CVE-2026-54706

OnionShare is an open source tool that lets you securely and anonymously share files, host websites, and chat with friends using the Tor network. Prior to 2.6.4, OnionShare CLI/Desktop follows symbolic links in cli/onionsharecli/web/sendbasemode.py through SendBaseModeWeb.setfileinfo and...

CVE-2026-54707 OnionShare Receive mode writes uploaded files even when file uploads are disabled

OnionShare is an open source tool that lets you securely and anonymously share files, host websites, and chat with friends using the Tor network. Prior to 2.6.4, OnionShare CLI/Desktop does not enforce the Receive mode disablefiles setting in cli/onionsharecli/web/receivemode.py, where...

PYSEC-2026-3324 Missing validation causes denial of service via `GetSessionTensor`

Impact The implementation of tf.rawops.GetSessionTensor does not fully validate the input arguments. This results in a CHECK-failure which can be used to trigger a denial of service attack: python import tensorflow as tf handle = tf.constant"", shape=0, dtype=tf.string...

CVE-2026-57671

Unauthenticated Cross Site Scripting XSS in perfmatters = 2.6.4 versions...

PT-2026-55483

Name of the Vulnerable Software and Affected Versions OnionShare versions prior to 2.6.4-1.1 Description OnionShare follows symbolic links symlinks within shared directories, which can lead to the unintended disclosure of local files from the host system. Recommendations Update to version 2.6.4-1...

OPENSUSE-SU-2026:11169-1 python3-onionshare-2.6.4-1.1 on GA media

These are all security issues fixed in the python3-onionshare-2.6.4-1.1 package on the GA media of openSUSE Tumbleweed...

CVE-2026-ThreemaWeb-PrototypePollution

CVE-2026-XXXXX: Threema Web Prototype Pollution via URI Query...

webp-https-errors (=4.7.2) potentially affected by unknown CVE via prettier-lint-lenz (=2.6.4)

prettier-lint-lenz NPM version =2.6.4 is affected by a known vulnerability. The following packages have a transitive dependency on prettier-lint-lenz and may be impacted: - webp-https-errors =4.7.2 Source cves: unknown CVE Source advisory: OSV:MAL-2026-3769...

CVE-2026-44221

ArcadeDB is a Multi-Model DBMS. Prior to 2.6.4, authenticated users and API tokens scoped to a specific database could read, write, and mutate schema on any other database on the same server. Two distinct defects contributed: 1 ServerSecurityUser.getDatabaseUser returned a DB user with an...

CVE-2026-41693

CVE-2026-41693 affects i18next-fs-backend

PT-2026-37824

A security issue was found in Sparkle before version 2.6.4. An attacker can replace an existing signed update with another payload, bypassing Sparkle’s EdDSA signing checks...

CVE-2026-1913 Gallagher Website Design <= 2.6.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'prefix' Shortcode Attribute

The Gallagher Website Design plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's loginlink shortcode in all versions up to, and including, 2.6.4 due to insufficient input sanitization and output escaping on the 'prefix' attribute. This makes it possible for...

CVE-2026-32777 affecting package expat for versions less than 2.6.4-5

CVE-2026-32777 affecting package expat for versions less than 2.6.4-5. A patched version of the package is available...

CVE-2026-35488

Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.4, RecipeBookViewSet and RecipeBookEntryViewSet use CustomIsShared as an alternative permission class, but CustomIsShared.hasobjectpermission returns True for all HTTP methods —...

CVE-2026-35488 Tandoor Recipes — CustomIsShared permits DELETE/PUT on RecipeBook by shared (read-only) users

Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.4, RecipeBookViewSet and RecipeBookEntryViewSet use CustomIsShared as an alternative permission class, but CustomIsShared.hasobjectpermission returns True for all HTTP methods —...

PT-2026-30862

Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.4, the POST /api/food/id/shopping/ endpoint reads amount and unit directly from request.data and passes them without validation to ShoppingListEntry.objects.create. Invalid amount...

Tandoor Recipes 安全漏洞

Tandoor Recipes is an open-source application designed for managing recipes, planning meals, creating shopping lists, and more. Versions of Tandoor Recipes prior to 2.6.4 contained security vulnerabilities. These vulnerabilities stemmed from the function CustomIsShared.hasobjectpermission, which...

CVE-2026-35045

The CVE-2026-35045 vulnerability affects Tandoor Recipes up to version 2.6.3. The PUT /api/recipe/batch_update/ endpoint lets any authenticated user within a Space modify any recipe (including private ones), bypassing object-level checks on PUT /api/recipe/{id}/. This enables forced exposure of p...

EUVD-2026-19388

Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.4, the PUT /api/recipe/batchupdate/ endpoint in Tandoor Recipes allows any authenticated user within a Space to modify any recipe in that Space, including recipes marked as private by...

Tandoor Recipes 安全漏洞

Tandoor Recipes is an open-source application designed for managing recipes, planning meals, creating shopping lists, and more. Versions of Tandoor Recipes prior to 2.6.4 contained security vulnerabilities. These vulnerabilities stemmed from a bypass of object-level authorization checks at the PU...