CVE-2026-66060

CVE-2026-66060 affects Home Assistant, where the Companion app accepts NFC/QR tag links via an OS-level routing mechanism and processes them as if physically scanned without validating the calling app or prompting the user. The root cause is unverified local calls delivering arbitrary tags to Hom...

EUVD-2026-54531

Allocation of Resources Without Limits or Throttling vulnerability in DivvyPayHQ absinthefederation allows an unauthenticated remote attacker to abort the Erlang VM via crafted entities representation keys. Every key of every object in the representations argument of the federation-mandated...

CVE-2026-66059

Frappe is a full-stack web application framework. Prior to 16.20.0 and 15.112.0, a field-level permissions bypass exposes restricted DocType fields. This issue is fixed in versions 16.23.0 and 15.112.0...

CVE-2026-19208

A vulnerability was detected in WonderTrader up to 0.9.9. Impacted is the function TraderDD::queryTrades of the file src/TraderDD/TraderDD.cpp. The manipulation of the argument FIDJYLB results in enforcement of behavioral workflow. The attack can be launched remotely. A high complexity level is...

CVE-2026-66059 Frappe: Field-level permission bypass via Document Follow

Frappe is a full-stack web application framework. Prior to 16.20.0 and 15.112.0, a field-level permissions bypass exposes restricted DocType fields. This issue is fixed in versions 16.23.0 and 15.112.0...

CVE-2026-66059

CVE-2026-66059 concerns the Frappe full‑stack web framework where, prior to versions 16.20.0 and 15.112.0 , a field‑level permissions bypass could expose restricted DocType fields. The underlying issue is a bypass of field permissions, enabling access to normally restricted data. The vulnerabilit...

CVE-2026-66059 Frappe: Field-level permission bypass via Document Follow

Frappe is a full-stack web application framework. Prior to 16.20.0 and 15.112.0, a field-level permissions bypass exposes restricted DocType fields. This issue is fixed in versions 16.23.0 and 15.112.0...

EUVD-2026-54500

Frappe is a full-stack web application framework. Prior to 16.20.0 and 15.112.0, a field-level permissions bypass exposes restricted DocType fields. This issue is fixed in versions 16.23.0 and 15.112.0...

MAL-2026-13516 Malicious code in forge-gas-diff (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4b1f6143f5a7c6106ab4ba0a21a6adaf9020e332835b1e528de6f36b64537734 index.js is advertised as a Foundry gas-report diff utility but on module load / CLI run schedules a setTimeout of 259,200,000 ms 3 days that calls...

Security Bulletin: form-data CRLF Injection via Unescaped Field Name and Filename

Summary form-data versions through 4.0.5 are vulnerable to CRLF injection CWE-93, CVSS 7.5, High. Field names and filenames passed to FormDataappend are not sanitized before being written into the Content-Disposition header, allowing an attacker who controls those values to inject arbitrary heade...

CVE-2026-12070

Tobit Laboratories AG TeamDavid's Webbox is vulnerable to an arbitrary file deletion vulnerability in the send email, fax, SMS, etc. functionality. By specifying an @@COMMENTFILE command in the form field scjob, any file on the system can be deleted. This issue affects TeamDavid through Rollout 5...

CVE-2026-54200

The CVE-2026-54200 entry concerns Tobit Laboratories AG TeamDavid’s Webbox. It describes a local file inclusion vulnerability in the “send email, fax, SMS, etc.” function accessible via the form field scjob where an the command like @@attach can attach files to a message, enabling an authenticate...

CVE-2026-54200 TeamDavid: Local File Inclusion via the form field 'scjob'

Tobit Laboratories AG TeamDavid's Webbox is vulnerable to a local file inclusion vulnerability in the send email, fax, SMS, etc. functionality. By specifying an '@@attach' command in the form field 'scjob', files can be attached to a message, which can then be downloaded by an authenticated user....

EUVD-2026-54424

Tobit Laboratories AG TeamDavid's Webbox is vulnerable to an arbitrary file deletion vulnerability in the send email, fax, SMS, etc. functionality. By specifying an @@COMMENTFILE command in the form field scjob, any file on the system can be deleted. This issue affects TeamDavid through Rollout 5...

CVE-2026-12070 TeamDavid: Arbitrary File Deletion via form field 'scjob'

Tobit Laboratories AG TeamDavid's Webbox is vulnerable to an arbitrary file deletion vulnerability in the send email, fax, SMS, etc. functionality. By specifying an @@COMMENTFILE command in the form field scjob, any file on the system can be deleted. This issue affects TeamDavid through Rollout 5...

EUVD-2026-54308

SQL Injection vulnerability in FineAdmin V1.0 allows a remote attacker to execute arbitrary code via the field and order parameters in paginated list endpoints...

CVE-2026-67689

SQL Injection vulnerability in FineAdmin V1.0 allows a remote attacker to execute arbitrary code via the field and order parameters in paginated list endpoints...

CVE-2026-15256

The Ninja Forms WordPress plugin before 3.14.10 does not prevent user-supplied query-string input, used to pre-populate a form field's default value, from being processed as a shortcode, allowing unauthenticated attackers to execute arbitrary shortcodes registered on the site when a form so...

Cross-site Scripting (XSS)

Overview craftcms/cms is a content management system. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the draftName field in the control panel rendering process. An attacker can execute arbitrary JavaScript in the session of higher-privileged users by crafting a...

CVE-2026-70557 diboot-core Authenticated Arbitrary Field Read via loadRelatedData Discloses Password Hashes and Salts

diboot-core's POST /common/load-related-data endpoint resolves caller-supplied field names to any @TableField column of any entity and returns those values for all rows, with no field or entity allowlist. The only guard, relatedDataSecurityCheck, returns true unconditionally, so any authenticated...