CVE-2026-54617

GravitLauncher LaunchServer (open-source Minecraft launcher) is vulnerable to an unauthenticated path traversal in its HTTP file server (FileServerHandler.channelRead0) on port 9274 , which is enabled by default and bound to 0.0.0.0. The root cause is a substring(1) that strips the first characte...

CVE-2026-54524

Frappe HR (HRMS) is an open-source human resources management solution. In versions prior to 16.7.0 , an authenticated user with the HR User role can perform a SQL injection through filters in the Salary Payments Based on Payment Mode report. The root cause lies in salary_payments_based_on_paymen...

CVE-2026-52852

Traccar , an open-source GPS tracking system, is vulnerable to an uncontrolled infinite loop DoS prior to version 6.14.0 . An authenticated user with group-management and report permissions can create a cyclic group-parent hierarchy . The resource class GroupResource permits the cycle, while Attr...

CVE-2026-52851

Traccar , an open source GPS tracking system, contains an authenticated blind SQL injection in the DELETE /api/permissions endpoint. The root cause lies in DatabaseStorage.removePermission(), which concatenates every key from the Permission map into the SQL WHERE clause as a column identifier, wh...

CVE-2026-92992

Dromara mayfly-go (up to 1.11.5 ) contains an authorization flaw in the AI Assistant component (file server/internal/ai/api/ai.go). The whitelist bypass is one-token wide: any compound command containing curl , wget , or sed executes automatically without approval, and that approval is granted by...

CVE-2026-54649

punchin-email is a Cloudflare Email Worker providing two-way role aliases while relaying mail to a private inbox. Prior to 1.5.0 , the handleInbound handler delivers inbound alias mail via message.forward(), which silently drops the Reply-To header intended to route responses through the relay. W...

CVE-2026-54571

ESPAsyncWebServer (an asynchronous HTTP/WebSocket server library for ESP32, ESP8266, RP2040, and RP2350) contains an integer overflow in its multipart/form-data parser (src/WebRequest.cpp). Prior to version 3.11.1, the _boundaryPosition variable is stored as an 8-bit value ; a remote request with...

CVE-2026-49292

Kiwi TCMS prior to 16.0 leaves the unauthenticated /init-db/ endpoint (handled by InitDBView in tcms/core/views.py) reachable after initial database setup. The page proxies requests to manage.py migrate, which is reentrant , so repeated access only reports "No migrations to apply." The advisory s...

CVE-2026-54239

FaustWP (a WordPress plugin within the Faust.js headless WordPress toolkit) contains an authentication bypass prior to version 1.8.11 . The root cause is in WPE\FaustWP\Auth\encrypt() and decrypt() (in plugins/faustwp/includes/auth/functions.php): the 16-byte initialization vector is excluded fro...

CVE-2026-55061

uniget CLI (a universal installer and updater for container tools) contains an argument injection vulnerability in cmd/uniget/hooks.go (line 199). The hooks edit command parses the UNIGET_EDITOR or EDITOR environment variable using strings.Split(editor, " "), passing every space-delimited suffix ...

CVE-2026-55062

CVE-2026-55062 affects uniget , a universal installer and updater for container tools. Prior to 0.27.6 , the hooks edit command in cmd/uniget/hooks.go (lines 135–160) concatenates an unvalidated hook filename with the hooks directory without sanitizing ../ sequences. The resulting path is passed ...

CVE-2026-52727

lxc-ci , the continuous integration and image-build scripts for LXC , shipped Arch Linux images (built from images/archlinux.yaml) that retained a shared pacman local-signing private key in /etc/pacman.d/gnupg. Every container or VM created from those images inherited the same key. An attacker wh...

CVE-2026-54451

Elixir's protobuf Hex package (versions ≥ 0.8.0,

CVE-2026-47252

Anyquery (a Go-based SQL query engine on SQLite) prior to 0.4.5 is vulnerable to AppleScript/JXA code injection in its macOS browser plugins. The chrome_tabs plugin (and equivalent Brave, Edge, and Safari variants) interpolates a SQL-controlled URL directly into AppleScript or JXA source via fmt....

CVE-2026-92927

SourceCodester Drug Recommendation System 1.0 is vulnerable to information disclosure through remote manipulation of the file /db/drug_recommendor.sql . The exact processing affected is described as unknown, but an unauthenticated attacker can exploit it over the network with low complexity to ga...

CVE-2026-89038

Verizon Cloud for Android (com.vcast.mediamanager) versions before 26.7.10 contain a path traversal vulnerability in the exported activities OneTouchUploadActivity and PrintShopCloudActivity . The root cause is unsanitized filename concatenation in the file-staging sink: a co-resident malicious a...

CVE-2026-92926

A SQL injection vulnerability exists in code-projects Matrimonial System 1.0 , specifically in the writepartnerprefs function of /partner_preference.php. Manipulating the education argument allows a remote attacker with no authentication to inject SQL, resulting in low impact on confidentiality, ...

CVE-2026-52836

OpenDDS , an open-source C++ implementation of the OMG Data Distribution Service (DDS), is affected by an out-of-bounds read pointer dereference in RtpsSampleHeader::init() (dds/DCPS/transport/rtps_udp/RtpsSampleHeader.cpp). A network attacker can crash a reachable participant by sending a malfor...

CVE-2026-54676

Scoold , a Q&A and knowledge-sharing platform for teams, is affected by an authorization bypass in ApiController.getPostReplies() (file ApiController.java). Prior to 1.69.0 , the GET /api/posts/{id}/answers endpoint did not call canAccessSpace before returning reply data, allowing users holding a...

CVE-2026-54677

Scoold is a team Q&A and knowledge-sharing platform. Prior to 1.69.0 , the QuestionController.reply() and CommentController.createAjax() methods failed to apply the canAccessSpace authorization check used by the question read path. When scoold.is_default_space_public is set to false and private s...

CVE-2026-54446

netlicensing-mcp (Labs64) is a natural-language MCP server for the NetLicensing licensing API. Prior to 0.1.6 , the ApiKeyMiddleware in server.py fails to reject requests that carry no client API key; the downstream client then falls back to the operator's NETLICENSING_API_KEY environment variabl...

CVE-2026-54053

Many Notes , a Markdown note-taking web application, is vulnerable to path traversal via its ZIP vault import (app/Actions/ProcessImportedVault.php) prior to version 0.16.0 . The import accepts archive filenames containing parent-directory traversal segments, allowing an authenticated user to wri...

CVE-2026-54551

WireGuard Portal (wg-portal) is a web-based configuration portal for managing WireGuard servers. In versions 2.2.0 through 2.3.0 , the authenticated /api/v0/ws statistics WebSocket (implemented in endpoint_websocket.go) subscribes to peer and interface stats topics and forwards every TrafficDelta...

CVE-2026-44235

rabbitmq-c (a C-language AMQP client library) prior to 0.16.0 contains an unsigned size_t underflow in amqp_handle_input() (librabbitmq/amqp_connection.c). A malicious AMQP server can send an undersized HEADER or METHOD frame during client login, causing the computed encoded.len to wrap to 0xffff...

CVE-2026-44236

rabbitmq-c is a C-language AMQP client library for RabbitMQ. Prior to 0.16.0 , a malicious or compromised AMQP server can send an undersized connection.tune.frame_max value (e.g., 1 byte) during the amqp_login() handshake. The library accepts the value in amqp_login_inner() and uses it in amqp_tu...

CVE-2026-54546

CloudTAK (a browser-based situational awareness tool compatible with TAK) is vulnerable to an authenticated full-read SSRF in the PUT /api/basemap endpoint prior to version 13.22.1 . The importBasemapURL() function in api/routes/basemap.ts passes an attacker-controlled URL to fetch() without IP-a...

CVE-2026-54579

mport , the MidnightBSD Package Manager, contained a vulnerability in the ping() function within libmport/ping.c prior to version 2.7.8 . The function accepted ICMP replies without validating icmp_id or icmp_seq and parsed the reply using a fixed IP-header offset instead of the actual ip_hl field...

CVE-2026-54576

mport , the MidnightBSD Package Manager, is affected by a symlink TOCTOU vulnerability in do_actual_install() (file libmport/bundle_read_install_pkg.c) prior to version 2.7.8 . The function used path-based lstat(), chown(), stat(), and chmod() operations during package installation. A local attac...

CVE-2026-54587

mport , the MidnightBSD Package Manager, is vulnerable to symlink and path traversal races in versions prior to 2.7.8 . The flaw resides in libmport/bundle_read_install_pkg.c, where directory assets (ASSET_DIR / ASSET_DIR_OWNER_MODE) used path-based mport_mkdirp(), ownership, and permission opera...

CVE-2026-54575

mport , the MidnightBSD Package Manager, is affected by a TOCTOU filesystem race in its privileged package fetch and cache-cleaning operations prior to version 2.7.8 . The race-prone path handling spans multiple components including libmport/fetch.c, libmport/clean.c, and the mport.create helper....

CVE-2026-85278

Technical details for CVE-2026-85278 are not publicly available in the provided documents. While a related OSV entry mentions security issues fixed in jackson-dataformat-csv-2.18.11-1.1 on openSUSE Tumbleweed, the specific details for this CVE remain unknown. Monitor for updates.

CVE-2026-8674

A assertion failure in the DNS stub resolver of the GNU C Library (glibc) versions 2.26 through 2.44 aborts any process that resolves names through the library. The root cause is that when the search list in /etc/resolv.conf or the LOCALDOMAIN environment variable contains a domain of roughly 200...

CVE-2026-54578

mport , the MidnightBSD Package Manager, contains a flaw in mport_verify_package() (libmport/verify.c) prior to version 2.7.8. After MD5File() or SHA256_File() fails, the function continues and compares an expected checksum against stale data in the hash buffer rather than a newly computed digest...

CVE-2026-54586

CVE-2026-54586 affects mport , the MidnightBSD Package Manager . Prior to version 2.7.8 , the mport_fetch_index(), mport_fetch_bootstrap_index(), and mport_fetch_bundle() paths in libmport/fetch.c accepted non-HTTPS repository and package mirror URLs without a url_is_https() enforcement check. Wh...

CVE-2026-54585

mport , the MidnightBSD Package Manager, is affected by a path-constraint flaw in create_sample_file() within libmport/bundle_read_install_pkg.c. Prior to version 2.7.8 , the function failed to constrain absolute source and destination paths from the sample-file manifest directive to the configur...

CVE-2026-54580

mport , the MidnightBSD Package Manager, is vulnerable prior to version 2.7.8 in its zstd decompression handling. In libmport/util.c , the function mport_decompress_zstd() did not make every truncated, corrupt, or failed zstd stream fatal, and libmport/fetch.c did not consistently propagate those...

CVE-2026-54582

mport is the MidnightBSD package manager. Prior to version 2.7.8 , the package installation path lacked a preflight check for incoming non-directory assets that already existed on disk. Specifically, the logic in libmport/check_preconditions.c, libmport/install_primative.c, and libmport/mport_pri...

CVE-2026-54577

mport , the MidnightBSD Package Manager, contained a bug in its audit command prior to version 2.7.8. The function in mport/mport.c computed option-adjusted local arguments but passed the original argument entry to audit_package(). When an operator or automation used an option such as -r before a...

CVE-2026-54583

mport , the MidnightBSD Package Manager, had an insufficient input-validation flaw in libmport/fetch.c prior to version 2.7.8. The missing is_valid_bundle_filename() checks failed to reject empty, dot, dot-dot, or slash-containing bundle filenames before composing package download and write paths...

CVE-2026-54581

CVE-2026-54581 affects mport , the MidnightBSD Package Manager. The mport_fetch_bootstrap_index() function in libmport/fetch.c (prior to version 2.7.8) could return success when bootstrap index hash verification encountered a missing or invalid hash, because the failure path did not preserve a fa...

CVE-2026-28326

SolarWinds Access Rights Manager (ARM) is affected by an unauthenticated remote code execution vulnerability caused by a hardcoded static key . The CVSS v3.1 score is 8.8 (HIGH) , with an adjacent network attack vector, no required privileges, and no user interaction. Impact is High across confid...

CVE-2026-93296

MISP contains a stored cross-site scripting (XSS) vulnerability in the Overmind theme's statistics views . The event General card (event_general.ctp) and server/feed preview card (preview_general.ctp) constructed donut chart legend labels by directly concatenating object names or category keys in...

CVE-2026-93292

SigNoz versions 0.88.0 through 0.142.0 contain a SQL injection vulnerability in the trace-funnel analytics endpoints. The root cause is the interpolation of service_name and span_name fields into ClickHouse string literals without escaping, as seen in the query builder code. An authenticated atta...

CVE-2026-93295

MISP (Malicious Intelligence Sharing Platform) is vulnerable to remote code execution via its background job dispatch mechanism. User-controlled fields (person and message) from the events/contact endpoint are passed unvalidated into the CakePHP console process argv. An attacker sets person to a ...

CVE-2026-85716

CVE-2026-85716 affects the AsyncHttpClient (AHC) Java library in versions 3.0.8 through 3.0.12 . The functions processScramAuthenticationInfo and processAuthenticationInfo compute the SCRAM ServerSignature or Digest rspauth verification result but, upon a mismatch, only log the discrepancy and st...

CVE-2026-93204

This vulnerability affects the batman-adv module (DAT component) in the Linux kernel . In batadv_dat_entry_add(), a MAC address is updated using a simple copy operation. A concurrent reader may observe only a partially updated MAC address , which can be transported over the network or used to cra...

CVE-2026-93202

CVE-2026-93202 is a deadlock vulnerability in the Linux kernel i3c master driver. The function i3c_master_register_new_i3c_devs() calls device_register() while holding i3c_bus_normaluse_lock() (a read-side rwsem). The resulting device probe callback may invoke I3C helpers that re-acquire the same...

CVE-2026-93203

CVE-2026-93203 is a race condition in the Linux kernel's batman-adv mesh networking module, specifically in the Bridge Loop Avoidance (BLA) subsystem. The function batadv_bla_add_claim() can corrupt the CRC16 of backbone gateway entries when a new claim and a backbone ownership change execute in ...

CVE-2026-93201

CVE-2026-93201 affects the Linux kernel dm-pcache (persistent cache) subsystem. The functions cache_pos_decode(), cache_key_decode(), and the last-kset branches of cache_replay(), the writeback worker, and the GC worker index cache->segments[] using a segment ID read from on-disk metadata with...

CVE-2026-93199

Linux kernel i3c master driver contains a logic flaw in the function i3c_master_search_i3c_dev_duplicate(). The function searches the I3C bus for another device sharing the same PID as a reference device, but can incorrectly match master->this—the I3C controller itself. Since the controller is...