyrion Music Server 9.2.0 contains a stored cross-site scripting vulnerability that allows attackers to inject malicious scripts through media file metadata tags like GENRE, ARTIST, and ALBUM. Attackers can craft files with XSS payloads in metadata tags that execute in the web interface when users view track information or play files, enabling access to management functions and settings disclosure.
CVE ID: CVE-2026-50233 Severity: MEDIUM (CVSS 6.9) CWE: CWE-548 KEV (actively exploited): NO Description: Lyrion Music Server 9.2.0 contains an arbitrary directory listing vulnerability in its readdirectory query, exposed through both the CLI service (TCP port 9090) and the HTTP JSON-RPC endpoint (/jsonrpc.js). The query accepts a folder parameter and lists its contents with no restriction to the configured media directories and no authentication in the default configuration, allowing a remote, unauthenticated attacker to enumerate arbitrary locations on the host filesystem.
CVE ID: CVE-2026-50234 Severity: HIGH (CVSS 8.7) CWE: CWE-22 KEV (actively exploited): NO Description: Lyrion Music Server 9.2.0 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files by exploiting directory traversal in the web server context. Attackers can manipulate file path parameters to access sensitive files outside the intended directory structure.
CVE ID: CVE-2026-50235 Severity: MEDIUM (CVSS 5.1) CWE: CWE-79 KEV (actively exploited): NO Description: Lyrion Music Server 9.2.0 contains a reflected cross-site scripting vulnerability in advanced search parameters that fail to properly sanitize user input before displaying it in search forms. Attackers can inject malicious scripts through unfiltered search parameters to execute arbitrary JavaScript in users' browsers and steal session information.
CVE ID: CVE-2026-9088 Severity: LOW (CVSS 2.7) CWE: CWE-1220 KEV (actively exploited): NO Description: A flaw was found in org.keycloak.services. An administrator with delegated access to read group memberships and users can bypass user profile permissions by accessing the group members endpoint. This allows the administrator to view user attributes that are explicitly configured to be denied, leading to information disclosure.
CVE ID: CVE-2026-11332 Severity: HIGH (CVSS 7.8) CWE: CWE-88 KEV (actively exploited): NO Description: A flaw was found in ansible-core. The ansible-galaxy role install command processes dependency specifications from a role's meta/requirements.yml file. Due to improper neutralization of argument delimiters, a malicious role author can inject arbitrary git configuration flags through the src field. This allows arbitrary code execution on the machine of a user who installs the role via ansible-galaxy role install.
CVE ID: CVE-2026-50265 Severity: HIGH (CVSS 7.0) CWE: CWE-78 KEV (actively exploited): NO Description: A flaw was found in libinput. A local attacker with access to /dev/uinput can inject arbitrary udev properties through the libinput-device-group helper. This injection can lead to root code execution, for example, by exploiting REMOVE_CMD properties that are executed when a device is removed. This vulnerability allows an attacker to gain elevated privileges on the system.
CVE ID: CVE-2026-26832 Severity: CRITICAL (CVSS 9.8) CWE: CWE-78 Affected: cpe:2.3:a:zapolnoch:tesseract_ocr:*:*:*:*:*:node.js:*:* KEV (actively exploited): NO Description: node-tesseract-ocr is an npm package that provides a Node.js wrapper for Tesseract OCR. In all versions through 2.2.1, the recognize() function in src/index.js is vulnerable to OS Command Injection. The file path parameter is concatenated into a shell command string and passed to child_process.exec() without proper sanitization
CVE ID: CVE-2026-4312 Severity: CRITICAL (CVSS 9.3) CWE: CWE-306 Affected: cpe:2.3:a:dragonsoft:gcb\/fcb_government_financial_cybersecurity_configuration_audit_software:-:*:*:*:*:*:*:* KEV (actively exploited): NO Description: GCB/FCB Audit Software developed by DrangSoft has a Missing Authentication vulnerability, allowing unauthenticated remote attackers to directly access certain APIs to create a new administrative account.
CVE ID: CVE-2026-33551 Severity: MEDIUM (CVSS 5.3) CWE: CWE-863 Affected: cpe:2.3:a:openstack:keystone:*:*:*:*:*:*:*:*, cpe:2.3:a:openstack:keystone:27.0.0:*:*:*:*:*:*:*, cpe:2.3:a:openstack:keystone:28.0.0:*:*:*:*:*:*:*, cpe:2.3:a:openstack:keystone:29.0.0:*:*:*:*:*:*:* KEV (actively exploited): NO Description: An issue was discovered in OpenStack Keystone 14 through 26 before 26.1.1, 27.0.0, 28.0.0, and 29.0.0. Restricted application credentials can create EC2 credentials. By using a restricted application credential to call the EC2 credential creation API, an authenticated user with only a reader role may obtain an EC2/S3 credential that carries the full set of the parent user's S3 permissions, effectively bypassing the role restrictions imposed on the application credential. Only deployments that use restricted application credentials in combination with the EC2/S3 compatibility API (swift3 / s3api) are affected.
CVE ID: CVE-2025-7743 Severity: CRITICAL (CVSS 9.6) CWE: CWE-319 Affected: cpe:2.3:a:dolusoft:omaspot:*:*:*:*:*:*:*:* KEV (actively exploited): NO Description: Cleartext Transmission of Sensitive Information vulnerability in Dolusoft Omaspot allows Interception, Privilege Escalation. This issue affects Omaspot: before 12.09.2025.
CVE ID: CVE-2025-7714 Severity: CRITICAL (CVSS 9.8) CWE: CWE-89 Affected: cpe:2.3:a:globalmedya:content_management_system:*:*:*:*:*:*:*:* KEV (actively exploited): NO Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Global Interactive Design Media Software Inc. Content Management System (CMS) allows Command Line Execution through SQL Injection. This issue affects Content Management System (CMS): through 21072025.
CVE ID: CVE-2025-7713 Severity: MEDIUM (CVSS 6.1) CWE: CWE-79 Affected: cpe:2.3:a:globalmedya:content_management_system:*:*:*:*:*:*:*:* KEV (actively exploited): NO Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Global Interactive Design Media Software Inc. Content Management System (CMS) allows XSS Through HTTP Headers. This issue affects Content Management System (CMS): through 21072025.
CVE ID: CVE-2024-58135 Severity: MEDIUM (CVSS 5.3) CWE: CWE-338 Affected: cpe:2.3:a:mojolicious:mojolicious:*:*:*:*:*:perl:*:* KEV (actively exploited): NO Description: Mojolicious versions from 7.28 through 9.45 for Perl will generate weak HMAC session cookie secrets via "mojo generate app" by default. When creating a default app skeleton with the "mojo generate app" tool, a weak secret is written to the application's configuration file using the insecure rand() function, and used for authenticating and protecting the integrity of the application's sessions. This may allow an attacker to brute force the application's session keys. Release 9.46 fixes the issue by providing high quality randomness, even in absence of CryptX. Users should be aware that the update does not replace previously generated weak secrets. A secret generated with the previous version MUST be replaced to ensure the updated version is using a strong secret.
CVE ID: CVE-2025-12686 Severity: CRITICAL (CVSS 9.8) CWE: CWE-120 Affected: cpe:2.3:o:synology:beestation_os:*:*:*:*:*:*:*:* KEV (actively exploited): NO Description: Buffer copy without checking size of input ('Classic Buffer Overflow') vulnerability in AdminCenter in Synology BeeStation OS before 1.3.2-65648 allows remote attackers to execute arbitrary code via unspecified vectors.
CVE ID: CVE-2026-22750 Severity: HIGH (CVSS 7.5) CWE: CWE-15 Affected: cpe:2.3:a:vmware:spring_cloud_gateway:4.2.0:*:*:*:*:*:*:* KEV (actively exploited): NO Description: When configuring SSL bundles in Spring Cloud Gateway by using the configuration property spring.ssl.bundle, the configuration was silently ignored and the default SSL configuration was used instead. Note: The 4.2.x branch is no longer under open source support. If you are using Spring Cloud Gateway 4.2.0 and are not an enterprise customer, you can upgrade to any Spring Cloud Gateway 4.2.x release newer than 4.2.0 available on Maven Centeral https://repo1.maven.org/maven2/org/springframework/cloud/spring-cloud-gateway/ . Ideally if you are not an enterprise customer, you should be upgrading to 5.0.2 or 5.1.1 which are the current supported open source releases.