CVE-2026-102615

HeyForm is an open-source form builder. Prior to 3.0.1, /api/upload accepts a file according to the client-controlled multipart file.mimetype while retaining an HTML filename, and static/upload serves the resulting file as text/html with contentSecurityPolicy: false. An ordinary user can therefor...

CVE-2026-102523

MariaDB server is a community developed fork of MySQL server. From 10.11.1 until 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, ALTER TABLE ... CONVERT ... PARTITION does not apply filename encoding to user-specified partition names before using them in filesystem path construction. An...

CVE-2026-70660

stable-diffusion.cpp is a pure C/C++ library for running diffusion model Stable Diffusion, Flux, Wan, Qwen Image, Z-Image, and more inference. Prior to master-764-e22272e, the safetensors loader in src/modelio/safetensorsio.cpp trusts each tensor's dataoffsets after checking only that nbytes equa...

CVE-2026-70659

stable-diffusion.cpp is a pure C/C++ library for running diffusion model Stable Diffusion, Flux, Wan, Qwen Image, Z-Image, and more inference. From master-742-1a13107 until master-763-4fcc6fe, IMatrixCollector::loadimatrix in src/runtime/imatrix.cpp reuses the values and counts vectors for entrie...

CVE-2026-107891

musl libc before 1.2.7, when an untrusted regular expression is used with regcomp, has multiple integer overflows, possibly leading to incorrect allocation sizes and out-of-bounds heap writes...

CVE-2026-123096

anacrolix/torrent through 1.61.0 contains a memory exhaustion vulnerability in the tracker/http package that allows malicious trackers to crash clients by returning unbounded responses. Attackers controlling an HTTP tracker in a torrent file or magnet link can return huge or gzip-compressed...

CVE-2026-123095

mpv 0.29.0 before 0.42.0 contains a playlist injection vulnerability in the bundled ytdlhook script that allows remote attackers to add unchecked entries by embedding newlines in playlist URLs. Attackers controlling a feed or page can bypass urlissafe to open file:// or av:// inputs, reading loca...

CVE-2026-123094

Huginn before 2026.11.05 contains a stored cross-site scripting vulnerability in the servicelabel helper that marks unescaped OAuth service display names as htmlsafe. Authenticated attackers can connect an OAuth account with a crafted nickname, name or email and share it globally, executing...

CVE-2026-122330

Blosc c-blosc2 before 3.5.0 contains a divide-by-zero vulnerability in blosc2schunkgetslicebuffer in blosc/schunk.c that allows attackers to crash applications by supplying crafted frames with unchecked zero chunksize or blocksize values. Attackers can provide a malicious Blosc2 frame opened via...

CVE-2026-122329

SDLmixer 3.1.2 through 3.2.4 contains a stack-based buffer overflow in FetchXLaw in src/decoderaiff.c due to miscalculated output offsets when expanding A-law or mu-law samples. Attackers can supply a crafted AIFF-C file that overwrites roughly 1 KB of adjacent stack memory when decoded, causing...

CVE-2026-122328

SDLmixer 3.1.2 through 3.2.4 contains a stack-based buffer overflow vulnerability in FetchXLaw of src/decoderwav.c when decoding A-law or mu-law WAV files. Attackers can supply a crafted WAV file whose doubly-offset float expansion overwrites about 1 KB of adjacent stack memory, causing crashes o...

CVE-2026-122327

Meelo through 3.13.1 contains a missing authorization vulnerability that allows authenticated non-admin users to modify shared catalog data because RolesGuard does not require Admin on song, track and video write routes. Attackers can send PUT requests to /songs/:idOrSlug, /tracks/:idOrSlug or...

CVE-2026-122326

Chevereto before 4.5.8 contains an authorization bypass vulnerability in the get-album-contents action of the /json route that allows unauthenticated attackers to list private albums by supplying another user's album id. Attackers with a session token from any public page and an album's encoded i...

CVE-2026-122324

SplitPro through 2.1.6 contains an authorization bypass vulnerability that allows authenticated users to read other users' expenses by supplying arbitrary expenseId values to expense.getExpenseDetails. Attackers who obtain an expense UUID, such as removed former participants, can retrieve expense...

CVE-2026-122317

SplitPro through 2.1.6 contains an authorization bypass vulnerability that allows authenticated users to retrieve any account's details by supplying arbitrary userId values to user.getUserDetails. Attackers can iterate sequential integer user ids to harvest every user's email, name, avatar,...

CVE-2026-66903

Authenticated Path Traversal in Catalog Image Management allows writing image files outside the intended directory in Apache OFBiz. This issue affects Apache OFBiz: before 24.09.08. Users are recommended to upgrade to version 24.09.08, which fixes the issue...

CVE-2026-71901

Improper Control of Resource Identifiers 'Resource Injection' vulnerability in Apache OFBiz. An authenticate user with access to sfa component can override the service to use on vcard import and access to other service. This issue affects Apache OFBiz: before 24.09.08. Users are recommended to...

CVE-2026-68524

An unauthenticated attacker can exploit temporary-file handling, access an open file descriptor, and inject a "file:" URI to cause OFBiz to load an attacker-controlled Screen definition. This issue affects Apache OFBiz: before 24.09.08. Users are recommended to upgrade to version 24.09.08, which...

CVE-2026-73577

Incorrect authorization in RequestHandler in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote unauthenticated attacker to bypass the authentication requirement of a protected view by appending it as a path suffix to a public request e.g.,...

CVE-2026-73578

Missing authorization enforcement in RequestHandler.renderView in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote unauthenticated attacker to bypass the request-map authentication policy for protected views by supplying a crafted LASTVIEWNAME value, which is stored as saved-vi...

CVE-2026-73580

Missing authorization check in the getHRChild service in Apache OFBiz through 24.09.07 on all platforms allows a remote unauthenticated attacker to recursively enumerate Human Resources organization and employee data, including department names and identifiers, employment position names and...

CVE-2026-74841

In multitenant deployments, ContextFilter and LoginWorker built a per-tenant delegator name from a request-supplied userTenantId parameter and requested a delegator for it before confirming the tenant existed. DelegatorFactory's internal cache retains every delegator name it is asked to resolve,...

CVE-2026-76150

Path traversal and missing authorization check in the replaceImageToExistImage service in Apache OFBiz through 24.09.07 on all platforms allows a remote authenticated attacker with only Catalog view permission to overwrite arbitrary files writable by the OFBiz process with JPEG-encoded content vi...

CVE-2026-81734

Missing Authorization in ProductEvents in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote authenticated attacker holding only catalog view permission to create, modify, or remove arbitrary product, product feature association, and product category association data by directly...

CVE-2026-76152

Path traversal and missing authorization check in the imageCrop and imageRotate services in Apache OFBiz through 24.09.07 on all platforms allows a remote authenticated attacker with only Catalog view permission to read arbitrary image-parseable files readable by the OFBiz process, disclosed via...

CVE-2026-81744

Incorrect Authorization in ContentPermissionServices in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote authenticated attacker holding only a limited content-create permission to self-grant the OWNER role on arbitrary content by invoking the createContentRole service e.g. via...

CVE-2026-81808

Missing Authorization in ProductSearchEvents in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote authenticated attacker holding only catalog view permission to bulk-modify product category and feature associations across arbitrary search results by seeding a broad product searc...

CVE-2026-81815

SQL Injection in the entity engine's generic performFind service in Apache OFBiz 24.09 before 24.09.08 on MySQL/MariaDB-backed deployments allows a remote unauthenticated attacker to disclose arbitrary rows from the queried entity by submitting an ignore-case find request e.g. ic=Y with a crafted...

CVE-2026-81816

XML External Entity XXE Injection in ContentWorker in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote authenticated attacker holding content-author permission to read arbitrary server files and trigger server-side request forgery by storing a crafted text/xml DataResource...

CVE-2026-81828

Server-Side Request Forgery in SurveyWrapper in Apache OFBiz 24.09 before 24.09.08 on all platforms allows an authenticated back-office user holding catalog permission to cause the server to fetch and render attacker-controlled URLs — including internal network and cloud-metadata endpoints and...

CVE-2026-82894

Improper Authorization in ContentWorker in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote unauthenticated attacker to trigger arbitrary OFBiz service invocation with attacker-controlled parameters, resulting in arbitrary file write, arbitrary file deletion, and server-side...

CVE-2026-82902

Server-Side Request Forgery in ViewDataFile in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote authenticated attacker holding only the base webtools permissions OFBTOOLSVIEW, WEBTOOLSVIEW to cause the server to issue arbitrary outbound HTTP requests, and an attacker additional...

CVE-2026-82904

Uncontrolled Resource Consumption in ServiceMultiEventHandler in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote unauthenticated attacker to pin a server request thread for an attacker-chosen number of synchronous service dispatches, up to the signed-integer maximum, by...

CVE-2026-82907

Authentication Bypass by Capture-replay in ExternalLoginKeysManager in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote unauthenticated attacker who captures a live externalLoginKey value to obtain a complete, cookie-free, reusable session as the user who issued it, in every...

CVE-2026-82910

Improper Neutralization of Special Elements Used in a Template Engine 'Server-Side Template Injection' in MacroScreenRenderer in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote authenticated attacker holding only the two view permissions of a control-servlet webapp e.g...

CVE-2026-82912

Improper Neutralization of Special Elements Used in an Expression Language Statement 'Expression Language Injection' in EmailServices in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote authenticated attacker holding only OFBTOOLSVIEW and ACCOUNTINGVIEW, the two view-level...

CVE-2026-82916

Missing Authorization in XmlDsDump in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote authenticated attacker holding only the webtools base permissions OFBTOOLSVIEW, WEBTOOLSVIEW — explicitly not the ENTITYMAINT permission the export feature declares and visibly refuses to...

CVE-2026-82960

Improper Control of Generation of Code 'Code Injection' in ModelFormField in the Apache OFBiz cms plugin before 24.09.08 on all platforms allows a remote authenticated attacker holding only CMS content-editor access to execute arbitrary operating system commands as the OFBiz process user via a...

CVE-2026-83538

Missing Authorization in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote unauthenticated attacker to disclose internal business records — including organization, employee, product catalog, and product-store data — by requesting several helper endpoints across the Human...

CVE-2026-83542

Improper Control of Generation of Code 'Code Injection' in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote unauthenticated attacker to execute arbitrary code on the server by staging crafted widget XML in a multipart upload and overriding the mainDecoratorLocation used by a...

CVE-2026-84183

Incorrect Authorization in the updateLayout simple-method in applications/content/minilang/layout/LayoutEvents.xml in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote authenticated attacker holding only OFBTOOLSVIEW and CONTENTMGRVIEW to execute arbitrary commands as the OFBiz...

CVE-2026-84728

Incorrect Authorization in Apache OFBiz 24.09 before 24.09.08 on all platforms, when documented multitenancy is enabled, allows a remote authenticated attacker holding only a valid low-privilege account in one tenant to read and write data belonging to a different tenant, by submitting their own...

CVE-2026-85627

Improper Neutralization of Special Elements Used in a Template Engine 'Server-Side Template Injection' in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote authenticated attacker holding only a stock non-administrative account to execute arbitrary operating system commands as th...

CVE-2026-92887

Incorrect default value in the REST API framework's .rest.xml definition parser ModelApiReader in Apache OFBiz through 24.09.07 on all platforms allows a remote, unauthenticated attacker to invoke a REST API operation without providing valid credentials via a .rest.xml resource or operation...

CVE-2026-97355

Use of Hard-coded Password vulnerability in the AdminServer component in Apache OFBiz 24.09.07 on all platforms allows an attacker able to reach the AdminServer control port to query the server's running state and trigger an unauthenticated shutdown of the instance via the fixed default control k...

CVE-2026-123024

A vulnerability has been found in agentscope-ai AgentScope up to 2.0.11. This impacts the function getcurrentuserid of the file src/agentscope/app/deps.py of the component Agent Service. Such manipulation of the argument X-User-ID leads to missing authentication. The attack can be executed...

CVE-2026-97356

External Control of File Name or Path vulnerability in the ViewFile component of Label Manager in Apache OFBiz 24.09.07 on all platforms allows an authenticated user holding only the LABELMANAGERVIEW permission to read arbitrary properties and xml files on the server, including the generated JWT...

CVE-2026-100168

Direct Request 'Forced Browsing' in the Content Manager component in Apache OFBiz 24.09.07 on all platforms allows an authenticated user holding only view-only content permissions OFBTOOLSVIEW and CONTENTMGRVIEW to re-parent content associations they do not own or manage via a direct POST request...

CVE-2026-100228

Improper Input Validation in Order Returns in Apache OFBiz 24.09.07 on all platforms allows an authenticated user without the ORDERMGRCREATE permission to persist an arbitrary price on a return item via the createReturnItem service, bypassing the intended server-computed price ceiling. Users are...

CVE-2026-105325

Missing check for ACCOUNTINGUPDATE / ACCOUNTINGCREATE in accounting in allows user with only ACCOUNTINGVIEW permission to update/create PaymentApplication. Affected versions before : 24.09.08 Users are recommended to upgrade to version 24.09.08 which fixes this issue...