CVE-2026-64837

ICEcoder through 8.1 is vulnerable to OS command injection in lib/properties.php . The root cause is an unescaped filesystem path passed to a shell command via popen() . An authenticated attacker can create directories containing shell metacharacters in their names and then invoke the Properties ...

CVE-2026-64836

ICEcoder versions through 8.1 contain a path traversal vulnerability in the file-control endpoint. The root cause is a logic error in the File::check() validation function, which compares realpath() to boolean true—a condition that never succeeds, effectively disabling the document-root confineme...

CVE-2026-12682

Ankaref Innovation and Technology Inc. LIBRID/LIBREF is affected by a Stored XSS vulnerability caused by improper input neutralization during web page generation. The issue affects versions from 2.01.0.2183 through 10092026 . The CVSS v3.1 score is 5.4 (Medium) with a network attack vector, low c...

CVE-2026-88921

MISP (versions ≤2.5.45) contains an HTML injection vulnerability in the MISPElementHTMLFormatterTool component, used during PDF report export via the convert_markdown_to_pdf module. The attribute(), objectAttribute(), object(), and tag() methods interpolated user-controlled fields (attribute type...

CVE-2026-6285

CVE-2026-6285 is an Improper Authentication vulnerability in Ankaref Innovation and Technology Inc. LIBRID/LIBREF , affecting versions 2.01.0.2183 through 10092026 . The root cause is a weak password recovery mechanism for forgotten passwords, allowing remote exploitation of the recovery flow. Th...

CVE-2026-85217

Autodesk Fusion Desktop is vulnerable to a Man-in-the-Middle (MITM) attack via a maliciously crafted add-in that, when installed and executed, can modify persistent network proxy settings without user notification or consent. A successful exploit allows an attacker to redirect authenticated Fusio...

CVE-2026-45763

Suricata 8.0.0 through 8.0.4 contains a flaw in its Lua sandbox where the security.lua.max-bytes memory limit was not consistently enforced for certain new allocation patterns. When Lua rules are enabled and an affected script is loaded, crafted allocation patterns could exceed the configured lim...

CVE-2026-12683

CVE-2026-12683 is a Stored XSS vulnerability in the management panel (Yönetim panel) of Ankaref Innovation and Technology Inc. LIBRID/LIBREF , caused by improper neutralization of input during web page generation. The issue affects versions 2.01.0.2183 through 10092026 . The CVSS 3.1 score is 5.4...

CVE-2026-88896

EspoCRM before 10.0.4 is vulnerable to Server-Side Request Forgery (SSRF) via an IPv6 transition address bypass in HostCheck::ipAddressIsNotInternal(). The function strips ::ffff: (IPv4-mapped IPv6) prefixes but fails to recognize IPv6 transition addresses that embed private IPv4 addresses—NAT64 ...

CVE-2026-88895

CyberPanel before 3.0.5 fails to enforce two-factor authentication (TOTP) on its API endpoints. Attackers who obtain an administrator's password can derive API tokens from that password and perform administrative operations or create authenticated sessions without the second factor. The vulnerabi...

CVE-2026-88894

Snipe-IT , an IT asset management platform, contains an authorization bypass in its predefined kit checkout path. The root cause is that PredefinedKitCheckoutService never calls the tenant-isolation check ($item->canCheckoutTo($target)) that all other checkout paths enforce under Full Multiple...

CVE-2026-88893

OpenPanel 's share lookup procedures fail to validate access controls, allowing unauthenticated callers who possess a share link to retrieve argon2id password hashes and full report configurations (event names, filters, breakdown dimensions). This enables offline password cracking and theft of bu...

CVE-2026-88892

OpenPanel , an analytics platform, has a server-side request forgery (SSRF) vulnerability in its data importer. The parseRemoteFile function in packages/importer/src/providers/umami.ts calls plain fetch() on a caller-supplied fileUrl validated only by z.string().url(), bypassing the project's exi...

CVE-2026-88891

OpenPanel fails to enforce its read-only project access level on 26 of 29 mutating procedures , caused by missing access level validation in mutation resolvers. Attackers with explicit read-only access can modify, delete, and publish project data , including deleting reports and dashboards, sched...

CVE-2026-88890

OpenPanel through commit cd24bb8 contains an SQL injection vulnerability in the analytics filter builder . The root cause is a failure to validate profile.* filter column identifiers before interpolating them into ClickHouse WHERE clauses . An authenticated attacker holding project-scoped read or...

CVE-2026-88889

Renovate (dependency update automation tool) versions before 44.14.7 contain a command injection vulnerability in the Maven Wrapper manager . An unescaped distributionType parameter in maven-wrapper.properties allows attackers to inject shell commands, leading to remote code execution when Renova...

CVE-2026-88888

Renovate before 44.14.7 is affected by a command injection vulnerability in the Mix manager . The root cause is unescaped organization parameters when processing private dependencies, allowing attackers to inject shell metacharacters through malicious package names. Successful exploitation enable...

CVE-2026-88886

Renovate (a dependency update automation tool) before 44.14.7 is affected by a command injection in the manager/gradle-wrapper module. The distributionUrl value read from a repository's gradle-wrapper.properties file is not escaped before invoking the Gradle Wrapper CLI. In self-hosted deployment...

CVE-2026-88887

Renovate (dependency update automation tool) is vulnerable to credential exfiltration when listing tags/digests for container images. The root cause is that Renovate follows pagination links supplied by the remote registry in the HTTP Link header and attaches registry credentials to the follow-up...

CVE-2026-88885

Renovate before 44.14.7 contains a command injection vulnerability in the gomod manager . When processing unescaped depName parameters in import-path update commands with binarySource=docker mode, attackers can inject shell metacharacters through malicious dependency names to execute arbitrary co...

CVE-2026-88884

Renovate , a dependency update automation tool, is affected by a stability-age bypass in versions before 44.3.1 (and Mend Renovate CE/EE images before 15.4.0, mend-renovate-ce Helm chart before 15.4.0, mend-renovate-enterprise-edition Helm chart before 10.4.0). The root cause is that digest updat...

CVE-2026-88883

Renovate versions before 44.14.4 (Mend Renovate CE/EE images before 15.4.0, mend-renovate-enterprise-edition Helm chart before 10.4.0) contain an incomplete log sanitisation flaw for TLS private keys used in Mutual TLS. The value of hostRules[].httpsPrivateKey was redacted in its own field but no...

CVE-2026-88882

Renovate is a dependency update automation tool. In versions before 44.11.2 (and Mend Renovate CE/EE images before 15.4.0, helm chart before 10.4.0), when fetching package versions from a NuGet registry , Renovate follows pagination URLs returned in the HTTP Link header without verifying the targ...

CVE-2026-88881

Renovate versions before 44.11.3 are vulnerable to credential exfiltration when following pagination links in the HTTP Link header. The root cause is that the pagination URL returned by a GitHub server is not validated against the originally contacted host, allowing a malicious or compromised ser...

CVE-2026-88880

Renovate before 44.11.3 contains a credential exfiltration vulnerability in its handling of Link headers when following GitLab server pagination . Because Renovate fails to validate Link header destinations, an attacker controlling a compromised GitLab server can specify a Link header pointing to...

CVE-2026-88879

Traefik (HTTP reverse proxy and load balancer) in v1.x, v2.x through v2.11.55, and v3.0.0 through v3.7.11 canonicalizes header names only on dashes, so X-Auth-User, X_Auth_User, and X.Auth.User are treated as three distinct headers by Traefik. However, backends (CGI, WSGI, PHP, NGINX) collapse th...

CVE-2026-88878

Traefik (HTTP reverse proxy and load balancer) versions v2.8.2 through v2.11.55 and v3.0.0 through v3.7.11 are affected by an HTTP/3 timeout bypass. The respondingTimeouts settings (notably readTimeout, default 60s) are not applied to the HTTP/3 request path because readTimeout is enforced as a d...

CVE-2026-88877

This CRITICAL (CVSS 3.1: 9.8) vulnerability affects Traefik v3.7.0 through v3.7.11, specifically its Kubernetes ingress-nginx provider . When an Ingress carries both an authentication annotation and the from-to-www-redirect annotation, the provider creates a "sibling" router that matches on host ...

CVE-2026-88876

AVideo through revision c3edcc274c389816d434acadac07ee78eaf330c1 contains a missing authorization flaw in plugin/PlayerSkins/seo.php. The getSources() function is invoked without validating the configured password, allowing an unauthenticated attacker to request the seo.php endpoint with a video ...

CVE-2026-88875

AVideo through revision c3edcc274c389816d434acadac07ee78eaf330c1 (master, 2026-08-23) incompletely sanitizes sensitive user fields in the APIName=video response. The function API::get_api_video() calls removeSensitiveUserFields() only when the caller is neither authenticated nor using a valid API...

CVE-2026-88874

AVideo (through revision c3edcc274c389816d434acadac07ee78eaf330c1, 2026-08-23) suffers from an authentication bypass in its live streaming feature. The Live::_getStats() method (plugin/Live/Live.php) exposes the RTMP stream key, isPasswordProtected flag, and HLS (m3u8) URL to unauthenticated call...

CVE-2026-88873

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a Cross-Site Request Forgery vulnerability in view/logArchive.json.php. The endpoint accepts GET requests without CSRF token validation , allowing unauthenticated attackers to craft malicious pages that trigger an admini...

CVE-2026-88871

WWBN AVideo 's CustomizeUser plugin (enabled by default) contains a CSRF vulnerability in the setSubscribers.json.php endpoint, affected through commit c3edcc274c (master, 2026-08-23). The endpoint reads users_id and ExtraSubscribers from $_REQUEST and calls User::setExtraSubscribers() without re...

CVE-2026-88872

AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a cross-site request forgery (CSRF) vulnerability in the setPassword.json.php endpoint due to missing CSRF token validation. An unauthenticated attacker can craft a malicious webpage that, when visited by an authenticated adm...

CVE-2026-88870

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a cross-site request forgery (CSRF) vulnerability in the LoginControl plugin PGP key endpoints. The affected endpoints, including savePublicKey.json.php , lack CSRF token validation and accept requests via GET. An attack...

CVE-2026-88868

AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 is affected by a stored cross-site scripting vulnerability in the LiveLinks plugin . The root cause is that the title and description fields are stored without sanitization. An attacker holding canStream permission can inject maliciou...

CVE-2026-88869

AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 is affected by a stored cross-site scripting (XSS) vulnerability in the AD_Server plugin 's log.php endpoint. The endpoint fails to escape the label parameter before storage, allowing an unauthenticated attacker to inject malicious HT...

CVE-2026-88867

WWBN AVideo (up to commit c3edcc274c389816d434acadac07ee78eaf330c1 ) is affected by a stored cross-site scripting (XSS) vulnerability. The endpoint objects/categoryAddNew.json.php passes the POST parameters name and iconClass into Category::setName() and Category::setIconClass() without sanitizat...

CVE-2026-88866

WWBN AVideo (through commit c3edcc274c389816d434acadac07ee78eaf330c1 ) contains a stored cross-site scripting vulnerability in the LoginControl plugin . The plugin fails to encode the User-Agent header before storing it in the login history. An attacker with any valid login account can inject mal...

CVE-2026-88865

AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate restream ownership in getRestream.json.php . Authenticated users holding the canStream permission can mint tokens for arbitrary restreams, then exchange those tokens to retrieve other users' stream keys from getLiveK...

CVE-2026-88864

Capgo (capgo.app) contains an authentication bypass vulnerability in its SSO provider management. The public.sso_providers table is exposed through Supabase PostgREST without restricting direct write access. A holder of an ordinary full API key can insert a forged row with status='active' and enf...

CVE-2026-88863

capgo.app (npm package capgo) through version 12.207.1 contains a privilege escalation vulnerability in the validateInvite() function within supabase/functions/_backend/private/invite_new_user_to_org.ts. The function fails to compare the caller's role rank against the requested role, allowing an ...

CVE-2026-88862

Capgo (capgo.app) backend through version 12.242.4 contains an authentication bypass in the API key manager via the x-limited-key-id header. The root cause is insufficient parent-child delegation validation in checkKeyByIdPg() within supabase/functions/_backend/utils/hono_middleware.ts. An authen...

CVE-2026-88861

Capgo (Cap-go/capgo.app), a continuous deployment platform, has an authentication bypass in all versions with no patched release available. The root cause is in the Edge authorization path: the JWT middleware (findJWT() in hono_middleware.ts) accepts tokens without validating their assurance leve...

CVE-2026-88860

Capgo , an OTA update platform, is affected by an authorization bypass caused by stale channel permission overrides. When a user's last organization role binding is deleted, Capgo fails to clean up associated channel-level permission overrides, leaving them active. An attacker with a previously r...

CVE-2026-88915

MISP ≤2.5.45 is affected by an authorization bypass in the event template instantiation path. When a template uses distribution = 4 , the template's sharing_group_id was passed directly into event creation without verifying that the acting user is permitted to use that sharing group via SharingGr...

CVE-2026-85543

Hikvision Wi-Fi series IP cameras are affected by insufficient permission validation on certain interfaces. An authenticated low-privileged user can exploit this flaw to obtain the device's Wi-Fi configuration information , representing a confidentiality impact rated CVSS 3.1: 4.3 (MEDIUM) . No i...

CVE-2026-85545

HikCentral Access Control is affected by a broken access control vulnerability in some unspecified versions. Authenticated low-privilege users can invoke API interfaces that their role is not authorized to access, representing an authorization bypass. The vulnerability is exploitable over the net...

CVE-2026-85544

CVE-2026-85544 is an Improper Encryption Configuration vulnerability affecting some Hikvision Intercom Products . The flaw allows an attacker with physical access to forge M1 cards , leading to high confidentiality impact and low integrity impact (CVSS 3.1: 5.2 MEDIUM ). No specific product model...

CVE-2026-9166

CVE-2026-9166 is a Path Traversal vulnerability (local file inclusion) in GIS Informatics GisLab Laboratory Management System , affecting versions 1.4.03 through 1.5 (exclusive) . The flaw is classified as Improper Limitation of a Pathname to a Restricted Directory . The CVSS 3.1 score is 7.5 (HI...