GNUnet P2P Framework 0.26.2

GNUnet is a peer-to-peer framework with focus on providing security. All peer-to-peer messages in the network are confidential and authenticated. The framework provides a transport abstraction layer and can currently encapsulate the network traffic in UDP IPv4 and IPv6, TCP IPv4 and IPv6, HTTP, o...

EUVD-2026-65478

Crater Invoice through 6.0.6 contains a path traversal vulnerability in the self-update API that allows authenticated company owners to write arbitrary files outside the intended extraction directory by supplying crafted ZIP archives with ../ sequences to the unzip endpoint. Attackers can exploit...

adidnsdump

Active Directory Integrated DNS dump tool By default any user in Active Directory can enumerate all DNS records in the Domain or Forest DNS zones, similar to a zone transfer. This tool enables enumeration and exporting of all DNS records in the zone for recon purposes of internal networks. For mo...

CVE-2026-20769

A flaw was found in the Intel NPU Driver. An unprivileged software adversary with an authenticated user can exploit an improper conditions check. This vulnerability, requiring local access and no user interaction, may lead to a denial of service on the affected system. Mitigation No mitigation is...

CVE-2026-78581

Authorization Bypass Through User-Controlled Key CWE-639 in Kibana can lead to unauthorized data modification via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. Under certain conditions, an authenticated user could reference another user's AI Assistant conversation identifier t...

CVE-2026-57863

Crater Invoice (through 6.0.6 ) contains a path traversal vulnerability in its self-update API. The root cause is unsanitized ZIP entry names containing ../ sequences passed to PHP's ZipArchive::extractTo(), allowing authenticated company owners to write arbitrary files outside the intended extra...

CVE-2026-79664

Ech0 before 4.7.3 fails to properly revoke access tokens created with never-expire option, allowing attackers to maintain perpetual authenticated access after token theft. Three independent revocation mechanisms fail: logout panics on nil ExpiresAt field, RevokeToken skips when remainTTL is zero,...

CVE-2026-79659

Ech0 before 4.7.3 contains a server-side request forgery vulnerability in the fetchPeerConnectInfo function that uses unvalidated HTTP requests instead of safe request methods with URL validation. Authenticated attackers can supply arbitrary URLs to access internal services and cloud metadata...

CVE-2026-77997

Joomla Extension - yootheme.com - Authenticated, privileged information disclosure in YOOtheme Pro 1.0.0-5.0.41 - A missing access check allowed users with comtemplate editing permissions to access information about arbitrary modules without the respective commodules permissions...

CVE-2026-77996

Joomla Extension - yootheme.com - Authenticated, privileged stored XSS in YOOtheme Pro 1.0.0-5.0.41 - Lack of escaping in the location custom field lead to a XSS vector...

CVE-2026-77997

YOOtheme Pro (a Joomla extension by yootheme.com) versions 1.0.0 through 5.0.41 contain a missing access check that allows authenticated users holding com_template editing permissions to view information about arbitrary site modules without the corresponding com_modules permissions. This constitu...

EUVD-2026-65472

Joomla Extension - yootheme.com - Authenticated, privileged information disclosure in YOOtheme Pro 1.0.0-5.0.41 - A missing access check allowed users with comtemplate editing permissions to access information about arbitrary modules without the respective commodules permissions...

CVE-2026-77997 Joomla Extension - yootheme.com - Authenticated, privileged information disclosure about site modules YOOtheme Pro 1.0.0-5.0.40

Joomla Extension - yootheme.com - Authenticated, privileged information disclosure in YOOtheme Pro 1.0.0-5.0.41 - A missing access check allowed users with comtemplate editing permissions to access information about arbitrary modules without the respective commodules permissions...

CVE-2026-77996 Joomla Extension - yootheme.com - Authenticated, privileged stored XSS in YOOtheme Pro 1.0.0-5.0.41

Joomla Extension - yootheme.com - Authenticated, privileged stored XSS in YOOtheme Pro 1.0.0-5.0.41 - Lack of escaping in the location custom field lead to a XSS vector...

CVE-2026-77996

YOOtheme Pro (a Joomla extension) is affected by an authenticated, privileged stored XSS in versions 1.0.0 through 5.0.41 . The root cause is a lack of escaping in the location custom field , which allows a privileged user to inject a cross-site scripting payload. The CVSS 4.0 base score is 7.5 (...

EUVD-2026-65477

Joomla Extension - yootheme.com - Authenticated, privileged stored XSS in YOOtheme Pro 1.0.0-5.0.41 - Lack of escaping in the location custom field lead to a XSS vector...

CVE-2026-77996 Joomla Extension - yootheme.com - Authenticated, privileged stored XSS in YOOtheme Pro 1.0.0-5.0.41

Joomla Extension - yootheme.com - Authenticated, privileged stored XSS in YOOtheme Pro 1.0.0-5.0.41 - Lack of escaping in the location custom field lead to a XSS vector...

CVE-2026-79666

Ech0 versions before 4.4.3 fail to enforce administrator authorization on dashboard log endpoints. Any authenticated user can query GET /api/system/logs and subscribe to SSE and WebSocket log streams, retrieving sensitive operational data including file paths, stack traces, and internal URLs . Th...

EUVD-2026-65448

Ech0 before 4.4.3 fails to enforce administrator authorization on dashboard log endpoints, allowing any authenticated user to access system logs. Attackers with valid user sessions can query GET /api/system/logs and subscribe to SSE and WebSocket log streams to retrieve sensitive operational data...

CVE-2026-79664

Ech0 versions before 4.7.3 contain an access token revocation bypass. When tokens are created with the never-expire option, three independent revocation mechanisms all fail: the logout handler panics on a nil ExpiresAt field, RevokeToken skips when remainTTL is zero, and the admin delete action d...