CVE-2026-128845

A flaw exists in TiMidity++ where an attacker can cause a Denial of Service (DoS) by tricking a user into opening or converting a specially crafted MIDI audio file. The root cause is a stack-based buffer overflow caused by missing bounds checks during the processing of oversized System Exclusive ...

CVE-2026-123274

An Out-of-bounds Write vulnerability exists in Apache DataSketches C++ (versions 2.0.0 through 5.3.0 ). The flaw occurs during the deserialization of a KLL sketch from an untrusted source because the application fails to validate serialized level boundaries. This allows an attacker to provide a c...

CVE-2026-123338

A vulnerability in Apache DataSketches C++ (versions 3.0.0 through 5.3.0) allows for an out-of-bounds write during the deserialization of a REQ sketch from an untrusted source. The root cause is the lack of validation on serialized compactor headers , which can lead to heap memory corruption when...

CVE-2026-109904

A buffer overread in X.Org xwayland and X Server is caused by an integer-overflow in Proc/SProcXResQueryClientIds. This vulnerability affects X.Org xwayland versions before 24.1.15 and X Server versions before 21.1.26 . An authenticated X client can exploit this to crash the server or leak inform...

CVE-2026-125659

The eMudhra emBridge software contains an information disclosure vulnerability due to missing authorization checks in the FileBrowser API endpoints. These endpoints perform file system enumeration using the LocalSystem account without validating the requester's authority. An unauthenticated attac...

CVE-2026-112182

OpenKM Community Edition contains an authorization vulnerability within its workflow definition management. The REST endpoints registerProcessDefinition and runProcessDefinition authenticate users but fail to verify roles in the WorkflowService or underlying layers. Consequently, an attacker with...

CVE-2026-112181

The OpenKM Community Edition software is vulnerable to an XML External Entity (XXE) flaw due to inadequate restriction of external references in the FormUtils / LocalEntityResolver component. An authenticated remote attacker with the ROLE_USER role can exploit this via a REST request. In the 6.3....

CVE-2023-54423

OpenMage magento-lts versions before 20.2.0 are vulnerable to a stored cross-site scripting (XSS) flaw. The root cause is that the TinyMCE WYSIWYG editor fails to adequately filter scripts within specially crafted HTML tags. An attacker can inject an element containing a malicious onmouseover at...

CVE-2024-58405

Zipline through version 3.7.9 is affected by an improper authorization vulnerability in the /api/auth/register endpoint. The flaw occurs because the system only enforces invite codes when user registration is disabled; if both features are enabled, registration succeeds without a required invite....

CVE-2024-58404

Zipline versions from 3.4.5 before 3.7.10 are affected by a path traversal vulnerability in the user data export endpoint . The root cause is a failure to properly validate the name query parameter , allowing authenticated attackers to bypass user ID checks. By using directory traversal sequences...

CVE-2025-71459

The software Zipline through 4.3.2 is vulnerable to a path traversal vulnerability (CWE-22) via the x-zipline-filename header. Authenticated uploaders can supply traversal sequences to write files outside the intended upload directory. An attacker using a local datasource can create or overwrite ...

CVE-2025-71460

Zipline versions before 4.2.1 are vulnerable to a missing authorization flaw in the /api/user/files/transaction endpoint. The root cause is the absence of ownership checks , which allows authenticated users to modify or delete files belonging to other users if they possess a target file ID. No sp...

CVE-2025-71461

The Zipline application, versions before 4.0.2 , is vulnerable to a predictable filename flaw caused by the use of a cryptographically weak pseudo-random number generator (Math.random ). By obtaining five consecutive gfycat-style filenames, an attacker can reconstruct the random generator's state...

CVE-2025-71462

Zipline versions before 3.7.12 are vulnerable to a cross-site scripting (XSS) vulnerability on the login page. The root cause is an unvalidated url parameter that allows an attacker to execute arbitrary JavaScript by crafting a login link containing a javascript: URI . When a victim clicks this l...

CVE-2026-75487

The Cudy TR3000 (versions before 2.5.42 ) is susceptible to a command injection vulnerability involving the WireGuard server private_key option. The root cause is that the action_wireguards_export() function passes the private key to luci.sys.exec during configuration export without proper saniti...

CVE-2025-71463

Scapy versions before 2.7.0 are vulnerable to an insecure deserialization flaw in the load_session function. An attacker can achieve Remote Code Execution (RCE) by tricking a user into loading a malicious .pkl.gz session file via the -s option or conf.session . The vulnerability occurs because th...

CVE-2026-75488

The Cudy TR3000 (versions before 2.5.42 ) is vulnerable to a stack buffer overflow within the CWMP client . A malicious ACS (Auto Configuration Server) can exploit this by sending Username and Password values up to 256 bytes during TR-069 Download or Upload requests. This causes an overflow of th...

CVE-2026-75490

The Cudy TR3000 router, running firmware versions prior to 2.5.42 , is susceptible to an unauthenticated remote code execution (RCE) vulnerability. An attacker on the upstream Ethernet segment can advertise rogue _cudycmagent._tcp records via mDNS to point to a malicious MQTT broker. By sending c...

CVE-2026-75489

The Cudy TR3000 (versions before 2.5.42 ) is vulnerable to an insufficient verification of data authenticity in the mt_wifi Smart Mesh Technology (SMT) onboarding process. The system improperly protects messages using an AES-CBC key derived from public values combined with a CRC32 check . This al...

CVE-2026-75491

The Cudy TR3000 (versions before 2.5.42 ) is vulnerable to an authentication bypass in the Mosquitto plugin auth_plugin_jwt.so . The root cause is the acceptance of unsigned JSON Web Tokens (JWTs) using the alg none algorithm. Attackers possessing any Cudy-trusted client certificate can authentic...

CVE-2026-75492

The Cudy TR3000 (versions before 2.5.42 ) is vulnerable to an unauthenticated stack buffer overflow in the stun_client TR-111 UDP Connection Request parser. The flaw exists because the parser processes requests before verifying the username or HMAC. A remote attacker can trigger the vulnerability...

CVE-2026-75493

The Cudy TR3000 (versions before 2.5.42 ) is vulnerable to a stack buffer overflow within the obuspa component. The flaw exists in the getter for the TR-098 WLANConfiguration KeyPassphrase parameter, where the system uses strcpy() to copy a stored value into a 4,096-byte stack buffer without perf...

CVE-2026-75494

The Cudy TR3000 (versions prior to 2.5.42 ) is vulnerable to an argument injection vulnerability in the easycwmpd Upload handler . A malicious or compromised ACS can inject curl options by providing unfiltered Username and Password values containing whitespace. This allows the attacker to append ...

CVE-2026-75576

The Cudy TR3000 (versions before 2.5.42 ) is vulnerable to a command injection flaw within the CBI FileUpload handler . This vulnerability occurs because the application fails to validate multipart filenames during the VPN configuration upload process. An authenticated administrator can execute a...

CVE-2026-75495

The Cudy TR3000 (versions before 2.5.42 ) is vulnerable to an OS command injection vulnerability via the TR-098 User Password Parameter . A malicious or compromised ACS can send a SetParameterValues request containing shell metacharacters in the InternetGatewayDevice.User.{i}.Password value. Thes...

CVE-2026-75577

The Cudy TR3000 (versions before 2.5.42 ) is vulnerable to a command injection vulnerability via the vpn.export_conf method on the /cgi-bin/luci/rpc/app JSON-RPC endpoint. Authenticated administrators can execute commands as root by providing a malicious WireGuard private key containing $() shell...

CVE-2026-126264

SiYuan versions before 3.8.9 are vulnerable to an information disclosure vulnerability. Authenticated Reader users can bypass the sensitive-path guard in the /api/file/getFile endpoint to retrieve credential-named widget files. By requesting specific paths such as /data/widgets//credentials.json ...

CVE-2026-75578

The Cudy TR3000 (versions before 2.5.42 ) is vulnerable to a command injection vulnerability in luci/model/cbi/vpn/openvpn/client.lua. The root cause is the improper handling of the remote host token from uploaded OpenVPN configuration files; the application embeds a shellquote()-quoted token int...

CVE-2026-126265

The SiYuan application, version 2.1.0 before 3.8.9, is vulnerable to a CAPTCHA Bypass due to a flaw in how the loginAuth challenge is handled. The challenge is stored in a signed client-side cookie , which allows an attacker to reuse a previously solved challenge. By replaying the original signed...

CVE-2026-126266

SiYuan versions 3.6.0 before 3.8.9 are susceptible to an information disclosure vulnerability. The flaw allows unauthenticated publish visitors to bypass per-document passwords by exploiting a regex search in the getDoc function. Specifically, an attacker can send POST requests to /api/filetree/g...

CVE-2026-126267

NocoDB versions from 0.300.0 before 2026.04.4 are vulnerable to a Denial of Service (DoS) attack. The issue stems from an unhandled promise rejection within MetaService metadata logging . An authenticated user can trigger the crash by sending a request that leaves a lookup condition undefined, le...

CVE-2026-126268

NocoDB versions prior to 2026.08.0 are vulnerable to an IP address spoofing vulnerability. The root cause is that Express trust proxy is enabled unconditionally, allowing unauthenticated attackers to forge their source IP by supplying X-Forwarded-For headers. This allows attackers to inject arbit...

CVE-2026-126269

NocoDB versions prior to 2026.09.0 are vulnerable to a Stored Cross-Site Scripting (XSS) flaw. The issue arises because the software fails to properly neutralize input during web page generation, specifically regarding attachment MIME types . An authenticated Editor user can use the records API t...

CVE-2026-126270

NocoDB versions prior to 2026.09.1 are vulnerable to an unauthenticated information disclosure due to missing authentication in the aggregated meta info route within utils.controller.ts . This flaw allows anonymous callers to access instance-wide metadata, including base enumerations, user counts...

CVE-2026-126271

NocoDB versions before 2026.09.0 are vulnerable to an information disclosure flaw where authenticated base Viewers can obtain TLS client private keys by reading a base's data source. The root cause is that the source read handler only masks the connection password, leaving the decrypted private k...

CVE-2026-126272

NocoDB versions prior to 2026.09.0 are vulnerable to an uncontrolled resource consumption (CWE-770) flaw in the v1 and v2 bulk write routes . The vulnerability allows authenticated users with Editor write permission on a table to bypass bulk row-count limits by utilizing session authentication in...

CVE-2026-126273

NocoDB versions before 2026.09.0 are vulnerable to a privilege escalation flaw in initAdminFromEnv.ts. The root cause is that the system silently skips the super-admin bootstrap process when the admin password environment variable is empty. An unauthenticated attacker can exploit this on a fresh ...

CVE-2026-126274

NocoDB versions prior to 2026.08.0 are vulnerable to a stored cross-site scripting (XSS) flaw. The issue resides in the Delete.vue confirmation dialog, which renders column or table titles via an unescaped innerHTML binding. Authenticated Creator users can exploit this by embedding malicious mark...

CVE-2026-126276

NocoDB versions before 2026.08.1 are vulnerable to a client authentication bypass within the oauth-token.service.ts component. The root cause is the software's failure to properly distinguish between PKCE and confidential client authentication, causing it to skip client secret verification when t...

CVE-2026-126275

NocoDB versions before 2026.09.0 are susceptible to an Insecure Direct Object Reference (IDOR) vulnerability within row comment operations. This flaw allows authenticated users to access row comments from unrelated bases by providing only the necessary model and row IDs . Specifically, attackers ...

CVE-2026-126277

NocoDB versions before 2026.08.1 are vulnerable to an uncontrolled resource consumption vulnerability (CWE-770) in the shared-view bulk API . An unauthenticated attacker possessing a shared view UUID can submit a large body of minimal filter objects via a POST request. This triggers a full databa...

CVE-2026-126278

NocoDB versions before 2026.08.1 are vulnerable to a race condition in users.service.ts. An attacker possessing a valid reset token can send concurrent reset requests to exploit the processing window of slow bcrypt hashing . This allows the attacker to overwrite the owner's new password before th...

CVE-2026-126279

NocoDB versions prior to 2026.06.2 are vulnerable to a stored cross-site scripting (XSS) flaw in the PromptWithFields.vue component. The root cause is the rendering of unescaped field references from AI field prompts as HTML within a tooltip. An attacker with Creator privileges or higher can inje...

CVE-2026-126280

NocoDB versions prior to 2026.08.0 are vulnerable to a race condition in the refresh-token rotation process. The flaw exists because UserRefreshToken.ts fails to verify the affected-row count during rotation. This allows an attacker with a captured refresh token to present it concurrently with a ...

CVE-2026-126281

NocoDB versions prior to 2026.08.0 are vulnerable to a missing authorization vulnerability (CWE-862) within the integrations.service.ts component. Specifically, the copy-from branch of integration creation fails to verify the owner or private flag of a source integration before decrypting its cre...

CVE-2026-126283

NocoDB versions before 2026.08.0 are vulnerable to an incorrect authorization flaw involving base-scoped API tokens . The root cause is that the system fails to store or verify the base_id associated with these tokens, allowing them to function as account-wide credentials . An attacker who obtain...

CVE-2026-126282

NocoDB versions 2026.04.0 before 2026.08.0 are susceptible to an improper privilege management vulnerability in org-users.service.ts. The root cause is that updating a user's legacy organization role incorrectly rewrites their default-workspace role . This flaw allows revoked users to silently re...

CVE-2026-126284

NocoDB versions 2026.05.2 before 2026.07.0 are vulnerable to a Server-Side Request Forgery (SSRF) . The root cause is that the data import functionality incorrectly reused the webhook internal-network exemption. When the configurations NC_ALLOW_LOCAL_HOOKS or NC_WEBHOOK_ALLOW_PRIVATE_NETWORK are ...

CVE-2026-126286

NocoDB versions prior to 2026.08.0 are vulnerable to a reflected cross-site scripting (XSS) flaw within the PageLeavingWarning.vue component. The root cause is the improper handling of the ncRedirectUrl scheme, where an attacker can embed an ASCII control character to bypass scheme checks. This a...

CVE-2026-126285

NocoDB versions before 2026.08.0 are vulnerable to an SQL injection flaw within the legacy where parameter on PostgreSQL . The root cause is the improper concatenation of filter values in CustomKnex.ts , allowing authenticated users with read access—including those with Viewer-role —to inject sin...