CVE-2026-18648 Blix Email Blue Mail Calendar App react-native-receive-sharing-intent FileDirectory.getFileFromUri path traversal

A vulnerability was detected in Blix Email Blue Mail Calendar App 2.2.305. Impacted is the function FileDirectory.getDataColumn/FileDirectory.getFileFromUri of the component react-native-receive-sharing-intent. The manipulation of the argument displayname results in path traversal. The attack is...

EUVD-2026-52442

A vulnerability was detected in Blix Email Blue Mail Calendar App 2.2.305. Impacted is the function FileDirectory.getDataColumn/FileDirectory.getFileFromUri of the component react-native-receive-sharing-intent. The manipulation of the argument displayname results in path traversal. The attack is...

CVE-2026-48063

Baileys (a TypeScript/JavaScript Web WhatsApp API) contains a vulnerability CVE-2026-48063 affecting versions prior to 6.7.22 and 7.0.0-rc12. An attacker can send a malicious protocolMessage payload via placeholderResendMessage to trigger a fake messages.upsert event with a fake message key and p...

CVE-2026-48063 Baileys has message upsert / hist sync spoofing and app state corruption when using maliciously crafted protocolMessage payload

Baileys is a cocket-based TS/JavaScript API for WhatsApp Web. In versions prior to both 6.7.22 and 7.0.0-rc12, any Baileys session can be sent a malicious payload via the placeholderResendMessage and trigger a fake messages.upsert event with a fake message key and payload. This allows anyone to...

CVE-2026-38713

creationtimestamp| type| source ---|---|--- 2026-08-03 20:54:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3ms7eym4tcx2o...

create-momentum-app (>=0.0.1, <=0.5.11), foliokit (0.0.0) +1 more potentially affected by CVE-2026-69149 via @angular/platform-server (>=21.1.2, <=21.2.9)

@angular/platform-server NPM version =21.1.2, =0.0.1, =0.0.2, =0.0.3 Source cves: CVE-2026-69149 Source advisory: SNYK:JS-ANGULARPLATFORMSERVER-18550630...

CVE-2026-18604

A vulnerability was identified in textPlus Text Message and Call App up to 8.3.5 on Android. This impacts the function DialerActivity of the component com.gogii.textplus. Such manipulation leads to improper export of android application components. The attack needs to be performed locally. The...

create-momentum-app (>=0.0.1, <=0.5.11), foliokit (0.0.0) +1 more potentially affected by CVE-2026-69149 via @angular/platform-server (>=21.1.2, <=21.2.9)

@angular/platform-server NPM version =21.1.2, =0.0.1, =0.0.2, =0.0.3 Source cves: CVE-2026-69149 Source advisory: OSV:GHSA-VPX6-8PJR-4G3V...

EUVD-2026-52340

A vulnerability was identified in textPlus Text Message and Call App up to 8.3.5 on Android. This impacts the function DialerActivity of the component com.gogii.textplus. Such manipulation leads to improper export of android application components. The attack needs to be performed locally. The...

CVE-2026-18604 textPlus Text Message and Call App com.gogii.textplus DialerActivity improper export of android application components

A vulnerability was identified in textPlus Text Message and Call App up to 8.3.5 on Android. This impacts the function DialerActivity of the component com.gogii.textplus. Such manipulation leads to improper export of android application components. The attack needs to be performed locally. The...

CVE-2026-18604 textPlus Text Message and Call App com.gogii.textplus DialerActivity improper export of android application components

A vulnerability was identified in textPlus Text Message and Call App up to 8.3.5 on Android. This impacts the function DialerActivity of the component com.gogii.textplus. Such manipulation leads to improper export of android application components. The attack needs to be performed locally. The...

CVE-2026-18604

A vulnerability was identified in textPlus Text Message and Call App up to 8.3.5 on Android. This impacts the function DialerActivity of the component com.gogii.textplus. Such manipulation leads to improper export of android application components. The attack needs to be performed locally. The...

CVE-2026-18604

Summary (CVE-2026-18604): A vulnerability in the Android app textPlus Text Message and Call App (up to 8.3.5) affects DialerActivity within the com.gogii.textplus component. The issue is described as an improper export of Android application components, enabling a local attacker to manipulate the...

CVE-2026-69096

OpenWrt luci-app-dockerman LuCI master and openwrt-25.12 snapshots containing the ucode dockerrpc.uc RPC backend after the JS/ucode conversion contains an OS command injection vulnerability. The package's read ACL grants broad ubus access to docker. / docker.container., which exposes the...

CVE-2026-69095

OpenWrt luci-app-bmx7 before commit 5890760a454dad2cb00389dba2cdc5e779e0ffdd contains a path traversal vulnerability in the bmx7-info CGI script that allows unauthenticated attackers to read files outside the configured runtimeDir. Attackers can supply directory traversal sequences in the query...

EUVD-2026-52289

OpenWrt luci-app-dockerman LuCI master and openwrt-25.12 snapshots containing the ucode dockerrpc.uc RPC backend after the JS/ucode conversion contains an OS command injection vulnerability. The package's read ACL grants broad ubus access to docker. / docker.container., which exposes the...

CVE-2026-69096 OpenWrt luci-app-dockerman Read ACL Remote Code Execution

OpenWrt luci-app-dockerman LuCI master and openwrt-25.12 snapshots containing the ucode dockerrpc.uc RPC backend after the JS/ucode conversion contains an OS command injection vulnerability. The package's read ACL grants broad ubus access to docker. / docker.container., which exposes the...

CVE-2026-69096 OpenWrt luci-app-dockerman Read ACL Remote Code Execution

OpenWrt luci-app-dockerman LuCI master and openwrt-25.12 snapshots containing the ucode dockerrpc.uc RPC backend after the JS/ucode conversion contains an OS command injection vulnerability. The package's read ACL grants broad ubus access to docker. / docker.container., which exposes the...

CVE-2026-69096

OpenWrt luci-app-dockerman LuCI master and openwrt-25.12 snapshots containing the ucode dockerrpc.uc RPC backend after the JS/ucode conversion contains an OS command injection vulnerability. The package's read ACL grants broad ubus access to docker. / docker.container., which exposes the...

CVE-2026-69096

OpenWrt luci-app-dockerman is affected by an OS command injection in the docker_rpc.uc backend after the JS/ucode conversion. The vulnerability arises because the read ACL can expose ubus objects docker.* / docker.container.* and the run_ttyd handler builds a shell command from request-controlled...