CVE-2026-88879

Traefik (HTTP reverse proxy and load balancer) in v1.x, v2.x through v2.11.55, and v3.0.0 through v3.7.11 canonicalizes header names only on dashes, so X-Auth-User, X_Auth_User, and X.Auth.User are treated as three distinct headers by Traefik. However, backends (CGI, WSGI, PHP, NGINX) collapse th...

CVE-2026-88877

This CRITICAL (CVSS 3.1: 9.8) vulnerability affects Traefik v3.7.0 through v3.7.11, specifically its Kubernetes ingress-nginx provider . When an Ingress carries both an authentication annotation and the from-to-www-redirect annotation, the provider creates a "sibling" router that matches on host ...

CVE-2026-88876

AVideo through revision c3edcc274c389816d434acadac07ee78eaf330c1 contains a missing authorization flaw in plugin/PlayerSkins/seo.php. The getSources() function is invoked without validating the configured password, allowing an unauthenticated attacker to request the seo.php endpoint with a video ...

CVE-2026-88875

AVideo through revision c3edcc274c389816d434acadac07ee78eaf330c1 (master, 2026-08-23) incompletely sanitizes sensitive user fields in the APIName=video response. The function API::get_api_video() calls removeSensitiveUserFields() only when the caller is neither authenticated nor using a valid API...

CVE-2026-88874

AVideo (through revision c3edcc274c389816d434acadac07ee78eaf330c1, 2026-08-23) suffers from an authentication bypass in its live streaming feature. The Live::_getStats() method (plugin/Live/Live.php) exposes the RTMP stream key, isPasswordProtected flag, and HLS (m3u8) URL to unauthenticated call...

CVE-2026-88873

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a Cross-Site Request Forgery vulnerability in view/logArchive.json.php. The endpoint accepts GET requests without CSRF token validation , allowing unauthenticated attackers to craft malicious pages that trigger an admini...

CVE-2026-88871

WWBN AVideo 's CustomizeUser plugin (enabled by default) contains a CSRF vulnerability in the setSubscribers.json.php endpoint, affected through commit c3edcc274c (master, 2026-08-23). The endpoint reads users_id and ExtraSubscribers from $_REQUEST and calls User::setExtraSubscribers() without re...

CVE-2026-88872

AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a cross-site request forgery (CSRF) vulnerability in the setPassword.json.php endpoint due to missing CSRF token validation. An unauthenticated attacker can craft a malicious webpage that, when visited by an authenticated adm...

CVE-2026-88870

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a cross-site request forgery (CSRF) vulnerability in the LoginControl plugin PGP key endpoints. The affected endpoints, including savePublicKey.json.php , lack CSRF token validation and accept requests via GET. An attack...

CVE-2026-88868

AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 is affected by a stored cross-site scripting vulnerability in the LiveLinks plugin . The root cause is that the title and description fields are stored without sanitization. An attacker holding canStream permission can inject maliciou...

CVE-2026-88869

AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 is affected by a stored cross-site scripting (XSS) vulnerability in the AD_Server plugin 's log.php endpoint. The endpoint fails to escape the label parameter before storage, allowing an unauthenticated attacker to inject malicious HT...

CVE-2026-88867

WWBN AVideo (up to commit c3edcc274c389816d434acadac07ee78eaf330c1 ) is affected by a stored cross-site scripting (XSS) vulnerability. The endpoint objects/categoryAddNew.json.php passes the POST parameters name and iconClass into Category::setName() and Category::setIconClass() without sanitizat...

CVE-2026-88866

WWBN AVideo (through commit c3edcc274c389816d434acadac07ee78eaf330c1 ) contains a stored cross-site scripting vulnerability in the LoginControl plugin . The plugin fails to encode the User-Agent header before storing it in the login history. An attacker with any valid login account can inject mal...

CVE-2026-88865

AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate restream ownership in getRestream.json.php . Authenticated users holding the canStream permission can mint tokens for arbitrary restreams, then exchange those tokens to retrieve other users' stream keys from getLiveK...

CVE-2026-88864

Capgo (capgo.app) contains an authentication bypass vulnerability in its SSO provider management. The public.sso_providers table is exposed through Supabase PostgREST without restricting direct write access. A holder of an ordinary full API key can insert a forged row with status='active' and enf...

CVE-2026-88863

capgo.app (npm package capgo) through version 12.207.1 contains a privilege escalation vulnerability in the validateInvite() function within supabase/functions/_backend/private/invite_new_user_to_org.ts. The function fails to compare the caller's role rank against the requested role, allowing an ...

CVE-2026-88862

Capgo (capgo.app) backend through version 12.242.4 contains an authentication bypass in the API key manager via the x-limited-key-id header. The root cause is insufficient parent-child delegation validation in checkKeyByIdPg() within supabase/functions/_backend/utils/hono_middleware.ts. An authen...

CVE-2026-88861

Capgo (Cap-go/capgo.app), a continuous deployment platform, has an authentication bypass in all versions with no patched release available. The root cause is in the Edge authorization path: the JWT middleware (findJWT() in hono_middleware.ts) accepts tokens without validating their assurance leve...

CVE-2026-88860

Capgo , an OTA update platform, is affected by an authorization bypass caused by stale channel permission overrides. When a user's last organization role binding is deleted, Capgo fails to clean up associated channel-level permission overrides, leaving them active. An attacker with a previously r...

CVE-2026-88915

MISP ≤2.5.45 is affected by an authorization bypass in the event template instantiation path. When a template uses distribution = 4 , the template's sharing_group_id was passed directly into event creation without verifying that the acting user is permitted to use that sharing group via SharingGr...

CVE-2026-85543

Hikvision Wi-Fi series IP cameras are affected by insufficient permission validation on certain interfaces. An authenticated low-privileged user can exploit this flaw to obtain the device's Wi-Fi configuration information , representing a confidentiality impact rated CVSS 3.1: 4.3 (MEDIUM) . No i...

CVE-2026-85545

HikCentral Access Control is affected by a broken access control vulnerability in some unspecified versions. Authenticated low-privilege users can invoke API interfaces that their role is not authorized to access, representing an authorization bypass. The vulnerability is exploitable over the net...

CVE-2026-85544

CVE-2026-85544 is an Improper Encryption Configuration vulnerability affecting some Hikvision Intercom Products . The flaw allows an attacker with physical access to forge M1 cards , leading to high confidentiality impact and low integrity impact (CVSS 3.1: 5.2 MEDIUM ). No specific product model...

CVE-2026-9166

CVE-2026-9166 is a Path Traversal vulnerability (local file inclusion) in GIS Informatics GisLab Laboratory Management System , affecting versions 1.4.03 through 1.5 (exclusive) . The flaw is classified as Improper Limitation of a Pathname to a Restricted Directory . The CVSS 3.1 score is 7.5 (HI...

CVE-2026-88038

The cookies Node.js library (used by Koa via ctx.cookies) is vulnerable to Set-Cookie attribute injection (CWE-74) in versions before 0.9.2 . The domain and path options are validated against a permissive RFC 7230 field-content matcher that allows semicolons, while the cookie name and value are c...

CVE-2026-9163

CVE-2026-9163 is a SQL injection vulnerability in GIS Informatics' GisLab Laboratory Management System , caused by improper neutralization of special elements in SQL commands. It affects versions 1.4.03 through before 1.5 , and the fix is available in version 1.5 . The CNA-assigned CVSS 3.1 score...

CVE-2026-9161

CVE-2026-9161 is an observable response discrepancy vulnerability in the DernekPlus Website Template that enables account footprinting (user enumeration). Affected versions are through 10092026 . The CVSS 3.1 score is 5.3 (MEDIUM) with a low confidentiality impact, as an unauthenticated network a...

CVE-2026-17038

DrEryk Gabinet versions prior to 11.5.0 embed hard-coded API credentials within its ticket reporting component. An attacker who discovers these credentials can authenticate directly to the ticket system API, bypassing the application's normal access controls and performing privileged operations s...

CVE-2026-88859

CVE-2026-88859 is a flaw in the Evolution email client where a remote attacker can send a crafted HTML email containing a spoofed vCard control . When the victim clicks it, Evolution's trusted JavaScript handler incorrectly assigns an attacker-controlled JavaScript URL to an iframe's source , res...

CVE-2026-84828

A local privilege escalation and information disclosure flaw in PCS (Pacemaker Configuration System) allows a user with membership in the haclient group to read arbitrary files on the filesystem via the pcs host auth --token command. The pcsd daemon reads file contents with root privileges , and ...

CVE-2026-87962

t-digest versions 3.1 through 3.3 (a Java library for approximate quantile estimation maintained by tdunning on GitHub) contain a denial of service vulnerability in MergingDigest.fromBytes . The root cause is a failure to validate length and capacity fields read from serialized data; a crafted se...

CVE-2026-87961

ESP32-audioI2S versions 3.4.4 through 4.0.0 contain a heap-based out-of-bounds read in the read_ID3_Header function, caused by a shadowed length parameter during ID3 synchronized-lyrics processing. An attacker can craft malicious MP3 files or HTTP audio streams with oversized frame size declarati...

CVE-2026-78085

SP Property is a Joomla extension published by joomshaper.com. A path traversal vulnerability exists in the gallery image management controller, which lacked directory confinement checks, allowing unauthenticated remote attackers to traverse directories. The vulnerability affects versions below 4...

CVE-2026-78302

SP Property (Joomla Extension by joomshaper.com) versions below 4.1.4 are affected by an unauthenticated Stored XSS vulnerability. Multiple template files across frontend views and administrator list tables rendered attributes and text values directly into HTML without contextual escaping , allow...

CVE-2026-78374

T4 Page Builder (by joomlart.com) for Joomla, versions prior to 2.3.0 , is vulnerable to an open mail relay via its front-end JSON editor endpoint. The exposed contact action requires no authentication, no CSRF token, no captcha (when no captcha plugin is enabled), and has no rate limiting. An at...

CVE-2026-78083

The SP Property Joomla extension (by joomshaper.com) contains a missing CSRF token verification vulnerability affecting versions prior to 4.1.4 . Specifically, the visitor booking endpoint (properties.booking ) and the agent contact form submission endpoint (agents.sendmail ) processed POST reque...

CVE-2026-78084

SP Property (a Joomla extension by joomshaper.com) versions below 4.1.4 contain a Missing Access Control vulnerability in the gallery image management controller. The affected controller tasks lacked authorization checks and CSRF token validation , allowing users to invoke file removal actions wi...

CVE-2026-78082

SP Property is a Joomla extension by joomshaper.com vulnerable to unauthenticated SQL injection in versions prior to 4.1.4 . The root cause lies in the property search and listing query builders, which assembled WHERE and ORDER BY clauses (for zipcode, sorting, price_range_dropdown, and psize_ran...

CVE-2026-78303

SP Property Joomla Extension by joomshaper.com (versions below 4.1.4 ) contains an unvalidated email destination and form manipulation vulnerability in its booking request handling. The root cause is that booking inquiries previously relied on client-submitted hidden fields for recipient email ro...

CVE-2026-87803

CVE-2026-87803 is an authorization bypass in Countly Server DBViewer caused by flawed sub-pipeline detection in the aggregation stage sanitizer at the /o/db endpoint. When the sanitizer encounters an unrecognized key such as the undocumented MongoDB-internal $_internalInhibitOptimization, it misc...

CVE-2026-15889

The Aruba HiSpeed Cache WordPress plugin is affected by a Stored Cross-Site Scripting (XSS) vulnerability in all versions up to and including 3.0.14 , caused by insufficient input sanitization and output escaping in the Post Content field. An authenticated attacker with Contributor-level access o...

CVE-2026-5399

The Redux Framework WordPress plugin is vulnerable to Stored Cross-Site Scripting (XSS) via the Slider field in User Profile settings in versions up to and including 4.5.13.1 . The root cause involves three factors: insufficient input sanitization in the user_meta_save() function (which only sani...

CVE-2026-42808

A buffer overflow vulnerability in Bosch Sensortec COINES_SDK versions 2.0 through 2.11 affects the host streaming API function coines_read_stream_sensor_data() . The root cause is that the internal stream processor, comm_intf_process_stream_response() , discards the requested sample count and co...

CVE-2026-42807

A heap-based buffer overflow in the PC bridge protocol decoder (bridge_decoder.c) of BoschSensortec COINES_SDK (versions 2.10–2.12.2) allows a malicious or compromised USB or BLE peripheral to trigger denial of service (process crash) or potentially arbitrary code execution . The root cause is th...

CVE-2026-42806

An out-of-bounds read vulnerability exists in the Bosch BME690 SensorAPI C-driver (v1.0.3 and prior) within the read_all_field_data function (bme69x.c). The driver prefetches heater configuration registers into a 30-byte stack buffer, but the gas_index field is extracted with a 4-bit mask (0–15) ...

CVE-2026-42805

CVE-2026-42805 is a stack-based buffer overflow in the Bosch Sensortec BHI385 SensorAPI (C library), specifically in the bhi385_parse_debug_message function within bhi385_parse.c. The root cause is that an 8-bit message length field is read directly from an attacker-controlled event payload and u...

CVE-2026-87009

This candidate has been reserved by an organization or individual " "that will use it when announcing a new security problem. When the candidate has been " "publicized, the details for this candidate will be provided...

CVE-2026-88265

crun (a container runtime) is affected by a flaw where, after pivot_root , reopening /dev/null for stdio can follow a symlink and attach a host file to container stdio, allowing the container to change that file's ownership (chown). This effectively permits a host bind-mount write and chown from ...

CVE-2026-42804

A stack-based buffer overflow exists in the Bosch Sensortec BHI360 SensorAPI (C-Library) , affecting versions up to and including commit d6b200416a. The flaw is in bhi360_parse_debug_message() (bhi360_parse.c, lines 1852–1875), where the first payload byte of a debug frame is used as a length and...

CVE-2026-8323

An open redirect vulnerability in Armiya Information Technologies Ltd. Co. Access Control System (versions before Version 2 ) allows an attacker to redirect users to an untrusted site, thereby faking the source of data . The CNA-assigned CVSS 3.1 score is 9.3 (CRITICAL) with vector CVSS:3.1/AV:N/...