PT-2026-64431

Cloudreve is a self-hosted file management and sharing system. Prior to 4.17.0, the WOPI PUT RELATIVE handler passes X-WOPI-SuggestedTarget to URI.JoinRaw as a path rather than a filename, allowing slash and dot-dot segments to escape the source file directory and create or conditionally overwrit...

PT-2026-64298

Name of the Vulnerable Software and Affected Versions Loytec LIP-ME201C versions prior to 8.4.17 Loytec L-INX versions prior to 8.4.17 Loytec L-GATE versions prior to 8.4.17 Loytec L-ROC versions prior to 8.4.17 Loytec L-IOB versions prior to 8.4.17 Loytec L-DALI versions prior to 8.4.17 Loytec...

PT-2026-64443

Summary The b64 extension inlines images referenced by as base64 data URIs. When resolving the src path it joins it onto the configured base path with os.path.normpath and opens the result directly, with no check that the resolved path stays inside base path. A src containing ../ sequences, or an...

PT-2026-64377

Name of the Vulnerable Software and Affected Versions sysPass versions prior to 3.2.12 Description Authenticated users possessing the PUBLICLINK CREATE profile flag can trigger unauthorized decryption and persistent storage of any vault account password. This occurs due to missing AccountAcl chec...

PT-2026-64273

Name of the Vulnerable Software and Affected Versions TOML::XS versions prior to 0.06 Description The software bundles an unsupported version of the tomlc99 library, which contains an uncontrolled recursion flaw. This occurs when the from toml function processes untrusted TOML data containing...

PT-2026-64267

A critical architectural breakdown targeting enterprise secret storage engines has been disclosed over the last 24 hours. A severe Zero-Day flaw dubbed "VaultSmuggle" tracked as CVE-2026-93401, CVSS 9.8 has been publicly revealed, heavily impacting HashiCorp Vault and OpenBao core clusters. When...

PT-2026-64416

Name of the Vulnerable Software and Affected Versions FFmpeg versions prior to 8.1.2 Description A heap out-of-bounds write exists in the native PNG and APNG encoders. A remote attacker can corrupt heap memory by providing a crafted PNG image containing a malicious eXIf chunk. By creating an eXIf...

PT-2026-64424

Name of the Vulnerable Software and Affected Versions Weintek cMT3092X affected versions not specified Description The HMI stores user account passwords in plaintext, which allows an attacker with access to the storage to retrieve sensitive credentials. Recommendations At the moment, there is no...

CVE-2026-47724

nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. Prior to version 0.3.4, the /api/v1/ route surface trusts the bearer token alone for authorisation on most endpoints. The codebase itself admits this at internal/api/hosts.go:384: "API trusts the bearer toke...

CVE-2026-48012

Shopware is an open commerce platform. Versions 6.7.3.0 through 6.7.10.0 have an open redirect in Shopware's public SSO entry point at GET /api/oauth/sso/auth. When the endpoint is reached without the expected SSO session state, the application falls back to the request's Referer header and uses...

UBUNTU-CVE-2026-65705

FFmpeg versions 3.4 through 8.1.2 contain an out-of-bounds write vulnerability in the vffloodfill video filter that allows attackers to corrupt heap memory by supplying a dynamically sized video stream with filtergraph reinitialization disabled via -reinitfilter 0. When configinput allocates the...

CVE-2026-47722 nebula-mesh: Host advanced overrides allow YAML injection into agent config.yml

nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. Prior to version 0.3.2, internal/configgen/generator.go:86,108,119 interpolates the operator-supplied ListenHost and TunDevice fields raw into a text/template that produces the agent's config.yml...

CVE-2026-48012 Shopware SSO referer trust leading to an arbitrary redirect target

Shopware is an open commerce platform. Versions 6.7.3.0 through 6.7.10.0 have an open redirect in Shopware's public SSO entry point at GET /api/oauth/sso/auth. When the endpoint is reached without the expected SSO session state, the application falls back to the request's Referer header and uses...

CVE-2026-48012

Summary: CVE-2026-48012 is an open redirect in Shopware’s public SSO endpoint (/api/oauth/sso/auth) affecting Shopware versions 6.7.3.0–6.7.10.0. When an SSO session state is missing, the code falls back to the Referer header to build the redirect destination without enforcing same-origin, relati...

CVE-2026-65703

FFmpeg versions 2.7 through 8.1.2 contain an out-of-bounds write vulnerability in the TDSC video decoder that allows remote attackers to cause heap corruption by supplying a crafted AVI file that changes frame dimensions across TDSF frames. The tdscparsetdsf function fails to unreference the...

Malicious code in yuinpm (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b4f439dbbb74a729ef5c43bdc62f612060dbc9e6a96b825c8305b88dd43b3172 Package [email protected] contains 3 files and produced no a static rule matches and no traced-code findings indicating exfiltration, install-time...

MAL-2026-11033 Malicious code in eth-codergen (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dda2a0fbfa98304482ef90da4f137c863775959e107fccd495311fcba4fd185c The package is advertised as an Ethereum ABI code generator but its index.js is a verbatim copy of the unrelated mongoose-lean-hooks plugin. Appended...

CVE-2026-65699

AgentGPT through 1.0.0 contains an authorization bypass through user-controlled key vulnerability that allows authenticated users to attach tasks to another user's agent run by supplying a target runid in the request body without ownership verification. The AgentCRUD.createtask and...

GO-2026-5987 Insecure enrollment token TTL in nebula-mesh in github.com/forgekeep/nebula-mesh

The nebula-mesh Web UI host creation ignores the configured enrollment token TTL and instead mints 24-hour bearer enrollment tokens. This can lead to tokens remaining valid for longer than intended, increasing the window of opportunity for an attacker to use an intercepted token...

CVE-2026-65917

CyberPanel through 1.9.1, fixed in commit b198460, contains an insecure direct object reference IDOR vulnerability in the IncBackups application's incremental-backup handlers deleteBackup, fetchRestorePoints, and restorePoint that allows authenticated panel users to access or manipulate other...