CVE-2026-2897: Improper Neutralization of Input During Web Page Generation

A security vulnerability has been detected in funadmin up to 7.1.0-rc4. This vulnerability affects unknown code of the file app/backend/view/index/index.html of the component Backend Interface. The manipulation of the argument Value leads to cross site scripting. The attack is possible to be...

CVE-2026-2933: Improper Neutralization of Input During Web Page Generation

A weakness has been identified in YiFang CMS up to 2.0.5. This affects the function update of the file app/db/admin/DadManage.php of the component Extended Management Module. Executing a manipulation of the argument Name can lead to cross site scripting. The attack may be performed from remote. T...

CVE-2026-2822

A security vulnerability has been detected in JeecgBoot up to 3.9.1. The affected element is an unknown function of the file /jeecgboot/sys/dict/loadDict/airagapp,1,createby of the component Backend Interface. Such manipulation of the argument keyword leads to sql injection. The attack can be...

CVE-2026-2895: Weak Password Recovery Mechanism for Forgotten Password

A security flaw has been discovered in funadmin up to 7.1.0-rc4. Affected by this issue is the function repass of the file app/frontend/controller/Member.php. Performing a manipulation of the argument forgetcode/vercode results in weak password recovery. Remote exploitation of the attack is...

GHSA-29VQ-49WR-VM6X vulnerabilities

Vulnerabilities for packages: airflow, kubeflow-pipelines-visualization-server, kubeflow-volumes-web-app, emissary, mlflow, open-webui, superset...

CVE-2026-27205 vulnerabilities

Vulnerabilities for packages: airflow, emissary, kubeflow-volumes-web-app, mlflow, open-webui, mitmproxy...

CVE-2026-27205 vulnerabilities

Vulnerabilities for packages: mlflow, open-webui, airflow, airflow-core, emissary, kubeflow-volumes-web-app, mitmproxy...

GHSA-29VQ-49WR-VM6X vulnerabilities

Vulnerabilities for packages: kubeflow-pipelines-visualization-server, superset, tensorflow-cpu-jupyter, mlflow, localstack, open-webui, airflow, tensorflow-gpu-jupyter, azure-functions-python-worker, airflow-core, emissary, kubeflow-volumes-web-app, litellm...

GHSA-68RP-WP8R-4726 vulnerabilities

Vulnerabilities for packages: mlflow, open-webui, airflow, airflow-core, emissary, kubeflow-volumes-web-app, mitmproxy...

CVE-2026-27199 vulnerabilities

Vulnerabilities for packages: kubeflow-pipelines-visualization-server, superset, tensorflow-cpu-jupyter, mlflow, localstack, open-webui, airflow, tensorflow-gpu-jupyter, azure-functions-python-worker, airflow-core, emissary, kubeflow-volumes-web-app, litellm...

CVE-2026-27115 ADB Explorer is Vulnerable to Arbitrary Directory Deletion via Command-Line Argument

ADB Explorer is a fluent UI for ADB on Windows. Versions 0.9.26020 and below have an unvalidated command-line argument that allows any user to trigger recursive deletion of arbitrary directories on the Windows filesystem. ADB Explorer accepts an optional path argument to set a custom data...

CVE-2026-2684

creationtimestamp| type| source ---|---|--- 2026-02-20 05:20:15+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mfbedrqbbb2a...

CVE-2026-2822 JeecgBoot Backend airag_app,1,create_by sql injection

A security vulnerability has been detected in JeecgBoot up to 3.9.1. The affected element is an unknown function of the file /jeecgboot/sys/dict/loadDict/airagapp,1,createby of the component Backend Interface. Such manipulation of the argument keyword leads to sql injection. The attack can be...

CVE-2026-26747

A Host Header Poisoning vulnerability exists in Monica 4.1.2 due to improper handling of the HTTP Host header in app/Providers/AppServiceProvider.php, combined with the default misconfiguration where the "app.forceurl" is not set and default is "false". The application generates absolute URLs suc...

CVE-2026-26747

A Host Header Poisoning vulnerability exists in Monica 4.1.2 due to improper handling of the HTTP Host header in app/Providers/AppServiceProvider.php, combined with the default misconfiguration where the "app.forceurl" is not set and default is "false". The application generates absolute URLs suc...

CVE-2026-26747: Improper Neutralization of HTTP Headers for Scripting Syntax

A Host Header Poisoning vulnerability exists in Monica 4.1.2 due to improper handling of the HTTP Host header in app/Providers/AppServiceProvider.php, combined with the default misconfiguration where the "app.forceurl" is not set and default is "false". The application generates absolute URLs suc...

CVE-2026-26747

A Host Header Poisoning vulnerability exists in Monica 4.1.2 due to improper handling of the HTTP Host header in app/Providers/AppServiceProvider.php, combined with the default misconfiguration where the "app.forceurl" is not set and default is "false". The application generates absolute URLs suc...

CVE-2026-26959 ADB Explorer Vulnerable to RCE via Insufficient Input Validation

ADB Explorer is a fluent UI for ADB on Windows. Versions 0.9.26020 and below fail to validate the integrity or authenticity of the ADB binary path specified in the ManualAdbPath setting before executing it, allowing arbitrary code execution with the privileges of the current user. An attacker can...

CVE-2026-23616

GFI MailEssentials AI versions prior to 22.4 contain a stored cross-site scripting vulnerability in the Anti-Spoofing configuration page. An authenticated user can supply HTML/JavaScript in the ctl00$ContentPlaceHolder1$AntiSpoofingGeneral1$TxtSmtpDesc parameter to...

Fake IPTV Apps Spread Massiv Android Malware Targeting Mobile Banking Users

Cybersecurity researchers have disclosed details of a new Android trojan called Massiv that's designed to facilitate device takeover DTO attacks for financial theft. The malware, according to ThreatFabric, masquerades as seemingly harmless IPTV apps to deceive victims, indicating that the activit...