CVE-2026-94482

Next.js is a React framework for building full-stack web applications. From 13.0.0 until 15.5.28 and 16.4.1, crafted requests targeting App Router applications with at least one Server Action can cause excessive CPU consumption and block processing of further requests in the same process...

CVE-2026-51954

An issue in Webasyst Framework 4.0.3 and before allows a remote attacker to execute arbitrary code via a crafted OAuth authorization URL with an arbitrary redirecturi...

CVE-2026-115450

External Control of Assumed-Immutable Web Parameter CWE-472 in the cart and checkout flow of MarcosCamara01 Ecommerce Template allows an authenticated user with no special privileges to be charged the price of one product while placing an order for another, because POST /api/user/cart accepts...

CVE-2026-115453

Authorization Bypass Through User-Controlled Key CWE-639 in the cart and wishlist repositories of MarcosCamara01 Ecommerce Template allows any authenticated user to delete and modify the cart and wishlist rows of any other user, because cartRepository.delete, cartRepository.updateQuantityInternal...

CVE-2026-115496

Overly informative error messages in the catalog functionality of KNIME Business Hub prior to version 1.18.5 may allow an authenticated remote attacker to see workflow names if their ID is known. A workaround is not possible...

CVE-2026-115494

A flaw in the cross-site request forgery CSRF prevention of KNIME Business Hub prior to version 1.19.0 allows an authenticated attacker to perform a CSRF attack with passive user interaction. This means the state of a resource could be changed without the user noticing. As a workaround, an API...

CVE-2026-115454

An excessive resource allocation issue in the remote workflow editing capabilities of KNIME Business Hub prior to version 1.19.0 allows a authenticated attack to exhaust resources on the server side. This leads to intermittent unavailability of workflow execution functionality. A workaround is no...

CVE-2026-115482

In lsquic before 4.9.0, the HTTP/3 implementation can use an excessive amount of memory because the number of buffered header sets is not limited, as demonstrated by a QPACK amplification attack. This is related to headeroutdynamicentry and esmaxheaderlistsize...

CVE-2026-114486

Incorrect authorization in the Devolutions Gateway token generation in Devolutions Server 2026.3.10.0 and earlier allows an authenticated non-administrative attacker to bypass the Network Access Rules of a virtual gateway and reach denied hosts via wildcard additional destinations signed into the...

CVE-2026-114487

Missing authorization in the PAM AD computer import endpoint in Devolutions Server 2026.3.5.0 through 2026.3.10.0 and 2026.2.20.0 and earlier allows an authenticated non-administrative user with a PAM license to create PAM sub-providers under existing AD providers via a crafted import request...

CVE-2026-114603

OpenTelemetry Python provides the Python API and SDK for OpenTelemetry. Prior to 1.45.1, the opentelemetry-api function TraceState.fromheader in opentelemetry/trace/span.py, reached through TraceContextTextMapPropagator.extract, parses inbound W3C tracestate headers with an unbounded...

CVE-2026-114485

Insufficient protection of sensitive information in the user list endpoint in Devolutions Server 2026.3.10.0 and earlier allows an authenticated attacker with delegated user view permissions to obtain the MFA secrets of all users via the user list API response...

CVE-2026-78846

AiDot Linkind Matter Smart Plug 1.01.32 is vulnerable to Buffer Overflow via SSDP local header parsing...

CVE-2026-78801

An issue in SKYWORTH DIGITAL CO., LTD SK-WR6640X Wi-Fi 6 Dual-Band Fiber Router AX1800M V1.0.3 allows a remote attacker to obtain sensitive information via the hiddenfactoryswitch.gch...

CVE-2026-113872

multer is a middleware for Node.js that handles multipart/form-data file uploads. In versions from 2.0.0 before 2.5.0, when multer is configured with an asynchronous fileFilter, a single request can crash the Node.js process. If the request is aborted while one file's asynchronous fileFilter is...

CVE-2026-16477

CleanShot X for macOS insecurely deserializes untrusted data embedded in a .cleanshot project file editable screenshot annotations. Exploitation requires an attacker to craft a malicious .cleanshot file, deliver it to the target, and have the target open it; the payload then executes automaticall...

CVE-2026-61791

OCO-Server is a self-hosted endpoint management application for computer inventory, software deployment, and mobile device management. Prior to 1.2.1, Html::commandButton in lib/Html.class.php embeds an action URL containing a stored computer hostname into a JavaScript string in an inline onclick...

CVE-2026-114510

Flexible GraphRAG is a Python framework for building graph and retrieval-augmented generation applications across multiple graph, vector, and search backends. From 0.6.0 until 0.8.2, the escape helper in flexible-graphrag/langchain/graph/pgstoreadapters/falkordbadapter.py escapes quotes before...

CVE-2026-114515

OCO-Server is a self-hosted endpoint management application for computer inventory, software deployment, and mobile device management. Prior to 1.2.3, a valid Self-Service Portal user with permission to create job containers and read visibility on a computer and package can queue an uninstall job...

CVE-2026-111181

body-parser is body parsing middleware for Node.js and Express. In versions before 1.20.9 and in versions from 2.0.0 before 2.4.0, a single request can crash any application using body-parser with default options. When a request carries a Content-Encoding such as gzip, body-parser pipes it into a...

CVE-2026-85080

In EmberZNet 9.1.1 and earlier, a malformed GetGroupMembership message can result in an out-of-bounds write leading to a crash. A limited number of values can be written using this vulnerability, so no route to remote code execution was observed. These messages must come from a device that has...

CVE-2026-89409

In Z-Wave SDK 8.1.1 and earlier for 700/800 series devices and 6.85.02 and earlier for 500 series devices, missing checks in the ZWAVECMDNODESEXIST handler can result in nodes being removed from the network. These messages must come from a device that has already joined the network...

CVE-2026-92709

Rsyslog is a rocket-fast system for log processing. From versions 1.15.0 to 8.2610.0, rsyslog's omfile dynaFile facility intentionally allows templates to generate flexible output paths. This supports valid deployments that route logs into different directories or use dynamically generated file...

CVE-2026-94502

In EmberZNet 9.1.1 and earlier, a malformed Publish Price Matrix command can result in an out-of-bounds write potentially leading to remote code execution. These messages must come from a device that has already joined the network. Only devices supporting the Price Cluster are impacted...

CVE-2026-89410

In Z-Wave SDK 8.1.1 and earlier, a malformed NCP SPI command can trigger out-of-bounds reads that leak sensitive information...

CVE-2026-85079

In EmberZNet 9.1.1 and earlier, a malformed SimpleDescreq response can result in an out-of-bounds write potentially leading to remote code execution. This response must come from a device that has already joined the network, and the attacker must wait for a SimpleDescreq before the attack can be...

CVE-2026-66282

In EmberZNet 9.1.1 and earlier, a malformed Publish Billing Period command can result in a recursive function call that will never reach its end condition. These messages must come from a device that has already joined the network. Only devices supporting the Price Cluster are impacted...

CVE-2026-66281

In EmberZNet 9.1.1 and earlier, a malformed Discover Attributes command can result in a loop with unreachable exit condition infinite loop. These messages must come from a device that has already joined the network. Only devices supporting manufacturer-specific clusters are impacted...

CVE-2026-66279

In Connect SDK 4.3.1 and earlier and Flex SDK 3.7.7 and earlier, a message with invalid security settings may bypass authentication resulting in network disruption. This vulnerability does not allow an attacker to gain the Network Key or otherwise break confidentiality...

CVE-2026-115411

crawlseo before version 0.2.4 contains a server-side request forgery vulnerability in its crawler engine where isPrivateIp fails to block reserved IP ranges such as RFC 6598 Carrier-Grade NAT, RFC 6890, TEST-NET ranges and certain IPv6 addresses, and additionally fails to pin the validated addres...

CVE-2026-115400

crawlseo before version 0.2.5 contains a cleartext storage vulnerability that allows attackers with database read access to obtain Google OAuth access and refresh tokens stored unencrypted in the User.googleTokens column. Attackers can read the plaintext long-lived refresh tokens from a compromis...

CVE-2026-113582

UNSUPPORTED WHEN ASSIGNED Improper restriction of XML external entity references in Apache Abdera allows an attacker to access sensitive data or make server-side requests when an application parses attacker-controlled XML with Abdera. This issue affects Apache Abdera: all versions. Apache Abdera ...

CVE-2026-115247

A security vulnerability has been detected in subhajitkhan online-clinic-management-system up to e9ee77a8827a1446220fa07ee693dc4d9a29a578. This vulnerability affects unknown code of the file patientregistration.php. The manipulation of the argument patpswd/docpswd leads to missing encryption of...

CVE-2026-115248

A vulnerability was detected in subhajitkhan online-clinic-management-system up to e9ee77a8827a1446220fa07ee693dc4d9a29a578. This issue affects some unknown processing of the file patappointtime.php of the component Booking Handler. The manipulation results in enforcement of behavioral workflow. ...

CVE-2026-115249

A flaw has been found in subhajitkhan online-clinic-management-system up to e9ee77a8827a1446220fa07ee693dc4d9a29a578. Impacted is an unknown function of the file patappointtime.php of the component Appointment Booking. This manipulation of the argument day/time/appdate causes improper input...

CVE-2026-107079

An issue in Systrome Validation & Certification 1.0 allows an attacker to cause a denial of service via the t URL parameter in the qrcodeauth.html component...

CVE-2026-111497

A buffer overflow vulnerability in the Brotli decoder c/dec/decode.c in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially...

CVE-2026-115246

A weakness has been identified in subhajitkhan online-clinic-management-system up to e9ee77a8827a1446220fa07ee693dc4d9a29a578. This affects an unknown part of the file patdocmsg.php. Executing a manipulation of the argument Query can lead to cross site scripting. The attack may be performed from...

CVE-2026-102785

Joomla Extension - yootheme.com - Unauthenticated remote code execution in YOOtheme Pro 5.0.0-5.0.52 - YOOtheme Pro’s publicly accessible image transformation handler incompletely binds normalized image operations and the output destination to its request signature. An unauthenticated remote...

CVE-2026-115329

Lotus through 0.10.2 contains an insecure direct object reference vulnerability in SubscriptionViewSet.getobject that uses an unscoped queryset without organization filtering or permission checks. Authenticated users or API keys from any organization can supply another organization's subscription...

CVE-2026-115332

Lotus through 0.10.2 contains an sql injection vulnerability that allows authenticated organization users to inject SQL by registering crafted subscriptionfilterkeys that bypass keyword-only validation. Attackers can create subscriptions using the malicious key, which is rendered as an unquoted...

CVE-2026-115331

Lotus through 0.10.2 contains an sql injection vulnerability that allows authenticated organization users to inject SQL by supplying crafted billable metric propertyname or categorical filter values. Attackers can embed SQL in values rendered unescaped into Jinja-generated counter, gauge and rate...

CVE-2026-115334

Lotus through 0.10.2 contains an authorization bypass vulnerability in ChangeUserOrganizationView.post that allows authenticated users to join any organization by supplying its UUID. Self-registered attackers who know another organization's UUID can send a POST request to /app/switchorganization/...

CVE-2026-13411

Mattermost versions 11.7.x = 11.7.11 fail to validate null elements when decoding playbook import conditions which allows an authenticated attacker to crash the Playbooks plugin instance-wide via a crafted import request containing a null condition. Mattermost Advisory ID: MMSA-2026-00709...

CVE-2026-115330

Lotus through 0.10.2 contains an sql injection vulnerability that allows authenticated organization users to execute arbitrary SQL by appending stacked statements to custom metric queries. Attackers can submit semicolon-separated SQL through POST /app/metrics/, bypassing first-statement-only...

CVE-2026-115333

Lotus through 0.10.2 contains an improper authentication vulnerability in the Go event ingestion middleware that validates API keys by prefix only, without checking the secret against the stored hashedkey. Attackers who know or obtain an API key prefix can submit usage events to POST /api/track/ ...

CVE-2026-115323

EverShop 1.2.2 before 2.2.1 contains a missing authorization vulnerability in the customer address API that allows unauthenticated attackers to manage other customers' addresses. Attackers who know customer and address UUIDs can send POST, PATCH, or DELETE requests to...

CVE-2026-115324

mem0 0.1.117 before 1.0.8 contains an sql injection vulnerability in mem0/vectorstores/databricks.py that allows attackers to inject SQL by influencing stored memory content. Attackers can supply crafted memory text, metadata, or message names that reach unescaped insert and update string...

CVE-2026-115325

Netmaker through 1.7.0 contains an authorization bypass vulnerability in the updateExtClient handler that allows network-scoped users to modify external clients on other networks. Attackers with external client permissions on one network can send PUT requests to /api/extclients/network/clientid t...

CVE-2026-115327

libyang through 6.4.13 contains an uninitialized pointer free vulnerability in lydxmlenvnetconfrpc in src/parserxml.c when parsing NETCONF rpc action envelopes. Peers with a NETCONF session can send an action element containing non-whitespace text via lydparseop to crash servers like netopeer2 or...