CVE-2026-78192

WebDyne versions from 2.022 before 3.022 for Perl disclose application source to unauthenticated clients via the viewer in the default index page. WebDyne's wrapper scripts, such as webdyne.psgi, enable the built-in index page by default. Its source viewer returns files under the document root...

CVE-2026-78191

WebDyne versions from 2.031 before 3.022 for Perl execute files with .psp anywhere in the name as Perl pages. WebDyne decides whether to run a requested file as a page by matching its name against WEBDYNEPSPEXTRE, which has no end anchor. An application that accepts uploads by checking only the...

CVE-2026-78190

WebDyne versions from 2.014 before 3.022 for Perl reflect request parameters unescaped into form field values, allowing cross-site scripting. The textfield, passwordfield and filefield tags fill their value attribute from the request parameter of the same name. WEBDYNECGIAUTOESCAPE, which control...

CVE-2026-78189

WebDyne versions from 3.007 before 3.022 for Perl execute .psp files outside the document root via path traversal in the PSGI API route fallback. When a request matches no file, the PSGI handler retries it as an API route through apifilename. That keeps .. segments in the request path and only...

CVE-2026-78188

WebDyne versions from 2.014 before 3.022 for Perl issue session cookies without the Secure, HttpOnly and SameSite attributes. WebDyne::Session sets its session cookie with only a name, value and path. Browsers then send the session ID over plain HTTP and with cross-site requests, and expose it to...

CVE-2026-120194

A flaw was found in json-glib. The JSONPath slice evaluator used by jsonpathquery can enter an infinite loop when given a slice expression with a negative step. An application that evaluates attacker-controlled JSONPath expressions can be forced into a hang, leading to a denial of service...

CVE-2026-118599

A file overwrite vulnerability exists in Epiphany when installing WebExtension packages from .xpi files. In src/webextension/ephy-web-extension-manager.c, decompressxpithread used libarchive with archivereadsupportformatall and filters, so the installer did not require a real ZIP. A TAR file name...

CVE-2026-118598

A logic error in Epiphany's site permission handling can cause camera and microphone access to be granted when the user only approves a different permission. In src/ephy-window.c, setpermission stores the user's Allow/Deny choice after a WebKit permission dialog. Types CLIPBOARD and...

CVE-2026-117681

A flaw was found in konflux-ci. This vulnerability allows privilege escalation when the user interface proxy automatically disables Transport Layer Security TLS certificate verification for connections to internal backend services in environments lacking a default service certificate authority...

CVE-2026-96630

Adminer blocks "ATTACH" queries for SQLite to prevent arbitrary file creation. However, "VACUUM INTO" is not blocked and achieves the same result: writing a database file containing attacker-controlled PHP code to any path with any extension. An authenticated SQLite user can write a web shell to...

CVE-2026-54442

The URL validation regex "^https?:/?/." added to emissary's "NavAction.java" allows protocol-relative URLs "//evil.com/..." and single-slash scheme variants "http:/evil.com" to bypass validation, enabling SSRF and open redirect attacks...

CVE-2026-96633

AdminNeo allows an authenticated SQLite-mode user to delete arbitrary files writable by the PHP process through the database-list drop action. The SQLite driver validates file extensions when creating or renaming databases, but the database-list drop path passes submitted "db" values directly to...

CVE-2026-96634

This vulnerability is a patch bypass that exploits catastrophic backtracking in a regular expression used to filter ATTACH statements in AdminNeo's SQLite functionality. The original vulnerability CVE-2021-43008 allowed authenticated users to create PHP files through SQLite ATTACH statements,...

CVE-2026-96632

AdminNeo inserts the database server's version string into a "" tag that carries a valid CSP nonce, without any sanitization. A rogue database server can return a crafted version string that breaks out of the JavaScript context and executes arbitrary code. Because the script tag already has a val...

CVE-2026-96629

AdminNeo's CSRF protection uses a BREACH-resistant XOR masking scheme, but the implementation transmits both the XOR mask and the masked value in every token. This allows any observer who sees a single CSRF token via network sniffing, log files, Referrer header, or XSS to instantly recover the...

CVE-2026-96631

AdminNeo versions 4.6.0 through at least 5.5.0 are vulnerable to cookie attribute injection via the "X-Forwarded-Prefix" HTTP header. An attacker who can influence this header e.g., through a reverse proxy that forwards it from clients, an attacker-controlled upstream proxy, or a man-in-the-middl...

CVE-2026-110176

The File Force Download module for Drupal 7 implements hookfiledownload to add a Content-Disposition header when a file URL carries the download query parameter. In Drupal 7, returning a non-empty header array from that hook is itself a grant of access to the file. In versions 7.1.0 through 7.1.2...

CVE-2026-77152

Improper Authorization vulnerability in Drupal Field Collection for Drupal 7 allows a user with the "edit field collections" permission to bypass access control on the parent host entity. The access check for field collection items fieldcollectionitemaccess granted edit and delete access to any...

CVE-2026-117656

Acceptance of Extraneous Untrusted Data With Trusted Data vulnerability in the Sign in with Apple strategy in pow-auth Assent allows an unauthenticated remote attacker to impersonate another user via the user parameter of the authorization callback. Apple posts the user's name to the callback...

CVE-2026-63414

Shopify App is a Rails engine for building Shopify applications. From 22.1.0 until 23.0.3, "token-exchange" authenticated controllers can expose a request-derived "shop" context instead of the identity from a verified Shopify ID token or active Shopify session. "currentshopifydomain" can resolve ...

CVE-2026-63410

secp256k1-native is a native C secp256k1 implementation for Ruby. In affected native builds, native constant-time scalar multiplication through "Pointmul" or "scalarmultiplyct" can leak timing information about a secret scalar when compiled by a toolchain that reconstructs branchless selection in...

CVE-2026-63400

Coop is an open source review and moderation tool from ROOST. Prior to 1.0.2, "resetPasswordForToken" updates the password row without invalidating database-backed sessions. An attacker who has acquired a password and established a session retains access even after the legitimate user resets the...

CVE-2026-63398

Coop is an open source review and moderation tool from ROOST. Prior to 1.0.2, the SAML strategy's verify callback resolved the authenticated user by email alone using "kyselyUserFindByEmail", without binding the lookup to the organization in "/saml/login/:orgId/callback". An attacker who...

CVE-2026-63401

Coop is an open source review and moderation tool from ROOST. Prior to 1.0.2, "addAccessibleQueuesForUser" and "removeAccessibleQueuesForUser" accepted arbitrary "queueId" and "userId" values without organization scoping. An authenticated user belonging to one organization and holding MRT...

CVE-2026-63396

Coop is an open source review and moderation tool from ROOST. Prior to 1.0.0, an unauthenticated actor can query "Query.allOrgs" through "/api/v1/graphql" on a publicly accessible deployment and obtain data for all organizations, including organization IDs, names, email addresses, website URLs an...

CVE-2026-63399

Coop is an open source review and moderation tool from ROOST. Prior to 1.0.0, the "GraphQL" "Mutation.createOrg" operation allows an unauthenticated actor to create arbitrary organizations on a publicly accessible instance. In addition to creating noise in the logs, the lack of rate limiting coul...

CVE-2026-63402

i18next is an internationalization framework for JavaScript. Prior to version 26.3.4, "deepExtend" in "src/utils.js" checks property existence with the in operator and recurses into inherited built-ins reached through "Object.prototype". An application must explicitly pass attacker-controlled...

CVE-2026-63339

IXP Manager is a full-stack web application for managing Internet Exchange Points. Prior to version 7.3.0, an authenticated, non-administrative user can elevate their privileges to administrator status. Restricting administrative functions reduces exposure but is not a complete fix. This issue is...

CVE-2026-63338

IXP Manager is a full-stack web application for managing Internet Exchange Points. Prior to version 7.3.0, an authenticated user can view and edit a resource belonging to another user without authorization. The API-key edit/update path in "ApiKeyController" selects records by identifier without...

CVE-2026-63393

OpenSearch SQL supports querying OpenSearch data using SQL and Piped Processing Language. In the 2.x line from 2.8.0.0 until 2.19.6.0, and the 3.x line prior to 3.7.0.0, a remote authenticated user with basic read/search permissions can provide a crafted "cursor" parameter to the "plugins/sql"...

CVE-2026-63378

TAKO AI Agent for Okta is a local-first AI agent that helps Okta administrators query tenant data using natural language. Prior to 3.0.1-beta, any authenticated user with a valid "fctrsession" cookie can submit arbitrary Python source in the "scriptcode" field of "POST /api/react/execute-script",...

CVE-2026-63377

TAKO AI Agent for Okta is a local-first AI agent that helps Okta administrators query tenant data using natural language. Prior to 3.0.1-beta, "POST /api/auth/setup" in "src/api/routers/auth.py" allows an unauthenticated network attacker to create the first administrator account before the...

CVE-2026-63346

Refitter is a tool for generating a C REST API client using the Refit library. Prior to 2.1.2, the header parameter name in "parameters.name" with "in: header" is emitted verbatim into a Refit "Header""" attribute string without escaping quotation marks. An attacker-influenced OpenAPI description...

CVE-2026-63344

Refitter is a tool for generating a C REST API client using the Refit library. Prior to 2.1.2, content-type keys in the content maps of "requestBody/responses" are emitted verbatim into a Refit "Headers"Accept: ", "Content-Type: "" attribute string without escaping quotation marks. A crafted...

CVE-2026-63345

Refitter is a tool for generating a C REST API client using the Refit library. Prior to 2.1.2, OpenAPI "paths"-object keys are emitted verbatim into Refit route attributes such as "Get""" without escaping quotation marks or restricting characters. An attacker-influenced single-line, slash-prefixe...

CVE-2026-61725

sevenz-rust2 is a Rust-native 7z compressor and "decompress"or. Prior to 0.21.1, extracting an attacker-supplied 7z archive can write or overwrite files outside the destination directory. In "src/util/decompress.rs", "decompressimpl" computes each destination with "dest.joinentry.name" without...

CVE-2026-63341

Aedes is an MQTT broker that can run on any stream server. Prior to 1.1.1, the MQTT broker does not bound topic depth or structural complexity before passing topics through "mqemitter" into "qlobber". A "PUBLISH", "SUBSCRIBE", or registered "Will" message containing an excessively deep topic can...

CVE-2026-63121

Kubewarden policies is a collection of WebAssembly policies for securing and governing Kubernetes clusters. For versions provisionally classified as affected before 2.1.2, "trusted-repos-policy" compares an image's "registry" hostname against "reject lists" and "allow lists" case-sensitively even...

CVE-2026-62277

LubeLogger is a self-hosted, open-source, web-based vehicle maintenance and fuel mileage tracker. Prior to 1.6.8, "PrintRecordStickers" in "/Controllers/VehicleController.cs" checks through "CollaboratorFilter" that the authenticated caller can view the supplied "vehicleId", but fetches...

CVE-2026-63224

OpenRemote is an open-source internet-of-things platform. Prior to 1.26.0, the "datapoint export" API constructs "CSV crosstab" SQL by concatenating an "asset name" and "attribute name" into a "COPY" query that uses "crosstab" and streams "TO STDOUT". The "asset name" enters both a double-quoted...

CVE-2026-63201

Netopeer2 is a server for implementing network configuration management based on the "NETCONF" Protocol. In affected versions, a low-privileged authenticated "NETCONF" user can remotely crash "netopeer2-server" by sending a "get RPC" with an invalid "subtree filter" whose text contains format...

CVE-2026-55614

uhttpd is a small HTTP server. In unpatched repository snapshots, "clientparseheader" in "client.c" lowercases header names but compares the "Transfer-Encoding" value to "chunked" using case-sensitive "strcmp". A mixed-case transfer-coding token is accepted without enabling "r-transferchunked",...

CVE-2026-55612

uhttpd is a small HTTP server. In unpatched repository snapshots, "clientpollpostdata" in "client.c" consumes an invalid chunk-length line, such as a size exceeding INTMAX, then clears "r-contentlength" and "r-transferchunked" without draining the remaining body or setting...

CVE-2026-55613

uhttpd is a small HTTP server. In unpatched repository snapshots, "uhubusdatasend" in "ubus.c" can desynchronize HTTP request boundaries when a "POST /ubus" JSON body arrives in multiple TCP segments. An initial segment completing a JSON object sets "du-jsobj"; a later segment takes the...

CVE-2026-63184

Refitter is a tool for generating a C REST API client using the Refit library. Prior to 2.1.1, the "refitter" dotnet tool invokes "NJsonSchema" with unsafe defaults for "$ref" resolution when generating Refit interfaces and contracts from attacker-controlled or attacker-influenced OpenAPI...

CVE-2026-63182

LightSAML implements SAML 2.0 data model classes, XML serialization and deserialization, XML security, certificate support, and message bindings. Prior to 4.7.1 and 5.0.1, LightSAML and xmlseclibs disagree about which assertion an inbound SAML signature covers. "Response::deserialize" uses...

CVE-2026-62347

Element Call is a native Matrix video conferencing application. From 0.16.0 until 0.20.3, the standalone Element Call "SPA" logs the "password" URL query parameter. When a user submits an error report, called a rageshake, these logs are shared with the application operator. Users can therefore...

CVE-2026-63115

ActivityPub is a multi-tenant ActivityPub server for Ghost, built with Fedify. From 1.0.0 until 1.2.6, the "Undo" handler allows a remote federated server to cause the service to act on a "follow" or "repost" as though the activity came from a different account. This permits removal of an existin...

CVE-2026-55146

LORIS Longitudinal Online Research and Imaging System is a self-hosted web application that provides data- and project-management for neuroimaging research. In versions from 16.0.0 prior to 27.0.4 and from 28.0.0 prior to 28.0.2, the "issuetracker" backend does not correctly verify edit access...

CVE-2026-55147

LORIS Longitudinal Online Research and Imaging System is a self-hosted web application that provides data- and project-management for neuroimaging research. In versions from 22.0.0 prior to 27.0.4 and from 28.0.0 prior to 28.0.2, the "API" for the "imagingbrowser" module permits edits to imaging...