CVE-2026-49244

SFTPGo (open-source file transfer solution) versions 2.2.0 through 2.7.3 contain a path confinement bypass in the public web-client partial ZIP download endpoint for browsable shares. The root cause is a raw byte-prefix comparison used to validate client-supplied file entries instead of a directo...

CVE-2026-54509

TREK (collaborative travel planner) versions 3.0.0 through 3.1.0 contain an IDOR vulnerability in the GET /api/journeys/:id/share-link route. The endpoint returns a journey share token without verifying that the authenticated requester owns or has access to the target journey. Because journey IDs...

CVE-2026-65801 Microsoft Exchange Online Elevation of Privilege Vulnerability

...

CVE-2026-65801

CVE-2026-65801 is a critical (CVSS 3.1: 10.0) server-side request forgery (SSRF) vulnerability in Microsoft Exchange Online that allows an unauthorized, unauthenticated attacker to elevate privileges over a network . The attack requires no user interaction, no prior privileges, and has low comple...

CVE-2026-67448 Mailpit: WebSocket origin check bypass via percent-encoded path (regression of CVE-2026-22689)

Mailpit is an email testing tool and API for developers. From 1.29.0 until 1.30.6, Mailpit's server/server.go origin middleware checks the raw RequestURI for the /api/ prefix while Go's ServeMux routes using the percent-decoded URL path, and server/websockets/client.go configures...

CVE-2026-67448 Mailpit: WebSocket origin check bypass via percent-encoded path (regression of CVE-2026-22689)

Mailpit is an email testing tool and API for developers. From 1.29.0 until 1.30.6, Mailpit's server/server.go origin middleware checks the raw RequestURI for the /api/ prefix while Go's ServeMux routes using the percent-decoded URL path, and server/websockets/client.go configures...

CVE-2026-67447 Mailpit: SMTP DATA line reader buffers over-limit input before size enforcement

Mailpit is an email testing tool and API for developers. From 1.30.0 until 1.30.5, Mailpit's internal/smtpd/smtpd.go readData function calls bufio.Reader.ReadBytes before applying the lendata+lenline size check to the completed SMTP DATA line against Server.MaxSize. An unauthenticated SMTP client...

EUVD-2026-63663

Mailpit is an email testing tool and API for developers. Prior to 1.30.4, Mailpit reads SMTP commands through internal/smtpd/smtpd.go session.readLine using bufio.Reader.ReadString before session.parseLine parses the verb or the RFC 5321 512-octet command-line limit is enforced. An unauthenticate...

EUVD-2026-63661

Improper Neutralization of CRLF Sequences 'CRLF Injection' vulnerability in mtrudel bandit allows an unauthenticated remote attacker to smuggle CR, LF, or NUL characters into application-visible request headers via HTTP/2. Bandit.HTTP2.Stream.readheaders/1 validates pseudo-header placement and...

CVE-2026-67446 Mailpit: Thumbnail generation decodes unbounded image dimensions before scaling

Mailpit is an email testing tool and API for developers. Prior to 1.30.4, Mailpit decodes attacker-supplied image attachments into a full raster before checking decoded dimensions, pixel count, or memory use in the GET /api/v1/message/id/part/partID/thumb endpoint. The Thumbnail handler in...

CVE-2026-43798

CVE-2026-43798 is an out-of-bounds stack write vulnerability in swift-nio-ssh , Apple's SSH library for Swift. A single crafted SSH message allows an unauthenticated network attacker to write attacker-controlled data of attacker-controlled length to an out-of-bounds stack location in any applicat...

CVE-2026-61712 vulnerabilities

Vulnerabilities for packages: guac, kaniko, podman, scorecard, kubescape, conftest...

CVE-2026-72861

The github-issue-bot templates in appwrite/templates verify the GitHub webhook signature with an inverted condition. verifyWebhook in node/github-issue-bot/src/github.js and in node-typescript/github-issue-bot/src/github.ts returns "typeof signature !== 'string' || await verify...", so when the...

CVE-2026-72861

In Appwrite templates' github-issue-bot, verifyWebhook uses an inverted condition (typeof signature !== 'string' || (await verify(...))) that short-circuits to success when the X-Hub-Signature-256 header is absent, skipping HMAC verification. Unauthenticated callers can then post arbitrary commen...

CVE-2026-19586

A pre-authentication OS command injection vulnerability has been identified in Omada gateways configured to operate as an OpenVPN Server due to insufficient validation of client-supplied data during OpenVPN connection establishment. An unauthenticated remote attacker may provide specially crafted...

CVE-2026-64777

CVE-2026-64777 affects Apple's container tool. A malicious builder peer can request an in-context file by name from the host and receive the contents of whatever that name resolves to, even when it resolves outside the build context . This is a path-traversal-style information disclosure: the fil...

Winter: Reflected XSS through the search query parameter in the backend Table widget

Impact Affected versions of Winter CMS render the search query parameter without HTML encoding inside a block in the backend Table widget partial modules/backend/widgets/table/partials/table.php: php value="" is an HTML raw-text context, so the surrounding value="…" attribute quoting is not a...

Fleet: Unauthenticated download of in-house iOS app binaries via predictable URLs

Summary Two endpoints serving in-house iOS application packages and manifests in Fleet's enterprise tier are reachable without a hard-to-guess token in the URL, allowing an unauthenticated attacker who can reach the Fleet server to download an in-house IPA by guessing sequential title identifiers...

EUVD-2026-44820

Qinglong has an incomplete fix for CVE-2026-3965: Improper Authentication...

GHSA-2P39-2JF3-FV2Q next-video: Unauthenticated arbitrary file read via /api/video request handler

Impact The HTTP route handler exported by next-video/request-handler — which the README instructs consumers to mount at /api/video — allows an unauthenticated remote attacker to read arbitrary .json files from the production filesystem of any application following the documented setup. The...