CVE-2026-61627

libass is a portable subtitle renderer for the "ASS"/SSA Advanced Substation Alpha/Substation Alpha subtitle format. Prior to 0.17.5, libass can overread and overwrite the glyph array in "wraplinesmeasure" while rendering malicious "ASS" content. In "wrap modes other than two", a final line endin...

CVE-2026-61626

libass is a portable subtitle renderer for the ASS/SSA Advanced Substation Alpha/Substation Alpha subtitle format. From 0.17.4 until 0.17.5, libass event pruning does not guard negative Matroska "ReadOrder" values, allowing an attacker to clear arbitrarily many bits to zero at attacker-controlled...

CVE-2026-61739

SOCFortress CoPilot focuses on providing a single pane of glass for all your security operations needs. Prior to 0.1.77, the Velociraptor Sigma exclusion-management endpoints in "backend/app/incidents/routes/incidentalert.py" omit role and tenant authorization, and "POST...

CVE-2026-61738

SOCFortress CoPilot focuses on providing a single pane of glass for all your security operations needs. Prior to 0.1.77, "POST /api/scoutsuite/generate-gcp-report" in "backend/app/integrations/scoutsuite/routes/scoutsuite.py" admits admin and analyst users and validates the uploaded content as...

CVE-2026-61737

ng-antd-admin is an Angular and NestJS administration system template. Prior to 22.0, a hardcoded default "JWT" secret permits token forgery when a deployment has not replaced the default secret, without a startup warning. An attacker can bypass authentication and authorization, impersonate any...

CVE-2026-44344

Chamilo LMS is an open-source learning management system. In the 1.x line before 1.11.40, and the 2.x line before 2.0.1, multiple "eval" calls in the vendored PEAR "HTMLQuickForm" libraries can execute arbitrary PHP code if form element names contain attacker-influenced data. Standard Chamilo for...

CVE-2026-45141

Chamilo LMS is an open-source learning management system. Prior to 2.0.1, the "add", "deletegradebookfromskill", "saveprofile", and "deleteprofile" actions in "public/main/inc/ajax/skill.ajax.php" perform database mutations without "Security::checktoken" validation. An attacker can use cross-site...

CVE-2026-45145

Chamilo LMS is an open-source learning management system. Prior to 2.0.1, "public/main/inc/lib/career.lib.php" and "public/main/cron/importcsv.php" call PHP's native "unserialize" on "usercareer.extradata" retrieved from the database without the "allowedclasses: false" safety option. An attacker...

CVE-2026-45144

Chamilo LMS is an open-source learning management system. From 2.0.0 until 2.0.1, "GET /user/username" is anonymously reachable and renders six user-editable profile fields "firstname", "lastname", "competences", "openarea", "teach", and "diplomas" inside "% autoescape false %", without server-si...

CVE-2026-61730

SOCFortress CoPilot focuses on providing a single pane of glass for all your security operations needs. In affected deployments, the unauthenticated "/scoutsuite-report" "StaticFiles" mount in "backend/copilot.py" exposes the "scoutsuite-report" directory even though normal /api routes require JW...

CVE-2026-61729

SOCFortress CoPilot focuses on providing a single pane of glass for all your security operations needs. Prior to 0.1.76, "verifygraylogheader" in "backend/app/activeresponse/routes/graylog.py" and "verifyvelociraptorheader" in "backend/app/incidents/routes/incidentalert.py" authenticate webhooks...

CVE-2026-61728

SOCFortress CoPilot focuses on providing a single pane of glass for all your security operations needs. In affected snapshots preceding the respective 0.1.70 and 0.1.76 sink repairs, portal users, including "customeruser", can submit stored markup through "POST...

CVE-2026-111487

An out-of-bounds write vulnerability in the Qt Framework assimp scene import plugin of the Qt3D module...

CVE-2026-61708

SOCFortress CoPilot focuses on providing a single pane of glass for all your security operations needs. Prior to 0.1.76, "POST /api/agentdatastore/upload" in "backend/app/datastore/datastoreroutes.py" permits "customeruser" callers to choose "bucketname" and "objectname" without an allowlist,...

CVE-2026-119664

Tamery formerly Conar 0.26.1 before 0.99.0 contains an authorization bypass vulnerability in the cloud sync API chatsMessages.update handler, which leaves the client-supplied chatId writable. Authenticated Pro subscribers who know another user's chat ID can move messages with arbitrary parts and...

CVE-2026-119665

WHartTest 2.2.0 through 2.8.1 contains a missing authorization vulnerability in ScheduledTaskViewSet and TaskExecutionViewSet that allows authenticated users to access other projects' tasks. Attackers can set projectpk to another project's sequential ID to modify, delete, or trigger scheduled tas...

CVE-2026-119663

Tamery formerly Conar 0.32.0 before 0.99.0 contains a broken authorization vulnerability in the cloud sync API connectionsResources.create handler that allows authenticated users to attach resources to other users' connections. Attackers owning one connection can include a victim's connectionId i...

CVE-2026-119662

Songloft 2.9.0 before 2.13.6 contains a hardcoded credentials vulnerability that allows adjacent network attackers to authenticate as administrator using the fixed admin/admin pair. Attackers on the same network can log in via the /api/v1/auth/login endpoint to modify library and configuration...

CVE-2026-119660

MuseBot before 2.0.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge admin sessions by using the hard-coded default sessionkey 'musebotsessionkey'. Attackers can sign a MuseBot-session cookie carrying a userid to gain full administrative access,...

CVE-2026-119661

ShowDoc through 3.9.5 contains an authorization bypass vulnerability in the api/paramDescLib/deleteEntries endpoint that checks edit permission only for the first supplied entry id. Authenticated attackers can place their own entry id first and append other users' entry ids to permanently delete...

CVE-2026-119659

Blossom through 1.17.1 contains an authorization bypass vulnerability that allows authenticated users to access other users' folders because FolderService queries filter only on folder id. Attackers can supply another user's folder id to /folder/info, /folder/upd, /folder/open or /folder/del to...

CVE-2026-119657

FilePress through 3.0.1 contains a missing authorization vulnerability in dzz/pichome/library that allows authenticated users to manage other libraries' folders because checkuserpermbyuid only checks membership of any library. Attackers who know another library's appid or folder id can invoke...

CVE-2026-119658

PowerDNS-Admin through 2026.08.1 contains an authorization bypass vulnerability that allows authenticated User-role accounts to refresh secondary zones they cannot access by supplying a different 'domain' field in the JSON body. Attackers authorized for any one zone can force axfr-retrieve...

CVE-2026-119656

CoreShop by CoreUnion through 1.5.5 contains an unauthenticated sql injection vulnerability in the api/Agent/GetGoodsPageList endpoint via the order parameter appended to an ORDER BY clause. Anonymous attackers can inject subqueries that bypass SqlSugar's field check to extract member accounts an...

CVE-2026-119655

CoreShop through 1.5.5 contains an unauthenticated sql injection vulnerability in the api/Good/GetGoodsPageList endpoint via the unvalidated order parameter appended to ORDER BY. Attackers can inject subqueries that bypass SqlSugar's field check and use boolean-based or time-based blind technique...

CVE-2026-119653

Nging through 5.3.5 contains an information disclosure vulnerability that allows any authenticated backend user to list host directories by abusing the public-tagged /user/autocompletepath endpoint. Low-privileged users without file-manager permission can supply arbitrary paths in the query...

CVE-2026-119654

DataCap through 2025.1.1 contains a missing authorization vulnerability that allows any authenticated user to escalate privileges by calling administrative role and menu management APIs. Attackers, including self-registered accounts, can send PUT requests to /api/v1/user/allocationRole to assign...

CVE-2026-119652

HuLa-Server through 3.0.7 contains an insecure direct object reference vulnerability in FriendController.friendList that allows authenticated users to view other users' friend lists by supplying a uid parameter. Attackers can send GET requests to /user/friend/page with a victim's uid, bypassing t...

CVE-2026-119651

HuLa-Server through 3.0.7 contains an insecure direct object reference vulnerability in FeedController.delFeed that allows authenticated users to delete other users' moments by supplying arbitrary feedId values. Attackers can send POST requests to /feed/del with another user's feedId to delete...

CVE-2026-119650

HuLa-Server through 3.0.7 contains an insecure direct object reference vulnerability in PrivacyController that allows authenticated users to access other users' privacy settings by supplying their uid. Attackers can send GET or POST requests to /privacy with a target uid parameter to read and...

CVE-2026-119649

Orchard CMS 1.10.3 through 1.11 contains an improper authorization vulnerability in MediaLibraryService.CheckMediaFolderPermission that allows authenticated Authors and Contributors to access other users' media. Attackers can display, clone, and delete other users' media items by content id and...

CVE-2026-119648

Tencent BlueKing CMDB bk-cmdb through 3.14.6 contains a missing authorization vulnerability that allows authenticated users to view hosts of other businesses via POST /api/v3/hosts/search/asstdetail. Attackers can submit host search conditions targeting other businesses or omitting business filte...

CVE-2026-119647

RuoYi-Vue-Plus through 6.0.0 contains an authorization bypass vulnerability in SysUserServiceImpl.selectUserListByDept that allows authenticated users to read users of other departments. Users holding system:user:list under a department-restricted role can request GET /system/user/list/dept/deptI...

CVE-2026-119646

Open Web Analytics before 1.14.1 contains an authorization vulnerability that allows authenticated users to read other sites' report data because clickstream and transaction reports are not scoped to the authorized siteId. Users with viewreports on one site can supply that siteId with another...

CVE-2026-119645

ZenTao PMS through 22.6 contains a missing authorization vulnerability in doc::ajaxGetDoc that allows authenticated users to read documents without checkPrivDoc access checks. Low-privilege attackers can enumerate sequential document ids to retrieve body and draft content of private documents and...

CVE-2026-119644

Blossom through 1.17.1 contains an authorization bypass vulnerability that allows authenticated non-readonly users to modify other users' pictures by supplying arbitrary picture ids. Attackers can call the picture delete, /picture/del/batch, or /picture/star endpoints to permanently delete victim...

CVE-2026-100355

Campfire is a web-based chat application. In version 1.4.4 and earlier, when a Campfire message contains a link, the server fetches it to build an OpenGraph unfurl preview. "RestrictedHTTP::PrivateNetworkGuard" relied on Ruby's "IPAddrprivate? IPAddrloopback?", and "IPAddrlinklocal?" predicates...

CVE-2026-119542

A flaw was found in the Ickle query parser in Infinispan. A query containing deeply nested predicates can cause recursive parsing to exhaust the Java thread stack and throw an uncaught StackOverflowError. An authenticated user with BULKREAD permission who can submit a cache query may trigger the...

CVE-2026-119528

A flaw was found in GIMP. The PSD plug-in’s image resource header loader uses an incorrect destination size when copying a converted resource name into a fixed stack buffer. Opening a crafted PSD file can cause a stack-based buffer overflow, leading to a crash and potentially arbitrary code...

CVE-2026-115683

A race condition in Epiphany allows a malicious website to bypass the TLS/SSL certificate warning page. Epiphany registers the main-world script message handler "tlsErrorPage" so its internal TLS error page can implement "Accept Risk and Proceed". The handler was registered immediately before...

CVE-2026-119602

libmspack through 0.11alpha contains an uninitialized memory disclosure vulnerability in the MS-ZIP decompressor that allows attackers to leak heap data via unchecked back-reference distances. Attackers can supply a crafted MS-ZIP CAB file whose first block begins with a back-reference, causing...

CVE-2026-119601

AFFLIB through 3.7.22 contains a heap out-of-bounds write vulnerability in afgetpage that allows attackers to corrupt heap memory by supplying crafted AFF images with mismatched page and sector sizes. Attackers can set a page size larger than and not a multiple of the sector size, causing the...

CVE-2026-119600

tcpflow through 1.6.1 contains an out-of-bounds read vulnerability that allows unauthenticated attackers to read process memory by sending packets with forged IP payload lengths. Attackers can inject crafted IPv4 or IPv6 TCP packets into captured traffic or pcap files to leak adjacent memory into...

CVE-2026-119599

AxonHub through 1.0.0-beta11 contains a privilege escalation vulnerability that allows project users to assign system-level scopes by creating serviceaccount API keys with unvalidated scopes. Attackers holding writeapikeys can mint keys with readchannels and query /admin/graphql to read every...

CVE-2026-119598

Miaomiaowu before 0.9.3 contains an insecure direct object reference vulnerability in /api/user/proxy-provider-configs that allows authenticated users to read other users' configurations. Attackers can iterate the global auto-increment externalsubscriptionid parameter to disclose override scripts...

CVE-2026-119597

OpenDeepWiki through 2.0.6 contains a hard-coded JWT signing key vulnerability that allows unauthenticated attackers to forge administrator tokens using the publicly known Jwt:SecretKey in appsettings.json. Attackers can mint HS256 bearer tokens with an Admin role claim to access /api/admin...

CVE-2026-119596

UNIT3D through 9.2.0 contains a missing authorization vulnerability in PlaylistZipController::show that allows authenticated users to download other members' private playlists. Attackers can enumerate sequential playlist ids at the /playlist-zips/playlist endpoint to obtain zips of all torrents,...

CVE-2026-119578

MONAI from 1.6.0 before 1.6.1 contains a remote code execution vulnerability in Auto3DSeg algofromjson that allows attackers to run Python code via a crafted work directory's algoobject.json. Attackers can ship a malicious algorithmtemplates module plus a target name that is imported and...

CVE-2026-119574

Traefik from 3.2.0 before 3.7.15 contains a data race in the experimental FastProxy that allows unauthenticated attackers to crash the process by abusing HTTP/1 protocol upgrades. Attackers can repeatedly open and abort upgraded connections such as WebSocket, corrupting the unsynchronized shared...

CVE-2026-119573

Traefik 3.7.11 before 3.7.15 contains an authorization bypass in the Kubernetes Ingress NGINX provider that skips the cross-namespace check on the auth-tls-secret annotation when a cached client authentication TLS option is reused. Users who can create Ingresses can reference another namespace's ...