Base de CVEs

CVE-2026-26161 Alta · 7.8 CWE-20 14/04/2026

Windows Sensor Data Service Elevation of Privilege Vulnerability

Untrusted pointer dereference in Windows Sensor Data Service allows an authorized attacker to elevate privileges locally.

CVE-2026-26156 Alta · 7.8 CWE-20 14/04/2026

Windows Hyper-V Remote Code Execution Vulnerability

Heap-based buffer overflow in Windows Hyper-V allows an unauthorized attacker to execute code locally.

CVE-2026-26154 Alta · 7.5 CWE-20 14/04/2026

Windows Server Update Service (WSUS) Tampering Vulnerability

Improper input validation in Windows Server Update Service allows an unauthorized attacker to perform tampering over a network.

CVE-2026-26143 Alta · 7.8 CWE-20 14/04/2026

Microsoft PowerShell Security Feature Bypass Vulnerability

Improper input validation in Microsoft PowerShell allows an unauthorized attacker to bypass a security feature locally.

CVE-2026-39417 Média · 5.5 CWE-20 13/04/2026

MaxKB: RCE via MCP stdio command injection in workflow engine

MaxKB is an open-source AI assistant for enterprise. Versions 2.7.1 and below contain an incomplete fix for CVE-2025-53928, where a Remote Code Execution vulnerability still exists in the MCP node of the workflow engine. MaxKB only restricts the referencing code path (loading MCP config from the database). The else branch, responsible for loading mcp_servers directly from user-supplied JSON remains completely unpatched. Since mcp_source is an optional field (required=False), an attacker can simply omit it or set it to any non-referencing value to bypass the fix. By calling the workflow creation API directly with a crafted JSON payload, an attacker can inject a complete MCP node configuration with stdio transport, arbitrary command, and args — achieving RCE when the workflow is triggered via chat. This issue has been fixed in version 2.8.0.

CVE-2026-33948 Média · 5.3 CWE-20 13/04/2026

jq: Embedded-NUL Truncation in CLI JSON Input Path Causes Prefix-Only Validation of Malformed Input

jq is a command-line JSON processor. Commits before 6374ae0bcdfe33a18eb0ae6db28493b1f34a0a5b contain a vulnerability where CLI input parsing allows validation bypass via embedded NUL bytes. When reading JSON from files or stdin, jq uses strlen() to determine buffer length instead of the actual byte count from fgets(), causing it to truncate input at the first NUL byte and parse only the preceding prefix. This enables an attacker to craft input with a benign JSON prefix before a NUL byte followed by malicious trailing data, where jq validates only the prefix as valid JSON while silently discarding the suffix. Workflows relying on jq to validate untrusted JSON before forwarding it to downstream consumers are susceptible to parser differential attacks, as those consumers may process the full input including the malicious trailing bytes. This issue has been patched by commit 6374ae0bcdfe33a18eb0ae6db28493b1f34a0a5b.

CVE-2026-22565 Alta · 7.5 CWE-20 13/04/2026

Improper Input Validation em Ubiquiti Inc UniFi Play PowerAmp

An Improper Input Validation vulnerability could allow a malicious actor with access to the UniFi Play network to cause the device to stop responding.  Affected Products: UniFi Play PowerAmp (Version 1.0.35 and earlier)  UniFi Play Audio Port (Version 1.0.24 and earlier)  Mitigation: Update UniFi Play PowerAmp to Version 1.0.38 or later  Update UniFi Play Audio Port to Version 1.1.9 or later

CVE-2026-22563 Crítica · 9.8 CWE-20 13/04/2026

Injeção de Comando no UniFi Play via Validação Imprópria de Entrada

Uma série de vulnerabilidades de Validação Imprópria de Entrada podem permitir uma Injeção de Comando por um agente malicioso com acesso à rede UniFi Play. Produtos Afetados: UniFi Play PowerAmp (Versão 1.0.35 e anteriores) UniFi Play Audio Port (Versão 1.0.24 e anteriores). Mitigação: Atualize o UniFi Play PowerAmp para a Versão 1.0.38 ou posterior. Atualize o UniFi Play Audio Port para a Versão 1.1.9 ou posterior.

CVE-2026-6231 Alta · 7.5 CWE-20 13/04/2026

bson_validate may skip validation when processing certain inputs

The bson_validate function may return early on specific inputs and incorrectly report success. This behavior could result in skipping validation for BSON data, allowing malformed or invalid UTF-8 sequences to bypass validation and be processed incorrectly. The issue may affect applications that rely on these functions to validate untrusted BSON data before further processing. This issue affects MongoDB C Driver versions prior to 1.30.5, MongoDB C Driver version 2.0.0 and MongoDB C Driver version 2.0.1

CVE-2026-34855 Média · 5.7 CWE-20 13/04/2026

Out-of-bounds write vulnerability in the kernel module. Impact: Successful exploitation of this...

Out-of-bounds write vulnerability in the kernel module. Impact: Successful exploitation of this vulnerability will affect availability and confidentiality.

CVE-2026-40162 Alta · 7.1 CWE-20 10/04/2026

Bugsink affected by authenticated arbitrary file write in artifactbundle/assemble

Bugsink is a self-hosted error tracking tool. In 2.1.0, an authenticated file write vulnerability was identified in Bugsink 2.1.0 in the artifact bundle assembly flow. A user with a valid authentication token could cause the application to write attacker-controlled content to a filesystem location writable by the Bugsink process. This vulnerability is fixed in 2.1.1.

CVE-2026-5500 Média · 5.9 CWE-20 10/04/2026

Improper Validation of AES-GCM Authentication Tag Length in PKCS#7 Envelope Allows Authentication Bypass

wolfSSL's wc_PKCS7_DecodeAuthEnvelopedData() does not properly sanitize the AES-GCM authentication tag length received and has no lower bounds check. A man-in-the-middle can therefore truncate the mac field from 16 bytes to 1 byte, reducing the tag check from 2⁻¹²⁸ to 2⁻⁸.

CVE-2026-33797 Alta · 7.4 CWE-20 09/04/2026

Junos OS and Junos OS Evolved: An attacker sending a specific genuine BGP packet causes a BGP reset

An Improper Input Validation vulnerability in Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated, adjacent attacker, sending a specific genuine BGP packet in an already established BGP session to reset only that session causing a Denial of Service (DoS). An attacker repeatedly sending the packet will sustain the Denial of Service (DoS).This issue affects Junos OS: * 25.2 versions before 25.2R2 This issue does not affect Junos OS versions before 25.2R1. This issue affects Junos OS Evolved: * 25.2-EVO versions before 25.2R2-EVO This issue does not affect Junos OS Evolved versions before 25.2R1-EVO. eBGP and iBGP are affected. IPv4 and IPv6 are affected.

CVE-2026-32990 Média · 5.3 CWE-20 09/04/2026

Apache Tomcat: Fix for CVE-2025-66614 is incomplete

Improper Input Validation vulnerability in Apache Tomcat due to an incomplete fix of CVE-2025-66614. This issue affects Apache Tomcat: from 11.0.15 through 11.0.19, from 10.1.50 through 10.1.52, from 9.0.113 through 9.0.115. Users are recommended to upgrade to version 11.0.20, 10.1.53 or 9.0.116, which fix the issue.

CVE-2026-5329 Média · 6.5 CWE-20 09/04/2026

Rapid7 Velociraptor Improper Input Validation in Client Message Handler

Rapid7 Velociraptor versions prior to 0.76.2 contain an improper input validation vulnerability in the client monitoring message handler on the Velociraptor server (primarily Linux) that allows an authenticated remote attacker to write to arbitrary internal server queues via a crafted monitoring message with a malicious queue name. The server handler that receives client monitoring messages does not sufficiently validate the queue name supplied by the client, allowing a rogue client to write arbitrary messages to privileged internal queues. This may lead to remote code execution on the Velociraptor server. Rapid7 Hosted Velociraptor instances are not affected by this vulnerability.

CVE-2026-34178 Crítica · 9.1 CWE-20 09/04/2026

Importing a crafted backup leads to project restriction bypass

In Canonical LXD before 6.8, the backup import path validates project restrictions against backup/index.yaml in the supplied tar archive but creates the instance from backup/container/backup.yaml, a separate file in the same archive that is never checked against project restrictions. An authenticated remote attacker with instance-creation permission in a restricted project can craft a backup archive where backup.yaml carries restricted settings such as security.privileged=true or raw.lxc directives, bypassing all project restriction enforcement and allowing full host compromise.

CVE-2026-5919 Média · 6.5 CWE-20 08/04/2026