CVE-2026-60084: Improper Limitation of a Pathname to a Restricted Directory

SiYuan versions before v3.7.4 contain an arbitrary file deletion vulnerability in the /api/search/removeTemplate endpoint that accepts an unvalidated path parameter passed directly to os.RemoveAll. Authenticated admin attackers can supply absolute filesystem paths to recursively delete any file o...

CVE-2026-77086

SiYuan before v3.7.4 fails to validate the packageName parameter in Bazaar install and uninstall endpoints, allowing authenticated administrators to perform path traversal via directory traversal sequences. Attackers with admin access can write arbitrary files to any location via install operatio...

EUVD-2026-63898

SiYuan before v3.7.4 fails to validate the packageName parameter in Bazaar install and uninstall endpoints, allowing authenticated administrators to perform path traversal via directory traversal sequences. Attackers with admin access can write arbitrary files to any location via install operatio...

EUVD-2026-63794

OS command injection in the api endpoint of Datiphy Data Management Center from v8.3.0 through v8.5.1 allows an authenticated administrator to execute arbitrary operating system commands as root...

CVE-2026-76156

Datiphy Data Management Center v8.3.0 through v8.5.1 has an OS command injection flaw (CWE-78) in its API endpoint, allowing authenticated administrators to execute arbitrary OS commands as root. No patch version or workaround is mentioned in the provided documents. Exploitation details are not p...

PT-2026-79285

OS command injection in the api endpoint of Datiphy Data Management Center from v8.3.0 through v8.5.1 allows an authenticated administrator to execute arbitrary operating system commands as root...

CVE-2026-77086: Improper Limitation of a Pathname to a Restricted Directory

SiYuan before v3.7.4 fails to validate the packageName parameter in Bazaar install and uninstall endpoints, allowing authenticated administrators to perform path traversal via directory traversal sequences. Attackers with admin access can write arbitrary files to any location via install operatio...

EUVD-2026-41146

Wagtail: Denial of service via unbounded filter specs in the image preview...

GHSA-8HW4-7QJR-3WXG Laravel Backpack CRUD: SingleBase64Image accepts any base64 payload behind a `data:image` prefix — SVG-with-script lands on the public disk

Summary SingleBase64Image::uploadFiles — the uploader bound to image-typed fields via withFiles — only verifies that the submitted value starts with the string data:image. The MIME subtype and the base64-decoded bytes are never inspected or validated. A related bug in FileNameGenerator causes the...

CVE-2026-76635

baserCMS before 5.3.0 is vulnerable in BcDatabaseService.php, where authenticated administrators can inject attacker-controlled table names and configuration values directly into SQL statements across sequence-update, CSV-export, and table-management operations. This chains with a backup-restore ...

EUVD-2026-63081

An OS command injection vulnerability exists in the web management interface of Archer C20 v6 firmware when processing certain WAN-related configuration operations. An authenticated administrator may exploit insufficient input validation to execute arbitrary system commands, potentially resulting...

CVE-2026-23938

A flaw was found in Zabbix. An authenticated administrator can exploit this vulnerability by creating specially crafted JavaScript scripts within preprocessing or script items. This can lead to a denial of service DoS by crashing the Zabbix server or proxy. Mitigation Restrict administrative acce...

GHSA-C9FV-CGMM-2WG7 LibreNMS Vulnerable to Remote Code Execution by Signal Alert Transportation module

Summary A vulnerability has been identified that allows an authenticated administrator to execute arbitrary code on the host server. By adding an alert transport entry, an attacker with administrative privileges can execute malicious commands. Details The vulnerability is caused by an unsafe exec...

CVE-2026-44845

JumpServer versions prior to 4.10.17 allow an authenticated administrator with Applet Host permissions to inject Jinja2 expressions into the IP/Host or Core Service Address fields, causing Ansible to evaluate them during deployment and execute arbitrary commands on the control node. The fix is in...

EUVD-2026-60468

JumpServer is an open source bastion host and an operation and maintenance security audit system. Prior to 4.10.17, an authenticated administrator with Applet Host management and deployment permissions can inject Jinja2 expressions into the IP/Host field or Core Service Address field, causing...

CVE-2026-64657 Budibase: Database Connector SQL Injections in PostgreSQL, MS SQL, and MySQL

Budibase is an open-source low-code platform. Prior to 3.39.19, the PostgreSQL datasource connector in packages/server/src/integrations/postgres.ts interpolates the user-controlled schema configuration field into a SET searchpath statement without escaping embedded double quotes, allowing an...

CVE-2026-64657

Budibase is an open-source low-code platform. Prior to 3.39.19, the PostgreSQL datasource connector in packages/server/src/integrations/postgres.ts interpolates the user-controlled schema configuration field into a SET searchpath statement without escaping embedded double quotes, allowing an...

GHSA-6X2C-PHFF-WX57 New API: User List API Leaks Root User Access Token Leading to Privilege Escalation

Vulnerability Information - Product: new-api - Affected versions: versions before v1.0.0-rc.7 that serialize User.AccessToken as accesstoken; the issue was confirmed in v0.12.14 - Patched version: v1.0.0-rc.7 - Fixed commit: 0936e2504655a5cbf7bc3c388f6d3e2bb24916d3 - Type: Information Disclosure ...

PT-2026-76668

Mattermost versions 11.7.x = 11.7.6, 11.8.x = 11.8.3 The access control policy unassign endpoint fails to re-validate that each target channel still belongs to the requesting admin's team, which allows an authenticated team administrator to remove ABAC attribute-based access control policy...

CVE-2026-19631

A SQL injection vulnerability exists in Security Center that could allow an authenticated administrator to execute arbitrary SQL queries, potentially resulting in unauthorized access to sensitive data, including credentials...