CVE-2026-79913

Cloudreve (self-hosted file management system) has an SSRF guard bypass in the ValidateExternalURL function (pkg/request/ssrf.go) prior to version 4.18.0 . The checkIP validator fails to decode NAT64 , IPv4-compatible , and 6to4 IPv4-in-IPv6 transition address wrappers, causing embedded loopback,...

CVE-2026-95655

Aureus ERP before 1.5.0 contains an IDOR vulnerability in the ChatterPanel Livewire component (Webkul Chatter plugin). Message lookups are not scoped to the current record, allowing any authenticated user to submit sequential message IDs and read, edit, delete, or pin messages belonging to other ...

CVE-2026-95654

Databasement before 1.7.14 is affected by an authorization bypass via stale invitation tokens . The vulnerability resides in the invitation acceptance flow (AcceptInvitation.php), where the system validates the token only when the page loads and caches the authorization decision without re-checki...

CVE-2026-95653

Concrete CMS Community Store versions before 2.7.8 contain a predictable digital download token vulnerability. The root cause is that download tokens are derived from order creation timestamps rather than cryptographically random values (in Download.php). Because order and file identifiers are se...

CVE-2026-80156

Lantronix autonomous out-of-band devices (SLC8000, EMG8500, EMG7500, SLB882, SLCx-03, SLCx-02) are affected by a path traversal vulnerability in the web management portal upload endpoint. The root cause is that the filename validation strips backslash characters but fails to subsequently check fo...

CVE-2026-63374

AnyIO (a Python asynchronous networking framework) is vulnerable to TLS certificate spoofing prior to version 4.14.2 . The functions connect_tcp() and TLSStream.wrap() validate internationalized (non-ASCII) domain names using the Python standard library's IDNA 2003 encoding instead of the more ac...

CVE-2026-80155

Lantronix SLC8000 (before firmware v9.7.0.5 ), EMG8500/EMG7500 (before v9.7.0.1 ), and all firmware versions of SLB882/SLCx-03/SLCx-02 are affected by an unauthenticated authentication bypass in the web management portal upload endpoint. The root cause is a snprintf call with a fixed-size buffer ...

CVE-2026-80154

CVE-2026-80154 affects all firmware versions of Lantronix SLC8000, EMG8500, EMG7500, SLB882, SLCx-03, and SLCx-02 . The vulnerability resides in the web management portal , where session tokens are generated deterministically from the device model and current time at one-second resolution , yield...

CVE-2026-80152

Lantronix SLC8000 (before firmware v9.7.0.3), EMG8500/EMG7500 (before v9.7.0.1), and SLB882/SLCx-03/SLCx-02 (all firmware versions) contain an OS command injection in the set script schedule command, which passes unsanitized user input to a system() call. An authenticated attacker with the servic...

CVE-2026-92706

Dark Reader , a browser extension that darkens web page colors, is vulnerable in its image inversion pipeline prior to version 4.9.126. A website can cause the extension to request an unauthenticated icon-like bitmap from a locally running web server when the resource uses a known public-like HTT...

CVE-2026-80151

Lantronix Autonomous Out-of-Band Devices (SLC8000 before firmware v9.7.0.3, EMG8500/EMG7500 before v9.7.0.1, and all firmware versions of SLB882/SLCx-03/SLCx-02) are affected by an OS command injection in the set nfs download command, which passes unsanitized user input to a system() call. Authen...

CVE-2026-80150

Lantronix autonomous out-of-band devices contain a server-side request forgery (SSRF) in the WebSSH/WebTelnet listener. The custom shellinaboxd process uses the rooturl parameter from the web connection to determine its own IP address; by modifying this parameter, an unauthenticated attacker can ...

CVE-2026-80149

CVE-2026-80149 is a server-side request forgery (SSRF) vulnerability in the WebSSH/WebTelnet listener of Lantronix Autonomous Out-of-Band devices. The affected products are the SLC8000 (before firmware v9.7.0.3), EMG8500/EMG7500 (before firmware v9.7.0.1), and all firmware versions of the SLB882 ...

CVE-2026-80148

Lantronix autonomous out-of-band devices (SLC8000, EMG8500, EMG7500, SLB882) contain a server-side request forgery (SSRF) in the WebSSH/WebTelnet listener . The custom shellinaboxd binary builds the SSH connection target using a snprintf call with user-supplied input; by supplying an overlong use...

CVE-2026-85055

Twenty is an open-source CRM platform. Prior to version 2.22.0 , field-level read permissions are enforced on selected output fields but not on GraphQL or REST filter predicates . A workspace member or API key with object-level read access but denied field-level access can reference the restricte...

CVE-2026-80147

Lantronix SLC8000 (before firmware v9.7.0.2), EMG8500/EMG7500 (before firmware v9.7.0.1), and all firmware versions of SLB882/SLCx-03/SLCx-02 are affected by a stack-based buffer overflow in an undocumented mfc eeprom write command. The command copies unbounded user input into a bounded stack buf...

CVE-2026-80146

Lantronix SLC8000, EMG8500, EMG7500, SLB882, SLCx-03, and SLCx-02 are affected by a stack-based buffer overflow in an undocumented mfc eeprom read command that copies unbounded user input into a bounded stack buffer before passing it to a system() call. An authenticated attacker (any user via the...

CVE-2026-77621

Vector , a high-performance observability data pipeline, is vulnerable to arbitrary file write via its file sink in versions 0.10.0 through 0.57.0 . The file sink renders its output path from a template that accepts event fields; when an untrusted source supplies a field containing an absolute pa...

CVE-2026-80145

Lantronix SLC8000 (before firmware v9.7.0.2 ), EMG8500/EMG7500 (before firmware v9.7.0.1 ), and all firmware versions of SLB882/SLCx-03/SLCx-02 are affected by a command injection vulnerability in the set cifs password CLI command. The root cause is unsanitized user input passed directly to a sys...

CVE-2026-77620

Vector is a high-performance observability data pipeline. In versions 0.15.0 through 0.57.0 , the logstash source feeds each decompressed frame back into its decoder without limiting nested compression depth. An unauthenticated remote peer that can reach the default 0.0.0.0:5044 listener can send...

CVE-2026-80144

Lantronix autonomous out-of-band devices (SLC8000, EMG8500, EMG7500, SLB882, SLCx-03, SLCx-02) are affected by a command injection vulnerability in an undocumented mfc eeprom write CLI command. An authenticated attacker can pass unsanitized input to a system() call, executing arbitrary shell comm...

CVE-2026-80143

Lantronix Autonomous Out-of-Band Devices (SLC8000, EMG8500, EMG7500, SLB882, SLCx-03, SLCx-02) are affected by a command injection vulnerability in the undocumented mfc eeprom read CLI command, which passes unsanitized user input directly to a system() call. Authenticated attackers can exploit th...

CVE-2026-77619

CVE-2026-77619 affects the logstash source in Vector (versions 0.15.0 through 0.57.0). The vulnerability stems from the source reading a 32-bit compressed-frame length from the network and sizing an in-memory buffer without an upper bound . An unauthenticated remote peer reaching the default 0.0....

CVE-2026-81883

radare2 , a UNIX-like reverse engineering framework and command-line toolset, is affected by an out-of-bounds read in its Lua 5.3 bytecode function parser prior to version 6.2.0 . The parser reads fixed function-metadata fields (two integers and three one-byte fields) immediately after a function...

CVE-2026-81885

radare2 prior to 6.2.0 contains a denial-of-service vulnerability in its NE relocation fixup-chain parser . The parser followed fixup chains without an iteration limit or cycle detection, so a crafted NE executable containing an in-bounds relocation entry that points back to itself causes the par...

CVE-2026-81882

The reverse engineering framework radare2 (prior to version 6.2.0 ) is vulnerable to an out-of-bounds read within its binary property-list Unicode parser. The parser fails to guarantee NUL termination and underallocates an uninitialized UTF-8 destination. When a local attacker executes the pFB or...

CVE-2026-81886

radare2 is a UNIX-like reverse engineering framework. Prior to 6.2.0 , its Windows 64-bit crash-dump (dmp64) parser used an input-controlled physical-memory-run PageCount directly as the bound of a per-page allocation loop without validating the count against the actual dump size. Opening a small...

CVE-2026-81884

radare2 is a UNIX-like reverse engineering framework. Prior to 6.2.0 , its Mach-O LC_DATA_IN_CODE parser trusted the dataoff and datasize fields and allowed a final partial record to be processed. When datasize was not a multiple of data_in_code_entry, the last iteration read beyond the allocated...

CVE-2026-81880

radare2 , a UNIX-like reverse engineering framework, is affected by an uncontrolled resource consumption flaw in its Apple Preferred Executable Format (PEF) loader . Prior to 6.2.0 , the loader accepted relocSecCount values not bounded by the actual number of sections or complete relocation recor...

CVE-2026-95806

MISP ships with PHP's phar stream wrapper registered in both its web and console entry points. Since no MISP component, vendored CakePHP framework, or runtime-loaded library actually reads or constructs phar archives, the wrapper serves no legitimate purpose and exists solely as an attacker primi...

CVE-2026-81879

radare2 (a UNIX-like reverse engineering framework) is vulnerable to a heap out-of-bounds read in its ELF parser's PN_XNUM handling prior to version 6.2.0. The root cause is a mismatch: the program-header array is allocated using the resolved PN_XNUM count, but several consumers still iterate usi...

CVE-2026-81878

radare2 , a UNIX-like reverse engineering framework, is affected by an integer overflow in its CPython bytecode .pyc marshal parser prior to version 6.2.0 . The root cause is that the marshal readers accepted a 32-bit string length without rejecting values that overflow the size-plus-one allocati...

CVE-2026-81881

The reverse engineering framework radare2 contains a heap out-of-bounds read vulnerability in its Mach-O Swift field-metadata parser (versions prior to 6.2.0 ). The issue arises because a relative Swift field pointer can be lower than the field-metadata section base, resulting in a negative logic...

CVE-2026-95805

CVE-2026-95805 affects the MISP ACLComponent , where a typo in the access control list caused the previewEventAttributes action to reference the permission string 'theming_enabled*' (with a trailing asterisk) instead of the correct 'theming_enabled'. Since the malformed key matches no valid permi...

CVE-2026-19915

HP Support Assistant versions prior to 9.55.10.0 contain a local privilege escalation vulnerability caused by insufficient access controls . A local attacker with low privileges can exploit this without user interaction to achieve high impact on the system's confidentiality, integrity, and availa...

CVE-2026-95754

CVE-2026-95754 affects MISP 's UsersController::login() method. The pre-authentication database query for the TOTP verification branch omitted the User.disabled column from its SELECT fields, so the disabled-user guard evaluated to null (falsy), allowing a disabled, TOTP-enrolled user to reach th...

CVE-2026-89407

FasterXML jackson-core (versions 2.17.0+) is vulnerable to a ReDoS (Regular Expression Denial of Service) in NumberInput.looksLikeValidNumber(). The PATTERN_FLOAT regex uses adjacent quantifiers over the same character class, causing quadratic backtracking when an input ultimately fails to match....

CVE-2026-95703

MISP is affected in the OrganisationsController::__uploadLogo method, which processes a caller-supplied tmp_name value using filesystem probes (file_exists, MIME type detection, EXIF reading) before verifying the value via is_uploaded_file. An authenticated site-admin user can supply an arbitrary...

CVE-2026-95701

MISP contains a path traversal weakness in the __statisticsOrgs method of UsersController.php, where an attacker-influenced organization name is concatenated directly into a file-system path used by file_exists() to check for a logo image. An authenticated user with the ability to create or renam...

CVE-2026-95698

MISP's OrgImgHelper::findOrgImage method builds a filesystem path by concatenating a user-supplied organization name (settable via event import) with a fixed image directory and extension, then calls file_exists() on the result. Because no validation is performed before path construction, an atta...

CVE-2026-95697

MISP contains an authorization flaw in the Organisation model's captureOrg method . When the $force parameter is set to true, the method unconditionally overwrites organization metadata fields without verifying that the invoking user holds sufficient privileges. An authenticated user with at leas...

CVE-2026-95501

mtrano APENCMS (a template engine component) is affected by a code injection vulnerability in the eval function of the file cms/weasel.php . Manipulating the $_CMS['site'] argument allows a remote attacker to inject and execute code. The attack requires high privileges and user interaction , resu...

CVE-2026-95693

MISP 's EventReport::uploadPicture method processes a caller-supplied tmp_name field by calling file_exists(), mime_content_type(), and exif_imagetype() on the path before validating it with is_uploaded_file(). An authenticated user with the perm_add permission can supply an arbitrary filesystem ...

CVE-2026-94127

F5 BIG-IP APM is affected by a heap-based buffer overflow (CWE-122) that allows an unauthenticated attacker to achieve remote code execution (RCE) . This vulnerability is specific to configurations where both an APM access policy and an OAuth profile are active on a virtual server, specifically w...

CVE-2026-95500

JosephChuks php-file-manager-with-code-editor up to version 3.0 is affected by an unrestricted file upload vulnerability in the Save Handler component. The flaw resides in the file_put_contents function within codeEditor.php, where manipulation of the filename/content argument allows a remote att...

CVE-2026-94570

SGLang is affected by a denial of service (DoS) vulnerability caused by a lack of input validation for AUX_DATA ZeroMQ control messages within the Decode worker . An unauthenticated remote attacker who can reach the Decode control PULL socket can exploit this flaw to terminate the Decode control ...

CVE-2026-95685

MISP contains an access control flaw in the EventReports functionality. The replaceSuggestionInReport action was incorrectly mapped to the wildcard permission ('*') in the ACLComponent, making it accessible to any authenticated user regardless of their assigned permissions. All analogous report-m...

CVE-2026-84388

An improper restriction of rendered UI layers or frames vulnerability in Fortinet FortiPAM Chrome Extension (versions 8.0 and 7.4 , all versions) allows a remote, unauthenticated attacker to achieve information disclosure and compromise the confidentiality and integrity of protected data. Accordi...

CVE-2026-65112

The NVIDIA Infrastructure Controller for Linux is vulnerable to uncontrolled resource consumption , which may lead to a denial of service (DoS). The root cause is identified as CWE-400 . This vulnerability affects versions 0 to 1.9 on the Linux platform. To remediate this issue, users should upda...

CVE-2026-65118

NVIDIA Infrastructure Controller for Linux contains a vulnerability (CVE-2026-65118 ) that allows an attacker to cause improper certificate validation (CWE-295). A successful exploitation of this flaw could result in information disclosure , data tampering , and denial of service . This vulnerabi...