CVE-2026-61842

Grav (file-based web platform) versions prior to 2.0.2 contain a Twig sandbox bypass in the content rendering pipeline. The sandbox replaces the config variable with a redacted facade and strips Config::get/toArray from the method allowlist, but the raw configuration container remains accessible ...

CVE-2026-45273

MyBooks is an ebook management web server also known as Talebook. In 3.41.2 and earlier, the AdminSettings.post handler for POST /api/admin/settings in webserver/handlers/admin.py applies the auth decorator but does not check the self.adminuser property, unlike the corresponding GET handler. Any...

CVE-2026-45274

MyBooks is anebook management web server also known as Talebook. In 3.41.2 and earlier, the SignUp.post handler for POST /api/user/signup in webserver/handlers/user.py does not enforce the ALLOWREGISTER configuration flag, even though the frontend hides registration controls when the flag is fals...

Security Bulletin: IBM® Db2® federated server is affected by a vulnerability in commons-configuration2-2.10.1 (CVE-2026-45205)

Summary IBM® Db2® federated server is affected by a vulnerability in commons-configuration2-2.10.1 CVE-2026-45205 Vulnerability Details CVEID:CVE-2026-45205 DESCRIPTION: Uncontrolled Recursion vulnerability in Apache Commons. When processing an untrusted configuration file, Commons Configuration...

CVE-2026-45274 MyBooks: Unauthenticated Registration Bypass via Missing Server-Side ALLOW_REGISTER Enforcement

MyBooks is anebook management web server also known as Talebook. In 3.41.2 and earlier, the SignUp.post handler for POST /api/user/signup in webserver/handlers/user.py does not enforce the ALLOWREGISTER configuration flag, even though the frontend hides registration controls when the flag is fals...

CVE-2026-45273

MyBooks (also known as Talebook ), an ebook management web server, is vulnerable to privilege escalation in versions 3.41.2 and earlier . The AdminSettings.post handler for POST /api/admin/settings in webserver/handlers/admin.py applies authentication but omits the self.admin_user authorization c...

CVE-2026-45273 MyBooks: Privilege Escalation via Missing Authorization on Admin Settings Endpoint

MyBooks is an ebook management web server also known as Talebook. In 3.41.2 and earlier, the AdminSettings.post handler for POST /api/admin/settings in webserver/handlers/admin.py applies the auth decorator but does not check the self.adminuser property, unlike the corresponding GET handler. Any...

EUVD-2026-62484

MyBooks is an ebook management web server also known as Talebook. In 3.41.2 and earlier, the AdminSettings.post handler for POST /api/admin/settings in webserver/handlers/admin.py applies the auth decorator but does not check the self.adminuser property, unlike the corresponding GET handler. Any...

CVE-2026-45273 MyBooks: Privilege Escalation via Missing Authorization on Admin Settings Endpoint

MyBooks is an ebook management web server also known as Talebook. In 3.41.2 and earlier, the AdminSettings.post handler for POST /api/admin/settings in webserver/handlers/admin.py applies the auth decorator but does not check the self.adminuser property, unlike the corresponding GET handler. Any...

ghidra Ghidra_12.1.3_build

Dockerized Ghidra Build From the root directory of your Ghidra release, run the following command. root@kitploit: ./docker/build-docker-image.sh This will build the ghidra docker image with a tag corresponding to the release version of Ghidra. The MODE environment variable The Ghidra Docker...

CVE-2026-76241

stigmem-node 0.9.0a1 allows plugin signature enforcement to be disabled via a single configuration flag without a second explicit acknowledgment. If that setting is carried into an environment where plugin directories are writable by less-trusted users, unsigned potentially malicious plugin code...

CVE-2026-76230

Renovate versions from 35.63.0 before 40.33.0 contain a command injection vulnerability in the npm manager where user-provided packageName values are appended to npm install commands without proper sanitization. Attackers with repository write access can craft malicious Renovate configuration fil...

CVE-2026-76211

phpMyFAQ before 4.1.7 fails to properly enforce CONFIGURATIONEDIT permission on admin API read endpoints for LDAP, Elasticsearch, OpenSearch, and dashboard configuration, allowing any authenticated user to access sensitive administrative data. Attackers can retrieve LDAP server topology, bind...

CVE-2026-76244 stigmem-node Insecure Federation Transport Configuration

stigmem-node contains an insecure default configuration vulnerability that allows federation traffic to traverse networks without mTLS protection when non-loopback endpoints are enabled. Operators who explicitly disabled mTLS while binding federation to non-loopback addresses expose federation...

CVE-2026-76244 stigmem-node Insecure Federation Transport Configuration

stigmem-node contains an insecure default configuration vulnerability that allows federation traffic to traverse networks without mTLS protection when non-loopback endpoints are enabled. Operators who explicitly disabled mTLS while binding federation to non-loopback addresses expose federation...

CVE-2026-76241

stigmem-node 0.9.0a1 lets an operator disable plugin signature enforcement via a single configuration flag without confirmation. If plugin directories are writable by less-trusted users, unsigned malicious plugins can be loaded, causing arbitrary code execution. Upgrade to 0.9.0a2, which requires...

CVE-2026-76241 stigmem Plugin Signature Enforcement Bypass via Configuration

stigmem-node 0.9.0a1 allows plugin signature enforcement to be disabled via a single configuration flag without a second explicit acknowledgment. If that setting is carried into an environment where plugin directories are writable by less-trusted users, unsigned potentially malicious plugin code...

CVE-2026-76241 stigmem Plugin Signature Enforcement Bypass via Configuration

stigmem-node 0.9.0a1 allows plugin signature enforcement to be disabled via a single configuration flag without a second explicit acknowledgment. If that setting is carried into an environment where plugin directories are writable by less-trusted users, unsigned potentially malicious plugin code...

CVE-2026-76241 stigmem Plugin Signature Enforcement Bypass via Configuration

stigmem-node 0.9.0a1 allows plugin signature enforcement to be disabled via a single configuration flag without a second explicit acknowledgment. If that setting is carried into an environment where plugin directories are writable by less-trusted users, unsigned potentially malicious plugin code...

CVE-2026-76230

Renovate (renovatebot/renovate) versions 35.63.0 through 40.32.x contain a command injection vulnerability in the npm manager . The root cause is that user-provided packageName values are appended to npm install commands in lib/modules/manager/npm/post-update/npm.ts without being escaped via the ...