Stack-based Buffer Overflow in REST API device management component of Brocade Fabric OS

: Multiple stack-based buffer overflow vulnerabilities exist in the REST API management component of Brocade Fabric OS versions prior to 10.0.1. When processing API request payloads—such as device configuration attributes or port mapping requests—the REST API service fails to properly validate...

Heap-Based Buffer Overflow in Port List Parsing within Brocade Fabric OS

: When Brocade Fabric OS versions before 10.0.1 processes trunk configuration operations, the application parses user-supplied list strings into dynamically allocated heap arrays without enforcing boundary checks on the maximum allowable number of elements. An authenticated administrator can...

WP < 7.1.3 - Author+ Sticky Post via REST API

Description WordPress does not correctly verify user capabilities before allowing a post to be set as sticky via the REST API in some cases, which could allow users with Author-level access and above to feature their own posts on the site front page, an action intended to require higher privilege...

CVE-2026-105486: Missing Authentication for Critical Function

A vulnerability was detected in OSSRS srs up to 7.0-a1. This affects the function systemAPI.Run of the file internal/proxy/api.go of the component System API. Performing a manipulation results in missing authentication. It is possible to initiate the attack remotely. The exploit is now public and...

CVE-2026-39794: Missing Authorization

Unauthenticated Broken Access Control in WooCommerce Multivendor Marketplace – REST API = 1.6.3 versions...

vLLM: Qwen2-VL / Qwen3-VL video samplers bound on request-controlled max_frames, which the num_frames ceiling does not reach

Summary An unauthenticated remote attacker can exhaust the memory of the vLLM API-server process by raising the request-level mediaiokwargs.video.maxframes and fps knobs on any deployment serving a Qwen2-VL or Qwen3-VL model. 74 extra bytes of JSON took the server's peak RSS from 2 271 MiB to 13...

GHSA-X6MC-67GF-CHW4 vLLM: Qwen2-VL / Qwen3-VL video samplers bound on request-controlled max_frames, which the num_frames ceiling does not reach

Summary An unauthenticated remote attacker can exhaust the memory of the vLLM API-server process by raising the request-level mediaiokwargs.video.maxframes and fps knobs on any deployment serving a Qwen2-VL or Qwen3-VL model. 74 extra bytes of JSON took the server's peak RSS from 2 271 MiB to 13...

CVE-2026-105786 Joplin: Unauthenticated account takeover via an attacker-chosen application-authorisation identifier

Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.13, packages/server/src/models/ApplicationModel.ts accepts a caller-chosen application authorization identifier, applications/:id/confirm binds that identifier to a logged-in use...

EUVD-2026-92870

Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.13, when Joplin Desktop is running with the opt-in Web Clipper server enabled, the server in packages/lib/ClipperServer.ts sends Access-Control-Allow-Origin: and allows an...

CVE-2026-105783 Joplin Web Clipper pairing allows cross-origin theft of a permanent API token

Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.13, when Joplin Desktop is running with the opt-in Web Clipper server enabled, the server in packages/lib/ClipperServer.ts sends Access-Control-Allow-Origin: and allows an...

CVE-2026-105783 Joplin Web Clipper pairing allows cross-origin theft of a permanent API token

Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.13, when Joplin Desktop is running with the opt-in Web Clipper server enabled, the server in packages/lib/ClipperServer.ts sends Access-Control-Allow-Origin: and allows an...

CVE-2026-105783

The Joplin note-taking application (prior to version 3.7.13 ) is vulnerable to cross-origin theft of a permanent API token when the optional Web Clipper server is enabled. The root cause is located in packages/lib/ClipperServer.ts, where the server sends Access-Control-Allow-Origin: * and fails t...

CVE-2026-105783 Joplin Web Clipper pairing allows cross-origin theft of a permanent API token

Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.13, when Joplin Desktop is running with the opt-in Web Clipper server enabled, the server in packages/lib/ClipperServer.ts sends Access-Control-Allow-Origin: and allows an...

CVE-2026-105762 Dify: Unauthenticated Server-Side Request Forgery in /console/api/remote-files/upload endpoint

Dify is an open-source LLM app development platform. Prior to 1.13.0, the /console/api/remote-files/upload endpoint in api/controllers/web/remotefiles.py accepted an attacker-controlled URL without authentication and caused the Dify server to retrieve it. A remote attacker could use the endpoint ...

CVE-2026-105762

Dify is an open-source LLM app development platform. Prior to 1.13.0, the /console/api/remote-files/upload endpoint in api/controllers/web/remotefiles.py accepted an attacker-controlled URL without authentication and caused the Dify server to retrieve it. A remote attacker could use the endpoint ...

CVE-2026-105761 Dify: IDOR in AppMCPServer PUT Endpoint Allows Modification of Other Apps' MCP Servers

Dify is an open-source LLM app development platform. Prior to 1.16.0, the PUT /console/api/apps/appid/server endpoint in api/controllers/console/app/mcpserver.py used AppMCPServerController.put to retrieve an AppMCPServer by the client-supplied server ID without verifying that the server belonged...

CVE-2026-105761

The open-source LLM app development platform Dify contains an Insecure Direct Object Reference (IDOR) vulnerability in versions prior to 1.16.0 . The root cause is located in api/controllers/console/app/mcp_server.py, where the PUT /console/api/apps//server endpoint uses AppMCPServerController.pu...

EUVD-2026-92852

Dify is an open-source LLM app development platform. Prior to 1.16.0, the PUT /console/api/apps/appid/server endpoint in api/controllers/console/app/mcpserver.py used AppMCPServerController.put to retrieve an AppMCPServer by the client-supplied server ID without verifying that the server belonged...

CVE-2026-105761 Dify: IDOR in AppMCPServer PUT Endpoint Allows Modification of Other Apps' MCP Servers

Dify is an open-source LLM app development platform. Prior to 1.16.0, the PUT /console/api/apps/appid/server endpoint in api/controllers/console/app/mcpserver.py used AppMCPServerController.put to retrieve an AppMCPServer by the client-supplied server ID without verifying that the server belonged...

CVE-2026-105761 Dify: IDOR in AppMCPServer PUT Endpoint Allows Modification of Other Apps' MCP Servers

Dify is an open-source LLM app development platform. Prior to 1.16.0, the PUT /console/api/apps/appid/server endpoint in api/controllers/console/app/mcpserver.py used AppMCPServerController.put to retrieve an AppMCPServer by the client-supplied server ID without verifying that the server belonged...