CVE-2026-45121

MyBB is free and open source forum software. Prior to 1.8.40, the calendar module does not check permissions consistently when listing calendars, allowing authenticated users to access titles of calendars that are otherwise inaccessible. The affected calendar-selection paths in calendar.php perfo...

CVE-2026-45121

MyBB is free and open source forum software. Prior to 1.8.40, the calendar module does not check permissions consistently when listing calendars, allowing authenticated users to access titles of calendars that are otherwise inaccessible. The affected calendar-selection paths in calendar.php perfo...

CVE-2026-45121

In MyBB versions before 1.8.40, calendar.php performs permission checks against an invalid calendar context, allowing authenticated users to view titles of otherwise inaccessible calendars. CVSS 3.1 scores this MEDIUM (4.3) with network attack vector and low privileges required. Upgrade to versio...

CVE-2026-74012

Deserialization of Untrusted Data vulnerability in TaxoPress allows Object Injection. This issue affects TaxoPress: from n/a through 3.51.0...

DEBIAN-CVE-2026-23938

An authenticated administrator is able to crash Zabbix server or proxy by creating specifically crafted preprocessing/script item JavaScript scripts, leading to potential denial of service...

DEBIAN-CVE-2026-23931

The frontend validatate.api.exists action can be exploited by authenticated users to extract plaintext user macro values leading to potential loss of confidentiality...

DEBIAN-CVE-2026-23934

An authenticated user is able to cause disproportionate CPU load on the Frontend webserver by sending specifically crafted requests to the Frontend validate.api.exists action, leading to potential denial of service...

CVE-2026-23934

An authenticated user is able to cause disproportionate CPU load on the Frontend webserver by sending specifically crafted requests to the Frontend validate.api.exists action, leading to potential denial of service...

UBUNTU-CVE-2026-23938

An authenticated administrator is able to crash Zabbix server or proxy by creating specifically crafted preprocessing/script item JavaScript scripts, leading to potential denial of service...

CVE-2026-23937

The Zabbix API host.get action allows authenticated users to extract a host's PSK key. With low privileges and network access, an attacker can compromise the pre-shared key used for TLS connections, enabling potential data integrity attacks (CVSS 6.0 MEDIUM, VI:H). The Zabbix Jira ticket ZBX-2807...

EUVD-2026-60740

The Zabbix API host.get action can be exploited by authenticated users to extract a host's PSK key leading to potential loss of data integrity...

CVE-2026-75836

The Grav API plugin getgrav/grav-plugin-api, bundled with Grav's admin-next/API stack before 1.0.14 fails to enforce the authorize requirement in MenubarController::executeAction. While the GET /menubar/items listing endpoint correctly filters menubar items via userPassesAuthorize, the POST...

CVE-2026-23934

An authenticated user is able to cause disproportionate CPU load on the Frontend webserver by sending specifically crafted requests to the Frontend validate.api.exists action, leading to potential denial of service...

CVE-2026-23931

The frontend validatate.api.exists action can be exploited by authenticated users to extract plaintext user macro values leading to potential loss of confidentiality...

EUVD-2026-60616

ArcadeDB versions before 26.8.1 fail to sanitize database names in the POST /api/v1/server endpoint's create database and drop database commands, allowing authenticated root users to write and delete arbitrary files outside the configured database directory. Attackers can supply database names...

CVE-2026-75855 ArcadeDB before 26.8.1 Path Traversal via create/drop database

ArcadeDB versions before 26.8.1 fail to sanitize database names in the POST /api/v1/server endpoint's create database and drop database commands, allowing authenticated root users to write and delete arbitrary files outside the configured database directory. Attackers can supply database names...

CVE-2026-75842

ArcadeDB versions before 26.8.1 allow authenticated users with read query privileges to exploit the OpenCypher LOAD CSV clause's file:// protocol, reading arbitrary server files and exfiltrating data in query responses. CVSS 7.7 HIGH; no exploit code provided. Patch to 26.8.1.

CVE-2026-75842 ArcadeDB before 26.8.1 Arbitrary File Read via LOAD CSV

ArcadeDB versions before 26.8.1 contain an arbitrary file read vulnerability in the OpenCypher LOAD CSV FROM clause that allows authenticated users to read local files. Attackers with read query privileges can use the file:// protocol in LOAD CSV statements to access arbitrary files with server...

CVE-2026-75842 ArcadeDB before 26.8.1 Arbitrary File Read via LOAD CSV

ArcadeDB versions before 26.8.1 contain an arbitrary file read vulnerability in the OpenCypher LOAD CSV FROM clause that allows authenticated users to read local files. Attackers with read query privileges can use the file:// protocol in LOAD CSV statements to access arbitrary files with server...

EUVD-2026-60605

ArcadeDB before 26.8.1 contains a denial of service vulnerability in the Cypher range function that allows authenticated users to exhaust server heap memory. Attackers can submit oversized range expressions with large bounds to trigger OutOfMemoryError and cause temporary service degradation or...