CVE-2026-97357

The SpaceCom , Space Battery pack with WiFi , and Data module compactplus are vulnerable to an Out-Of-Bounds Write due to missing input validation in the autoprogramming interface . This vulnerability could result in a denial of service for the affected communication device. No specific exploit d...

CVE-2026-128079

The envd tool (versions 0.3.38 to 1.3.5 ) is vulnerable to host file disclosure due to insufficient containment of host-side requirements-file reads in install.python_packages(requirements=...). This vulnerability allows an attacker who can influence build input to cause files outside the build c...

CVE-2026-124679

Apache APISIX versions 3.18.0 through 3.19.0 are vulnerable to an authentication bypass by spoofing vulnerability. The root cause occurs when routes use jwe-decrypt with strict: false and a forward_header distinct from the token header, allowing unauthenticated clients to supply values treated as...

CVE-2026-124716

Apache APISIX versions 1.4.0 through 3.19.0 are impacted by an Incorrect Authorization vulnerability. An authenticated user possessing only one of the required permissions or scopes for a route can successfully access the protected upstream. This allows the user to bypass remaining security requi...

CVE-2026-107398

The Indico event management system is vulnerable to a path traversal vulnerability in versions prior to 3.3.14 . When building an "offline copy" of an event, a malicious event manager can exploit this flaw to retrieve the content of any local file readable by the user running the Indico service o...

CVE-2026-124666

Apache APISIX versions 3.8.0 through 3.19.0 are vulnerable to an authentication bypass by spoofing (CWE-290). The root cause is that during multi-auth processes, if the system falls back from wolf-rbac to another successful authenticator, client-supplied Wolf identity headers may persist in the r...

CVE-2026-124680

Apache APISIX versions 0.9 through 3.19.0 are vulnerable to an Interpretation Conflict leading to Incorrect Authorization . An unauthenticated client can bypass route-level auth plugins by accessing upstream paths when a route without authentication exists on the same upstream, provided the upstr...

CVE-2026-124719

Apache APISIX versions 3.19.0 through 3.19.x are vulnerable to an authentication bypass by spoofing in the openapi-to-mcp component. The vulnerability occurs when a Route's configured headers carry a caller identity while the OpenAPI document declares the same header, allowing a caller to imperso...

CVE-2026-124723

Apache APISIX versions 3.18.0 through 3.19.0 are vulnerable to an Interpretation Conflict leading to Incorrect Authorization . When match_uri_encoded_slash is enabled and skip_mtls_uri_regex is configured, a client without a certificate can bypass mTLS requirements to reach an upstream service. T...

CVE-2026-124726

Apache APISIX versions 3.19.0 before 3.20.0 are vulnerable to a Relative Path Traversal and Unintended Proxy vulnerability. A caller of the MCP endpoint can bypass the OpenAPI document's declared limits to invoke undeclared endpoints using the HTTP method of a declared tool and the credentials ad...

CVE-2026-128078

The GLPI asset and IT management software (versions 9.5.0 until 10.0.27 and 11.0.9) contains an improper access control vulnerability (CWE-284). Authenticated users can access ITIL followups, tasks, or solutions generated from templates because the system fails to perform a read-permission check ...

CVE-2026-128077

The Nuxt web development framework (versions 4.6.0 through 4.6.4 ) is vulnerable to an interpretation conflict where request paths beginning with // are incorrectly parsed as URL hosts. Because Nitro server/middleware and routeRules evaluate the original path while the renderer uses the parsed ho...

CVE-2026-128076

The Nuxt web development framework (versions 3.21.6 to before 4.0.0 and 4.4.6 to 4.6.4) is vulnerable to a path collision issue. The root cause is that the /__nuxt_island path hash uses ohash serialization without escaping quotes in string values or delimiters in object keys. This allows differen...

CVE-2026-128075

The Nuxt web development framework (versions 3.0.0 until 4.6.4 ) contains a vulnerability where non-HTTP errors thrown during server rendering are incorrectly handled. The framework wraps these errors with createError and treats them as intentionally exposed by the application. In production, thi...

CVE-2026-128074

The Nuxt web development framework (versions 4.6.0 to 4.6.3) is vulnerable to a Regular Expression Denial of Service (ReDoS) . The issue stems from a trailing-slash regular expression used in _payload.json URL generation and the experimental early-404 path, which exhibits quadratic complexity whe...

CVE-2026-128072

The Nuxt web development framework contains a vulnerability in the development middleware of @nuxt/webpack-builder (versions 3.0.0 to 4.6.4) and @nuxt/rspack-builder (versions 3.12.2 to 4.6.4). The middleware incorrectly trusts Origin , Referer , or Sec-Fetch-Site headers when the Host header mat...

CVE-2026-123177

A flaw exists in dnf5daemon-server where unauthenticated D-Bus methods pass caller-controlled URL or .rpm path patterns into a root-privileged cmdline package loader . This vulnerability allows a local attacker to disclose privileged content by storing fetched content in a world-readable cache wi...

CVE-2026-128071

The Nuxt web development framework (versions 3.0.0 to 4.6.4), along with @nuxt/nitro-server (3.20.0 to 4.6.4) and @nuxt/vite-server (4.6.0 to 4.6.4), contains a vulnerability where an encoded slash (%2F) in a request path bypasses routeRules . This occurs because the system leaves the slash encod...

CVE-2026-129139

The paicoding platform (commits b8206b9 through 903adce ) is vulnerable to account takeover due to predictable credentials for accounts created via ZSXQ login. The root cause is that the loginByZsxq function derives both the username and password solely from the member's ZSXQ number . An unauthen...

CVE-2026-129140

Versions 1.0.0 through 1.0.3 of paicoding are vulnerable to a stored cross-site scripting (XSS) vulnerability in the image upload functionality. The root cause is located in the ImageServiceImpl.validateStaticImg method, which fails to restrict SVG files . When these files are uploaded and served...

CVE-2026-129141

Versions 1.0.0 through 1.0.3 of paicoding are vulnerable to a Stored Cross-Site Scripting (XSS) flaw. The root cause is that the SeoInjectService component embeds user profile text into an inline JSON-LD script element without proper escaping. This allows an authenticated attacker to inject a clo...

CVE-2026-129142

The paicoding platform (commits 766c48b through 903adce) is vulnerable to a Stored Cross-Site Scripting (XSS) flaw within the payment notifications system. The root cause is that NotifyMsgListener inserts a payer's display name without proper escaping, which is subsequently rendered in notify-sys...

CVE-2026-129143

The paicoding 1.0.3 software contains a missing authorization vulnerability in the ArticleRestController article detail endpoint. This flaw allows unauthenticated attackers to bypass access controls and read restricted content by enumerating article IDs via the GET /article/api/data/detail/{artic...

CVE-2026-129144

The paicoding 1.0.3 software contains a payment bypass vulnerability in the /article/api/pay/callback endpoint. Authenticated attackers can unlock paid articles by exploiting weak payment confirmation codes. The root cause is a small space of random values (CWE-334) in IdUtil.genPayCode , allowin...

CVE-2026-129151

SurveyKing version 1.13.2 is vulnerable to an unauthenticated survey response disclosure due to a missing authorization flaw in the result lookup functionality. The anonymous survey view leaks the lookup configuration, including the password, and fails to enforce a password check when no answer i...

CVE-2026-129152

SurveyKing versions 1.12.0 through 1.13.2 are vulnerable to an authentication bypass via the saveAnswer response submission. The root cause is located in the AnswerServiceImpl.saveAnswer method, which fails to perform mandatory login and survey password checks. This allows unauthenticated attacke...

CVE-2026-129153

SurveyKing versions 1.12.0 through 1.13.2 are vulnerable to an authorization bypass within the linked survey feature. The application fails to verify if the referenced linkSurveyId belongs to the caller's project. Consequently, an authenticated attacker can point a linked option at another user's...

CVE-2026-129155

DjangoBlog versions 2.0.0.0 through 2.1.0.0 are vulnerable to a Stored Cross-Site Scripting (XSS) vulnerability. The root cause is that the class_filter comment sanitizer fails to strip event-handler attributes from span, div, pre, and code tags. This allows authenticated commenters to post malic...

CVE-2026-129154

SurveyKing versions 1.13.0 through 1.13.2 are vulnerable to a stored cross-site scripting (XSS) vulnerability. The issue arises because the server accepts a respondent-supplied survey snapshot , which the frontend subsequently renders using innerHTML . This allows anonymous respondents to submit ...

CVE-2026-129156

The DjangoBlog application (commits d186b1c through 6134ed6 ) is vulnerable to a Stored Cross-Site Scripting (XSS) flaw within the comment reactions feature. The root cause is an unescaped nickname used by authenticated OAuth users. An attacker can set their OAuth display name to a malicious payl...

CVE-2026-129157

The software ragent versions 1.0.0 through 1.1.0 contains a missing authorization vulnerability in the RagTraceController component. This flaw allows any authenticated user to access and view RAG traces belonging to other users. By navigating the /rag/traces/runs and related node endpoints, an at...

CVE-2026-129158

The ragent 1.1.0 application contains a stored cross-site scripting (XSS) vulnerability. Authenticated users can inject malicious scripts by uploading SVG files as knowledge-base documents via the /knowledge-base/{kb-id}/docs/upload endpoint. Because the application serves these files inline as i...

CVE-2026-129160

The Dromara free-fs software (versions 2.0.1 through 2.3.1 ) is vulnerable to an SQL Injection within the FileShareServiceImpl.getPages method. The application passes the orderBy parameter from the /apis/share/pages endpoint directly into a MyBatis-Flex ORDER BY clause without utilizing a column ...

CVE-2026-129161

Dromara free-fs versions 2.0.1 through 2.3.1 are vulnerable to an improper restriction of authentication attempts (CWE-307). An unauthenticated attacker can exploit this by requesting a six-digit password reset code via PUT /apis/user/forget-password for a known email address. Due to the lack of ...

CVE-2026-129162

Dromara free-fs versions 2.0.1 through 2.3.1 contain a missing authentication vulnerability in the FileStreamController.preview component. This flaw allows unauthenticated attackers to download any user's or workspace's stored files by requesting the /api/file/stream/preview/{fileId} endpoint. To...

CVE-2026-129163

The software Dromara free-fs (versions 2.0.1 through 2.3.1 ) is vulnerable to a stored cross-site scripting (XSS) flaw in the file preview endpoint. The issue occurs because the application allows registered users to upload HTML files that are served inline as text/html. An attacker can provide a...

CVE-2026-129164

Dromara free-fs versions 2.0.1 through 2.3.1 are vulnerable to an authorization bypass because share codes are only enforced on the client-side. Attackers who possess a share ID can directly call the share items and download endpoints to list and download files without providing the required code...

CVE-2026-129165

Tactical RMM versions 0.17.0 through 1.6.1 are vulnerable to an arbitrary file read via the /reporting/templates/preview/ endpoint. The root cause is that the WeasyPrint library resolves file:// links within user-supplied template_md inputs and embeds the content into the generated PDF. This allo...

CVE-2026-129166

Keep versions 0.34.10 through 0.55.0 are vulnerable to a blind SQL injection in the CEL-to-SQL converter . The root cause is the insertion of unescaped bracket-indexed JSON keys from CEL filters into JSON path expressions for SQLite, PostgreSQL, and MySQL . Authenticated users with read:alert per...

CVE-2026-129167

The SeaDoc converter (versions 2.0.4 before 2.0.11 and 3.0.0 before 3.0.8) is vulnerable to an absolute path traversal vulnerability. This flaw allows unauthenticated attackers possessing a public share token to achieve Remote Code Execution (RCE) . By supplying an absolute filename to the /api/v...

CVE-2026-129168

PMail versions 2.9.1 through 2.9.8 are vulnerable to a stored cross-site scripting (XSS) flaw. The issue resides in the /attachments/{id}/{cid} endpoint, which returns email attachments verbatim using the sender-supplied Content-Type after rewriting cid: references into links. This allows unauthe...

CVE-2026-129169

PMail versions 2.5.0 through 2.9.8 are vulnerable to a stored cross-site scripting (XSS) vulnerability via the /api/email/send endpoint. The root cause is the processing of unsanitized HTML in the email body, which allows authenticated users to inject malicious scripts. These scripts can execute ...

CVE-2026-129171

The NginxPulse monitoring tool (versions prior to 1.6.26 ) is vulnerable to an unauthenticated SQL injection via the /api/stats/:type endpoint. The root cause is the improper handling of the id and locationType parameters, which allows remote attackers to append SQL commands. Impact includes the ...

CVE-2026-129170

FileCodeBox versions 2.2.1 through 2.8.4 are vulnerable to a stored cross-site scripting (XSS) vulnerability within the renderMarkdownPreview function. The root cause is an improper handling of errors where the markdown parser throws an exception, causing the application to return unsanitized tex...

CVE-2026-129172

EdgeEver versions 1.9.0 before 2.13.0 are vulnerable to a stored cross-site scripting (XSS) flaw in the backup restore endpoint PUT /api/v1/restores/json/resources/:id. The root cause is a failure to verify consistency when the application accepts a resource kind identified as an image paired wit...

CVE-2026-128070

The Nuxt web development framework (versions 3.5.0 through 4.6.4 ) contains a vulnerability where the development server may incorrectly identify a parent directory as the default workspaceDir . This occurs if a stray parent lockfile exists outside a Git repository, or if a parent pnpm or Deno se...

CVE-2026-128069

The rails-html-sanitizer gem is vulnerable to Cross-Site Scripting (XSS) in versions prior to 1.7.2 . The root cause is a race condition where the HTML4 and HTML5 variants of Rails::HTML::SafeListSanitizer reuse a single Rails::HTML::PermitScrubber across calls without proper synchronization. In ...

CVE-2026-128068

The rails-html-sanitizer library (versions 1.0.3 through 1.7.1) is vulnerable to a Regular Expression Denial of Service (ReDoS) . The root cause lies in the Rails::HTML::PermitScrubber component, where a pattern used to check SVG href and xlink:href local references causes all-whitespace values t...

CVE-2026-123965

The Jet Admin Cloud Platform is affected by a prompt injection vulnerability across all versions. This flaw allows a remote attacker possessing a free account to expose sensitive .env configuration files and exfiltrate critical credentials. The vulnerability was mitigated via a sandbox component ...

CVE-2026-124041

The Catalis/Patriot Properties WebPro 5.0 software is vulnerable to an SQL Injection vulnerability (CWE-89). This flaw allows a remote unauthenticated attacker to execute arbitrary SQL queries against the underlying MSSQL database . The primary impact is the potential exfiltration of sensitive pr...