CVE-2026-55864

CVE-2026-55864 affects GeoNetwork , a geospatial metadata management platform. The root cause is a single missing annotation that leaves critical GeoNetwork infrastructure exposed. According to PT Security research, affected deployments span 39 countries , with 89% belonging to government, milita...

CVE-2026-51760

TOTOLINK T6 routers running firmware 4.1.5cu.748_B20211015 contain an incorrect access control flaw in the informSyncUpgfw function, mediated through the cs_broker MQTT component. An unauthenticated network attacker can send a crafted MQTT message to mass-trigger firmware update activity across a...

CVE-2026-51956

Grashjs Atlas CMMS prior to v1.6.0 is affected by a Broken Object Level Authorization (BOLA) vulnerability in the /company/{id} endpoint. The application does not enforce tenant-level ownership checks when accessing or updating company objects, allowing any authenticated user to read and modify a...

CVE-2026-51761

An incorrect access control flaw in the updateLanIp function of the TOTOLINK T6 router (version 4.1.5cu.748_B20211015) allows unauthenticated attackers to refresh the LAN address state by sending a crafted MQTT message to the cs_broker component. The CVSS 3.1 score is 5.3 (Medium) with Low integr...

CVE-2026-51750

TOTOLINK T6 (firmware 4.1.5cu.748_B20211015) contains an incorrect access control flaw in the updatePriChannel function, accessible via the cs_broker MQTT component. An unauthenticated network attacker can send a crafted MQTT message to rescan and switch the primary mesh channel , disrupting wire...

CVE-2026-51768

CVE-2026-51768 is an incorrect access control vulnerability in the setElinkQosConfig function of the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015). An unauthenticated attacker with network access can send a crafted MQTT message to the cs_broker component to modify the privileged QoS policy ...

CVE-2026-51764

An incorrect access control flaw in the recvSlaveCloudCheckStatus function of the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015 ) allows an unauthenticated remote attacker to overwrite cloud-result tracking files by sending a crafted MQTT message to the cs_broker component. The CVSS 3.1 scor...

CVE-2026-52132

llama.cpp through commit 97f06e9 is vulnerable to a remote denial of service when started with the --reranking flag. A negative top_n value in a POST request to the /rerank endpoint triggers a std::bad_alloc exception, resulting in an HTTP 500 and service disruption. The vulnerability requires no...

CVE-2026-52131

llama.cpp versions b5693 and earlier are affected by a Reachable Assertion in the gguf_reader::read function. The vulnerability is rated CVSS 3.1 7.5 (High) with a network-based attack vector requiring no privileges or user interaction, leading to high confidentiality impact but no integrity or a...

CVE-2026-51751

CVE-2026-51751 is a critical (CVSS 9.8) incorrect access control vulnerability in the delSlaveDevice function of TOTOLINK T6 (firmware 4.1.5cu.748_B20211015). An unauthenticated network attacker can send a crafted MQTT message to the cs_broker component to remove a specified slave device from loc...

CVE-2026-51754

CVE-2026-51754 is an incorrect access control vulnerability in the updateSlaveIpList function of the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015 ). Unauthenticated attackers can overwrite the slave IP inventory state by sending a crafted MQTT message to the cs_broker component. The CVSS 3....

CVE-2026-52022

Kamailio v.6.1.1 and before contains a vulnerability in its IMS P-CSCF registration handling components that allows a remote, unauthenticated attacker to trigger a denial of service over the network (CVSS 3.1: 7.5 HIGH ). The vulnerability requires no user interaction and results in high availabi...

CVE-2026-52023

Kamailio v.6.1.1 and earlier is vulnerable to a remote denial of service in the ims_registrar_pcscf module, specifically in the pcscf_save_pending/save_pending path and the security-agreement parsing function parse_sec_agree() in sec_agree.c. The vulnerability is exploitable over the network with...

CVE-2026-51756

An incorrect access control flaw in the meshSlaveUpgfw function of the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015 ) allows an unauthenticated attacker to initiate firmware flashing using existing upgrade files by sending a crafted MQTT message to the cs_broker component. The CVSS 3.1 scor...

CVE-2026-83524

A command injection vulnerability affects the System Clock component of RedPort Optimizer wXa-203 , wXa-213 , and wXa-223 (up to version 20260704). The flaw resides in the exec function of /xgatev1/system/datetime.php, allowing a remote attacker with low privileges to inject commands without user...

CVE-2026-82971

A command injection vulnerability in QVidium Opera11 3.3.2a26-Ax4x-opera11 affects the CGI script /cgi-bin/net_tr.cgi , where manipulation of the ipaddr argument allows remote, unauthenticated attackers to execute arbitrary commands. The vulnerability is rated CVSS 10.0 (Critical) with low attack...

CVE-2026-82957

CVE-2026-82957 is a server-side request forgery (SSRF) in hyperledger-firefly up to version 1.4.0. The flaw resides in the ValidateOptions function within internal/events/webhooks/webhooks.go of the Webhook Subscription component. Manipulating the url argument allows a remote, unauthenticated att...

CVE-2026-82954

CVE-2026-82954 is a remote path traversal vulnerability in Dokploy (up to version 0.29.7), specifically in the writeTraefikConfigInPath function within the file packages/server/src/utils/traefik/application.ts of the Settings component. Manipulation of the path argument allows an attacker with lo...

CVE-2026-82398

pypdf , a pure-Python PDF library, is vulnerable to excessive resource consumption in the read_until_whitespace function within pypdf/_utils.py. When processing a crafted PDF containing a long sequence of non-whitespace bytes, the function performs immutable bytes concatenation in a one-byte loop...

CVE-2026-82922

ShopEx ECShop versions up to 2.5.1 are affected by a remote SQL injection in the function flow_update_cart within the file /flow.php?step=update_cart. The vulnerability is triggered by manipulating the rec_id argument, allowing an unauthenticated attacker to inject SQL over the network with no us...

CVE-2026-82397

Tornado (Python web framework / async networking library), prior to 6.5.8 , parses application/x-www-form-urlencoded request bodies via urllib.parse.parse_qs in tornado/escape.py without passing max_num_fields. Because RequestHandler._execute parses the body before handler dispatch, an unauthenti...

CVE-2026-82396

Sulu , an open-source PHP CMS built on Symfony, is affected by a stored XSS in MediaStreamController.php prior to versions 2.6.25 and 3.0.8 . The /media/{id}/download/{slug} route honors the inline=1 query parameter for scriptable MIME types (text/html, application/xhtml+xml, text/xml, applicatio...

CVE-2026-77353

Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 5.0.0 , authenticated users could inject arbitrary iCalendar properties and events into their exported .ics feed by embedding raw CRLF sequences in subscription names or notes. The root cause is that the input...

CVE-2026-77352

Wallos (open-source, self-hostable personal subscription tracker) versions 2.0.0 through before 5.0.0 contain an authenticated SSRF via the per-user SMTP notification host. Any authenticated user (no admin rights required) can set their notification SMTP host to an internal or link-local address....

CVE-2026-82395

CVE-2026-82395 is an IDOR (authorization bypass) in Sulu , an open-source PHP CMS built on Symfony. Prior to versions 2.6.25 and 3.0.8 , the media move endpoint (MediaManager::move() in MediaManager.php) derives its permission check from the client-supplied collection rather than the media item's...

CVE-2026-82394

Sulu , an open-source PHP CMS built on Symfony , contains an authorization bypass in its preview-link functionality. Prior to versions 2.6.25 and 3.0.8 , the methods PreviewLinkManager::generate() and PreviewLinkManager::revoke() fail to enforce the VIEW permission on the target resource. An auth...

CVE-2026-77348

Wallos , an open-source self-hostable subscription tracker, ships a second unauthenticated logo-image search endpoint—endpoints/payments/search.php—that was missed when the original httpoxy SSRF fix (CVE-2026-33407) hardened endpoints/logos/search.php. Prior to version 5.0.0 , the endpoint passes...

CVE-2026-82921

ShopEx ECShop up to 2.5.1 is affected by an unrestricted file upload vulnerability in the check_img_type function within admin/pack.php . Manipulating the pack_img argument allows a remote attacker with no privileges and no user interaction to upload arbitrary files. The vulnerability is rated CV...

CVE-2026-77351

Wallos , an open-source self-hosted personal subscription tracker, is vulnerable to SSRF prior to version 5.0.0 . The root cause is that any authenticated user can store an arbitrary SMTP host—including private and cloud-metadata IP addresses—in their personal email notification settings, with no...

CVE-2026-82393

pnpm prior to 10.34.5 and 11.11.0 is vulnerable to a scoped path traversal in a tarball dependency's package.json manifest name. The root cause is in pickPackage.ts (npm-resolver), which rejects slash characters only for unscoped names, allowing a crafted scoped name to reach raw path joins in re...

CVE-2026-82882

Devtron versions through 2.2.0 fail to enforce authorization checks on the GET /orchestrator/api-token/webhook endpoint. Any user with a valid authenticated account can query this endpoint with arbitrary project, environment, and application parameters to retrieve plaintext super-admin JWT tokens...

CVE-2026-82392

pnpm , a JavaScript package manager, is affected by a path traversal vulnerability in its virtual store linker. Prior to 10.34.5 and from 11.0.0 until 11.11.0 , pnpm parses the package name from attacker-controlled pnpm-lock.yaml keys via dp.parse(depPath).name without validation in lockfileToDep...

CVE-2026-82919

A missing authentication vulnerability was identified in cu silicon up to version 0.1.5 , affecting the create_app function in views.py within the edit Endpoint component. A remote attacker with no prior authentication can exploit this flaw, resulting in low impact on confidentiality, integrity, ...

CVE-2026-62993

Smarty is a PHP template engine. In versions prior to 4.5.7 and 5.8.2 , the {fetch} tag (handled in libs/plugins/function.fetch.php and src/FunctionHandler/Fetch.php) validated only the initial remote URL against the trusted_uri allowlist via Security::isTrustedUri(). Because PHP's file_get_conte...

CVE-2026-75594

Kirby , an open-source CMS, is affected by a path traversal vulnerability in its media handler (src/Cms/Media.php, Kirby\Cms\Media::thumb()) and the file::version path (src/Filesystem/Asset.php). On nginx, PHP's built-in server, or Apache with AllowEncodedSlashes enabled, a remote unauthenticated...

CVE-2026-61641

Wallos (open-source personal subscription tracker) versions 4.0.0 through before 4.9.6 contain an OIDC login flaw where an incoming identity is linked to an existing local account by matching the email claim alone, without verifying the IdP's email_verified attribute. When the configured IdP allo...

CVE-2026-75592

Kirby (open-source CMS) contained an incomplete filesystem containment flaw in its media handler prior to 4.9.5 and 5.5.2 . The Dir::realpath() and F::realpath() functions accepted a sibling directory sharing the intended root's string prefix (e.g., /var/www/site2 next to /var/www/site) without e...

CVE-2026-61640

Wallos , an open-source self-hostable personal subscription tracker, is affected by an SSRF vulnerability prior to version 4.9.6. The root cause is in includes/oidc/handle_oidc_callback.php (lines 18–49), where Admin-configured OIDC token_url and user_info_url values are passed directly to curl_i...

CVE-2026-83596

CVE-2026-83596 is a memory corruption vulnerability in WebKitGTK caused by improper handling of the featurelist array in the OpenTypeVerticalData::findFeature function. Processing malicious web content can trigger the flaw, leading to memory corruption with high impact on confidentiality, integri...

CVE-2026-71415

Kirby CMS (versions 5.0.0–5.5.2) contains a flaw in its REST API chunk upload handler (src/Api/Upload.php). The method Kirby\Api\Upload::process() failed to execute the relevant upload authorization preflight before processChunk() persisted chunk data. An authenticated user holding the access.pan...

CVE-2026-82914

kishan0725 Hospital-Management-System 1.0 contains a SQL injection vulnerability in the file /search.php , triggered by manipulation of the Contact argument. The flaw allows a remote, unauthenticated attacker to execute arbitrary SQL queries, resulting in low impact on confidentiality, integrity,...

CVE-2026-61639

Wallos , an open-source self-hostable personal subscription tracker, contains a Zip Slip path traversal in POST /endpoints/db/restore.php prior to version 4.9.6 . The endpoint calls ZipArchive::extractTo() without validating entry names for ../ sequences. An authenticated admin can upload a craft...

CVE-2026-81779

CVE-2026-81779 is a backdoor vulnerability in the Silk Themes Newspapers X WordPress theme, discovered by ashv4ni and reported via Patchstack . It affects versions 1.0.46 through 1.0.48 and is classified as Improper Validation of Specified Quantity in Input , allowing malicious software to be imp...

CVE-2026-61638

CVE-2026-61638 affects Wallos , an open-source, self-hostable personal subscription tracker. Prior to version 4.9.6 , the endpoint POST /endpoints/notifications/testemailnotifications.php accepts smtpaddress and smtpport from the request body with no SSRF validation , allowing PHPMailer to connec...

CVE-2026-81278

WPExperts Post SMTP WordPress plugin is affected by a Missing Authorization (Settings Change) vulnerability in versions 4.0.0 through 4.0.0-beta.1 . The flaw allows low-privileged users to exploit incorrectly configured access control levels, resulting in low integrity and availability impact wit...

CVE-2026-81892

EasyAdmin for Symfony (versions 4.0.0 through 4.29.16 and 5.5.1) contains a security bypass in its custom-action dispatcher. When Action::linkToRoute() or MenuItem::linkToRoute() is used, the executed controller is swapped via the routeName query parameter on the kernel.controller event — after S...

CVE-2026-82346

A potential privilege escalation vulnerability was identified in HP ImageDiags , affecting versions prior to 5.0.0.36 . The root cause is insufficient access controls , which could allow a local attacker with low privileges and active user interaction to escalate to higher system access. The assi...

CVE-2026-81891

elFinder (open-source web file manager) is vulnerable to remote code execution prior to version 2.1.70 . The flaw resides in checkExtractItems() in php/elFinderVolumeDriver.class.php, which calls mimetypeInternalDetect() without passing the result through mimeTypeNormalize(). Because the .phtml, ...

CVE-2026-54600

Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.9.4 , the endpoints/db/import.php endpoint lacks authentication. The only protective guard is a check on the user-table row count: if the count is zero (as in a fresh or unconfigured install ), an unauthenti...

CVE-2026-82229

An unauthenticated Cross Site Scripting (XSS) vulnerability affects the WordPress Social Login and Register plugin in versions 7.8.2 and earlier . The flaw was discovered by Patchstack researcher Ananda Dhakal and carries a CVSS 3.1 score of 7.1 (HIGH) with a vector of AV:N/AC:L/PR:N/UI:R/S:C/C:L...