EUVD-2026-67692

Budibase before 3.41.3 fails to validate app-scoped builder role assignments in the public user create and update endpoints, allowing an authenticated app-scoped builder to grant builder access to unrelated apps. Attackers can submit crafted requests to the user update API with builder.apps field...

CVE-2026-82240 Budibase before 3.41.3 Privilege Escalation via User Update API

Budibase before 3.41.3 fails to validate app-scoped builder role assignments in the public user create and update endpoints, allowing an authenticated app-scoped builder to grant builder access to unrelated apps. Attackers can submit crafted requests to the user update API with builder.apps field...

CVE-2026-82240 Budibase before 3.41.3 Privilege Escalation via User Update API

Budibase before 3.41.3 fails to validate app-scoped builder role assignments in the public user create and update endpoints, allowing an authenticated app-scoped builder to grant builder access to unrelated apps. Attackers can submit crafted requests to the user update API with builder.apps field...

CVE-2026-82089

The wallabag aka fr.gaulupeau.apps.InThePoche application through 2.6.0 for Android allows XSS because /api/entries data is loaded into a WebView...

Root-My-Galaxy-Payloads-Testing

Root My Galaxy Payloads This repository contains the device-s...

Malicious code in @hd-team/app-dnpkg-beta (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8f5be2650e129e66738602f02b893ba443ffbd9a47df685f76bd4ae84b885529 The tarball contains only package.json and index.js. index.js is not JavaScript source: it is a base64-encoded JSON blob that decodes to a...

MAL-2026-14569 Malicious code in @hd-team/app-dnpkg-beta (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8f5be2650e129e66738602f02b893ba443ffbd9a47df685f76bd4ae84b885529 The tarball contains only package.json and index.js. index.js is not JavaScript source: it is a base64-encoded JSON blob that decodes to a...

CVE-2026-26899

An issue was discovered in luci-app-https-dns-proxy on OpenWrt PR 15 2026-01-17. The setInitAction function in /usr/libexec/rpcd/luci.https-dns-proxy allows authenticated users to execute arbitrary shell commands via shell metacharacters in the name parameter...

CVE-2026-26897

An issue in EcoOnline EHS com.airsweb.v10 application for Android, version 0.2.499 allows a remote attacker to obtain sensitive information and execute arbitrary code via the AndroidManifest.xml component...

CVE-2026-27330

Unauthenticated Broken Access Control in Mobile App for WooCommerce = 0.4.62 versions...

CVE-2026-27330

An unauthenticated Broken Access Control vulnerability affects the WordPress plugin Mobile App for WooCommerce in versions ≤ 0.4.62 , as reported by researcher Phat RiO and cataloged by Patchstack. The flaw allows a remote attacker with no prior authentication or user interaction to access protec...

CVE-2026-27330 WordPress Mobile App for WooCommerce plugin <= 0.4.62 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Mobile App for WooCommerce = 0.4.62 versions...

EUVD-2026-66987

Unauthenticated Broken Access Control in Mobile App for WooCommerce = 0.4.62 versions...

AppEnumGuard v1.2

AppEnumGuard AppEnumGuard is a defensive rootHide tweak for the installed-application enumeration side channel tracked as CVE-2025-31207. It is designed for the Relaxin jailbreak on iOS 17.0–17.3.1 , using Relaxin's rootHide architecture. The repository also contains a normal sandboxed iOS test...

WordPress Mobile App for WooCommerce plugin <= 0.4.69 - Other Vulnerability Type vulnerability

Other Vulnerability Type vulnerability discovered by TruongLV1 From FPT Night Wolf in WordPress Plugin Mobile App for WooCommerce versions = 0.4.69...

EUVD-2026-67100

An issue in EcoOnline EHS com.airsweb.v10 application for Android, version 0.2.499 allows a remote attacker to obtain sensitive information and execute arbitrary code via the AndroidManifest.xml component...

CVE-2026-26899

An issue was discovered in luci-app-https-dns-proxy on OpenWrt PR 15 2026-01-17. The setInitAction function in /usr/libexec/rpcd/luci.https-dns-proxy allows authenticated users to execute arbitrary shell commands via shell metacharacters in the name parameter...

CVE-2026-26899

CVE-2026-26899 affects the luci-app-https-dns-proxy package on OpenWrt (versions prior to 2026-01-17). The setInitAction function in /usr/libexec/rpcd/luci.https-dns-proxy fails to sanitize the name parameter, allowing authenticated users to execute arbitrary shell commands via shell metacharacte...

CVE-2026-26897

An issue in EcoOnline EHS com.airsweb.v10 application for Android, version 0.2.499 allows a remote attacker to obtain sensitive information and execute arbitrary code via the AndroidManifest.xml component...

EUVD-2026-67101

An issue was discovered in luci-app-https-dns-proxy on OpenWrt PR 15 2026-01-17. The setInitAction function in /usr/libexec/rpcd/luci.https-dns-proxy allows authenticated users to execute arbitrary shell commands via shell metacharacters in the name parameter...