CVE-2026-92262

The MariaDB server is vulnerable to multiple issues caused by a historical #mysql50# tablename encoding bypass . The root cause allows the #mysql50# prefix to bypass normal filesystem encoding for table names. An attacker can trigger this by using a table name with the #mysql50# prefix to access ...

CVE-2026-92262

MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the mysql50 bypass prefix is affected because it allows the mysql50 prefix to bypass normal table-name filesystem encoding. An attacker can trigger the issue wit...

CVE-2026-42269

countly-server is the server-side part of Countly, a product analytics solution. Prior to 24.05.50 and 25.03.44, the authenticated data-migration deletion route in plugins/datamigration/api/api.js passes the user-controlled exportid to cleanupdata without path validation...

CVE-2026-61801 affecting package containerized-data-importer for versions less than 1.62.0-9

CVE-2026-61801 affecting package containerized-data-importer for versions less than 1.62.0-9. A patched version of the package is available...

CVE-2026-78669 affecting package containerized-data-importer for versions less than 1.62.0-9

CVE-2026-78669 affecting package containerized-data-importer for versions less than 1.62.0-9. A patched version of the package is available...

CVE-2026-78663 affecting package containerized-data-importer for versions less than 1.62.0-9

CVE-2026-78663 affecting package containerized-data-importer for versions less than 1.62.0-9. A patched version of the package is available...

CVE-2026-97032 affecting package containerized-data-importer for versions less than 1.62.0-9

CVE-2026-97032 affecting package containerized-data-importer for versions less than 1.62.0-9. A patched version of the package is available...

CVE-2026-78660 affecting package containerized-data-importer for versions less than 1.62.0-9

CVE-2026-78660 affecting package containerized-data-importer for versions less than 1.62.0-9. A patched version of the package is available...

CVE-2026-78659 affecting package containerized-data-importer for versions less than 1.62.0-9

CVE-2026-78659 affecting package containerized-data-importer for versions less than 1.62.0-9. A patched version of the package is available...

WordPress Kirki deserialization injection vulnerability

WordPress Kirki versions 6.3.2 and earlier have a deserialization injection vulnerability. This vulnerability arises from insufficient validation during the deserialization of untrusted inputs, allowing PHP object injection. Certified attackers can inject PHP objects into the system. If a POP cha...

Admidio authorization issue vulnerability

The Admidio versions from 5.0.11 to 5.0.16 have a vulnerability related to authorization. This vulnerability stems from improper access control in modules/inventory/inventorydata.php. Attackers who are already authenticated can bypass the restrictions of the inventorymoduleEnabled setting by maki...

Thorsten Rinne phpMyFAQ Authorization Issues Vulnerability

Thorsten Rinne reported an authorization issue in versions of phpMyFAQ between 3.2.0 and 4.1.9, as well as between 4.2.0-alpha and 4.2.0-beta. The issue stems from the GET /admin/api/user/data/userId API, which contains an insecure direct object reference. No checks are performed on SuperAdmin or...

Thorsten Rinne phpMyFAQ Authorization Issues Vulnerability

Thorsten Rinne has identified an authorization issue in versions of phpMyFAQ prior to 4.1.9, including 4.1.0 and 4.2.0-alpha. This issue arises due to a lack of authorization in the management dashboard. Users who are authenticated but do not have administrator privileges can access restricted da...

CVE-2026-42269 countly-server: Path Traversal in delete_import Endpoint Allows Arbitrary File and Directory Deletion

countly-server is the server-side part of Countly, a product analytics solution. Prior to 24.05.50 and 25.03.44, the authenticated data-migration deletion route in plugins/datamigration/api/api.js passes the user-controlled exportid to cleanupdata without path validation...

EUVD-2026-102915

countly-server is the server-side part of Countly, a product analytics solution. Prior to 24.05.50 and 25.03.44, the authenticated data-migration deletion route in plugins/datamigration/api/api.js passes the user-controlled exportid to cleanupdata without path validation...

CVE-2026-42269

countly-server is the server-side part of Countly, a product analytics solution. Prior to 24.05.50 and 25.03.44, the authenticated data-migration deletion route in plugins/datamigration/api/api.js passes the user-controlled exportid to cleanupdata without path validation...

CVE-2026-42269

The countly-server product analytics solution is vulnerable to a path traversal vulnerability in versions prior to 24.05.50 and 25.03.44 . The authenticated data-migration deletion route in plugins/data_migration/api/api.js fails to validate the user-controlled exportid parameter before passing i...

CVE-2026-42269 countly-server: Path Traversal in delete_import Endpoint Allows Arbitrary File and Directory Deletion

countly-server is the server-side part of Countly, a product analytics solution. Prior to 24.05.50 and 25.03.44, the authenticated data-migration deletion route in plugins/datamigration/api/api.js passes the user-controlled exportid to cleanupdata without path validation...

CVE-2026-42269 countly-server: Path Traversal in delete_import Endpoint Allows Arbitrary File and Directory Deletion

countly-server is the server-side part of Countly, a product analytics solution. Prior to 24.05.50 and 25.03.44, the authenticated data-migration deletion route in plugins/datamigration/api/api.js passes the user-controlled exportid to cleanupdata without path validation...

CVE-2026-111139

A flaw was found in libnsbmp. This vulnerability allows an attacker to cause a Denial of Service DoS by tricking an application into processing a specially crafted icon ICO file. Due to improper bounds checking when decoding mask data for an image whose bitmap width is not an expected multiple of...