1657 matches found
CVE-2026-70558 Dinky Unauthenticated Arbitrary File Write via /download/uploadFromRsByLocal Gated Only by Hardcoded Default Token
Dinky's POST /download/uploadFromRsByLocal handler passes the caller-supplied path parameter directly to new Filepath and file.transferTodest with no path validation. The route is marked @SaIgnore and /download/ is excluded from the Sa-Token interceptor, so the only guard is a header equality che...
CVE-2026-70558 Dinky Unauthenticated Arbitrary File Write via /download/uploadFromRsByLocal Gated Only by Hardcoded Default Token
Dinky's POST /download/uploadFromRsByLocal handler passes the caller-supplied path parameter directly to new Filepath and file.transferTodest with no path validation. The route is marked @SaIgnore and /download/ is excluded from the Sa-Token interceptor, so the only guard is a header equality che...
CVE-2026-16067 Event Booking Manager for WooCommerce (Pro) < 5.0.3 - Unauthenticated Payment Bypass via Client-Controlled Ticket Price
The Event Booking Manager for WooCommerce Pro WordPress plugin before 5.0.3 does not validate the ticket price on the server during its native non-WooCommerce checkout, trusting the per-ticket price supplied by the client instead of re-deriving the event's configured price. This allows...
CVE-2026-70639
llama.cpp builds b1886 through b7445 contain a null pointer dereference vulnerability in the LLaMA-Android JNI wrapper where the bench1model function fails to validate the model context pointer before dereferencing it. Attackers can supply a malicious, corrupt, or truncated model file to trigger ...
CVE-2026-61466
In Apache CXF's OAuth2 Dynamic Client Registration endpoint, the authorization server accepts and stores the scope value supplied in the client registration request verbatim, without validating it against an AS-defined allowlist. This could lead to a client self-assigning privileged scopes at...
EUVD-2026-53820
When an Event Publisher output adapter is configured with irrelevant properties, the affected products log these properties. This logging occurs without sufficient validation or sanitization of the property values. A malicious actor with access to the 'wso2carbon' log files could retrieve sensiti...
CVE-2026-19025
H5Olayoutdecode in H5Olayout.c in HDF5 through 2.3.0 does not validate that a chunked dataset's stored chunk-layout dimensionality matches its dataspace rank when an existing dataset is opened, whereas this check is performed only at dataset-creation time. This allows attackers to cause a denial ...
CVE-2026-71286
The render-template component of ember-dynamic-render-template addon/components/render-template.js passes its property directly into Ember/Glimmer's compileTemplate from @ember/template-compilation with no sanitization, allow-listing, or validation of the input...
EUVD-2026-53365
go-shiori's DownloadBookmark internal/core/download.go fetches a caller-supplied bookmark URL using a plain http.Client with no custom DialContext or destination-IP validation no IsLoopback, IsPrivate, IsUnspecified, or IsLinkLocalUnicast checks. An authenticated user creating or updating a...
CVE-2026-71277
Affected software: rust-iot-platform, specifically the AuthToken request-guard in api/src/main.rs. Vulnerability: the guard only checks for the presence of the Authorization header, with no validation against sessions, token stores, or signatures. Any non-empty header (e.g., Authorization: fake) ...
CVE-2026-71277 rust-iot-platform Authentication Bypass via Non-Validated Authorization Header
rust-iot-platform's AuthToken request-guard implementation api/src/main.rs only checks whether the Authorization HTTP header is present, and never validates its value against any session, token store, or signature. Any request carrying an arbitrary non-empty Authorization header e.g. satisfies th...
CVE-2026-71212
xidown a yt-dlp/ffmpeg GUI wrapper builds its yt-dlp command-line invocation xidown/core/scanner.py and downloader.py by appending the user-provided or scanned URL as a bare trailing positional argument, with no '--' end-of-options marker and no scheme validation anywhere in the codebase. Because...
CVE-2026-7444
The Search Analytics for WP plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.4.16. This is due to missing or incorrect nonce validation on the processbulkaction function of MWTSAStatsTable. This makes it possible for unauthenticated attacker...
CVE-2026-70589
Ghost is a Node.js content management system. From 4.22.0 until 6.54.1, a missing validation check allowed users to redeem subscription offers that were no longer active. This issue is fixed in version 6.54.1...
EUVD-2026-52929
Ghost is a Node.js content management system. From 4.22.0 until 6.54.1, a missing validation check allowed users to redeem subscription offers that were no longer active. This issue is fixed in version 6.54.1...
CVE-2026-70589 Ghost: Archived Offers can be Redeemed
Ghost is a Node.js content management system. From 4.22.0 until 6.54.1, a missing validation check allowed users to redeem subscription offers that were no longer active. This issue is fixed in version 6.54.1...
Flowise: Broken Access Control in Stripe Subscription Endpoints Allows Cross-Tenant Billing Manipulation
Summary Several organization billing endpoints accept attacker-controlled Stripe identifiers subscriptionId without verifying that the identifier belongs to the authenticated user's organization. This allows an authenticated attacker to perform unauthorized Stripe subscription operations on other...
CVE-2026-18806
The CVE-2026-18806 entry concerns pardus-image-writer (before 1.0.4) with an external control of the file name or path vulnerability. The issue is described across CVE/NVD/CVELIST as affecting pardus-image-writer and enabling potential unauthorized modification of file targets, with CVSS 3.1 vect...
CVE-2026-69090
Admidio before 5.0.11 fails to validate target organization membership in role handlers, allowing authenticated role administrators to delete, activate, deactivate, or edit roles belonging to other organizations. Attackers can supply a role UUID from another organization to groupsroles.php handle...
