CVE-2026-2974

AliasVault App (up to 0.25.3) on Android/iOS contains a vulnerability in the Backup Handler that manipulates tokens inside shared_prefs/aliasvault.xml (accessToken/refreshToken/metadata/key_derivation_params/auth_methods). This can expose backup files to an unauthorized control sphere through a l...

PT-2026-21541

Name of the Vulnerable Software and Affected Versions Tencent iOA versions through 210.9.28693.621001 Description A privilege escalation issue exists in the Tencent iOA app on Windows devices. A local user can execute programs with elevated privileges by exploiting a race condition. Recommendatio...

CVE-2025-63945

CVE-2025-63945 is a privilege-escalation vulnerability in the Tencent iOA app for Windows up to version 210.9.28693.621001. The issue is a race-condition at local privilege escalation time, allowing a non-privileged user to execute programs with SYSTEM-like privileges under certain conditions. Pu...

CVE-2025-63945

A privilege escalation PE vulnerability in the Tencent iOA app thru 210.9.28693.621001 on Windows devices enables a local user to execute programs with elevated privileges. However, execution requires that the local user is able to successfully exploit a race condition...

CVE-2026-25591

creationtimestamp| type| source ---|---|--- 2026-02-22 15:59:14+00:00| published-proof-of-concept| https://github.com/QuantumNous/new-api/security/advisories/GHSA-w6x6-9fp7-fqm4 2026-02-24 09:00:31+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3mflsjc6zzn2u 2026-02-24...

CVE-2026-2897

A security vulnerability has been detected in funadmin up to 7.1.0-rc4. This vulnerability affects unknown code of the file app/backend/view/index/index.html of the component Backend Interface. The manipulation of the argument Value leads to cross site scripting. The attack is possible to be...

CVE-2026-2822

A security vulnerability has been detected in JeecgBoot up to 3.9.1. The affected element is an unknown function of the file /jeecgboot/sys/dict/loadDict/airagapp,1,createby of the component Backend Interface. Such manipulation of the argument keyword leads to sql injection. The attack can be...

GHSA-29VQ-49WR-VM6X vulnerabilities

Vulnerabilities for packages: mlflow, airflow, emissary, open-webui, kubeflow-pipelines-visualization-server, kubeflow-volumes-web-app, superset...

CVE-2026-27205 vulnerabilities

Vulnerabilities for packages: mlflow, airflow, emissary, open-webui, mitmproxy, kubeflow-volumes-web-app...

GHSA-29VQ-49WR-VM6X vulnerabilities

Vulnerabilities for packages: airflow, kubeflow-volumes-web-app, tensorflow-gpu-jupyter, litellm, airflow-core, mlflow, localstack, open-webui, tensorflow-cpu-jupyter, azure-functions-python-worker, kubeflow-pipelines-visualization-server, emissary, superset...

GHSA-68RP-WP8R-4726 vulnerabilities

Vulnerabilities for packages: airflow, kubeflow-volumes-web-app, mitmproxy, airflow-core, mlflow, open-webui, emissary...

CVE-2026-27205 vulnerabilities

Vulnerabilities for packages: airflow, kubeflow-volumes-web-app, mitmproxy, airflow-core, mlflow, open-webui, emissary...

CVE-2026-27199 vulnerabilities

Vulnerabilities for packages: airflow, kubeflow-volumes-web-app, tensorflow-gpu-jupyter, litellm, airflow-core, mlflow, localstack, open-webui, tensorflow-cpu-jupyter, azure-functions-python-worker, kubeflow-pipelines-visualization-server, emissary, superset...

CVE-2026-27115 ADB Explorer is Vulnerable to Arbitrary Directory Deletion via Command-Line Argument

ADB Explorer is a fluent UI for ADB on Windows. Versions 0.9.26020 and below have an unvalidated command-line argument that allows any user to trigger recursive deletion of arbitrary directories on the Windows filesystem. ADB Explorer accepts an optional path argument to set a custom data...

CVE-2026-2684

creationtimestamp| type| source ---|---|--- 2026-02-20 05:20:15+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mfbedrqbbb2a...

CVE-2026-2822 JeecgBoot Backend airag_app,1,create_by sql injection

A security vulnerability has been detected in JeecgBoot up to 3.9.1. The affected element is an unknown function of the file /jeecgboot/sys/dict/loadDict/airagapp,1,createby of the component Backend Interface. Such manipulation of the argument keyword leads to sql injection. The attack can be...

CVE-2026-26747

A Host Header Poisoning vulnerability exists in Monica 4.1.2 due to improper handling of the HTTP Host header in app/Providers/AppServiceProvider.php, combined with the default misconfiguration where the "app.forceurl" is not set and default is "false". The application generates absolute URLs suc...

CVE-2026-26747

A Host Header Poisoning vulnerability exists in Monica 4.1.2 due to improper handling of the HTTP Host header in app/Providers/AppServiceProvider.php, combined with the default misconfiguration where the "app.forceurl" is not set and default is "false". The application generates absolute URLs suc...

CVE-2026-26747

A Host Header Poisoning vulnerability exists in Monica 4.1.2 due to improper handling of the HTTP Host header in app/Providers/AppServiceProvider.php, combined with the default misconfiguration where the "app.forceurl" is not set and default is "false". The application generates absolute URLs suc...

CVE-2026-26959 ADB Explorer Vulnerable to RCE via Insufficient Input Validation

ADB Explorer is a fluent UI for ADB on Windows. Versions 0.9.26020 and below fail to validate the integrity or authenticity of the ADB binary path specified in the ManualAdbPath setting before executing it, allowing arbitrary code execution with the privileges of the current user. An attacker can...