CVE-2026-74908 Grav plugin-api before 1.0.15 Script Injection via SVG

Grav plugin-api before 1.0.15 contains a script injection vulnerability where the SVG sanitizer only checks for the exact extension 'svg', allowing .svgz and .xhtml files to bypass sanitization and be stored unsanitized. Attackers with api.media.write permission can upload files containing...

CVE-2026-74906 SiYuan before v3.7.4 Incorrect Authorization via Publish Access

SiYuan before v3.7.4 contains an incorrect authorization vulnerability in eight publish-mode reader-facing endpoints that filter results using the visibility list instead of the disabled list. Anonymous visitors can discover and read content from documents explicitly marked as forbidden from...

CVE-2026-74904 SiYuan before v3.7.4 Missing Authorization via block API

SiYuan before v3.7.4 is missing authorization checks in 17 block metadata/content endpoints in kernel/api/block.go including getRefText, checkBlockExist, and getBlockBreadcrumb. These handlers are gated only by basic authentication model.CheckAuth and lack publish-access filtering, allowing...

CVE-2026-74905 SiYuan before v3.7.4 SSRF via IPv6 Transition Address Bypass

SiYuan before v3.7.4 contains a server-side request forgery SSRF vulnerability in the isPrivateIP function in kernel/util/net.go, used by SSRFSafeDialer to enforce SSRF protection in SafeMode. The function only checks for loopback, link-local unicast, private, and unspecified addresses and does n...

CVE-2026-74903 SiYuan before v3.7.4 Insufficient Access Control via spinBlockDOM

SiYuan before v3.7.4 contains an insufficient access control vulnerability in the /api/lute/spinBlockDOM endpoint, which is guarded only by CheckAuth middleware instead of CheckAdminRole like its sibling endpoint. Authenticated users with RoleEditor or RoleReader roles can invoke the endpoint to...

CVE-2026-74902 SiYuan before v3.7.4 XSS-to-RCE via malicious filename upload

SiYuan before v3.7.4 contains a cross-site scripting vulnerability in the file upload validation flow that fails to escape filenames before inserting them into HTML via insertAdjacentHTML. Attackers can craft a malicious filename containing script payloads that execute with full OS command access...

CVE-2026-75774 karakeep-app karakeep OAuth Sign-In auth.ts improper authentication

A vulnerability was determined in karakeep-app karakeep up to 0.32.0. The impacted element is an unknown function of the file apps/web/server/auth.ts of the component OAuth Sign-In. This manipulation causes improper authentication. It is possible to initiate the attack remotely. The complexity of...

CVE-2026-19608 Keycloak-services: keycloak-services: name-only group claims let same-name groups satisfy path-specific group policies

A flaw was found in the group policy provider of Keycloak authorization services, which is used to manage fine-grained access control to resources. The issue occurs when the system evaluates group-based policies using tokens that only contain group names rather than full paths. If two groups in...

CVE-2026-75773 karakeep-app karakeep Login Endpoint auth.ts authorize excessive authentication

A vulnerability was found in karakeep-app karakeep up to 0.32.0. The affected element is the function authorize of the file apps/web/server/auth.ts of the component Login Endpoint. The manipulation results in improper restriction of excessive authentication attempts. The attack may be performed...

CVE-2026-19447 Stored XSS in Fileorbis Informatics's FileOrbis

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Fileorbis Informatics Services Trade Inc. FileOrbis allows Stored XSS. This issue affects FileOrbis: before 16.5...

CVE-2026-75627 Bastillion Authentication Bypass via Path-Prefix Routing Mismatch

Bastillion fails to properly validate request URI paths in its controller dispatcher, allowing unauthenticated attackers to bypass authentication filters by prefixing requests with arbitrary path segments. Attackers can access administrative controllers to read user listings, create manager...

CVE-2026-75626 SpiderFoot Stored Cross-Site Scripting via Correlation Titles

SpiderFoot fails to HTML-escape correlation titles built from external scan data sources including server banners and metadata. Attackers can inject malicious HTML elements with event handlers into correlation results that execute scripts in the operator's browser when the correlations view is...

CVE-2024-14046 OpenBoxes Document Upload Controller DocumentController.groovy DocumentController unrestricted upload

A security vulnerability has been detected in OpenBoxes up to 0.9.1. This issue affects the function DocumentController of the file grails-app/controllers/org/pih/warehouse/core/DocumentController.groovy of the component Document Upload Controller. The manipulation leads to unrestricted upload. I...

CVE-2026-18929 Resource Exhaustion in Carbone

Carbone is vulnerable to Denial of Service due to lack of protection against zip bombs when processing .docx files. The library uses yazl for zip decompression without validating entry sizes, allowing an attacker to supply a malicious .docx file containing a zip bomb that decompresses to a...

CVE-2026-43971 Link Header Directive Smuggling via Unescaped target/rel/Attribute Keys in cow_link:link/1

Improper Encoding or Escaping of Output vulnerability in ninenines cowlib allows Link header directive smuggling via unescaped special characters in cowlink:link/1. cowlink:dolink/1 in cowlib interpolates the target URI, rel value, and attribute keys directly into the serialized Link: header valu...

CVE-2024-14045 OpenBoxes Product Supplier Edit Controller RoleInterceptor.groovy improper authorization

A weakness has been identified in OpenBoxes up to 0.9.2. This vulnerability affects unknown code of the file grails-app/controllers/org/pih/warehouse/RoleInterceptor.groovy of the component Product Supplier Edit Controller. Executing a manipulation can lead to improper authorization. The attack m...

CVE-2026-34884 Apache SkyWalking MCP: SSRF via set_skywalking_url Tool and GraphQL Expression Injection in MCP Server

SSRF via setskywalkingurl Tool and GraphQL expression injection vulnerability in Apache SkyWalking MCP. This issue affects Apache SkyWalking MCP: 0.1.0. Users are recommended to upgrade to version 0.2.0, which fixes this issue...

CVE-2026-15371 Velociraptor Stored XSS in URL column types

Velociraptor's web GUI allows specifying a custom type for columns in tables. The URL type takes the cell value and forms a URL which can be clicked in the GUI.The code does not limit the schemes allowed in this URL , allowing an attacker to specify a JavaScript scheme exposing the user to XSS...

CVE-2026-75091 Quill Forms <= 5.7.1 - Unauthenticated Stored Cross-Site Scripting

The Quill Forms | Conversational Multi Step Forms, Surveys & quizzes plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 5.7.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...

CVE-2026-15748 Forminator Forms <= 1.56.1 - Unauthenticated Arbitrary File Upload via Forged Upload Field Configuration

The Forminator Forms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.56.1 via the handlefileupload function. This is due to insufficient file type validation in handlefileupload, where the dangerous-extension blocklist performs exact-key matchin...

CVE-2026-11801 WPAdverts <= 2.3.2 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via classifieds-types REST Endpoint

The WPAdverts – Classifieds Plugin plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.3.2. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to...

CVE-2026-75151 SourceCodester Onlne Examination & Learning Management System cross-site request forgery

A vulnerability has been found in SourceCodester Onlne Examination & Learning Management System 1.0. Affected by this vulnerability is an unknown functionality. The manipulation leads to cross-site request forgery. The attack can be initiated remotely...

CVE-2026-75094 COMFAST CF-N1-S CGI mbox-config sub_44B438 os command injection

A flaw has been found in COMFAST CF-N1-S 2.6.0.1. This impacts the function sub44B438 of the file /cgi-bin/mbox-config?method=SET&section=ptestssid of the component CGI Interface. This manipulation of the argument ssid causes os command injection. Remote exploitation of the attack is possible. Th...

CVE-2026-75093 sonos tract ONNX Initializer Loader tensor.rs from_raw_dt_align buffer size

A security vulnerability has been detected in sonos tract up to 0.23.4. This impacts the function Tensor::fromrawdtalign of the file data/src/tensor.rs of the component ONNX Initializer Loader. Such manipulation leads to incorrect calculation of buffer size. The attack may be launched remotely. T...

CVE-2026-75090 EricLBuehler Mistral.rs GGUF Tokenizer gguf_tokenizer.rs convert_gguf_to_hf_tokenizer out-of-bounds

A vulnerability was detected in EricLBuehler Mistral.rs up to 0.8.22. Affected by this issue is the function convertgguftohftokenizer of the file mistralrs-core/src/gguf/gguftokenizer.rs of the component GGUF Tokenizer. The manipulation of the argument eostokenid/bostokenid/unknowntokenid results...

CVE-2026-75089 PHPGurukul Complaint Management System check_availability.php sql injection

A weakness has been identified in PHPGurukul Complaint Management System 1.0. Affected by this issue is some unknown functionality of the file user/checkavailability.php. This manipulation of the argument email causes sql injection. Remote exploitation of the attack is possible. The exploit has...

CVE-2026-75088 itsourcecode Hospital Management System viewbilling.php sql injection

A vulnerability was determined in itsourcecode Hospital Management System 1.0. This impacts an unknown function of the file /viewbilling.php. Executing a manipulation of the argument delid can lead to sql injection. The attack can be launched remotely. The exploit has been publicly disclosed and...

CVE-2026-75087 itsourcecode Hospital Management System viewdepartment.php sql injection

A vulnerability was found in itsourcecode Hospital Management System 1.0. This affects an unknown function of the file /viewdepartment.php. Performing a manipulation of the argument delid results in sql injection. The attack can be initiated remotely. The exploit has been made public and could be...

CVE-2026-75086 itsourcecode Hospital Management System viewroom.php sql injection

A vulnerability has been found in itsourcecode Hospital Management System 1.0. The impacted element is an unknown function of the file /viewroom.php. Such manipulation of the argument delid leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the...

CVE-2026-75082 Webkul Bagisto Customer-Registration Notification Email register cross site scripting

A flaw has been found in Webkul Bagisto up to 2.4.4. The affected element is an unknown function of the file /customer/register of the component Customer-Registration Notification Email. This manipulation of the argument firstname/lastname causes basic cross site scripting. It is possible to...

CVE-2026-57826

An issue was discovered in openHiTLS 0.2.0 through 0.3.2. In the X.509 certificate chain verification, the basic constraints extension and CA flag processing of intermediate CAs are only verified for v3 certificates, and v1/v2 certificates are ignored...

CVE-2026-30250

Cross-site scripting vulnerability in the user documentation field in Beta Systems Software AG ANOW! Automate v.3.3.1.90 allows a remote attacker to execute arbitrary code...

CVE-2026-52610

An arbitrary file write/directory traversal vulnerability in reportico-web = 8.1.0 allows remote attackers to create or overwrite files anywhere on the filesystem subject to the permissions of the web user by specifying a filename in the "saveTemplate" parameter in conjuction with...

CVE-2026-52481

An issue in SJRC F11 SJ-GPS-PRO firmware build 2019-09-17 allows a remote attacker to obtain sensitive information via the tcpactions function...

CVE-2021-43717

An issue exists in pson EH-TW5350 Epson iProjection.apk v3.2.6. If you identify a projector equipped with an iProjection function, you can access the projector using hard-coded authentication information and control the projector maliciously...

CVE-2021-43718

An Authentication Bypass vulnerability exists in EPSON EH-TW5350 EPSON 150075647YWWV110, which could let a remote malicious user cause a Denial of Service via specially crafted series of HTTP...

CVE-2026-67921

Cross-Site Request Forgery CSRF vulnerability exists in Halo CMS versions up to 2.25.4 via the CorsConfigurer.java and the CsrfConfigurer.java components. This allows a remote attacker to execute arbitrary code...

CVE-2021-43716

Verification Bypass vulnerability exists in EPSON 150075647YWWV110 EasyMP Network Updater Ver.1.20. The Epson projector can be updated by encrypted firmware through USB...

CVE-2026-52609

A reflected cross-site scripting XSS vulnerability in reportico-web = 8.1.0 allows remote attackers to execute arbitrary JavaScript in the web browser of a user by including a malicious payload in the reporticocriteria parameter in conjunction with the executemode=CRITERIA parameter of run.php...

CVE-2026-52608

An incorrect access control vulnerability in reportico-web = 8.1.0 allows an unauthenticated attacker to inject arbitrary php code into the PreExecuteCode attribute of any report regardless of the safemode setting leading to remote code execution...

CVE-2026-67846

Berkeley Out-of-Order Machine BOOM commit 5223e44cfeb26f41380057a2eb4d651197475f69 contains a potential incorrect privilege assignment issue in the v3 and v4 NBDTLB implementations. The raw mstatus.SUM value participates in the read and write permission logic without an explicit local satp.MODE...

CVE-2026-71675

An issue in Open5GS v.2.7.0 allows a remote attacker to cause a denial of service via the ngapsendtonas function in src/amf/ngap-path.c...

CVE-2026-52607

A directory traversal vulnerability in reportico-web = 8.1.0 allows remote attackers to expose or execute arbitrary php files on the web server by specifying the filename in the targetformat parameter in conjunction with the executemode=EXECUTE parameter of the run.php endpoint...

CVE-2026-67920

An issue in Halo 2.25.4 allows a remote attacker to execute arbitrary code via the run.halo.app.migration.impl.MigrationServiceImpl.restoreWorkdir, and org.springframework.util.FileSystemUtils.copyRecursively components...

CVE-2026-52606

A reflected cross-site scripting XSS vulnerability in reportico-web = 8.1.0 allows remote attackers to execute arbitrary JavaScript in the web browser of a user by including a malicious payload in the loadTemplate parameter in conjunction with the executemode=PREPARE parameter of run.php...

CVE-2026-52480

An issue in SJRC F11 SJ-GPS-PRO firmware build 2019-09-17 allows a remote attacker to obtain sensitive information via the inetd service...

CVE-2026-71676

Buffer Overflow vulnerability in Open5GS v.2.7.0 allows a remote attacker to cause a denial of service via the NAS 5GS decoder chain, triggered when the message type byte of a NAS PDU is mutated...

CVE-2026-75081 Webkul Bagisto store behavioral workflow

A vulnerability was detected in Webkul Bagisto up to 2.4.4. Impacted is an unknown function of the file /customer/account/rma/store. The manipulation of the argument rmaqty/resolutiontype/rmareasonid results in enforcement of behavioral workflow. The attack may be performed from remote. The explo...

CVE-2026-75080 SourceCodester Class and Exam Timetabling System edit_subject1.php sql injection

A security vulnerability has been detected in SourceCodester Class and Exam Timetabling System 1.0. This issue affects some unknown processing of the file /editsubject1.php. The manipulation of the argument ID leads to sql injection. The attack is possible to be carried out remotely. The exploit...

CVE-2026-75079 SourceCodester Class and Exam Timetabling System edit_subject2.php sql injection

A weakness has been identified in SourceCodester Class and Exam Timetabling System 1.0. This vulnerability affects unknown code of the file /editsubject2.php. Executing a manipulation of the argument ID can lead to sql injection. The attack can be executed remotely. The exploit has been made...