CVE-2026-103022 Urwid: handle_short_request() crashes on non-ASCII POST body (UnicodeEncodeError DoS)

Urwid is a console user interface library for Python. Prior to 4.0.7, handleshortrequest in urwid/display/web.py performs unguarded character encoding on POST input and unguarded UTF-8 decoding on polling update socket output. A remote attacker who obtains a valid X-Urwid-ID session token can...

CVE-2026-94619 FileGator: Missing authorization in POST /upload allows cross-user read and deletion of temporary files

FileGator is a multi-user file manager. Prior to 7.15.0, POST /upload in backend/Controllers/UploadController.php uses the request-supplied resumableFilename as an unnamespaced key in shared temporary storage. In a multi-user deployment configured with distinct per-user home directories, a...

CVE-2026-94618 FileGator: Missing authorization in GET /batchdownload allows cross-user retrieval of another user's archive

FileGator is a multi-user file manager. Prior to 7.15.0, GET /batchdownload in backend/Controllers/DownloadController.php uses batchDownloadStart to stream a shared temporary archive selected by the request-supplied uniqid without checking that the current session created it. In deployments with...

CVE-2026-119800 Ryot: Cross-tenant collection read via `collectionContents`

Ryot is a self-hosted personal tracking application. Prior to 10.5.6, the collectionContents GraphQL query implemented by collectioncontents in crates/services/collection/src/contentoperations.rs accepts a caller-controlled CollectionContentsInput.collectionid and returns a collection without...

CVE-2026-77442 Ryot: `createOrUpdateUserIntegration` trusts a client-supplied `integrationId` with no ownership check, letting any user hijack/overwrite another user's integration (cross-tenant IDOR)

Ryot is a self-hosted personal tracking application. Prior to 10.4.0, the createOrUpdateUserIntegration GraphQL mutation in crates/services/user/src/integrationoperations.rs allows a low-privileged authenticated user to supply another user's integrationId to createorupdateuserintegration without ...

CVE-2026-47738 liboqs: Uninitialized function-pointer dereference in OQS_KEM_encaps_derand for NTRU KEMs

liboqs is a C-language cryptographic library that provides implementations of post-quantum cryptography algorithms. Prior to 0.16.0, OQSKEMencapsderand can dereference an uninitialized encapsderand function pointer when called on NTRU-HPS-2048-509, NTRU-HPS-2048-677, NTRU-HPS-4096-821,...

CVE-2026-44519 liboqs: Missing value barrier in FO implicit rejection path (FrodoKEM, NTRU, and others)

liboqs is a C-language cryptographic library that provides implementations of post-quantum cryptography algorithms. Prior to 0.16.0, the ctselect function in src/kem/frodokem/external/util.c for the FrodoKEM-640, FrodoKEM-976, and FrodoKEM-1344 AES and SHAKE reference variants lacks a value barri...

CVE-2026-69128 Chartbrew: AI orchestrator run_query SQL blocklist bypass enables arbitrary file read on connected PostgreSQL (quoted-identifier + pg_stat_file/pg_ls_* sibling gap)

Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. In 5.2.2, the AI SQL blocklist omitted sibling PostgreSQL filesystem functions and failed to match double-quoted identifier forms of denied functions. The vulnerable...

CVE-2026-86044

JupyterLab Desktop is the cross-platform desktop application for JupyterLab. Prior to 4.6.2-1, JupyterLab Desktop exposed getServerInfo to the renderer without confirming that the current page still had the local Jupyter server origin. In a local managed session using JupyterLab before 4.4.8, an...

CVE-2026-86005

Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to 5.2.3, the administrative BullMQ dashboard was mounted without an authentication check. The vulnerable surface is the Bull Board/BullMQ administration dashboard ...

CVE-2026-85726

Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to 5.2.3, a date-typed MongoDB variable placed inside a quoted query placeholder was inserted as an unescaped string, unlike the safely escaped or coerced string,...

CVE-2026-85712

Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to 5.2.3, the shared project permission check trusted a caller-controlled teamid and let the teamOwner/teamAdmin branch continue without confirming that the target...

CVE-2026-85708

Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to 5.2.3, Chart share and embed tokens were signed with CBSECRET, including known or shipped-default values in stock source and repository Docker Compose installs...

CVE-2026-85736

Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to 5.2.3, connection creation or update stored attacker-chosen absolute SSL and SSH file paths, and later connection cleanup passed those stored paths to fs.unlink...

CVE-2026-85737

Velociraptor is a tool for collecting host-based state information using Velociraptor Query Language VQL queries. Prior to 0.77.2, SQLPlugin.Call in vql/parsers/sql/sql.go does not enforce plugin-level FILESYSTEMREAD or NETWORK checks before the mysql and postgres branches pass a caller-controlle...

CVE-2026-71863

SecureDrop is an open-source whistleblower submission system that media organizations can use to securely accept documents from, and communicate with anonymous sources. From 2.13.0 until 2.16.1, running the securedrop-admin install Ansible playbook with journalist alerts disabled leaves the...

CVE-2026-63441

2FAuth is a web app to manage Two-Factor Authentication 2FA accounts and generate their security codes. From 6.1.0 until 8.0.0, App\Services\Traits\ValidatesUrls::isPublicIp does not recognize the 64:ff9b::/96 and 64:ff9b:1::/48 NAT64 prefixes, so an otpauth URI image parameter can pass an IPv6...

CVE-2026-63440

2FAuth is a web app to manage Two-Factor Authentication 2FA accounts and generate their security codes. Prior to 8.0.0, the otpauth image-fetch path validates a hostname through ValidatesUrls::isExternalHost and then lets IconService::storeRemoteImage resolve the same hostname again for the HTTP...

CVE-2026-85295

Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to 5.2.3, four authentication helpers accepted session tokens signed with CBSECRET, including known, weak, or shipped-default values. The vulnerable surface is...

CVE-2026-63439

2FAuth is a web app to manage Two-Factor Authentication 2FA accounts and generate their security codes. Prior to 8.0.0, when AUTHENTICATIONGUARD=reverse-proxy-guard is enabled, ReverseProxyGuard::user reads the default REMOTEUSER identity header, or a custom identity header selected by the...