CVE-2026-71251 Akaunting - Cross-Company Media IDOR in Customer Portal Download Endpoint

Akaunting's shared download route app/Http/Controllers/Common/Uploads.php::download, reachable at uploads/id/download behind only generic auth middleware fetched the requested Media record by ID with no verification that it belonged to the requesting portal customer's own company, allowing any...

CVE-2026-71245

CVE-2026-71245 is explicitly rejected; Red Hat CNA-LR concluded it is not valid, so it does not represent an active vulnerability entry and no risk assessment applies.

CVE-2026-71245

...

CVE-2026-67554

CVE-2026-67554 affects Apache Qpid Proton-Dotnet up to version 1.0.0. An authenticated attacker can craft a disposition frame with large or illegal ranges due to naive range handling, causing excessive CPU usage and leading to denial of service. Product: Apache Qpid Proton-Dotnet (affected); Root...

CVE-2026-70485

CVE-2026-70485 – Open WebUI : Affected versions 0.9.0 through 0.11.0 of the Open WebUI self-hosted AI platform check whether a user-provided URL is globally routable by applying ipaddress.is_global to the literal IPv6 address, without considering embedded IPv4 in transition encodings. In NAT64 de...

CVE-2026-49131

OPNsense prior to 26.1.9 is affected by a stored XSS in the firewall rule description field (via the filter API). Unsanitized descriptions are persisted and later rendered by opnsense_bootgrid.js using innerHTML, allowing an authenticated attacker with firewall rule management privileges to execu...

CVE-2026-11872 Clever Mega Menu for Visual Composer <= 1.0.1 - Subscriber+ Menu Item Meta Update via save_clever_menu_item

The Clever Mega Menu for Visual Composer WordPress plugin through 1.0.1 does not perform a nonce or capability check in an AJAX action that updates navigation menu item metadata, allowing any authenticated user, including Subscribers, to overwrite menu item content and settings that are rendered ...

CVE-2026-2411

Zephyr's Bluetooth host declares a GATT characteristic as two consecutive attributes: a Characteristic Declaration whose permission is hard-coded to BTGATTPERMREAD, and a Characteristic Value attribute that carries the application-specified security permissions e.g. BTGATTPERMREADENCRYPT /...

CVE-2026-55825

Contao is an Open Source CMS. In versions 5.7.0 through 5.7.6, an authenticated backend user who can access one job can request an attachment identifier containing ../ segments and make the job attachment download endpoint read a file from another job directory inside var/job-attachments. The...

CVE-2026-14929

The JS Help Desk WordPress plugin before 3.1.4 does not verify ownership of the targeted reply before updating it, allowing any authenticated user Subscriber and above to overwrite the content of any support-ticket reply on the site...

EUVD-2026-51416

The Paid Membership Subscriptions WordPress plugin before 3.0.7 does not perform capability or nonce checks on one of its payment-related AJAX actions, allowing any authenticated user with Subscriber-level access and above to disclose the payment details of any member by enumerating the payment...

CVE-2026-5492

DriveLock Directory Traversal Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of DriveLock. Authentication is required to exploit this vulnerability. The specific flaw exists within the web service, which...

CVE-2026-5490

DriveLock SQL Injection Privilege Escalation Vulnerability. This vulnerability allows remote attackers to escalate privileges on affected installations of DriveLock. Authentication is required to exploit this vulnerability. The specific flaw exists within the web service, which listens on TCP por...

CVE-2026-5492 DriveLock Directory Traversal Information Disclosure Vulnerability

DriveLock Directory Traversal Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of DriveLock. Authentication is required to exploit this vulnerability. The specific flaw exists within the web service, which...

EUVD-2026-50496

DriveLock Directory Traversal Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of DriveLock. Authentication is required to exploit this vulnerability. The specific flaw exists within the web service, which...

CVE-2026-5492

The DriveLock vulnerability CVE-2026-5492 affects the web service listening on TCP 4568. It stems from insufficient validation of a user-supplied path, enabling a directory traversal that can disclose information in the context of the service account. Exploitation requires authentication and is d...

EUVD-2026-50494

DriveLock SQL Injection Privilege Escalation Vulnerability. This vulnerability allows remote attackers to escalate privileges on affected installations of DriveLock. Authentication is required to exploit this vulnerability. The specific flaw exists within the web service, which listens on TCP por...

CVE-2026-5490 DriveLock SQL Injection Privilege Escalation Vulnerability

DriveLock SQL Injection Privilege Escalation Vulnerability. This vulnerability allows remote attackers to escalate privileges on affected installations of DriveLock. Authentication is required to exploit this vulnerability. The specific flaw exists within the web service, which listens on TCP por...

CVE-2026-5490

CVE-2026-5490 involves DriveLock where the web service (listening on TCP 4568 by default) constructs SQL queries from unvalidated user input, leading to a SQL Injection that can escalate privileges. The vulnerability is network-accessible and requires authentication to exploit, with impact descri...

EUVD-2026-50487

Heimdall Data Database Proxy generateFileContent CRLF Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Heimdall Data Database Proxy. Authentication is required to exploit this vulnerability. The specif...