Reserved but Public CVEs

CVE-2016-6196 is an unrestricted file creation vulnerability in SAP Adaptive Server Enterprise. The flaw affects handling of the TRANSFER TABLE statement and allows a user who is permitted to execute that statement, including a table owner, to create files as the database server process owner. By abusing this capability, an attacker can place attacker-controlled files on the host and potentially create and load shared libraries into the database server process, resulting in code execution within the database server context.

CVE-2016-6196First seen Aug 20, 2026

CVE-2015-1413 is a cross-site scripting vulnerability in Magnolia CMS affecting version 5.3.6 Enterprise Edition and Community Edition, and possibly other versions. The flaw allows attacker-controlled script content to be injected into application output and executed in the browser of a user interacting with the vulnerable application. Successful exploitation occurs within the security context of the targeted user's session and can enable unauthorized client-side actions against the CMS.

CVE-2015-1413First seen Aug 20, 2026

CVE-2026-73554 is a critical authentication bypass vulnerability in Dolt MCP affecting versions 0.3.1 through 0.3.6 when deployed with remote HTTP transport and JWT authentication enabled. The flaw arises from two conditions in the request handling chain: JWT rejection logic writes an HTTP 401 response for an invalid token but does not terminate execution because the middleware omits a return statement, and session validation in the underlying mcp-go implementation accepts forged session identifiers matching an expected format without verifying that the session was actually created by the server. By combining an invalid JWT with a crafted session identifier, an unauthenticated attacker can bypass intended access controls, reach the MCP tool dispatcher, and invoke database operations through the server context despite failed authentication. A notable characteristic is that the server may still return HTTP 401 Unauthorized while including the result of the unauthorized operation in the response body.

CVE-2026-73554First seen Aug 16, 2026

CVE-2018-1579 is an authentication bypass vulnerability affecting Palo Alto Networks PAN-OS GlobalProtect portal and gateway functionality. The issue allows an unauthenticated remote attacker to bypass normal authentication controls on exposed VPN infrastructure under affected conditions. Public reporting associates the vulnerability with intrusion activity in which attackers used vulnerable VPN appliances as an initial access vector into enterprise environments.

CVE-2018-1579First seen Aug 14, 2026

First seen Apr 9, 2026

First seen Aug 5, 2026

First seen Aug 3, 2026

CVE-2023-20713First seen May 26, 2026

First seen Jul 31, 2026

CVE-2026-57152First seen Jul 27, 2026

CVE-2026-47678 is one of multiple vulnerabilities fixed in GLPI 10.0.26 and 11.0.8. Affected versions prior to those releases contain a flaw that, in the broader set of patched issues, may contribute to cross-site scripting, SQL injection, security control bypass, data confidentiality and integrity compromise, or privilege escalation. Specific technical details for this individual CVE, including the vulnerable component or function, are currently not available.

CVE-2026-47678First seen Jul 27, 2026

First seen May 26, 2026

CVE-2026-24205 is a medium-severity race condition vulnerability affecting NVIDIA TensorRT-LLM. The flaw occurs when a user runs concurrent database requests, creating a timing-dependent condition in which shared state or resources may be accessed in an unsafe order. In concurrent execution scenarios, improper synchronization can cause inconsistent application behavior and may undermine the integrity or availability of the affected service.

CVE-2026-24205First seen May 27, 2026

CVE-2024-20452 is a critical buffer overflow vulnerability in the web-based management interface of Cisco Small Business SPA 300 and SPA 500 series IP phones. The flaw affects all software releases for the affected products regardless of configuration. A remote, unauthenticated attacker can trigger the vulnerability by sending a specially crafted HTTP request to a vulnerable device, leading to arbitrary command execution on the underlying operating system with root privileges.

CVE-2024-20452First seen May 26, 2026

CVE-2024-20453 is a high-severity vulnerability in the web-based management interface of Cisco Small Business SPA300 Series and SPA500 Series IP phones. The flaw is caused by inadequate validation of HTTP packets processed by the management interface. A remote attacker can send a crafted HTTP packet to a vulnerable device and trigger a denial-of-service condition. Cisco indicated that all software releases for the affected product lines are vulnerable regardless of configuration, and that this issue is independently exploitable from the other disclosed flaws affecting the same devices.

CVE-2024-20453First seen May 26, 2026

CVE-2026-52848First seen Jul 27, 2026

CVE-2026-55606 is a moderate-severity vulnerability in OpenWrt's odhcpd DHCP service. The flaw is a stack buffer over-read caused by an endianness mismatch when handling a DHCP Unique Identifier (DUID) length value. Improper interpretation of the DUID length can cause odhcpd to read beyond the intended bounds of a stack buffer while processing attacker-supplied DHCPv6 data. The issue is reachable by a network-adjacent attacker against the default-enabled odhcpd service in affected OpenWrt releases prior to the fixed 25.12.5 update.

CVE-2026-55606First seen Jun 30, 2026

CVE-2026-57187 is a heap use-after-free vulnerability in Asterisk's PJSIP handling of TCP/SDP state when a connection-oriented SIP session is closed during SDP processing. According to the advisory, an authenticated attacker can trigger the flaw by sending a SIP INVITE over a connection-oriented transport such as TCP and then disconnecting before Asterisk sends its 200 OK response. This can result in dereferencing freed heap memory during the lifetime management of resources associated with SDP processing. The issue is mapped to CWE-416 and also associated with improper resource lifetime control. The advisory notes that the crash has only been reproducible when Asterisk is built with Address Sanitizer enabled.

CVE-2026-57187First seen Jun 26, 2026

First seen Jul 1, 2026

CVE-2026-52717 is an incorrect memory management vulnerability in the ffmpeg plugin shipped with GStreamer via the gst-libav1.0 package. According to the provided advisory context, the flaw can result in heap memory corruption during processing in the plugin. Specific vulnerable functions, code paths, and trigger conditions were not provided in the available content.

CVE-2026-52717First seen Jun 19, 2026

First seen Jun 17, 2026

CVE-2025-55662 is a divide-by-zero vulnerability in GPAC/MP4Box affecting gpac/gpac prior to fix commit ff8249a407685d00ceb5f4d2a798b9cad195140e. The flaw is in gf_opus_parse_packet_header() in media_tools/av_parsers.c while processing an MP4 file containing an Opus audio track with malformed packet or header parameters. Specifically, critical Opus packet fields such as nb_frames are not validated before being used in arithmetic; the available reporting notes logic equivalent to computing values derived from header->nb_frames without first ensuring the field is non-zero and otherwise valid. When MP4Box reaches the Opus dump path on a crafted file, this can trigger a division by zero and terminate the process with a floating-point exception, with published traces pointing to media_tools/av_parsers.c:11479 and call paths including gf_inspect_dump_opus_internal() and dump_isom_opus().

CVE-2025-55662First seen Jun 13, 2026

CVE-2025-61620 is described in the provided content only as a denial-of-service vulnerability in vLLM involving chat template handling. The content states it affects the same general attack surface as later template-rendering issues, but does not provide specific technical details such as the vulnerable function, affected versions, exact trigger condition, or patch information for this CVE.

CVE-2025-61620First seen Apr 20, 2026

CVE-2023-47399 affects Nagios XI and allows the Nagios XI database user (`nagiosxi`) to update or delete records in the `xi_auditlog` table. Based on the provided advisory context, the issue is not a memory corruption or code execution flaw but an authorization and integrity weakness in database privilege design: the application database account was granted full CRUD capabilities over audit log records when audit data should be append-only or otherwise protected from modification and deletion. This undermines the trustworthiness of Nagios XI audit logging because actions recorded for administrative and security-relevant events can be altered or removed by an attacker who gains the ability to act through that database user or abuse application functionality that uses it.

CVE-2023-47399First seen May 31, 2026

CVE-2023-47405 is a vulnerability in Nagios XI affecting at least version 5.11.1 in which the installer creates multiple MySQL database accounts with weak default credentials. According to the provided advisory context, a fresh installation creates at least three database users—nagiosxi, nagiosql, and ndoutils—using the password "n@gweb". This results in predictable, low-entropy credentials being present by default for backend database access.

CVE-2023-47405First seen May 31, 2026