CVE-2026-41477

Deskflow is a keyboard and mouse sharing app. In 1.20.0, 1.26.0.134, and earlier, Deskflow daemon runs as SYSTEM and exposes an IPC named pipe with WorldAccessOption enabled. The daemon processes privileged commands without authentication, allowing any local unprivileged user to execute arbitrary...

CVE-2026-41477

Deskflow is a keyboard and mouse sharing app. In 1.20.0, 1.26.0.134, and earlier, Deskflow daemon runs as SYSTEM and exposes an IPC named pipe with WorldAccessOption enabled. The daemon processes privileged commands without authentication, allowing any local unprivileged user to execute arbitrary...

CVE-2026-6130 chatboxai chatbox Model Context Protocol Server Management System ipc-stdio-transport.ts StdioClientTransport os command injection

A flaw has been found in chatboxai chatbox up to 1.20.0. This impacts the function StdioClientTransport of the file src/main/mcp/ipc-stdio-transport.ts of the component Model Context Protocol Server Management System. Executing a manipulation of the argument args/env can lead to os command...

CVE-2026-6130

CVE-2026-6130 affects chatboxai up to version 1.20.0, impacting the StdioClientTransport function in src/main/mcp/ipc-stdio-transport.ts within the Model Context Protocol Server Management System. The root cause is a flaw where manipulating the argument list (args/env) enables os command injectio...

Chatbox 操作系统命令注入漏洞

Chatbox is a chat software developed by Shafqat Hasan. Versions of Chatbox 1.20.0 and earlier contained a vulnerability related to operating system command injection. This vulnerability stemmed from incorrect handling of the parameters args and env in the file src/main/mcp/ipc-stdio-transport.ts,...

CVE-2026-30870

PowerSync Service is the server-side component of the PowerSync sync engine. In version 1.20.0, when using new sync streams with config.edition: 3, certain subquery filters were ignored when determining which data to sync to users. Depending on the sync stream configuration, this could result in...

CVE-2026-30870

PowerSync Service is the server-side component of the PowerSync sync engine. In version 1.20.0, when using new sync streams with config.edition: 3, certain subquery filters were ignored when determining which data to sync to users. Depending on the sync stream configuration, this could result in...

CVE-2026-30870 Some sync filters in PowerSync Service ignored using `config.edition: 3`

PowerSync Service is the server-side component of the PowerSync sync engine. In version 1.20.0, when using new sync streams with config.edition: 3, certain subquery filters were ignored when determining which data to sync to users. Depending on the sync stream configuration, this could result in...

CVE-2026-30870 Some sync filters in PowerSync Service ignored using `config.edition: 3`

PowerSync Service is the server-side component of the PowerSync sync engine. In version 1.20.0, when using new sync streams with config.edition: 3, certain subquery filters were ignored when determining which data to sync to users. Depending on the sync stream configuration, this could result in...

GHSA-Q6WC-XX4M-92FJ PowerSync: Some sync filters ignored on 1.20.0 using `config.edition: 3`

Impact In version 1.20.0, when using new sync streams with config.edition: 3, certain subquery filters were ignored when determining which data to sync to users. Depending on the sync stream configuration, this could result in authenticated users syncing data that should have been restricted. Onl...

CVE-2026-28443

OpenReplay is a self-hosted session replay suite. Prior to version 1.20.0, the POST /projectId/cards/search endpoint has a SQL injection in the sort.field parameter. This issue has been patched in version 1.20.0...

PT-2026-24089

Name of the Vulnerable Software and Affected Versions PowerSync versions prior to 1.20.1 Description The PowerSync Service, a server-side component of the PowerSync sync engine, had an issue in version 1.20.0 where subquery filters were ignored when determining data synchronization for users with...

CVE-2026-28443

OpenReplay is a self-hosted session replay suite. Prior to version 1.20.0, the POST /projectId/cards/search endpoint has a SQL injection in the sort.field parameter. This issue has been patched in version 1.20.0...

CVE-2026-28443 OpenReplay: SQL injection in cards/search via unvalidated sort field parameter

OpenReplay is a self-hosted session replay suite. Prior to version 1.20.0, the POST /projectId/cards/search endpoint has a SQL injection in the sort.field parameter. This issue has been patched in version 1.20.0...

CVE-2026-28443 OpenReplay: SQL injection in cards/search via unvalidated sort field parameter

OpenReplay is a self-hosted session replay suite. Prior to version 1.20.0, the POST /projectId/cards/search endpoint has a SQL injection in the sort.field parameter. This issue has been patched in version 1.20.0...

CVE-2026-28443

OpenReplay is a self-hosted session replay suite. Prior to version 1.20.0, the POST /projectId/cards/search endpoint has a SQL injection in the sort.field parameter. This issue has been patched in version 1.20.0...

CVE-2026-28443

OpenReplay (self-hosted session replay) has a SQL injection in the POST /{projectId}/cards/search endpoint, specifically in the sort.field parameter, that affects versions prior to 1.20.0. The issue has been patched in version 1.20.0. Practical impact is high (as indicated by the CVSS data in the...

CVE-2026-28443 OpenReplay: SQL injection in cards/search via unvalidated sort field parameter

OpenReplay is a self-hosted session replay suite. Prior to version 1.20.0, the POST /projectId/cards/search endpoint has a SQL injection in the sort.field parameter. This issue has been patched in version 1.20.0...

EUVD-2026-9880

OpenReplay is a self-hosted session replay suite. Prior to version 1.20.0, the POST /projectId/cards/search endpoint has a SQL injection in the sort.field parameter. This issue has been patched in version 1.20.0...

@backstage/backend-defaults (>=0.0.0-nightly-20240929023448 <=0.15.2-next.1), @backstage/backend-dynamic-feature-service (>=0.0.0-nightly-20240929023448 <=0.7.9-next.1) +80 more potentially affected by CVE-2026-29185 via @backstage/integration (>=1.15.0 <=1.20.0)

@backstage/integration NPM version =1.15.0, =0.0.0-nightly-20240929023448, =0.0.0-nightly-20240929023448, =0.0.0-nightly-20240929023448, =0.0.0-nightly-20240929023448, =0.0.0-nightly-20250614024041, =0.0.0-nightly-20240929023448, =0.0.0-nightly-20250129022746, =0.0.0-nightly-20250129022746,...