CVE-2026-110119 yshopmall through 2.0.0 IDOR via Member Address API in UserAddressController

Yshopmall through 2.0.0 contains an insecure direct object reference vulnerability in the member address API that allows authenticated members to read, overwrite and delete other members' shipping addresses. Attackers can enumerate sequential address ids via /address/detail/id, /address/del and...

CVE-2026-110115 Digital-Infrastructure 9.6.5 through 9.6.11 Path Traversal via fileManager retrieveFileStream

Risesoft Digital-Infrastructure 9.6.5 through 9.6.11 contains a path traversal vulnerability in the fileManager Y9FileController.retrieveFileStream handler that allows unauthenticated attackers to read arbitrary files by supplying parent-directory segments in the fullPath and fileName parameters...

Security update for xorg-x11-server

This update for xorg-x11-server fixes the following issues: CVE-2026-88812: XKB SetGeometry TextDoodad Double Free bsc1281213. CVE-2026-93515: X.Org Server Present Extension Use-After-Free bsc1281218. CVE-2026-93516: X.Org Server XInput Passive Grab Use-After-Free bsc1281220. CVE-2026-93517: GLX...

SUSE-SU-2026:4645-1 Security update for xorg-x11-server

This update for xorg-x11-server fixes the following issues: - CVE-2026-88812: XKB SetGeometry TextDoodad Double Free bsc1281213. - CVE-2026-93515: X.Org Server Present Extension Use-After-Free bsc1281218. - CVE-2026-93516: X.Org Server XInput Passive Grab Use-After-Free bsc1281220. -...

GrafTraverse-CVE-2021-43798

GrafTraverse - CVE-2021-43798 MiNi Exploitation Framework Command-line automation tool for authorized security testing of Grafana Directory Traversal CVE-2021-43798. Overview CVE-2021-43798 is an unauthenticated directory traversal vulnerability in Grafana 8.x that allows attackers to read...

CVE-2024-20767

Proof of Concept script for CVE-2024-20767 Overview get-the-files.py is a Python script that exploits a vulnerability in Adobe ColdFusion Servers CVE-2024-20767 to read files from the server. The script is based on a method outlined at https://jeva.cc/2973.html. Disclaimer This script is provided...

CVE-2026-106047

Ivanti Xtraction versions prior to 2026.4 are vulnerable to a Path Traversal vulnerability within the template export functionality . This flaw allows a remote authenticated attacker to perform arbitrary file reads. The documents do not provide specific details regarding exploit availability or d...

CVE-2026-81507

ESF-IDF is the Espressif Internet of Things IOT Development Framework. Prior to 5.2.8, 5.3.6, 5.5.5, 6.0.3, and 6.1-rc1, ESP-IDF BlueDroid L2CAP configuration-option processing in l2cmain.c and l2cutils.c does not consistently validate option lengths against the remaining received packet bytes. A...

DEBIAN-CVE-2026-105460

A flaw was found in BlueZ. An out-of-bounds read vulnerability exists in the btmon Bluetooth monitor tool when processing crafted HCI Return Link Keys events. A maliciously crafted btsnoop capture file can specify a large number of link keys that exceeds the actual packet data, causing btmon to...

CVE-2026-105460

A flaw was found in BlueZ. An out-of-bounds read vulnerability exists in the btmon Bluetooth monitor tool when processing crafted HCI Return Link Keys events. A maliciously crafted btsnoop capture file can specify a large number of link keys that exceeds the actual packet data, causing btmon to...

CVE-2026-103928

Metabase is an open source business intelligence and analytics platform. From 1.55.0 until 1.58.16, 1.59.13, 1.60.9, and 1.61.4, native queries and actions against an H2 data source are passed through without restricting host-facing built-in functions. A user authorized to run native queries or...

CVE-2026-102734

asteval is a Python expression evaluator designed for restricted execution. Prior to 1.0.9, in asteval/astutils.py, the default Interpreter with numpy enabled exposes a ctypes type and permits fromaddress memory access. safegetattr blocks the ctypes module but not reachable ctypes type objects,...

UBUNTU-CVE-2026-105460

A flaw was found in BlueZ. An out-of-bounds read vulnerability exists in the btmon Bluetooth monitor tool when processing crafted HCI Return Link Keys events. A maliciously crafted btsnoop capture file can specify a large number of link keys that exceeds the actual packet data, causing btmon to...

CVE-2026-105460

A flaw was found in BlueZ. An out-of-bounds read vulnerability exists in the btmon Bluetooth monitor tool when processing crafted HCI Return Link Keys events. A maliciously crafted btsnoop capture file can specify a large number of link keys that exceeds the actual packet data, causing btmon to...

CVE-2026-54640 OpenRemote: XXE in KNXProtocol.startAssetImport() allows arbitrary file read via unprotected XMLInputFactory

OpenRemote is an open-source internet-of-things platform. Prior to 1.24.2, the KNXProtocol.startAssetImport method in agent/src/main/java/org/openremote/agent/protocol/knx/KNXProtocol.java processes 0.xml from an authenticated user's uploaded ETS project ZIP with Saxon TransformerFactoryImpl and...

EUVD-2026-98841

OpenRemote is an open-source internet-of-things platform. Prior to 1.24.2, the KNXProtocol.startAssetImport method in agent/src/main/java/org/openremote/agent/protocol/knx/KNXProtocol.java processes 0.xml from an authenticated user's uploaded ETS project ZIP with Saxon TransformerFactoryImpl and...

CVE-2026-54640

The OpenRemote IoT platform is vulnerable to an XML External Entity (XXE) injection in the KNXProtocol.startAssetImport() method. This occurs because the KNXProtocol handler, located in agent/src/main/java/org/openremote/agent/protocol/knx/KNXProtocol.java, processes user-uploaded ETS project ZIP...

CVE-2026-103928 Metabase: Arbitrary File Read/Write via Unsafe H2 Built-in Functions

Metabase is an open source business intelligence and analytics platform. From 1.55.0 until 1.58.16, 1.59.13, 1.60.9, and 1.61.4, native queries and actions against an H2 data source are passed through without restricting host-facing built-in functions. A user authorized to run native queries or...

CVE-2026-103928

The business intelligence platform Metabase is vulnerable to arbitrary file read and write in versions 1.55.0 through 1.58.16, 1.59.13, 1.60.9, and 1.61.4. The root cause is the failure to restrict host-facing built-in functions when processing native queries or actions against an H2 data source ...

CVE-2026-79609

XPTI Xen Page Table Isolation was introduced to mitigate Meltdown CVE-2017-5754, one aspect of XSA-254. This involves copying 64-bit PV guest page table entries from guest-chosen root page tables to the Xen- chosen one which is in actual use by hardware. To read the guest root page table, the...