CVE-2026-75926

Hugo 0.162.0–0.164.x added tailwindcss to the default security.exec.allow list, causing nodePermissionArgs to append --allow-child-process. A malicious tailwind.config.js executes top-level code inside the permitted Node process, calls child_process to spawn a shell, and the spawned non-Node proc...

CVE-2026-45126 MyBB: ACP Questions state CSRF

MyBB is free and open source forum software. Prior to 1.8.40, the Admin CP Security Questions module does not validate the anti-CSRF token correctly, allowing same-site attackers to enable or disable registration challenge questions with a specially crafted URL. The controller processes GET...

CVE-2026-45126 MyBB: ACP Questions state CSRF

MyBB is free and open source forum software. Prior to 1.8.40, the Admin CP Security Questions module does not validate the anti-CSRF token correctly, allowing same-site attackers to enable or disable registration challenge questions with a specially crafted URL. The controller processes GET...

EUVD-2026-61007

MyBB is free and open source forum software. Prior to 1.8.40, the Admin CP Security Questions module does not validate the anti-CSRF token correctly, allowing same-site attackers to enable or disable registration challenge questions with a specially crafted URL. The controller processes GET...

CVE-2026-45126

MyBB is free and open source forum software. Prior to 1.8.40, the Admin CP Security Questions module does not validate the anti-CSRF token correctly, allowing same-site attackers to enable or disable registration challenge questions with a specially crafted URL. The controller processes GET...

CVE-2026-45126

MyBB (open-source forum software) prior to 1.8.40 contains a CSRF vulnerability in the Admin CP Security Questions module (admin/modules/config/questions.php). The controller processes GET requests for enable/disable actions that modify mybb_questions.active without verifying the my_post_key anti...

CVE-2026-45126 MyBB: ACP Questions state CSRF

MyBB is free and open source forum software. Prior to 1.8.40, the Admin CP Security Questions module does not validate the anti-CSRF token correctly, allowing same-site attackers to enable or disable registration challenge questions with a specially crafted URL. The controller processes GET...

CVE-2026-45121

MyBB is free and open source forum software. Prior to 1.8.40, the calendar module does not check permissions consistently when listing calendars, allowing authenticated users to access titles of calendars that are otherwise inaccessible. The affected calendar-selection paths in calendar.php perfo...

CVE-2026-45121 MyBB: Insufficient permission check for calendar select

MyBB is free and open source forum software. Prior to 1.8.40, the calendar module does not check permissions consistently when listing calendars, allowing authenticated users to access titles of calendars that are otherwise inaccessible. The affected calendar-selection paths in calendar.php perfo...

CVE-2026-45121 MyBB: Insufficient permission check for calendar select

MyBB is free and open source forum software. Prior to 1.8.40, the calendar module does not check permissions consistently when listing calendars, allowing authenticated users to access titles of calendars that are otherwise inaccessible. The affected calendar-selection paths in calendar.php perfo...

EUVD-2026-61053

MyBB is free and open source forum software. Prior to 1.8.40, the calendar module does not check permissions consistently when listing calendars, allowing authenticated users to access titles of calendars that are otherwise inaccessible. The affected calendar-selection paths in calendar.php perfo...

CVE-2026-45121

In MyBB versions before 1.8.40, calendar.php performs permission checks against an invalid calendar context, allowing authenticated users to view titles of otherwise inaccessible calendars. CVSS 3.1 scores this MEDIUM (4.3) with network attack vector and low privileges required. Upgrade to versio...

CVE-2026-45121 MyBB: Insufficient permission check for calendar select

MyBB is free and open source forum software. Prior to 1.8.40, the calendar module does not check permissions consistently when listing calendars, allowing authenticated users to access titles of calendars that are otherwise inaccessible. The affected calendar-selection paths in calendar.php perfo...

CVE-2026-45128 MyBB: ACP Users View Manager default CSRF

MyBB is free and open source forum software. Prior to 1.8.40, the ACP Users View Manager module does not validate requests correctly, allowing same-site attackers to change a victim administrator's default user list view by embedding a specially crafted URL. The Set as Default control named...

CVE-2026-45128

MyBB is free and open source forum software. Prior to 1.8.40, the ACP Users View Manager module does not validate requests correctly, allowing same-site attackers to change a victim administrator's default user list view by embedding a specially crafted URL. The Set as Default control named...

CVE-2026-45128 MyBB: ACP Users View Manager default CSRF

MyBB is free and open source forum software. Prior to 1.8.40, the ACP Users View Manager module does not validate requests correctly, allowing same-site attackers to change a victim administrator's default user list view by embedding a specially crafted URL. The Set as Default control named...

CVE-2026-45128

MyBB (open-source forum software) versions prior to 1.8.40 are affected by a CSRF vulnerability in the ACP Users View Manager module. The set_default control in Admin CP → Users & Groups → Users → View Manager processes state-changing actions on GET requests without request forgery protection, im...

EUVD-2026-61050

MyBB is free and open source forum software. Prior to 1.8.40, the ACP Users View Manager module does not validate requests correctly, allowing same-site attackers to change a victim administrator's default user list view by embedding a specially crafted URL. The Set as Default control named...

CVE-2026-45128 MyBB: ACP Users View Manager default CSRF

MyBB is free and open source forum software. Prior to 1.8.40, the ACP Users View Manager module does not validate requests correctly, allowing same-site attackers to change a victim administrator's default user list view by embedding a specially crafted URL. The Set as Default control named...

CVE-2026-45127

MyBB is free and open source forum software. Prior to 1.8.40, the ACP Mass Mail module does not validate certain requests correctly, allowing same-site attackers to create draft entries from archived entries by embedding a specially crafted URL. The Resend route in Admin CP, Users & Groups, Mass...