CVE-2026-41255

CKAN: CSRF exemption primed by anonymous requests

CKAN is an open-source DMS (data management system) for powering data hubs and data portals. Prior to 2.10.10 and 2.11.5, Access to the views via tokens or unauthenticated requests marked the endpoint as not requiring CSRF protection. The marking was a member variable in flask-wtf.csrf.CSRFProtect(), which was stored as a module level variable in the flask_app middleware. This API was never intended for request level changes, it is primarily a decorator for static configuration. An unauthenticated request could hit a protected endpoint, exempting it from CSRF protection for the life of the particular server process. (e.g. one worker of uwsgi). This vulnerability is fixed in 2.10.10 and 2.11.5.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Ckan Okfn

Products

Ckan Ckan

CVE-2026-41132

CKAN: No certificate validation on STMP connection

CKAN is an open-source DMS (data management system) for powering data hubs and data portals. Prior to 2.10.10 and 2.11.5, the configured SMTP server may be spoofed with any certificate (e.g. self-signed), leaving credentials and all emails sent open to MITM attacks. This vulnerability is fixed in 2.10.10 and 2.11.5.

CVSS 4.0 · 6.6 Medium EPSS < 1% KEV · Not listed

Vendors

Ckan Okfn

Products

Ckan Ckan

CVE-2026-44523

Note Mark: JWT Secret Weakness allows Full Account Takeover via token forgery

Note Mark is an open-source note-taking application. Prior to 0.19.4, no minimum length or entropy is enforced on the JWT_SECRET configuration value. The application accepts any base64-decodable secret regardless of size, including secrets as short as 1 byte. This vulnerability is fixed in 0.19.4.

CVSS 3.1 · 10 Critical EPSS < 1% KEV · Not listed

Vendors

Enchant97

Products

Note-mark

CVE-2026-41612

Visual Studio Code Information Disclosure Vulnerability

Relative path traversal in Visual Studio Code allows an unauthorized attacker to disclose information locally.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Live Preview Visual Studio Code

CVE-2026-43891

changedetection.io: Arbitrary Local File Read via crafted backup restore

changedetection.io is a free open source web page change detection tool. Prior to 0.55.1, the vulnerability is caused by trusting attacker-controlled snapshot paths restored from backup files. The vulnerable flow starts in the backup restore logic. When a backup ZIP is restored, the application extracts the archive and copies each restored watch UUID directory directly into the live datastore using shutil.copytree(entry.path, dst_dir). This preserves attacker-controlled files inside the restored watch directory, including history.txt. After restore, the application parses history.txt in the watch history property and returns the contents of the targeted local file. This vulnerability is fixed in 0.55.1.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Dgtlmoon Webtechnologies

Products

Changedetection.io Changedetection

CVE-2026-8634

Crabbox < v0.12.0 Environment Variable Information Disclosure

Crabbox prior to v0.12.0 contains an environment variable exposure vulnerability that allows attackers with access to a malicious or compromised repository to forward local secrets such as API tokens, cloud credentials, and broker tokens into the remote command environment. Attackers can exploit overly permissive environment variable allowlisting in repo-local Crabbox configuration to serialize sensitive environment variables into remote command execution, exposing credentials to the remote environment.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Openclaw

Products

Crabbox

CVE-2025-53870

Improper Neutralization of Special Elements in OS Command Injection in Fortinet FortiAP Devices

An improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiAP 7.6.0 through 7.6.2, FortiAP 7.4.0 through 7.4.5, FortiAP 7.2 all versions, FortiAP 7.0 all versions, FortiAP 6.4 all versions, FortiAP-W2 7.4.0 through 7.4.4, FortiAP-W2 7.2 all versions, FortiAP-W2 7.0 all versions may allow an authenticated attacker to execute unauthorized code or commands via a specifically crafted cli command.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Fortinet

Products

Fortiap Fortiap-w2

CVE-2026-3290

Timing limitations of the HRNG in RS9116 when power save mode is enabled results in predictable values

Timing limitations of the HRNG in RS9116 when power save mode is enabled results in predictable values

CVSS 4.0 · 7.4 High EPSS < 1% KEV · Not listed

Vendors

Silicon Labs

Products

Rs9116 Sdk

CVE-2024-36345

Out‑of‑Bounds Read in AMD OverDrive SMM Module

Improper input validation in the AMD OverDrive (AOD) System Management Mode (SMM) module could allow a privileged attacker to perform an out-of-bounds read, potentially resulting in loss of confidentiality.

CVSS 4.0 · 4.6 Medium EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2024-36332

Guest VM Privilege Escalation: Unauthorized GPU Register Access Causing Host Reboot

Improper isolation of GPU HW register space could allow a privileged attacker in malicious Guest Virtual Machine (VM) to perform unauthorized access to specific victim range of GPU MMIO register space, potentially causing the host OS to reboot and creating a Denial of Service (DOS) condition.

CVSS 4.0 · 6.8 Medium EPSS < 1% KEV · Not listed

Vendors

Amd

Products

Radeon Pro V710

CVE-2025-0045

Local Buffer Overflow in AMD Secure Processor PCI Driver

Improper Input validation in the AMD Secure Processor (ASP) PCI driver may allow a local attacker to create a buffer overflow condition, potentially resulting in a crash or denial of service

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2025-48519

Local Privilege Escalation via Out-of-Bounds Access in AMD PMF Driver

An improper input validation vulnerability within the AMD Platform Management Framework (PMF) driver can allow a local attacker to read or write Out-of-Bounds, potentially resulting in privilege escalation

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2025-54517

Out‑of‑Bounds Write in AMD GPU Diagnostic IOCTL Enables Local Privilege Escalation

Out of bounds write in AMD AMDGV_CMD_GET_DIAG_DATA ioctl handler could allow a local user to escalate privileges via remote code execution.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed

Vendors

Amd

Products

Instinct Mi210 Instinct Mi250 Instinct Mi300a and 5 more

CVE-2025-48512

Privilege Escalation via Improper GPIO Installation Directory Permissions

Incorrect default permissions in the installation directory for the AMD general-purpose input/output controller (GPIO) could allow an attacker to achieve privilege escalation resulting in arbitrary code execution.

CVSS 4.0 · 7 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-0432

Privilege Escalation via Incorrect Permissions in AMD Chipset Driver Installation Directory

Incorrect default permissions in the installation directory for the AMD chipset driver could allow an attacker to achieve privilege escalation resulting in arbitrary code execution.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2025-29938

Unchecked return value in AMD PMF enables arbitrary memory write

An unchecked return value within the AMD Platform Management Framework (PMF) could allow an attacker to write to an arbitrary memory address resulting in denial of service or arbitrary code execution.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Amd

Products

Ryzen 7035 Series Processors With Radeon Graphics Ryzen 7040 Series Mobile Processors With Radeon Graphics Ryzen 8040 Series Mobile Processors With Radeon Graphics and 1 more

CVE-2025-48521

Improper Input Validation In AMD Secure Processor PCI Driver Leads To Local Use‑After‑Free

Improper input validation in the AMD Secure Processor (ASP) PCI driver could allow a local attacker to trigger a Use-After-Free (UAF) condition, potentially resulting in a loss of platform integrity or crash.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-42312

pyload-ng: non-admin SETTINGS users can disable outbound TLS peer verification

pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev100, the set_config_value() API method (@permission(Perms.SETTINGS)) in src/pyload/core/api/__init__.py gates security-sensitive options behind a hand-maintained allowlist ADMIN_ONLY_CORE_OPTIONS. The option ("general", "ssl_verify") is not on that allowlist. Any authenticated user with the non-admin SETTINGS permission can set general.ssl_verify = off, and every subsequent outbound pycurl request is made with SSL_VERIFYPEER=0 and SSL_VERIFYHOST=0 — TLS peer and hostname verification are fully disabled. An on-path attacker can then present forged certificates for any hostname pyload fetches. This is a direct continuation of the fix family CVE-2026-33509 / CVE-2026-35463 / CVE-2026-35464 / CVE-2026-35586, each of which patched a different missed option in the same allowlist. This vulnerability is fixed in 0.5.0b3.dev100.

CVSS 3.1 · 6.8 Medium EPSS < 1% KEV · Not listed

Vendors

Pyload Pyload-ng Project

Products

Pyload Pyload-ng

CVE-2026-6228

Frontend Admin by DynamiApps <= 3.28.36 - Unauthenticated Privilege Escalation via Edit User Form

The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Privilege Escalation in versions up to and including 3.28.36. This is due to insufficient authorization checks in the role field update mechanism combined with overly permissive capabilities for the admin_form post type. The admin_form custom post type uses 'capability_type' => 'page', which grants editors the ability to create and edit forms. When an editor creates an edit_user form, they can manipulate the form configuration to include 'administrator' in the role_options array by directly submitting POST data to wp-admin/post.php, bypassing the UI restrictions in feadmin_get_user_roles(). When the form is subsequently submitted, the pre_update_value() function in class-role.php only validates that the submitted role exists in the form's role_options array (lines 107-110), but fails to verify that the current user has permission to assign that specific role. This makes it possible for unauthenticated attackers to first register as editors (via a public new_user form), then create an edit_user form with administrator in the allowed roles, and finally use that form to escalate their own privileges to administrator.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Shabti Wordpress

Products

Frontend Admin By Dynamapps Wordpress

CVE-2026-6646

The7 <= 14.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode 'link' Parameter

The The7 theme for WordPress is vulnerable to Stored Cross-Site Scripting via the 'dt_default_button' shortcode in all versions up to, and including, 14.3.2. This is due to insufficient input sanitization and output escaping on the 'title' component of the 'link' shortcode parameter. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

CVSS 3.1 · 6.4 Medium EPSS < 1% KEV · Not listed

Vendors

Dream-theme Wordpress

Products

The7 — Website And Ecommerce Builder For Wordpress Wordpress