CVE-2026-57586 CodeRAG: Gradle Wrapper Execution During Dependency Discovery Enables Arbitrary Code Execution

CodeRAG is a lightweight semantic code search and distillation utility for AI coding agents. Prior to 1.3.1, the default agent-coderag sync flow in coderag/entry/cli.py calls syncdependencies for an indexed path, and coderag/core/manager.py treats build.gradle or build.gradle.kts as sufficient to...

EUVD-2026-77683

Flask-Reuploaded provides file uploads for Flask. From 1.5.0 until 1.6.0, UploadSet.savestorage, name=... in src/flaskuploads/flaskuploads.py applies lowercaseext to the default upload path but uses the case-preserving extension helper for a caller-supplied name before extensionallowed evaluates ...

Astra Linux – Vulnerability in imagemagick

A vulnerability was discovered in ImageMagick-7.0.11-5, where executing a specially crafted file using the “convert” command allows ASAN to detect memory leaks...

Astra Linux – Vulnerability in docker.io

Moby is an open-source project created by Docker to enable software containerization. A bug was discovered in Moby Docker Engine, where the data directory /var/lib/docker, which typically has restricted permissions, contained subdirectories with insufficiently restricted permissions. This allowed...

CVE-2026-54567: Improper Handling of Case Sensitivity

Flask-Reuploaded provides file uploads for Flask. From 1.5.0 until 1.6.0, UploadSet.savestorage, name=... in src/flaskuploads/flaskuploads.py applies lowercaseext to the default upload path but uses the case-preserving extension helper for a caller-supplied name before extensionallowed evaluates ...

CVE-2026-84869

A condition in the ScreenConnect client may allow files to be transferred and executed through an active remote session without authorization or Host confirmation in certain circumstances. ScreenConnect servers are not impacted...

CVE-2026-84869

CVE-2026-84869 affects the ScreenConnect client (by ConnectWise). A condition in the client allows a guest to transfer and execute files on the host through an active remote session without proper authorization or Host confirmation, as described in the CVELIST record title. ScreenConnect servers ...

CVE-2026-84869 ScreenConnect Client: Guest-to-Host File Execution via File-Transfer Actions

A condition in the ScreenConnect client may allow files to be transferred and executed through an active remote session without authorization or Host confirmation in certain circumstances. ScreenConnect servers are not impacted...

CVE-2026-84869 ScreenConnect Client: Guest-to-Host File Execution via File-Transfer Actions

A condition in the ScreenConnect client may allow files to be transferred and executed through an active remote session without authorization or Host confirmation in certain circumstances. ScreenConnect servers are not impacted...

CVE-2026-78069

Joomla Extension - j2commerce.com - Missing authorization on Apps controller delegation chain in J2Store 1.0.0-3.3.21, 4.0.0-4.0.21, 4.1.0-4.1.6 - J2StoreControllerApps's appTask delegation path instantiates app-plugin controllers with no ACL check anywhere in the code. It currently returns 403...

CVE-2026-78069 Joomla Extension - j2commerce.com - Missing authorization on Apps controller delegation chain in J2Store 1.0.0-3.3.21, 4.0.0-4.0.21, 4.1.0-4.1.6

Joomla Extension - j2commerce.com - Missing authorization on Apps controller delegation chain in J2Store 1.0.0-3.3.21, 4.0.0-4.0.21, 4.1.0-4.1.6 - J2StoreControllerApps's appTask delegation path instantiates app-plugin controllers with no ACL check anywhere in the code. It currently returns 403...

EUVD-2026-70445

Joomla Extension - j2commerce.com - Missing authorization on Apps controller delegation chain in J2Store 1.0.0-3.3.21, 4.0.0-4.0.21, 4.1.0-4.1.6 - J2StoreControllerApps's appTask delegation path instantiates app-plugin controllers with no ACL check anywhere in the code. It currently returns 403...

CVE-2026-78069

CVE-2026-78069 affects the J2Store Joomla extension (by j2commerce.com), versions 1.0.0–3.3.21, 4.0.0–4.0.21, and 4.1.0–4.1.6 . The root cause is a missing authorization check in the J2StoreControllerApps appTask delegation path, which instantiates app-plugin controllers with no deliberate ACL ch...

CVE-2026-78069: Missing Authorization

Joomla Extension - j2commerce.com - Missing authorization on Apps controller delegation chain in J2Store 1.0.0-3.3.21, 4.0.0-4.0.21, 4.1.0-4.1.6 - J2StoreControllerApps's appTask delegation path instantiates app-plugin controllers with no ACL check anywhere in the code. It currently returns 403...

Malicious code in python-walletlibr-v (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6783cffec9c8f9377babacd1cb4490a278bace564b34861bf49b35258be7220c python-walletlibr-v is a wallet-lookalike PyPI package that ships no wallet functionality — only a stub hello that prints 'Hello from my custom...

CVE-2026-34741

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, authentication bypass allows unauthenticated remote attackers to execute arbitrary PHP files from the env-production directory on a new iTop instance in the production environment. This issue has been fixed in version 3.2.3...

EUVD-2026-64183

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, authentication bypass allows unauthenticated remote attackers to execute arbitrary PHP files from the env-production directory on a new iTop instance in the production environment. This issue has been fixed in version 3.2.3...

CVE-2026-34741

Combodo iTop (web-based IT service management tool) is affected by an authentication bypass in exec.php that allows unauthenticated remote attackers to execute arbitrary PHP files from the env-production directory on a new iTop instance in the production environment. The vulnerability is rated CV...

CVE-2026-34741 Combodo iTop: Authentication bypass in exec.php allows PHP file execution

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, authentication bypass allows unauthenticated remote attackers to execute arbitrary PHP files from the env-production directory on a new iTop instance in the production environment. This issue has been fixed in version 3.2.3...

CVE-2026-34741 Combodo iTop: Authentication bypass in exec.php allows PHP file execution

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, authentication bypass allows unauthenticated remote attackers to execute arbitrary PHP files from the env-production directory on a new iTop instance in the production environment. This issue has been fixed in version 3.2.3...