EUVD-2026-102198

In authd before 0.7.1, the user identity matching in UpdateUser internal/users/manager.go resolves an incoming login by the broker-scoped provider ID, but falls back to matching the username when the provider ID does not belong to any known user, and does not reject a conflicting non-empty provid...

CVE-2026-102631

In authd before 0.7.1, the user identity matching in UpdateUser internal/users/manager.go resolves an incoming login by the broker-scoped provider ID, but falls back to matching the username when the provider ID does not belong to any known user, and does not reject a conflicting non-empty provid...

CVE-2026-62679 Lychee: Path traversal in `SecurePathController` allows authenticated arbitrary file read

Lychee is a free, open-source photo-management tool. Prior to 7.6.4, SecurePathController, which serves GET /image/path, concatenates the attacker-controlled path with the local storage root and performs a string-prefix check before canonicalizing dot segments. Under the supported non-default...

CVE-2026-62679

The photo-management tool Lychee is vulnerable to a path traversal flaw in the SecurePathController component (prior to version 7.6.4 ). The application incorrectly performs a string-prefix check before canonicalizing dot segments when serving GET /image/{path}. Under specific non-default configu...

CVE-2026-62679 Lychee: Path traversal in `SecurePathController` allows authenticated arbitrary file read

Lychee is a free, open-source photo-management tool. Prior to 7.6.4, SecurePathController, which serves GET /image/path, concatenates the attacker-controlled path with the local storage root and performs a string-prefix check before canonicalizing dot segments. Under the supported non-default...

CVE-2026-62679 Lychee: Path traversal in `SecurePathController` allows authenticated arbitrary file read

Lychee is a free, open-source photo-management tool. Prior to 7.6.4, SecurePathController, which serves GET /image/path, concatenates the attacker-controlled path with the local storage root and performs a string-prefix check before canonicalizing dot segments. Under the supported non-default...

EUVD-2026-102192

Lychee is a free, open-source photo-management tool. Prior to 7.6.4, SecurePathController, which serves GET /image/path, concatenates the attacker-controlled path with the local storage root and performs a string-prefix check before canonicalizing dot segments. Under the supported non-default...

CVE-2026-62679

Lychee is a free, open-source photo-management tool. Prior to 7.6.4, SecurePathController, which serves GET /image/path, concatenates the attacker-controlled path with the local storage root and performs a string-prefix check before canonicalizing dot segments. Under the supported non-default...

CVE-2026-58393

OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, the OpenVPN Client Specific Override commonname field accepts path traversal sequences and openvpncscconfwrite concatenates the value into /var/etc/openvpn-csc// without normalization or a basename check. The...

CVE-2026-52167

A stack overflow in the gensubParsePsb function of AOC LC32D1320 v2.05 allows attackers to cause a Denial of Service DoS via supplying a crafted .PSB subtitle file...

CVE-2026-85634

A flaw was found in the ContentRepositoryImpl.copyExplodedContent function of the wildfly-core library, which is used by WildFly and JBoss EAP to manage server deployments. The issue occurs when the library processes an unsanitized deployment name. Due to a missing containment check, an attacker...

Red Hat Enterprise Linux Posting Link Vulnerabilities

Red Hat Enterprise Linux versions 10, 7, 8, and 9 have a post-installation link vulnerability. This vulnerability arises because Nautilus does not verify whether the path to the recycle bin directory is a symbolic link when uninstalling or ejecting removable drives or disk images. An attacker can...

WordPress ELEX – WordPress HelpDesk & Customer Ticketing System: Arbitrary File Upload Vulnerability

WordPress ELEX WordPress HelpDesk & Customer Ticketing System versions 3.3.7 and earlier have an arbitrary file upload vulnerability. This vulnerability stems from the initMailPart function, which does not properly validate the file type when saving IMAP email attachments. This allows unauthorize...

Red Hat Enterprise Linux numerical error vulnerabilities

Red Hat Enterprise Linux versions 7, 8, 9, and 10 have a numerical error vulnerability. This vulnerability stems from an integer overflow that occurs during the calculation of the memory buffer size for image dimensions by the GIMP’s file-pvr plugin. Attackers can exploit this vulnerability by...

ubports lomiri-download-manager: Permissions, licensing, and access control issues

The ubports lomiri-download-manager version from 0.1.0 to 0.3.3 had vulnerabilities related to permission management and access control. These vulnerabilities stemmed from incorrect DBus policies in the lomiri-upload-manager component, allowing any user to read arbitrary files with root privilege...

Nezhahq Nezha: Input validation error vulnerability

Versions of Nezhahq Nezha from 2.1.0 to 2.3.15 had a vulnerability related to input validation errors. This vulnerability occurred because the mintTransferTool never validated the construction of Host headers for the fs.downloadurl and fs.uploadurl URLs. This could allow attackers to redirect fil...

WHEELS.DEV: Wheel

WHEELS.DEV: In versions 4.0.0 to 4.1.2, there is a vulnerability related to input validation errors. This vulnerability stems from the use of case-insensitive comparisons on a case-sensitive file system. As a result, the checks for standard paths of zip entries, package maps, development...

Kitae Park Mang Board arbitrary file upload vulnerability

Kitae Park’s Mang Board version 2.4.4 and earlier have a vulnerability related to arbitrary file uploads. This vulnerability stems from the mbwfileUpload function, which fails to validate the file extension of the imagepath parameter provided by the attacker. The function relies on the basename o...

Helicalinsight path traversal vulnerability

Helicalinsight 7.0.0 and earlier versions have a path traversal vulnerability. This vulnerability stems from the path parameter in the getExternalResource function, which allows authenticated users to access files outside of the solution directory. Attackers can provide any readable file with...

5rahim Seanime command injection vulnerability

The 5rahim Seanime version from 3.7.0 to 3.10.3 has a command injection vulnerability. This vulnerability arises due to improper authorization; unauthenticated LAN or Tailnet clients can bypass the media stream settings. By using the transcodeHwAccelCustomSettings field, they can append...