CVE-2026-107046

A Server-Side Request Forgery SSRF in the url/title/author/coverUrl component of FocusPodcast versionCode 70allows attackers to scan internal resources via supplying a crafted URL...

CVE-2026-107019

Insecure permissions in the feiertage.ImportActivity component of Arbeitszeiterfassung2 versionCode 159 allows unauthorized attackers to create forged holiday/work-time entries via crafted ICS imports...

CVE-2026-51851

modelscope agent-zero 1.7, 1.8, 1.9, and 1.10 is vulnerable to Directory Traversal in python/helpers/filebrowser.py:FileBrowser.savetextfile. The savetextfile method accepts user-controlled file paths without normalization or validation, allowing path traversal attacks...

CVE-2026-107045

Insecure permissions in the CitrineContentProvider component of Citrine v3.1.0 versionCode 62 allows unauthorized attackers to arbitrarily read another's Nostr event database...

WS-2026-0176

Incus: authentication and authorization bypass through unverified client certificate chains. The HTTPS API accepted a client when any certificate in the presented chain was trusted, not only the leaf, so an attacker with network access and a trusted client's public certificate could impersonate...

CVE-2026-107027

Insecure permissions in lz233 Tarnhelm v1.8.2 versionCode 20250630 allows unauthorized attackers to invoke an exported component, leading to arbitrary data access and overwriting...

CVE-2026-107060

Insecure permissions in Tailscale versionCode 297862600 allows unauthorized attackers to make arbitrary changes to another user's VPN configurations and preferences...

CVE-2026-107048

An issue in the WebView rendering path component of MotionCreative Motion UI versionCode 101 allows attackers to execute arbitrary code via supplying a crafted POST request...

CVE-2026-51903

SuperAGI v0.0.14 contains an improper access control vulnerability in getagentbylatestexecution in superagi/controllers/agentexecution.py. A remote authenticated attacker from one organization can retrieve latest execution and agent metadata for another organization's project through...

CVE-2026-107030

Insecure permissions in craftxbox YubiClip XOR fork v1.0.1 versionCode 10003 allows unauthorized attackers to trigger the OTP-clipboard One-Time Password mechanism, causing a desynchronization of the timing...

CVE-2026-107033

Insecure permissions in the MirakelInternalContentProvider component of Mirakel v3.0 versionCode 60 allows unauthorized attackers to arbitrarily read and modify another user's task database...

CVE-2026-107041

Insecure permissions in the FeatureActionActivity component of Oasis Feng Island versionCode 51801 allows unauthorized attackers to arbitrarily force a freeze in the device, leading to a Denial of Service DoS...

CVE-2026-51902

SuperAGI up to v0.0.14 contains an improper access control vulnerability. The agent controller endpoint /api/agents/get/project/projectid allows authenticated users from one organization to retrieve the complete list of agents belonging to a different organization's project. The endpoint accepts ...

CVE-2026-107024

Insecure permissions in Share 2 Archive Today versionCode 61 allows unauthorized attackers to arbitrarily overwrite another user's clipboard content via supplying a crafted URL...

CVE-2026-107050

An issue in libretro RetroArch v1.22.2 allows attackers to force another user into loading attacker-supplied code in their uid, leading to arbitrary code execution...

CVE-2026-51912

OpenBMB XAgent v1.0.0 contains directory traversal vulnerability in main-uploadfile-the-preserved-live-upload-file-witness-directly-reaches ToolServer/ToolServerNode/main.py:46...

CVE-2026-107053

Insecure permissions in foobnix Librera PDF Reader versionCode 7222 allows unauthorized attackers to arbitrarily write and truncate files in a shared storage space outside of the sandbox...

CVE-2026-51863

DB-GPT v0.7.5 and 0.8.0 contains directory traversal in useexamplefile packages/dbgpt-app/src/dbgptapp/openapi/apiv1/examplesapi.py:129. A remote attacker can use the validated exploitation path to write files outside the intended workspace or storage boundary...

CVE-2026-107051

Insecure permissions in klassm AndFHEM v2.4.1 versionCode 241, the verified build allows unauthorized attackers to arbitrarily manipulate another user's FHEM home-automation control configurations...

CVE-2026-107059

An issue in Nextcloud versionCode 30390190 allows attackers to force victim users to logout of their accounts and switch to an attacker controlled progile, bypassing authentication...

CVE-2026-107058

An issue in Shelter versionCode 445 allows attackers to register their own authkey and execute a takeover of another user's binder service API and preference state...

CVE-2026-107040

Insecure permissions in MBasov OMN-Go versionCode 26080824 allows unauthorized attackers to invoke an exported component, leading to arbitrary data access and control of data flow...

CVE-2026-107039

Insecure permissions in the ActivityMain component of M66B/Marcel Bokhorst NetGuard no-root firewall versionCode 2026080101/versionName 2.337 allows unauthorized attackers to arbitrarily force a device reset or Denial of Service DoS...

CVE-2026-51905

TransformerOptimus SuperAGI v0.0.14 is vulnerable to Incorrect Access Control in getagentexecutionconfiguration in superagi/controllers/agentexecutionconfig.py. A remote authenticated attacker from one organization can read another organization's agent execution configuration by supplying the...

CVE-2026-107056

Insecure permissions in the io.file.importer.ImportActivity component of OpenTracks versionCode 6751 allows unauthorized attackers to inject crafted tracking data into the victim's location database via a crafted SEND message...

CVE-2026-107016

Insecure permissions in Fossify v1.3.0 allows unauthorized attackers to access and read another user's stored contacts...

CVE-2026-107021

Insecure permissions in the CardProvider content provider component of helloworld1 AnyMemo versionCode 20260730 allows unauthorized attackers to arbitrarily read flashcards across the user's entire memorization database...

CVE-2026-107043

Insecure permissions in Code Catcher versionCode 131 allow unauthorized attackers to arbitrarily manipulate the app's SMS-code-capture mechanism...

CVE-2026-107057

An issue in AndBible versionCode 1111 allows attackers to execute arbitrary code via uploading a crafted module zip...

CVE-2026-107029

Insecure permissions in rubenalfon Pile v1.1.3 allows unauthorized attackers to invoke an exported component, leading to arbitrary data access and overwriting...

CVE-2026-107035

Insecure permissions in the object/Page.java component of MBasov OMN Outline notes Markdown versionCode 3400 allows unauthorized attackers to arbitrarily write content into another user's private storage via a crafted payload...

CVE-2026-107038

Insecure permissions in Yet Another UPnP Controller versionCode 50200 allows unauthorized attackers to invoke an exported component, leading to arbitrary data access and control of application data...

CVE-2026-118589

A weakness has been identified in nschloe meshio up to 5.3.5. Impacted is an unknown function of the file meshio/vtk42.py of the component VTK Reader. Executing a manipulation of the argument DIMENSIONS can lead to uncontrolled memory allocation. The attack can be executed remotely. The project w...

CVE-2026-118586

A security flaw has been discovered in dfm feedfinder2 up to 0.0.4. This issue affects the function findfeeds of the file feedfinder2.py. Performing a manipulation results in server-side request forgery. Remote exploitation of the attack is possible. The project was informed of the problem early...

CVE-2026-86983

A remote attacker may be able to terminate a process that passes attacker-controlled input to the P-384 VOPRF API without bounding its length. This vulnerability is addressed in swift-crypto version 5.0.3...

CVE-2026-118578

A security flaw has been discovered in maotoumao MusicFreeDesktop 0.0.6/0.0.7/0.0.8. The affected element is an unknown function of the component Request Forwarder. The manipulation results in information disclosure. The attack can only be performed from the local network. The exploit has been...

CVE-2026-82411

Open Object provides an API and admin interface to manage objects and object types. From 2.4.3 until 2.5.1, 3.6.2, 4.0.2, and 4.1.1, a token scoped to read one ObjectType can read the full versioned record of an object of any other ObjectType via the history-detail endpoint "GET...

CVE-2026-85749

MailWatch for MailScanner is a web-based front-end to MailScanner. Prior to 1.2.27, any authenticated MailWatch user, including the U/user, D/domain-admin, and H/host roles, can release to inbox or permanently delete the quarantined mail of any other user or domain by supplying an arbitrary messa...

CVE-2026-75520

Domoticz is a free, open source home automation system for Linux, Windows, macOS, and Raspberry Pi. Prior to 2026.3, the "udevices" JSON command handler, "CmdUpdateDevices" in "main/WebServerCmds.cpp", performed no "session.rights" check before invoking a Lua parser script, while its sibling...

CVE-2026-118577

A vulnerability was identified in maotoumao MusicFreeDesktop 0.0.6/0.0.7/0.0.8. Impacted is an unknown function of the component Request Forwarder. The manipulation leads to server-side request forgery. Remote exploitation of the attack is possible. The exploit is publicly available and might be...

CVE-2026-55458

Caddy's reverse proxy fails to strip RFC 7230 hop-by-hop headers from upstream responses when handling WebSocket upgrades HTTP 101 Switching Protocols. Headers including "Alt-Svc", "Keep-Alive", "Proxy-Authenticate", "Transfer-Encoding", or "Trailer", which Caddy actually correctly strips for...

CVE-2026-118538

A vulnerability was determined in a2ui-project a2ui up to 0.12.0. This issue affects the function Root.renderComponentTree of the file src/0.8/ui/root.js of the component Renderer. Executing a manipulation can lead to dynamically-determined object attributes. The attack may be launched remotely...

CVE-2026-61575

AVideo is a video-sharing Platform. Prior to 8.1.0, "view/queue.php" uses "pathinfo" on the caller-controlled "fileURI" and stores its filename through "setTitle" in "encoderqueue.title" without neutralization. "fileURI" is not in the "objects/security.php" filter lists, and the "Login::canUpload...

CVE-2026-61569

AVideo is a video-sharing Platform. Prior to 8.1.0, the unauthenticated streamer login at "objects/login.json.php" passes the "user" parameter to "Streamer::get" in "objects/Streamer.php", where it is interpolated into a single-quoted MariaDB SELECT without parameterization or escaping. Although...

CVE-2026-54453

OpenCATS is an open-source applicant tracking system and recruitment CRM for staffing agencies and hiring teams. Prior to version 0.10.0, the Professional License configuration feature in "SettingsUI" "manageProfessional" accepts administrator-controlled license key input that is reconstructed in...

CVE-2026-61571

AVideo is a video-sharing Platform. Prior to 8.1.0, the encoder lacks a global authentication layer and exposes control and status PHP endpoints to anonymous network callers. "view/run.php" has a commented-out guard and invokes "Encoder::run". "view/queue.json.php" calls "Encoder::getAlltrue",...

CVE-2026-116641

The DB Tools rely on the TLS implementation in Golang’s standard library, which generally uses the system CA store. However, the crypto/x509 package also has its own internal denylist of known-bad CA certificates. Golang 1.27.3 adds the eMudhra certificates to this list. DB Tools version 100.19.0...

CVE-2026-61572

AVideo is a video-sharing Platform. Before the initial remediation attempt in 8.1.0, "urlgetcontents" in "objects/functions.php" accepts caller-controlled destinations after only "FILTERVALIDATEURL" syntax validation, without rejecting private, loopback, or link-local addresses, and disables TLS...

CVE-2026-61573

AVideo is a video-sharing Platform. Prior to 8.1.0, the anonymous login interface reflects request values into HTML and JavaScript without output encoding. In "view/index.php", "webSiteRootURL" is returned verbatim by "Streamer::getStreamerURL" in "objects/Streamer.php" and reaches navigation and...

CVE-2026-118537

A vulnerability was found in a2ui up to 0.10.4. This vulnerability affects unknown code of the file src/v09/basiccatalog/components/Image.js of the component Image Player/Video Player/Audio Player. Performing a manipulation of the argument url results in improper input validation. The attack may ...