reachy_mini Allows Unrestricted Upload of File with Dangerous Type

Summary The Reachy Mini daemon exposes the “/api/media/sounds/upload” endpoint without authentication and file validation mechanisms. An attacker can use this endpoint to upload malicious files into the file system that will propagate in future attacks. Compromise Chain: Unauthenticated to Full...

GHSA-M2PC-3Q4Q-W6JR reachy_mini Allows Unrestricted Upload of File with Dangerous Type

Summary The Reachy Mini daemon exposes the “/api/media/sounds/upload” endpoint without authentication and file validation mechanisms. An attacker can use this endpoint to upload malicious files into the file system that will propagate in future attacks. Compromise Chain: Unauthenticated to Full...

CVE-2026-55419 Reachy Mini: Unrestricted Upload of File with Dangerous Type

Reachy Mini is an SDK for controlling Reachy Mini robots. Prior to 1.8.2, the Reachy Mini daemon exposes the /api/media/sounds/upload endpoint implemented by the uploadsound method in src/reachymini/daemon/app/routers/media.py without authentication, file-extension checks, content validation, or...

CVE-2026-55419

Reachy Mini (an SDK by Pollen Robotics for controlling Reachy Mini robots) prior to 1.8.2 exposes the /api/media/sounds/upload endpoint without authentication, file-extension checks, content validation, or size validation. The daemon binds to 0.0.0.0 by default and uses permissive CORS (allow_ori...

EUVD-2026-65627

Reachy Mini is an SDK for controlling Reachy Mini robots. Prior to 1.8.2, the Reachy Mini daemon exposes the /api/media/sounds/upload endpoint implemented by the uploadsound method in src/reachymini/daemon/app/routers/media.py without authentication, file-extension checks, content validation, or...

CVE-2026-55419 Reachy Mini: Unrestricted Upload of File with Dangerous Type

Reachy Mini is an SDK for controlling Reachy Mini robots. Prior to 1.8.2, the Reachy Mini daemon exposes the /api/media/sounds/upload endpoint implemented by the uploadsound method in src/reachymini/daemon/app/routers/media.py without authentication, file-extension checks, content validation, or...

CVE-2026-55419 Reachy Mini: Unrestricted Upload of File with Dangerous Type

Reachy Mini is an SDK for controlling Reachy Mini robots. Prior to 1.8.2, the Reachy Mini daemon exposes the /api/media/sounds/upload endpoint implemented by the uploadsound method in src/reachymini/daemon/app/routers/media.py without authentication, file-extension checks, content validation, or...

GHSA-MCJ4-MPHF-J9FF Trivy has a path traversal via a crafted vulnerability database or other downloaded artifacts

Summary When Trivy downloads an OCI artifact, it uses the org.opencontainers.image.title annotation from the artifact manifest as the destination filename without validation. An attacker who can make Trivy fetch an attacker-controlled artifact can supply a crafted annotation that resolves to a pa...

Trivy has a path traversal via a crafted vulnerability database or other downloaded artifacts

Summary When Trivy downloads an OCI artifact, it uses the org.opencontainers.image.title annotation from the artifact manifest as the destination filename without validation. An attacker who can make Trivy fetch an attacker-controlled artifact can supply a crafted annotation that resolves to a pa...

GHSA-PG62-F8G4-4WQH phpMyFAQ privilege escalation: GroupController::updatePermissions lets a GROUP_EDIT admin grant rights they do not hold

Overview When phpMyFAQ hardened its admin permission-assignment endpoints against privilege escalation, it added a "a non-SuperAdmin may only assign rights they themselves hold" constraint to the user-rights endpoint UserController::updateUserRights. The equivalent group-rights endpoint,...

phpMyFAQ privilege escalation: GroupController::updatePermissions lets a GROUP_EDIT admin grant rights they do not hold

Overview When phpMyFAQ hardened its admin permission-assignment endpoints against privilege escalation, it added a "a non-SuperAdmin may only assign rights they themselves hold" constraint to the user-rights endpoint UserController::updateUserRights. The equivalent group-rights endpoint,...

GHSA-MF8R-WM2W-F8C5 phpMyFAQ public FAQ APIs expose inactive FAQ content

Affected Product phpMyFAQ Affected Versions - Confirmed affected: 4.1.4, API v3.1. - Confirmed affected: current main / 4.2-style source, API v4.0, for GET /api/v4.0/faqs/tags/tagId when api.onlyActiveFaqs=true. Patched Versions 4.1.5. Description The public FAQ API applies inconsistent active =...

phpMyFAQ public FAQ APIs expose inactive FAQ content

Affected Product phpMyFAQ Affected Versions - Confirmed affected: 4.1.4, API v3.1. - Confirmed affected: current main / 4.2-style source, API v4.0, for GET /api/v4.0/faqs/tags/tagId when api.onlyActiveFaqs=true. Patched Versions 4.1.5. Description The public FAQ API applies inconsistent active =...

GHSA-88G4-74F3-63X9 phpMyFAQ has Potential Authenticated Path Traversal in PDF Export

Summary There is an authenticated path traversal condition in the PDF export functionality, specifically within the PDF image resolution logic. The issue may allow a privileged FAQ editor to cause the application to attempt reading files outside the intended content directory during PDF generatio...

phpMyFAQ has Potential Authenticated Path Traversal in PDF Export

Summary There is an authenticated path traversal condition in the PDF export functionality, specifically within the PDF image resolution logic. The issue may allow a privileged FAQ editor to cause the application to attempt reading files outside the intended content directory during PDF generatio...

CVE-2026-13216

The virtio PCI driver drivers/virtio/virtiopci.c parses a device's PCI capability list during driver initialization. In virtiopcireadcap the device-supplied capability length byte caplen read from PCI config space via pcieconfread was only checked with asserttmp.caplen == capstructsize. That asse...

Access of Resource Using Incompatible Type ('Type Confusion')

Overview nokogiri is a gem for parsing HTML, XML, SAX, and Reader. Affected versions of this package are vulnerable to Access of Resource Using Incompatible Type 'Type Confusion' in the initializecopywithargs function. An attacker can cause a process crash by passing a non-Node argument, such as ...

Protection Mechanism Failure

Overview Affected versions of this package are vulnerable to Protection Mechanism Failure via the System\Twig\SecurityPolicy process. An attacker can read and modify arbitrary database records, execute arbitrary SQL commands, and inject PHP code to achieve remote code execution by exploiting meth...

GHSA-Q27Q-98J4-9PFV qwed Vulnerable to Authenticated Remote Code Execution via Unsafe SymPy `parse_expr()`

Summary The qwed package version 5.1.1 passes attacker-controlled input directly to SymPy's parseexpr function without a restricted namespace. Because parseexpr internally calls Python's eval, any authenticated tenant can execute arbitrary Python code inside the API server process. The attack...

qwed Vulnerable to Authenticated Remote Code Execution via Unsafe SymPy `parse_expr()`

Summary The qwed package version 5.1.1 passes attacker-controlled input directly to SymPy's parseexpr function without a restricted namespace. Because parseexpr internally calls Python's eval, any authenticated tenant can execute arbitrary Python code inside the API server process. The attack...