CVE Radar.

You can follow the current trends of security vulnerabilities.

CVE Radar (290)

Detected during the last 30 days

CVE-2026-40383

CVSS: 9.8

An improper validation of user-supplied input leads to a local file inclusion vulnerability. Continue Reading

CRITICAL

CVE-2026-44723

CVSS: 5

Vowpal Wabbit is a machine learning system. The workflow .github/workflows/python_checks.yml embeds ${{ github.event.pull_request.title }} directly inside double-quoted bash strings in four separate steps across four jobs, each passing it as a CLI argument to the Python test script run_tests_model_gen_and_load.py. The shell interprets the expanded string before invoking Python, allowing an attacker to break out of the quotes and execute arbitrary commands on the runner. The pull_request trigger fires on PRs targeting any branch (branches: ['*']), with no additional access gate. This vulnerability is fixed by the 998e390e80a7e8192d7849b7784bc113dbd190ad commit. Continue Reading

MEDIUM

CVE-2026-48691

CVSS: 9.8

FastNetMon Community Edition through 1.2.9 contains an integer overflow in the BGP AS_PATH attribute encoder. In src/bgp_protocol.hpp, the IPv4UnicastAnnounce::get_attributes() function computes attribute_length as 'sizeof(bgp_as_path_segment_element_t) + this->as_path_asns.size() * sizeof(uint32_t)' and stores it in a uint8_t field (line 600-605). Since uint8_t can only hold values 0-255, an AS_PATH containing more than 63 ASNs (2 + 64*4 = 258 > 255) causes silent truncation. The truncated length is used for buffer sizing, while the actual data written is the full untruncated amount, resulting in a heap buffer overflow. Similarly, the path_segment_length field at line 621 is also uint8_t, truncating with more than 255 ASNs. Continue Reading

CRITICAL

CVE-2026-48898

CVSS: 9.8

An improper access check allows privilege escalation through the com_users batch task. Continue Reading

CRITICAL

CVE-2026-48899

CVSS: 9.8

An improper access check allows privilege escalation through the com_users batch task. Continue Reading

CRITICAL

CVE-2026-48904

CVSS: 9.8

An improper access check allows privelege escalation through the com_users group editing webservice endpoint. Continue Reading

CRITICAL

CVE-2026-8633

CVSS: 9.8

IBM Web Server Plug-ins for WebSphere Application Server and WebSphere Liberty 8.5, 9.0 IBM WebSphere Application Server and WebSphere Application Server Liberty are vulnerable to remote code execution in the Web Server Plug-ins, through a specially crafted request. Continue Reading

CRITICAL

CVE-2026-8855

CVSS: 8.1

IBM HTTP Server 8.5, and 9.0 is vulnerable to remote code execution and denial of service in configurations with TLS mutual authentication (client authentication). Continue Reading

HIGH

CVE-2026-8856

CVSS: 7.7

IBM HTTP Server 8.5, and 9.0 is vulnerable to denial of service in configurations where an attacker has write access to parts of the server configuration. Continue Reading

HIGH

CVE-2026-48689

CVSS: 9.8

FastNetMon Community Edition through 1.2.9 contains an off-by-one heap-based buffer overflow in the dynamic_binary_buffer_t class (src/dynamic_binary_buffer.hpp). Five methods (append_dynamic_buffer, append_data_as_pointer, append_data_as_object_ptr, memcpy_from_ptr, memcpy_from_object_ptr) use an incorrect bounds check of the form 'if (offset + length > maximum_internal_storage_size + 1)' instead of the correct 'if (offset + length > maximum_internal_storage_size)'. This allows writing exactly one byte past the end of the heap-allocated buffer. The class is used pervasively in BGP message encoding/decoding, NetFlow template processing, and Flow Spec NLRI construction. An attacker who can send network traffic (NetFlow, sFlow, IPFIX, or BGP) to a FastNetMon instance can trigger this overflow, potentially achieving arbitrary code execution by corrupting heap metadata. Notably, the append_byte() method uses the correct bounds check, confirming the inconsistency. Continue Reading

CRITICAL

Description

News

Affected

References

Attack Vector:

Attack Complexity (AC):

Privileges Required (PR):

User Interaction (UI):

Scope (S):

Availability Impact (A):

Confidentiality Impact (C):

Integrity Impact (I):

Exploitability:

Impact:

Vector String:

Get Free 100 Credits Monthly

Try first, decide later! Get started with a free plan. You can cancel at any time.

Start Free Trial

Ponarize offers an online tool that allows you to check whether a URL & IP address categorization and reputation scoring solution is classified in our Databases. Our goal is to offer you this service at the most affordable prices. We are happy to help you and enjoy working tog.

Spam Check IP Lookup Domain Lookup About Pricing Blog

Contact FAQ GDPR Privacy Policy Terms & Conditions

[email protected]