CveMate
Vulnerability intelligence, open to everyone. Vulnerabilities, threat metrics, KEV catalogs and exploit data from 30 sources, in one platform — no account needed.
30data sources
Star on GitHub, 8 starsLatest high-priority signals
Real-time tracking of critical vulnerabilities, ransomware campaigns, and CISA KEV additions.
CriticalCVE-2026-115806codexonics · prime mover – backup and migrationPrime Mover <= 2.2.1 - Unauthenticated PHP Object Injection via Base64-Encoded Comment during Migration Search-and-ReplaceThe Prime Mover – Backup and Migration plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.2.1 via deserialization of untrusted input in the migration search-and-replace routine (recursiveUnserializeReplace()). An unauthenticated attacker can store a crafted, base64-encoded serialized object in wp_comments.comment_content through the standard comment-submission endpoint (wp-comments-post.php). When an administrator subsequently performs a routine Prime Mover export or restore, the plugin base64-decodes that stored value and passes it to unserialize() with no allowed_classes restriction. A Property-Oriented Programming (POP) chain is present in the plugin's own bundled Freemius library (FS_Clone_Manager::__set → FS_Option_Manager::set_option → store() → update_option()), so no additional plugin or theme is required — the plugin ships the gadget itself.CriticalCVE-2026-115931gitroomhq · postiz-appArbitrary file read and backend crash through unrestricted provider method callsPostiz lets a signed-in user ask the backend to run a function on one of their connected channels. The backend did not restrict which functions can be requested, so a user could call internal helper functions that were never meant to be reachable from the web interface.
One of those helpers reads a file from the server's disk. A user who connects a channel whose stored token is a file path can have the backend return the contents of any file it can read, including its environment, which holds the secret used to sign login sessions, the database address and the credentials of connected services. Another helper makes the backend process exit with a single request. Self-registration is open by default, so no existing account and no action by another user is needed.CriticalCVE-2026-115893bytecodealliance · wasmtimeWasmtime: Cranelift backend on aarch64 can jump to incorrect target on large Wasm `br_table` instructionWasmtime is a runtime for WebAssembly. Prior to 36.0.19, 48.0.7, and 49.0.4, the Cranelift compiler backend on aarch64 can compile a Wasm br_table instruction with more than approximately 256,000 targets so that it has an incorrect conditional branch target. The branch can then jump to arbitrary other code at a user-controlled offset, allowing a user-controlled Wasm module to escape the sandbox on aarch64 engines using the default Cranelift backend. This issue is fixed in versions 36.0.19, 48.0.7, and 49.0.4.CriticalCVE-2026-115889bytecodealliance · wasmtime +2 moreWasmtime: Bit-packing in Cranelift compiler causes silent overflow and miscompilationBit-packing in Cranelift compiler causes silent overflow and miscompilation
This is an entry in the RustSec database for the Wasmtime security advisory
located at
https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-897f-g5gm-fmxm
For more information see the GitHub-hosted security advisory.CriticalCVE-2026-115812aws · multi-model-serverRelative path traversal during model archive extraction in Amazon Web Services Multi Model ServerMulti Model Server is end of life and no fixed version is available. Users should discontinue use of Multi Model Server and migrate to a supported model serving solution.CriticalCVE-2026-53942conda · infrastructureConda Organization Infrastructure: Pwn Request in update workflow allows PR-controlled template rendering with SYNC_TOKENConda Organization Infrastructure is a centralized location for infrastructure codes. Prior to commit 9c0f238, a GitHub Actions Pwn Request vulnerability appears to remain present in conda/conda. The affected workflow is .github/workflows/update.yml. It is triggered by issue_comment events containing @conda-bot render or @conda-bot recreate. For the render path, the workflow obtains the pull request head repository and branch from the PR API, checks out that PR-controlled repository/ref using secrets.SYNC_TOKEN, and then runs conda/actions/template-files@7f6830b1428a9bd47f0b068892c77eae95207037. The external template-files action reads its default configuration and templates from the checked-out working directory. In the confirmed finding, that action uses an unsandboxed Jinja2 environment to render attacker-controlled template content. This creates a Pwn Request chain in which an untrusted PR/comment path can reach template rendering in a privileged token context. This issue has been patched via commit 9c0f238.CriticalCVE-2026-46652intranda · goobi-viewer-corePath traversal via HTTP `Content-Disposition` header in ExternalFilesDownloader enables remote code execution in Goobi viewerThe Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 24.03 to before version 26.05, ExternalFilesDownloader.getFilename() extracts the destination filename from a server-supplied Content-Disposition response header and passes it directly to Path.resolve() without stripping directory components. This allows for a malicious HTTP server that the viewer fetches from to supply an absolute path or ../ traversal sequences as the filename, writing attacker-controlled content to an arbitrary path writable by the Tomcat process. When targeting the deployed web-application directory, this yields remote code execution as the tomcat OS user. This issue has been patched in version 26.05.CriticalCVE-2026-46651intranda · goobi-viewer-coreUnauthenticated SSRF and local file inclusion via DownloadTaskEndpoint WebSocket in Goobi viewerThe Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 24.03 to before version 26.05, the DownloadTaskEndpoint WebSocket endpoint (/tasks/download/monitor.socket) in goobi-viewer-core accepts download requests from unauthenticated users. This issue has been patched in version 26.05.CriticalCVE-2026-53921openwrt · odhcpdodhcpd: Stack buffer overflow in DHCPv6 IA reply serialization (2 independent sites)odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt. Prior to version 25.12, odhcpd's DHCPv6 IA response handler writes past the end of a fixed 512-byte stack buffer (pdbuf) when a single DHCPv6 REQUEST carries enough IA options to nearly exhaust the reply space. Two independent overflow sites exist in the same call chain, both reachable from the network via a single unauthenticated UDP packet. odhcpd runs as root on OpenWrt; embedded targets often lack stack canaries and ASLR, making code execution realistic. This issue has been patched in version 25.12.CriticalCVE-2026-112848aivahthemes · hostme v2WordPress Hostme v2 theme <= 7.0 - PHP Object Injection vulnerabilityDeserialization of Untrusted Data vulnerability in AivahThemes Hostme v2 hostmev2 allows Object Injection.This issue affects Hostme v2: from n/a through 7.0.