CVE-2026-87809: Authorization Bypass Through User-Controlled Key

Siyuan before v3.8.2 fails to apply publish-access filtering to embedded blocks before rendering in the /api/export/preview and /api/lute/copyStdMarkdown endpoints. Attackers with reader access can retrieve the full rendered content of private, hidden, or publish-disabled blocks by accessing publ...

CVE-2026-86742: Improper Neutralization of Formula Elements in a CSV File

Snipe-IT through 8.6.3 does not neutralize formula elements in the "unaccepted assets" acceptance report CSV export. ReportsController::postAssetAcceptanceReport builds the CSV by hand stripping commas and joining rows manually and, unlike the six sibling exports in the same controller, never...

PT-2026-89027

Snipe-IT before 8.7.0 fails to properly enforce the viewKeys authorization gate in CSV export and API index endpoints, allowing authenticated users with only licenses.view permission to access product keys. Attackers can download all license keys in bulk via CSV export or validate candidate keys...

PT-2026-88842

Improper export of android application components in Bixby Touch prior to version 4.3.01.17 allows local attackers to access sensitive information...

CVE-2026-21113: Improper Export of Android Application Components

Improper export of android application components in Visual Voicemail prior to version 20.1.00.05 allows local attackers to initiate call without proper permission...

CVE-2026-21108: Improper Export of Android Application Components

Improper export of android application components in Bixby Touch prior to version 4.3.01.17 allows local attackers to access sensitive information...

CVE-2026-86758: Observable Response Discrepancy

Snipe-IT before 8.7.0 fails to properly enforce the viewKeys authorization gate in CSV export and API index endpoints, allowing authenticated users with only licenses.view permission to access product keys. Attackers can download all license keys in bulk via CSV export or validate candidate keys...

kernel: vfio/pci: Check BAR resources before exporting a DMABUF

A flaw was found in the Linux kernel's vfio/pci subsystem. This vulnerability occurs because the Direct Memory Access Buffer DMABUF export mechanism does not adequately verify if Base Address Register BAR resources are properly reserved before allowing access. A local attacker could exploit this ...

CVE-2026-86257

wger before 2.6 fails to sanitize firstname and lastname fields in the gym member TSV export endpoint, allowing any gym member to inject spreadsheet formulas. Attackers can inject formulas like =HYPERLINK to exfiltrate admin data or execute code when admins open the exported file in Excel or...

CVE-2026-86257

CVE-2026-86257 affects wger before version 2.6 . The root cause is a lack of sanitization on the first_name and last_name fields in the gym member TSV export endpoint , enabling any gym member to inject spreadsheet formulas such as =HYPERLINK. When an admin opens the exported file in Excel or Lib...

CVE-2026-86257 wger before 2.6 CSV Formula Injection via member export

wger before 2.6 fails to sanitize firstname and lastname fields in the gym member TSV export endpoint, allowing any gym member to inject spreadsheet formulas. Attackers can inject formulas like =HYPERLINK to exfiltrate admin data or execute code when admins open the exported file in Excel or...

CVE-2026-86257 wger before 2.6 CSV Formula Injection via member export

wger before 2.6 fails to sanitize firstname and lastname fields in the gym member TSV export endpoint, allowing any gym member to inject spreadsheet formulas. Attackers can inject formulas like =HYPERLINK to exfiltrate admin data or execute code when admins open the exported file in Excel or...

CVE-2026-86257 wger before 2.6 CSV Formula Injection via member export

wger before 2.6 fails to sanitize firstname and lastname fields in the gym member TSV export endpoint, allowing any gym member to inject spreadsheet formulas. Attackers can inject formulas like =HYPERLINK to exfiltrate admin data or execute code when admins open the exported file in Excel or...

EUVD-2026-72113

wger before 2.6 fails to sanitize firstname and lastname fields in the gym member TSV export endpoint, allowing any gym member to inject spreadsheet formulas. Attackers can inject formulas like =HYPERLINK to exfiltrate admin data or execute code when admins open the exported file in Excel or...

PT-2026-86526

wger before 2.6 fails to sanitize first name and last name fields in the gym member TSV export endpoint, allowing any gym member to inject spreadsheet formulas. Attackers can inject formulas like =HYPERLINK to exfiltrate admin data or execute code when admins open the exported file in Excel or...

CVE-2026-86257: Improper Neutralization of Formula Elements in a CSV File

wger before 2.6 fails to sanitize firstname and lastname fields in the gym member TSV export endpoint, allowing any gym member to inject spreadsheet formulas. Attackers can inject formulas like =HYPERLINK to exfiltrate admin data or execute code when admins open the exported file in Excel or...

Signal-iOS v8.27.0.1843

Signal iOS Signal is a free and open source messaging app for simple private communication with friends. Also available on Android and Desktop. Questions? For troubleshooting and questions, please visit our support center or unofficial community forum. Contributing Bug Reports The best way to...

scanopy v0.17.14

Scanopy Network documentation, without the drawing. Scanopy replaces manual network diagrams with a continuously maintained model of what's actually running. A single daemon scans on a schedule and produces four views from each scan: L2 physical, L3 logical, workloads, and applications. Unlike...

CVE-2026-50553

Note Mark is an open-source note-taking application. Prior to version 0.19.5, Note Mark validates book and note slug values with the OpenAPI/huma tag pattern:"a-z0-9-+". huma compiles this with regexp.MustCompiles.Pattern and tests it with patternRe.MatchStringstr, an UNANCHORED match. Because th...

CVE-2026-50553 Note Mark: Path traversal via unsanitized book/note slug in migrate export (sibling of GHSA-g49p)

Note Mark is an open-source note-taking application. Prior to version 0.19.5, Note Mark validates book and note slug values with the OpenAPI/huma tag pattern:"a-z0-9-+". huma compiles this with regexp.MustCompiles.Pattern and tests it with patternRe.MatchStringstr, an UNANCHORED match. Because th...