CVE-2025-71149

kernel: io_uring/poll: correctly handle io_poll_add() return value on update

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

CVSS 3.1 · 5.5 Medium EPSS n/a KEV · Not listed

Vendors

—

Products

—

CVE-2026-43504

Unauthenticated XMPP Traffic Relay via Improper mod_proxy65 Access Control

An issue was discovered in Prosody before 0.12.6 and 1.0.0 through 13.0.0 before 13.0.5, when mod_proxy65 is enabled. Because mod_proxy65 mishandles access control in a paused scenario, relaying of unauthenticated traffic can occur.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Prosody

Products

Prosody

CVE-2026-5656

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in Wireshark

Profile import path traversal in Wireshark 4.6.0 to 4.6.4 and 4.4.0 to 4.4.14 allows denial of service and possible code execution

CVSS 3.1 · 7 High EPSS < 1% KEV · Not listed

Vendors

Wireshark

Products

Wireshark

CVE-2026-39807

Client-supplied URI scheme trusted without transport verification in bandit

Reliance on Untrusted Inputs in a Security Decision vulnerability in mtrudel bandit allows unauthenticated transport-state spoofing on plaintext HTTP connections. 'Elixir.Bandit.Pipeline':determine_scheme/2 in lib/bandit/pipeline.ex returns the client-supplied URI scheme verbatim, ignoring the transport's secure? flag. HTTP/1.1 absolute-form request targets (e.g. GET https://victim/path HTTP/1.1) and the HTTP/2 :scheme pseudo-header are both attacker-controlled strings that flow through this function. Over a plaintext TCP connection, a client can declare https and Bandit will set conn.scheme = :https even though no TLS was negotiated. Downstream Plug consumers that branch on conn.scheme are silently misled: Plug.SSL's already-secure branch skips its HTTP→HTTPS redirect, cookies emitted with secure: true are sent over plaintext, audit logs record requests as having arrived over HTTPS, and CSRF/SameSite gating may make incorrect decisions. This issue affects bandit: from 1.0.0 before 1.11.0.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Mtrudel

Products

Bandit

CVE-2026-7320

Information disclosure due to incorrect boundary conditions in the Audio/Video component

Information disclosure due to incorrect boundary conditions in the Audio/Video component. This vulnerability was fixed in Firefox 150.0.1, Firefox ESR 140.10.1, Firefox ESR 115.35.1, Thunderbird 150.0.1, and Thunderbird 140.10.1.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Mozilla

Products

Firefox Thunderbird

CVE-2026-7324

Memory safety bugs fixed in Thunderbird 150.0.1

Memory safety bugs present in Thunderbird 150.0.0. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 150.0.1 and Thunderbird 150.0.1.

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed

Vendors

Mozilla

Products

Firefox Thunderbird

CVE-2026-38992

Cockpit CMS Arbitrary Code Execution via MongoLite $func Operator

Cockpit v2.13.5 and earlier is vulnerable to arbitrary code execution via the filter parameter within multiple endpoints. This vulnerability allows an attacker to run system commands on the underlying infrastructure via the MongoLite $func operator.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Cockpit-hq

Products

Cockpit

CVE-2026-38991

Authenticated File Rename Allows PHP Execution in Cockpit CMS

Cockpit 2.13.5 and earlier is affected by a misconfiguration within the Bucket component _isFileTypeAllowed function where a specially crafted filename bypasses an extension filter. This allows an authenticated attacker to rename arbitrary files with the .php file extension enabling arbitrary code to be executed on the underlying server.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Cockpit-hq

Products

Cockpit

CVE-2025-56535

Cross‑Site Scripting via Zone Attribute Parameter in OpenNebula

A cross-site scripting (XSS) vulnerability in opennebula v6.10.0.1 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the zone attribute parameter.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Opennebula

Products

Opennebula

CVE-2025-56537

Stored XSS Vulnerability in OpenNebula 6.10.0.1 Virtual Network Template

A stored cross-site scripting (XSS) vulnerability in opennebula v6.10.0.1 and fixed in v.7.0 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the virtual network template parameter.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Opennebula

Products

Opennebula

CVE-2026-36960

Cross‑Site Request Forgery in U‑SPEED N300 Router Web Management Interface

A Cross-Site Request Forgery (CSRF) vulnerability exists in the web management interface of the U-SPEED N300 Rounter V1.0.0. The device does not implement CSRF protection mechanisms such as anti-CSRF tokens or strict Origin/Referer validation for administrative API endpoints. An attacker can craft a malicious webpage that sends forged HTTP requests to configuration endpoints. If an authenticated administrator visits the malicious webpage, the victim's browser automatically includes the valid session cookie in the request, allowing the router to process the request as a legitimate administrative action.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

U-speed

Products

N300 Router

CVE-2026-36757

Authenticated SSRF Enabling Intranet Reconnaissance via Halo Plugin Upgrade Endpoint

A Server-Side Request Forgery (SSRF) in the /plugins/{name}/upgrade-from-uri endpoint of halo v2.22.14 allows authenticated attackers to scan internal resources via a crafted GET request.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Halo

Products

Halo

CVE-2026-36759

Authenticated SSRF Enabling Internal Network Scanning

A Server-Side Request Forgery (SSRF) in the /themes/{name}/upgrade-from-uri endpoint of halo v2.22.14 allows authenticated attackers to scan internal resources via a crafted GET request.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Halo

Products

Halo

CVE-2026-36760

Authenticated File Upload Path Traversal Allowing Arbitrary File Creation in JeeSite 5.15.1

An issue in the fileMd5 parameter in the /a/file/upload endpoint of JeeSite v5.15.1 allows authenticated attackers with file upload permissions to execute a path traversal and write arbitrary files with whitelisted suffixes to arbitrary filesystem locations while chunked upload is enabled.

CVSS 3.1 · 9.6 Critical EPSS < 1% KEV · Not listed

Vendors

Thinkgem

Products

Jeesite

CVE-2026-36764

Authenticated SSRF in SpringBlade v4.8.0 Allows Internal Resource Scanning

A Server-Side Request Forgery (SSRF) in the /ureport/datasource/testConnection endpoint of SpringBlade v4.8.0 allows authenticated attackers to scan internal resources via a crafted GET request.

CVSS 3.1 · 5 Medium EPSS < 1% KEV · Not listed

Vendors

Chillzhuang

Products

Springblade

CVE-2026-36767

Arbitrary File Write via Path Traversal in Shopizer Image Upload

A path traversal vulnerability in the /content/images/add endpoint of shopizer v3.2.5 allows attackers write arbitrary files to any writeable path via a crafted POST request.

CVSS 3.1 · 10 Critical EPSS < 1% KEV · Not listed

Vendors

Shopizer

Products

Shopizer

CVE-2026-36766

Authenticated XSS via Shopizer getInputStream and getReader in XssHttpServletRequestWrapper

Multiple authenticated cross-site scripting (XSS) vulnerabilities in the XssHttpServletRequestWrapper class of shopizer v3.2.5 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the getInputStream() or getReader() functions.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Shopizer

Products

Shopizer

CVE-2026-6870

Access of Uninitialized Pointer in Wireshark

GSM RP protocol dissector crash in Wireshark 4.6.0 to 4.6.4 and 4.4.0 to 4.4.14 allows denial of service

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Wireshark

Products

Wireshark

CVE-2026-6526

NULL Pointer Dereference in Wireshark

RTSP protocol dissector crash in Wireshark 4.6.0 to 4.6.4

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Wireshark

Products

Wireshark

CVE-2026-6531

Loop with Unreachable Exit Condition ('Infinite Loop') in Wireshark

SANE protocol dissector infinite loop in Wireshark 4.6.0 to 4.6.4 and 4.4.0 to 4.4.14 allows denial of service

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Wireshark

Products

Wireshark