Frappe Google OAuth state is client-controllable, enabling redirects and authorization-flow abuse

Frappe Google OAuth State Is Client-Controllable, Enabling Redirects and Authorization-Flow Abuse Vulnerability Overview The Google integrations in Frappe Framework Gmail/Calendar/Drive, etc. share a unified OAuth authorization entry point and callback handler. Before the fix, the authorization...

Frappe Kanban Board whitelisted methods lack board permission checks, allowing unauthorized read and tampering

Frappe Kanban Board Whitelisted Methods Lack Board Permission Checks, Allowing Unauthorized Read and Tampering Vulnerability Overview Kanban Board in Frappe Framework exposes multiple whitelisted methods for Desk-side kanban operations. Before the fix, after loading a kanban board document, sever...

Frappe Connected App OAuth flow: insufficient permission checks and external redirect

Frappe Connected App OAuth Flow: Insufficient Permission Checks and External Redirect Vulnerability Overview Connected App in Frappe Framework is an OAuth2 client integration mechanism; its whitelisted method is used to generate an authorization URL for a user and write the authorization state in...

Frappe Auto Repeat update_reference lacks reference-document permission check, allowing unauthorized document references

Frappe Auto Repeat updatereference Lacks Reference-Document Permission Check, Allowing Unauthorized Document References Vulnerability Overview Auto Repeat in Frappe Framework automatic repetition / subscription documents provides a whitelisted method used to bind a reference document to an...

Frappe Web Form script context values rendered unescaped, leading to XSS

Frappe Web Form Script Context Values Rendered Unescaped, Leading to Stored XSS Vulnerability Overview Web Form in Frappe Framework website forms is a data-submission entry point for anonymous/external users; its page template serializes the server-side document object and injects it into a globa...

Frappe list filter values rendered unescaped, leading to XSS

Frappe List Filter Values Rendered Unescaped, Leading to XSS Vulnerability Overview When rendering the search/filter template of the website-side list view in Frappe Framework, the search keywords from the query string and the page path are embedded directly into the HTML output, with key positio...

Frappe comment template context values unescaped, leading to XSS

Frappe Comment Template Context Values Unescaped, Leading to XSS Vulnerability Overview When rendering the Jinja template of the website-side comment component in Frappe Framework, context values such as the page path, referenced doctype, and document name are concatenated directly into HTML...

Frappe Discussion Reply Markdown rendering allows unsafe tags, leading to stored XSS

Frappe Discussion Reply Markdown Rendering Allows Unsafe Tags, Leading to Stored XSS Vulnerability Overview The Discussion feature on the website side of Frappe Framework supports Markdown replies; after a reply is saved, the system pushes the rendered Markdown result in real time to all online...

Frappe Prepared Report / Query Report bypass subject, owner and row-level permission checks to read other users' report data

Frappe Prepared Report / Query Report Bypass Permission Checks to Read Other Users' Report Data Vulnerability Overview Query Report in Frappe Framework supports background pre-generation Prepared Report: the query is executed with the initiating user's privileges and the result is persisted for...

Frappe GDPR Personal Data Download Request ownership error leads to IDOR, allowing download of other users' PII

Frappe GDPR Personal Data Download Request Ownership Error Leads to IDOR, Allowing Download of Other Users' PII Vulnerability Overview When generating a user's personal data export file, the Personal Data Download Request feature that Frappe Framework provides for GDPR compliance failed to...

DokuWiki Revert plugin renders changelog usernames unescaped, leading to stored XSS

DokuWiki Revert plugin renders changelog usernames unescaped, leading to stored XSS Vulnerability Overview DokuWiki's built-in revert admin plugin, when listing changelog edit records, HTML-escapes edit summaries but outputs the changelog user field verbatim. For authentication backends that do n...

DokuWiki authplain modifyUser regex injection can delete other users' accounts

DokuWiki authplain modifyUser regex injection can delete other users' accounts Vulnerability Overview When DokuWiki uses the built-in authplain authentication backend, user profiles are stored in the users.auth.php file, and the modifyUser operation triggered by a user updating their profile...

PhotoPrism StartIndexing path traversal (index endpoint escapes the originals directory)

PhotoPrism StartIndexing path traversal index endpoint escapes the originals directory Vulnerability Overview PhotoPrism's indexing feature allows specifying the subdirectory to scan via the path parameter of POST /api/v1/index. Before the fix, when this path was joined with the media library roo...

PhotoPrism global preview/download tokens bypass resource visibility boundaries

PhotoPrism global preview/download tokens bypass resource visibility boundaries Vulnerability Overview PhotoPrism loads thumbnails and file downloads via simple URLs that cannot carry authentication headers preview/download tokens in query parameters or paths, validated by an in-memory token look...

PhotoPrism Vision API can read server-local files

PhotoPrism Vision API can read server-local files Vulnerability Overview PhotoPrism's computer vision features caption, labels, nsfw, face assemble image references into outbound requests to the configured vision model through a set of request builders. Image references come from two sources: loc...

PhotoPrism WebDAV Sync path traversal allows writing to arbitrary paths

PhotoPrism WebDAV Sync path traversal allows writing to arbitrary paths Vulnerability Overview PhotoPrism supports WebDAV sync: after an administrator configures a WebDAV remote, a background worker pulls the remote directory listing and downloads files to the local sync directory. The local...

Seafile out-of-bounds read on malformed head commit ID

Seafile out-of-bounds read on malformed head commit ID Vulnerability Overview When the Seafile client daemon checks the remote head commit, it parses the head commit ID from the server response and copies it into the destination buffer at a fixed length 40 bytes; Seafile commit IDs are 40...

Seafile server-controlled sync path can escape the client worktree (macOS/Linux)

Seafile server-controlled sync path can escape the client worktree macOS/Linux Vulnerability Overview The Seafile client's sync module applies file diffs delivered by the server during the checkout phase, and the target path of rename operations is fully controlled by the server. The validity che...

WeKan 6-digit invite codes can be brute-forced to take over invited accounts (InviteBleed)

WeKan 6-Digit Invite Codes Can Be Brute-Forced to Take Over Invited Accounts InviteBleed Vulnerability Overview In WeKan's invitation-based registration flow, invitees complete registration and account creation using a verification code from their email. Before the fix, two flaws compounded: firs...

Portainer Edge Agent endpoints do not validate EdgeStack assignment, allowing unauthorized reads of unassigned stack files and forged status reports

Portainer Edge Agent Endpoint EdgeStack Assignment Authorization Bypass Vulnerability Overview Two categories of Portainer Server endpoints serving Edge Agents -- Edge Stack deployment-file retrieval and deployment status reporting -- resolve the reporting environment from the Edge ID in the...

NocoDB leaks other creators' private integration configuration when includeConfig is omitted

NocoDB Private Integration Configuration Information Disclosure Vulnerability Overview NocoDB's workspace-level Base Integration read service has an authorization logic flaw in its handling of the includeConfig request parameter: the check that "a private integration's configuration is visible on...

WeKan expired impersonation records bypass private board export authorization (ImpersonateBleed)

WeKan Expired Impersonation Records Bypass Private Board Export Authorization ImpersonateBleed Vulnerability Overview WeKan administrators can use the impersonation feature to operate as other users, and the system records every impersonation action. The flaw is this: in addition to the normal...

NocoDB dtxp field DDL constraint injection (CHECK/REFERENCES injection; fixed via strict precision allowlist)

NocoDB Data-Type Precision Field DDL Constraint Injection Vulnerability Overview When generating DDL statements such as table creation and column addition, NocoDB concatenates the user-provided data-type precision field dtxp into the column definition, applying only limited processing without...

WeKan /metrics unconditionally trusts X-Forwarded-For, allowing whitelist IP spoofing (MetricsBleed)

WeKan /metrics Unconditionally Trusts X-Forwarded-For, Allowing Whitelist IP Spoofing MetricsBleed Vulnerability Overview WeKan's Prometheus /metrics endpoint restricts access via an IP whitelist only configured monitoring IPs are allowed. When determining the client's source IP, the code...

WeKan Trello import source.url stored XSS can steal Meteor.loginToken (SourceBleed)

WeKan Trello Import source.url Stored XSS Can Steal Session Tokens SourceBleed Vulnerability Overview When WeKan imports a Trello board, it persists the import source information including the source board's URL and renders it as a clickable link in the board's activity sidebar, without validatin...

Miniflux: cross-user favicon read via icon ID enumeration (horizontal privilege information disclosure)

Miniflux Icon Endpoint Cross-User Unauthorized Favicon Read Vulnerability Overview The Miniflux v2 REST API endpoint that fetches a favicon by icon ID queries solely on the icon's globally unique numeric identifier within the instance, without performing any association check between the icon and...

WeKan Avatar Localization follows redirects, bypassing SSRF protections (RedirectBleed)

WeKan Avatar Localization Follows Redirects, Bypassing SSRF Protections RedirectBleed Vulnerability Overview WeKan allows users to set an external avatar URL in their profile, and the server-side avatar localization feature fetches that URL and caches the avatar as a local attachment. Although SS...

WeKan Trello Live Import attachment download lacks SSRF validation, allowing readable-response SSRF (LiveBleed)

WeKan Trello Live Import Attachment Download Lacks SSRF Validation, Allowing Readable-Response SSRF LiveBleed Vulnerability Overview WeKan supports two ways to import Trello boards: offline import and Live Import online API key mode. Download URLs on the offline import path all go through unified...

WeKan OIDC login callback shares serviceData/profile, enabling concurrent account takeover (regression hardening)

WeKan OIDC Login Callback Shares Login Context, Enabling Concurrent Account Takeover Regression Hardening Vulnerability Overview In WeKan's OIDC OAuth2/OIDC login flow, the per-login identity context objects were once placed in a shared scope outside the login callback, so multiple concurrent OID...

WeKan CAS login shares module-level global user data, enabling concurrent account takeover (CasBleed)

WeKan CAS Login Shares Module-Level Global User Data, Enabling Concurrent Account Takeover CasBleed Vulnerability Overview WeKan's CAS single sign-on implementation contains a concurrent race condition flaw: the user identity data returned by the CAS server after ticket validation is stored in a...

Vaultwarden /events/collect cross-organization event injection

Vaultwarden /events/collect Cross-Organization Event Injection Vulnerability Overview The Bitwarden protocol's event-reporting endpoint POST /events/collect receives user operation events submitted by clients entry viewing, password-field copying, editing, etc., and the server writes them into...

Vaultwarden unconditionally trusts the X-Real-IP header, enabling rate-limit bypass and audit IP spoofing

Vaultwarden Unconditional Trust in the X-Real-IP Request Header Leading to Rate-Limit Bypass and Audit IP Spoofing Overview Vaultwarden supports reading the client IP from a configurable HTTP request header IPHEADER, default X-Real-IP for rate limiting of login/2FA and the admin panel, as well as...

GStreamer DTLS plugin openssl_verify_callback stack buffer overflow on certificate subject DN causes remote denial of service

GStreamer DTLS Plugin Stack Buffer Overflow in Certificate Subject DN Handling Causes Remote Denial of Service CVE-2026-59692 Vulnerability Overview In the GStreamer DTLS plugin the dtls element of gst-plugins-bad, used for the DTLS channel in WebRTC pipelines, the peer certificate verification...

VMware Workstation/Fusion NAT vulnerability: a guest VM admin can disrupt or intercept other guest VMs' network connections

VMware Workstation/Fusion NAT Network Packet Management Flaw Allows a Guest VM to Disrupt or Intercept Other Guest VMs' Network Connections CVE-2026-22715 Vulnerability Overview VMware Workstation and Fusion contain a logic flaw CWE-923, communication channel not correctly restricted to intended...

Vaultwarden icon endpoint SSRF via IP-literal hrefs

Vaultwarden icon Endpoint Server-Side Request Forgery SSRF Vulnerability Overview Vaultwarden's built-in icon service ICONSERVICE=internal automatically fetches, on the server side, the web pages and icon resources pointed to by vault entry URIs in order to display favicons for entries. The...

Apache Superset CTAS tmp_table_name SQL injection bypasses the allow_dml restriction

Apache Superset CTAS tmptablename SQL Injection Bypasses the allowdml Database Security Restriction ZAI-2026-IIRAQ1 Vulnerability Overview In Apache Superset's SQL Lab "save query result as table" CTAS/CVAS feature, the tmptablename parameter used to specify the target table name is neither...

Joomla com_installer update list stored XSS (description/detailsurl unescaped)

Joomla cominstaller Update List Stored XSS CVE-2026-48952 Vulnerability Overview The extension update list in the Joomla CMS administrative backend the update view of cominstaller renders the description and detailsurl fields of extension update information without HTML escaping, constituting a...

GStreamer librfb: rfb_decoder_fill_rectangle() wrong write granularity causes heap out-of-bounds write

GStreamer librfb: rfbdecoderfillrectangle wrong write granularity causes heap out-of-bounds write Vulnerability Overview In rfbsrc the VNC/RFB client element of GStreamer gst-plugins-bad, rfbdecoderfillrectangle fills rectangles by writing pixels at guint32 4-byte granularity regardless of the...

GStreamer webrtcbin: inverted SDP fingerprint presence check enables remote SDP authentication-binding bypass

GStreamer webrtcbin: inverted SDP fingerprint presence check enables remote SDP authentication-binding bypass Vulnerability Overview While validating a remote SDP in the set-remote-description path, GStreamer webrtcbin's checksdpcrypto inverts the presence check for a=fingerprint attributes: an S...

Linux kernel MRP: vector attribute parsing errors break applicant state handling

Linux kernel MRP: vector attribute parsing errors break applicant state handling Vulnerability Overview The Linux kernel MRP IEEE 802.1 Multiple Registration Protocol PDU parser mishandles zero-length vector attributes, event counts and attribute-value advancement in mrppduparsevecattr, breaking...

Linux kernel 6LoWPAN: off-by-one in multicast context address compression leaks a stack byte

Linux kernel 6LoWPAN: off-by-one in multicast context address compression leaks a stack byte Vulnerability Overview The Linux kernel 6LoWPAN IPHC multicast context address compression path contains an off-by-one error and uses a wrong memcpy offset, corrupting the RIID field of compressed multica...

FTP parser: recoverable RETR error escalated to APP_LAYER_ERROR disables FTP application-layer inspection on the same flow

FTP parser: recoverable RETR error escalated to APPLAYERERROR disables FTP application-layer inspection on the same flow Vulnerability Overview Suricata's FTP application-layer parser escalates a protocol-recoverable command-ordering error — a client sending RETR/STOR before negotiating a data po...

WebKit single-bug RCE: crafted web content yields AAR/AAW/PC-hijack in content process

Summary A memory-corruption vulnerability in Apple's WebKit engine is reachable from maliciously crafted web content. Apple's public advisory understates the impact as an "unexpected process crash" and notes it was addressed with improved memory handling. In practice the bug is a single-shot remo...

SMTP MIME message/rfc822: encapsulation parser state not reset, bypassing attachment filename and decoded-content inspection

SMTP MIME message/rfc822: encapsulation parser state not reset, bypassing attachment filename and decoded-content inspection Vulnerability Overview Suricata's SMTP MIME parser incompletely resets state when processing message/rfc822 encapsulated messages: after entering the inner message, the...

Linux kernel 9p: oldfid erroneously released in p9_client_walk() error path

In the Linux kernel, the following vulnerability has been resolved: 9p: avoid putting oldfid in p9clientwalk error path When p9clientwalk is called with clone set to false, fid aliases oldfid. If the walk subsequently fails after the request has been sent, the error path jumps to clunkfid, which...

Linux kernel garp: unsigned integer underflow in garp_pdu_parse_attr

In the Linux kernel, the following vulnerability has been resolved: net: garp: fix unsigned integer underflow in garppduparseattr The receive-side GARP attribute parser computes dlen with reversed operands: dlen = sizeofga - ga-len; ga-len is the on-wire attribute length and includes the GARP...

Linux kernel 6lowpan: NHC entry use-after-free on error path

In the Linux kernel, the following vulnerability has been resolved: 6lowpan: fix NHC entry use-after-free on error path lowpannhcdouncompression looks up an NHC descriptor while holding lowpannhclock. If the descriptor has no uncompress callback, the error path drops the lock before printing...

Suricata datasets: non-string value_key in JSON/NDJSON dataset enrichment causes null-pointer dereference denial of service

Suricata datasets: non-string valuekey in JSON/NDJSON dataset enrichment causes null-pointer dereference denial of service Vulnerability Overview Suricata supports loading external datasets in JSON/NDJSON format and using dataset records to enrich traffic e.g., enriching IP addresses, domains, an...

Linux kernel FDDI: short frames parsed before header length validation cause out-of-bounds read

Linux kernel FDDI: short frames parsed before header length validation cause out-of-bounds read Vulnerability Overview The Linux kernel FDDI receive path parses FDDI/LLC/SNAP header fields before verifying that the skb contains enough bytes, so malformed short frames can trigger an out-of-bounds...

[FreeBSD] thr_kill2 permission check bypass: cross-UID signal delivery

Summary thrkill2 does not check pcansignal return value before tdksignal, allowing cross-UID signal delivery by local unprivileged users. Fixed in commit bf1e2c07. CVE-2026-45256, FreeBSD-SA-26:25.thr...