CVE-2026-77474 dcg: Exponential-time command-substitution preprocessing lets a crafted command hang dcg and bypass the guard via hook-timeout fail-open

destructivecommandguard dcg is a command-line safety tool that blocks destructive shell commands before AI coding agents run them. Prior to 0.6.6, nested or unclosed substitutions are recursively rescanned after an inner scan returns unterminated, producing exponential-time work. The affected...

CVE-2026-77474

The destructive_command_guard (dcg) tool (prior to version 0.6.6 ) is vulnerable to an exponential-time command-substitution preprocessing flaw. The issue occurs because nested or unclosed substitutions (e.g., $( or $(() cause the scanner to recursively rescans the remaining command suffix. This ...

CVE-2026-77474 dcg: Exponential-time command-substitution preprocessing lets a crafted command hang dcg and bypass the guard via hook-timeout fail-open

destructivecommandguard dcg is a command-line safety tool that blocks destructive shell commands before AI coding agents run them. Prior to 0.6.6, nested or unclosed substitutions are recursively rescanned after an inner scan returns unterminated, producing exponential-time work. The affected...

CVE-2026-42270

The countly-server (the server-side component of Countly) is vulnerable to an unauthenticated Denial of Service (DoS) attack in versions prior to 24.05.50 and 25.03.44 . The root cause is that certain public image and screenshot routes—including star-rating/images/, dashboards/images/screenshots/...

CVE-2026-42270 countly-server: Unauthenticated Denial of Service (DoS) via Unhandled Stream Exception

countly-server is the server-side part of Countly, a product analytics solution. Prior to 24.05.50 and 25.03.44, star-rating/images/ and dashboards/images/screenshots/ are among public image and screenshot routes using the local fs storage backend that call getStream and pipe filesystem streams t...

CVE-2026-42270 countly-server: Unauthenticated Denial of Service (DoS) via Unhandled Stream Exception

countly-server is the server-side part of Countly, a product analytics solution. Prior to 24.05.50 and 25.03.44, star-rating/images/ and dashboards/images/screenshots/ are among public image and screenshot routes using the local fs storage backend that call getStream and pipe filesystem streams t...

CVE-2026-42269

The countly-server product analytics solution is vulnerable to a path traversal vulnerability in versions prior to 24.05.50 and 25.03.44 . The authenticated data-migration deletion route in plugins/data_migration/api/api.js fails to validate the user-controlled exportid parameter before passing i...

EUVD-2026-102915

countly-server is the server-side part of Countly, a product analytics solution. Prior to 24.05.50 and 25.03.44, the authenticated data-migration deletion route in plugins/datamigration/api/api.js passes the user-controlled exportid to cleanupdata without path validation...

CVE-2026-42269 countly-server: Path Traversal in delete_import Endpoint Allows Arbitrary File and Directory Deletion

countly-server is the server-side part of Countly, a product analytics solution. Prior to 24.05.50 and 25.03.44, the authenticated data-migration deletion route in plugins/datamigration/api/api.js passes the user-controlled exportid to cleanupdata without path validation...

CVE-2026-42269 countly-server: Path Traversal in delete_import Endpoint Allows Arbitrary File and Directory Deletion

countly-server is the server-side part of Countly, a product analytics solution. Prior to 24.05.50 and 25.03.44, the authenticated data-migration deletion route in plugins/datamigration/api/api.js passes the user-controlled exportid to cleanupdata without path validation...

CVE-2026-102923 SparkyFitness: SSRF via unvalidated custom_url in AI service settings

SparkyFitness is a self-hosted, AI-powered health and fitness tracker for families. Prior to 1.6.0, SparkyFitnessServer/services/chatService.ts and SparkyFitnessServer/services/labelScanService.ts do not validate destinations supplied in custom AI service settings. An authenticated user saves a...

CVE-2026-102923

Prior to version 1.6.0 , the SparkyFitness health and fitness tracker is vulnerable to Server-Side Request Forgery (SSRF) . The flaw exists because the components SparkyFitnessServer/services/chatService.ts and SparkyFitnessServer/services/labelScanService.ts fail to validate destinations provide...

CVE-2026-102923 SparkyFitness: SSRF via unvalidated custom_url in AI service settings

SparkyFitness is a self-hosted, AI-powered health and fitness tracker for families. Prior to 1.6.0, SparkyFitnessServer/services/chatService.ts and SparkyFitnessServer/services/labelScanService.ts do not validate destinations supplied in custom AI service settings. An authenticated user saves a...

CVE-2026-68907

libIEC61850 is an open-source implementation of IEC 61850 client and server protocols including MMS, GOOSE, Sampled Values, and R-Session. Prior to 1.6.2, checkDataSetAccess reverses the source and destination arguments to StringUtilscopyStringToBuffer while constructing an MMSASSOCIATIONSPECIFIC...

EUVD-2026-102911

libIEC61850 is an open-source implementation of IEC 61850 client and server protocols including MMS, GOOSE, Sampled Values, and R-Session. Prior to 1.6.2, checkDataSetAccess reverses the source and destination arguments to StringUtilscopyStringToBuffer while constructing an MMSASSOCIATIONSPECIFIC...

CVE-2026-68907 libIEC61850: Server-side out-of-bounds stack read in association-specific dynamic dataset creation due to reversed StringUtils_copyStringToBuffer arguments

libIEC61850 is an open-source implementation of IEC 61850 client and server protocols including MMS, GOOSE, Sampled Values, and R-Session. Prior to 1.6.2, checkDataSetAccess reverses the source and destination arguments to StringUtilscopyStringToBuffer while constructing an MMSASSOCIATIONSPECIFIC...

CVE-2026-68907 libIEC61850: Server-side out-of-bounds stack read in association-specific dynamic dataset creation due to reversed StringUtils_copyStringToBuffer arguments

libIEC61850 is an open-source implementation of IEC 61850 client and server protocols including MMS, GOOSE, Sampled Values, and R-Session. Prior to 1.6.2, checkDataSetAccess reverses the source and destination arguments to StringUtilscopyStringToBuffer while constructing an MMSASSOCIATIONSPECIFIC...

CVE-2026-68907

The libIEC61850 library, an open-source implementation of IEC 61850 protocols, contains a server-side out-of-bounds stack read vulnerability in versions prior to 1.6.2 . The root cause is in the checkDataSetAccess function, which reverses the source and destination arguments when calling StringUt...

CVE-2026-48503 libIEC61850: Remote information disclosure in MMS file service via out-of-range initialPosition in fileOpen followed by fileRead

libIEC61850 is an open-source implementation of IEC 61850 client and server protocols including MMS, GOOSE, Sampled Values, and R-Session. Prior to 1.6.2, the MMS file service in src/mms/isomms/server/mmsfileservice.c accepts an out-of-range initialPosition in fileOpen and stores it in the...

CVE-2026-48503 libIEC61850: Remote information disclosure in MMS file service via out-of-range initialPosition in fileOpen followed by fileRead

libIEC61850 is an open-source implementation of IEC 61850 client and server protocols including MMS, GOOSE, Sampled Values, and R-Session. Prior to 1.6.2, the MMS file service in src/mms/isomms/server/mmsfileservice.c accepts an out-of-range initialPosition in fileOpen and stores it in the...