CVE-2026-61808

LightRAG provides simple and fast retrieval-augmented generation. Through version 1.5.4, the LightRAG API server binds to all network interfaces with authentication disabled by default, allowing an unauthenticated network attacker to read indexed document content, upload or delete documents, modi...

CVE-2026-61808 LightRAG: Missing Authentication for Critical API Functions in Default Configuration

LightRAG provides simple and fast retrieval-augmented generation. Through version 1.5.4, the LightRAG API server binds to all network interfaces with authentication disabled by default, allowing an unauthenticated network attacker to read indexed document content, upload or delete documents, modi...

CVE-2026-61808

CVE-2026-61808 affects LightRAG up to version 1.5.4, where the API server binds to all network interfaces with authentication disabled by default. This allows an unauthenticated network attacker to read indexed documents, upload or delete documents, modify the knowledge graph, cancel pipelines, c...

CVE-2026-19016

Affected software: Consul Community Edition and Consul Enterprise (versions 1.19.1–2.0.2). Issue: Authorization bypass for session deletion via the transaction API. The vulnerability arises because the session:write ACL permission was not enforced for session deletion operations through the trans...

CVE-2026-19231 SourceCodester Simple Doctors Appointment System ajax.php delete_appointment sql injection

A security flaw has been discovered in SourceCodester Simple Doctors Appointment System 1.0. This vulnerability affects unknown code of the file /admin/ajax.php?action=deleteappointment. The manipulation of the argument ID results in sql injection. The attack may be launched remotely. The exploit...

CVE-2026-19231 SourceCodester Simple Doctors Appointment System ajax.php delete_appointment sql injection

A security flaw has been discovered in SourceCodester Simple Doctors Appointment System 1.0. This vulnerability affects unknown code of the file /admin/ajax.php?action=deleteappointment. The manipulation of the argument ID results in sql injection. The attack may be launched remotely. The exploit...

EUVD-2026-54575

A security flaw has been discovered in SourceCodester Simple Doctors Appointment System 1.0. This vulnerability affects unknown code of the file /admin/ajax.php?action=deleteappointment. The manipulation of the argument ID results in sql injection. The attack may be launched remotely. The exploit...

CVE-2026-19231

CVE-2026-19231 : A vulnerability in SourceCodester Simple Doctors Appointment System 1.0 affects the unknown code path in /admin/ajax.php?action=delete_appointment where manipulating the argument ID leads to SQL injection . The issue can be exploited remotely with no authentication, as implied by...

CVE-2026-66493

Joomla Extension - phoca.cz - Path Traversal vulnerability in Phoca Commander 1.0.0-6.1.3 - Improper limitation of paths for delete, copy and move actions lead to path traversal vulnerabilities...

sctp: don't free the ASCONF's own transport in DEL-IP processing

...

CVE-2026-66493

CVE-2026-66493 affects the Joomla extension Phoca Commander (phoca.cz) versions 1.0.0 through 6.1.3. The issue is a path traversal vulnerability caused by improper limitation of paths for delete, copy, and move actions. The CVSS data indicates NETWORK access with low complexity and high privilege...

CVE-2026-66493 Joomla Extension - phoca.cz - Path traversal vulnerability in Phoca Commander 1.0.0-6.1.3

Joomla Extension - phoca.cz - Path Traversal vulnerability in Phoca Commander 1.0.0-6.1.3 - Improper limitation of paths for delete, copy and move actions lead to path traversal vulnerabilities...

EUVD-2026-54409

Joomla Extension - phoca.cz - Path Traversal vulnerability in Phoca Commander 1.0.0-6.1.3 - Improper limitation of paths for delete, copy and move actions lead to path traversal vulnerabilities...

CVE-2026-66493

Joomla Extension - phoca.cz - Path Traversal vulnerability in Phoca Commander 1.0.0-6.1.3 - Improper limitation of paths for delete, copy and move actions lead to path traversal vulnerabilities...

SUSE CVE-2026-64564

In the Linux kernel, the following vulnerability has been resolved: sctp: don't free the ASCONF's own transport in DEL-IP processing sctpprocessasconf caches the transport the ASCONF chunk is processed against in asconf-transport == chunk-transport, set once in sctprcv. For an ASCONF located...

CVE-2026-19054

A vulnerability was detected in Lspace-io lspace-server up to 79f02fe5aa8970b210a6a05cf097155f8d9ffd71. This issue affects the function fileExists/readFile/writeFile/deleteFile of the file src/core/repository.ts of the component Repositories File API. Performing a manipulation of the argument...

CVE-2026-19054

CVE-2026-19054 affects Lspace-io lspace-server (Repositories File API) with a path traversal in the repository.ts file between fileExists/readFile/writeFile/deleteFile. The vulnerability is triggered by manipulating the argument filePath and is limited to local access. No version details or publi...

EUVD-2026-54096

llama.cpp builds b1886 through b7445 contain a double free vulnerability in the LLaMA-Android JNI wrapper where new1batch allocates memory using malloc while free1batch deallocates it using the C++ delete operator, causing heap metadata corruption. Attackers can trigger this memory management...

CVE-2026-43622 llama.cpp b1886–b7445 Double Free via llama-android.cpp

llama.cpp builds b1886 through b7445 contain a double free vulnerability in the LLaMA-Android JNI wrapper where new1batch allocates memory using malloc while free1batch deallocates it using the C++ delete operator, causing heap metadata corruption. Attackers can trigger this memory management...

CVE-2026-18258

CVE-2026-18258 affects Scripta/eScriptorium up to version 26.04.1, impacting the Line, LineTranscription, VirtualCollection, tag and process API endpoints. The root cause is authorization bypass where a remote authenticated user can read, modify, and delete other users’ transcription content. Thi...