Frappe Google OAuth state is client-controllable, enabling redirects and authorization-flow abuse

Frappe Google OAuth State Is Client-Controllable, Enabling Redirects and Authorization-Flow Abuse Vulnerability Overview The Google integrations in Frappe Framework Gmail/Calendar/Drive, etc. share a unified OAuth authorization entry point and callback handler. Before the fix, the authorization...

Frappe Prepared Report / Query Report bypass subject, owner and row-level permission checks to read other users' report data

Frappe Prepared Report / Query Report Bypass Permission Checks to Read Other Users' Report Data Vulnerability Overview Query Report in Frappe Framework supports background pre-generation Prepared Report: the query is executed with the initiating user's privileges and the result is persisted for...

GStreamer librfb: rfb_decoder_fill_rectangle() wrong write granularity causes heap out-of-bounds write

GStreamer librfb: rfbdecoderfillrectangle wrong write granularity causes heap out-of-bounds write Vulnerability Overview In rfbsrc the VNC/RFB client element of GStreamer gst-plugins-bad, rfbdecoderfillrectangle fills rectangles by writing pixels at guint32 4-byte granularity regardless of the...

Superhuman: undisclosed vulnerability (ZAI-2026-HVZBCH)

Not disclosed. Details are not yet publicly disclosed...

FineReport: undisclosed vulnerability (ZAI-2026-88NSND)

Not disclosed. Details are not yet publicly disclosed...

Redis: undisclosed vulnerability (ZAI-2026-XCSSCM)

Not disclosed. Details are not yet publicly disclosed...

libevent: undisclosed vulnerability (ZAI-2026-IGDWCQ)

Not disclosed. Details are not yet publicly disclosed...

DokuWiki Revert plugin renders changelog usernames unescaped, leading to stored XSS

DokuWiki Revert plugin renders changelog usernames unescaped, leading to stored XSS Vulnerability Overview DokuWiki's built-in revert admin plugin, when listing changelog edit records, HTML-escapes edit summaries but outputs the changelog user field verbatim. For authentication backends that do n...

Vaultwarden unconditionally trusts the X-Real-IP header, enabling rate-limit bypass and audit IP spoofing

Vaultwarden Unconditional Trust in the X-Real-IP Request Header Leading to Rate-Limit Bypass and Audit IP Spoofing Overview Vaultwarden supports reading the client IP from a configurable HTTP request header IPHEADER, default X-Real-IP for rate limiting of login/2FA and the admin panel, as well as...

Linux kernel 9p: oldfid erroneously released in p9_client_walk() error path

In the Linux kernel, the following vulnerability has been resolved: 9p: avoid putting oldfid in p9clientwalk error path When p9clientwalk is called with clone set to false, fid aliases oldfid. If the walk subsequently fails after the request has been sent, the error path jumps to clunkfid, which...

MongoDB: undisclosed vulnerability (ZAI-2026-M5JLW3)

Not disclosed. Details are not yet publicly disclosed...

Frappe list filter values rendered unescaped, leading to XSS

Frappe List Filter Values Rendered Unescaped, Leading to XSS Vulnerability Overview When rendering the search/filter template of the website-side list view in Frappe Framework, the search keywords from the query string and the page path are embedded directly into the HTML output, with key positio...

WeKan expired impersonation records bypass private board export authorization (ImpersonateBleed)

WeKan Expired Impersonation Records Bypass Private Board Export Authorization ImpersonateBleed Vulnerability Overview WeKan administrators can use the impersonation feature to operate as other users, and the system records every impersonation action. The flaw is this: in addition to the normal...

WeKan Avatar Localization follows redirects, bypassing SSRF protections (RedirectBleed)

WeKan Avatar Localization Follows Redirects, Bypassing SSRF Protections RedirectBleed Vulnerability Overview WeKan allows users to set an external avatar URL in their profile, and the server-side avatar localization feature fetches that URL and caches the avatar as a local attachment. Although SS...

GStreamer DTLS plugin openssl_verify_callback stack buffer overflow on certificate subject DN causes remote denial of service

GStreamer DTLS Plugin Stack Buffer Overflow in Certificate Subject DN Handling Causes Remote Denial of Service CVE-2026-59692 Vulnerability Overview In the GStreamer DTLS plugin the dtls element of gst-plugins-bad, used for the DTLS channel in WebRTC pipelines, the peer certificate verification...

Joomla com_installer update list stored XSS (description/detailsurl unescaped)

Joomla cominstaller Update List Stored XSS CVE-2026-48952 Vulnerability Overview The extension update list in the Joomla CMS administrative backend the update view of cominstaller renders the description and detailsurl fields of extension update information without HTML escaping, constituting a...

FTP parser: recoverable RETR error escalated to APP_LAYER_ERROR disables FTP application-layer inspection on the same flow

FTP parser: recoverable RETR error escalated to APPLAYERERROR disables FTP application-layer inspection on the same flow Vulnerability Overview Suricata's FTP application-layer parser escalates a protocol-recoverable command-ordering error — a client sending RETR/STOR before negotiating a data po...

WebKit single-bug RCE: crafted web content yields AAR/AAW/PC-hijack in content process

Summary A memory-corruption vulnerability in Apple's WebKit engine is reachable from maliciously crafted web content. Apple's public advisory understates the impact as an "unexpected process crash" and notes it was addressed with improved memory handling. In practice the bug is a single-shot remo...

Linux kernel garp: unsigned integer underflow in garp_pdu_parse_attr

In the Linux kernel, the following vulnerability has been resolved: net: garp: fix unsigned integer underflow in garppduparseattr The receive-side GARP attribute parser computes dlen with reversed operands: dlen = sizeofga - ga-len; ga-len is the on-wire attribute length and includes the GARP...

wolfSSL: undisclosed vulnerability (ZAI-2026-ZZJMHM)

Not disclosed. Details are not yet publicly disclosed...

JeecgBoot: undisclosed vulnerability (ZAI-2026-SUNNZJ)

Not disclosed. Details are not yet publicly disclosed...

Sogou Browser: undisclosed vulnerability (ZAI-2026-DFWIYP)

Not disclosed. Details are not yet publicly disclosed...

FreeType: undisclosed vulnerability (ZAI-2026-S5HCAG)

Not disclosed. Details are not yet publicly disclosed...

Redis: undisclosed vulnerability (ZAI-2026-5YPF8J)

Not disclosed. Details are not yet publicly disclosed...

Knot Resolver: undisclosed vulnerability (ZAI-2026-HFI2PO)

Not disclosed. Details are not yet publicly disclosed...

FineReport: undisclosed vulnerability (ZAI-2026-WP2SMY)

Not disclosed. Details are not yet publicly disclosed...

Beyond Compare: undisclosed vulnerability (ZAI-2026-6I43U8)

Not disclosed. Details are not yet publicly disclosed...

Affirm: undisclosed vulnerability (ZAI-2026-VNVE7A)

Not disclosed. Details are not yet publicly disclosed...

WinRAR: undisclosed vulnerability (ZAI-2026-Y5KTQB)

Not disclosed. Details are not yet publicly disclosed...

DokuWiki authplain modifyUser regex injection can delete other users' accounts

DokuWiki authplain modifyUser regex injection can delete other users' accounts Vulnerability Overview When DokuWiki uses the built-in authplain authentication backend, user profiles are stored in the users.auth.php file, and the modifyUser operation triggered by a user updating their profile...

PhotoPrism WebDAV Sync path traversal allows writing to arbitrary paths

PhotoPrism WebDAV Sync path traversal allows writing to arbitrary paths Vulnerability Overview PhotoPrism supports WebDAV sync: after an administrator configures a WebDAV remote, a background worker pulls the remote directory listing and downloads files to the local sync directory. The local...

NocoDB leaks other creators' private integration configuration when includeConfig is omitted

NocoDB Private Integration Configuration Information Disclosure Vulnerability Overview NocoDB's workspace-level Base Integration read service has an authorization logic flaw in its handling of the includeConfig request parameter: the check that "a private integration's configuration is visible on...

Suricata datasets: non-string value_key in JSON/NDJSON dataset enrichment causes null-pointer dereference denial of service

Suricata datasets: non-string valuekey in JSON/NDJSON dataset enrichment causes null-pointer dereference denial of service Vulnerability Overview Suricata supports loading external datasets in JSON/NDJSON format and using dataset records to enrich traffic e.g., enriching IP addresses, domains, an...

ZenTao: undisclosed vulnerability (ZAI-2026-IRUA72)

Not disclosed. Details are not yet publicly disclosed...

wolfSSL: undisclosed vulnerability (ZAI-2026-HCDDTA)

Not disclosed. Details are not yet publicly disclosed...

memcached: undisclosed vulnerability (ZAI-2026-NPWI7E)

Not disclosed. Details are not yet publicly disclosed...

SLBrowser: undisclosed vulnerability (ZAI-2026-5IS294)

Not disclosed. Details are not yet publicly disclosed...

Redis: undisclosed vulnerability (ZAI-2026-ZW22XM)

Not disclosed. Details are not yet publicly disclosed...

FFmpeg: undisclosed vulnerability (ZAI-2026-42S9BI)

Not disclosed. Details are not yet publicly disclosed...

Smartbi: undisclosed vulnerability (ZAI-2026-XXZN8R)

Not disclosed. Details are not yet publicly disclosed...

lwIP: undisclosed vulnerability (ZAI-2026-O3JX0Y)

Not disclosed. Details are not yet publicly disclosed...

RT-Thread: undisclosed vulnerability (ZAI-2026-RQA8QG)

Not disclosed. Details are not yet publicly disclosed...

Oracle Real Application Clusters DB Home: undisclosed vulnerability (ZAI-2026-BNPM81)

Not disclosed. Details are not yet publicly disclosed...

Intel Integrated Performance Primitives: undisclosed vulnerability (ZAI-2026-DVOTYV)

Not disclosed. Details are not yet publicly disclosed...

Stripe: undisclosed vulnerability (ZAI-2026-PDG48R)

Not disclosed. Details are not yet publicly disclosed...

Stripe: undisclosed vulnerability (ZAI-2026-0T5LSJ)

Not disclosed. Details are not yet publicly disclosed...

PhotoPrism StartIndexing path traversal (index endpoint escapes the originals directory)

PhotoPrism StartIndexing path traversal index endpoint escapes the originals directory Vulnerability Overview PhotoPrism's indexing feature allows specifying the subdirectory to scan via the path parameter of POST /api/v1/index. Before the fix, when this path was joined with the media library roo...

PhotoPrism global preview/download tokens bypass resource visibility boundaries

PhotoPrism global preview/download tokens bypass resource visibility boundaries Vulnerability Overview PhotoPrism loads thumbnails and file downloads via simple URLs that cannot carry authentication headers preview/download tokens in query parameters or paths, validated by an in-memory token look...

Seafile server-controlled sync path can escape the client worktree (macOS/Linux)

Seafile server-controlled sync path can escape the client worktree macOS/Linux Vulnerability Overview The Seafile client's sync module applies file diffs delivered by the server during the checkout phase, and the target path of rename operations is fully controlled by the server. The validity che...

Linux kernel MRP: vector attribute parsing errors break applicant state handling

Linux kernel MRP: vector attribute parsing errors break applicant state handling Vulnerability Overview The Linux kernel MRP IEEE 802.1 Multiple Registration Protocol PDU parser mishandles zero-length vector attributes, event counts and attribute-value advancement in mrppduparsevecattr, breaking...