PT-2026-69158

Name of the Vulnerable Software and Affected Versions Ghostfolio versions prior to 3.4.0 Description The Stripe checkout success-URL handler at GET /api/v1/subscription/stripe/callback?checkoutSessionId= retrieves the Stripe Checkout Session by ID and grants a Premium subscription to the client...

CVE-2026-19244: Improper Access Control

A vulnerability was detected in HKUDS nanobot up to 0.2.1. The affected element is the function connectmcpservers of the file nanobot/agent/tools/mcp.py of the component MCP enabledTools Scope Handler. Performing a manipulation results in improper access controls. The attack is possible to be...

PT-2026-69043

Name of the Vulnerable Software and Affected Versions libiec61850 versions prior to 1.6.2 Description A heap-based buffer overflow exists in the ASDU Element Handler component within the SVReceiver stopThreadless function located in the src/sampled values/sv subscriber.c file. This issue allows a...

CVE-2026-19246: Server-Side Request Forgery (SSRF)

A vulnerability has been found in HKUDS nanobot up to 0.2.1. This affects the function downloadimagedataurl of the file nanobot/providers/imagegeneration.py of the component Provider-returned Image URL Handler. The manipulation leads to server-side request forgery. It is possible to initiate the...

CVE-2026-19243: Improper Neutralization of Special Elements used in an OS Command

A security vulnerability has been detected in HKUDS nanobot up to 0.2.1. Impacted is the function ExecTool.guardcommand/ExecTool.spawn of the file nanobot/agent/tools/shell.py of the component Shell Allowlist Handler. Such manipulation leads to os command injection. The attack can be executed...

CVE-2026-19245: Exposure of Sensitive Information to an Unauthorized Actor

A flaw has been found in HKUDS nanobot up to 0.2.1. The impacted element is the function ExecTool.preparecommand of the file nanobot/agent/tools/shell.py of the component Login-shell Environment Handler. Executing a manipulation can lead to information disclosure. The attack requires local access...

PT-2026-69148

Name of the Vulnerable Software and Affected Versions HKUDS nanobot versions prior to 0.3.0 Description A flaw in the Login-shell Environment Handler allows local attackers to cause information disclosure. The issue exists in the ExecTool. prepare command function within the...

CVE-2026-52879: Uncontrolled Resource Consumption

Klever-Go is the Go implementation of the Klever blockchain protocol. In versions 1.7.14 through 1.7.17, the direct-message ingress handler spawns a new goroutine for every incoming direct message before the processor-level antiflood layer makes any admission decision, with no semaphore, throttle...

CVE-2026-19206: Heap-based Buffer Overflow

A security flaw has been discovered in MZ Automation libiec61850 up to 1.6.1. This affects the function SVReceiverstopThreadless of the file src/sampledvalues/svsubscriber.c of the component ASDU Element Handler. Performing a manipulation results in heap-based buffer overflow. The attack must be...

CVE-2026-19213: Improper Enforcement of Behavioral Workflow

A vulnerability was identified in WonderTrader up to 0.9.9. Affected is the function undoneqty in the library src/WtCore/TraderAdapter.h of the component Pending Order Handler. The manipulation of the argument getUndoneQty leads to enforcement of behavioral workflow. The attack is possible to be...

CVE-2026-48087

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.2, the registration handler at POST /api/auth/register/userId validates the relationship between the WebAuthn challenge and the registration cookie's email but never...

CVE-2026-19061

A flaw has been found in Insta InstaKNXServiceApp 1.2.3.1469. Affected by this issue is the function CreateWebClientAndDownloadFileList of the component Firmware Update Handler. Executing a manipulation can lead to insufficient verification of data authenticity. It is possible to launch the attac...

Exploit for Signal Handler Race Condition in Sonicwall Sma_6200_Firmware

C...

Directory Traversal

Overview @fastify/static is a Plugin for serving static files as fast as possible. Affected versions of this package are vulnerable to Directory Traversal via the static file handler process. An attacker can access protected files by submitting requests with non-canonical path segments, such as d...

MITM (Man-in-the-Middle) io.netty:netty-handler Dependency in Jira Software Data Center

This High severity MITM Man-in-the-Middle vulnerability was introduced in versions 9.12.1, 9.17.0, 10.0.0, 10.1.1, 10.2.0, 10.3.0, 10.4.0, 10.5.0, 10.6.0, 10.7.1, 11.0.0, 11.1.0, 11.2.0, and 11.3.0 of Jira Software Data Center. This MITM Man-in-the-Middle vulnerability, with a CVSS Score of 7.5 a...

CVE-2026-19061

CVE-2026-19061 affects Insta InstaKNXServiceApp 1.2.3.1469, specifically the Firmware Update Handler’s CreateWebClientAndDownloadFileList function. The issue is insufficient verification of data authenticity, with exploitation described as remote and technically complex. No remediation or version...

CVE-2026-71446

The CVE-2026-71446 vulnerability affects the AIL Framework, specifically the crawler domain view where crawled URLs are embedded directly into a JavaScript onclick handler for the stored screenshot feature. The root cause is inadequate encoding of the stored URL, allowing an attacker to inject Ja...

CVE-2026-71446 Stored Cross-Site Scripting in AIL Framework Domain Screenshot View

AIL Framework contains a stored cross-site scripting vulnerability in the crawler domain view. Crawled URLs were embedded directly into the JavaScript onclick handler used to display a stored screenshot, without context-appropriate encoding. An attacker who can cause a specially crafted URL to be...

Improper Authorization io.netty:netty-handler Dependency in Jira Software Data Center

This High severity Improper Authorization vulnerability was introduced in versions 9.12.1, 9.17.0, 10.0.0, 10.1.1, 10.2.0, 10.3.0, 10.4.0, 10.5.0, 10.6.0, 10.7.1, 11.0.0, 11.1.0, 11.2.0, and 11.3.0 of Jira Software Data Center. This Improper Authorization vulnerability, with a CVSS Score of 8.1 a...

CVE-2026-18427

@fastify/static before version 10.1.3 contains an incomplete fix for a previous route guard bypass. The static file handler rejected only parent directory segments, but it did not canonicalize dot segments, duplicate slashes, encoded dots, or backslashes before route matching and before delegatin...