PT-2026-88842

Improper export of android application components in Bixby Touch prior to version 4.3.01.17 allows local attackers to access sensitive information...

CVE-2026-21113: Improper Export of Android Application Components

Improper export of android application components in Visual Voicemail prior to version 20.1.00.05 allows local attackers to initiate call without proper permission...

CVE-2026-21108: Improper Export of Android Application Components

Improper export of android application components in Bixby Touch prior to version 4.3.01.17 allows local attackers to access sensitive information...

CVE-2026-86758: Observable Response Discrepancy

Snipe-IT before 8.7.0 fails to properly enforce the viewKeys authorization gate in CSV export and API index endpoints, allowing authenticated users with only licenses.view permission to access product keys. Attackers can download all license keys in bulk via CSV export or validate candidate keys...

kernel: vfio/pci: Check BAR resources before exporting a DMABUF

A flaw was found in the Linux kernel's vfio/pci subsystem. This vulnerability occurs because the Direct Memory Access Buffer DMABUF export mechanism does not adequately verify if Base Address Register BAR resources are properly reserved before allowing access. A local attacker could exploit this ...

CVE-2026-86257

wger before 2.6 fails to sanitize firstname and lastname fields in the gym member TSV export endpoint, allowing any gym member to inject spreadsheet formulas. Attackers can inject formulas like =HYPERLINK to exfiltrate admin data or execute code when admins open the exported file in Excel or...

CVE-2026-86257 wger before 2.6 CSV Formula Injection via member export

wger before 2.6 fails to sanitize firstname and lastname fields in the gym member TSV export endpoint, allowing any gym member to inject spreadsheet formulas. Attackers can inject formulas like =HYPERLINK to exfiltrate admin data or execute code when admins open the exported file in Excel or...

CVE-2026-86257

CVE-2026-86257 affects wger before version 2.6 . The root cause is a lack of sanitization on the first_name and last_name fields in the gym member TSV export endpoint , enabling any gym member to inject spreadsheet formulas such as =HYPERLINK. When an admin opens the exported file in Excel or Lib...

EUVD-2026-72113

wger before 2.6 fails to sanitize firstname and lastname fields in the gym member TSV export endpoint, allowing any gym member to inject spreadsheet formulas. Attackers can inject formulas like =HYPERLINK to exfiltrate admin data or execute code when admins open the exported file in Excel or...

CVE-2026-86257 wger before 2.6 CSV Formula Injection via member export

wger before 2.6 fails to sanitize firstname and lastname fields in the gym member TSV export endpoint, allowing any gym member to inject spreadsheet formulas. Attackers can inject formulas like =HYPERLINK to exfiltrate admin data or execute code when admins open the exported file in Excel or...

CVE-2026-86257 wger before 2.6 CSV Formula Injection via member export

wger before 2.6 fails to sanitize firstname and lastname fields in the gym member TSV export endpoint, allowing any gym member to inject spreadsheet formulas. Attackers can inject formulas like =HYPERLINK to exfiltrate admin data or execute code when admins open the exported file in Excel or...

PT-2026-86526

wger before 2.6 fails to sanitize first name and last name fields in the gym member TSV export endpoint, allowing any gym member to inject spreadsheet formulas. Attackers can inject formulas like =HYPERLINK to exfiltrate admin data or execute code when admins open the exported file in Excel or...

CVE-2026-86257: Improper Neutralization of Formula Elements in a CSV File

wger before 2.6 fails to sanitize firstname and lastname fields in the gym member TSV export endpoint, allowing any gym member to inject spreadsheet formulas. Attackers can inject formulas like =HYPERLINK to exfiltrate admin data or execute code when admins open the exported file in Excel or...

CVE-2026-50553

Note Mark is an open-source note-taking application. Prior to version 0.19.5, Note Mark validates book and note slug values with the OpenAPI/huma tag pattern:"a-z0-9-+". huma compiles this with regexp.MustCompiles.Pattern and tests it with patternRe.MatchStringstr, an UNANCHORED match. Because th...

CVE-2026-50553 Note Mark: Path traversal via unsanitized book/note slug in migrate export (sibling of GHSA-g49p)

Note Mark is an open-source note-taking application. Prior to version 0.19.5, Note Mark validates book and note slug values with the OpenAPI/huma tag pattern:"a-z0-9-+". huma compiles this with regexp.MustCompiles.Pattern and tests it with patternRe.MatchStringstr, an UNANCHORED match. Because th...

CVE-2026-50553

Note Mark (open-source Go note-taking app, module github.com/enchant97/note-mark/backend) is vulnerable to a path traversal in its data-export CLI commands (migrate export and migrate export-v1) prior to version 0.19.5 . The root cause is an unanchored regex ([a-z0-9-]+) used to validate book and...

CVE-2026-50553 Note Mark: Path traversal via unsanitized book/note slug in migrate export (sibling of GHSA-g49p)

Note Mark is an open-source note-taking application. Prior to version 0.19.5, Note Mark validates book and note slug values with the OpenAPI/huma tag pattern:"a-z0-9-+". huma compiles this with regexp.MustCompiles.Pattern and tests it with patternRe.MatchStringstr, an UNANCHORED match. Because th...

EUVD-2026-71618

Note Mark is an open-source note-taking application. Prior to version 0.19.5, Note Mark validates book and note slug values with the OpenAPI/huma tag pattern:"a-z0-9-+". huma compiles this with regexp.MustCompiles.Pattern and tests it with patternRe.MatchStringstr, an UNANCHORED match. Because th...

zoneminder-rce-poc

just wait and see Proof of concept for an OS command injection vulnerability in ZoneMinder's event export functionality web/includes/downloadfunctions.php. Monitor names are interpolated directly into shell commands using manual single-quote wrapping instead of escapeshellarg. An attacker who can...

CVE-2026-85588

phpMyFAQ versions before 4.1.8 include live TOTP shared secrets in plaintext within user data export ZIP files. Attackers obtaining exported archives can extract the TOTP seed and generate valid one-time codes to bypass two-factor authentication...