CVE-2026-68549

ClickMigrate is a database migration tool for ClickHouse with automatic SQL migration management and version tracking. Prior to version 1.0.3, a path traversal vulnerability in the revision command allowed a crafted migration name supplied via the -m argument to escape the intended migrations...

MSC-2026-13715

aurum-pay poses as a payment SDK for an online casino site. On the first API call, AurumPay.request runs a hidden routine that fetches a shell command from aurum-casino.com/sdk/ping and executes it in the background, through hidden PowerShell on Windows or bash on Linux and macOS, with all output...

CVE-2026-126626

The web services listener of Progressive Robot hMailServer 6.3.3 through 6.3.7 counts every failed CardDAV, CalDAV or Autodiscover sign-in from a proxy it trusts - one on the same machine, or one named in WebServicesTrustedProxies, whose X-Forwarded-Proto it believes - against the proxy's own...

CVE-2026-126621

Progressive Robot hMailServer 6.0.0-B1 through 6.3.7 on Windows hands OpenSSL the names of its own TLS files - the listeners' certificates, chains, private keys and Diffie-Hellman parameters, a port's client-certificate CA file from 6.2.19, the object store's CA file from 6.3.4 and the ACME...

CVE-2026-126619

Misinterpretation of SQL statement text in the database layer of Progressive Robot hMailServer 6.0.0-B1 through 6.3.7 allows a remote unauthenticated attacker to have a failed database write reported to the server as successful. The layer answers a failed statement as a success when it finds the...

CVE-2026-126617

SQL injection in the database layer of Progressive Robot hMailServer 6.0.0-B1 through 6.2.18, when the server uses MySQL/MariaDB or PostgreSQL, allows a remote attacker to alter SQL statements the server runs. On those two engines parameters are not bound: SQLStatement::GenerateFromCommand wrote...

CVE-2026-126618

The auto-ban of Progressive Robot hMailServer 6.0.0-B1 through 6.3.7 can be kept from banning an address after repeated failed logons, which allows a remote unauthenticated attacker who can connect from two or more addresses to go on guessing account passwords - over SMTP AUTH, IMAP and POP3, and...

CVE-2026-126616

The auto-ban of Progressive Robot hMailServer 6.2.0 through 6.3.3, with a MySQL or MariaDB database, can be kept from banning an address after repeated failed logons, which allows a remote unauthenticated attacker to go on guessing account passwords from a single address without being banned. The...

CVE-2026-126615

The sign-in of Progressive Robot hMailServer 6.2.22-pre2 through 6.3.7 takes for an account names that are not its address but under which the database's own comparison finds it, while the per-name lockout and the compromised-account hold are kept by the name as the client gave it. This allows a...

CVE-2026-126614

The web services listener of Progressive Robot hMailServer 6.3.3 through 6.3.7 does not apply the server's IP ranges to the connections it accepts, which allows a remote unauthenticated attacker to go on guessing account passwords at the listener's sign-ins after the auto-ban has banned the...

CVE-2026-126625

Incorrect default permissions in the Windows installer of Progressive Robot hMailServer 6.3.7 allow a local authenticated user to run code as the administrator who installs the product, when it is installed into a new program folder in a location whose permissions let every user write, such as th...

CVE-2026-126624

Unverified ownership in the Windows installer of Progressive Robot hMailServer 6.3.7 allows a local authenticated user to run code as the mail server's service account or as an administrator when setup installs into, or upgrades, a program folder that accounts other than the administrators could...

CVE-2026-126623

Inefficient algorithmic complexity in the JSON reader of Progressive Robot hMailServer 6.3.6 and 6.3.7 allows a remote attacker to hold the server's mail delivery threads or its REST API's worker threads, making mail delivery, the REST API and the webmail unavailable. 6.3.6 fixed CVE-2026-107574,...

CVE-2026-126622

Incorrect default permissions in the Windows installer of Progressive Robot hMailServer 6.3.7 allow a local authenticated user to run code as the administrator who runs setup, when the server is installed into a program folder that is already there and that accounts other than the administrators...

CVE-2026-126613

Allocation of resources without limits in the JSON reader of Progressive Robot hMailServer 6.3.2 through 6.3.7 allows a remote attacker to exhaust the server's memory and hold its threads, making mail delivery, the REST API and the webmail unavailable. The reader built a tree of values far larger...

CVE-2026-126612

Improper link resolution in the Windows installer of Progressive Robot hMailServer 6.0.0 through 6.3.7 allows a local authenticated user to run code as the mail server's service account or as an administrator when the path to the program folder passes through a junction, a symbolic link or a moun...

CVE-2026-126610

Progressive Robot hMailServer 6.3.4 through 6.3.7, with a MySQL or MariaDB database and TlsMode=verify-full, does not hand the database client the CA file that TlsCaFile names when the file's name contains a character outside ASCII on Linux, or above U+00FF on Windows, which allows an attacker wh...

CVE-2026-126611

Progressive Robot hMailServer 6.3.4 through 6.3.7, with a MySQL or MariaDB database, TlsMode=verify-full and no TlsCaFile, does not verify the database server's certificate's issuer or name when the connection is one that MariaDB Connector/C treats as local - Server= set to 127.0.0.1, ::1 or...

CVE-2026-126607

Progressive Robot hMailServer 6.2.3 through 6.3.7 on Windows, with a MySQL or MariaDB database, hands the bundled MariaDB Connector/C the folder of its authentication plugins the plugin folder in the installation's Bin folder as Latin-1 bytes, which the client reads in the system's ANSI code page...

CVE-2026-126609

Progressive Robot hMailServer 6.2.25 through 6.3.7 on Windows, with a PostgreSQL database, the connection's sslmode require, verify-ca or verify-full, and a root certificate file named by PostgreSQLSslRootCert from 6.2.25 or, with TlsMode=verify-full and neither PostgreSQL key set, by TlsCaFile...

CVE-2026-116468

A flaw was found in the group-move and organization group reparenting endpoints of the keycloak-services component. This component is responsible for core authentication and authorization services in the Red Hat build of Keycloak. The issue occurs because the system fails to check if a target...

CVE-2026-118368

Akaunting 3.3.0 contains a stored cross-site scripting vulnerability in the XLSX item-import workflow. An authenticated Manager can import an item whose name contains HTML. When another authenticated user selects that item while creating a document, Akaunting places the stored name in an invoice ...

CVE-2026-59191

TwigView plugin for CakePHP provides wrappers for common View operations and extensions that expose CakePHP functions and jasny/twig-extensions helpers. Prior to versions 1.3.3 and 2.1.2, if FileLoader::findTemplate is supplied un-validated user controlled data, arbitrary files can be read. This...

CVE-2026-59192

TwigView plugin for CakePHP provides wrappers for common View operations and extensions that expose CakePHP functions and jasny/twig-extensions helpers. Prior to versions 1.3.3 and 2.1.2, the unserialize filter has no restriction on which classes are allowed. This can used as a deserialization...

CVE-2026-64686

OpenSearch Dashboards is an open-source data visualization tool designed to work with OpenSearch. From versions 2.14.0 to before 2.19.6, and 3.0.0 to before 3.7.0, a Server-Side Request Forgery SSRF vulnerability in OpenSearch Dashboards exists in the fetchDataSourceMetaData route. The sibling...

CVE-2026-64678

NOsql Object NO2 a.k.a Nitrite database is an open source nosql embedded document store. Prior to version 4.4.1, when Nitrite opens a database file, MVStoreUtils.openOrCreate automatically checks for a legacy v1-format store and, on detecting one or hitting a compatibility error while opening,...

CVE-2026-64682

AstroBlocks is a block-first CMS for Astro projects. Prior to version 3.4.0, admin session tokens can be forged due to a hard-coded fallback JWT secret and a mismatched environment variable name. An attacker who knows the public fallback value readable in the published package can forge a valid...

CVE-2026-64669

pamusb provides hardware authentication for Linux using removable media. From version 0.8.0 to before version 0.9.3, the denyremote feature in pamusb uses /usr/bin/w -i to detect whether the authenticating user has an active remote tmux session. In pusbtmuxhasremoteclients src/tmux.c, the IPv6...

CVE-2026-64667

pamusb provides hardware authentication for Linux using removable media. Prior to version 0.9.3, src/local.c pusbgetttyfromdisplayserver allocates a 4096-byte cmdline buffer, reads up to 4096 bytes from /proc//cmdline, then replaces every NUL separator with a space. When read2 returns exactly 409...

CVE-2026-64666

pamusb provides hardware authentication for Linux using removable media. Prior to version 0.9.3, src/local.c reads XRDPSESSION with plain getenv3 at the head of pusblocallogin while every other env consumer in the same function uses securegetenv3. When pamusb.so loads into a setuid PAM host, the...

CVE-2026-64668

pamusb provides hardware authentication for Linux using removable media. From version 0.8.0 to before version 0.9.3, the denyremote feature in pamusb uses /usr/bin/w -i to detect whether the authenticating user has an active remote tmux session. In pusbtmuxhasremoteclients src/tmux.c, the IPv6...

CVE-2026-64670

Waline is a comment system with backend support. In versions 3.15.2 and prior, @waline/client renders the comment editor's live preview with marked and no sanitizer utils/markdown.ts, and the preview is injected with v-html. When a comment is edited, the editor is seeded with the comment's raw,...

CVE-2026-64671

Waline is a comment system with backend support. In versions 3.15.2 and prior, the @waline/client UserList widget builds its DOM by concatenating server-returned commenter fields directly into root.innerHTML with no HTML escaping. The commenter nick and link are stored and returned verbatim by th...

CVE-2026-97054

For HTTP/1 servers, when MaxBytesReader's limit is exceeded, "Connection: close" header is automatically set without synchronization, which might race with another header being set explicitly in the server handler. As a result, an HTTP/1 server that utilizes MaxBytesReader or MaxBytesHandler can...

CVE-2026-97033

Building a malicious package that uses cgo could cause arbitrary code execution at build time through several compiler and linker flags permitted in "cgo" directives. Specifically, "--sysroot" in GCC and Clang relocates compiler subprograms, spec files, and CRT startup objects to an...

CVE-2026-97034

When using GCC, building a malicious package that uses cgo could cause arbitrary command execution at link time via untrusted GCC spec files "specs" or ".spec". When linking with "-fopenmp", "-fopenacc", or "-fsanitize=" in "cgo LDFLAGS", GCC's built-in link spec evaluates "%:includelibgomp.spec"...

CVE-2026-97035

When using Clang or GCC, building a malicious package that uses cgo could cause unexpected code execution at build time or write files to arbitrary directories via "-gen-" or "-gnat" flags in "cgo" directives. The "-g" wildcard in the compiler and linker flag allowlists previously matched Clang's...

CVE-2026-97037

Building a malicious package that uses cgo could cause arbitrary code execution at link time by passing linker script files to the host linker via "cgo LDFLAGS". Split "-Wl," flags that consume a following argument such as "-Wl,-rpath", "-Wl,--just-symbols", and "-Wl,-undefined" previously accept...

CVE-2026-97036

On Darwin, building a malicious package that uses cgo could cause arbitrary code execution when using the Apple linker due to passing "-l tolibrary " in a "cgo LDFLAGS" directive. The Apple linker recombines the separated arguments "-l" and "tolibrary" into "-ltolibrary", which loads an arbitrary...

CVE-2026-97039

Building a malicious package that uses "cgo pkg-config:" directives could load untrusted pkg-config ".pc" files or inject unvalidated compiler and linker flags. The pkg-config flag allowlist previously permitted "--with-path=" and "--personality=", allowed "--define-variable=" values beginning wi...

CVE-2026-97040

Building a package containing a crafted ".syso" file could bypass cgo flag validation and inject arbitrary linker flags when linking. When loading ".syso" entries from a package archive, the linker only checked for recognized host object headers ELF, Mach-O, PE, and XCOFF before falling through t...

CVE-2026-97042

Building a malicious package that uses "//go:cgoimportdynamic" or links against a crafted PE object on Windows could pass unsafe library arguments to the external linker. The compiler only checked the first character of the library name in "//go:cgoimportdynamic" directives and skipped validation...

CVE-2026-97038

Building a malicious package containing ".syso" files or cgo linker inputs could inject arbitrary linker flags or execute arbitrary code at link time. Linker input files—including ".syso" files, direct object or library inputs in "cgo LDFLAGS", and libraries in "-L" directories—were passed to the...

CVE-2026-97041

Building a malicious package containing "//go:cgo" compiler directives could inject arbitrary flags into the external linker invocation on ELF platforms. The compiler and linker did not reject commas in "//go:cgoimportdynamic", "//go:cgoexportdynamic", "//go:cgoexportstatic",...

CVE-2026-97043

Building a malicious package that uses cgo could bypass "cgo LDFLAGS" validation and cause unexpected code execution at build time, or cause the go command to panic, via crafted quoting in "//go:cgoldflag" directives. When "cmd/cgo" generates "cgogotypes.go", it quotes each "cgo LDFLAGS" argument...

CVE-2026-116645

LimeSurvey Community Edition 7.8.0 contains an SQL injection vulnerability in the survey-archive participant import and SPSS-response export workflow. An authenticated user with global surveys.create permission can import a crafted .lsa archive whose participant XML creates an attacker-named...

CVE-2026-63660

node-fontnik is a library that delivers a range of glyphs rendered as SDFs signed distance fields in a protocol buffer. Prior to version 0.7.7, a crafted font could trigger a heap out-of-bounds write in RenderSDF include/mapbox/glyphfoundryimpl.hpp. RenderSDF computed the SDF bitmap allocation si...

CVE-2026-126570

Padloc 4.0.0 before 4.3.1 contains a prototype pollution vulnerability that allows SCIM token holders to modify Object.prototype by sending crafted SCIM PATCH paths to ScimServer.handleScimUsersPatch. Attackers can supply paths like proto.x or constructor.prototype.x passed to setPath to pollute...

CVE-2026-126571

Padloc 4.0.0 before 4.3.1 contains an authentication bypass vulnerability in the legacy retrieveMFAToken handler that never counts wrong email verification codes toward the attempt limit. Unauthenticated attackers knowing a victim's email can brute force the 6-digit code to obtain verification...

CVE-2026-126569

Mbin 1.2.1 before 1.11.1 contains a stored cross-site scripting vulnerability in EmbedElement::buildDestructed that renders nested Markdown image alt text and URL without HTML escaping. Authenticated users can embed HTML in the alt text of an image inside a link in entries, comments, posts,...