CVE-2026-77466

Lychee is a free, open-source photo-management tool. Prior to 7.7.0, Lychee hides the Omnipay Dummy test provider from the checkout options in production through OmnipayFactory::getsupportedproviders, but CreateSessionRequest validates only that the submitted provider is an OmnipayProviderType an...

CVE-2026-61610

Lychee is a free, open-source photo-management tool. Prior to 7.6.1, when photosstarvisibility is set to anonymous, POST /api/v2/Photo::highlight can fetch and modify a photo without confirming that the caller can see it. BaseApiRequest::validateResolved invokes...

CVE-2026-61838

Lychee is a free, open-source photo-management tool. Prior to 7.6.3, GET /api/v2/Zip authorizes album and photo archives through AlbumPolicy::canDownload and PhotoPolicy::canDownload without first enforcing AlbumPolicy::canAccess. For a public, password-protected album with grantsdownload enabled...

CVE-2026-61611

Lychee is a free, open-source photo-management tool. Prior to 7.6.1, POST /api/v2/Album::unlock has no throttle, attempt counter, backoff, CAPTCHA, or lockout. UnlockAlbumRequest::authorize permits any caller to submit attempts, and app/Actions/Album/Unlock.php verifies each guess with Hash::chec...

CVE-2026-62679

Lychee is a free, open-source photo-management tool. Prior to 7.6.4, SecurePathController, which serves GET /image/path, concatenates the attacker-controlled path with the local storage root and performs a string-prefix check before canonicalizing dot segments. Under the supported non-default...

CVE-2026-57569

Lychee is a free, open-source photo-management tool. Prior to 7.6.0, the POST /api/v2/Photo::fromUrl flow validates a hostname and its resolved addresses in app/Rules/PhotoUrlRule.php but later passes the original hostname through app/Actions/Import/FromUrl.php to app/Image/Files/DownloadedFile.p...

CVE-2026-57568

Lychee is a free, open-source photo-management tool. Prior to 7.6.0, Lychee permits an authenticated user with album-edit permissions to store a javascript URI in an album or photo Markdown description because config/markdown.php enables allowunsafelinks...

CVE-2026-110812

Deserialization of untrusted data in the Gremlin graph data import component in Amazon Neptune engine might allow an authenticated remote actor with standard database permissions to execute arbitrary code and access internal service credentials. To remediate this issue, users not enrolled in...

CVE-2026-105065

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in 8theme.com XStore xstore allows Reflected XSS.This issue affects XStore: from n/a before 9.7.9...

CVE-2026-102631

In authd before 0.7.1, the user identity matching in UpdateUser internal/users/manager.go resolves an incoming login by the broker-scoped provider ID, but falls back to matching the username when the provider ID does not belong to any known user, and does not reject a conflicting non-empty provid...

CVE-2026-102527

Nuxt OG Image generates OG Images with Vue templates in Nuxt. From 6.2.5 until 6.7.0, the dynamic /og/d/.png route accepts unsigned requests while resolvePathCacheKey produces cache keys from the request path, site URL, and normalized rendering options exposed through image URLs and server...

CVE-2026-100353

kin-openapi is a Go project for handling OpenAPI files. From 0.136.0 until 0.149.0, three openapi3filter decoder paths that were missed by the fix for GHSA-p6wj-qrr4-pgh5 lack a nil-items guard for legal OpenAPI 3.1 array schemas. An unauthenticated remote client can trigger a deterministic...

CVE-2026-100354

kin-openapi is a Go project for handling OpenAPI files. Prior to 0.149.0, runtime request, response, and direct schema validation lacks cycle detection when an allOf, anyOf, or oneOf chain refers back to an ancestor schema, even though loading and document validation accept the circular reference...

CVE-2026-100409

OpenNext Cloudflare is an open Next.js adapter for Cloudflare. From 0.3.0 until 1.20.2, applications that enable enableCacheInterception, rely on middleware for access control, and have a matching cached protected route process encoded pathnames inconsistently between middleware matching and cach...

CVE-2026-97712

Sonatype Nexus Repository 3 allows a user that holds the role create or role update permission to grant roles and privileges that the account does not hold. This can give the user more access than intended, up to full administrative access...

CVE-2026-97394

kin-openapi is a Go project for handling OpenAPI files. From 0.136.0 until 0.143.0, openapi3filter accepts OpenAPI 3.1 array schemas without an items keyword and then dereferences the nil Schema.Items value while decoding application/x-www-form-urlencoded or multipart/form-data request bodies,...

CVE-2026-97665

A missing authorization check in Nexus Repository 3's NuGet Components API upload path allows an account holding only repository read and browse privileges to upload and persist NuGet symbol packages .snupkg to a hosted repository, bypassing the write-permission check enforced for ordinary packag...

CVE-2026-97666

Sonatype Nexus Repository 3 allows an unauthenticated remote attacker to supply attacker-controlled input to a Java class loading call through an ExtDirect endpoint. This allows the attacker to learn whether specific classes are present in the application. The issue does not by itself allow code...

CVE-2026-97667

Sonatype Nexus Repository 3 allows a user account that holds the edit permission on a hosted R repository to store script content in the metadata of an uploaded R package. The script runs in the browser of a user who opens the details of that package in the Browse user interface, with the...

CVE-2026-95155

FasterXML Jackson 1.x, confirmed in jackson-mapper-asl versions 1.8.3, 1.9.2, 1.9.11, 1.9.12, and 1.9.13, allows attackers to cause a denial of service by supplying deeply nested JSON input to an application that deserializes untrusted JSON using ObjectMapper.readValue...

CVE-2026-92982

A flaw was found in Ansible Operator Plugins. A low-privileged Kubernetes user can exploit a Jinja2 template injection vulnerability by crafting malicious custom resource CR specification values. These values are processed by Ansible without proper sanitization, allowing embedded Jinja2 expressio...

CVE-2026-88753

A Regular-Expression Denial of Service ReDoS in the Markdown2. extractmetadata function lib/markdown2.py of trentm markdown2 through v2.5.5 allows attackers to cause a Denial of Service DoS via a crafted Markdown document...

CVE-2026-75505

EspoCRM is an open source customer relationship management application. Prior to 10.0.2, an authenticated user with mass-update permission can supply a known attachment identifier to the mass-update functionality. The mass-update processor duplicates the attachment without checking whether the...

CVE-2026-63442

OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, the unauthenticated WebGUI login usernamefld accepts carriage-return and line-feed characters that survive LOGAUTH processing through syslog-ng-lockout.conf into the syslog-ng program destination feeding...

CVE-2026-71490

OPNsense is a FreeBSD based firewall and routing platform. Prior to 26.1.11, OPNsense\Core\ACL::hasPrivilege appends a directly assigned comma-separated value as one string and then uses an exact comparison when checking user-config-readonly. A user directly assigned both a component write...

CVE-2026-58391

OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, Firewall Rules and NAT views place stored category names and alias descriptions into HTML title attributes in filterrule.volt and natrule.volt without quote-safe encoding. The response layer uses ENTNOQUOTES, so ...

CVE-2026-58392

OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, the NTP GPS page stores the operator-supplied initcmd value in base64 form, applies legacyhtmlescapeformdata to the encoded string, and then uses base64decode to decode the value directly into the GPS...

CVE-2026-58393

OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, the OpenVPN Client Specific Override commonname field accepts path traversal sequences and openvpncscconfwrite concatenates the value into /var/etc/openvpn-csc// without normalization or a basename check. The...

CVE-2026-58394

OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, src/www/systemadvancedadmin.php reads certificate records into $acert but omits that array from legacyhtmlescapeformdata before rendering each certificate descr value in the SSL Certificate selector. The...

CVE-2026-58395

OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, the safe-delete path reached through ApiMutableModelControllerBase::delBase interpolates an unvalidated safe-delete token from the request URL into an XPath expression over config.xml before confirming that the...

CVE-2026-57155

OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, the Firewall Alias GeoIP importer's processzip and processgzip paths in src/opnsense/scripts/filter/lib/alias/geoip.py use an unvalidated CSV countrycode value to construct output filenames below...

CVE-2026-58390

OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, the OpenVPN connection-status dashboard widget in src/opnsense/www/js/widgets/OpenVPNClients.js and the connection-status view place a client commonname into data-common-name attributes without quote-safe encodin...

CVE-2026-52167

A stack overflow in the gensubParsePsb function of AOC LC32D1320 v2.05 allows attackers to cause a Denial of Service DoS via supplying a crafted .PSB subtitle file...

CVE-2026-53582

OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.10, the Trust module stores attacker-controlled certificate authority and certificate refid values and interpolates them into XPath expressions in src/opnsense/mvc/app/models/OPNsense/Trust/FieldTypes/CAsField.php an...

CVE-2026-45450

: Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in Unitronics Unitronics UniStream Pro/UniLogic. This issue affects Unitronics UniStream Pro/UniLogic: Unitronics UniStream Pro versions only B10 / C10 – UniLogic versions prior to 1.41.329...

CVE-2026-45451

: Improper Authentication vulnerability in Unitronics Unitronics UniStream Pro/UniLogic. This issue affects Unitronics UniStream Pro/UniLogic: Unitronics UniStream Pro versions only B10 / C10 – UniLogic versions prior to 1.41.329...

CVE-2026-45452

Use of Externally-Controlled format string vulnerability in Unitronics Unitronics UniStream Pro/UniLogic. This issue affects Unitronics UniStream Pro/UniLogic: Unitronics UniStream Pro versions only B10 / C10 – UniLogic versions prior to 1.41.329...

CVE-2026-45449

: Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability in Unitronics Unitronics UniStream Pro/UniLogic. This issue affects Unitronics UniStream Pro/UniLogic: Unitronics UniStream Pro versions only B10 / C10 – UniLogic versions prior to 1.41.329...

CVE-2026-111095

In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 stored XSS in the classic project overview was possible...

CVE-2026-111096

In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 stored XSS in the classic build log was possible...

CVE-2026-110958

A vulnerability was found in Wavlink WN530HG4B M30HG4BV260724. The impacted element is an unknown function of the file api.cgi. The manipulation results in heap-based buffer overflow. It is possible to launch the attack remotely. The exploit has been made public and could be used. Upgrading to...

CVE-2026-111091

In JetBrains Junie CLI before 26.8.3 code execution was possible via an untrusted project's MCP server configuration...

CVE-2026-111092

In JetBrains YouTrack before 2026.2.19575 2026.3.16075 2026.3.16397 2026.3.16402 mail rules allowed a project admin to execute cross-project issue commands...

CVE-2026-111093

In JetBrains Datalore before 2026.2.1 unauthenticated path traversal via the report blob endpoint allowed reading arbitrary files...

CVE-2026-111094

In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 remote code execution via a whitelist bypass in the build messages protocol was possible...

CVE-2026-109449

In Symfony Expression Language versions prior to 5.4.54, 6.4.48, 7.4.21, and 8.1.9, the parser of the ExpressionLanguage component built its node tree with no bound on its depth. An expression made of tens of thousands of nested unary operators, array literals, binary operators or property access...

CVE-2026-105474

A server-side template injection exists in SolusVM 2 up to version 2.0.0-44576 that allows remote authenticated users to execute arbitrary code as root...

CVE-2026-100351

kin-openapi is a Go project for handling OpenAPI files. From 0.144.0 until 0.147.0, openapi3filter.ValidationHandler validates an operation selected from decoded URL.Path while a downstream gorilla/mux router configured with UseEncodedPath can dispatch a different operation selected from...

CVE-2026-100352

kin-openapi is a Go project for handling OpenAPI files. Prior to 0.148.0, the OpenAPI 3.1 validation path passes YAML NaN and infinity numeric values to santhosh-tekuri/jsonschema v6.0.2 without applying kin-openapi's existing finite-number guards. A remote unauthenticated client can send an...

CVE-2026-100348

kin-openapi is a Go project for handling OpenAPI files. Prior to 0.145.0, openapi3.Loader can dereference a nil SchemaRef.Value while resolving a self-referential additionalProperties JSON Reference such as a schema that points to its own additionalProperties member. Loading an attacker-controlle...