CVE-2026-103541

A vulnerability exists in formtools.org Form Tools up to version 3.1.1 . The flaw is located in the Ajax Handler component, specifically within the Files::uploadFile function of the global/code/actions.php file. This issue allows for unrestricted upload via a remote attack vector. While the proje...

Cisco-ASA-CVE-2025-20333-Scanner

CVE-2025-20333 Scanner A Python-based diagnostic scanner for Cisco ASA / FTD VPN Web Server Buffer Overflow CVE-2025-20333. CVE-2025-20333 is a critical heap-based buffer overflow vulnerability in the WebVPN file upload handler that can lead to remote code execution RCE as root when successfully...

CVE-2025-5548

🐞 CVE-2025-5548: FreeFloat FTP Server 1.0 - Stack-Based Buffer Overflow Buffer overflow in FreeFloat FTP Server 1.0 illustrating how a single unsafe handler can generate multiple CVE entries across different commands. 📑 Table of Contents Why this repository exists Why this vulnerability is...

CVE-2026-103532

A vulnerability has been found in immich-app Immich up to 2.7.5. This affects the function checkSharedLinkAccess of the file server/src/utils/access.ts of the component Shared Link Preview Handler. The manipulation of the argument Password leads to improper authorization. The attack may be...

CVE-2026-103532 immich-app Immich Shared Link Preview access.ts checkSharedLinkAccess improper authorization

A vulnerability has been found in immich-app Immich up to 2.7.5. This affects the function checkSharedLinkAccess of the file server/src/utils/access.ts of the component Shared Link Preview Handler. The manipulation of the argument Password leads to improper authorization. The attack may be...

EUVD-2026-90451

A vulnerability has been found in immich-app Immich up to 2.7.5. This affects the function checkSharedLinkAccess of the file server/src/utils/access.ts of the component Shared Link Preview Handler. The manipulation of the argument Password leads to improper authorization. The attack may be...

CVE-2026-103532

The immich-app Immich software, version up to 2.7.5 , is vulnerable to an improper authorization flaw. The issue resides in the Shared Link Preview Handler component, specifically within the checkSharedLinkAccess function of the server/src/utils/access.ts file. By manipulating the Password argume...

CVE-2026-103532 immich-app Immich Shared Link Preview access.ts checkSharedLinkAccess improper authorization

A vulnerability has been found in immich-app Immich up to 2.7.5. This affects the function checkSharedLinkAccess of the file server/src/utils/access.ts of the component Shared Link Preview Handler. The manipulation of the argument Password leads to improper authorization. The attack may be...

Linux Distros Unpatched Vulnerability : CVE-2026-103387

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A weakness has been identified in garycourt uri-js up to 4.4.1. This affects the function URI.parse of the file src/schemes/mailto.ts of the component Mailto...

AlmaLinux 9.2 [TuxCare] Security Update: libssh / libssh-config / libssh-devel (ALMALINUX9.2:CLSA-2026:1773830791)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1773830791 advisory. - A weakness has been identified in libssh up to 0.11.3. The impacted element is the function sftpextensionsgetname/sftpextensionsgetdata of...

CVE-2026-103532: Improper Authorization

A vulnerability has been found in immich-app Immich up to 2.7.5. This affects the function checkSharedLinkAccess of the file server/src/utils/access.ts of the component Shared Link Preview Handler. The manipulation of the argument Password leads to improper authorization. The attack may be...

CVE-2026-104057: Concurrent Execution using Shared Resource with Improper Synchronization

Podgrab contains an unauthenticated denial-of-service vulnerability caused by unsynchronized concurrent access to shared maps activePlayers and allConnections in its WebSocket handler, where Wshandler and HandleWebsocketMessages goroutines read and write these maps without a mutex. A remote...

Rocky Linux 9.6 [TuxCare] Security Update: expat / expat-devel / expat-static Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1784290625)

The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1784290625 advisory. - libexpat before 2.8.2 lacks handler call depth tracking for calls to XMLGetBuffer, XMLParse, XMLParseBuffer, XMLParserFree, or...

CentOS Linux 8.4 [TuxCare] Security Update: expat / expat-devel / expat-static (CENTOS8.4:CLSA-2026:1770648617)

The CentOS Linux 8.4 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS8.4:CLSA-2026:1770648617 advisory. - In libexpat before 2.7.4, XMLExternalEntityParserCreate does not copy unknown encoding handler user data. CVE-2026-24515 Note that Nessus h...

CVE-2026-103544: Exposure of Data Element to Wrong Session

A vulnerability was found in datadrivenconstruction OpenConstructionERP up to 14.8.1. The impacted element is an unknown function of the file backend/app/modules/ai/aiclient.py of the component Al Provider Configuration Handler. Performing a manipulation results in exposure of data element to wro...

PT-2026-103952

Name of the Vulnerable Software and Affected Versions Tapo C120 v1 Tapo C200 V5 Description Insufficient protection of login challenge data and lack of sanitization of attacker-controlled input processed by the MacTool handler allow an unauthenticated attacker on the same local network to replay...

PT-2026-103922

Name of the Vulnerable Software and Affected Versions Apache HTTP Server versions 2.4.60 through 2.4.68 Description A deployment of wrong handler issue allows the target of certain internal redirects from CGI programs to be treated as CGI and executed. This occurs if the target is located in a...

CVE-2026-102369: Improper Authentication

Tapo C120 v1 and C200 V5 do not adequately protect login challenge data or sanitize attacker-controlled input processed by the MacTool handler. An unauthenticated attacker on the same local network can replay login challenge data to obtain an administrative session, enable a privileged service th...

CVE-2026-42356: Deployment of Wrong Handler

Deployment of wrong handler vulnerability in Apache HTTP Server allows the target of some internal redirects from CGI programs to also be treated as CGI and executed. The target must already be in a directory enabled for CGI and have no other extension understood by modmime. This issue affects...

CVE-2026-103251: Missing Authorization

n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a validation bypass vulnerability in the community package installation handler for queue mode deployments. Attackers with Redis write access can bypass name validation, permission checks, checksum...