CVE-2026-40349

Movary is a self hosted web app to track and rate a user's watched movies. Prior to version 0.71.1, an ordinary authenticated user can escalate their own account to administrator by sending "isAdmin=true" to "PUT /settings/users/userId" for their own user ID. The endpoint is intended to let a use...

CVE-2026-40349 Authenticated Movary User Can Self-Escalate to Administrator via PUT /settings/users/{userId} by Setting isAdmin=true

Movary is a self hosted web app to track and rate a user's watched movies. Prior to version 0.71.1, an ordinary authenticated user can escalate their own account to administrator by sending isAdmin=true to PUT /settings/users/userId for their own user ID. The endpoint is intended to let a user ed...

EUVD-2026-23619

Movary is a self hosted web app to track and rate a user's watched movies. Prior to version 0.71.1, an ordinary authenticated user can escalate their own account to administrator by sending isAdmin=true to PUT /settings/users/userId for their own user ID. The endpoint is intended to let a user ed...

CVE-2026-40348

Movary contains an authenticated SSRF vulnerability present before version 0.71.1. An ordinary authenticated user can trigger server-side requests by sending a user-controlled URL to POST /settings/jellyfin/server-url-verify, which appends /system/info/public and causes the server to issue a requ...

CVE-2026-40349: Missing Authorization

Movary is a self hosted web app to track and rate a user's watched movies. Prior to version 0.71.1, an ordinary authenticated user can escalate their own account to administrator by sending isAdmin=true to PUT /settings/users/userId for their own user ID. The endpoint is intended to let a user ed...

CVE-2026-40348: Server-Side Request Forgery (SSRF)

Movary is a self hosted web app to track and rate a user's watched movies. Prior to version 0.71.1, an ordinary authenticated user can trigger server-side requests to arbitrary internal targets through POST /settings/jellyfin/server-url-verify. The endpoint accepts a user-controlled URL, appends...

CVE-2026-35402

creationtimestamp| type| source ---|---|--- 2026-04-17 22:26:27+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mjpxscq4l32f...

com.expediagroup:drone-fly-app (>=1.0.9, <=1.0.10), com.github.hiwepy:pac4j-biz (1.0.2.release) +20 more potentially affected by CVE-2026-40458 via org.pac4j:pac4j-core (4.5.5)

org.pac4j:pac4j-core MAVEN version 4.5.5 is affected by a known vulnerability. The following packages have a transitive dependency on org.pac4j:pac4j-core and may be impacted: - com.expediagroup:drone-fly-app =1.0.9, =1.0.3.release, =1.0.2.release, =4.0.0-alpha-2, =4.0.0-alpha-2, =4.0.0-alpha-2,...

Time-of-check Time-of-use (TOCTOU) Race Condition

Overview github.com/mattermost/mattermost/server/channels/app is a private-cloud Slack alternative Affected versions of this package are vulnerable to Time-of-check Time-of-use TOCTOU Race Condition in the authentication process. An attacker can gain unauthorized access to multiple authenticated...

CVE-2026-6451

creationtimestamp| type| source ---|---|--- 2026-04-17 10:27:09+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mjopm4miod2k 2026-04-17 12:32:05+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mjowljd7yw2n...

CVE-2026-30457

creationtimestamp| type| source ---|---|--- 2026-04-17 06:35:41+00:00| seen| https://bsky.app/profile/breachandbuild.bsky.social/post/3mjocnufyha26...

Note Mark security vulnerabilities

Note Mark is a web-based Markdown note-taking application developed by Leo Spratt. Versions of Note Mark prior to 0.19.1 contained a security vulnerability. This vulnerability stemmed from the login endpoint only performing bcrypt password verification when a username was provided. This allowed...

CVE-2026-40262

Note Mark is an open-source note-taking application. In versions 0.19.1 and prior, the asset delivery handler serves uploaded files inline and relies on magic-byte detection for content type, which does not identify text-based formats such as HTML, SVG, or XHTML. These files are served with an...

[SECURITY] Fedora 44 Update: spacebar-6.6.4-1.fc44

Spacebar is a telepathy-qt based SMS application that primarily targets Plasm a Mobile...

[SECURITY] Fedora 44 Update: kf6-kuserfeedback-6.25.0-1.fc44

Framework for collecting user feedback for apps via telemetry and surveys...

bugbug (0.0.593), chatlas-chains (>=0.1.3, <=0.3.3) +4 more potentially affected by CVE-2026-41488 via langchain-openai (0.3.32)

langchain-openai PYPI version 0.3.32 is affected by a known vulnerability. The following packages have a transitive dependency on langchain-openai and may be impacted: - bugbug 0.0.593 - chatlas-chains =0.1.3, =1.0.0, =0.1.8, =0.0.86, =0.0.92 Source cves: CVE-2026-41488 Source advisory:...

@saltcorn/cli (>=1.0.0-beta.1, <=1.4.5), @saltcorn/mobile-builder (>=1.0.0-beta.1, <=1.4.5) potentially affected by CVE-2026-41478 via @saltcorn/mobile-app (>=1.0.0-beta.1, <=1.4.5)

@saltcorn/mobile-app NPM version =1.0.0-beta.1, =1.0.0-beta.1, =1.0.0-beta.1, =1.4.5 Source cves: CVE-2026-41478 Source advisory: SNYK:JS-SALTCORNMOBILEAPP-16110990...

@saltcorn/cli (>=1.5.0-beta.0, <=1.5.5), @saltcorn/mobile-builder (>=1.5.0-beta.0, <=1.5.5) potentially affected by CVE-2026-41478 via @saltcorn/mobile-app (>=1.5.0-beta.0, <=1.5.5)

@saltcorn/mobile-app NPM version =1.5.0-beta.0, =1.5.0-beta.0, =1.5.0-beta.0, =1.5.5 Source cves: CVE-2026-41478 Source advisory: SNYK:JS-SALTCORNMOBILEAPP-16110990...

@saltcorn/cli (>=1.6.0-alpha.0, <=1.6.0-beta.4), @saltcorn/mobile-builder (>=1.6.0-alpha.0, <=1.6.0-beta.4) potentially affected by CVE-2026-41478 via @saltcorn/mobile-app (>=1.6.0-alpha.0, <=1.6.0-beta.4)

@saltcorn/mobile-app NPM version =1.6.0-alpha.0, =1.6.0-alpha.0, =1.6.0-alpha.0, =1.6.0-beta.4 Source cves: CVE-2026-41478 Source advisory: SNYK:JS-SALTCORNMOBILEAPP-16110990...

SQL Injection

Overview @saltcorn/mobile-app is a Saltcorn mobile app for Android and iOS Affected versions of this package are vulnerable to SQL Injection via the getSyncRows and getDelRows functions. An attacker can execute arbitrary SQL commands, exfiltrate sensitive data, modify or delete database contents,...