rainbutterfly/cve_corpus huggingface dataset:
CVE-2026-37982 Keycloak: org.keycloak.authentication: keycloak: unauthorized account takeover via webauthn token replay
A flaw was found in Keycloak. This authentication vulnerability allows a remote attacker to replay `ExecuteActionsActionToken` tokens within Keycloak's WebAuthn (Web Authentication) flow. By intercepting an execute-actions email link, an attacker can register their own authenticator to a victim's account. This leads to unauthorized enrollment of a hardware-backed credential, enabling persistent account takeover.
Affected products: vendor: Red Hat
product: Red Hat build of Keycloak 26.4
cpes: cpe:/a:redhat:build_keycloak:26.4::el9
default_status: affected
vendor: Red Hat
product: Red Hat build of Keycloak 26.4
cpes: cpe:/a:redhat:build_keycloak:26.4::el9
default_status: affected
vendor: Red Hat
product: Red Hat build of Keycloak 26.4
cpes: cpe:/a:redhat:build_keycloak:26.4::el9
default_status: affected
vendor: Red Hat
product: Red Hat build of Keycloak 26.4.12
cpes: cpe:/a:redhat:build_keycloak:26.4::el9
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.8
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N
version: 3.1
Published: 2026-05-19T10:52:32.486Z
CVE-2026-38360 
Directory Traversal vulnerability in fohrloop dash-uploader v.0.1.0 through v.0.7.0a2 allows a remote attacker to execute arbitrary code via the dash_uploader/httprequesthandler.py, aseHttpRequestHandler.get_temp_root(), BaseHttpRequestHandler._post() components
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-05-08T00:00:00.000Z
CVE-2026-38361 
An issue in fohrloop dash-uploader v.0.1.0 through v.0.7.0a2 allows a remote attacker to execute arbitrary code via the dash_uploader/httprequesthandler.py, dash_uploader/upload.py in the Upload function and max_file_size parameter, dash_uploader/configure_upload.py components
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-05-08T00:00:00.000Z
CVE-2026-38422 
Buffer Overflow vulnerability in arendst Tasmota v.15.3.0.3 and before allows a remote attacker to execute arbitrary code via the tasmota/tasmota_xdrv_driver/xdrv_10_scripter.ino, fetch_jpg() function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-05-27T00:00:00.000Z
CVE-2026-38426 
Buffer Overflow vulnerability in arendst Tasmota v.15.3.0.3 and before allows a remote attacker to execute arbitrary code via the xdrv_10_scripter.ino, fetch_jpg(), jpg_task.boundary[40], strcpy() function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-05-27T00:00:00.000Z
CVE-2026-38427 
An issue in fetch_jpg() in xdrv_10_scripter.ino in Tasmota through 15.3.0.3 allows a remote attacker to cause heap buffer overflow. The Content-Length from a JPEG stream is stored in a uint16_t variable; values above 65535 wrap around, causing allocation of a smaller buffer than the data actually read.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-05-27T00:00:00.000Z
CVE-2026-38428 
Kestra v1.3.3 and before is vulnerable to SQL Injection. The vulnerability occurs because user-controlled input from a GET parameter is directly concatenated into an SQL query without proper sanitization or parameterization. As a result, attackers can inject arbitrary SQL expressions into the database query.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-05-05T00:00:00.000Z
CVE-2026-38429 
OpenCMS v20 and before is vulnerable to XML External Entity (XXE) in the Admin Import DB feature due to insecure XML parsing of user supplied .zip files containing a manifest.xml.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-05-05T00:00:00.000Z
CVE-2026-38431 
ERPNext v15.103.1 and before is vulnerable to Server-Side Template Injection (SSTI). An attacker with permission to create or edit email templates can inject template expressions that are executed on the server when the template is rendered.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-05-05T00:00:00.000Z
CVE-2026-38432 
ERPNext v15.103.1 and before is vulnerable to Cross Site Scripting (XSS) in the Email Template engine. An attacker with permission to create or edit email templates can inject malicious JavaScript code that are executed on the victim's browser when the template is applied.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-05-05T00:00:00.000Z
CVE-2026-38526 
An authenticated arbitrary file upload vulnerability in the /admin/tinymce/upload endpoint of Webkul Krayin CRM v2.2.x allows attackers to execute arbitrary code via uploading a crafted PHP file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AC:L/AV:N/A:H/C:H/I:H/PR:L/S:C/UI:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: CHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
baseScore: 9.9
baseSeverity: CRITICAL
Published: 2026-04-14T00:00:00.000Z
CVE-2026-38527 
A Server-Side Request Forgery (SSRF) in the /settings/webhooks/create component of Webkul Krayin CRM v2.2.x allows attackers to scan internal resources via supplying a crafted POST request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AC:L/AV:N/A:N/C:H/I:L/PR:L/S:C/UI:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: CHANGED
confidentialityImpact: HIGH
integrityImpact: LOW
availabilityImpact: NONE
baseScore: 8.5
baseSeverity: HIGH
Published: 2026-04-14T00:00:00.000Z
CVE-2026-38528 
Krayin CRM v2.2.x was discovered to contain a SQL injection vulnerability via the rotten_lead parameter at /Lead/LeadDataGrid.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AC:L/AV:N/A:N/C:H/I:L/PR:L/S:U/UI:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: LOW
availabilityImpact: NONE
baseScore: 7.1
baseSeverity: HIGH
Published: 2026-04-14T00:00:00.000Z
CVE-2026-38529 
A Broken Object-Level Authorization (BOLA) in the /Settings/UserController.php endpoint of Webkul Krayin CRM v2.2.x allows authenticated attackers to arbitrarily reset user passwords and perform a full account takeover via supplying a crafted HTTP request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AC:L/AV:N/A:H/C:H/I:H/PR:L/S:U/UI:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
baseScore: 8.8
baseSeverity: HIGH
Published: 2026-04-14T00:00:00.000Z
CVE-2026-38530 
A Broken Object-Level Authorization (BOLA) in the /Controllers/Lead/LeadController.php endpoint of Webkul Krayin CRM v2.2.x allows authenticated attackers to arbitrarily read, modify, and permanently delete any lead owned by other users via supplying a crafted GET request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AC:L/AV:N/A:N/C:H/I:H/PR:L/S:U/UI:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: NONE
baseScore: 8.1
baseSeverity: HIGH
Published: 2026-04-14T00:00:00.000Z
CVE-2026-38532 
A Broken Object-Level Authorization (BOLA) in the /Contact/Persons/PersonController.php endpoint of Webkul Krayin CRM v2.2.x allows authenticated attackers to arbitrarily read, modify, and permanently delete any contact owned by other users via supplying a crafted GET request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AC:L/AV:N/A:N/C:H/I:H/PR:L/S:U/UI:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: NONE
baseScore: 8.1
baseSeverity: HIGH
Published: 2026-04-14T00:00:00.000Z
CVE-2026-38533 
An improper authorization vulnerability in the /api/v1/users/{id} endpoint of Snipe-IT v8.4.0 allows authenticated attackers with the users.edit permission to modify sensitive authentication and account-state fields of other non-admin users via supplying a crafted PUT request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-04-14T00:00:00.000Z
CVE-2026-38566 
HireFlow v1.2 does not implement CSRF token validation on any state-changing POST endpoint. All forms (password change at /profile, candidate deletion at /candidates/delete/<id>, feedback submission at /feedback/add/<id>, interview scheduling at /interviews/add) are vulnerable to CSRF. An attacker who can trick an authenticated user into visiting a malicious page can silently change the victim's password, delete records, or inject arbitrary data on their behalf. The SESSION_COOKIE_SAMESITE attribute is also not configured, removing the browser-level CSRF defense.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-05-11T00:00:00.000Z
CVE-2026-38567 
HireFlow v1.2 is vulnerable to SQL injection in the /login and /search endpoints. User-supplied input is concatenated directly into SQL queries without parameterization. An unauthenticated attacker can bypass authentication by supplying a crafted username (e.g. admin'--) or extract the full contents of the database including user credentials via UNION-based injection at the /search endpoint.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-05-11T00:00:00.000Z
CVE-2026-38568 
HireFlow v1.2 is vulnerable to Incorrect Access Control. The application does not enforce object-level authorization on the /candidate/<id> and /interview/<id> endpoints. The route handlers retrieve records by the user-supplied ID without verifying that the requesting user is the owner or has an authorized role. Any authenticated user can access any other user's candidate profiles and interview notes by iterating the integer ID in the URL path, constituting a horizontal privilege escalation and full data breach of all records in the system.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-05-11T00:00:00.000Z
CVE-2026-38569 
HireFlow v1.2 is vulnerable to Cross Site Scripting (XSS) in candidate_detail.html via the Resume or Feedback Comment fields via POST /candidates/add or POST /feedback/add.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-05-11T00:00:00.000Z
CVE-2026-38570 
bacnet_stack 1.3.1 contains an Out-of-bounds Read in bacnet_tag_number_decode which allows attackers to cause a denial of service.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-06-04T00:00:00.000Z
CVE-2026-38579 
Multiple reflected Cross-Site Scripting (XSS) vulnerabilities in damasac thaipalliative_lte through version 3.0 allow remote attackers to inject arbitrary web script or HTML via the idFormMain parameter (line 24), the id parameter (lines 25, 75), and the ptid_key parameter (lines 26, 42) in /substudy/ezform.php. User input is echoed into HTML attributes and JavaScript contexts without encoding.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-06-05T00:00:00.000Z
CVE-2026-38587 
An Insecure Direct Object Reference (IDOR) vulnerability was discovered in ONLYOFFICE DocSpace before 3.2.1. The flaw exists in multiple REST API endpoints. This allows authenticated users with low-level permissions (User or Guest) to retrieve sensitive information, such as the Owner's unique identifier (ID) and profile information, which should only be accessible to administrators.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-05-26T00:00:00.000Z
CVE-2026-38651 
Authentication Bypass vulnerability exists in Netmaker versions prior to 1.5.0. The VerifyHostToken function in logic/jwts.go fails to validate the JWT signature when verifying host tokens. An attacker can forge a JWT signed with any arbitrary key and use it to impersonate any host in the network, gaining access to sensitive information
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-04-28T00:00:00.000Z
CVE-2026-38669 
wCMS v.1.4 is vulnerable to Cross Site Scripting (XSS) when creating a new blog.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-05-04T00:00:00.000Z
CVE-2026-38702 
A command injection vulnerability exists in the Admin Access feature of InHand Networks IR302 firmware V3.5.108, IR305 firmware V1.0.118, IR315 firmware V1.0.118, IR615 firmware V1.0.118, and earlier versions. Attackers can exploit this vulnerability to obtain ROOT privileges on remote target devices.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-05-28T00:00:00.000Z
CVE-2026-38703 
A command injection vulnerability exists in the ZeroTier VPN feature of InHand Networks IR302 firmware V3.5.108, IR305 firmware V1.0.118, IR315 firmware V1.0.118, IR615 firmware V1.0.118, and earlier versions. Attackers can exploit this vulnerability to obtain ROOT privileges on remote target devices.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-05-28T00:00:00.000Z
CVE-2026-38704 
A command injection vulnerability exists in the WireGuard VPN feature of InHand Networks IR302 firmware V3.5.108, IR305 firmware V1.0.118, IR315 firmware V1.0.118, IR615 firmware V1.0.118, and earlier versions. Attackers can exploit this vulnerability to obtain ROOT privileges on remote target devices.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-05-28T00:00:00.000Z
CVE-2026-38707 
A command injection vulnerability exists in the IPSec VPN feature of InHand Networks IR302 firmware V3.5.108, IR305 firmware V1.0.118, IR315 firmware V1.0.118, IR615 firmware V1.0.118, and earlier versions. Attackers can exploit this vulnerability to obtain ROOT privileges on remote target devices.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-05-28T00:00:00.000Z
CVE-2026-38719 
OpENer v2.3-558-g1e99582 contains an out-of-bounds read vulnerability in the Common Packet Format (CPF) parser, specifically in CreateCommonPacketFormatStructure() in source/src/enet_encap/cpf.c. A crafted ENIP/CPF message can supply an attacker-controlled item_count value that is not consistently validated against the remaining data_length of the CPF slice
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-05-18T00:00:00.000Z
CVE-2026-38728 
An issue in Nodemailer smtp_server before v.3.18.3 allows a remote attacker to cause a denial of service via the SMTPStream._write, lib/smtp-stream.js components
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-05-15T00:00:00.000Z
CVE-2026-38740 
Foscam VD1 Video Doorbell before V5.3.13_1072 is vulnerable to Cleartext Transmission of Sensitive Information. The device transmits sensitive Session Description Protocol (SDP), including ICE credentials and candidates, in cleartext over network interfaces. An attacker with network visibility can intercept these credentials to hijack media streams or authenticate to Foscam's TURN/relay infrastructure to forward arbitrary traffic at the vendor's expense.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-05-14T00:00:00.000Z
CVE-2026-38743 Apache Airflow: Dags endpoint might provide access to otherwise inaccessible entities
The authenticated /ui/dags endpoint did not enforce per-DAG access control on embedded Human-in-the-Loop (HITL) and TaskInstance records: a logged-in Airflow user with read access to at least one DAG could retrieve HITL prompts (including their request parameters) and full TaskInstance details for DAGs outside their authorized scope. Because HITL prompts and TaskInstance fields routinely carry operator parameters and free-form context attached to a task, the leak widens visibility of DAG-run data beyond the intended per-DAG RBAC boundary for every authenticated user.

Users are recommended to upgrade to version 3.2.1 , which fixes this issue.
Problem types: cwe_id: CWE-1220
description: CWE-1220: Insufficient Granularity of Access Control
Affected products: vendor: Apache Software Foundation
product: Apache Airflow
default_status: unaffected
Credits: lang: en
value: Jed Cunningham
lang: en
value: Kevin Yang
Published: 2026-04-24T12:36:40.202Z
CVE-2026-38751 
OpenSTAManager version 2.10 and earlier contains an arbitrary file upload vulnerability in the module update functionality (modules/aggiornamenti/upload_modules.php)
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-05-04T00:00:00.000Z
CVE-2026-38807 
Insecure Permissions vulnerability in kvf-admin v1.0.0 allows a remote attacker to escalate privileges via the UserController.java component
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-05-27T00:00:00.000Z
CVE-2026-38808 
SQL Injection vulnerability in uzy-ssm-mall v1.1.0 allows a remote attacker to obtain sensitive information via the ProductMapper.xml and /OrderUtil.java components
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-05-27T00:00:00.000Z
CVE-2026-38834 
Tenda W30E V2.0 V16.01.0.21 was found to contain a command injection vulnerability in the do_ping_action function via the hostName parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-04-21T00:00:00.000Z
CVE-2026-38835 
Tenda W30E V2.0 V16.01.0.21 was found to contain a command injection vulnerability in the formSetUSBPartitionUmount function via the usbPartitionName parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-04-21T00:00:00.000Z
CVE-2026-38930 
OpenRapid RapidCMS v1.3.1 was discovered to contain an authentication bypass in the /template/default/menu.php component. This vulnerability is exploited via injecting a crafted SQL payload into the name cookie parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-05-27T00:00:00.000Z
CVE-2026-38931 
A stored cross-site scripting (XSS) vulnerability in the /admin/config-module.php component of creatorsofcode simplephp GitHub commit 5184cff (Latest as of 2026-02-27) via injecting a crafted payload.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-05-27T00:00:00.000Z
CVE-2026-38934 
Cross Site Request Forgery vulnerability in diskoverdata diskover-community v.2.3.5. and before allows a remote attacker to escalate privileges and obtain sensitive information via the public/settings_process.php
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-04-27T00:00:00.000Z
CVE-2026-38935 
A reflected cross-site scripting (XSS) vulnerability exists in diskover-community <= 2.3.5 in public/view.php via the doctype parameter
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-04-27T00:00:00.000Z
CVE-2026-38936 
A reflected cross-site scripting (XSS) vulnerability exists in diskover-community <= 2.3.5 in public/selectindices.php via the namecontains parameter
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-04-27T00:00:00.000Z
CVE-2026-38939 
Cross Site Scripting vulnerability in andrewtch88 mvc-ecommerce v.1.0 allows a remote attacker to execute arbitrary code and obtain sensitive information via the product_catalogue.php component
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-04-30T00:00:00.000Z
CVE-2026-38940 
Cross Site Scripting vulnerability in RafyMrX TOKO-ONLINE-ROTI v.1.0 allows a remote attacker to execute arbitrary code via the detail_produk.php component
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-04-30T00:00:00.000Z
CVE-2026-38945 
Command injection in Raynet rvia version 12.6 Update 8 and previous versions allows adversaries to execute arbitrary code via a crafted path that matches the improperly terminated search criteria of rvia's Java search using the find command.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-05-27T00:00:00.000Z
CVE-2026-38947 
FluentCMS 1.2.3 is vulnerable to Cross Site Scripting (XSS) in TextHTML plugin.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-05-05T00:00:00.000Z
CVE-2026-38948 
Cross-Site Scripting (XSS) vulnerability exists in FUEL CMS v1.5.2 and before within the asset upload functionality. The application fails to properly sanitize uploaded SVG files, allowing a low-privileged authenticated user to upload a crafted SVG file containing malicious code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-04-28T00:00:00.000Z
CVE-2026-38949 
Cross-Site Scripting (XSS) vulnerability exists in HTMLy version 3.1.1 in the content creation functionality at the /add/content?type=image endpoint. The application fails to properly sanitize user input, allowing injection of arbitrary code
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-04-28T00:00:00.000Z
CVE-2026-38950 
An issue in ESA AnomalyMatch before 1.3.1 allow attackers to execute arbitrary code via crafted model checkpoint files. The affected components load model files from session directories using torch.load() with unrestricted deserialization.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-06-01T00:00:00.000Z
CVE-2026-38967 
CrowCpp Crow through v1.3.1 HTTP is vulnerable to response header injection via unvalidated response header values.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-06-02T00:00:00.000Z
CVE-2026-38978 
transmission through 4.1.1 was found to have a clickjacking weakness in the browser-facing WebUI and RPC response paths.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-06-02T00:00:00.000Z
CVE-2026-38991 
Cockpit 2.13.5 and earlier is affected by a misconfiguration within the Bucket component _isFileTypeAllowed function where a specially crafted filename bypasses an extension filter. This allows an authenticated attacker to rename arbitrary files with the .php file extension enabling arbitrary code to be executed on the underlying server.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-04-29T00:00:00.000Z
CVE-2026-38992 
Cockpit v2.13.5 and earlier is vulnerable to arbitrary code execution via the filter parameter within multiple endpoints. This vulnerability allows an attacker to run system commands on the underlying infrastructure via the MongoLite $func operator.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-04-29T00:00:00.000Z