CVE-2026-27115

CVE-2026-27115 affects ADB Explorer for Windows (v0.9.26020 and earlier). An unvalidated command‑line argument allows a crafted shortcut or script to trigger recursive deletion of arbitrary directories by issuing Directory.Delete(dir, true) on a configurable data directory during startup and exit...

CVE-2026-27115 ADB Explorer is Vulnerable to Arbitrary Directory Deletion via Command-Line Argument

ADB Explorer is a fluent UI for ADB on Windows. Versions 0.9.26020 and below have an unvalidated command-line argument that allows any user to trigger recursive deletion of arbitrary directories on the Windows filesystem. ADB Explorer accepts an optional path argument to set a custom data...

CVE-2026-26993

Flare is a Next.js-based, self-hostable file sharing platform that integrates with screenshot tools. Versions 1.7.0 and below allow users to upload files without proper content validation or sanitization. By embedding malicious JavaScript within an SVG or other active content formats such as HTML...

PT-2026-21279

ADB Explorer is a fluent UI for ADB on Windows. Versions 0.9.26020 and below have an unvalidated command-line argument that allows any user to trigger recursive deletion of arbitrary directories on the Windows filesystem. ADB Explorer accepts an optional path argument to set a custom data...

Nagios XI 操作系统命令注入漏洞

Nagios XI is a IT infrastructure monitoring solution developed by the American company Nagios. This solution supports monitoring and early alerts for applications, services, operating systems, etc. Nagios XI has a vulnerability related to operating system command injection. This vulnerability ste...

Svelte 跨站脚本漏洞

Svelte is an open-source approach to building web applications developed by Svelte. Versions of Svelte prior to 5.51.5 contained a cross-site scripting vulnerability. This vulnerability stemmed from the lack of validation or cleanup of tag names during server-side rendering, which could lead to...

Photobooth Web-Component 跨站脚本漏洞

Photobooth Web-Component is a software developed by Lukas personally. Versions of Photobooth Web-Component prior to 1.0.1 contained a cross-site scripting vulnerability. This vulnerability stemmed from the lack of validation on user input fields, which could lead to cross-site scripting attacks...

SVXportal 安全漏洞

SVXportal is a portal website developed by Peter as an individual developer. Versions of SVXportal 2.5 and earlier contained security vulnerabilities. These vulnerabilities stemmed from the lack of validation for the search query parameter in the log.php file, which could lead to reflection-type...

SVXportal 安全漏洞

SVXportal is a portal website developed by Peter as an individual developer. Versions of SVXportal 2.5 and earlier contained security vulnerabilities. These vulnerabilities stemmed from the lack of validation for the search query parameter in the admin/log.php file, which could lead to...

ADB Explorer 安全漏洞

ADB Explorer is a ADB user interface developed by Alex B as an individual developer. Versions of ADB Explorer prior to 0.9.26020 contain security vulnerabilities, which stem from unvalidated command-line parameters and could lead to recursive deletion of directories...

Ghost SQL注入漏洞

Ghost is a hosting service developed by the Ghost open-source project. Versions of Ghost from 3.24.0 to 6.19.0 have SQL injection vulnerabilities. These vulnerabilities stem from unvalidated code, which may allow unauthorized attackers to execute arbitrary reads from the database...

Libredesk 代码问题漏洞

Libredesk is a user support platform developed by Abhinav Raut personally. Versions of Libredesk prior to 1.0.2-0.20260215211005-727213631ce6 contained code vulnerabilities. These vulnerabilities stemmed from unvalidated Webhook target URLs, which could allow the server to send HTTP requests to...

ROS-20260220-73-0024

A vulnerability in the Linux operating system kernel function jffs2linknoderef is related to a lack of validation of the function's return code. Exploitation of the vulnerability could allow an attacker to cause a denial of service...

CVE-2026-26959 ADB Explorer Vulnerable to RCE via Insufficient Input Validation

ADB Explorer is a fluent UI for ADB on Windows. Versions 0.9.26020 and below fail to validate the integrity or authenticity of the ADB binary path specified in the ManualAdbPath setting before executing it, allowing arbitrary code execution with the privileges of the current user. An attacker can...

CVE-2026-27472

SPIP 4.4.9 fixes a Blind Server-Side Request Forgery (SSRF) in syndicated sites. In SPIP versions before 4.4.9, when editing a syndicated site, the app does not verify that the syndication URL is a valid remote URL, allowing an authenticated attacker to trigger the server to issue requests to arb...

Server-Side Request Forgery (SSRF)

Langflow is vulnerable to Server-Side Request Forgery SSRF. The vulnerability is due to insufficient validation and filtering of user-supplied URLs in the API Request component, which allows an attacker to send crafted requests to internal or restricted network resources and retrieve their...

CVE-2026-2735

CVE-2026-2735 describes a Stored XSS in Alkacon’s OpenCms v18.0. The vulnerability occurs when user input is not properly validated in a POST request to /blog/new-article/org.opencms.ugc.CmsUgcEditService.gwt using the text parameter. According to the record, the impact is limited to the vulnerab...

SPIP 安全漏洞

SPIP is an open-source software created by SPIP for creating Internet websites. Versions of SPIP prior to 4.4.9 contained security vulnerabilities. These vulnerabilities stemmed from the lack of validation of joint URLs when editing joint sites, which could lead to Man-in-the-Middle attacks...

Gogs 安全漏洞

Gogs Go Git Service is a Go-based self-service Git hosting service developed by the Gogs team. It supports creating and migrating public/private repositories, as well as adding and removing repository collaborators. Gogs versions 0.13.4 and earlier have security vulnerabilities; these...

Weblate 参数注入漏洞

Weblate is an open-source, copyleft, web-based free software system for continuous localization. Versions of Weblate prior to 5.16.0 contained a parameter injection vulnerability. This vulnerability stemmed from the SSH management console failing to validate the input when adding SSH host keys,...