CVE-2026-118426

In affected versions of Octopus Server with the LDAP authentication provider enabled, any authenticated user could call the LDAP user search and LDAP group search...

CVE-2026-113409

The Ortto plugin for WordPress before 1.0.25 did not escape stored settings on its admin settings page, leading to stored cross-site scripting. A threat actor able to modify the plugin's configuration could execute arbitrary JavaScript in an administrator's session when they visited the impacted...

CVE-2026-114173

The Ortto plugin for WordPress before 1.0.25 did not filter the WooCommerce product data it embedded in public storefront pages. An unauthenticated threat actor could read product passwords and private product metadata from an affected store...

CVE-2026-113387

The Ortto plugin for WordPress before 1.0.25 did not authenticate configuration update requests, relying only on a secret exposed in public HTML. An unauthenticated threat actor could overwrite the plugin's configuration to serve arbitrary scripts...

CVE-2026-66092 Stored XSS in pre-login notice via reachable legacy logon route

In openEQUELLA before 2026.2, the pre-login notice is stored as HTML and rendered on the legacy logon page without encoding or sanitisation. A user holding the EDITSYSTEMSETTINGS permission can set a notice containing an arbitrary script PUT /api/preloginnotice, resulting in stored cross-site...

CVE-2026-66091 Unauthenticated IDOR Enables Disclosure of Other Users’ last-known details

In openEQUELLA before 2026.1, the GET /api/userquery/userinfobackup endpoint performs no authentication or authorisation check. An unauthenticated attacker who supplies another user's uniqueId can retrieve that user's stored personal details username, first name, last name and email address withi...

CVE-2026-66090 XML External Entity (XXE) Injection in Metadata Field Allows Arbitrary File Read

In openEQUELLA before 2026.1, the XML parser used for item metadata does not disable external entity resolution. A user permitted to create items CREATEITEM can submit crafted XML to POST /api/item and cause the server to read arbitrary files accessible to the openEQUELLA service, or make request...

CVE-2026-66089 XML External Entity (XXE) Vulnerability in SOAP Interface Allows External Entity Expansion

In openEQUELLA before 2026.1, the SOAP API parses XML supplied in the stopEdit operation with a parser that resolves external entities. This allows an attacker to read arbitrary files accessible to the openEQUELLA service or cause the server to issue requests to attacker-specified locations SSRF...

CVE-2026-66088 Unrestricted Command Execution via system.execute

In openEQUELLA before 2026.1, the system.execute function available to the scripting engine runs supplied operating system commands without validation or an allow-list of permitted executables. A user able to create or edit scripts can use it to execute arbitrary commands with the privileges of t...

CVE-2026-16889 Stored XSS via Pre-Login Notice Image Upload Serves Attacker HTML from Application Origin

In openEQUELLA before 2026.1, the pre-login notice image upload endpoint PUT /api/preloginnotice/image/name does not validate the type of uploaded files and serves them with a Content-Type derived from the supplied filename. A user holding the EDITSYSTEMSETTINGS permission can upload an HTML file...

CVE-2026-21157

Improper input validation in Bixby prior to version 4.0.85.6 allows privileged local attackers to launch arbitrary activity...

CVE-2026-113957

An attacker who controls the registry, a mirror, or the network path to it may be able to serve arbitrary image content in response to a pull by digest, so that a user runs an image other than the one they pinned. The fix compares the returned digest to the pinned digest and fails the pull on a...

CVE-2026-118590 nipy nibabel Header volumeutils.py array_from_file memory allocation

A security vulnerability has been detected in nipy nibabel up to 5.4.2. The affected element is the function arrayfromfile of the file nibabel/volumeutils.py of the component Header Handler. The manipulation leads to uncontrolled memory allocation. The attack is possible to be carried out remotel...

CVE-2026-118589 nschloe meshio VTK Reader _vtk_42.py memory allocation

A weakness has been identified in nschloe meshio up to 5.3.5. Impacted is an unknown function of the file meshio/vtk42.py of the component VTK Reader. Executing a manipulation of the argument DIMENSIONS can lead to uncontrolled memory allocation. The attack can be executed remotely. The project w...

CVE-2026-118586 dfm feedfinder2 feedfinder2.py find_feeds server-side request forgery

A security flaw has been discovered in dfm feedfinder2 up to 0.0.4. This issue affects the function findfeeds of the file feedfinder2.py. Performing a manipulation results in server-side request forgery. Remote exploitation of the attack is possible. The project was informed of the problem early...

CVE-2026-118585 configuroweb inventariobasico Add Product addlist.php cross site scripting

A vulnerability was identified in configuroweb inventariobasico c9377cdba474deb3eb5a0704d197b5733af16b47/f9db0c0a04d79ad931c218140df4fb23809d4fab. This vulnerability affects unknown code of the file addlist.php of the component Add Product Page. Such manipulation of the argument product name lead...

CVE-2026-86983

A remote attacker may be able to terminate a process that passes attacker-controlled input to the P-384 VOPRF API without bounding its length. This vulnerability is addressed in swift-crypto version 5.0.3...

CVE-2026-118579 D-Link DIR-505 Web Management CGI secmark1524.cgi main backdoor

A weakness has been identified in D-Link DIR-505 1.10B02. The impacted element is the function main of the file /secmark1524.cgi of the component Web Management CGI. This manipulation of the argument accu/pass/code/hash/cmds causes backdoor. The attack is possible to be carried out remotely. The...

CVE-2026-118578 maotoumao MusicFreeDesktop Request Forwarder information disclosure

A security flaw has been discovered in maotoumao MusicFreeDesktop 0.0.6/0.0.7/0.0.8. The affected element is an unknown function of the component Request Forwarder. The manipulation results in information disclosure. The attack can only be performed from the local network. The exploit has been...

CVE-2026-82411 Objects API: Cross-object-type authorization bypass on the object history-detail endpoint

Open Object provides an API and admin interface to manage objects and object types. From 2.4.3 until 2.5.1, 3.6.2, 4.0.2, and 4.1.1, a token scoped to read one ObjectType can read the full versioned record of an object of any other ObjectType via the history-detail endpoint GET...

CVE-2026-85749 MailWatch: IDOR lets any authenticated user release or delete another tenant's quarantined mail

MailWatch for MailScanner is a web-based front-end to MailScanner. Prior to 1.2.27, any authenticated MailWatch user, including the U/user, D/domain-admin, and H/host roles, can release to inbox or permanently delete the quarantined mail of any other user or domain by supplying an arbitrary messa...

CVE-2026-55561 InvoicePlane: Guest user IDOR in quote approval and rejection

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2-beta-1, guest users can approve or reject quotes belonging to any client, not just their assigned clients. The approve and reject methods in the Guest Quotes controller,...

CVE-2026-75520 Domoticz: Missing authorization and path traversal in the udevices Lua parser handler

Domoticz is a free, open source home automation system for Linux, Windows, macOS, and Raspberry Pi. Prior to 2026.3, the udevices JSON command handler, CmdUpdateDevices in main/WebServerCmds.cpp, performed no session.rights check before invoking a Lua parser script, while its sibling command...

CVE-2026-118577 maotoumao MusicFreeDesktop Request Forwarder server-side request forgery

A vulnerability was identified in maotoumao MusicFreeDesktop 0.0.6/0.0.7/0.0.8. Impacted is an unknown function of the component Request Forwarder. The manipulation leads to server-side request forgery. Remote exploitation of the attack is possible. The exploit is publicly available and might be...

CVE-2026-118538 a2ui-project a2ui Renderer root.js Root.renderComponentTree dynamically-determined object attributes

A vulnerability was determined in a2ui-project a2ui up to 0.12.0. This issue affects the function Root.renderComponentTree of the file src/0.8/ui/root.js of the component Renderer. Executing a manipulation can lead to dynamically-determined object attributes. The attack may be launched remotely...

CVE-2026-61575 AVideo-Encoder vulnerable to stored DOM cross-site scripting through queue titles

AVideo is a video-sharing Platform. Prior to 8.1.0, view/queue.php uses pathinfo on the caller-controlled fileURI and stores its filename through setTitle in encoderqueue.title without neutralization. fileURI is not in the objects/security.php filter lists, and the Login::canUpload capability...

CVE-2026-61569 AVideo-Encoder: pre-authentication streamer-login SQL injection

AVideo is a video-sharing Platform. Prior to 8.1.0, the unauthenticated streamer login at objects/login.json.php passes the user parameter to Streamer::get in objects/Streamer.php, where it is interpolated into a single-quoted MariaDB SELECT without parameterization or escaping. Although...

CVE-2026-54453 OpenCATS: Authenticated Remote Code Execution via SettingsUI (manageProfessional)

OpenCATS is an open-source applicant tracking system and recruitment CRM for staffing agencies and hiring teams. Prior to version 0.10.0, the Professional License configuration feature in SettingsUI manageProfessional accepts administrator-controlled license key input that is reconstructed into a...

CVE-2026-61571 AVideo-Encoder: missing authentication on control and status endpoints

AVideo is a video-sharing Platform. Prior to 8.1.0, the encoder lacks a global authentication layer and exposes control and status PHP endpoints to anonymous network callers. view/run.php has a commented-out guard and invokes Encoder::run. view/queue.json.php calls Encoder::getAlltrue, reveals...

CVE-2026-116641 The DB Tools trust certificates issued by recoverable eMudhra intermediate CAs

The DB Tools rely on the TLS implementation in Golang’s standard library, which generally uses the system CA store. However, the crypto/x509 package also has its own internal denylist of known-bad CA certificates. Golang 1.27.3 adds the eMudhra certificates to this list. DB Tools version 100.19.0...

CVE-2026-61572 AVideo-Encoder: unauthenticated full-response server-side request forgery

AVideo is a video-sharing Platform. Before the initial remediation attempt in 8.1.0, urlgetcontents in objects/functions.php accepts caller-controlled destinations after only FILTERVALIDATEURL syntax validation, without rejecting private, loopback, or link-local addresses, and disables TLS peer...

CVE-2026-61573 AVideo-Encoder: reflected cross-site scripting in the login interface

AVideo is a video-sharing Platform. Prior to 8.1.0, the anonymous login interface reflects request values into HTML and JavaScript without output encoding. In view/index.php, webSiteRootURL is returned verbatim by Streamer::getStreamerURL in objects/Streamer.php and reaches navigation and form...

CVE-2026-118537 a2ui Image Player/Video Player/Audio Player Image.js input validation

A vulnerability was found in a2ui up to 0.10.4. This vulnerability affects unknown code of the file src/v09/basiccatalog/components/Image.js of the component Image Player/Video Player/Audio Player. Performing a manipulation of the argument url results in improper input validation. The attack may ...

CVE-2026-54455 OpenCATS: Authenticated SQL injection in activity DataGrid date filters

OpenCATS is an open-source applicant tracking system and recruitment CRM for staffing agencies and hiring teams. Prior to version 0.10.0, activity DataGrid date filtering in home:CallsDataGrid and activity:ActivityDataGrid uses request-controlled period, startDate and endDate parameters without...

CVE-2026-61567 AVideo-Encoder: unauthenticated command execution through streamer login trust

AVideo is a video-sharing Platform. Prior to 8.1.0, the live-streaming endpoint view/videosListToLive.php accepts an attacker-named streamer in webSiteRootURL, calls Login::run in objects/Login.php, and trusts the returned JSON as session state. An unauthenticated remote attacker who can host an...

CVE-2026-61564 AVideo-Encoder: unauthenticated installer PHP code injection

AVideo is a video-sharing Platform. Prior to 8.1.0, the unauthenticated installer endpoint install/checkConfiguration.php assembles videos/configuration.php by interpolating request parameters, including webSiteRootURL, into single-quoted PHP string literals without escaping. An attacker can...

CVE-2026-57448 Blombooru: administrator image-proxy server-side request forgery

Blombooru is a self-hosted personal booru for organizing and tagging private image collections. Prior to 1.40.0, the administrator-only GET /proxy-image endpoint, exposed as /api/booru-import/proxy-image, accepts a url query parameter and fetches it server-side without meaningful destination...

CVE-2026-93851 Path traversal in Mattermost Agents plugin mention reminder allows plugin replacement via crafted post

Mattermost versions 11.9.x = 11.9.1, 11.8.x = 11.8.5, 11.7.x = 11.7.10 fail to validate the target post ID in the Agents plugin's mention reminder component, which allows an authenticated user who can post in a channel visible to a system administrator to cause the administrator's browser to send...

CVE-2026-61546 AnkiMCP: DNS rebinding reaches unauthenticated local AnkiMCP HTTP tools

AnkiMCP is an Anki addon that implements an MCP server, enabling AI assistants to interact with the Anki flashcard application. Prior to version 0.21.0, ankimcpserver/mcpserver.py globally disables FastMCP DNS-rebinding protection through TransportSecuritySettings with...

CVE-2026-118804 Bricks Broken Access Control via query_result Endpoint

Bricks Builder 2.4.3 and before contains a broken access control vulnerability that allows unauthenticated attackers to access restricted post content by submitting crafted poststatus and posttype values in the originalQueryVars parameter to the POST /wp-json/bricks/v1/queryresult REST endpoint...

CVE-2026-118803 Bricks Theme Unauthenticated Dynamic Data Tag Injection via query_result

Bricks Theme 2.4.3 and before contains an unauthenticated dynamic-data tag injection vulnerability that allows anonymous attackers to control the urlParams object in the queryresult REST endpoint, causing the submitted value to be re-parsed as a Bricks dynamic data tag. Attackers can inject tags...

CVE-2026-118756 gopass before 1.17.0 Path Traversal via fs Storage Prune and IsDir

gopass before 1.17.0 contains a path traversal vulnerability in the filesystem storage backend that allows attackers to delete directories outside the password store via ../ entry names in Prune and IsDir. Collaborators with write access to a shared git-synced store can introduce crafted entries,...

CVE-2026-118757 PiWeb Disable payment method / Partial payment for WooCommerce before 1.1.10.9 Missing Authorization via update_fees

PiWeb Disable payment method / Partial payment for WooCommerce before 1.1.10.9 contains a missing authorization vulnerability in the updatefees AJAX handler that allows unauthenticated attackers to modify and read other customers' orders. Attackers can reuse a nonce from their own order-pay page...

CVE-2026-118755 Volmarg Personal Management System through 2.1.0 OS Command Injection via Storage Folder Path

Volmarg Personal Management System through 2.1.0 contains an OS command injection vulnerability that allows authenticated users to execute shell commands via unescaped folder paths in the storage module's tree command. Attackers can create a directory under upload/files containing shell...

CVE-2026-118753 FreeImage (danoli3 fork) before 3.19.25 Heap Buffer Overflow via GIF_PLAYBACK Compositing

FreeImage danoli3 fork before 3.19.25 contains a heap buffer overflow vulnerability in PluginGIF.cpp that allows attackers to write past the canvas allocation via unclipped GIF frame rectangles. Attackers can craft a GIF whose frame left plus width exceeds the logical screen width, causing...

CVE-2026-118754 Dolibarr ERP CRM before 24.0.2 Missing Authorization via public recruitment view.php

Dolibarr ERP CRM before 24.0.2 contains a missing authorization vulnerability in htdocs/public/recruitment/view.php that allows unauthenticated attackers to view unpublished draft job positions. Attackers can enumerate sequential provisional references via the ref parameter to read titles,...

CVE-2026-118752 FreeImage before 3.19.22 Heap Buffer Overflow via IFF/LBM PBM RLE Decoder

FreeImage danoli3 fork before 3.19.22 contains a heap buffer overflow vulnerability in the PBM RLE decoder of PluginIFF.cpp that lacks bounds checks on ByteRun1 runs. Attackers can supply a crafted IFF/LBM PBM file with runs straddling scanline ends to write up to 127 controlled bytes past the...

CVE-2026-118693 CherryTree through 1.7.2 Local File Disclosure via Embedded-File Filename Path

CherryTree through 1.7.2 contains a path traversal vulnerability in CtStorageXmlHelper::createimagefromxml that trusts unvalidated embedded-file 'filename' attributes in XML documents. Attackers can craft a .ctd, .ctz, or .ctx document with an absolute or / filename and no data, so saving embeds...

CVE-2026-118694 python-markdown2 through 2.5.5 Denial of Service via Unclosed Inline Link Destinations

python-markdown2 through 2.5.5 contains a denial of service vulnerability that allows remote users to exhaust CPU by submitting Markdown with unclosed inline link destinations. Attackers can submit repeated 'a' or '!a' sequences, causing findbalanced to rescan the remaining document for each link...

CVE-2026-118692 CherryTree through 1.7.2 OS Command Injection via Custom Web Link Action

CherryTree through 1.7.2 contains an OS command injection vulnerability in CtActions::linkclicked that allows attackers to execute commands by embedding shell metacharacters in web link URLs. When the non-default Custom Web Link Clicked Action option is enabled, attackers can supply crafted...