CVE-2026-100854: Missing Authorization

AzuraCast before 0.23.6 lacks RequireInternalConnection middleware on the Liquidsoap API endpoint and incorrectly derives the AutoDJ flag from header presence rather than validated value. Users with View station permission can inject arbitrary now-playing metadata, disrupt live broadcasts, and...

EUVD-2026-87503

OpenClaw is a coding agent distributed as the npm package openclaw. In affected versions 2026.7.1 through 2026.7.2, alternate but valid file: URL spellings supplied over the Agent Client Protocol ACP were treated as relative paths and were incorrectly classified as reads scoped to the session...

CVE-2026-76907 LaSuite Doc: Public Documents Enumeration

LaSuite Doc is a collaborative note taking, wiki and documentation platform. From 4.8.2 until 5.4.0, GET /api/v1.0/documents/search/ accepts sequential seven-digit document paths to scope descendant searches without requiring the caller to possess the public document UUID. An unauthenticated call...

CLEANSTART-2026-BL26881 Previously, resolving relative paths containing parent directory ('

Security vulnerability affects the fluent-operator package. Previously, resolving relative paths containing parent directory '...

CVE-2026-96672 Frappe ERPNext before 16.34.1 Unauthorized Method Invocation

Frappe ERPNext versions before 16.34.1 fail to validate that Financial Report Template calculationformula values reference whitelisted methods before passing them to frappe.call. Accounts Managers can supply arbitrary dotted Python paths to invoke non-whitelisted internal server-side methods and...

CVE-2026-71178

Dell Secure Connect Gateway SCG Policy Manager, versions prior to 5.34.00.16, contains an Use of Non-Canonical URL Paths for Authorization Decisions vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Unauthorized access...

Improper Neutralization of Special Elements Used in a Template Engine

Overview solspace/craft-freeform is a flexible and user-friendly form building plugin! Affected versions of this package are vulnerable to Improper Neutralization of Special Elements Used in a Template Engine via the rendering of submitted form field values in an isolated Twig context. An attacke...

EUVD-2026-85330

Dell Secure Connect Gateway SCG Policy Manager, versions prior to 5.34.00.16, contains an Use of Non-Canonical URL Paths for Authorization Decisions vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Unauthorized access...

CVE-2026-71178

Dell Secure Connect Gateway SCG Policy Manager, versions prior to 5.34.00.16, contains an Use of Non-Canonical URL Paths for Authorization Decisions vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Unauthorized access...

CVE-2026-71178

The Dell Secure Connect Gateway (SCG) Policy Manager , versions prior to 5.34.00.16 , is vulnerable to an Use of Non-Canonical URL Paths for Authorization Decisions vulnerability. An unauthenticated attacker with remote access could potentially exploit this flaw to gain Unauthorized access . No s...

CVE-2026-71178

Dell Secure Connect Gateway SCG Policy Manager, versions prior to 5.34.00.16, contains an Use of Non-Canonical URL Paths for Authorization Decisions vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Unauthorized access...

CVE-2026-91801

Foxit PDF Editor/Reader is susceptible to a path traversal vulnerability within its handling of embedded PDF resources , specifically involving RichMedia Annotations . The vulnerability is caused by insufficient validation of resource file paths , which may allow files to be written outside of th...

CVE-2026-71178: Use of Non-Canonical URL Paths for Authorization Decisions

Dell Secure Connect Gateway SCG Policy Manager, versions prior to 5.34.00.16, contains an Use of Non-Canonical URL Paths for Authorization Decisions vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Unauthorized access...

PT-2026-97332

Name of the Vulnerable Software and Affected Versions Dell Secure Connect Gateway SCG Policy Manager versions prior to 5.34.00.16 Description An issue exists involving the use of non-canonical URL paths for authorization decisions. This allows an unauthenticated remote attacker to potentially...

PT-2026-97358

Name of the Vulnerable Software and Affected Versions Frappe ERPNext versions prior to 16.34.1 Description Accounts Managers can invoke non-whitelisted internal server-side methods and read their return values. This occurs because the software fails to validate that the calculation formula values...

lightrag-hku: Sensitive Information Exposure Through Raw Exception Messages in API Error Responses

Summary The LightRAG API server passes raw Python exception messages directly into HTTP error responses across 30+ error handlers in every router. When combined with the default unauthenticated configuration see companion report on CWE-306, any network-reachable client can trigger exceptions whos...

CVE-2026-77253

MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. Prior to 0.22.0, Jira and Confluence attachment upload tools accept arbitrary local filesystem paths and send the selected bytes to Atlassian. In HTTP or multi-user deployments, a caller can cross the...

CLEANSTART-2026-AL86944 Previously, resolving relative paths containing parent directory ('

CVE-2026-56860 affects multiple packages. Previously, resolving relative paths containing parent directory '. See references for individual vulnerability details...

PT-2026-96942

Name of the Vulnerable Software and Affected Versions MCP Atlassian versions prior to 0.22.0 Description Jira and Confluence upload tools interpret caller-controlled path arguments on the MCP server and open those files before sending them as attachments. This allows a permitted client to disclos...

SUSE CVE-2026-72802

SiYuan versions before v3.7.4 contain an information disclosure vulnerability in the resolveAssetPath endpoint that returns absolute filesystem paths unmodified to CheckAuth-only requests. Attackers can harvest relative asset paths from published documents and submit them to resolveAssetPath to...