Craft CMS: Arbitrary user password reset leading to administrator account takeover

The vulnerability allows any authenticated user to change their own password without providing the current password or having an active elevated session. It also allows the attacker to change other users’ passwords if the attacker’s account has edit users permission which doesn’t allow changing...

CVE-2026-43629 llama.cpp b4882–b9058 Buffer Overflow in KV Cache State Restore

llama.cpp builds b4882 through b9058 contain a heap buffer overflow vulnerability in the KV cache state restore path where the statereaddata function computes write size without overflow checking, allowing attackers with write access to the slotsavepath directory to corrupt heap memory. Attackers...

CVE-2026-43629

The CVE-2026-43629 entry concerns llama.cpp builds b4882–b9058 with a heap buffer overflow in the KV cache state restore path. The root cause is state_read_data() computing the write size without overflow checks, enabling an attacker with write access to the slot_save_path directory to craft mali...

CVE-2026-67687

Insecure Permissions vulnerability in ics-park v.2.0 allows a remote attacker to escalate privileges via the /system/role/save endpoint in RoleController.java and system/user/update endpoint in UserController.java...

PT-2026-68732

Name of the Vulnerable Software and Affected Versions Frappe versions prior to 16.18.0 Description The Workspace Save API endpoint accepts a workspace identifier from any authenticated user without verifying workspace ownership. This allows an attacker to modify private workspaces belonging to...

CVE-2026-47185: Incorrect Authorization

Frappe is a full-stack web application framework. Prior to 16.18.0, the Workspace Save API accepts a controlled workspace identifier from any authenticated user without enforcing workspace ownership, allowing modification of another user's private workspace and persistent script injection. This...

CVE-2026-67687

Insecure Permissions vulnerability in ics-park v.2.0 allows a remote attacker to escalate privileges via the /system/role/save endpoint in RoleController.java and system/user/update endpoint in UserController.java...

PT-2026-68728

Name of the Vulnerable Software and Affected Versions llama.cpp versions b4882 through b9058 Description A heap buffer overflow exists in the KV cache state restore path. The state read data function calculates the write size without performing overflow checks. An attacker with write access to th...

CVE-2026-67687

The ICS-Park Smart Park Management System v2.0 contains an Insecure Permissions vulnerability allowing an authenticated low-privileged user to perform vertical privilege escalation. The root cause is a lack of authorization checks in the RoleController.save() method (missing @HasPermissions annot...

📄 Node-RED 5.0.4 Unauthenticated Denial of Service

A proof of concept exploit for an unauthenticated denial of service vulnerability in Node-RED version 5.0.4. The vulnerability is triggered by a path traversal primitive that allows a bare .. segment to reach the library save path, ultimately causing an unhandled promise rejection and process...

PT-2026-68777

Name of the Vulnerable Software and Affected Versions ics-park version 2.0 Description Insecure permissions allow a remote attacker to escalate privileges. This issue occurs through the '/system/role/save' endpoint in RoleController.java and the '/system/user/update' endpoint in...

CVE-2026-67687: Improper Access Control

Insecure Permissions vulnerability in ics-park v.2.0 allows a remote attacker to escalate privileges via the /system/role/save endpoint in RoleController.java and system/user/update endpoint in UserController.java...

CVE-2026-67687

Insecure Permissions vulnerability in ics-park v.2.0 allows a remote attacker to escalate privileges via the /system/role/save endpoint in RoleController.java and system/user/update endpoint in UserController.java...

CVE-2026-18953 Improper limitation of a pathname to a restricted directory in aws-transform-mcp-server

Improper limitation of a pathname to a restricted directory in the getresource tool in Amazon awslabs.aws-transform-mcp-server 0.1.0 through 0.1.4 might allow a context-dependent actor to write arbitrary files outside the intended working directory via the savePath parameter. To remediate this...

CVE-2026-18953

Improper limitation of a pathname to a restricted directory in the getresource tool in Amazon awslabs.aws-transform-mcp-server 0.1.0 through 0.1.4 might allow a context-dependent actor to write arbitrary files outside the intended working directory via the savePath parameter. To remediate this...

CVE-2026-39923

Flarum before 1.8.16 contains a password reset token expiry bypass vulnerability that allows unauthenticated attackers to reuse expired password reset tokens by submitting them directly to the reset processing endpoint. The SavePasswordController::handle method calls PasswordToken::findOrFail...

CVE-2026-71269

Node-RED's local-filesystem library storage module getLibraryEntry and saveLibraryEntry in packages/nodemodules/@node-red/runtime/lib/storage/localfilesystem/library.js, reachable via GET/POST /library/:lib/:type/path, joins the user-supplied path parameter directly into the filesystem path via...

CVE-2026-71204 changedetection.io - Omitted Checkbox in /settings Save Silently Disables API Key Enforcement

changedetection.io's /settings save handler builds an update dict from form.data'application' and blind-merges it into the stored application settings via .update...

CVE-2026-71204 changedetection.io - Omitted Checkbox in /settings Save Silently Disables API Key Enforcement

changedetection.io's /settings save handler builds an update dict from form.data'application' and blind-merges it into the stored application settings via .update...

CVE-2026-71204

The CVE-2026-71204 entry concerns changedetection.io. A POST to /settings that omits api_access_token_enabled causes the update logic to silently disable API key enforcement because WTForms treats unchecked checkboxes as False and only the password field is specially handled. This results in the ...