CVE-2026-63725 sysPass FileBackupService Authenticated OS Command Injection via Backup Path

sysPass's FileBackupService::doBackupFiles in lib/SP/Services/Backup/FileBackupService.php around line 388 builds a tar shell command by string-concatenating the backup directory path $this-path directly into the command line 'tar czf ' . $backupFileApp . ' ' . BASEPATH . ' --exclude "'...

CVE-2026-63725 sysPass FileBackupService Authenticated OS Command Injection via Backup Path

sysPass's FileBackupService::doBackupFiles in lib/SP/Services/Backup/FileBackupService.php around line 388 builds a tar shell command by string-concatenating the backup directory path $this-path directly into the command line 'tar czf ' . $backupFileApp . ' ' . BASEPATH . ' --exclude "'...

CVE-2026-16620 WPC Name Your Price for WooCommerce < 2.2.5 - Unauthenticated Price Manipulation via Select Mode

The WPC Name Your Price for WooCommerce WordPress plugin before 2.2.5 does not enforce its server-side price allowlist for products configured in "Select" price mode, allowing an unauthenticated visitor to add such a product to the cart at an arbitrary value below the merchant-defined allowed...

CVE-2026-14831

Technical details are not publicly available in the provided documents; monitor for updates.

CVE-2026-70633 TimescaleDB 2.29.1 Out-of-Bounds Read DoS via Gorilla Compression Reverse Iterator

TimescaleDB through 2.29.1, fixed in commit 517c13e, contains an out-of-bounds read vulnerability in the Gorilla compression reverse row iterator that allows authenticated attackers to cause a denial of service by storing a crafted compressed datum with an internally inconsistent BitArray...

CVE-2026-71445

The CVE-2026-71445 entry concerns AIL Framework. It describes an authenticated reflected cross-site scripting flaw in the /tag/add_tags endpoint, where an error message is emitted directly as HTML via str(res[0]), allowing attacker-controlled input to be reflected without proper encoding. Exploit...

CVE-2026-71445 Authenticated Reflected Cross-Site Scripting in Tag Error Responses in ail-framework

AIL Framework contained a reflected cross-site scripting vulnerability in the /tag/addtags endpoint. When an error occurred while processing a tag operation, the application returned the error value directly as an HTML response using strres0. If attacker-controlled input was included in the...

CVE-2026-71326

Traefik is an open source HTTP reverse proxy and load balancer. From 3.6.11 until 3.6.25 and 3.7.10, Traefik's BasicAuth middleware in pkg/middlewares/auth/basicauth.go deduplicates concurrent password checks with a singleflight key built from the delimiter-free concatenation of password and...

CVE-2026-71326 Traefik: BasicAuth singleflight key collision allows authenticated identity spoofing

Traefik is an open source HTTP reverse proxy and load balancer. From 3.6.11 until 3.6.25 and 3.7.10, Traefik's BasicAuth middleware in pkg/middlewares/auth/basicauth.go deduplicates concurrent password checks with a singleflight key built from the delimiter-free concatenation of password and...

CVE-2026-18487 Epiphany: address bar / host spoofing via userinfo in ephy_uri_get_decoded_host()

A flaw was found in Epiphany. An issue in how the browser reads web addresses allows attackers to fake the domain name shown in the address bar. If a user clicks a specially crafted link containing a colon for example, https://trusted.com:[email protected]/, the address bar and security menus will...

CVE-2026-18277

Missing authorization in the OcrModelRight create and delete views in Scripta eScriptorium through 26.04.1 allows a remote authenticated user to grant themselves access to another user's private OCR model and to revoke any user's OCR model access via a POST request, because the ownership check is...

CVE-2026-18258

Authorization bypass in the Line, LineTranscription, VirtualCollection, tag and process API endpoints in Scripta/eScriptorium through 26.04.1 allows a remote authenticated user to read, modify and delete other users' transcription content via primary keys supplied in the request body, which are...

CVE-2026-18276

Missing authorization in the websocket consumer in Scripta eScriptorium through 26.04.1 allows a remote authenticated user to subscribe to any document's event stream and observe another user's segmentation, transcription, import, export and training activity via the objectcls and objectpk values...

Traefik: Cross-user response poisoning via proxied CONNECT on Traefik's shared backend keep-alive pool

Summary There is a critical vulnerability in Traefik's default HTTP reverse proxy that leads to unauthenticated cross-user response poisoning. When a client opens an HTTP/2 or HTTP/3 CONNECT request, Traefik forwards it — body included — to an HTTP/1.1 upstream over a shared net/http.Transport. I...

GHSA-3CCP-42PG-HGV6 Traefik: Cross-user response poisoning via proxied CONNECT on Traefik's shared backend keep-alive pool

Summary There is a critical vulnerability in Traefik's default HTTP reverse proxy that leads to unauthenticated cross-user response poisoning. When a client opens an HTTP/2 or HTTP/3 CONNECT request, Traefik forwards it — body included — to an HTTP/1.1 upstream over a shared net/http.Transport. I...

CVE-2026-71324 Traefik: Cross-user response poisoning via proxied CONNECT on Traefik's shared backend keep-alive pool

Traefik is an open source HTTP reverse proxy and load balancer. Prior to 2.11.53, 3.6.24, and 3.7.9, Traefik's default HTTP reverse proxy forwards a plain HTTP/2 or HTTP/3 CONNECT request and its body to an HTTP/1.1 upstream through a shared net/http.Transport. When the upstream answers the CONNE...

CVE-2026-71324 Traefik: Cross-user response poisoning via proxied CONNECT on Traefik's shared backend keep-alive pool

Traefik is an open source HTTP reverse proxy and load balancer. Prior to 2.11.53, 3.6.24, and 3.7.9, Traefik's default HTTP reverse proxy forwards a plain HTTP/2 or HTTP/3 CONNECT request and its body to an HTTP/1.1 upstream through a shared net/http.Transport. When the upstream answers the CONNE...

CVE-2026-71324 Traefik: Cross-user response poisoning via proxied CONNECT on Traefik's shared backend keep-alive pool

Traefik is an open source HTTP reverse proxy and load balancer. Prior to 2.11.53, 3.6.24, and 3.7.9, Traefik's default HTTP reverse proxy forwards a plain HTTP/2 or HTTP/3 CONNECT request and its body to an HTTP/1.1 upstream through a shared net/http.Transport. When the upstream answers the CONNE...

CVE-2026-71324

CVE-2026-71324 (Traefik) : Unauthenticated cross-user response poisoning via proxied CONNECT on Traefik’s shared backend keep-alive pool. Traefik forwards HTTP/2/HTTP/3 CONNECT and its body to an HTTP/1.1 upstream through a shared net/http.Transport. If the upstream returns a keep-alive non-2xx a...

EUVD-2026-54288

Traefik is an open source HTTP reverse proxy and load balancer. Prior to 2.11.53, 3.6.24, and 3.7.9, Traefik's default HTTP reverse proxy forwards a plain HTTP/2 or HTTP/3 CONNECT request and its body to an HTTP/1.1 upstream through a shared net/http.Transport. When the upstream answers the CONNE...