CVE-2026-55383: Improper Authorization

InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates. Prior to version 2.4.0, InvoiceShelf public customer invoice, estimate, and payment routes use an EmailLog token's numeric mailableid without verifying mailabletype,...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: tomcat (UTSA-2026-130090)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-130090 advisory. The JsonErrorReportValve in Apache Tomcat 8.5.83, 9.0.40 to 9.0.68 and 10.1.0-M1 to 10.1.1 did not escape the type, message or description values. In some...

CVE-2026-84994

Qwik is a performance-focused JavaScript framework. Prior to @builder.io/qwik 1.20.0 and @qwik.dev/core 2.0.0-beta.37, default server-side qwik-json deserialization causes ResourceSerializer.$fill$ to pass resource.resolved to Promise.resolve without first rejecting attacker-controlled thenables...

CVE-2026-95114

A flaw was found in libwebsockets. An out-of-bounds read vulnerability in the Lightweight Embedded JSON Parser LEJP allows a remote attacker to cause a Denial of Service DoS. By submitting specially crafted JSON data, an attacker can trigger an invalid memory read that causes the application to...

SUSE CVE-2026-109282

ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a type confusion flaw in the INFO, JSON and YAML encoders, where an internal method receives a pointer of an unexpected type when writing an image in a compressed format. An attacker who can cause such an image write can trigger a...

CVE-2026-85990 Leantime: Any Authenticated User Can Self-Escalate to Admin via Unauthorized JSON-RPC Methods

Leantime is an open source project management system. Prior to 3.10.0, for the provisionally grouped account-creation and plugin-management surfaces, Leantime's JSON-RPC dispatcher in app/Domain/Api/Controllers/Jsonrpc.php exposes public API service methods, while PermissionEnforcer::enforce allo...

CVE-2026-85990

The open-source project management system Leantime is vulnerable to privilege escalation and unauthorized plugin management in versions prior to 3.10.0 . The root cause is located in the JSON-RPC dispatcher (app/Domain/Api/Controllers/Jsonrpc.php), where PermissionEnforcer::enforce allows executi...

CVE-2026-85990 Leantime: Any Authenticated User Can Self-Escalate to Admin via Unauthorized JSON-RPC Methods

Leantime is an open source project management system. Prior to 3.10.0, for the provisionally grouped account-creation and plugin-management surfaces, Leantime's JSON-RPC dispatcher in app/Domain/Api/Controllers/Jsonrpc.php exposes public API service methods, while PermissionEnforcer::enforce allo...

DEBIAN-CVE-2026-95115

Buffer Overflow vulnerability in libwebsockets main 106d542c allows a remote attacker to cause a denial of service via the LEJP JSON parser...

CVE-2026-95115

Buffer Overflow vulnerability in libwebsockets main 106d542c allows a remote attacker to cause a denial of service via the LEJP JSON parser...

UBUNTU-CVE-2026-95115

Buffer Overflow vulnerability in libwebsockets main 106d542c allows a remote attacker to cause a denial of service via the LEJP JSON parser...

CVE-2026-95115

Buffer Overflow vulnerability in libwebsockets main 106d542c allows a remote attacker to cause a denial of service via the LEJP JSON parser...

CVE-2026-109967

yt-dlp-web-ui through 4.0.0 contains a NULL pointer dereference vulnerability in the Service.Formats JSON-RPC method that allows remote unauthenticated attackers to crash the server. Attackers can send a single request with a url value like --version, causing invalid yt-dlp JSON output and an...

CVE-2026-109966

yt-dlp-web-ui through 4.0.0 contains an argument injection vulnerability that allows unauthenticated remote attackers to inject yt-dlp options by supplying a dash-prefixed url parameter to the Service.Formats JSON-RPC method. Attackers can send values like --load-info-json via /rpc/http or /rpc/w...

CVE-2026-109967

yt-dlp-web-ui through 4.0.0 contains a NULL pointer dereference vulnerability in the Service.Formats JSON-RPC method that allows remote unauthenticated attackers to crash the server. Attackers can send a single request with a url value like --version, causing invalid yt-dlp JSON output and an...

CVE-2026-109966 yt-dlp-web-ui through 4.0.0 Argument Injection via Service.Formats JSON-RPC Method

yt-dlp-web-ui through 4.0.0 contains an argument injection vulnerability that allows unauthenticated remote attackers to inject yt-dlp options by supplying a dash-prefixed url parameter to the Service.Formats JSON-RPC method. Attackers can send values like --load-info-json via /rpc/http or /rpc/w...

CVE-2026-109966 yt-dlp-web-ui through 4.0.0 Argument Injection via Service.Formats JSON-RPC Method

yt-dlp-web-ui through 4.0.0 contains an argument injection vulnerability that allows unauthenticated remote attackers to inject yt-dlp options by supplying a dash-prefixed url parameter to the Service.Formats JSON-RPC method. Attackers can send values like --load-info-json via /rpc/http or /rpc/w...

EUVD-2026-98692

yt-dlp-web-ui through 4.0.0 contains an argument injection vulnerability that allows unauthenticated remote attackers to inject yt-dlp options by supplying a dash-prefixed url parameter to the Service.Formats JSON-RPC method. Attackers can send values like --load-info-json via /rpc/http or /rpc/w...

CVE-2026-109966 yt-dlp-web-ui through 4.0.0 Argument Injection via Service.Formats JSON-RPC Method

yt-dlp-web-ui through 4.0.0 contains an argument injection vulnerability that allows unauthenticated remote attackers to inject yt-dlp options by supplying a dash-prefixed url parameter to the Service.Formats JSON-RPC method. Attackers can send values like --load-info-json via /rpc/http or /rpc/w...

CVE-2026-109966

The yt-dlp-web-ui software, through version 4.0.0 , is vulnerable to an argument injection vulnerability within the Service.Formats JSON-RPC method. Unauthenticated remote attackers can exploit this by supplying a dash-prefixed url parameter via the /rpc/http or /rpc/ws endpoints. By injecting op...