CVE-2026-92263

SparkyFitness is a self-hosted, AI-powered health and fitness tracker for families. Prior to 1.6.0, the api/admin/backup/restore endpoint interpolates an uploaded filename into a shell command. An authenticated global administrator uploads a restore archive with a crafted filename. The...

CVE-2026-44977

countly-server is the server-side part of Countly, a product analytics solution. Prior to 24.05.50 and 25.03.44, plugins/star-rating/api/api.js allows a non-global application administrator to use uploadFeedbackFile to store attacker-controlled active content while trusting the supplied MIME type...

CVE-2026-42269

countly-server is the server-side part of Countly, a product analytics solution. Prior to 24.05.50 and 25.03.44, the authenticated data-migration deletion route in plugins/datamigration/api/api.js passes the user-controlled exportid to cleanupdata without path validation...

CVE-2026-57169

The Docker management application Dockhand is vulnerable to unauthenticated command execution in versions prior to 1.0.34 . The /api/containers/exec endpoint fails to enforce authentication during a WebSocket upgrade request. An unauthenticated attacker with network reach and knowledge of a targe...

EUVD-2026-102920

Dockhand is a Docker management application. Prior to 1.0.34, the in-browser container terminal endpoint /api/containers//exec does not enforce authentication on the WebSocket upgrade request. When an unauthenticated attacker has network reach to Dockhand, knows a target container ID, and targets...

CVE-2026-57169 Dockhand: Unauthenticated container exec via WebSocket upgrade

Dockhand is a Docker management application. Prior to 1.0.34, the in-browser container terminal endpoint /api/containers//exec does not enforce authentication on the WebSocket upgrade request. When an unauthenticated attacker has network reach to Dockhand, knows a target container ID, and targets...

CVE-2026-57169

Dockhand is a Docker management application. Prior to 1.0.34, the in-browser container terminal endpoint /api/containers//exec does not enforce authentication on the WebSocket upgrade request. When an unauthenticated attacker has network reach to Dockhand, knows a target container ID, and targets...

CVE-2026-57169 Dockhand: Unauthenticated container exec via WebSocket upgrade

Dockhand is a Docker management application. Prior to 1.0.34, the in-browser container terminal endpoint /api/containers//exec does not enforce authentication on the WebSocket upgrade request. When an unauthenticated attacker has network reach to Dockhand, knows a target container ID, and targets...

CVE-2026-44977 countly-server: Stored XSS in feedback upload enables app-admin to compromise global admin session context

countly-server is the server-side part of Countly, a product analytics solution. Prior to 24.05.50 and 25.03.44, plugins/star-rating/api/api.js allows a non-global application administrator to use uploadFeedbackFile to store attacker-controlled active content while trusting the supplied MIME type...

CVE-2026-44977

countly-server is the server-side part of Countly, a product analytics solution. Prior to 24.05.50 and 25.03.44, plugins/star-rating/api/api.js allows a non-global application administrator to use uploadFeedbackFile to store attacker-controlled active content while trusting the supplied MIME type...

CVE-2026-44977 countly-server: Stored XSS in feedback upload enables app-admin to compromise global admin session context

countly-server is the server-side part of Countly, a product analytics solution. Prior to 24.05.50 and 25.03.44, plugins/star-rating/api/api.js allows a non-global application administrator to use uploadFeedbackFile to store attacker-controlled active content while trusting the supplied MIME type...

EUVD-2026-102918

countly-server is the server-side part of Countly, a product analytics solution. Prior to 24.05.50 and 25.03.44, plugins/star-rating/api/api.js allows a non-global application administrator to use uploadFeedbackFile to store attacker-controlled active content while trusting the supplied MIME type...

CVE-2026-44977

The countly-server product analytics solution is vulnerable to a Stored Cross-Site Scripting (XSS) flaw in versions prior to 24.05.50 and 25.03.44 . The plugins/star-rating/api/api.js component allows a non-global application administrator to use uploadFeedbackFile to store attacker-controlled ac...

CVE-2026-44977 countly-server: Stored XSS in feedback upload enables app-admin to compromise global admin session context

countly-server is the server-side part of Countly, a product analytics solution. Prior to 24.05.50 and 25.03.44, plugins/star-rating/api/api.js allows a non-global application administrator to use uploadFeedbackFile to store attacker-controlled active content while trusting the supplied MIME type...

Thorsten Rinne phpMyFAQ Authorization Issues Vulnerability

Thorsten Rinne’s phpMyFAQ version 4.2.0-alpha to 4.2.0-beta had an authorization issue. This vulnerability stemmed from a bypass in the isFaqAccessibleForUser function, allowing unauthorized users to access FAQ translations that were not protected by ACL restrictions. Attackers could exploit this...

Coder information leakage vulnerability

The Coder version 2.26.0 to 2.34.8 had an information leakage vulnerability. This vulnerability stemmed from the GET /api/v2/workspaces/id/acl endpoint, which only checked the read permissions for workspaces. Additionally, it used elevated system privileges to obtain group member information. As ...

Coder Authorization Issue Vulnerabilities

Coder versions from 2.0.0 to 2.34.8 had an authorization issue. This issue stemmed from the aclallow rule in coderd/rbac/policy.rego, which did not verify the organizational member identity for each user’s ACL entries. Additionally, when organizational members were removed, these entries were not...

Thorsten Rinne phpMyFAQ Permission and Access Control Vulnerabilities

Thorsten Rinne’s phpMyFAQ version 4.2.0-alpha.2 to 4.2.0-beta had a vulnerability related to permission licensing and access control. This vulnerability occurred because UserController::updateUserRights discarded the language-specific permission restrictions during the re-granting of permissions...

Thorsten Rinne phpMyFAQ information leakage vulnerability

Thorsten Rinne’s phpMyFAQ version prior to 4.2.0-beta and 4.2.0-alpha versions contained an information leakage vulnerability. This vulnerability stemmed from a reversal of the api.onlyPublicQuestions check in the OpenQuestionController. Unauthorized attackers could read hidden open questions, as...

Thorsten Rinne phpMyFAQ Authorization Issues Vulnerability

Thorsten Rinne: phpMyFAQ versions from 4.0.0 to 4.1.9 have a permission issue vulnerability. This vulnerability stems from improper authorization checks in the PUT /admin/api/news/update interface. The error checks are set to NEWSDELETE instead of NEWSEDIT. As a result, users who lack the editnew...