CVE-2026-55159

CVE-2026-55159 affects luci-app-adblock-fast , a WebUI for a DNS-based ad-blocker on OpenWrt (compatible with dnsmasq, smartdns, or unbound). Prior to 1.2.4-2 , the luci.adblock-fast.setCronEntry RPC method fails to sanitize carriage-return or line-feed characters in its entry argument, serializi...

CVE-2026-55159 luci-app-adblock-fast: Delegated `luci-app-adblock-fast` users can reach root command execution by injecting newline-separated cron entries

luci-app-adblock-fast a WebUI for fast, lightweight DNS-based ad-blocker for OpenWrt that works with dnsmasq, smartdns, or unbound. Prior to 1.2.4-2, the luci.adblock-fast.setCronEntry RPC method accepts an entry argument containing carriage-return or line-feed characters and serializes it into...

CVE-2026-55159 luci-app-adblock-fast: Delegated `luci-app-adblock-fast` users can reach root command execution by injecting newline-separated cron entries

luci-app-adblock-fast a WebUI for fast, lightweight DNS-based ad-blocker for OpenWrt that works with dnsmasq, smartdns, or unbound. Prior to 1.2.4-2, the luci.adblock-fast.setCronEntry RPC method accepts an entry argument containing carriage-return or line-feed characters and serializes it into...

CVE-2026-77560 Tinyauth: forward-auth per-app ACL is matched case-sensitively against the (case-insensitive) hostname, letting an authenticated user reach apps they are not on the allowlist for

Tinyauth is an authentication and authorization server. Prior to 5.1.2, Tinyauth compares forwarded hostnames case-sensitively while reverse proxies route equivalent hostnames case-insensitively, allowing an authenticated low-privilege user to bypass per-app access controls with a differently cas...

CVE-2026-90860

The Canva Mobile App for HarmonyOS before v1.15.1 did not restrict the headers returned to an external origin running in a privileged WebView. A threat actor with control of the WebView could access a user’s session...

EUVD-2026-83843

The Canva Mobile App for HarmonyOS before v1.15.1 did not restrict the headers returned to an external origin running in a privileged WebView. A threat actor with control of the WebView could access a user’s session...

CVE-2026-90860

Canva Mobile App for HarmonyOS prior to v1.15.1 failed to restrict HTTP headers returned to an external origin running in a privileged WebView . The underlying cause is an insufficient origin check on WebView responses, allowing a threat actor with control of the WebView to read a user's session ...

CVE-2026-90860

The Canva Mobile App for HarmonyOS before v1.15.1 did not restrict the headers returned to an external origin running in a privileged WebView. A threat actor with control of the WebView could access a user’s session...

CVE-2026-90860

The Canva Mobile App for HarmonyOS before v1.15.1 did not restrict the headers returned to an external origin running in a privileged WebView. A threat actor with control of the WebView could access a user’s session...

CVE-2026-55897: Improper Neutralization of Special Elements used in an OS Command

luci-app-advanced-reboot is a LuCI web interface application for OpenWrt that provides a way to reboot your router into an alternative firmware partition or perform reboot operations directly from the web UI. Prior to 1.1.2-6, the luci-app-advanced-reboot read ACL in...

CVE-2026-90860: Improper Removal of Sensitive Information Before Storage or Transfer

The Canva Mobile App for HarmonyOS before v1.15.1 did not restrict the headers returned to an external origin running in a privileged WebView. A threat actor with control of the WebView could access a user’s session...

CVE-2026-94210: Improper Neutralization of Input During Web Page Generation

A flaw has been found in Hyve5 Leantime up to 3.9.8. Affected by this vulnerability is the function getAllGrouped of the file app/Domain/Tickets/Services/Tickets.php of the component Kanban Board. This manipulation causes cross site scripting. The attack is possible to be carried out remotely. Th...

PT-2026-96233

Name of the Vulnerable Software and Affected Versions luci-app-advanced-reboot versions prior to 1.1.2-6 Description An issue exists where the read Access Control List ACL in the file applications/luci-app-advanced-reboot/root/usr/share/rpcd/acl.d/luci-app-advanced-reboot.json grants rpcd the...

PT-2026-96044

Name of the Vulnerable Software and Affected Versions Canva Mobile App for HarmonyOS versions prior to 1.15.1 Description The application fails to restrict headers returned to an external origin operating within a privileged WebView. A privileged WebView is a system component that allows the...

CVE-2026-55159: Improper Neutralization of CRLF Sequences

luci-app-adblock-fast a WebUI for fast, lightweight DNS-based ad-blocker for OpenWrt that works with dnsmasq, smartdns, or unbound. Prior to 1.2.4-2, the luci.adblock-fast.setCronEntry RPC method accepts an entry argument containing carriage-return or line-feed characters and serializes it into...

PT-2026-96232

Name of the Vulnerable Software and Affected Versions luci-app-adblock-fast versions prior to 1.2.4-2 Description The luci.adblock-fast.setCronEntry RPC method fails to properly sanitize the entry argument, allowing the inclusion of carriage-return or line-feed characters. These characters are...

PT-2026-96065

Name of the Vulnerable Software and Affected Versions MISP versions prior to 2.5.47 Description The galaxy matrix statistics view app/View/Users/statistics galaxymatrix.ctp renders the galaxy name directly into HTML output using the sprintf function without proper HTML encoding. An authenticated...

PT-2026-96085

Name of the Vulnerable Software and Affected Versions Hyve5 Leantime versions prior to 3.9.9 Description A flaw in the Kanban Board component allows remote attackers to perform cross-site scripting XSS, a technique where malicious scripts are injected into trusted websites. The issue resides in t...

Root-My-Galaxy-Payloads

Root My Galaxy Payloads This repository contains the device-s...

CVE-2026-94038

A security vulnerability has been detected in NonceGeek dim-sum-app. This impacts the function textSearchV2Handler of the file deno/main.tsx of the component Deno Backend. Such manipulation of the argument supabaseurl leads to server-side request forgery. The attack can be executed remotely. The...