CVE-2026-49436

LinkAce (a self-hosted link archive) is vulnerable to stored XSS via its Bulk Link API endpoint (POST /api/v2/bulk/links). Prior to version 2.5.7 , the endpoint accepts URLs without format validation, allowing an authenticated user to store a javascript: URI. The stored URI is rendered verbatim a...

EUVD-2026-63686

LinkAce is a self-hosted archive to collect website links. Prior to version 2.5.7, the Bulk Link API endpoint POST /api/v2/bulk/links accepts URLs without any format validation, allowing an authenticated user to store a javascript: URI. The stored URI is later rendered verbatim as an href in Blad...

CVE-2026-49436 LinkAce vulnerable to stored XSS via 'javascript:' URI in Bulk Link API

LinkAce is a self-hosted archive to collect website links. Prior to version 2.5.7, the Bulk Link API endpoint POST /api/v2/bulk/links accepts URLs without any format validation, allowing an authenticated user to store a javascript: URI. The stored URI is later rendered verbatim as an href in Blad...

EUVD-2026-63683

BigBlueButton is an open-source virtual classroom. Prior to 3.0.29, BigBlueButton presenters could submit a presentationId through /api/graphql that identified a presentation belonging to another meeting...

CVE-2026-55489 BigBlueButton: IDOR on BBB through /api/graphql via POST parameter "presentationId" leads to Authentication Bypass

BigBlueButton is an open-source virtual classroom. Prior to 3.0.29, BigBlueButton presenters could submit a presentationId through /api/graphql that identified a presentation belonging to another meeting...

CVE-2026-55489 BigBlueButton: IDOR on BBB through /api/graphql via POST parameter "presentationId" leads to Authentication Bypass

BigBlueButton is an open-source virtual classroom. Prior to 3.0.29, BigBlueButton presenters could submit a presentationId through /api/graphql that identified a presentation belonging to another meeting...

CVE-2026-72860 9router Server-Side Request Forgery via /api/provider-nodes/validate Because the IPv4-Mapped IPv6 Denylist Check Is Unreachable

The POST /api/provider-nodes/validate route in 9router takes a caller-supplied baseUrl and issues server-side HTTP requests to it, guarding the destination with assertPublicUrl from src/shared/utils/ssrfGuard.js. That guard compares hostname strings only: it resolves no DNS, does not revalidate...

CVE-2026-46355

BigBlueButton prior to 3.0.23 exposed the /bigbluebutton/api/handleJoinExistingUser endpoint through a routable controller action in ApiController.groovy rather than a private helper. An authenticated requester who could supply the existingUserID of an active participant was able to reuse that pa...

CVE-2026-76019

CVE-2026-76019 is an incorrect authorization vulnerability in the Workers component of Google Chrome prior to 151.0.7922.173 . A remote attacker who has already compromised the renderer process and leverages social engineering can bypass the web origin policy via a crafted HTML page. The CVSS 3.1...

CVE-2026-72861

In Appwrite templates' github-issue-bot, verifyWebhook uses an inverted condition (typeof signature !== 'string' || (await verify(...))) that short-circuits to success when the X-Hub-Signature-256 header is absent, skipping HMAC verification. Unauthenticated callers can then post arbitrary commen...

CVE-2026-72854

msgpackunpackerexpandbuffer in src/unpack.c, reached through the public msgpackunpackerreservebuffer API, computes its new buffer size using an unchecked sizet addition of the requested size and the amount already used. The doubling loop guards its own multiplication against overflow, but the...

Wagtail: Improper restriction handling on Page translation API endpoint

Impact A CMS user with the "submit translations" permission, could use the Admin API's "copy for translation" endpoint to copy an existing page that they do not have edit access to, allowing them to view its contents. Patches Patched versions have been released as Wagtail 7.0.9, 7.3.4, 7.4.3 and...

Wagtail: Improper restriction handling on descendant collections in Documents and Images API

Impact The Documents and Images API V2 incorrectly listed items in descendants of private collections, which should inherit the view restrictions defined on their ancestors. A user with access to the API could see the filename and name of documents and images in these descendant collections...

GHSA-2P39-2JF3-FV2Q next-video: Unauthenticated arbitrary file read via /api/video request handler

Impact The HTTP route handler exported by next-video/request-handler — which the README instructs consumers to mount at /api/video — allows an unauthenticated remote attacker to read arbitrary .json files from the production filesystem of any application following the documented setup. The...

Exploit for Improper Input Validation in Drupal

SAWPOC — CVE-2018-7600 A Python Proof of Concept for CVE-20...

CVE-2026-72854 msgpack-c Integer Overflow in msgpack_unpacker_expand_buffer Causes a False-Success Undersized Reservation

msgpackunpackerexpandbuffer in src/unpack.c, reached through the public msgpackunpackerreservebuffer API, computes its new buffer size using an unchecked sizet addition of the requested size and the amount already used. The doubling loop guards its own multiplication against overflow, but the...

GHSA-RRWH-6JRQ-WP5V

creationtimestamp| type| source ---|---|--- 2026-08-20 17:51:42+00:00| seen| https://bsky.app/profile/thestandup.bsky.social/post/3mtjsq4tke52x...

CVE-2026-54136

Windmill is an open-source developer platform for internal code: APIs, background jobs, workflows and UIs. Prior to 1.715.0, a resource-scoped API token could read script contents outside its allowed path scope through GET /api/w/workspace/scripts/listsearch. The route-level scope middleware...

MAL-2026-14328 Malicious code in goldstar-api-server (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 79d095fdd61f79c64b4b5d12ba75957b7c5de47df2bcfa549b05b23c7e450eba Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2026-54136 Windmill: Resource-scoped API tokens can read script contents outside their allowed path via scripts/list_search

Windmill is an open-source developer platform for internal code: APIs, background jobs, workflows and UIs. Prior to 1.715.0, a resource-scoped API token could read script contents outside its allowed path scope through GET /api/w/workspace/scripts/listsearch. The route-level scope middleware...