CERT-Bund (BSI CSAF)
advisoryDEcert_bund
CERT-Bund, Germany's national CERT at the BSI — publishes CSAF 2.0 security advisories (WID-SEC-…) coordinating vendor and product vulnerabilities.
01
advisories (13,984)
Vendor and ecosystem advisories describing this.
- WID-SEC-W-2026-4117
- WID-SEC-W-2026-4054
- WID-SEC-W-2026-4055
- WID-SEC-W-2026-4056
- WID-SEC-W-2026-4057
- WID-SEC-W-2026-4058
- WID-SEC-W-2026-4059
- WID-SEC-W-2026-4060
- WID-SEC-W-2026-4061
- WID-SEC-W-2026-4062
- WID-SEC-W-2026-4063
- WID-SEC-W-2026-4064
- WID-SEC-W-2026-4065
- WID-SEC-W-2026-4066
- WID-SEC-W-2026-4067
- WID-SEC-W-2026-4068
- WID-SEC-W-2026-4069
- WID-SEC-W-2026-4070
- WID-SEC-W-2026-4071
- WID-SEC-W-2026-4072
showing 20 of 13,984
02
product assertions (23,193)
Products and version ranges known to be affected.
- A10 Networks ACOS <4.1.4-GR1-P3
- A10 Networks ACOS <5.0.0-P1
- ABB 800xA 5.1.x
- ABB 800xA 6.0.3.x
- ABB 800xA 6.1.1.x
- ABB 800xA 6.2.x
- ABB 800xA <=7.0
- ABB 800xA AC800M CI868 <6.1.1
- ABB 800xA AC800M CI868 <7.0
- ABB AC-500 <2.5.3
- ABB AC-500 <3.8.0
- ABB AC-500 <3.9.1
- ABB AC-500 V3 <3.8.0
- ABB AC-500 v3 3.90
- ABB Relion 630 <1.1.0.C5
- ABB Relion 630 <1.2.0.B8
- ABB Relion 630 <1.3.0.B1
- ABB Symphony Melody Plus MR PM 877 <3.53
- AMD Prozessor
- AMD Prozessor Arm Trusted Firmware for Cortex-A processors <2025.2
showing 20 of 23,193
03
CVE links (81,020)
Known CVEs related to this entry.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-106074US | —OT elevated | Exploit | ||
A flaw in Node.js `crypto` causes the internal entropy caches used by `crypto.randomUUID()`, `crypto.randomUUIDv7()`, and `crypto.randomInt()` to be saved into user-land startup sn… | ||||
| CVE-2026-106073US | — | Exploit | ||
A flaw in Node.js Permission Model filesystem enforcement leaves `fs.realpathSync()` without the required read permission checks. This is an incomplete fix of CVE-2026-21715, which… | ||||
| CVE-2026-106072US | — | Exploit | ||
A flaw in Node.js TLS hostname verification allows a certificate with only a DNS SAN to authenticate an IP endpoint when the client connects using a non-canonical IPv4 spelling, su… | ||||
| CVE-2026-106071US | — | Exploit | ||
A flaw in Node.js Permission Model filesystem enforcement can grant access to paths that do not match a wildcard `--allow-fs-read` or `--allow-fs-write` rule.
When the requested p… | ||||
| CVE-2026-106070US | — | Exploit | ||
A flaw in the Node.js `zlib.ZipFile` API can cause it to return bytes that do not belong to the requested entry after the local and central header validation fails.
When `zipEntry… | ||||
| CVE-2026-106069US | — | Exploit | ||
A flaw in Node.js TLS hostname verification can cause a server certificate to be validated against a different IP address than the one the client connected to, when the host is a n… | ||||
| CVE-2026-105483US | — | Exploit | ||
A flaw in Node.js TLS hostname verification allows a certificate without a matching IP address SAN to authenticate a connection to an IPv4 address when the host is written with non… | ||||
| CVE-2026-105482US | — | Exploit | ||
A flaw in Node.js DNS resolution allows hostnames containing a NUL byte to be silently truncated by the dns.resolve*() functions and dns.reverse(). This is an incomplete fix of CVE… | ||||
| CVE-2026-105481US | — | Exploit | ||
A flaw in Node.js HTTP Agent connection reuse can cause a client to accept as valid a response that was sent before the client has sent the request. This is an incomplete fix of CV… | ||||
| CVE-2026-49442US | — | — | ||
Cacti is an open source performance and fault management framework. Prior to version 1.2.31, a User Enumeration vulnerability allows an attacker to identify valid usernames on the… | ||||
| CVE-2026-46531US | — | — | ||
Cacti is an open source performance and fault management framework. From version 1.2.27 to before version 1.2.31, Cacti contains an authenticated stored second-order SQL injection… | ||||
| CVE-2026-39902US | — | Exploit | ||
Cacti is an open source performance and fault management framework. Prior to version 1.2.31, the prior blocklist ([;&| `$\\n\r]) omitted single-quote, double-quote, redirect operat… | ||||
| CVE-2026-111497US | — | Exploit | ||
A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to co… | ||||
| CVE-2026-96398US | —OT elevated | — | ||
Incorrect Authorization vulnerability in Drupal Webform allows Forceful Browsing. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1. | ||||
| CVE-2026-96392US | — | — | ||
Improper Neutralization of Special Elements Used in a Template Engine vulnerability in Drupal AI CKEditor allows Code Injection. This issue affects AI CKEditor versions: from 0.0.0… | ||||
| CVE-2026-96391US | —OT elevated | — | ||
Missing Authorization vulnerability in Drupal Webform REST allows Forceful Browsing. This issue affects Webform REST versions: from 0.0.0 to 4.2.1. | ||||
| CVE-2026-96390US | — | — | ||
Privilege Defined With Unsafe Actions vulnerability in Drupal Editoria11y Accessibility Checker allows Privilege Escalation. This issue affects Editoria11y Accessibility Checker ve… | ||||
| CVE-2026-96388US | — | — | ||
Cross-Site Request Forgery (CSRF) vulnerability in Drupal Tawk.to - Live chat application allows Cross Site Request Forgery. This issue affects Tawk.to - Live chat application vers… | ||||
| CVE-2026-96387US | —OT elevated | — | ||
Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Stop administrator login allows Authentication Bypass. This issue affects Stop administrator login… | ||||
| CVE-2026-96386US | —OT elevated | — | ||
Missing Authorization vulnerability in Drupal Smart Content allows Forceful Browsing. This issue affects Smart Content versions: from 0.0.0 to 3.2.1. | ||||
showing 20 of 81,020