CVE-2026-92932 MISP sachertortephp Xml::build() Operator Precedence Bypass Allows Unintended HTTPS SSRF When readFile Is Disabled

In the MISP sachertortephp library, the Xml::build static method in lib/Cake/Utility/Xml.php contains a logic error in the conditional that gates network-based XML fetching. The original condition was written as: $options'readFile' && strpos$input, 'http://' === 0 || strpos$input, 'https://' === ...

CVE-2026-92932 MISP sachertortephp Xml::build() Operator Precedence Bypass Allows Unintended HTTPS SSRF When readFile Is Disabled

In the MISP sachertortephp library, the Xml::build static method in lib/Cake/Utility/Xml.php contains a logic error in the conditional that gates network-based XML fetching. The original condition was written as: $options'readFile' && strpos$input, 'http://' === 0 || strpos$input, 'https://' === ...

CVE-2026-92932

CVE-2026-92932 affects the MISP sachertortephp library, specifically the Xml::build() static method in lib/Cake/Utility/Xml.php. The root cause is a PHP operator precedence error : the condition $options['readFile'] && strpos($input, 'http://') === 0 || strpos($input, 'https://') === 0 evaluates ...

EUVD-2026-81474

In the MISP sachertortephp library, the Xml::build static method in lib/Cake/Utility/Xml.php contains a logic error in the conditional that gates network-based XML fetching. The original condition was written as: $options'readFile' && strpos$input, 'http://' === 0 || strpos$input, 'https://' === ...

BIT-MONGODB-2026-82060 Insufficient Validation of Shard Key Values in MongoDB Server Leads to Query Operator Injection in Change Stream Post-Image Lookups

In MongoDB, insufficient validation of shard key values during document insertion allowed authenticated users to store documents with specially crafted, operator-shaped objects as shard key values in sharded collections. When change stream events for such documents were processed with the...

CVE-2026-54253: Improper Neutralization of Input During Web Page Generation

TS3 Manager is modern web interface for maintaining Teamspeak3 servers. Prior to 2.2.6, the /api/download handler in packages/server/routes/api.js passes the attacker-controlled port query parameter to socket.connectport, host and returns the resulting error.message through...

PT-2026-95064

Name of the Vulnerable Software and Affected Versions TS3 Manager versions prior to 2.2.6 Description The /api/download endpoint in packages/server/routes/api.js improperly handles the port query parameter, passing it to the socket.connectport, host function and returning the resulting error...

CVE-2026-54495: Exposure of Resource to Wrong Sphere

The OpenFeature Operator allows users to expose feature flags to applications. In version 0.9.2 and earlier, a tenant who can create a controller-owned workload can use the openfeature.dev/featureflagsource annotation with NAMESPACE/NAME syntax to reference a FeatureFlagSource or...

EUVD-2026-81020

BC Security Empire before 6.7.1 fails to validate the multipart filename parameter in upload endpoints, allowing authenticated operators to write files to arbitrary paths on the C2 server. Attackers can use path traversal sequences in the filename to bypass directory containment and write malicio...

CVE-2026-92717

Covenant through 0.6 registers the CovenantHub SignalR hub without an Authorize attribute, allowing unauthenticated callers to invoke CreateHttpListener and receive a signed JWT token. Attackers can use the obtained token to authenticate against the entire operator API and access grunts,...

CVE-2026-92717

Covenant through version 0.6 registers its CovenantHub SignalR hub without an Authorize attribute , allowing unauthenticated callers to invoke CreateHttpListener and receive a signed JWT token . With that token, an attacker can authenticate against the entire operator API and access grunts, crede...

CVE-2026-92717 Covenant through 0.6 Missing Authentication on the CovenantHub SignalR Hub

Covenant through 0.6 registers the CovenantHub SignalR hub without an Authorize attribute, allowing unauthenticated callers to invoke CreateHttpListener and receive a signed JWT token. Attackers can use the obtained token to authenticate against the entire operator API and access grunts,...

CVE-2026-92717 Covenant through 0.6 Missing Authentication on the CovenantHub SignalR Hub

Covenant through 0.6 registers the CovenantHub SignalR hub without an Authorize attribute, allowing unauthenticated callers to invoke CreateHttpListener and receive a signed JWT token. Attackers can use the obtained token to authenticate against the entire operator API and access grunts,...

CVE-2026-92717 Covenant through 0.6 Missing Authentication on the CovenantHub SignalR Hub

Covenant through 0.6 registers the CovenantHub SignalR hub without an Authorize attribute, allowing unauthenticated callers to invoke CreateHttpListener and receive a signed JWT token. Attackers can use the obtained token to authenticate against the entire operator API and access grunts,...

CVE-2026-27554

A low-privileged remote attacker can exploit a command injection vulnerability in the /index.php/ajax/saveioddparameters endpoint using operator credentials allowing execution of commands with root privileges on the device...

CVE-2026-27558

A low-privileged remote attacker can exploit a command injection vulnerability in the /index.php/attacheddevicestab/ajaxremoveuploadedioddfiles endpoint using operator credentials allowing execution of commands with root privileges on the device...

CVE-2026-27556

A low-privileged remote attacker can exploit a local file inclusion vulnerability in the /index.php/ajax/saveioddparameters endpoint using a valid operator cookie allowing execution of arbitrary PHP code on the device...

CVE-2026-27549

A low-privileged remote attacker can exploit a command injection vulnerability in the /index.php/attacheddevicestab/doupload endpoint using operator credentials allowing execution of commands with root privileges on the device...

CVE-2026-27550

A low-privileged remote attacker can exploit a command injection vulnerability in the FieldShadowPassword class using operator credentials allowing execution of commands with root privileges on the device...

CVE-2026-27558 Command Injection in /index.php/attached_devices_tab/ajax_remove_uploaded_iodd_files

A low-privileged remote attacker can exploit a command injection vulnerability in the /index.php/attacheddevicestab/ajaxremoveuploadedioddfiles endpoint using operator credentials allowing execution of commands with root privileges on the device...