CVE-2026-103397

The OpenSave software prior to version 2.4.0-beta.1 is vulnerable to an authentication bypass due to insufficient validation of sender identities in WAN relay requests. An attacker who knows the room code can join a room, extract paired peer identifiers from announcements, and then spoof the Rela...

CVE-2026-103398

The software OpenSave through 2.4.0 is vulnerable to an arbitrary file read and write flaw. The issue originates in the manifest request handler , which fails to properly validate save paths provided by paired peers. This allows an attacker to specify arbitrary directories outside of the configur...

CVE-2026-41478

Saltcorn is an extensible, open source, no-code database application builder. Prior to 1.4.6, 1.5.6, and 1.6.0-beta.5, a SQL injection vulnerability in Saltcorn’s mobile-sync routes allows any authenticated low-privilege user with read access to at least one table to inject arbitrary SQL through...

CVE-2026-41478 Saltcorn: SQL Injection via Unparameterized Sync Endpoints (maxLoadedId)

Saltcorn is an extensible, open source, no-code database application builder. Prior to 1.4.6, 1.5.6, and 1.6.0-beta.5, a SQL injection vulnerability in Saltcorn’s mobile-sync routes allows any authenticated low-privilege user with read access to at least one table to inject arbitrary SQL through...

EUVD-2026-25633

Saltcorn is an extensible, open source, no-code database application builder. Prior to 1.4.6, 1.5.6, and 1.6.0-beta.5, a SQL injection vulnerability in Saltcorn’s mobile-sync routes allows any authenticated low-privilege user with read access to at least one table to inject arbitrary SQL through...

CVE-2026-41478: Improper Neutralization of Special Elements used in an SQL Command

Saltcorn is an extensible, open source, no-code database application builder. Prior to 1.4.6, 1.5.6, and 1.6.0-beta.5, a SQL injection vulnerability in Saltcorn’s mobile-sync routes allows any authenticated low-privilege user with read access to at least one table to inject arbitrary SQL through...