|
2991
|
7.5 |
HIGH
Network
|
mosaic5g
|
flexric
|
FlexRIC v2.0.0 crashes when the iApp receives an E42_RIC_SUBSCRIPTION_REQUEST referencing a non-existent E2 Node. The lookup function returns NULL, which is enforced by assert() in Debug builds (SIGA…
|
CWE-476
NULL Pointer Dereference
|
CVE-2026-37226
|
2026-06-4 02:16 |
2026-06-2 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
2992
|
7.5 |
HIGH
Network
|
mosaic5g
|
flexric
|
FlexRIC v2.0.0 contains a reachable assertion in e2ap_recv_sctp_msg() (src/lib/ep/e2ap_ep.c). The function allocates a fixed 32KB receive buffer and enforces assert(rc < len) on the sctp_recvmsg() re…
|
CWE-617
Reachable Assertion
|
CVE-2026-37228
|
2026-06-4 02:16 |
2026-06-2 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
2993
|
7.5 |
HIGH
Network
|
mosaic5g
|
flexric
|
FlexRIC v2.0.0 contains a reachable assertion in e2ap_create_pdu() triggered when ASN.1 PER decoding fails. A remote unauthenticated attacker can send any non-PER byte sequence (e.g., a single 0x00 b…
|
CWE-617
Reachable Assertion
|
CVE-2026-37229
|
2026-06-4 02:16 |
2026-06-2 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
2994
|
7.5 |
HIGH
Network
|
mosaic5g
|
flexric
|
FlexRIC v2.0.0 crashes when the near-RT RIC receives a RIC_INDICATION message with a ran_func_id that does not exist in its registry. The lookup returns NULL, triggering assert() in Debug builds (SIG…
|
CWE-476
NULL Pointer Dereference
|
CVE-2026-37230
|
2026-06-4 02:16 |
2026-06-2 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
2995
|
7.5 |
HIGH
Network
|
mosaic5g
|
flexric
|
FlexRIC v2.0.0 uses a uint16_t counter for xapp_id assignment but stores the value in uint32_t message fields. After 65,530+ E42_SETUP_REQUESTs, the 16-bit counter wraps around and produces duplicate…
|
CWE-191
Integer Underflow (Wrap or Wraparound)
|
CVE-2026-37231
|
2026-06-4 02:16 |
2026-06-2 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
2996
|
7.5 |
HIGH
Network
|
mosaic5g
|
flexric
|
FlexRIC v2.0.0 contains an authorization bypass in the iApp's xApp isolation mechanism. The equality function eq_xapp_ric_gen_id() in src/ric/iApp/xapp_ric_id.c compares m0->xapp_id against itself (m…
|
CWE-617
Reachable Assertion
|
CVE-2026-37233
|
2026-06-4 02:16 |
2026-06-2 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
2997
|
7.5 |
HIGH
Network
|
mosaic5g
|
flexric
|
FlexRIC v2.0.0 trusts the xapp_id field from E42 message payloads without binding it to the sender's SCTP association. The validation function valid_xapp_id() only checks that the value is within the…
|
CWE-284
Improper Access Control
|
CVE-2026-37235
|
2026-06-4 02:15 |
2026-06-2 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
2998
|
6.5 |
MEDIUM
Network
|
nextcloud
|
nextcloud_server
|
Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 31.0.0 to before 31.0.14, and 32.0.0 to before 32.0.4, if {lang} is used in the template directory config…
|
CWE-22
Path Traversal
|
CVE-2026-45279
|
2026-06-4 02:15 |
2026-06-2 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
2999
|
8.1 |
HIGH
Network
|
nextcloud
|
nextcloud_server
|
Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 32.0.0 to before 32.0.9, and 33.0.0 to before 33.0.3, with the knowledge of other users’ principal URL an…
|
CWE-639
Authorization Bypass Through User-Controlled Key
|
CVE-2026-45281
|
2026-06-4 02:11 |
2026-06-2 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
3000
|
8.1 |
HIGH
Network
|
jupyter
|
jupyter_server
|
A path traversal vulnerability exists in jupyter-server version 2.17.0 due to an incorrect root directory boundary check in the _get_os_path() function within jupyter_server/services/contents/fileio.…
|
CWE-23
Relative Path Traversal
|
CVE-2026-5422
|
2026-06-4 02:09 |
2026-06-2 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
