CVE-2026-66798

Microsoft Edge (Chromium-based) is affected by a Use After Free vulnerability that allows an unauthorized attacker to execute code over a network . The CVSS 3.1 base score is 4.3 (MEDIUM) , with an attack vector of network, low complexity, no privileges required, but user interaction required . N...

CVE-2026-66324

CVE-2026-66324 is a spoofing vulnerability in Microsoft Edge (Chromium-based) caused by external control of a file name or path . An unauthorized network-based attacker with low complexity and no prior privileges , but requiring user interaction , can exploit this to perform spoofing. The CVSS 3....

CVE-2026-66323

Microsoft Edge (Chromium-based) is affected by an improper neutralization of parameter/argument delimiters vulnerability that allows an unauthorized attacker to achieve remote code execution over a network. The CVSS v3.1 score is 5.4 (Medium) , reflecting a network attack vector with low complexi...

CVE-2026-62904

CVE-2026-62904 is an information disclosure vulnerability in Microsoft Edge (Chromium-based) caused by incorrect authorization , allowing an unauthorized attacker to disclose information over a network. The CVSS 3.1 score is 5.4 (Medium) with a vector of AV:N/AC:L/PR:N/UI:R, meaning exploitation ...

CVE-2026-58616

CVE-2026-58616 is a race condition (improper synchronization of a shared resource) in Copilot Chat within Microsoft Edge , rated CVSS 4.4 (Medium) . An authorized attacker with low privileges can trigger a network-based information disclosure , requiring user interaction and exhibiting changed sc...

CVE-2026-70331

CVE-2026-70331 affects Microsoft Edge for iOS and involves an improper neutralization of input used for LLM prompting , allowing an unauthorized attacker to perform spoofing over a network . The vulnerability requires user interaction and no prior privileges , with low attack complexity over the ...

CVE-2026-55566

Yamcs , a mission control framework, is affected by a DOM XSS in the /ext URL route (affected versions prior to 5.12.8 and 5.13.2 ). The root cause is that attacker-controlled data in files extension.matcher.ts, extension.component.ts, and app.component.ts is rendered via innerHTML without valida...

CVE-2026-55565

Yamcs (mission control framework) is vulnerable to authenticated remote code execution in LikeExpression.fillCode_getValueReturn, where an unescaped StreamSQL LIKE pattern is injected into Java source compiled at runtime by Janino (SimpleCompiler.cook). A " in the pattern breaks out of the genera...

CVE-2026-55559

CVE-2026-55559 is a Critical (CVSS 9.8) remote code execution vulnerability in Yamcs (mission control framework) prior to versions 5.12.8 and 5.13.2 . The root cause is that templateArgs submitted via POST /api/instances or PATCH /api/instances/{instance} are appended into the rendered YAML confi...

CVE-2026-55552

Yamcs is a mission control framework affected by an unauthenticated directory traversal in StaticFileHandler.locateFile (yamcs-core). The method resolves request paths without calling Path.normalize and Path.toAbsolutePath to verify the result stays within the configured staticRoots, allowing tra...

CVE-2026-55549

Yamcs , an open-source mission control framework, is vulnerable to reflected cross-site scripting (XSS) in the redirect_uri parameter of the GET /auth/authorize endpoint. The parameter is reflected into authorize.html without adequate HTML escaping by AuthHandler.java and HandlerContext.java , al...

CVE-2026-55547

CVE-2026-55547 affects Yamcs , a mission control framework, in versions prior to 5.12.8 and 5.13.2 . The root cause is missing SystemPrivilege.ControlAccess authorization checks in three IAM API endpoints (GET /api/roles, GET /api/roles/{name}, GET /api/privileges) within IamApi.java. Any authent...

CVE-2026-55545

CVE-2026-55545 is an authorization bypass in Yamcs , a mission control framework, affecting versions prior to 5.12.8 and 5.13.2 . Three WebSocket subscription handlers fail to enforce the privilege checks their REST counterparts require: PacketsApi.subscribePackets omits the ReadPacket check, Pro...

CVE-2026-55521

Yamcs , a mission control framework, contains multiple missing function-level access control vulnerabilities in its Core API. Prior to 5.12.8 and 5.13.2 , authorization checks are omitted in IndexesApi.listPacketIndex, IndexesApi.listEventIndex, Cop1Api.disable/resume/initialize/updateConfig, and...

CVE-2026-77939

Flextype CMS through v1.0.0-dev is affected by an expression language injection in its Symfony ExpressionLanguage engine , reachable via the POST /api/v1/query endpoint. Unsanitized, user-supplied input is passed to the engine, exposing application objects such as filesystem() and serializers() w...

CVE-2026-55511

Yamcs is a mission control framework. In versions prior to 5.12.8 and 5.13.2 , an authenticated user holding the SystemPrivilege.ControlArchiving privilege can inject arbitrary Java into the StreamSQL aggregate expression compiler by crafting a malicious double-quoted column name. The column name...

CVE-2026-55068

free5GC (open-source 5G core network) version 4.2.2 and earlier is vulnerable to NF Registration Poisoning in the NRF component. The RegisterNFInstance handler (PUT /nnrf-nfm/v1/nf-instances/{nfInstanceID}) accepts NF profile bodies without enforcing 3GPP TS 29.510 constraints for UUID format, nf...

CVE-2026-55067

Vikunja , an open-source self-hosted task management platform, is affected by a cross-tenant mass-assignment flaw prior to 2.4.0 . In pkg/models/kanban.go, the Bucket.Update function writes the request body's project_view_id without validating the destination view; the permission check only confi...

CVE-2026-55066

Vikunja (open-source self-hosted task management) has a cross-tenant IDOR in the kanban move-task endpoint. The task_id field is attacker-controlled via the request body, yet TaskBucket.CanUpdate only authorizes the project/view/bucket from the URL — never the task itself. Because Task.ReadOne pe...

CVE-2026-55065

Vikunja (open-source self-hosted task management platform) versions 0.24.6 through 2.4.0 are affected by an authorization bypass in ProjectView.Delete. The permission check (CanDelete) verifies admin status for the URL-supplied project but never confirms the view actually belongs to that project....

CVE-2026-55064

Vikunja (open-source self-hosted task management platform) versions 2.3.0 through 2.4.0 contain an incomplete fix for CVE-2026-35595. The authorization checks in pkg/models/project_permissions.go and pkg/models/project.go only gate reparent operations when parent_project_id > 0, but UpdateProj...

CVE-2026-54766

Vikunja , an open-source self-hosted task management platform, has an authorization bypass in its project duplication endpoint (PUT /api/v1/projects/{project}/duplicate). The flaw in ProjectDuplicate.CanCreate (pkg/models/project_duplicate.go) calls parent.CanCreate on an unhydrated Project struc...

CVE-2026-54788

dd-trace-rs (Datadog APM for Rust), versions 0.1.0 through 0.3.3, is affected by an unbounded W3C tracestate parsing flaw in datadog-opentelemetry/src/propagation/tracecontext.rs. The parser collects every semicolon-separated key:value pair in the Datadog dd=... vendor entry into a HashMap withou...

CVE-2026-55834

Pocket ID (an OIDC provider for passkey-based authentication), versions 2.6.0 through 2.9.0 , contains an open redirect in its OIDC /authorize page. When a request uses prompt=none and silent authorization cannot complete, the SvelteKit frontend constructs a callback URL directly from the raw red...

CVE-2026-55569

aqua (aquaproj/aqua), a declarative command-line version manager written in Go, contains a symlink traversal flaw in pkg/unarchive/archives.go (HandleFile). The handler calls os.Symlink with an unvalidated LinkTarget and does not jail the target to the extraction destination. A subsequent regular...

CVE-2026-82343

A flaw in GIMP's file-psd plugin fails to properly validate the channel-count parameter when processing a specially crafted PSD file, resulting in a heap out-of-bounds read and a stack out-of-bounds access . The impact is an application crash leading to denial of service or limited information di...

CVE-2026-54755

Klever-Go (the Go implementation of the Klever blockchain) contains a uint32 integer overflow in split-royalty validation. Per-entry royalty percentages are decoded without an upper bound, and the validation sum wraps to zero when two crafted values (e.g., 0x80000000 each) overflow uint32, passin...

CVE-2026-54754

Klever-Go (the Go node for the Klever blockchain) has a time-of-check/time-of-use flaw in marketplace settlement (core/kapp/market/market.go). The referral percentage is snapshotted at listing, but the royalty percentage is read live at purchase. An asset owner can raise the royalty via UpdateRoy...

CVE-2026-82306

StarRocks through 4.0.13 contains an information disclosure vulnerability in the query_detail endpoint, which returns unfiltered query history for all users rather than scoping results to the requesting user. An authenticated attacker with low privileges can thereby retrieve the full SQL text , e...

CVE-2026-82290

Chainlit through version 2.12.0 fails to validate ownership of feedback records in its PUT and DELETE endpoints. The root cause is a missing ownership check, allowing authenticated attackers to delete or modify other users' feedback by supplying arbitrary feedback identifiers. The practical conse...

CVE-2026-82291

HeyForm versions before 3.0.0-rc.8 reflect the request Origin header in CORS responses while simultaneously allowing credentials. This misconfiguration enables attackers to execute authenticated GraphQL queries from a malicious page visited by a logged-in user, granting access to workspaces, proj...

CVE-2026-82289

Gitingest (through 0.3.1 ) has a flaw in its _validate_host function that accepts any hostname with a git. , gitlab. , or github. prefix without verifying membership in a known-hosts list. An attacker can supply a URL with a crafted hostname (e.g., github.evil.com), causing the application to ope...

CVE-2026-82287

Rybbit before 2.7.0 contains a CORS misconfiguration in its server that reflects any request origin in the Access-Control-Allow-Origin response header while credentials remain enabled. This allows an attacker on any website to issue credentialed cross-origin requests against a victim's session, r...

CVE-2026-82288

Stable Diffusion WebUI through version 1.10.1 is affected by a credential disclosure vulnerability in the /sdapi/v1/cmd-flags API endpoint. The endpoint returns parsed command-line arguments—including gradio_auth and api_auth values—in cleartext, allowing unauthenticated network attackers to retr...

CVE-2026-82286

gpt-crawler through version 1.5.1 (BuilderIO) is vulnerable to an arbitrary file write via the outputFileName parameter in the POST /crawl endpoint. The root cause is a failure to validate this parameter, allowing unauthenticated attackers to supply absolute paths or parent-directory segments and...

CVE-2026-82285

BISHENG (by dataelement ) through version 2.6.0-fix2 is affected by an unauthenticated Server-Side Request Forgery (SSRF) in the POST /api/v1/workflow/report/callback endpoint. The endpoint lacks authentication and applies no URL scheme restrictions or host filtering , allowing unauthenticated at...

CVE-2026-82284

Quivr versions through 0.0.322 contain a missing ownership validation flaw in three chat API endpoints: GET /chat/{chat_id}/history, DELETE /chat/{chat_id}, and POST /chat/{chat_id}/question/answer. An authenticated attacker can leverage this to read other users' conversation histories (including...

CVE-2026-82283

VoltAgent through 2.1.20 contains an authorization flaw in its memory API handlers , which fail to validate conversation ownership . An authenticated attacker can supply caller-controlled identifiers to memory endpoints to read, modify, or delete conversations and messages belonging to other user...

CVE-2026-82282

Atlantis (through version 0.47.1 ) contains an authentication bypass in the /github-app/setup endpoint. The endpoint fails to require authentication, allowing unauthenticated callers to observe or intercept the GitHub redirect during app setup and extract the RSA private key and webhook secret . ...

CVE-2026-82281

Kotaemon (by Cinnamon) through 0.12.0 is affected by a missing ownership validation in the select_conv , delete_conv , rename_conv , and on_set_public_conversation functions within libs/ktem/ktem/pages/chat/control.py. An unauthenticated attacker with no privileges required can supply arbitrary c...

CVE-2026-82280

Quivr through 0.0.322 fails to validate ownership in its prompt endpoints, allowing any authenticated user to modify prompts by identifier. An attacker with only read-only access to a shared brain can discover exposed prompt identifiers and overwrite system prompts , affecting all users of that b...

CVE-2026-82279

HyperDX through version 1.10.1 fails to enforce role-based access control on team management endpoints, allowing any authenticated team member (low privileges) to perform administrative actions. Specifically, requests to PATCH /team/apiKey , PATCH /team/name , and DELETE /team/member can be used ...

CVE-2026-82278

BISHENG versions before 2.6.0 contain an authenticated remote code execution vulnerability in the POST /api/v1/workflow/run_once endpoint. Crafted Code node definitions submitted by authenticated users are executed via exec() without sandboxing , granting access to the filesystem, credentials, an...

CVE-2026-82277

Argo Rollouts dashboard through 1.10.0 binds to all network interfaces and exposes mutating Rollout operations without authentication, authorization, or CSRF protection . Attackers on the same network can invoke PromoteRollout, AbortRollout, RestartRollout, SetRolloutImage, UndoRollout, and Retry...

CVE-2026-82276

StarRocks through 4.0.13 contains an authentication bypass in the Frontend (FE) where five REST handler classes override execute() directly instead of implementing executeWithoutPassword(), thereby bypassing the base class authentication gate. As a result, six unauthenticated endpoints on the fro...

CVE-2026-82275

Qwen-Agent through 0.0.34 contains a path traversal vulnerability in its document parser (in simple_doc_parser.py and utils.py) that fails to restrict file access to intended directories. Because the Gradio interface is unauthenticated, an attacker can supply absolute file paths to read arbitrary...

CVE-2026-82274

Twenty through version 2.35.0 contains an open redirect vulnerability in the OAuthPropagatorController.propagateOAuthCallback endpoint. The root cause is that the state query parameter is treated as a redirect URL, allowing attackers to craft malicious requests that redirect users to arbitrary ho...

CVE-2026-82273

Mastra through 1.63.0 contains an authentication bypass in the memory API thread ownership validation. When the mapUserToResourceId callback is omitted from configuration, the ownership check becomes a no-op, allowing any authenticated user to enumerate all threads via GET /api/memory/threads and...

CVE-2026-82271

R2R (SciPhi-AI) versions through 3.6.5 fail to properly validate user ownership in conversation update and message handlers. An authenticated user can supply arbitrary conversation identifiers to rename other users' conversations and append messages to their histories, corrupting state and inject...

CVE-2026-82272

Immich versions up to 3.1.0 contain a visibility enforcement flaw: when an asset is locked via the single-asset endpoint , the lock is not correctly applied to shared albums and shared links , allowing a low-privileged attacker to read the asset and its metadata without bypassing any other protec...