CVE-2026-77520

MaxKB (open-source enterprise AI assistant) in versions 2.10.2-lts and earlier has an authorization flaw in the homepage application question-ranking endpoint. A normal user in the same workspace can extract another user's application_id when the victim's published application has ranking activit...

CVE-2026-77519

MaxKB (an open-source enterprise AI assistant) versions 2.10.2-lts and earlier contain an authentication inconsistency in the /chat/api/mcp endpoint. The MCP authentication path validates ApplicationApiKey using only the secret and active status, omitting the is_permanent and expire_time checks e...

CVE-2026-73511

Envoy (open source edge and service proxy) contains a path-matching/authentication bypass in versions prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1 . The root cause is a mismatch in how per-segment matrix parameters (semicolon-delimited) are handled: Envoy matches the raw request path, while servl...

CVE-2026-73553

CVE-2026-73553 affects Envoy , the open-source edge and service proxy for cloud-native applications. When the route option ignore_path_parameters_in_path_matching is enabled, Envoy's router strips semicolon suffixes before route matching, but the RBAC url_path matcher evaluates the raw path. This...

CVE-2026-73551

Envoy is an open-source edge and service proxy for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1 , its URL normalization does not recognize dot and dotdot path segments carrying semicolon parameters . A request such as /user/..;foo=bar/admin is not canonicalized to /admi...

CVE-2026-94572

In OpenStack Octavia before 18.0.1 , the Amphora provider driver failed to validate the tls_ciphers field on listener and pool objects for control characters. The unvalidated value is written verbatim into the HAProxy configuration generated on the amphora, allowing an authenticated project membe...

CVE-2026-93433

A stack buffer overflow in libstoragemgmt's _sg_parse_vpd_80() function allows a local or virtual storage device controlled by an attacker to supply malformed SCSI VPD page 0x80 data with an untrusted page length field. This can crash or destabilize the process querying the serial number, resulti...

CVE-2026-94571

OpenStack Octavia versions before 18.0.1 are affected when using the Amphora provider driver . The root cause is that the RFC 3986 URL validator percent-encodes control characters before structural validation, allowing newlines to pass checks, yet Octavia writes the raw unencoded value directly i...

CVE-2026-58269

Sync-in Server is an open-source platform for file storage, sharing, collaboration, and syncing. Prior to version 2.4.0 , the POST /api/auth/token endpoint authenticates users with only username and password, then calls getTokens(), which returns full access and refresh JWTs without checking whet...

CVE-2026-73546

Envoy 's /stats?format=html admin endpoint is vulnerable to stored XSS because StatsHtmlRender sanitizes statistic values but emits statistic names without HTML encoding. A data-plane component such as grpc_stats with stats_for_all_methods enabled can embed attacker-controlled path segments into ...

CVE-2026-73512

CVE-2026-73512 is a use-after-free in Envoy Proxy 's HttpDatagramHandler (QUIC/HTTP3 datagram handling). When Capsule Protocol is enabled, the handler caches the current RequestDecoder pointer. During stream recreation—such as an internal redirect —the ActiveStream is replaced and EnvoyQuicServer...

CVE-2026-58271

Sync-in Server , an open-source platform for file storage and collaboration, is vulnerable to TOTP brute-force in versions prior to 2.4.0 . The endpoint POST /api/app/sync/register fails to increment the passwordAttempts counter on TOTP failure due to a freeze branch in updateAccesses(), so the l...

CVE-2026-73550

Envoy (open-source edge/service proxy) is vulnerable to an HTTP/2 memory-exhaustion flaw. When a duplicate Host header is present alongside :authority , Envoy copies the decoded value before discarding it, but the discarded copy bypasses saveHeader and is not charged against request-header size o...

CVE-2026-73547

Envoy 's ext_authz filter contains a null pointer dereference: when an authorization response includes query_parameters_to_set or query_parameters_to_remove, the filter calls request_headers_->Path() to parse the query string. A path-less CONNECT request causes that pointer to be null, and Fil...

CVE-2026-48521

Envoy versions prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1 contain a null pointer dereference (CWE-476) in ProdClusterManagerFactory::allocateConnPool during HTTP/3 connection pool selection. When auto_config and HTTP/3 are enabled, certain LoadBalancerContext implementations used by synthetic, ...

CVE-2026-73549

CVE-2026-73549 is an incomplete fix for CVE-2026-26310 in Envoy (versions prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1). The Utility::copyInternetAddressAndPort and QUIC client-address paths reconstruct scoped IPv6 addresses via addressAsString and Ipv6Instance, producing a string with a percent ...

CVE-2026-73513

CVE-2026-73513 is a heap use-after-free in Envoy's optional oghttp2 upstream HTTP/2 codec. When an untrusted upstream sends a response trailer HEADERS frame without the END_STREAM flag, Envoy completes and deferred-deletes the ActiveRequest while oghttp2 keeps the stream open, leaving a dangling ...

CVE-2026-85219

CVE-2026-85219 is a Denial-of-Service vulnerability in the Redis module of Thinkst Canary's OpenCanary 0.9.9 . An unauthenticated remote attacker can trigger unconstrained memory usage , leading to service degradation. The CVSS 3.1 score is 3.7 (Low) , reflecting a network attack vector with high...

CVE-2026-49811

Dell Command | Monitor (DCM) , versions prior to 10.13.2 , is affected by an Incorrect Permission Assignment for Critical Resource vulnerability. A low-privileged attacker with local access can exploit this flaw to achieve Elevation of Privileges , with a CVSS 3.1 base score of 8.4 (HIGH) (AV:L/A...

CVE-2026-73552

Envoy HTTP RBAC safe_regex matching evaluates header values with RE2's UTF-8 subject semantics , but Envoy accepts RFC-valid obs-text (non-UTF-8) header bytes. In a negative RBAC policy (deny rule), a crafted header containing an obs-text octet causes RE2::FullMatch to return no-match, which the ...

CVE-2026-73548

CVE-2026-73548 affects Envoy (open source edge/service proxy) prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1 . The root cause is that Envoy forwards data for a configured non-WebSocket HTTP upgrade before the upstream accepts it. An unauthenticated HTTP/2 client can smuggle a complete HTTP/1.1 requ...

CVE-2026-50572

Envoy 's HTTP ext_authz client (specifically RawHttpClientImpl::onSuccess) is vulnerable to a use-after-free when a stale request callback is retained after a request is rejected. When the callback owner is destroyed but onSuccess later invokes callbacks_, the proxy process crashes under producti...

CVE-2026-55897

luci-app-advanced-reboot , a LuCI web UI application for OpenWrt, contained a read ACL in applications/luci-app-advanced-reboot/root/usr/share/rpcd/acl.d/luci-app-advanced-reboot.json that granted rpcd file.exec permission for the general shell interpreter /bin/sh . Prior to version 1.1.2-6 , an ...

CVE-2026-81469

Dell Inventory Collector Client versions prior to 15.0.0 are affected by an Unquoted Search Path or Element vulnerability. A low-privileged attacker with local access can exploit this to achieve code execution and elevation of privileges , rated CVSS 7.8 (HIGH) with full impact to confidentiality...

CVE-2026-55159

CVE-2026-55159 affects luci-app-adblock-fast , a WebUI for a DNS-based ad-blocker on OpenWrt (compatible with dnsmasq, smartdns, or unbound). Prior to 1.2.4-2 , the luci.adblock-fast.setCronEntry RPC method fails to sanitize carriage-return or line-feed characters in its entry argument, serializi...

CVE-2026-45381

Tautulli is a Python-based monitoring and tracking tool for Plex Media Server . In versions prior to 2.17.2 , the /search endpoint inserts a user-controlled query parameter into a JavaScript string in data/interfaces/default/search.html using manual escaping that handles quotes and slashes but no...

CVE-2026-49995

Tautulli , a Python-based monitoring and tracking tool for Plex Media Server, contains a stored XSS in the newsletter configuration. Prior to version 2.17.2, the newsletter cron field in the newsletters database table is inserted into a JavaScript string within newsletter_config.html without safe...

CVE-2026-54915

Tautulli , a Python-based monitoring tool for Plex Media Server, contains an open redirect vulnerability in its unauthenticated /auth/redirect endpoint (plexpy/webauth.py). The flaw stems from the endpoint stripping forward slashes from the user-controlled redirect_uri parameter while leaving tab...

CVE-2026-52835

Tautulli , a Python-based monitoring and tracking tool for Plex Media Server, is affected by a path traversal / arbitrary file write vulnerability prior to version 2.17.2 . The flaw exists in the import_config handler and the database_file branch of import_database in plexpy/webserve.py, where an...

CVE-2026-62247

Supabase Realtime (prior to 2.111.2 ) contains an incorrect authorization flaw in its per-extension presence.read row-level security (RLS) policy enforcement. When a private-channel client is granted presence.write but explicitly denied presence.read , the client can still receive presence_diff m...

CVE-2026-91167

Warpgate , an open-source SSH/HTTPS/MySQL bastion host for Linux, has a missing authorization check in the PUT /@warpgate/admin/api/users/:id/roles/:role_id endpoint. The handler api_update_user_role in warpgate-admin/src/api/users.rs routes through AdminContext but does not require AdminPermissi...

CVE-2026-91166

Warpgate is an open-source SSH, HTTPS, and MySQL bastion host for Linux. In versions 0.25.0 through 0.27.6 , the browser SSH path mishandles RCEvent::HostKeyUnknown by passing the final target's host and port to KnownHosts::trust instead of the presenting hop's identity. In Prompt and AutoAccept ...

CVE-2026-91165

Warpgate , an open source SSH/HTTPS/MySQL bastion host for Linux, is affected by a markup injection in its form_post SSO return path (prior to version 0.27.6). The root cause is that serde_json::to_string is used inside ReturnToSsoPostResponse without neutralizing a script-closing sequence, allow...

CVE-2026-91164

Warpgate is an open-source SSH, HTTPS, and MySQL bastion host for Linux. In versions 0.23.0 through 0.27.2 , the HTTP API token authentication flow fails to enforce the owning user's allowed_ip_ranges against the trusted client address, as the token is resolved without that check in warpgate-prot...

CVE-2026-63330

Warpgate, an open source SSH, HTTPS, and MySQL bastion host for Linux, is affected by a missing authorization check prior to version 0.25.6 . The api_get_recording_stream function in warpgate-admin/src/api/recordings_detail.rs protects the recording stream WebSocket endpoint with only session aut...

CVE-2026-63329

Warpgate is an open source SSH, HTTPS, and MySQL bastion host for Linux. Prior to version 0.25.6 , the copy_server_request function in warpgate-protocol-http/src/proxy.rs forwards a client-supplied x-warpgate-username header before the authenticated username is injected via inject_own_headers. Be...

CVE-2026-58491

Warpgate (an open-source SSH, HTTPS, and MySQL bastion host for Linux) prior to 0.25.5 is vulnerable to reflected XSS and open redirect in its SSO return endpoint. The root cause is an attacker-controlled next parameter stored at /@warpgate/api/sso/providers/:name/start and inserted without HTML ...

CVE-2026-61748

InvenTree is an open-source inventory management system. Prior to version 1.4.0 , the ReportPrint and LabelPrint endpoints (POST /api/report/print/ and POST /api/report/label/print/) require authentication but fail to invoke the caller's per-model permission check before selecting objects by prim...

CVE-2026-61746

InvenTree , an open-source inventory management system, is vulnerable prior to 1.4.0 . The PluginSettingList , PluginAllSettingList , and PluginSettingDetail classes use GlobalSettingsPermissions without requiring IsAuthenticated, and since AuthRequiredMiddleware exempts /api/ paths, unauthentica...

CVE-2026-61744

InvenTree , an open-source inventory management system, is affected by an authorization bypass in its barcode-scan API (POST /api/barcode/) prior to 1.4.0 . The endpoint requires only authentication or a general read scope via IsAuthenticatedOrReadScope, and the built-in barcode plugin resolves o...

CVE-2026-61747

InvenTree , an open-source inventory management system, is affected by an authenticated IDOR vulnerability in its data-import API prior to version 1.4.0 . The /api/importer/row/ and /api/importer/mapping/ endpoints fail to scope DataImportRow and DataImportColumnMap querysets to the owner of the ...

CVE-2026-17052

CVE-2026-17052 affects Zephyr RTOS builds with CONFIG_USERSPACE=y and CONFIG_TIMEAWARE_GPIO=y enabled (practically, v3.6.0 through v4.4.0). The syscall verification handler z_vrfy_tgpio_pin_read_ts_ec() in drivers/timeaware_gpio/timeaware_gpio_handlers.c validated the port device object but omitt...

CVE-2026-61749

InvenTree is an open-source inventory management system. In versions prior to 1.4.0 , privileged staff users with the ability to author report or label templates can trigger WeasyPrint report rendering to fetch attacker-controlled resources via HTTP/HTTPS URL schemes or the local file URI scheme....

CVE-2026-94403

ColorFul iGameCenter 1.0.3.4 contains an untrusted pointer dereference in the function sub_140001AF0 within the ene.sys driver's IOCTL Handler component. The vulnerability is exploitable locally with low complexity and low privileges, no user interaction required, and scope is changed, resulting ...

CVE-2026-82165

Dell Command | Integration Suite for System Center , versions prior to 6.7.2 , contains an Incorrect Default Permissions vulnerability. A low-privileged attacker with local access could exploit it to achieve Information Disclosure . The CVSS v3.1 base score is 5.5 (Medium) with a local attack vec...

CVE-2026-49810

Dell Command PowerShell Provider (DCPP) versions prior to 2.10.2 contain an Insertion of Sensitive Information into Log File vulnerability. A low-privileged attacker with local access can exploit this to achieve Information Disclosure . The Dell security advisory (DSA-2026-379) describes the issu...

CVE-2026-94501

jshERP through version 3.6 contains an authorization bypass vulnerability in its userBusiness CRUD endpoints . Authenticated users can create, modify, or delete authorization-relation rows without adequate privilege checks, enabling them to manipulate user-role mappings and access controls. This ...

CVE-2026-94497

jshERP through 3.6 suffers from a broken object-level authorization (IDOR) flaw in its by-id info, update, and delete endpoints across multiple resource types. Authenticated users can read, modify, or delete other users' business objects by submitting direct object identifiers without proper owne...

CVE-2026-94496

jshERP through 3.6 fails to validate caller permissions in its role management endpoints (/role/update and /role/delete), allowing any authenticated user to modify or delete any role 's data scope. An attacker can escalate privileges by changing a role's data visibility to cover all records, gain...

CVE-2026-94495

jshERP through 3.6 is affected by a missing authorization flaw in SystemConfigService.updateSystemConfig , accessible via the systemConfig endpoint. The service fails to properly validate user privileges, allowing any authenticated user to rewrite or delete tenant-wide settings covering company i...