mirror of
https://github.com/trickest/cve.git
synced 2026-11-07 12:38:17 -10:00
Update Mon Oct 5 13:14:12 UTC 2026
This commit is contained in:
trickest-workflows committed
1 parent
4a2278d3f3
commit
325fdd80f7
189 files changed
+3404
-1
No files matched your search
@@ -10,6 +10,7 @@ OTFCC commit 617837b was discovered to contain a heap buffer overflow via /relea
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://drive.google.com/file/d/1OgmLjZ9VnEbzFh8tqyhPlVGJtdrhgfWz/view?usp=sharing
|
||||
- https://github.com/Cvjark/Poc/blob/main/otfcc/CVE-2022-35056.md
|
||||
|
||||
#### Github
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2024-31027](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-31027)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
Cross Site Scripting vulnerability in Greek Universities Network (GUnet) Open eClass Platform v.3.15 allows a remote attacker to execute arbitrary code via the last name, first name, and username parameters in the user registration functionality.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://panagiotiscp.github.io/cve-2024-31027-stored-xss-user-info/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -12,6 +12,7 @@ Eine kritische Schwachstelle wurde in SourceCodester Best House Rental Managemen
|
||||
|
||||
#### Reference
|
||||
- https://github.com/para-paradise/webray.com.cn/blob/main/Best%20house%20rental%20management%20system%20project%20in%20php/Best%20house%20rental%20management%20system%20signup%20time-based%20SQL%20Injection%20Vulnerability.md
|
||||
- https://vuldb.com/?id.278210
|
||||
- https://vuldb.com/?submit.411471
|
||||
- https://www.sourcecodester.com/
|
||||
|
||||
|
||||
@@ -5,7 +5,7 @@
|
||||
|
||||
### Description
|
||||
|
||||
Missing Authorization vulnerability in Dimitri Grassi Salon booking system salon-booking-system allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Salon booking system: from n/a through 10.31.8.
|
||||
Missing Authorization vulnerability in Dimitri Grassi Salon booking system salon-booking-system allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Salon booking system: from n/a through 10.31.9.
|
||||
|
||||
### POC
|
||||
|
||||
|
||||
@@ -0,0 +1,18 @@
|
||||
### [CVE-2026-100102](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-100102)
|
||||
&color=blue)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
Perforce P4 Search container images prior to 2026.4.2 enable an unauthenticated Java debug interface. An attacker with network access to this interface can execute arbitrary code as the P4 Search service account, potentially leading to compromise of the connected P4 Server.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://portal.perforce.com/s/cve/a91Qi000003FE7NIAW/rce-via-exposed-jdwp-debug-agent-in-p4search
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,18 @@
|
||||
### [CVE-2026-100103](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-100103)
|
||||
&color=blue)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
Perforce P4 Search container images prior to 2026.4.2 reset the service authentication token to a publicly documented default value. An unauthenticated attacker with network access can obtain the highest application privilege, potentially leading to arbitrary code execution and compromise of the connected P4 Server.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://portal.perforce.com/s/cve/a91Qi000003FE8zIAG/authentication-bypass-via-default-auth-token-in-p4search
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,18 @@
|
||||
### [CVE-2026-103262](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-103262)
|
||||
|
||||
|
||||
|
||||
&color=brightgreen)
|
||||
|
||||
### Description
|
||||
|
||||
Tornado versions before 6.5.9 contain an unbounded memory accumulation vulnerability in CurlAsyncHTTPClient that allows remote attackers to cause denial of service by sending a compressed response. Attackers can send a gzip-encoded decompression bomb that accumulates in memory without size limits, causing the application process to be killed by out-of-memory conditions.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/tornadoweb/tornado/security/advisories/GHSA-chx6-46f5-w4vp
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,18 @@
|
||||
### [CVE-2026-103507](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-103507)
|
||||
&color=blue)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
Perforce P4 Search prior to 2026.4.2 does not restrict file paths written through its logging configuration interface. An attacker holding the service authentication token can write arbitrary files on the host, potentially leading to code execution as the P4 Search service account.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://portal.perforce.com/s/cve/a91Qi000003FE49IAG/arbitrary-filewrite-via-log-configuration-path-in-p4search
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,18 @@
|
||||
### [CVE-2026-103510](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-103510)
|
||||
&color=blue)
|
||||
|
||||
|
||||
&color=brightgreen)
|
||||
|
||||
### Description
|
||||
|
||||
P4 Search prior to 2026.4.2 does not fail securely when its service authentication token is blank. In affected configurations, an unauthenticated attacker with network access can obtain the highest application privilege, potentially leading to compromise of P4 Search and the connected P4 Server.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://portal.perforce.com/s/cve/a91Qi000003FDw5IAG/authentication-bypass-via-blank-auth-token-in-p4search
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,18 @@
|
||||
### [CVE-2026-103511](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-103511)
|
||||
&color=blue)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
Perforce P4 Search prior to 2026.4.2 does not validate file names supplied to its extension installation feature. An attacker with super-user or service-token privileges can write files with arbitrary content to the P4 Search installation directory.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://portal.perforce.com/s/cve/a91Qi000003FDpdIAG/arbitrary-filewrite-via-extension-installation-in-p4search
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,18 @@
|
||||
### [CVE-2026-103512](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-103512)
|
||||
&color=blue)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
Perforce P4 Search prior to 2026.4.2 trusts a client-supplied address when validating certain authentication requests. An attacker holding a stolen P4 Server ticket can bypass host-based ticket restrictions and trusted-address controls, gaining access to P4 Search as the ticket's owner.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://portal.perforce.com/s/cve/a91Qi000003FDo1IAG/ticket-hostbinding-bypass-via-spoofed-client-ip-in-p4search
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,19 @@
|
||||
### [CVE-2026-104056](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-104056)
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
Authlib version 1.7.2 and below contains a vulnerability where discovery JSON metadata is cached without validation or issuer-origin binding. This allows a poisoned discovery response to replace all endpoint values with attacker-controlled values rather than endpoint URLs that share the origin of the configured server metadata URL.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://uziii2208.github.io/post/cve-2026-104056/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,30 @@
|
||||
### [CVE-2026-105174](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-105174)
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A vulnerability has been found in Gerapy up to 0.9.13. This vulnerability affects the function project_create of the file gerapy/server/core/views.py of the component Project Management. The manipulation of the argument project_name leads to path traversal. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used. The identifier of the patch is 6e481078cfba6388a67ca2d9792288405019ba3e. Applying a patch is the recommended action to fix this issue.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/Gerapy/Gerapy/issues/317
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-13607](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13607)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
The File Uploads Addon for WooCommerce WordPress plugin through 1.7.6 stores customer-uploaded files in a publicly web-accessible uploads directory and the access restriction it generates is ineffective, so an unauthenticated attacker who knows or guesses a file's name can retrieve customer-uploaded files directly, bypassing the File Uploads Addon for WooCommerce WordPress plugin through 1.7.6's authenticated download mechanism.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://wpscan.com/vulnerability/6eb71c2f-5060-42ed-9a8f-c7ade01e32a9/
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,18 @@
|
||||
### [CVE-2026-16376](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-16376)
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
Denial-of-service in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://bugzilla.mozilla.org/show_bug.cgi?id=2035733
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,18 @@
|
||||
### [CVE-2026-16395](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-16395)
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
Integer overflow in the Audio/Video component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://bugzilla.mozilla.org/show_bug.cgi?id=2047221
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-17052](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-17052)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
The Time-aware GPIO syscall verification handler z_vrfy_tgpio_pin_read_ts_ec() in drivers/timeaware_gpio/timeaware_gpio_handlers.c validated only the port device object and passed the caller-supplied timestamp and event_count output pointers to the driver without a K_SYSCALL_MEMORY_WRITE() check. The other handlers in the same file (z_vrfy_tgpio_port_get_time(), z_vrfy_tgpio_port_get_cycles_per_second()) already performed that check, so the omission left one syscall unguarded.tgpio_pin_read_ts_ec() is declared __syscall, so with CONFIG_USERSPACE=y an unprivileged user-mode thread that has been granted access to the TGPIO device object can invoke it with arbitrary pointer values. tgpio_intel_read_ts_ec() in drivers/timeaware_gpio/timeaware_gpio_intel.c bounds-checks only the pin index and then unconditionally performs timestamp = ... and event_count = ..., executing two 8-byte stores in supervisor mode at addresses chosen by the user-mode caller.The result is a write-what-where primitive that crosses the userspace/kernel boundary: the target address is fully attacker-chosen and the stored values are the hardware time-capture and event-counter register contents. Corrupting kernel data structures this way can escalate the calling thread to supervisor privilege or crash the system; the device-object permission required is a narrow capability that is not intended to confer any kernel-memory access. The fix adds the two missing K_SYSCALL_MEMORY_WRITE() validations before the driver call.Exposure is narrow in practice. Only builds with CONFIG_USERSPACE=y and CONFIG_TIMEAWARE_GPIO=y compile the affected file, and from v3.6.0 onward the file additionally referenced a relocated header (<zephyr/syscall_handler.h>) and removed Z_SYSCALL_* macros, so such a configuration failed to build until those were repaired after v4.4.0. Downstream trees that locally corrected that breakage, and v3.5.0 builds where it did not exist, are the exposed population.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-8qw6-x76h-8mpc
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-17053](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-17053)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
The SMBus driver API exposed smbus_smbalert_remove_cb() and smbus_host_notify_remove_cb() as Zephyr syscalls. Their verifiers in drivers/smbus/smbus_handlers.c validated only the dev argument with K_SYSCALL_OBJ(dev, K_OBJ_DRIVER_SMBUS) and forwarded the caller-supplied struct smbus_callback *cb pointer into kernel-mode driver code without any K_SYSCALL_MEMORY_READ/K_SYSCALL_MEMORY_WRITE validation. A companion change in 2023 had already removed the matching smbus_smbalert_set_cb() / smbus_host_notify_set_cb() syscalls for this reason, but the two removal syscalls were left exposed.On a build with CONFIG_USERSPACE=y, CONFIG_SMBUS=y and a driver implementing the callback operations (drivers/smbus/intel_pch_smbus.c with CONFIG_SMBUS_INTEL_PCH_SMBALERT/CONFIG_SMBUS_INTEL_PCH_HOST_NOTIFY, or drivers/smbus/smbus_stm32.c with CONFIG_SMBUS_STM32_SMBALERT), any user-mode thread that has been granted the SMBus device object can invoke these syscalls with an arbitrary pointer. The value reaches smbus_callback_remove() in drivers/smbus/smbus_utils.h, which uses it as a node identity against the kernel's sys_slist_t of registered callbacks.The consequence is that an unprivileged thread can unregister an SMBALERT or Host Notify callback that a supervisor-mode component registered, silently disabling alert handling for the rest of the system; because Zephyr images have fixed symbol addresses and the syscall returns 0 on a hit versus -ENOENT on a miss, the target address is both derivable and searchable. In builds with CONFIG_ASSERT=y the __ASSERT(callback->handler, ...) check additionally dereferences the caller-supplied address in supervisor mode, so a bogus pointer raises a kernel-mode fault and a fatal system error, and the fault/no-fault outcome discloses which addresses are mapped.The fix removes both syscall entry points, demoting the two functions to ordinary static inline calls so that callback list manipulation is available only to supervisor-mode code. There is no impact on builds without CONFIG_USERSPACE, and no impact on configurations that do not enable an SMBus driver with SMBALERT or Host Notify support.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-hqh5-956f-5x2r
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,20 @@
|
||||
### [CVE-2026-17545](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-17545)
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
On Windows, PHP's filesystem and stream APIs do not reject reserved device names such as CON, PRN, AUX, NUL, COM1 to COM9, LPT1 to LPT9, CONIN$ and CONOUT$ when they appear as a component of a path. An attacker-controlled filename therefore reaches CreateFileW() and opens a device instead of the regular file the application expected, which can block or hang the request and exhaust worker processes.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/php/php-src/security/advisories/GHSA-9f67-6fw4-hpfp
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-42323](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42323)
|
||||
|
||||
|
||||
&color=brightgreen)
|
||||
|
||||
### Description
|
||||
|
||||
Piwigo is a full featured open source photo gallery application for the web. Prior to 16.4.0, admin/batch_manager.php accepts administrator-controlled dimension width, height, and ratio values and filesize values from the Batch Manager filter URL without numeric validation. The URL filter parser stores those values in the bulk_manager_filter session state, and later query construction concatenates them into SQL predicates, unlike the validated POST filter path. An authenticated administrator can use crafted filter values to execute time-based or other SQL expressions and potentially disclose, modify, or disrupt database data. This issue is fixed in version 16.4.0.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/Piwigo/Piwigo/security/advisories/GHSA-7r67-9xhq-7p2c
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,18 @@
|
||||
### [CVE-2026-46343](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46343)
|
||||
|
||||
|
||||
|
||||
&color=brightgreen)
|
||||
|
||||
### Description
|
||||
|
||||
Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4.0.0 until 4.14.6 and 5.0.0-beta2, WazuhCommon.end_receiving_file() in framework/wazuh/core/cluster/common.py allows a cluster-authenticated node to delete files outside WAZUH_PATH. A syn_i_w_m_e request with an unknown task_id reaches the cleanup branch, where an attacker-controlled filename is passed to os.path.join without canonicalization or confinement. Absolute paths and traversal sequences can therefore target files such as ossec.conf, jwt_secret.json, TLS certificates, and ruleset files that are accessible to the Wazuh manager process. Deletion can disable the manager, invalidate API tokens, or disrupt cluster and API connectivity. This issue is fixed in versions 4.14.6 and 5.0.0-beta2.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/wazuh/wazuh/security/advisories/GHSA-cqvw-w2rg-327f
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-46649](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46649)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.2, Joplin Server's GET /api/login_with_code/:id endpoint accepts a nine-digit SSO authentication code with a ten-minute lifetime without applying limiterLoginBruteForce. An unauthenticated attacker who targets a user during an active SSO login can make unlimited guesses, and a correct code returns a full session token that permits access to and modification of the user's notes, notebooks, and account settings. This issue is fixed in version 3.7.2.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/laurent22/joplin/security/advisories/GHSA-6vwc-4hrg-qp5h
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-46711](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46711)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
Soft Machine is a Virtual Machine–based agentic development environment / Cloud OS. In versions 0.2.247 and prior, the workspace HTTP service that listens on 0.0.0.0:8080 inside each sm-ws-* Fly Machine exposes endpoints (/health, /file/<path>, /archive/<dir>) without any authentication or origin check. Any host that can reach TCP/8080 on a workspace can read arbitrary files under that workspace's /workspace root and download whole project trees as tar archives. Because every workspace shares the same Fly private 6PN and resolves all peer addresses via the unauthenticated _instances.internal TXT record, every other sm-ws-* machine on the same Fly app/org is a reachable, unauthenticated attacker — the trust boundary (workspace owner ↔ everyone-else) is missing. At time of publication, there are no publicly known patches.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/Soft-Machine-io/security/security/advisories/GHSA-h6g6-qr45-qmrr
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,20 @@
|
||||
### [CVE-2026-48521](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-48521)
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy's ProdClusterManagerFactory::allocateConnPool dereferences transport_socket_options while selecting an HTTP/3 connection pool without first checking whether the pointer is null. LoadBalancerContext implementations used by synthetic, mirror, health-check, and async-client calls can return no transport-socket options. With auto_config and HTTP/3 enabled, routine traffic reaching one of those contexts can crash an Envoy worker. The relevant scope boundary is that the affected branch requires HTTP/3 in the protocol set and a context that supplies no transport-socket options. This issue is fixed in versions 1.36.10, 1.37.6, 1.38.4, and 1.39.1.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/envoyproxy/envoy/security/advisories/GHSA-5vff-j9p4-38j3
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-48737](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-48737)
|
||||
|
||||
|
||||
&color=brightgreen)
|
||||
|
||||
### Description
|
||||
|
||||
pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev101, is_global_address in src/pyload/core/utils/web/check.py relies on Python's global-address classification without examining IPv4 destinations embedded in 6to4 or NAT64 IPv6 addresses. A low-privileged user can submit an IPv6 literal through parse_urls to the pre-resolution is_global_host guard. Because host_to_ip is pinned to AF_INET, that guard does not evaluate a hostname's AAAA result. Separately, curl resolves hostnames before the pycurl PREREQFUNC in src/pyload/core/network/http/http_request.py applies the same vulnerable is_global_address check to the actual connection address, so a transition-form AAAA result can be permitted even when it terminates at an embedded loopback, private, CGNAT, or link-local IPv4 address. Exploitation requires the pyLoad host to route the applicable transition mechanism, including 6to4 on affected Python 3.9 through 3.11 deployments or NAT64 on a network with a NAT64 gateway. Successful exploitation can enable internal-network reconnaissance, timing-based confirmation, limited service disruption, or cloud metadata disclosure where the wrapped address is routable. This issue is fixed in version 0.5.0b3.dev101.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/pyload/pyload/security/advisories/GHSA-m5x5-28jr-gpjj
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,20 @@
|
||||
### [CVE-2026-5013](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-5013)
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A vulnerability has been found in elecV2 elecV2P up to 3.8.3. Impacted is the function path.join of the file /store/:key. The manipulation of the argument URL leads to path traversal. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through an issue report but has not responded yet.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/elecV2/elecV2P/issues/199
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -11,6 +11,7 @@ A vulnerability was identified in code-projects Online Food Ordering System 1.0.
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://gist.github.com/HxH404/f7f1502ffc9f2aacc936a6e8f290b6a5
|
||||
- https://vuldb.com/vuln/354189
|
||||
- https://vuldb.com/vuln/354189/cti
|
||||
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-54011](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-54011)
|
||||
|
||||
|
||||
&color=brightgreen)
|
||||
|
||||
### Description
|
||||
|
||||
Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.6,Open WebUI renders Mermaid blocks from Markdown files in the file preview panel and inserts the generated SVG into the DOM using innerHTML. Because Mermaid is configured with securityLevel: 'loose', attacker-controlled Mermaid content can be rendered unsafely in this flow. A working payload was validated through the Markdown preview path, resulting in JavaScript execution in the victim’s browser under the application origin. This vulnerability is fixed in 0.9.6.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/open-webui/open-webui/security/advisories/GHSA-v8qj-hxv7-mgvv
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,18 @@
|
||||
### [CVE-2026-54022](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-54022)
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.8.11, the ydoc:document:join Socket.IO handler checks note ownership only when the document_id starts with note: (colon). However, the YdocManager storage layer normalizes all document IDs by replacing colons with underscores (document_id.replace(":", "_")). An attacker can join a document room using note_<id> (underscore) instead of note:<id> (colon), bypassing the authorization check entirely while accessing the same underlying Yjs document. The server then returns the full document state, leaking the victim's private note contents. This vulnerability is fixed in 0.8.11.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/open-webui/open-webui/security/advisories/GHSA-8788-j68r-3cgh
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-54056](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-54056)
|
||||
|
||||
|
||||
&color=brightgreen)
|
||||
|
||||
### Description
|
||||
|
||||
Kitty is a cross-platform GPU based terminal. In versions 0.47.0 and 0.47.1, `kitten dnd` can allow a malicious remote drag-and-drop source to overwrite or truncate arbitrary files writable by the local kitty user. Remote `text/uri-list` drops are staged in a temporary directory, but on case-sensitive filesystems duplicate remote basenames are not de-duplicated. An attacker can first create a staged symlink and then send a same-name regular-file entry. The regular-file write uses `utils.CreateAt()` / `openat(O_RDWR|O_CREAT|O_TRUNC)` without `O_NOFOLLOW`, so it follows the attacker-created symlink and writes outside the staging directory before final overwrite confirmation runs. This appears related in class to the file-transfer symlink advisory, but it is a different bug: it affects `kitten dnd` remote drag-and-drop staging, uses different vulnerable code (`kittens/dnd/drop.go` and `tools/utils/file_at_fd.go`), and reproduces on commit `4aa4a5c0567a92553a8c20a88a4352da637fca5d`, after the file-transfer `O_NOFOLLOW` fix. Version 0.47.2 patches the issue.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/kovidgoyal/kitty/security/advisories/GHSA-r892-cv7q-fw8x
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,18 @@
|
||||
### [CVE-2026-54057](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-54057)
|
||||
|
||||
|
||||
|
||||
&color=brightgreen)
|
||||
|
||||
### Description
|
||||
|
||||
Kitty is a cross-platform GPU based terminal. In versions prior to 0.47.3, kitty's OSC 21 (color-control) query reply reflects attacker-controlled bytes, including newlines, into the shell's input without sanitization. Version 0.47.3 fixes the issue.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/kovidgoyal/kitty/security/advisories/GHSA-5gmr-9gwg-hhq6
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-54058](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-54058)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
Pillow is a Python imaging library. Prior to 12.3.0, when Pillow loads an uncompressed McIdas AREA image from a filename through the mmap raw codec path, attacker-controlled header words can set a row stride smaller than the natural row width, causing pixel access such as Image.tobytes(), getpixel, convert, or save to read beyond the mapped region and disclose adjacent process memory or fault. This issue is fixed in version 12.3.0.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/python-pillow/Pillow/security/advisories/GHSA-62p4-gmf7-7g93
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,19 @@
|
||||
### [CVE-2026-54066](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-54066)
|
||||
|
||||
|
||||
|
||||
&color=brightgreen)
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
SiYuan is an open-source personal knowledge management system. Prior to 3.7.0, the patch for CVE-2026-41894 ("Path Traversal via Double URL Encoding") sanitized the /export/ route but the identical root cause remains in the /assets/*path route. In publish mode (anonymous read-only HTTP endpoint, default port 6808), an unauthenticated remote attacker can read arbitrary files inside WorkspaceDir — including conf/conf.json (which contains the AccessAuthCode SHA256 hash, API token, and sync keys), temp/siyuan.db, temp/blocktree.db, and siyuan.log — by double-URL-encoding .. segments. This vulnerability is fixed in 3.7.0.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/siyuan-note/siyuan/security/advisories/GHSA-p4m3-mgmm-c664
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,18 @@
|
||||
### [CVE-2026-54090](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-54090)
|
||||
|
||||
|
||||
|
||||
&color=brightgreen)
|
||||
|
||||
### Description
|
||||
|
||||
File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Prior to 2.33.8, when a shell interpreter is configured (e.g. /bin/sh -c), the command allowlist can be bypassed through shell metacharacters. The allowlist validates only the first token of user input, but the entire raw string is handed to the shell — semicolons, pipes, backticks, and $() all work to chain arbitrary commands after a permitted one. This vulnerability is fixed in 2.33.8.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/filebrowser/filebrowser/security/advisories/GHSA-8c9q-7855-wfxq
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-54096](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-54096)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Prior to 2.63.7, `POST /api/share/<path>` accepts an authenticated request for an arbitrary path and stores a public share record without checking whether the target file currently exists. Later, when a file is created at that same path, the previously created public share immediately becomes valid and exposes the new file through `GET /api/public/dl/<hash>`. This vulnerability is fixed in 2.63.7.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/filebrowser/filebrowser/security/advisories/GHSA-3q2p-72cj-682c
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,19 @@
|
||||
### [CVE-2026-54164](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-54164)
|
||||
|
||||
|
||||
|
||||
|
||||
&color=brightgreen)
|
||||
|
||||
### Description
|
||||
|
||||
API Platform Core is a system to create hypermedia-driven REST and GraphQL APIs. In versions prior to 4.1.30, 4.2.26 and 4.3.12, the serializer's AbstractItemNormalizer does not validate the resource type returned when resolving relation IRIs, allowing type confusion where a resource of an unintended type can be silently assigned to a relation property. An attacker who can submit write requests (POST/PUT/PATCH) to an API Platform endpoint with writable relations can supply a relation IRI pointing to a resource of a different type than the relation's declared class. Because getResourceFromIri() does not pass an $operation to IriConverter::getResourceFromIri(), the is_a type guard at IriConverter.php:86 is skipped. For untyped relation properties (legacy @var-only style), the wrong-typed object is silently assigned, corrupting invariants and potentially feeding downstream logic that assumes the declared type (CWE-843). For typed properties (modern PHP 8.x), the substitution is blocked by Symfony's PropertyAccessor with an InvalidTypeException. This issue has been fixed in versions 4.1.30, 4.2.26 and 4.3.12.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/api-platform/core/security/advisories/GHSA-9rjg-x2p2-h68h
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-54232](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-54232)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
vLLM is an inference and serving engine for large language models (LLMs). Prior to 0.22.1, the vLLM Dockerfile is vulnerable to a dependency confusion attack through the flashinfer-jit-cache package. The package is installed from a custom index (flashinfer.ai/whl/) using --extra-index-url, but the package name was not registered on PyPI, and UV_INDEX_STRATEGY="unsafe-best-match" is set globally. An attacker who registers flashinfer-jit-cache on PyPI with version 0.6.11.post2 can execute arbitrary code as root during the Docker build and backdoor every resulting container image, enabling exfiltration of all user prompts, API credentials, and model data from production vLLM deployments This vulnerability is fixed in 0.22.1.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/vllm-project/vllm/security/advisories/GHSA-jrf6-vqxq-pjv2
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,18 @@
|
||||
### [CVE-2026-54234](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-54234)
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
vLLM is a high-throughput and memory-efficient inference and serving engine for LLMs. Prior to 0.24.0, a frontend-legal multi-request speculative decoding workload can cause the rejection sampler to produce a recovered token equal to the model vocabulary size boundary value, which is then converted to negative one when the engine selects the next live token for a request and is written back into the drafter's input ids; that out-of-vocabulary value is later consumed by the model's embedding and attention path and crashes the engine worker with a GPU device-side assertion. The same triggering request sequence is reachable through the public gRPC Generate and Abort endpoints, so a remote client that can send generation requests can crash the shared engine worker, aborting concurrent requests and causing a service-wide denial of service for other clients of the deployment until the worker is restarted. This issue is fixed in version 0.24.0.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/vllm-project/vllm/security/advisories/GHSA-8wr5-jm2h-8r4f
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,19 @@
|
||||
### [CVE-2026-54258](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-54258)
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
ZoneMinder is a free, open source closed-circuit television software application. Versions prior to 1.36.39, 1.38.4, and 1.39.11 allow an authenticated low-privileged user with coarse `Events=View` and/or `Snapshots=View` permissions to directly fetch media for events belonging to monitors they are not allowed to access. The normal UI correctly hides the restricted monitor and its events, but direct event media views accept an arbitrary `eid` and stream media from the event path without enforcing the event/monitor-level ACL. This exposes private surveillance footage across monitor boundaries. Versions 1.36.39, 1.38.4, and 1.39.11 fix the issue.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/ZoneMinder/zoneminder/security/advisories/GHSA-vj5r-pc2v-gfwv
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,18 @@
|
||||
### [CVE-2026-54272](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-54272)
|
||||
|
||||
|
||||
|
||||
&color=brightgreen)
|
||||
|
||||
### Description
|
||||
|
||||
ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Versions 10.1.1 through 10.2.0 are vulnerable to SSRF through misclassification of IPv4-mapped/NAT64 IPv6 addresses. Address6.getType() classifies an address by matching it against a table of known IPv6 special-use prefixes, returning Global unicast when nothing matches. That table had no entry for the IPv4-mapped range (::ffff:0:0/96), so every mapped address fell through to Global unicast; NAT64 addresses matched their own NAT64 … labels. The boolean checks isLoopback, isUnspecified, and isMulticast compared getType() against a fixed label and so returned false, while isLinkLocal and isULA checked only the native IPv6 ranges. The library already exposed isMapped4() and to4(), but did not apply them inside these checks, so a mapped or NAT64 address was never normalized to its embedded IPv4 address before classification. For IPv4-mapped addresses the host OS routes to the IPv4 stack, so the misclassification is reachable on any dual-stack host. For NAT64, the classification bypass is unconditional but end-to-end reachability additionally requires a NAT64/DNS64 gateway in the deployment network.This issue has been fixed in version 10.2.1.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/beaugunderson/ip-address/security/advisories/GHSA-22jq-vg5j-6vgg
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,19 @@
|
||||
### [CVE-2026-54297](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-54297)
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
Faraday is an HTTP client library abstraction layer that provides a common interface over many adapters. From 1.0.0 until 1.10.6 and 2.14.3, Faraday::NestedParamsEncoder, the default nested query parameter encoder/decoder in Faraday, decodes nested query strings without enforcing a maximum nesting depth. A crafted query string causes Faraday to build a deeply nested Ruby Hash structure. The internal dehash routine then recursively walks this attacker-controlled structure without a depth limit. At sufficient depth, Ruby raises an uncaught SystemStackError (stack level too deep), crashing the calling thread or worker. This can lead to denial of service in applications that pass attacker-controlled query strings to Faraday's nested query parsing or URL-building paths. This vulnerability is fixed in 1.10.6 and 2.14.3.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/lostisland/faraday/security/advisories/GHSA-98m9-hrrm-r99r
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-54355](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-54355)
|
||||
|
||||
|
||||
&color=brightgreen)
|
||||
|
||||
### Description
|
||||
|
||||
MapServer is a system for developing web-based GIS applications. From 6.0 until 8.6.4, MapServer's OpenLayers HTML output for SERVICE=WMS&REQUEST=GetMap&FORMAT=application/openlayers reflects an attacker-controlled X-Forwarded-Host value received as HTTP_X_FORWARDED_HOST through msBuildOnlineResource(), processLine(), and the [mapserv_onlineresource] substitution in src/maputil.c and src/maptemplate.c without escaping it for a single-quoted JavaScript string. When the deployment trusts the forwarded header and does not configure a fixed ows_onlineresource or MS_ONLINERESOURCE value, embedded single quotes can escape the generated URL string. An unauthenticated attacker can craft a URL that executes arbitrary JavaScript in the MapServer site origin when opened by a victim, enabling access to sessions or tokens, same-origin data and requests, and actions as the victim. This issue is fixed in version 8.6.4.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/MapServer/MapServer/security/advisories/GHSA-xqj6-vjqr-33vv
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,19 @@
|
||||
### [CVE-2026-54506](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-54506)
|
||||
|
||||
|
||||
|
||||
|
||||
&color=brightgreen)
|
||||
|
||||
### Description
|
||||
|
||||
Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.5, app/controller/user/profile.php accepts the user[bio] field and passes stored content through sanitizeHTML() in system/functions.php, whose on* event-handler regular expression omits the forward-slash delimiter and whose do-while condition compares the string to itself, so forbidden nested tags are removed only once. An Author-role or higher user can submit solidus-prefixed event-handler markup or nested forbidden tags that survive sanitization. The stored bio is rendered without sufficient output encoding on /author/{username}, in the admin user-management view, and potentially in comment displays, causing attacker-controlled JavaScript to execute when unauthenticated visitors, administrators, or other users view the content. This can expose browser-session data and permit victim-context account actions, defacement, or phishing. This issue is fixed in version 1.0.8.5.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/givanz/Vvveb/security/advisories/GHSA-5cg7-phhv-4qjr
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-54507](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-54507)
|
||||
|
||||
|
||||
&color=brightgreen)
|
||||
|
||||
### Description
|
||||
|
||||
Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.5, the oEmbedProxy() handler in admin/controller/editor/editor.php accepts an attacker-controlled url parameter and passes it to getUrl(), while validateUrl() in system/functions.php checks only the hostname string and does not validate its resolved addresses. An authenticated admin-panel user with editor/* permission can invoke GET /admin/index.php?module=editor/editor&action=oEmbedProxy with a dotted hostname or normalized loopback form that resolves to a private, loopback, link-local, or reserved address, causing the server to issue an HTTP or HTTPS request and return the response body. Storefront users and anonymous visitors cannot invoke the endpoint, but no CSRF token is required because the action uses GET. This can disclose internal service responses or cloud instance metadata and associated credentials. This issue is fixed in version 1.0.8.5.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/givanz/Vvveb/security/advisories/GHSA-xxp7-59p2-4jr8
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,20 @@
|
||||
### [CVE-2026-54512](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-54512)
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.10.0 until 2.18.8, 2.21.4, and 3.1.4, jackson-databind's PolymorphicTypeValidator (PTV) is the primary safety mechanism guarding polymorphic deserialization. When polymorphic typing is enabled and a type identifier contains generic parameters (i.e. the type ID string contains <), DatabindContext._resolveAndValidateGeneric() validates only the raw container class name (the substring before <) against the configured PTV. If the container type is approved, the method parses the full canonical type string via TypeFactory.constructFromCanonical() and returns the fully parameterized type without ever validating the nested type arguments against the PTV. The nested type arguments are then resolved, instantiated, and populated as beans during deserialization. An attacker who controls the type ID can therefore place a denied class as a generic type parameter of an allowed container — for example java.util.ArrayList<com.evil.Gadget> when only java.util.ArrayList is allow-listed. The container passes the PTV check; com.evil.Gadget is loaded via Class.forName(name, true, loader), instantiated, and its properties are set from attacker-controlled JSON. This completely bypasses an explicitly configured PTV allow-list. This vulnerability is fixed in 2.18.8, 2.21.4, and 3.1.4.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-j3rv-43j4-c7qm
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-54519](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-54519)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
AI Agent Automation is a modular AI agent workflow automation platform with schedulers, tools, and observability. Prior to 0.9.1, backend/src/controllers/memory.controller.js authenticates requests but listMemories, deleteMemory, and clearAgentMemory use a caller-supplied agentId or memory _id without verifying through the related Agent that the record belongs to req.user. An authenticated attacker who knows or obtains another user's identifiers can read victim AgentMemory content, including conversation history, agent context, task data, embeddings, and metadata, delete an individual victim memory, or clear all memory belonging to a victim agent. This breaks tenant isolation and causes unauthorized disclosure and data loss. This issue is fixed in version 0.9.1.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/vmDeshpande/ai-agent-automation/security/advisories/GHSA-qv97-83w4-ff86
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-54523](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-54523)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
Kyverno is a policy engine designed for cloud native platform engineering teams. From 1.18.0 until 1.18.2, the NamespacedMutatingPolicy CEL compiler exposes the generator library to matchConditions, allowing a namespace-scoped policy to invoke generator.apply(namespace, resources) with an arbitrary target namespace. The validation in pkg/cel/policies/mpol/validate.go checks that the policy compiles but does not enforce namespace scope, and GenerateResources in pkg/cel/libs/context.go does not reject the cross-namespace target. A user who can create NamespacedMutatingPolicy objects in one namespace can cause the admission controller, operating with cluster-wide privileges, to create ConfigMaps, NetworkPolicies, Secrets, RoleBindings, and other resources in another namespace, enabling unauthorized modification and potential privilege escalation. This issue is fixed in version 1.18.2.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/kyverno/kyverno/security/advisories/GHSA-79gf-7frw-68m9
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,18 @@
|
||||
### [CVE-2026-54526](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-54526)
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. Prior to 3.7.15 and 4.0.6, the allow-list fix for CVE-2026-31892 is incomplete because workflow/util/merge.go ValidateUserOverrides and SanitizeUserWorkflowSpec walk only the top-level fields of WorkflowSpec via reflection, and WorkflowSpec.ArtifactGC is allow-listed wholesale; the struct behind that field, WorkflowLevelArtifactGC, has a PodSpecPatch sub-field whose contents flow unmodified into util.ApplyPodSpecPatch on the artifact-GC pod, the same sink the original fix closed for WorkflowSpec.PodSpecPatch, so a user submitting a Workflow under templateReferencing: Strict or Secure (against a referenced WorkflowTemplate that declares an output artifact and setting spec.artifactGC.strategy: OnWorkflowCompletion) can still inject an arbitrary strategic merge patch into the artifact-GC pod, including hostPath volumes, privileged: true, arbitrary image and command, and hostNetwork: true, defeating the stated purpose of Strict/Secure reference mode. This issue is fixed in versions 3.7.15 and 4.0.6.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/argoproj/argo-workflows/security/advisories/GHSA-48p8-g2fx-3wwm
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-54527](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-54527)
|
||||
|
||||
|
||||
&color=brightgreen)
|
||||
|
||||
### Description
|
||||
|
||||
JupyterLab Git is a Git extension for JupyterLab. From 0.30.0b3 before 0.54.0, the PlainTextDiff.ts createHeader() method passes Git filenames directly to innerHTML when rendering renamed files in commit history, allowing a crafted filename to execute JavaScript when a victim views the rename diff in the Git History tab. This issue is fixed in version 0.54.0.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/jupyterlab/jupyterlab-git/security/advisories/GHSA-f962-v9hr-pfg5
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-54547](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-54547)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
Meta Ads MCP is a Model Context Protocol (MCP) server that lets AI assistants run Meta Ads. Prior to version 1.0.115, AuthInjectionMiddleware in meta_ads_mcp/core/http_auth_integration.py rejects HTTP MCP requests only when both auth_token and pipeboard_token are absent, while extract_token_from_headers() does not recognize X-Pipeboard-Token as a primary credential. A network caller using the streamable-http transport can therefore send any X-Pipeboard-Token value, pass the guard without establishing authentication context, and cause get_auth_token() to fall back to the server operator's META_ACCESS_TOKEN. Subsequent MCP tools execute with the operator's Meta credentials and can read or modify the operator's Meta Ads data. Deployments using the default stdio transport or without META_ACCESS_TOKEN are not affected. This issue is fixed in version 1.0.115.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/pipeboard-co/meta-ads-mcp/security/advisories/GHSA-2v2f-mvfg-ph56
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-54549](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-54549)
|
||||
|
||||
|
||||
&color=brightgreen)
|
||||
|
||||
### Description
|
||||
|
||||
Meta Ads MCP is a Model Context Protocol (MCP) server that lets AI assistants run Meta Ads. Prior to version 1.0.115, the upload_ad_image tool in meta_ads_mcp/core/ads.py passes an attacker-controlled image_url to try_multiple_download_methods() in meta_ads_mcp/core/utils.py, where httpx.AsyncClient uses follow_redirects=True and performs HTTP requests without validating the scheme, host, or resolved IP address. In a streamable-http deployment, a network caller can use any non-empty authorization value because Meta credential validation occurs after the image download, then direct the server to loopback services, private-network addresses, cloud metadata endpoints, or redirect-chained internal targets. The resulting server-side request forgery can expose internal data, invoke state-changing internal services, or disrupt reachable services. This issue is fixed in version 1.0.115.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/pipeboard-co/meta-ads-mcp/security/advisories/GHSA-45gf-fjxp-cjpq
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-54550](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-54550)
|
||||
|
||||
|
||||
&color=brightgreen)
|
||||
|
||||
### Description
|
||||
|
||||
IzPack is a widely used tool for packaging applications on the Java platform as cross-platform installers. In 5.2.6 and earlier, UnpackerBase.unpack() in izpack-installer/src/main/java/com/izforge/izpack/installer/unpacker/UnpackerBase.java obtains an attacker-controlled PackFile targetPath, passes it through IoHelper.translatePath(), which only converts separators, and constructs a File without normalizing parent-directory segments or enforcing destination containment. A malicious installer pack entry containing ../ sequences can therefore write outside the intended installation directory to startup folders, executable search paths, or other locations accessible with the victim's privileges when the victim runs the installer.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/izpack/izpack/security/advisories/GHSA-f63g-88cj-hjf9
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,20 @@
|
||||
### [CVE-2026-54565](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-54565)
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
&color=brightgreen)
|
||||
|
||||
### Description
|
||||
|
||||
rhwp is an HWP viewer and editor implemented in Rust and WebAssembly. Prior to rhwp 0.7.15 and rhwp Chrome and Firefox extension 0.2.4, the browser extensions use an all-URLs host permission to detect HWP and HWPX links on visited pages, but the service workers do not validate message senders, URL schemes, or destination addresses before privileged fetches. The affected paths are rhwp-chrome/manifest.json, rhwp-chrome/content-script.js, rhwp-chrome/sw/message-router.js, rhwp-chrome/sw/thumbnail-extractor.js, rhwp-firefox/manifest.json, rhwp-firefox/content-script.js, rhwp-firefox/sw/message-router.js, and rhwp-firefox/sw/thumbnail-extractor.js. An untrusted page can make the fetch-file and extract-thumbnail handlers request localhost or private-network resources. When a target HWP or HWPX file contains an extractable PrvImage, the extension returns the preview as a data URI in page-readable DOM, allowing page script to read it. The flaw also permits internal-resource existence and port probing and extension presence or version fingerprinting. Exploitation requires a user to visit an untrusted page while the extension is enabled, and preview disclosure is limited to an extractable PrvImage. This issue is fixed in rhwp 0.7.15 and rhwp Chrome and Firefox extension 0.2.4.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/edwardkim/rhwp/commit/e07b76ba79f42078c6cdf1045b58f894ec55bdf9
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,18 @@
|
||||
### [CVE-2026-54569](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-54569)
|
||||
|
||||
|
||||
|
||||
&color=brightgreen)
|
||||
|
||||
### Description
|
||||
|
||||
SENAITE.CORE is the core framework for the SENAITE laboratory information management system. From 2.0.0 to 2.6.0, the SENAITE.CORE JSON API permits unauthenticated remote code execution through a two-request chain involving missing authorization and unsafe evaluation. The state-changing routes in src/bika/lims/jsonapi/update.py, including update, update_many, remove, doActionFor, doActionFor_many, and getusers, do not enforce the senaite.core: Access JSON API permission before resolving attacker-selected objects. In src/bika/lims/jsonapi/init.py, set_fields_from_request passes raw request values for RecordsField and RecordField instances to eval() before field mutator write-permission checks execute. An anonymous attacker can discover the bika_setup object identifier through @@uuid, send a value such as RejectionReasons to /@@API/update, and execute arbitrary Python in the Zope worker before a later mutation failure rolls back ZODB changes. The same unsafe evaluation pattern is present in src/senaite/core/browser/fields/record.py and src/senaite/core/browser/fields/records.py. Successful exploitation can expose or modify laboratory data, files, and accounts and can disrupt the service.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/senaite/senaite.core/security/advisories/GHSA-jrw6-7x4q-w25j
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-54573](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-54573)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
Outline is a service that allows for collaborative documentation. Prior to 1.8.0, the AuthenticationHelper.canAccess function uses ctx.originalUrl to verify if an API key or OAuth token has the required scopes for a request. It extracts the resource by splitting the URL by / and taking the last segment. However, it fails to strip the URL fragment (#). Because Koa's router uses ctx.path (which strips the fragment) for routing, an attacker can append a fragment containing a permitted path (e.g., #foo/api/documents.info) to a restricted endpoint (e.g., /api/documents.create). The router will route the request to the restricted endpoint, but canAccess will evaluate the permitted path in the fragment, bypassing the API key scope restrictions and allowing privilege escalation. This vulnerability is fixed in 1.8.0.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/outline/outline/security/advisories/GHSA-5x79-rj4g-qrh8
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-54574](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-54574)
|
||||
|
||||
|
||||
%20Following&color=brightgreen)
|
||||
|
||||
### Description
|
||||
|
||||
proot-distro is a utility for managing proot containers. Prior to version 5.1.5, proot-distro install extracted plain tarball root filesystems through _extract_plain_tar() in proot_distro/commands/install.py and Docker layers through _apply_layer() in proot_distro/helpers/docker.py without validating archive-controlled symlink targets in member.linkname, allowing a malicious archive to plant an absolute host-path symlink and write files through it onto the host filesystem. This issue is fixed in version 5.1.5.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/termux/proot-distro/security/advisories/GHSA-9xq3-3fqg-4vg7
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,19 @@
|
||||
### [CVE-2026-54588](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-54588)
|
||||
|
||||
|
||||
|
||||
|
||||
&color=brightgreen)
|
||||
|
||||
### Description
|
||||
|
||||
Poweradmin is a web-based DNS administration tool for PowerDNS server. Versions prior to 4.2.4 and 4.3.3 use the attacker-controlled `HTTP_HOST` request header as the authoritative source for building callback URLs in its OIDC, SAML, and logout authentication flows without any validation. An unauthenticated attacker can poison the `redirect_uri` sent to the Identity Provider, causing the IdP to redirect the victim's authorization code to an attacker-controlled server - resulting in full account takeover with no credentials required. Versions 4.2.4 and 4.3.3 patch the issue.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/poweradmin/poweradmin/security/advisories/GHSA-3735-5339-xfwx
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-54594](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-54594)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
OmniBlocks is a monorepo for the OmniBlocks project. Prior to the June 6, 2026 workflow remediation, .github/workflows/disc.yml runs for the issues opened event and the issues edited event and invokes the createDiscussion mutation whenever an issue is classified as off-topic, without recording that the issue was already converted or otherwise suppressing duplicate runs. A user who creates one off-topic issue and repeatedly edits its description before conversion completes can therefore cause multiple discussions to be created for the same issue, producing discussion spam and additional moderation work. This issue is fixed with commit 627e0f0a16a7d74b09128106b57dd7e85d2545df.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/OmniBlocks/monorepo/security/advisories/GHSA-pq9c-3595-72jq
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-54597](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-54597)
|
||||
|
||||
|
||||
&color=brightgreen)
|
||||
|
||||
### Description
|
||||
|
||||
ITFlow provides an IT documentation, ticketing and accounting system for small managed service providers. Prior to version 26.07, an authenticated user with module_support write permission and access to a credential record can perform time-based blind SQL injection through the expires parameter of the share_generate_link handler in agent/ajax.php. sanitizeInput applies string-context escaping, but expires is inserted unquoted into the item_expire_at MySQL INTERVAL expression, allowing a crafted expression and interval unit to execute conditional database queries whose results are inferred from response delays. This can expose password hashes, SMTP credentials, API keys, encrypted vault data, and database metadata and support administrative takeover after credential cracking. This issue is fixed in version 26.07.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/itflow-org/itflow/security/advisories/GHSA-m63v-j7fw-hq2h
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,18 @@
|
||||
### [CVE-2026-54626](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-54626)
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
SAIL is a cross-platform library for loading and saving images with support for animation, metadata, and ICC profiles. In 0.9.10 and earlier, the TGA_INDEXED_RLE path selected by image_type == 9 allocates an image buffer using the one-byte-per-pixel SAIL_PIXEL_FORMAT_BPP8_INDEXED format returned by tga_private_sail_pixel_format() in src/sail-codecs/tga/helpers.c, while sail_codec_load_frame_v8_tga() in src/sail-codecs/tga/tga.c derives a two-to-four-byte pixel_size from an attacker-controlled header bpp value from 9 through 32. Loading a crafted color-mapped run-length-encoded TGA through sail_load_from_file() or sail_load_from_memory() therefore writes attacker-controlled bytes beyond the heap pixel buffer. The pixel-count clamp added for CVE-2026-40494 does not constrain the per-pixel write width, so this issue is an incomplete fix of that vulnerability and can cause heap corruption, a reliable crash, or potential code execution. This issue is fixed in version 1.0.0.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/HappySeaFox/sail/security/advisories/GHSA-744p-cqg2-m33h
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,20 @@
|
||||
### [CVE-2026-54628](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-54628)
|
||||
|
||||
|
||||
|
||||
&color=brightgreen)
|
||||
|
||||
&color=brightgreen)
|
||||
|
||||
### Description
|
||||
|
||||
Anyquery is an SQL query engine built on top of SQLite. Prior to 0.4.5, anyquery server exposes URL-capable SQLite virtual table modules such as json_reader and log_reader through its unauthenticated MySQL-compatible server port without restricting outbound destinations. A remote attacker can provide a loopback, private-network, or link-local cloud metadata URL, causing go-getter in the Anyquery server process to fetch the selected resource and expose its response as queryable table data. This permits internal network probing, access to internal APIs, and disclosure of cloud credentials; low-integrity impact is possible when a reached internal API performs state-changing actions. This issue is fixed in version 0.4.5.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/julien040/anyquery/security/advisories/GHSA-hwrq-8wxh-q4xv
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-54644](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-54644)
|
||||
|
||||
|
||||
&color=brightgreen)
|
||||
|
||||
### Description
|
||||
|
||||
CubeCart is an ecommerce software solution. Prior to 6.7.5, the _errorMessage method in classes/gui.class.php uses strip_tags to permit anchor elements in error, information, and warning messages while retaining unsafe href values and onclick event handlers. Attacker-controlled search or input data that reaches a GUI message can carry a javascript: URI or event handler through the filter, and viewing or interacting with the rendered anchor executes JavaScript in the victim's browser session, enabling session exposure or unauthorized application actions. This issue is fixed in version 6.7.5.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/cubecart/v6/security/advisories/GHSA-v55x-fh73-29vq
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-54646](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-54646)
|
||||
|
||||
|
||||
&color=brightgreen)
|
||||
|
||||
### Description
|
||||
|
||||
CubeCart is an ecommerce software solution. Prior to 6.7.5, admin/sources/maintenance.index.inc.php places administrator-controlled tablename values into ALTER TABLE, CHECK TABLE, and ANALYZE TABLE statements without validating the identifiers or escaping embedded backticks. An authenticated administrator can terminate the quoted identifier with a closing backtick and introduce attacker-controlled structural SQL, potentially compromising database confidentiality, integrity, and availability within the application's database privileges. This issue is fixed in version 6.7.5.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/cubecart/v6/security/advisories/GHSA-qcx6-cg43-ffmx
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,18 @@
|
||||
### [CVE-2026-54659](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-54659)
|
||||
|
||||
|
||||
|
||||
&color=brightgreen)
|
||||
|
||||
### Description
|
||||
|
||||
Pagy is agnostic pagination in plain Ruby. From 43.0.0 until 43.5.6, Pagy::I18n.locale= in gem/lib/pagy/modules/i18n/i18n.rb stored locale values verbatim and later used them as <locale>.yml path components, allowing untrusted params[:locale] values with absolute paths or ../ sequences to create a file existence and readability oracle for YAML files. This issue is fixed in version 43.5.6.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/ddnexus/pagy/security/advisories/GHSA-2xmw-f8j8-wfxc
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,19 @@
|
||||
### [CVE-2026-54673](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-54673)
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
electron-updater allows for automatic updates for Electron apps. Prior to 9.7.0, the HTTP redirect handler (HttpExecutor.prepareRedirectUrlOptions) only stripped a credential header whose key string matched exactly lowercase "authorization", exposing credentials. Other credential-bearing headers — most notably PRIVATE-TOKEN (used by GitLab's personal access token flow) and mixed-case Authorization (used by GitLab's Bearer/OAuth flow) — were not stripped and could be forwarded to an attacker-controlled cross-origin redirect destination. This issue has been fixed in version 9.7.0.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/electron-userland/electron-builder/security/advisories/GHSA-p2f4-r6v6-j797
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-54677](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-54677)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
Scoold is a Q&A and a knowledge sharing platform for teams. Prior to 1.69.0, authenticated users who are not members of a private space can create content in questions belonging to that space because src/main/java/com/erudika/scoold/controllers/QuestionController.java in QuestionController.reply() and src/main/java/com/erudika/scoold/controllers/CommentController.java in CommentController.createAjax() do not apply the canAccessSpace authorization check used by the question read path. With scoold.is_default_space_public set to false and private spaces in use, a user with a valid session and a known or enumerable question identifier can send requests to POST /question/{id} and POST /comment, causing replies and comments to be stored in a thread the user cannot read. This permits unauthorized modification of private discussions and can trigger notifications that reveal the existence or metadata of private activity. This issue is fixed in version 1.69.0.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/Erudika/scoold/security/advisories/GHSA-h2p4-mm8g-whxr
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,18 @@
|
||||
### [CVE-2026-54680](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-54680)
|
||||
|
||||
|
||||
&color=brightgreen)
|
||||
&color=brightgreen)
|
||||
|
||||
### Description
|
||||
|
||||
Logging operator automates the deployment and configuration of Kubernetes logging pipelines. Prior to 6.6.0, the Fluentd configuration renderer FluentRender in pkg/sdk/logging/model/render/fluent.go writes CRD strings such as Flow record_transformer.records values directly into fluent.conf without escaping, allowing a user who can create Flow resources to inject a Fluentd <match **> block using @type exec and execute arbitrary commands inside the Fluentd aggregator. This issue is fixed in version 6.6.0.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/kube-logging/logging-operator/security/advisories/GHSA-mjqf-28ph-426h
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-54685](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-54685)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
FileBrowser Quantum is a free, self-hosted, web-based file manager. Prior to version 1.3.2-beta, the `/api/auth/login` authentication endpoint does not execute in constant time. When a non-existent username is supplied, the server returns a `401`/`403` response almost immediately. When a valid username is provided, the server performs a bcrypt password comparison, causing a measurable delay in the response time. Version 1.3.2-beta patches the issue.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/gtsteffaniak/filebrowser/security/advisories/GHSA-7789-65hx-f26w
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,18 @@
|
||||
### [CVE-2026-54692](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-54692)
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
SAIL is a cross-platform library for loading and saving images with support for animation, metadata, and ICC profiles. Prior to 1.0.0, sail_codec_load_frame_v8_xbm() in src/sail-codecs/xbm/xbm.c allocates the decoded pixel buffer using the X11 one-byte-per-literal layout, but an X10 static short file causes the flat decode loop to write two file-controlled bytes per literal. When ceil(width/8) produces an odd row stride, the X10 literal count includes a padding byte for every row, but the destination has no space for those bytes, so loading the XBM through sail_load_from_file, sail_load_from_memory, or sail_start_loading_* produces a forward heap overwrite that scales with image height. The X11 static char path is not affected. The overwrite can corrupt process state, cause reliable crashes, and potentially enable code execution in a susceptible consuming application. This issue is fixed in version 1.0.0.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/HappySeaFox/sail/security/advisories/GHSA-gp27-qv2x-55v5
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-54706](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-54706)
|
||||
|
||||
|
||||
&color=brightgreen)
|
||||
|
||||
### Description
|
||||
|
||||
OnionShare is an open source tool that lets you securely and anonymously share files, host websites, and chat with friends using the Tor network. Prior to 2.6.4, OnionShare CLI/Desktop follows symbolic links in cli/onionshare_cli/web/send_base_mode.py through SendBaseModeWeb.set_file_info() and stream_individual_file(), allowing remote recipients of Share or Website mode to read local files outside the selected directory. This issue is fixed in version 2.6.4.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/onionshare/onionshare/security/advisories/GHSA-22p9-r2f5-22mf
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-54707](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-54707)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
OnionShare is an open source tool that lets you securely and anonymously share files, host websites, and chat with friends using the Tor network. Prior to 2.6.4, OnionShare CLI/Desktop does not enforce the Receive mode disable_files setting in cli/onionshare_cli/web/receive_mode.py, where ReceiveModeRequest._get_file_stream() writes multipart file[] data to disk despite the text-only setting. This issue is fixed in version 2.6.4.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/onionshare/onionshare/security/advisories/GHSA-v833-3823-cmhp
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-54722](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-54722)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
DSSRF is a Node.js library that provides a wide range of utilities and advanced SSRF defense checks. Prior to 1.0.4, is_url_safe in src/helpers.ts strips the @ userinfo delimiter with remove_at_symbol_in_string before new URL parses the URL, allowing an attacker-controlled URL to bypass internal-IP validation and cause a client using the original URL to reach an internal service. This issue is fixed in version 1.0.4.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/HackingRepo/dssrf-js/issues/97
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,18 @@
|
||||
### [CVE-2026-54740](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-54740)
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
Lemmy is a link aggregator and forum for the fediverse. Prior to 0.19.19 and 1.0.0-alpha.18, a lower-ranked remote moderator can remove a higher-ranked moderator by sending a signed ActivityPub Remove activity to the target instance. The local API uses LocalUser::is_higher_mod_or_admin_check to enforce moderator rank, but CollectionRemove::verify in crates/apub/activities/src/community/collection_remove.rs only calls verify_mod_action. CollectionRemove::receive dereferences self.object as an ApubPerson, creates a CommunityModeratorForm, and calls CommunityActions::leave without checking that the actor outranks the moderator identified by the object field. In communities with federated moderators, a junior moderator can therefore strip senior moderators from the community moderator list even though the local API rejects the same action. This issue is fixed in versions 0.19.19 and 1.0.0-alpha.18.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/LemmyNet/lemmy/security/advisories/GHSA-xmpx-2j2f-c7g7
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,18 @@
|
||||
### [CVE-2026-54758](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-54758)
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
Notepad++ is a free and open-source source code editor. Prior to 8.9.7, the expandNppEnvironmentStrs function in PowerEditor/src/WinControls/StaticDialog/RunDlg/RunDlg.cpp copies a Notepad++ variable name between $( and ) into the fixed-size wchar_t str[MAX_PATH] stack buffer without bounding the m loop index, allowing a name of 260 or more characters to corrupt adjacent stack data, terminate the process through __report_gsfailure, and potentially execute code. This issue is fixed in version 8.9.7.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/notepad-plus-plus/notepad-plus-plus/security/advisories/GHSA-gv94-327x-2gc5
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-54768](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-54768)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
WPGraphQL provides a GraphQL API for WordPress sites. From 2.0.0 until 2.15.1, the deprecated user field on SendPasswordResetEmailPayload lets an unauthenticated caller distinguish existing author-class accounts through the sendPasswordResetEmail mutation and obtain public profile fields. This issue is fixed in version 2.15.1.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/wp-graphql/wp-graphql/security/advisories/GHSA-jhh7-832h-f8hv
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-54771](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-54771)
|
||||
|
||||
|
||||
&color=brightgreen)
|
||||
|
||||
### Description
|
||||
|
||||
Langroid is a framework for building large-language-model-powered applications. Prior to version 0.65.3, a Langroid application exposing a chat interface to untrusted users may allow direct tool invocation via raw JSON payloads, even when tools are registered with `use=False, handle=True`. Version 0.65.3 fixes the issue.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/langroid/langroid/security/advisories/GHSA-gjgq-w2m6-wr5q
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -16,6 +16,7 @@ Inefficient algorithmic complexity in Plug's nested-parameter decoder allows an
|
||||
|
||||
#### Reference
|
||||
- https://cna.erlef.org/cves/CVE-2026-54892.html
|
||||
- https://github.com/elixir-plug/plug/security/advisories/GHSA-j43x-5hjq-rgxf
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-54904](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-54904)
|
||||
|
||||
|
||||
&color=brightgreen)
|
||||
|
||||
### Description
|
||||
|
||||
concurrent-ruby is a modern concurrency tools for Ruby. Prior to 1.3.7, Concurrent::AtomicReference#update can enter a permanent busy retry loop when the current value is Float::NAN. The issue is caused by the interaction between AtomicReference#update, which retries until compare_and_set(old_value, new_value) succeeds; Numeric compare_and_set, which checks old == old_value before attempting the underlying atomic swap.; and Ruby NaN semantics, where Float::NAN == Float::NAN is always false. As a result, once an AtomicReference contains Float::NAN, calling #update repeatedly evaluates the caller's block and never returns. In services that store externally derived numeric values in an AtomicReference, this can cause CPU exhaustion or permanent request/job hangs. This vulnerability is fixed in 1.3.7.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/ruby-concurrency/concurrent-ruby/security/advisories/GHSA-h8w8-99g7-qmvj
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,20 @@
|
||||
### [CVE-2026-54920](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-54920)
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. In versions 3.4.0 through 3.4.12, a reachable assertion failure in the HTJ2K decode path allows a crafted HTJ2K-compressed EXR file to cause an unconditional process abort in any application that calls exr_start_read() on untrusted input, resulting in denial of service. The crash is triggered by a QCD marker whose lower five bits are zero, which OpenEXR passes into the vendored OpenJPH library while constructing the codestream and evaluating its quantization delta parameters. OpenJPH uses an assertion rather than a recoverable error to validate those bits, so any invalid value calls abort() directly and cannot be intercepted by surrounding error handling, a problem compounded by OpenEXR wrapping only its internal HT header parser in error handling while leaving the later codestream read and construction calls unprotected. This issue has been resolved in version 3.4.13.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-fp75-87pr-8329
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-5570](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-5570)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A vulnerability was determined in Technostrobe HI-LED-WR120-G2 5.5.0.1R6.03.30. The affected element is the function index_config of the file /LoginCB. This manipulation causes improper authentication. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/shiky8/my--cve-vulnerability-research/blob/main/my_VulnDB_cves/CVE-TECHNOSTROBE-02-AuthBypass.md
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,18 @@
|
||||
### [CVE-2026-5839](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-5839)
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A vulnerability was identified in PHPGurukul News Portal Project 4.1. This issue affects some unknown processing of the file /admin/add-subcategory.php. Such manipulation of the argument sucatdescription leads to sql injection. The attack may be launched remotely. The exploit is publicly available and might be used.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/f1rstb100d/CVE/issues/28
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-5962](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-5962)
|
||||
|
||||
%20&color=brightgreen)
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
A vulnerability was detected in Tenda CH22 1.0.0.6(468). This issue affects the function R7WebsSecurityHandlerfunction of the component httpd. The manipulation results in path traversal. The attack may be launched remotely. The exploit is now public and may be used.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/Litengzheng/vuldb_new/blob/main/CH22/vul_55/README.md
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-66004](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-66004)
|
||||
|
||||
|
||||
&color=brightgreen)
|
||||
|
||||
### Description
|
||||
|
||||
BlenderMCP before commit 30a3308 contains a path traversal vulnerability in the download_polyhaven_asset method that allows attackers to write arbitrary files by injecting traversal sequences in API response include keys. Attackers performing MITM attacks or prompt injection can supply malicious paths like '../../.bashrc' to overwrite sensitive files and achieve persistent code execution.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/ahujasid/blender-mcp/issues/257
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,19 @@
|
||||
### [CVE-2026-66005](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-66005)
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
Jan through 0.8.4, fixed in commit 3e1c1e7, contains a CORS misconfiguration vulnerability in its local API server that allows network-adjacent attackers to bypass trusted host restrictions by exploiting the server's replacement of user-configured trusted hosts with a wildcard that reflects arbitrary origins with credentials. Attackers on the local network or using DNS rebinding can reach the unauthenticated OpenAI-compatible API to perform inference, enumerate models, invoke MCP tools, and read cross-origin responses.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/janhq/jan/issues/8453
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,19 @@
|
||||
### [CVE-2026-66006](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-66006)
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
lakeFS through 1.83.0, fixed in commit 71a45ee, contains an authentication bypass vulnerability in the /setup_comm_prefs endpoint that allows unauthenticated attackers to overwrite operator metadata including email, name, and company after setup completion. Attackers can POST to this endpoint to modify security update preferences, disable security communications, and trigger falsified telemetry events using the legitimate installation ID.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/treeverse/lakeFS/issues/10465
|
||||
- https://github.com/treeverse/lakeFS/pull/10499
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,18 @@
|
||||
### [CVE-2026-66007](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-66007)
|
||||
|
||||
|
||||
|
||||
&color=brightgreen)
|
||||
|
||||
### Description
|
||||
|
||||
Datasets through 5.0.0, fixed in commit f989ef9, contains a path traversal vulnerability in folder-based dataset builders where the file_name metadata field is not properly validated before being joined to the dataset directory. Attackers can supply crafted file_name values with directory traversal sequences to read arbitrary local files, which are then embedded into output when save_to_disk or push_to_hub is called.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/huggingface/datasets/issues/8324
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,18 @@
|
||||
### [CVE-2026-66010](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-66010)
|
||||
|
||||
|
||||
|
||||
&color=brightgreen)
|
||||
|
||||
### Description
|
||||
|
||||
DOMPurify before 3.4.12 fails to execute afterSanitizeElements hook for custom elements allowed via CUSTOM_ELEMENT_HANDLING.tagNameCheck, allowing attributes to bypass application security policies. Attackers can preserve sensitive attributes on custom elements that later re-inject them into innerHTML sinks, creating second-order XSS gadgets.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/cure53/DOMPurify/security/advisories/GHSA-c2j3-45gr-mqc4
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-66029](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-66029)
|
||||
|
||||
|
||||
&color=brightgreen)
|
||||
|
||||
### Description
|
||||
|
||||
Ekushey Project Manager CRM through version 5.0 contains a stored cross-site scripting vulnerability that allows authenticated client users to inject arbitrary HTML and JavaScript by entering malicious payloads into the client Name field on the Edit Profile page without sanitization. Attackers can craft and store malicious scripts that execute in the browser sessions of Staff or Administrator users who view the Manage Clients or Manage Client Projects pages where client names are rendered unsanitized.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/aaronamran/CVE-Disclosures/tree/main/CVE-2026/CVE-2026-66029
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-66031](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-66031)
|
||||
|
||||
|
||||
&color=brightgreen)
|
||||
|
||||
### Description
|
||||
|
||||
Ekushey Project Manager CRM through version 5.0 contains a stored cross-site scripting vulnerability that allows authenticated client users to inject arbitrary HTML and JavaScript by entering malicious payloads into the Reply Ticket field. Attackers can craft and store malicious scripts that execute in the browser sessions of Staff or Administrator users who view the Support Ticket detail page.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/aaronamran/CVE-Disclosures/tree/main/CVE-2026/CVE-2026-66031
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-66046](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-66046)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
Expat through 2.8.3 contains a denial of service vulnerability caused by quadratic algorithmic complexity in the storeAtts() function in xmlparse.c, where processing N specified attributes with non-normalized values triggers an O(N^2) linear scan of elementType->defaultAtts to determine CDATA status. A remote unauthenticated attacker can supply a single well-formed XML document of a few megabytes to an application parsing untrusted XML to cause excessive CPU consumption, resulting in denial of service without requiring authentication, external entity resolution, or non-default parser options.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/libexpat/libexpat/pull/1321
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-66050](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-66050)
|
||||
|
||||
|
||||
&color=brightgreen)
|
||||
|
||||
### Description
|
||||
|
||||
NitroShare Desktop through 0.3.4 contains a path traversal vulnerability in its LAN file transfer server that allows unauthenticated attackers on the same network to write arbitrary files by sending a crafted filename containing directory traversal sequences in the JSON item header name field. Attackers can exploit the lack of path validation to write files outside the transfer root directory to arbitrary locations the current user has write access, including the Windows Startup folder, enabling persistent code execution on the next user login.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/cduram/NotCVE-2026-0009
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-66060](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-66060)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
Home Assistant is open source home automation software focused on local control and privacy. Prior to 2026.5.3, the Companion app treats tag links (NFC or QR) delivered through an OS-level routing mechanism as if they were physically scanned, without validating the calling app or prompting the user. As a result, any untrusted app on the device can forward an arbitrary tag to Home Assistant, causing it to execute the associated automation as though a legitimate user had scanned an authorized tag. This allows silent, unattended automation execution by untrusted local callers. This issue is fixed in version 2026.8.1.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/home-assistant/core/security/advisories/GHSA-2xqv-hwrf-983f
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
### [CVE-2026-66061](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-66061)
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
Home Assistant is open source home automation software focused on local control and privacy. Prior to 2026.5.0, the iOS Companion app treats tag links (NFC or QR) delivered through an OS-level routing mechanism such as iOS universal links as if they were physically scanned, without validating the calling app or prompting the user. As a result, any untrusted app on the device can forward an arbitrary tag to Home Assistant, causing it to execute the associated automation as though a legitimate user had scanned an authorized tag. This allows silent, unattended automation execution by untrusted local callers. This issue has been fixed in version 2026.5.0.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/home-assistant/core/security/advisories/GHSA-j23v-9672-677j
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,18 @@
|
||||
### [CVE-2026-66296](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-66296)
|
||||
|
||||
|
||||
|
||||
&color=brightgreen)
|
||||
|
||||
### Description
|
||||
|
||||
Improper Neutralization of Input During Web Page Generation (XSS) vulnerability in lud oaskit allows reflected cross-site scripting via the default HTML error handler.Oaskit.ErrorHandler.Default.format_reason/4 and Oaskit.ErrorHandler.Default.reason_to_html/1 in lib/oaskit/error_handler/default.ex render request-validation failures as an HTML page whenever the request's Accept header contains html, interpolating request-controlled strings into that page without HTML escaping. The unescaped values are object keys taken from a request body or from an object or deepObject query parameter, which appear in the JSON Schema error's instance path when a schema rejects them (for example under additionalProperties: false), and the raw Content-Type header, reflected in unsupported-media-type errors when it fails to parse.Because browsers send Accept: text/html on ordinary top-level navigation, a crafted GET link is sufficient to trigger the error page; no form submission, custom Content-Type, or attacker-controlled script on the victim's side is required. A payload such as filter[</code></h2><script>alert(document.domain)</script>]=x terminates the enclosing markup and the injected script executes in the origin of the application using oaskit, giving it access to that origin's cookies, session, and same-origin responses.Both HTML error rendering and the vulnerable handler are enabled by default: Oaskit.Plugs.ValidateRequest defaults :html_errors to true and :error_handler to Oaskit.ErrorHandler.Default, so applications following the documented usage are affected without any opt-in.This issue affects oaskit: from 0.1.0 before 0.14.1.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/lud/oaskit/security/advisories/GHSA-h7xw-x8wr-xpcc
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,21 @@
|
||||
### [CVE-2026-66297](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-66297)
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
&color=brightgreen)
|
||||
|
||||
### Description
|
||||
|
||||
Improper Neutralization of Special Elements used in an OS Command (OS Command Injection) vulnerability in livebook-dev livebook allows command injection into generated deployment setup commands.LivebookWeb.Hub.Teams.DeploymentGroupAgentComponent.docker_instructions/2 and LivebookWeb.Hub.Teams.DeploymentGroupAgentComponent.fly_instructions/4 in lib/livebook_web/live/hub/teams/deployment_group_agent_component.ex interpolate deployment group environment variable values into the generated Docker and Fly.io setup commands without shell escaping. The values originate from the deployment group configuration and reach the sinks through Livebook.Hubs.Dockerfile.online_docker_info/3.Both sinks place the value inside a double-quoted shell word, so a value containing a command substitution such as $(...) or backticks is evaluated by the shell without any need to break out of the quoting, and a literal double quote terminates the quoted word and allows arbitrary further tokens. The generated command is displayed in the Livebook web interface with a copy button, so a user who copies it and runs it without reviewing it first executes the injected commands on their own machine, under their own account.An attacker requires privileges sufficient to set deployment group environment variables, while the resulting code execution occurs on the machine of whoever runs the generated command. The Kubernetes instructions are not affected, because they render the same values into a YAML manifest with escaping rather than into a shell command.This issue affects livebook: from 0.13.0 before 0.18.7 and from 0.19.0 before 0.19.9.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/livebook-dev/livebook/security/advisories/GHSA-qpjc-w5mm-73mj
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,18 @@
|
||||
### [CVE-2026-66353](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-66353)
|
||||
|
||||
|
||||
|
||||
&color=brightgreen)
|
||||
|
||||
### Description
|
||||
|
||||
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in woylie doggo allows Reflected XSS.Doggo.normalize_value/2 in lib/doggo.ex returned date field values wrapped in {:safe, ...}, the Phoenix.HTML marker meaning "already escaped, emit verbatim", without escaping them, so the value reached the value attribute of the <input> rendered by the field component unchanged. Any application rendering <.field type="date"> over user-controlled params is affected through the ordinary Phoenix form round-trip, where a failed validation re-renders the submitted value. The pattern kept exactly the first ten bytes and discarded shorter values, capping a payload at ten bytes: enough to terminate the attribute and open an element or attach a short event handler, not enough to place attacker-chosen script inline. Only type="date" is affected.This issue affects doggo: from 0.1.0 before 0.14.8.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/woylie/doggo/security/advisories/GHSA-w9rp-cf93-86pj
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -10,6 +10,7 @@ Knot Resolver before 6.4.1 allows remote code execution via a heap-based buffer
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/venglin/knot-doq
|
||||
- https://openwall.com/lists/oss-security/2026/07/23/6
|
||||
|
||||
#### Github
|
||||
|
||||
@@ -0,0 +1,18 @@
|
||||
### [CVE-2026-66393](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-66393)
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### Description
|
||||
|
||||
NLTK versions before 3.9.4 contain an unbounded recursion vulnerability in JSONTaggedDecoder.decode_obj() that allows attackers to cause denial of service by supplying deeply nested JSON structures. Attackers can craft JSON payloads exceeding the recursion limit to trigger an unhandled RecursionError that crashes the Python process.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/nltk/nltk/security/advisories/GHSA-rf74-v2fm-23pw
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,18 @@
|
||||
### [CVE-2026-66395](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-66395)
|
||||
|
||||
|
||||
|
||||
&color=brightgreen)
|
||||
|
||||
### Description
|
||||
|
||||
SiYuan desktop before v3.7.2 contains a reflected cross-site scripting vulnerability in the bazaar plugin readme handler that allows attackers to execute arbitrary code by crafting a malicious siyuan:// deep link. Attackers can inject HTML payloads via the plugin name parameter that execute with full Node.js access through insertAdjacentHTML rendering in an insecurely configured Electron renderer.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/siyuan-note/siyuan/security/advisories/GHSA-6gx2-8gcr-x83f
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
@@ -0,0 +1,18 @@
|
||||
### [CVE-2026-66396](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-66396)
|
||||
|
||||
|
||||
|
||||
&color=brightgreen)
|
||||
|
||||
### Description
|
||||
|
||||
SiYuan before v3.7.2 fails to escape the title-img Individual Attribute List value when rendering Gallery and Kanban cover images, allowing stored cross-site scripting via unescaped style attribute interpolation. Attackers with editor permissions can inject onload handlers that execute arbitrary code in the Electron renderer with full Node.js access when victims open affected documents.
|
||||
|
||||
### POC
|
||||
|
||||
#### Reference
|
||||
- https://github.com/siyuan-note/siyuan/security/advisories/GHSA-5rxg-wh59-mg34
|
||||
|
||||
#### Github
|
||||
No PoCs found on GitHub currently.
|
||||
|
||||
Loaded 100 of 189 files, more files were not shown because too many files have changed in this diff.
Show more
Reference in new issue
Block a user