EUVD-2026-62197

Streambert is a cross-platform Electron Desktop App to stream and download video content. From version 2.5.0 until version 2.6.0, the wyzie-open-redeem IPC handler in index.js creates the partition:wyzie-redeem Electron session and registers an onHeadersReceived hook that removes the...

CVE-2026-52873 Streambert: Global CSP Removal in Wyzie Redeem Window Enables Unconstrained XSS in Electron Renderer

Streambert is a cross-platform Electron Desktop App to stream and download video content. From version 2.5.0 until version 2.6.0, the wyzie-open-redeem IPC handler in index.js creates the partition:wyzie-redeem Electron session and registers an onHeadersReceived hook that removes the...

CVE-2026-52877

In Streambert versions before 2.6.0, the open-external IPC handler in src/ipc/downloads.js forwards renderer-supplied URLs to Electron's shell.openExternal without protocol validation. A compromised renderer can inject file: URIs or custom schemes, leading to local file access, remote resource re...

CVE-2026-52877 Streambert : Insecure Protocol Execution in open-external IPC Handler

Streambert is a cross-platform Electron Desktop App to stream and download video content. Prior to version 2.6.0, the open-external IPC handler in src/ipc/downloads.js passes a renderer-supplied url directly to Electron's shell.openExternal without validating its protocol. A compromised renderer...

EUVD-2026-62196

Streambert is a cross-platform Electron Desktop App to stream and download video content. Prior to version 2.6.0, the open-external IPC handler in src/ipc/downloads.js passes a renderer-supplied url directly to Electron's shell.openExternal without validating its protocol. A compromised renderer...

CVE-2026-52877 Streambert : Insecure Protocol Execution in open-external IPC Handler

Streambert is a cross-platform Electron Desktop App to stream and download video content. Prior to version 2.6.0, the open-external IPC handler in src/ipc/downloads.js passes a renderer-supplied url directly to Electron's shell.openExternal without validating its protocol. A compromised renderer...

CVE-2026-48796 CefSharp: `FolderSchemeHandlerFactory` path boundary check can expose files outside the configured root folder

CefSharp provides .NET bindings for the Chromium Embedded Framework for Windows Forms and Windows Presentation Foundation applications. Prior to version 148.0.90, CefSharp/SchemeHandler/FolderSchemeHandlerFactory.cs used filePath.StartsWithrootFolder, StringComparison.OrdinalIgnoreCase to decide...

CVE-2026-53458

Blueprint Studio is a VS Code-like file editor for Home Assistant configuration files. Prior to 2.5.2, Blueprint Studio backend API handlers in customcomponents/blueprintstudio/backend/api.py returned raw exception strings to authenticated Home Assistant users. Some exception messages could conta...

CVE-2026-41921

Koha (versions before 25.05.13, 25.11.07, and 26.05.02) stores unsanitized input from fields like title, author, isbn, publishercode, place, collectiontitle, itemtype, and note in the purchase suggestion handler, rendering it in the suggestion list template and executing injected scripts in other...

EUVD-2026-61491

The Zephyr kernel validates the kthreadjoin and kthreadabort system calls declared syscall in include/zephyr/kernel.h through threadobjvalidate in kernel/thread.c. Its default switch branch is the access-denied path, taken when kobjectvalidate returns -EPERM the calling user thread was never...

Missing Authorization

Overview lemur is a Certificate management and orchestration service Affected versions of this package are vulnerable to Missing Authorization in the CertificateExport handler when the selected export plugin has requireskey set to False. An attacker can access certificate public data without prop...

CVE-2026-53458 Blueprint Studio API exposed internal exception details

Blueprint Studio is a VS Code-like file editor for Home Assistant configuration files. Prior to 2.5.2, Blueprint Studio backend API handlers in customcomponents/blueprintstudio/backend/api.py returned raw exception strings to authenticated Home Assistant users. Some exception messages could conta...

CVE-2026-53458

Blueprint Studio (a Home Assistant configuration editor add-on) prior to v2.5.2 returned raw exception strings from backend API handlers in custom_components/blueprint_studio/backend/api.py to authenticated users, exposing internal filesystem paths and implementation details that could aid finger...

CVE-2026-76032 Pydio Cells 5.0.0 to 5.0.2 - Missing Authorization on the Share Link REST Handler

Pydio Cells 5.0.0 through 5.0.2 returns share-link details to any authenticated user. The REST handler for GET /a/share/link/Uuid in idm/share/rest/handler.go reads the workspace UUID from the path, calls LinkById, and writes the result with no authorization step, whereas the sibling handler for...

CVE-2026-76032

Pydio Cells 5.0.0 through 5.0.2 is affected by a missing authorization flaw in the REST handler for GET /a/share/link/{Uuid} in idm/share/rest/handler.go. Unlike the sibling handler for GET /a/share/cell/{Uuid}, which enforces MatchPolicies with ResourcePolicyAction_READ, the link handler calls L...

CVE-2026-76032 Pydio Cells 5.0.0 to 5.0.2 - Missing Authorization on the Share Link REST Handler

Pydio Cells 5.0.0 through 5.0.2 returns share-link details to any authenticated user. The REST handler for GET /a/share/link/Uuid in idm/share/rest/handler.go reads the workspace UUID from the path, calls LinkById, and writes the result with no authorization step, whereas the sibling handler for...

CVE-2026-12520

In Zephyr RTOS v4.4.0 and earlier, the HL7800 modem driver's ~20 AT-response handlers write into a 128-byte stack buffer. The +KCELLMEAS handler passes the unbounded wire length as destination size, causing a full stack overflow; other handlers suffer single-byte off-by-one NUL writes. The fix us...

CVE-2026-12520 Stack buffer overflow and off-by-one writes in Zephyr HL7800 modem AT response handlers

The Sierra Wireless HL7800 cellular modem driver drivers/modem/vendorstandalone/hl7800.c, located at drivers/modem/hl7800.c in v4.4.0 and earlier parses AT responses with roughly twenty handlers that call netbuflinearizevalue, sizeofvalue, buf, 0, len into a 128-byte stack buffer and then write...

CVE-2026-71551

Super Productivity is an advanced todo list app with integrated timeboxing and time tracking capabilities. Prior to 18.13.0, the EXEC IPC handler in electron/ipc-handlers/exec.ts accepts a command string from the renderer through the IPC.EXEC channel and executes it with childprocess.exec. The...

CVE-2026-63640

MagicMirror² is an open source modular smart mirror platform. Prior to 2.37.0, when hideConfigSecrets is enabled, the catch-all socket dispatcher in js/nodehelper.js passes every inbound object payload through replaceSecretPlaceholder in js/serverfunctions.js before invoking...