CVE-2026-87954

CVE-2026-87954 affects the Taxonomy Term Glossary Drupal contrib module, which adds automatic highlighting of taxonomy terms in content. The module fails to sufficiently check access on taxonomy terms exposed via its JSON endpoint , allowing anonymous users to view any of the site's taxonomy term...

CVE-2026-71805

LZ-litchi 1.0.0 is affected by an arbitrary file upload and path traversal vulnerability. Unauthenticated remote attackers can leverage the directory parameter in the POST /app-api/infra/file/upload endpoint to write uploaded files outside the intended storage directory. The vulnerability is rate...

CVE-2026-71801

CVE-2026-71801 affects s-pms SPMS-Server through v1.0 . The root cause is a hardcoded default access token secret embedded in the core configuration file that is neither overridden nor removed in the production environment profile. This allows a remote, unauthenticated attacker to locally forge v...

CVE-2026-87945

CVE-2026-87945 affects the miniorange_saml Drupal module, which configures a site as a SAML 2.0 Service Provider for external identity provider authentication. The vulnerability is an open redirect : the module does not sufficiently validate certain user-supplied URLs before performing redirects....

CVE-2026-87948

CVE-2026-87948 affects the SAML SSO – Service Provider Drupal contrib module, which allows a Drupal site to act as a SAML 2.0 Service Provider for external identity-provider authentication. The vulnerability stems from insufficient sanitization of user-supplied data before it is rendered into gen...

CVE-2025-51619

CVE-2025-51619 affects the Thesycon DPC Latency Checker driver (dpc.sys ) versions through 1.4.0 on Windows. The root cause is an unvalidated pointer dereference in the driver's IOCTL interface (0x81772008 ): a user-supplied pointer is dereferenced and the resulting value is passed to ExSetTimerR...

CVE-2026-61909

Cyrus IMAP versions before 3.12.4 are affected by a per-href ACL bypass in the CalDAV/CardDAV multiget functionality. An authenticated DAV user with some shared access to another user's calendar or address book can read unshared events or contacts by including the target hrefs in a calendar-multi...

CVE-2026-79323

Magefan Blog GraphQL for Magento 2 (magefan/module-blog-graph-ql through 2.2.1) contains an information disclosure in the blogComments GraphQL query. A remote unauthenticated attacker can send a POST request to /graphql to obtain blog commenter email addresses and internal customer/admin identifi...

CVE-2026-87943

CVE-2026-87943 affects the Drupal contrib module miniorange_saml (SAML SSO – Service Provider), which allows a Drupal site to act as a SAML 2.0 Service Provider for external identity-provider authentication. The module fails to correctly restrict access to certain functionality intended for admin...

CVE-2026-87937

CVE-2026-87937 affects the Drupal CAS Server contrib module, which turns a Drupal installation into a Central Authentication System (CAS) Server for SSO environments. The root cause is that the module does not sufficiently validate the service URL used to redirect users during logout , resulting ...

CVE-2026-87936

CVE-2026-87936 affects the Drupal contrib module amazee.ai Private AI Provider (SA-CONTRIB-2026-134), rated Critical by the Drupal security team. The vulnerability is an SQL injection in the module's Postgres/pgvector vector database backend used with Search API AI Search : filter values are not ...

CVE-2026-87949

CVE-2026-87949 affects the SAML SSO – Service Provider Drupal module (DRUPAL-CONTRIB-2026-147), which allows a Drupal site to act as a SAML 2.0 Service Provider for external identity-provider authentication. The root cause is insufficient sanitization of certain values derived from SAML assertion...

CVE-2026-52482

CVE-2026-52482 affects the SJRC F11 / SJ-GPS-PRO consumer drone (firmware build 2019-09-17, running Linux 3.0.8 on a Fullhan FH8856 ARM SoC). The root cause is the inetd service spawning /app/sh_for_telnet , which exposes an unauthenticated root shell over Telnet (port 23) . A remote attacker con...

CVE-2026-61910

Cyrus IMAP versions before 3.12.4 are affected by an issue in the Mailbox/set command that allows an authenticated user holding the maySetKeywords permission on a shared mailbox to modify its specialuse annotation . This could reassign the mailbox to an archived, snoozed, or other special role, p...

CVE-2026-87947

CVE-2026-87947 affects the Drupal SAML SSO – Service Provider module, which allows a Drupal site to act as a SAML 2.0 Service Provider for authentication via an external identity provider (IdP). The root cause is that the module does not properly restrict which signature algorithm may be used to ...

CVE-2026-61911

Cyrus IMAP before 3.12.4 is affected by a Sieve mailbox existence oracle . An authenticated user can install a Sieve script that probes whether another user's private mailbox exists, or read the value of shared mailbox annotations , by observing which fileinto branch fires during LMTP delivery. T...

CVE-2026-71614

CVE-2026-71614 affects GPAC , an open-source media framework, at commit c2dee3aff638cd96f9617ac5b17dc2868cd90ef3. The vulnerability resides in the src/media_tools/dvb_mpe.c file, specifically in the descriptorTime_slice_fec_identifier() and gf_m2ts_ipdatagram_reader() functions, which handle DVB ...

CVE-2026-87944

SAML SSO (Service Provider) is a Drupal contrib module that configures a Drupal site as a SAML 2.0 Service Provider for user authentication via an external identity provider. The module does not properly validate TLS certificates when making outbound HTTPS requests. An attacker in a position to i...

CVE-2026-87946

CVE-2026-87946 affects the SAML SSO – Service Provider Drupal module, which enables a Drupal site to act as a SAML 2.0 Service Provider for external identity-provider authentication. The vulnerability stems from weak cryptographic practices : the module performs signature comparisons using non-co...

CVE-2026-87938

CVE-2026-87938 affects the CSP Log Drupal contrib module, which provides a reporting endpoint, custom storage, and aggregated reports for Content Security Policy headers. The vulnerability is a SQL injection caused by insufficient sanitization of user-supplied values used in database queries. It ...

CVE-2026-75308

yshopmall versions up to and including 3.3 contain a Cross-Site Scripting (XSS) vulnerability in the file upload endpoint /api/upload . The endpoint lacks file type validation , allowing attackers to upload files of arbitrary types, including HTML, JSP, and other executable files . This can enabl...

CVE-2026-75307

zhitan-ems 1.0.0 is vulnerable to Cross-Site Scripting (XSS) via SVG file upload through the /equipmentFile/upload endpoint. The vulnerability is scored CVSS 3.1: 6.1 (Medium) with a changed scope, indicating that successful exploitation may allow an attacker to execute script in a different secu...

CVE-2026-84388

CVE-2026-84388 affects the FortiPAM Chrome extension , used for Privileged Access Management by over 1 million users. The vulnerability allowed any website to (1) set the browser's proxy for the user's session and (2) create a new tab whose screen recording could be sent to an attacker's server. ...

CVE-2026-71802

A stored XSS vulnerability exists in the announcement preview component of REBUILD 4.4.3 . Although announcement content is HTML-escaped on the server side, client-side preview code reverses the escaped entities using jQuery's html().text() method and injects the result into the DOM. An administr...

CVE-2026-79522

GPAC v26.07.0 contains an out-of-bounds read in the gf_dm_get_chunk_data function (src/utils/downloader.c), which can be triggered by sending a crafted HTTP request, leading to a Denial of Service . The CVSS 3.1 score is 6.5 (Medium) , with a network attack vector, low complexity, no privileges r...

CVE-2026-38998

LIVE555 Streaming Media (version 2026.02.26) is affected by a use-after-free in the SocketDescriptor::tcpReadHandler1 function located in liveMedia/RTPInterface.cpp. An attacker can trigger a Denial of Service by sending a series of crafted RTSP and HTTP requests to the server. No specific patch ...

CVE-2026-39020

Wings3D v.2.4.1 is vulnerable to a denial of service when a local attacker supplies a crafted Wavefront OBJ file for processing. The CVSS 3.1 score is 5.5 (MEDIUM) , with local attack vector, low complexity, no privileges required, and user interaction required, impacting only availability. The v...

CVE-2026-71807

RuoYi-Cloud-Plus versions up to 2.6.2 are affected in the ruoyi-workflow module. The root cause is that multiple core task APIs in FlwTaskController lack permission annotations, and the Service layer does not verify whether the current user is the task handler or related user. Authenticated low-p...

CVE-2026-79516

CVE-2026-79516 is an out-of-bounds read in the stbsp_vsnprintf function (stb_sprintf.h) of the nothings/stb library, as of commit 31c1ad3 . A crafted input can trigger the OOB read, leading to a Denial of Service . The CVSS 3.1 score is 4.0 (MEDIUM) with a local attack vector and high complexity ...

CVE-2026-71809

Siam Ordering (siam-server) 1.0.0 contains an Authentication Bypass via Hardcoded Master Verification Code vulnerability. This allows a remote unauthenticated attacker to log in as any user, merchant, or administrator , effectively granting full access to the application without valid credentials...

CVE-2026-87942

CVE-2026-87942 affects the SafeDelete Drupal contrib module, which manages content deletion and provides reports for identifying orphaned content. The root cause is insufficient sanitization of node titles when displaying the orphaned nodes report, resulting in a persistent cross-site scripting (...

CVE-2026-79322

CVE-2026-79322 is a SQL injection vulnerability in the RelatedProduct block of Mageplaza Blog for Magento 2 (mageplaza/magento-2-blog-extension) through version 4.3.2 . Remote unauthenticated attackers can execute arbitrary SQL commands and read arbitrary database contents by manipulating the id ...

CVE-2026-71613

CVE-2026-71613 is a buffer overflow in GPAC (a multimedia framework), specifically in the j2kdec_process() function (JPEG 2000 decoder). The vulnerability is present in commit c2dee3aff638cd96f9617ac5b17dc2868cd90ef3 and allows an attacker to execute arbitrary code via a local attack vector requi...

CVE-2026-79324

A missing authorization flaw in the Address Delete controller of the Mageplaza GDPR extension for Magento 2 (mageplaza/module-gdpr) through version 4.2.9 allows a remote, unauthenticated attacker to delete any customer's saved address via a simple GET request to /customer/address/delete/id/{id}. ...

CVE-2026-71612

A buffer overflow in the nhntdmx_process() function of GPAC (introduced in commit c2dee3aff638cd96f9617ac5b17dc2868cd90ef3) allows an attacker to execute arbitrary code . The vulnerability is fixed in commit fac50e6a12ac27ffabdd5d3080b51afcc44ad8d6, available at the GPAC repository . No specific ...

CVE-2026-71808

CVE-2026-71808 is a SQL Injection vulnerability in Siam Ordering (siam-server) 1.0.0 . The root cause is the use of ${} string concatenation in MyBatis Mapper files—specifically AdminMapper.java , MerchantWithdrawRecordMapper.java , and MemberWithdrawRecordMapper.java —which allows remote authent...

CVE-2026-87952

CVE-2026-87952 affects the SAML SSO – Service Provider Drupal contrib module, which allows a Drupal site to act as a SAML 2.0 Service Provider. The module does not sufficiently prevent reuse of previously accepted SAML assertions : under certain circumstances, a valid assertion can be replayed wi...

CVE-2026-87955

CVE-2026-87955 affects the Ultimate Table Field Drupal contrib module, which stores table data in a field and allows editing cells through a dialog. The module does not sufficiently protect the route that opens the cell editor dialog, making it accessible to anonymous users who can open the dialo...

CVE-2026-87950

CVE-2026-87950 affects the SAML SSO – Service Provider Drupal contrib module, which allows a Drupal site to act as a SAML 2.0 Service Provider for external identity provider authentication. The vulnerability stems from embedded credentials within the module that, under certain circumstances, coul...

CVE-2026-87940

CVE-2026-87940 affects a Drupal contrib module that enables key-based authentication on a per-user basis. The module does not cache authentication keys per user, which can allow an attacker with the same permissions as another user to view that user's authentication keys, resulting in an access b...

CVE-2026-87951

CVE-2026-87951 affects the SAML SSO – Service Provider Drupal contrib module, which configures a Drupal site as a SAML 2.0 Service Provider for authentication via an external identity provider. The module stores sensitive authentication information in a manner that could allow disclosure to users...

CVE-2026-87941

CVE-2026-87941 is a reserved CVE that, per the connected Drupal advisory SA-CONTRIB-2026-139 , is associated with the Patreon Drupal module. The advisory classifies the issue as Critical and marks the module as unsupported , indicating the maintainer has not fixed the known security issue. No spe...

CVE-2026-79515

CVE-2026-79515 is an out-of-bounds read in the stbtt_GetGlyphShape component of the nothings/stb library (commit 31c1ad3). A crafted TTF file can trigger the read, leading to a Denial of Service . The CVSS 3.1 score is 4.3 (MEDIUM) with a network attack vector, low complexity, no required privile...

CVE-2026-79387

CVE-2026-79387 is an SQL injection (CWE-89) in PbootCMS versions 3.2.0 through 3.2.5, located in the mod() method of UserController.php and modUser() in UserModel.php. The field and value GET parameters are concatenated directly into a SQL UPDATE statement without sanitization or parameterized qu...

CVE-2026-19201

Google go-attestation versions up to and including 0.6.1 contain an uncontrolled recursion vulnerability in its Windows SIPA event log parser . The (*WinEvents).readELAMAggregation function recurses for every nested elamAggregation sub-event without enforcing a maximum depth limit, while the size...

CVE-2026-53939

OpenIDC/cjose is a C library implementing JOSE. In versions 0.6.1 through 0.6.2.5 , when encrypting a JWE using an AES-CBC-HMAC content-encryption algorithm (A128CBC-HS256, A192CBC-HS384, or A256CBC-HS512) with any key-management algorithm that generates a fresh CEK, the CEK is all zero bytes ins...

CVE-2026-53938

OpenIDC/cjose , a C library implementing JOSE, is affected by a heap buffer overflow in its JWE decryption path for the AES Key Wrap algorithms (A128KW, A192KW, A256KW) prior to version 0.6.2.5 . The root cause is a missing length validation of the attacker-supplied encrypted_key before unwrappin...

CVE-2026-53937

CVE-2026-53937 affects the MCP Kotlin SDK (versions 0.7.0–0.12.0 ). The root cause is an unbounded kotlinx.io.Buffer in ReadBuffer.append, which grows indefinitely when the stdio transport receives a byte stream without a terminating newline. The issue is amplified by StdioServerTransport and Std...

CVE-2026-87065

CVE-2026-87065 affects konflux-operator-tasks , where Tekton task steps execute with root privileges without sufficient defense-in-depth hardening. The lack of restricted capabilities, disabled privilege escalation, and other security controls could allow an attacker to escalate privileges or per...

CVE-2026-87064

konflux-operator-tasks contains a flaw where GitHub workflows do not explicitly define their required permissions. This oversight allows workflows to inherit default access tokens that grant broader privileges than intended. Excessive permissions could potentially allow an attacker to gain unauth...