CVE-2026-33692

Summary: CVE-2026-33692 affects WWBN AVideo prior to 29.0, where the official Docker Compose configuration exposes the project’s .env file to unauthenticated users via the root path (/.env). The docker-compose.yml mounts the entire project root as the Apache document root, allowing access to sens...

GHSA-X8MG-6R4P-87PF ArcadeDB has cross-database IDOR: /ts/*, /batch/*, Prometheus and Grafana handlers bypass authorization

About 14 HTTP handlers resolve the database path param and call getDatabase... WITHOUT user.canAccessToDatabase... and without setting the engine principal, because they extend AbstractServerHttpHandler directly instead of DatabaseAbstractHandler which holds the only per-database gate at...

GHSA-VG6X-6PG9-6QWG ArcadeDB: Read-only users can mutate database schema (incomplete fix of CVE-2026-44221)

Impact The fix for CVE-2026-44221 GHSA-fxc7-fm93-6q77 added an UPDATESCHEMA authorization check to a single schema-mutating method LocalDocumentType.createProperty. The remaining public schema mutators were left unchecked, so an authenticated identity including a read-only API token that lacks th...

CVE-2026-46513

Frogman provides headless PBX control through MCP and HTTP API. Prior to 1.6.2, Frogman stored API tokens generated by Tools/CreateApiToken.php:33-36 as raw bin2hexrandombytes32 strings in ocapitokens, and Frogman.class.php:78 authenticated the X-Frogman-Token header by comparing it with the stor...

MAL-2026-10735 Malicious code in isite (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 08f0ac64df493f0f780dab52b41f561daedaf70c2a6c9cb62fe51307f89d29fe On initialization of the framework index.js - init, lib/wsClient.js opens a WebSocket to ws://socket.social-browser.com/isite URL hidden by a custom...

CVE-2026-46621

Yamcs is a mission control framework. Prior to 5.12.7, the Yamcs script evaluation engine for Python algorithms dynamically compiled and evaluated user-controlled algorithm text using Jython through the JSR-223 ScriptEngine API without enforcing a secure sandbox, so an authenticated user with the...

CVE-2026-44632

Yamcs is a mission control framework. Prior to 5.12.7, a server-side code injection vulnerability existed in the Yamcs algorithm evaluation engine org.yamcs.algorithms.JavaExprAlgorithmExecutionFactory, which dynamically compiled and evaluated user-controlled algorithm text through the Janino...

CVE-2026-46621 Yamcs: Authenticated Remote Code Execution (RCE) via Jython Algorithm Code Injection

Yamcs is a mission control framework. Prior to 5.12.7, the Yamcs script evaluation engine for Python algorithms dynamically compiled and evaluated user-controlled algorithm text using Jython through the JSR-223 ScriptEngine API without enforcing a secure sandbox, so an authenticated user with the...

CVE-2026-46621

Yamcs is a mission control framework. Prior to 5.12.7, the Yamcs script evaluation engine for Python algorithms dynamically compiled and evaluated user-controlled algorithm text using Jython through the JSR-223 ScriptEngine API without enforcing a secure sandbox, so an authenticated user with the...

CVE-2026-46621

Summary of CVE-2026-46621 (Yamcs) : The issue arises in Yamcs’ script evaluation engine for Python algorithms, where user-controlled code is dynamically compiled and executed via Jython (JSR-223) without a secure sandbox. An authenticated user with the ChangeMissionDatabase privilege can override...

CVE-2026-46562 Yamcs: Remote Code Execution via Mission Database algorithm override

Yamcs is a mission control framework. Prior to 5.12.7, the Nashorn ScriptEngine used to evaluate user-supplied JavaScript algorithm text in yamcs-core/src/main/java/org/yamcs/algorithms/ScriptAlgorithmExecutorFactory.java was constructed without a ClassFilter, so a user with the...

CVE-2026-46562

Summary : CVE-2026-46562 affects Yamcs releases from 4.7.3 through 5.12.6. The vulnerability stems from constructing the Nashorn ScriptEngine without a ClassFilter, allowing a user with ChangeMissionDatabase privilege (or unauthenticated in default config) to execute arbitrary Java via Java.type,...

CVE-2026-44632 Yamcs: Server-Side Code Injection (RCE) via Janino Expression Engine in `JavaExprAlgorithmExecutionFactory`

Yamcs is a mission control framework. Prior to 5.12.7, a server-side code injection vulnerability existed in the Yamcs algorithm evaluation engine org.yamcs.algorithms.JavaExprAlgorithmExecutionFactory, which dynamically compiled and evaluated user-controlled algorithm text through the Janino...

CVE-2026-44632

CVE-2026-44632 affects Yamcs: the server-side evaluation engine org.yamcs.algorithms.JavaExprAlgorithmExecutionFactory) can compile and execute user-supplied algorithm text via Janino without sandboxing. An authenticated user with ChangeMissionDatabase privilege could override an algorithm throug...

Exploit for Improper Privilege Management in Microsoft

CVE-2026-49176 SYSTEM Shell PoC Local privilege-escalation pr...

Remote Code Execution (RCE)

github.com/julien040/anyquery, is vulnerable to Remote Code Execution RCE. The vulnerability is due to the server mode allowing unrestricted use of native SQLite ATTACH DATABASE commands, which allows an unauthenticated attacker to write arbitrary files to writable locations on the filesystem and...

WordPress TrueBooker plugin <= 1.2.3 - SQL Injection vulnerability

SQL Injection vulnerability discovered by HaiND in WordPress Plugin TrueBooker versions = 1.2.3...

WordPress Form Vibes – Database Manager for Forms plugin <= 1.5.2 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by hhhai in WordPress Plugin Form Vibes – Database Manager for Forms versions = 1.5.2...

CVE-2026-60082

A flaw was found in perl-DBI, a database interface for Perl. This vulnerability arises when the DBI library processes inconsistent data, specifically when a statement handle lacks fields but is associated with a non-empty data row. This inconsistency can cause the internal row-buffer to attempt...

CVE-2026-15022

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to generic SQL Injection via Stored Quiz Answer Array in all versions up to, and including, 4.0.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing...