EUVD-2026-125728

Flowise through 3.1.4 contains a server-side request forgery vulnerability that allows authenticated attackers with chatflows or agentflows create/update permissions to bypass the Custom Function sandbox's SSRF protection by requiring a module subpath inside an allowlisted package, such as...

wch-ch56x-lib

wch-ch56x-lib This library was built alongside Hydradancer, a new backend for the Facedancer USB emulation library based on the WCH569 chip. Reliable drivers were needed for this project and many features were missing from the WCH examples or untested. This library provides USB3, USB2, HSPI and...

cve-2020-1015

CVE-2020-1015 PoC for CVE-2020-1015 More detail available here To compile: 1. Create an empty C++ project in Visual Studio. 2. Add cve20201015.cpp and Source.idl to the project as source files. 3. Compile Source.idl. This will generate three files: Sourcec.c, Sourceh.h and Sources.c. 4. Add the...

EUVD-2026-125547

MRBS before 1.13.0 contains an LDAP injection vulnerability in web/lib/MRBS/Auth/AuthLdap.php that interpolates unescaped login usernames into DN search and group-membership filters. Attackers with valid directory credentials outside the required group can submit crafted usernames that make the...

CVE-2026-128345

ExcelJS through 4.4.0 contains a regular expression denial of service vulnerability in slideFormula in lib/utils/shared-formula.js when translating shared formulas to child cells. Attackers can supply a crafted spreadsheet with very long master formulas, such as runs of hyphens, causing quadratic...

CVE-2026-128348

ExcelJS through 4.4.0 contains a formula injection vulnerability in the totals row formula getter in lib/doc/table.js that fails to escape , , and ' characters in structured reference column names. Attackers can supply column names containing via untrusted input like imported CSV headers to injec...

CVE-2026-126464

OpenEMR before 8.5.0 contains a server-side request forgery vulnerability in PatientPortalPDFDocumentCreator::createPdfObject that allows authenticated patients to make the server issue HTTP GET requests. Attackers can submit img src, inline style url, or reinserted unpurified style blocks via th...

CVE-2026-126437

OpenEMR before 8.5.0 contains an authorization bypass vulnerability in portal/lib/downloadtemplate.php that allows any authenticated core user to render documents for arbitrary patients by setting isModule. Attackers can submit arbitrary pid and templateid values to disclose patient names, birth...

CVE-2026-126437

OpenEMR versions before 8.5.0 are susceptible to an authorization bypass vulnerability in portal/lib/download_template.php. The flaw allows any authenticated core user to bypass ACL and squad restrictions by manipulating the isModule parameter. By submitting arbitrary pid and template_id values, ...

EUVD-2026-125006

OpenEMR before 8.5.0 contains an authorization bypass vulnerability in portal/lib/downloadtemplate.php that allows any authenticated core user to render documents for arbitrary patients by setting isModule. Attackers can submit arbitrary pid and templateid values to disclose patient names, birth...

CVE-2026-126464

The OpenEMR software (versions before 8.5.0 ) contains a Server-Side Request Forgery (SSRF) vulnerability within the PatientPortalPDFDocumentCreator::createPdfObject() function. Authenticated patients can trigger the server to issue HTTP GET requests by submitting malicious img src, inline style ...

CVE-2026-126464 OpenEMR before 8.5.0 SSRF via Patient Portal PDF Generation

OpenEMR before 8.5.0 contains a server-side request forgery vulnerability in PatientPortalPDFDocumentCreator::createPdfObject that allows authenticated patients to make the server issue HTTP GET requests. Attackers can submit img src, inline style url, or reinserted unpurified style blocks via th...

EUVD-2026-124960

OpenEMR before 8.5.0 contains a server-side request forgery vulnerability in PatientPortalPDFDocumentCreator::createPdfObject that allows authenticated patients to make the server issue HTTP GET requests. Attackers can submit img src, inline style url, or reinserted unpurified style blocks via th...

EUVD-2026-125154

ExcelJS through 4.4.0 contains a regular expression denial of service vulnerability in slideFormula in lib/utils/shared-formula.js when translating shared formulas to child cells. Attackers can supply a crafted spreadsheet with very long master formulas, such as runs of hyphens, causing quadratic...

CVE-2026-128348 ExcelJS through 4.4.0 Formula Injection via Table Totals Row Column Names

ExcelJS through 4.4.0 contains a formula injection vulnerability in the totals row formula getter in lib/doc/table.js that fails to escape , , and ' characters in structured reference column names. Attackers can supply column names containing via untrusted input like imported CSV headers to injec...

CVE-2026-128348

Versions of ExcelJS through 4.4.0 are vulnerable to a formula injection vulnerability in the totals row formula getter located in lib/doc/table.js. The root cause is the failure to escape characters such as [, ], #, and ' in structured reference column names. An attacker can provide untrusted inp...

EUVD-2026-125151

ExcelJS through 4.4.0 contains a formula injection vulnerability in the totals row formula getter in lib/doc/table.js that fails to escape , , and ' characters in structured reference column names. Attackers can supply column names containing via untrusted input like imported CSV headers to injec...

CVE-2026-90781-alsa-lib-oob

CVE-2026-90781 — alsa-lib OOB Write Reproducer Standalone C reproducer for CVE-2026-90781 , a 1-byte out-of-bounds write in alsa-lib's sndctlasciielemidparse when parsing name= both quoted and unquoted forms. Vulnerability In src/control/ctlparse.c v1.2.16.1 and earlier development HEAD: char...

Exploit for CVE-2026-107360

CVE-2026-107360 — rubygem-safemode compound-assignment Jail al...

LatePoint < 5.7.7 - Unauthenticated Authentication Bypass / Account Takeover

Unauthenticated SQL operator injection in the latepointroutecall AJAX route wpajaxnopriv. buildconditionsquery in lib/models/model.php treats literal 'IS NULL'/'IS NOT NULL' as SQL operators and concatenates them unbound, bypassing the customer password-reset token check - account takeover of...