CveMate
Vulnerability intelligence, open to everyone. Vulnerabilities, threat metrics, KEV catalogs and exploit data from 30 sources, in one platform — no account needed.
30data sources
Star on GitHub, 8 starsLatest high-priority signals
Real-time tracking of critical vulnerabilities, ransomware campaigns, and CISA KEV additions.
CriticalCVE-2026-54630part-db · part-db-serverPart-DB: Authenticated RCE via .phar attachment upload served from public/mediaPart-DB is an open source inventory management system for electronic components. Prior to version 2.12.1, the part attachment upload handler stores uploaded files under the web-served media directory using the client-supplied file extension, and its extension blocklist does not include phar. AttachmentSubmitHandler::renameBlacklistedExtensions() rewrites dangerous extensions (php, phtml, sh, cgi, py, js, html, htaccess, ...) to .txt, but phar is absent from the list, so a .phar file keeps its extension. Public attachments (the default) are written into public/media/, which is the Apache document root. The shipped Apache configuration routes .phar to PHP-FPM, so the stored file is executed as PHP on request. The per-attachment-type extension filter is empty by default and is not consulted by the upload handler in a way that blocks this, and a non-admin user in the default users group can create an attachment type with no filter and attach files to parts. Any authenticated user in the default users group uploads a .phar attachment to a part and fetches it under /media/, executing arbitrary PHP as the www-data web user. Ability to exploit depends on the webserver config, docker image contained the vulnerability by default. This issue has been patched in version 2.12.1.CriticalCVE-2026-110243kiloview · e3 firmwareKiloview E3 NDI Encoder OS Command InjectionThe network management service on affected Kiloview E3 NDI encoder firmware fails to validate the network interface name accepted by its link maintenance address configuration endpoint before passing it to a shell command, unlike sibling handlers that perform the same validation. An authenticated web user with permission to configure network settings can exploit this to execute arbitrary operating system commands as root.CriticalCVE-2026-107861kiloview · e3 firmwareKiloview E3 NDI Encoder OS Command InjectionThe system control service on affected Kiloview E3 NDI encoder firmware fails to sanitize the hostname parameter accepted by its device naming endpoint, passing it unquoted into a shell command. An authenticated web user with access to this function can embed characters to execute arbitrary operating system commands as root, resulting in full device compromise.CriticalCVE-2026-110063microsoft · vm inspector for azure virtual machinesVM Inspector for Azure Virtual Machines Elevation of Privilege VulnerabilityImproper link resolution before file access ('link following') in VM Inspector for Azure Virtual Machines allows an unauthorized attacker to elevate privileges over a network.CriticalCVE-2026-83938microsoft · azure kubernetes configuration serviceAzure Kubernetes Configuration Service Elevation of Privilege VulnerabilityMissing authentication for critical function in Azure Kubernetes Configuration Service allows an unauthorized attacker to elevate privileges over a network.CriticalCVE-2026-97785microsoft · microsoft entra application proxyAAD App Proxy Elevation of Privilege VulnerabilityImproper authentication in AAD App Proxy allows an unauthorized attacker to elevate privileges over a network.CriticalCVE-2026-114625arista networks · velocloud orchestratorSecurity Advisory 0199VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator.
On an affected system, any authenticated user can gain operator privileges and masquerade as a local "superuser operator" user. This includes access to functionality that is intended for internal use only and which is not intended to be remotely accessible.
Hosted, including Dedicated, versions of VCO were impacted and have already been patched.CriticalCVE-2026-115384bytecodealliance · wasmtimeWasmtime 39.0.0 before 48.0.4 and 49.0.0 before 49.0.2 Stack Buffer OverflowAttackers can supply components with mistyped component-model-async callback functions to overwrite return addresses, crashing the host or escaping the sandbox.CriticalCVE-2026-115377lxc · incusIncus before 6.0.7, 6.1.0 before 7.0.2, and 7.1.0 before 7.5.0 Arbitrary File Write via Symlink in Migration StreamAttackers can craft rsync or btrfs receive streams with a symlink such as rootfs pointing to the host root, writing files as root for full host compromise.CriticalCVE-2026-115375lxc · incusIncus 7.0.0 before 7.0.2 and 7.1.0 before 7.5.0 Path Traversal via Instance Backup Dependent VolumesThe flaw stems from unvalidated dependent custom volume names in instance backup index.yaml files. Attackers can import a crafted instance backup with ../ sequences in dependent volume names to create root-owned directories with controlled content, leading to full host compromise.