CVE-2026-94414

jshERP through 3.6 is missing an authorization check on the POST /userBusiness/updateBtnStr endpoint. Authenticated users can supply arbitrary roleId and btnStr parameters to overwrite button-permission configurations for any role in the tenant without privilege validation, leading to low integri...

CVE-2026-94413

jshERP through 3.6 fails to redact password hashes in the /user/info endpoint. Authenticated users can retrieve unsalted MD5 password digests for any user by supplying arbitrary user IDs. The disclosed hashes are suitable for offline cracking or direct authentication bypass , enabling privilege e...

CVE-2026-94412

jshERP through 3.6 contains an authorization bypass vulnerability in the POST /user/resetPwd endpoint (UserController.java). An authenticated attacker can submit a request with an arbitrary target user ID, resetting that account's password to a known default value and enabling unauthorized access...

CVE-2026-94411

jshERP 3.6 contains a privilege escalation vulnerability in the updateOneValueByKeyIdAndType endpoint (located in UserBusinessController.java). An authenticated low-privilege tenant user can send a POST request with type=UserRole, their own user ID, and an arbitrary role ID list to grant themselv...

CVE-2026-82163

Dell Command | Intel vPro Out of Band , versions prior to 4.7.2 , contains an Incorrect Default Permissions vulnerability. A low-privileged attacker with local access can exploit this to achieve Information Disclosure . The CVSS 3.1 base score is 5.5 (MEDIUM) with a local attack vector, low compl...

CVE-2026-66280

This CVE ID has been rejected or withdrawn by its CNA and does not represent an active vulnerability entry.

CVE-2026-61745

InvenTree , an open-source inventory management system, contains a missing authorization flaw in the POST /api/machine/{pk}/restart/ endpoint (src/backend/InvenTree/machine/api.py). The endpoint uses IsAuthenticatedOrReadScope without requiring the ADMIN role that other machine management operati...

CVE-2026-69190

Graylog is an open-source log management platform. In versions 6.3.0 through 6.3.14, 7.0.9, and 7.1.4, the view update API for saved searches and dashboards permits a user with edit permission but without entity ownership to include a shareRequest that grants owner permissions to an arbitrary acc...

CVE-2026-55473

HomeBox , a home inventory and organization system, has a server-side request forgery (SSRF) bypass in its notifier URL validation prior to version 0.26.0 . The default-on BlockBogonNets and BlockCloudMetadata guards in backend/internal/sys/validate/notifier_url.go fail to inspect IPv4 destinatio...

CVE-2026-48826

HomeBox , a home inventory and organization system, contains an authorization flaw in HandleWipeInventory (backend/app/api/handlers/v1/v1_ctrl_actions.go). The endpoint POST /v1/actions/wipe-inventory checks the global ctx.User.IsOwner value instead of the caller's role in the active group, which...

CVE-2026-48974

The home inventory and organization system HomeBox is vulnerable to unauthorized group membership assignment prior to version 0.26.0 . The POST /v1/groups/members endpoint invokes HandleGroupMemberAdd and GroupService.AddMember using a caller-supplied userID without verifying an owner role, invit...

CVE-2026-48975

The HomeBox home inventory system is vulnerable to a cross-tenant IDOR (Insecure Direct Object Reference) issue in versions prior to 0.26.0 . The flaw exists in MaintenanceEntryRepository.Update and MaintenanceEntryRepository.Delete within backend/internal/data/repo/repo_maintenance_entry.go, whe...

CVE-2026-48976

Prior to version 0.26.0 , HomeBox (a home inventory and organization system) is vulnerable to a cross-tenant Insecure Direct Object Reference (IDOR) in the NotifierRepository.Update function located at backend/internal/data/repo/repo_notifier.go. The application fails to verify if the record's us...

CVE-2026-62182

The KubeEdge system is vulnerable to command injection in the ConfigUpdateJob processing logic located in edge/pkg/taskmanager/actions/configupdatejob.go. The root cause is the concatenation of authenticated user-controlled updateFields values into a command string, which is then executed via a s...

CVE-2026-61612

The @aborruso/ckan-mcp-server (npm) component is vulnerable to Server-Side Request Forgery (SSRF) prior to version 0.4.108 . The root cause is a flaw in the validateServerUrl function within src/utils/http.ts, which validates only the hostname string without performing DNS resolution. This allows...

CVE-2026-94488

Telegram Desktop versions prior to 6.9.4 are vulnerable to Cross-Site Scripting (XSS) within the HTML exporter. The root cause is located in the button.text.toUtf8 function in export_output_html.cpp. For exploitation to occur, a victim must actively use the HTML export feature; however, an exploi...

CVE-2026-92382

The usbredir software is susceptible to a heap out-of-bounds write flaw. The root cause occurs when an isochronous OUT stream is initiated with a transfer count of 1, which leaves the stream's single transfer buffer permanently unsubmitted. This condition defeats the bounds check within the usbre...

CVE-2026-93012

The Email::Sender::Transport::Sendmail Perl module (versions before 2.602 ) is vulnerable to arbitrary command execution on Windows systems. The issue resides in the _sendmail_pipe function, where the module concatenates the envelope sender and every recipient into a single command string that is...

CVE-2026-62369

KubeEdge's keadm component contains a path traversal vulnerability in the DecompressTarGz function located in keadm/cmd/keadm/app/cmd/util/common.go. The root cause is the lack of sufficient validation when joining archive entry names to the extraction destination. This specifically affects Windo...

CVE-2026-62370

KubeEdge is vulnerable to an unbounded memory allocation in the pkg/viaduct/pkg/packer component. The Reader.Read function trusts the 32-bit PackageHeader.PayloadLen received through the CloudHub viaduct message-processing path and allocates memory before validating an upper bound. An authenticat...

CVE-2026-62371

KubeEdge versions 1.12.0 through 1.21.2 , 1.22.2 , and 1.23.1 are vulnerable to command injection due to improper neutralization of special elements in the v1alpha2 NodeUpgradeJob handler. The edge/pkg/taskmanager/actions/nodeupgradejob.go component concatenates user-controlled spec.version and s...

CVE-2026-94449

A memory leak exists in the SmallRye Fault Tolerance library , which is utilized by Quarkus for microservice strategies like retries and circuit breakers. The vulnerability is triggered when using the ApplyGuard or ApplyFaultTolerance annotations, as the library fails to release internal tracking...

CVE-2026-63116

The deepstream server (versions 10.1.0 through 10.1.1 ) contains a permission bypass vulnerability. The root cause is the omission of RECORD_ACTION.PATCH_MULTI from the RULES_MAP in src/services/permission/valve/rules-map.ts. When an authenticated user performs a PATCH_MULTI operation with permis...

CVE-2026-59168

The Dasel command-line tool and library (versions 3.0.0 through 3.11.0 ) are vulnerable to an unrecoverable Denial of Service (DoS) due to unbounded recursion in the JSON and XML readers. The decodeValue, decodeObject, and decodeArray functions in parsing/json/json_reader.go, along with parseElem...

CVE-2026-62866

The Dasel command-line tool and library (versions 3.0.0 through 3.11.2 ) are vulnerable to an index-out-of-range panic in the selector/lexer/tokenize.go file. The root cause is located in the parseCurRune function, where a whitespace-skip loop advances the input index to the end of the source (p....

CVE-2026-77561

The Tinyauth authentication server is vulnerable to a denial of service (DoS) attack in versions prior to 5.1.0 . An unauthenticated remote attacker can send POST /api/user/login requests using 257 distinct nonexistent usernames to exhaust the MaxLoginAttemptRecords cap. This triggers a global lo...

CVE-2026-77582

The Tinyauth authentication and authorization server is vulnerable to a user enumeration attack via a timing oracle in versions prior to 5.1.0 . The root cause is located in internal/controller/user_controller.go (loginHandler), internal/middleware/context_middleware.go (basicAuth), and internal/...

CVE-2026-17051

The Intel SEDI IPM (inter-processor mailbox) driver in drivers/ipm/ipm_sedi.c contains an out-of-bounds write vulnerability. The ipm_event_dispose() function reads a peer-written doorbell register and extracts a payload length using IPC_HEADER_GET_LENGTH(), passing it directly to sedi_ipc_read_ms...

CVE-2026-17050

The Zephyr RTOS experimental USB host stack is vulnerable to a double free in the usb_device_heap when handling a malformed or malicious USB peripheral. Specifically, in usbh_device_set_configuration(), a buffer (udev->cfg_desc) is released via k_heap_free() on three specific failure paths, bu...

CVE-2026-77560

The Tinyauth authentication and authorization server (versions

CVE-2026-79920

The Ajenti modular server admin panel (Linux & BSD) is vulnerable to local privilege escalation prior to version 2.2.16 . An authenticated user can call the /api/core/tasks/start endpoint to enqueue tasks like InstallPlugin , UnInstallPlugin , or UpgradeAll from plugins/plugins/tasks.py without t...

CVE-2026-76898

draw.io prior to version 30.3.8 is vulnerable to an unauthenticated SSRF via an IPv6 ULA blocklist bypass in /embed2.js. The root cause is in Utils.sanitizeUrl(), which checks for IPv6 ULA addresses by comparing the literal text prefixes fc00:: and fd00::, but the JDK returns the expanded address...

CVE-2026-63373

draw.io prior to version 30.2.7 contains an OAuth CSRF vulnerability in its callback handler (AbsAuth.java) that skips the stateToken/cookieToken comparison when IS_GAE is false, affecting self-hosted Docker and WAR deployments . An attacker can inject their own authorization code into a victim's...

CVE-2026-63334

draw.io versions prior to 30.2.7 are vulnerable to server-side request forgery (SSRF) when deployed with ENABLE_DRAWIO_PROXY=1. The root cause is a TOCTOU DNS rebinding flaw: Utils.sanitizeUrl() performs one DNS resolution for the private-address check, while ProxyServlet.java performs a second r...

CVE-2026-63416

draw.io (a diagramming and whiteboarding application) is affected by a path traversal vulnerability in ExportProxyServlet.java prior to version 30.2.7 . The servlet uses request.getPathInfo() to build a proxy path and appends it directly to EXPORT_URL without rejecting dot segments or verifying t...

CVE-2026-58504

CVE-2026-58504 is a Stored XSS in draw.io prior to version 30.2.5 , constituting a patch bypass of CVE-2026-46642 . When a victim opens or imports a crafted .drawio file, a pair of sibling cells triggers the vulnerability: an HTML cell keeps the formatted-label path active while an editable=0 pla...

CVE-2026-62987

Fabio (an HTTP/S and TCP router for Consul-managed applications) versions 1.6.6 through 1.7.2 contain an incomplete fix for CVE-2025-48865 . The protectHeaders logic in proxy/http_headers.go covers a hardcoded set of forwarded headers but omits operator-configured ClientIPHeader , TLSHeader , and...

CVE-2026-61674

Fluent Bit (versions 0.11.0 through 5.0.8) contains a remote stack buffer overflow in the out_forward Secure-Forward PONG handler (plugins/out_forward/forward.c, function secure_forward_pong). The server-controlled PONG[2] reason field is copied via memcpy into a fixed 32-byte stack buffer withou...

CVE-2026-84990

ntopng is a web-based network traffic monitoring application. Prior to 6.7.260718 , two REST endpoint scripts (list_available_backups.lua and download_backup.lua) lack an administrator authorization check , allowing any authenticated non-admin user to list and download system-configuration backup...

CVE-2026-83621

ntopng , a web-based network traffic monitoring application, contains a missing authorization check in the REST API endpoint POST /lua/rest/v2/edit/system/edit_blacklist.lua prior to version 6.7.260717 . The endpoint calls lists_utils.editList for any authenticated user without verifying administ...

CVE-2026-82412

ntopng , a web-based network traffic monitoring application, is affected by an OS command injection in its vulnerability-scan REST API prior to version 6.7.260717 . The endpoints add/host/to_scan.lua and exec/host/schedule_vulnerability_scan.lua accept the scan_ports parameter without an administ...

CVE-2026-55563

Feast , an open-source feature store for AI/ML, is vulnerable in versions prior to 0.65.0 through its GitHub Actions workflow (.github/workflows/pr_integration_tests.yml). The workflow uses pull_request_target with the synchronize event and preserves approval labels (ok-to-test, approved, lgtm) a...

CVE-2026-88978

Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows. Prior to 0.106.1 , the WorkerStatus gRPC polling path in pkg/repository/durable_events.go passes caller-supplied durable task, node, and branch identifiers to ListSatisfiedEntries without a tenant filter ....

CVE-2026-84298

Hatchet , a platform for orchestrating background tasks and durable workflows, contains a cross-tenant information disclosure in its V1 DurableTask stream handler prior to version 0.95.3. The root cause is that worker-supplied task_external_id values are stored in the durableInvocations routing m...

CVE-2026-61687

Hatchet , a platform for orchestrating background tasks, AI agents, and durable workflows, contains an unauthenticated OAuth state CSRF / login-CSRF vulnerability in its ValidateOAuthState function (prior to 0.91.1 ). After a successful OAuth callback, the function clears the oauth_state_ session...

CVE-2026-63342

Hatchet , a platform for orchestrating background tasks, AI agents, and durable workflows, is affected by a cross-tenant authorization bypass prior to version 0.91.1 . The GET /api/v1/stable/durable-tasks/{durable-task} endpoint (implemented by listDurableEventLog) fails to require the target ten...

CVE-2026-61681

Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows. Prior to version 0.91.1 , the SNS UnsubscribeConfirmation handler in internal/integrations/ingestors/sns/sns.go calls http.Get() on payload.UnsubscribeURL after VerifyPayload(), even though BuildSignature(...

CVE-2026-85751

Mailu is a mail server distributed as a set of Docker images. In deployments where PROXY_AUTH_WHITELIST was configured but REAL_IP_HEADER was unset (Mailu 2.0 through 2024.06.54; helm-charts prior to 2.7.3), nginx trusted a client-controlled X-Forwarded-By header for proxy authentication. The pro...

CVE-2026-53940

Conda versions prior to 26.5.2 are vulnerable to a path traversal during noarch:python package installation. The function parse_entry_point_def in conda/common/path/python.py accepted an unvalidated entry-point command from a package's info/link.json metadata, which was then interpolated into the...

CVE-2026-77166

CVE-2026-77166 affects the emoji field in a web application's page emoji update endpoint , where improper input validation allows an authenticated user to inject long text and line breaks , breaking the sidebar layout and potentially hiding other items. The vulnerability is rated CVSS 3.0 2.4 (Lo...