Reserved but Public CVEs

CVE-2026-28257 is an improper authorization vulnerability in Dell AppSync versions 4.6.0.4 and 4.6.1.0. An authenticated remote attacker with low privileges can exploit insufficient authorization enforcement to obtain unauthorized access. The vulnerability is rated CVSS v3.1 7.6 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L).

CVE-2026-28257First seen Aug 31, 2026

CVE-2026-77682First seen Aug 22, 2026

CVE-2026-81501First seen Aug 28, 2026

CVE-2026-81500First seen Aug 28, 2026

First seen Aug 11, 2026

CVE-2026-44701 is a low-severity cross-site scripting vulnerability in devcode-it/openstamanager. The application accepts unsanitized user-group name input and renders it in the interface without context-appropriate HTML encoding. A privileged user who can create or modify groups can inject arbitrary HTML into group-related views.

CVE-2026-44701First seen Aug 26, 2026

First seen Aug 26, 2026

CVE-2026-63124 is an infinite-loop denial-of-service vulnerability in io.netty.incubator:netty-incubator-codec-bhttp prior to 0.0.23.Final. The Binary HTTP parser can fail to advance or terminate when parsing a known-length field section that ends exactly at a complete field-line boundary. A crafted Binary HTTP input can cause BinaryHttpParser or BinaryHttpDecoder to repeatedly process the boundary condition without making progress. The issue is associated with CWE-835 (loop with unreachable exit condition) and CWE-400 (uncontrolled resource consumption).

CVE-2026-63124First seen Aug 21, 2026

CVE-2023-43020 is a denial-of-service vulnerability in IBM Db2 for Linux, UNIX and Windows, including Db2 Connect Server. A low-privileged authenticated user can submit a specially crafted database query that causes a high availability impact. Affected supported releases include Db2 10.5.0.11, 11.1.4.7, and 11.5.x on supported Linux, AIX, Windows, HP-UX, and Solaris platforms. Earlier unsupported Db2 releases may also be affected.

CVE-2023-43020First seen Aug 22, 2026

CVE-2024-50604 is an improper validation of integrity check value vulnerability in RUCKUS FastIron firmware used by the RUCKUS ICX switch product line. The issue is described as insufficient validation for a software component integrity check, indicating that the firmware does not adequately verify integrity metadata associated with software components. In the documented attack scenario, this weakness can be combined with CVE-2024-50607, a directory traversal vulnerability, to enable malware injection on vulnerable ICX switches. The affected scope includes multiple ICX firmware branches across the 08.0.95r, 09.0.10j, 10.0.10f, and 10.0.20b release lines.

CVE-2024-50604First seen Aug 22, 2026

CVE-2024-50607 is a directory traversal vulnerability in RUCKUS FastIron firmware used by the RUCKUS ICX switch product line. The flaw is classified as a path traversal issue and affects multiple ICX firmware branches. Available information indicates that, in combination with CVE-2024-50604, the vulnerability can be used by an authenticated attacker with physical access to facilitate malware injection on vulnerable switches. Specific details about the affected function or code path are currently not available.

CVE-2024-50607First seen Aug 22, 2026

CVE-2017-17768First seen Aug 22, 2026

CVE-2026-2574 is a memory-safety vulnerability in glib-networking affecting the OpenSSL backend used for TLS connections. A malicious TLS server can exploit the flaw when a client connects and the server advertises a specially crafted client certificate authority list during the handshake. This malformed input can cause the client to read memory outside the bounds of an allocated buffer and then free memory incorrectly. The issue is therefore characterized by an out-of-bounds read coupled with invalid memory deallocation in TLS handshake processing, which can crash the client and may expose a limited amount of heap memory.

CVE-2026-2574First seen Aug 23, 2026

CVE-2026-78332 is a stored cross-site scripting vulnerability in the contacts component of NethServer WebTop. It affects WebTop version 1.5.6 and earlier. The flaw allows malicious content to be stored in contact data and later rendered in another user's browser, resulting in execution of attacker-supplied JavaScript when the affected contact is viewed. The issue was fixed in WebTop 1.5.7.

CVE-2026-78332First seen Aug 24, 2026

CVE-2026-78331 is a stored cross-site scripting vulnerability in the calendar component of NethServer WebTop. The issue affects WebTop version 1.5.6 and earlier and allows malicious content to be stored within calendar data. When another user later views the crafted calendar event, attacker-supplied JavaScript executes in that user's browser within the context of the application.

CVE-2026-78331First seen Aug 24, 2026

CVE-2021-27745 is a server-side request forgery vulnerability in HCL Digital Experience associated with the Quickr Document Picker component. The issue affects an internal proxy entry point exposed by that enterprise application, allowing attacker-supplied requests to be relayed by the server. In vulnerable deployments, an unauthenticated remote attacker can cause the HCL Digital Experience server to initiate outbound requests to attacker-chosen destinations, resulting in SSRF through the affected application path.

CVE-2021-27745First seen Aug 23, 2026

CVE-2020-14282 is a broken access control vulnerability in HCL Digital Experience affecting versions 8.5, 9.0, and 9.5. The flaw allows anonymous, unauthenticated users to access limited access-control data and may expose system files and folders that should not be available without authorization. The exposed access is described as read-only, and anonymous users cannot use it to grant permissions or modify access settings. The issue stems from improper enforcement of authorization restrictions on resources that should require authenticated access.

CVE-2020-14282First seen Aug 23, 2026

First seen Jul 5, 2026

First seen Jul 5, 2026

HCL Launch contains a vulnerability in which a manually edited keystore password used by the agent relay component is stored in clear text after restart. This results in insufficient protection of sensitive credentials at rest, allowing a local user with access to the affected system to read the stored password directly. The issue is a cleartext storage weakness affecting credential handling rather than a memory disclosure or cryptographic bypass.

CVE-2020-14267First seen Aug 23, 2026

CVE-2021-27666 is a high-severity information disclosure vulnerability in the Android telecommunication/modem component. Successful exploitation can lead to remote disclosure of sensitive information. The available information indicates that the issue is remotely reachable and does not require additional execution privileges. Specific details about the vulnerable function or code path are not available from the provided material.

CVE-2021-27666First seen Aug 22, 2026

CVE-2015-1509 is a reflected cross-site scripting vulnerability in Intland Software codeBeamer, reported in version 7.3.2-201410071117. The flaw allows arbitrarily supplied request parameters to be reflected by a web-accessible application component without sufficient sanitization or output encoding, enabling attacker-controlled script content to execute in a victim user's browser within the application's security context.

CVE-2015-1509First seen Aug 20, 2026

CVE-2015-1508 is a blind time-based SQL injection vulnerability in Brainworks Software XpanceNET affecting version 7.3.27 and earlier. The flaw is present in the UserID parameter, including in password-change request functionality, where insufficient neutralization of attacker-controlled input allows crafted SQL expressions to be processed by the backend database. Because the issue is blind and time-based, successful exploitation is inferred through response timing differences rather than direct error messages or query output. Depending on the privileges available to the application’s database context, the vulnerability can enable unauthorized interaction with the underlying database.

CVE-2015-1508First seen Aug 20, 2026

CVE-2014-6285 is a privilege escalation vulnerability in SAP Adaptive Server Enterprise (ASE) caused by an SQL injection flaw in replication support code. ASE contains an implementation flaw that allows SQL statements supplied through replication-related functionality to be executed without normal security checks. The issue affects users granted replication-related privileges and enables injected SQL to run in a more privileged context than intended. As a result, an authenticated user can abuse the vulnerable code path to elevate privileges within the database server, including escalation to administrative database roles.

CVE-2014-6285First seen Aug 20, 2026

CVE-2016-4013 is a SQL injection vulnerability in SAP Adaptive Server Enterprise (ASE) 16.0 SP02 introduced through Data Store Access Management (DSAM) support in CREATE DATABASE and ALTER DATABASE processing. When DSAM is configured, these statements perform additional logic to add specially named segments. A flaw in that implementation allows a low-privileged user to embed T-SQL code into the affected database-management workflow, causing attacker-controlled SQL to be executed with elevated privileges. The issue can lead to full compromise of the ASE server.

CVE-2016-4013First seen Aug 20, 2026