CVE-2026-53529 LeafWiki vulnerable to stored XSS via search-result title (highlight() returns raw title into dangerouslySetInnerHTML)

LeafWiki is a self-hosted wiki. Prior to version 0.10.2, page titles returned by the search API could be rendered as raw HTML in the frontend. A user with editor or administrator permissions could create or modify a page title containing an HTML/JavaScript payload. When another user searched for ...

CVE-2026-33047 Combodo iTop: Object can be locked by a user without write permissions

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, an object can be locked by a user who is not assigned write permissions. This issue has been fixed in version 3.2.3...

CVE-2026-53509 @aborruso/ckan-mcp-server: SSRF via base_url allows access to internal networks (Potential fix bypass of CVE-2026-33060)

CKAN MCP Server is a tool for querying CKAN open data portals. A known vulnerability CVE-2026-33060 indicated tools including ckanpackagesearch and sparqlquery that accept a baseurl parameter had the risk of making HTTP requests to arbitrary endpoints without restriction. A fix was applied to...

CVE-2026-31880 Combodo iTop: Reflected XSS in universal search

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, there is a Reflected Cross-Site Scripting XSS vulnerability in the universal search. This issue has been fixed in version 3.2.3...

CVE-2026-31803 Combodo iTop: Reflected XSS in tag admin

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, 3.2.3, there is a Reflected Cross-Site Scripting XSS vulnerability in pages/tagadmin.php. This issue has been fixed in version 3.2.3...

CVE-2026-53656 FiftyOne App server uses wildcard CORS (Access-Control-Allow-Origin: *), enabling cross-origin reads of local server data

FiftyOne is an open-source platform for refining high-quality datasets and visual AI models. Prior to 1.17.0, the FiftyOne App/API server in fiftyone/server/app.py and the /media route in fiftyone/server/routes/media.py unconditionally return Access-Control-Allow-Origin: . Because the embedded...

CVE-2026-62283 Nezha Monitoring: Cross-tenant terminal/file-manager session hijack via WebSocket stream UUID without ownership check

Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. Nezha versions 1.14.13 through 1.14.14 and 2.0.0 through 2.0.9 do not bind stream identifiers created by CreateStream in service/rpc/iostream.go to their creating user, and GET /ws/terminal/:id and GET...

CVE-2026-77219 GNU Emacs < 31.0.91 Heap Over-Read via PBM/PPM/PGM Image Loader

GNU Emacs before 31.0.91 contains an integer overflow in the PBM/PPM/PGM image loader that allows an attacker to leak heap memory contents by supplying a crafted image with large dimensions and an elevated max color index. The image loader multiplies image dimensions and channel count using signe...

CVE-2026-30826 Combodo iTop: Reflected XSS in run_query.php

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, there is a Reflected Cross-Site Scripting XSS vulnerability in the testing OQL query functionality. This issue has been fixed in version 3.2.3...

CVE-2026-68508 Hydra: hydra.utils.instantiate with untrusted config can lead to code execution

Hydra is a framework for elegantly configuring complex applications. Prior to 1.3.4, hydra.utils.instantiate resolves and calls Python objects selected by configuration through resolvetarget in hydra/internal/instantiate/instantiate2.py, allowing attacker-controlled target values and arguments to...

CVE-2026-30819 Combodo iTop: Reflected XSS in /pages/ajax.render.php dashboard_id parameter

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, iTop has a reflected Cross-Site Scripting XSS vulnerability in its dashboard revert functionality with the parameter dashboardid in /pages/ajax.render.php. This issue has been fixed in version 3.2.3...

CVE-2026-27463 Combodo iTop: Version disclosure via login page logo

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, the HTML title attribute of the logo in the login page contains the complete iTop version. This issue has been fixed in version 3.2.3...

CVE-2026-50290 @asymmetric-effort/specifyjs: CSS expression sanitization is bypassable in renderToString

SpecifyJS is a declarative TypeScript user interface framework. Prior to version 0.2.136, CSS value sanitization stripped expression and urljavascript: using simple regex, but could be bypassed with CSS unicode escapes \65xpression, null bytes, or CSS comments exp//ression. These CSS injection...

CVE-2026-50288 @asymmetric-effort/specifyjs: URL parse failure silently allows request

SpecifyJS is a declarative TypeScript user interface framework. Prior to version 0.2.136, when new URL throws a parse error, the assertSecureUrl function returned without throwing, silently allowing the request to proceed without HTTPS validation. Starting in version 0.2.136, the catch block now...

CVE-2026-67361 Joomla Extension - j2commerce.com - Unauthenticated file upload with missing directory protection in J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5

Joomla Extension - j2commerce.com - Unauthenticated file upload with missing directory protection in J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5 - The file upload endpoint accepted POST requests from unauthenticated visitors with no CSRF token. Compounding this, the installer manifest omitted...

CVE-2026-74252 Joomla Extension - j2commerce.com - Stored XSS in Guest checkout in J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5

Joomla Extension - j2commerce.com - Stored XSS in Guest checkout in J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5 - J2Commerce 4.1.5 is vulnerable to Stored Cross-Site Scripting XSS through the guest checkout billing address fields. An unauthenticated attacker exploits a filter bypass in Joomla...

CVE-2026-67358 Joomla Extension - j2commerce.com - Download quota manipulation in J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5

Joomla Extension - j2commerce.com - Download quota manipulation in J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5 - An authenticated user with a valid order token could increment the download limit counter on a download record belonging to a different order. The endpoint also lacked a CSRF token...

CVE-2026-67362 Joomla Extension - j2commerce.com - Open redirect in cart controller in J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5

Joomla Extension - j2commerce.com - Open redirect in cart controller in J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5 - Four task handlers accepted a base64-encoded URL from user input and redirected to it without validating the destination host, enabling phishing using the shop's trusted domai...

CVE-2026-67359 Joomla Extension - j2commerce.com - Order content disclosure J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5

Joomla Extension - j2commerce.com - Order content disclosure J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5 - An unauthenticated visitor could supply any orderid as a query parameter to render the full checkout confirmation page for that order, including line items, prices, and totals...

CVE-2026-67360 Joomla Extension - j2commerce.com - Cross-customer order replication in J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5

Joomla Extension - j2commerce.com - Cross-customer order replication in J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5 - An authenticated user could supply another customer's orderid to copy their cart contents and address data into the attacker's session. The CSRF token was validated but...

CVE-2026-54071 BabelDOC: Arbitrary Code Execution via CMap Pickle Deserialization in babeldoc/pdfminer/cmapdb.py

BabelDOC is a document translation tool. Prior to 0.6.3, BabelDOC's vendored PDF parser in babeldoc/pdfminer/cmapdb.py deserializes untrusted pickle data when CMapDB.loaddata loads CMap files. PDF-controlled Encoding or CMapName values and embedded PostScript usecmap operators can reach this sink...

CVE-2026-54073 VeraCrypt: Hidden volume quick format weakens plausible deniability

VeraCrypt provides disk encryption with strong security based on TrueCrypt. From 1.26.6 until 1.26.29, file-hosted hidden volume creation forces quick format and the FormatNoFs function in src/Common/Format.c and FormatFat function in src/Common/Fat.c use WriteFile to place raw zeroed sectors at...

CVE-2026-54681 DiscordChatExporter: HTML attribute injection via unescaped emoji name in HTML export

DiscordChatExporter saves Discord chat logs to a file. Prior to 2.47.2, the VisitEmojiAsync method in DiscordChatExporter.Core/Exporting/HtmlMarkdownVisitor.cs interpolates emoji.Name into the alt attribute and emoji.Code into the title attribute without HTML entity encoding. This affects HTML...

CVE-2026-55850 Element Web: A malicious homeserver can inject HTML in Element Web using its homepage

Element Web is a Matrix web client built using the Matrix React SDK. Prior to 1.12.22, EmbeddedPage in apps/web/src/components/structures/EmbeddedPage.tsx renders homeserver-supplied homepage content through dangerouslySetInnerHTML without passing it through sanitizedHtmlNode. A malicious...

CVE-2026-77795 Dromara RuoYi-Vue-Plus Workflow Endpoint TestLeaveController improper authorization

A vulnerability was identified in Dromara RuoYi-Vue-Plus up to 5.6.2. This issue affects the function FlwInstanceController/FlwDefinitionController/FlwCategoryController/FlwSpelController/TestLeaveController of the component Workflow Endpoint. Such manipulation leads to improper authorization. Th...

CVE-2026-35163 OctoPrint: XSS in Suppressed Command Notifications

OctoPrint provides a web interface for controlling consumer 3D printers. Prior to 1.11.8 and 2.0.0rc3, Suppressed Command notification popups use PNotify rendering for printer-controlled payload.command and payload.message values in src/octoprint/static/js/app/viewmodels/terminal.js without HTML...

CVE-2026-63466 Unleash: Global Mustache.escape override disables HTML escaping process-wide, enabling Slack/Teams link-injection via unrestricted username

Unleash is an open-source feature management platform. Prior to 8.0.3, FeatureEventFormatterMd.format in src/lib/addons/feature-event-formatter-md.ts assigns Mustache.escape to an identity function before rendering action and path templates. Because Mustache.escape is process-wide, the assignment...

CVE-2026-63004 Unleash: Addon webhook URL is dialed server-side with no internal-address filtering, enabling SSRF to internal services / cloud metadata and exfiltration of configured request headers

Unleash is an open-source feature management platform. Prior to 7.5.2, 7.6.5, and 8.0.2, the addon and integration subsystem passes the operator-controlled parameters.url value from src/lib/addons/webhook.ts and the Slack, Microsoft Teams, Datadog, and New Relic integrations to Addon.fetchRetry i...

CVE-2026-71862 Checkmate: Sensitive Bearer Token Exposure via Public Status Pages When showURL Setting is Enabled

Checkmate is an open-source, self-hosted tool designed to track and monitor server hardware, uptime, response times, and incidents in real-time with beautiful visualizations. From 3.3.0 until 3.9.2, enabling the global showURL setting causes the unauthenticated GET /api/v1/status-page/:url endpoi...

CVE-2026-70656 Checkmate: Regular Expression Denial of Service (ReDoS) via User-Controlled Regex in Monitor Advanced Matching

Checkmate is an open-source, self-hosted tool designed to track and monitor server hardware, uptime, response times, and incidents in real-time with beautiful visualizations. From 3.5.1 until 3.9.2, an authenticated admin or superadmin can set matchMethod to regex and place a malicious expression...

CVE-2026-27875 Simplex Incident Manager Clear Test

Cleartext Storage of Sensitive Information in Memory vulnerability in Johnson Controls Simplex Incident Manager / Autocall Fire Administrator may allow an attcker to Retrieve Embedded Sensitive Data. This issue affects Simplex Incident Manager / Autocall Fire Administrator: before 2.01.05...

CVE-2026-77237 Missing type validation in xQueueAddToSet in FreeRTOS-Kernel

Missing queue-set type validation in xQueueAddToSet in the FreeRTOS-Kernel before 11.3.1 might allow an unprivileged task on MPU-enabled ports with configUSEQUEUESETS=1 to read privileged kernel memory. To remediate this issue, users should upgrade to version 11.3.1 or later...

CVE-2026-71494 Infracost: Terraform Cloud and registry token disclosure via unvalidated hostname

Infracost provides cloud cost intelligence for engineers, AI coding agents, and CI/CD. Prior to 0.10.45, internal/hcl/remotevariablesloader.go and related Terraform Cloud, remote-plan, and Terragrunt registry request paths can attach a configured Terraform Cloud or registry token to a destination...

CVE-2026-62675 Omnigent: Uploaded Agent Bundle Allows Authenticated Runner RCE via Python Callable Tools

Omnigent is an open-source AI agent framework and meta-harness for orchestrating coding agents. Prior to 0.3.0, multipart POST /v1/sessions accepts an authenticated user's agent bundle and omnigent/server/bundles.py validateagentbundle does not reject a tools..callable dotted Python path...

CVE-2026-77236 Missing size validation in SecureContext_AllocateContext in FreeRTOS-Kernel

Missing minimum size validation in secure context allocation in FreeRTOS-Kernel before 11.3.1 might allow local users to corrupt secure-world heap metadata via an out-of-bounds write with an undersized stack size parameter. To remediate this issue, users should upgrade to version 11.3.1 or later...

CVE-2026-62677 Omnigent: Unvalidated os_env.cwd in agent bundle yields arbitrary host filesystem access on runners without OMNIGENT_RUNNER_WORKSPACE

Omnigent is an open-source AI agent framework and meta-harness for orchestrating coding agents. Prior to 0.3.0, an authenticated user can upload a session-scoped agent bundle with an absolute or traversal-containing osenv.cwd value because omnigent/spec/parser.py stores the value verbatim and...

CVE-2026-41450 UAC < 3.3.0 Command Injection via command_collector.sh

UAC Unix-like Artifacts Collector versions prior to 3.3.0 contain a command injection vulnerability in the commandcollector function where foreach command output lines are substituted directly into command strings via sed without proper escaping before being evaluated with eval. Attackers can...

CVE-2026-41449 UAC < 3.3.0 Command Injection via run_command.sh

UAC Unix-like Artifacts Collector versions prior to 3.3.0 contain a command injection vulnerability in the runcommand function that allows attackers to execute arbitrary commands by injecting shell metacharacters into untrusted data such as usernames, process names, or filenames. Attackers can...

CVE-2026-17252 Unauthenticated Denial of Service via Composed HTTP Parsing and Stack-Based Out-of-Bounds Write Vulnerability in TL-MR6400 Web Management Interface

A stack-based out-of-bounds write vulnerability exists in the login request handling functionality of the administrative web interface of TP-Link TL-MR6400 v7 routers. An unauthenticated adjacent attacker can trigger the vulnerability by sending a specially crafted malformed HTTP request...

CVE-2026-17251 Unauthenticated Denial of Service via Null Pointer Dereference in HTTP Request Parsing

A NULL pointer dereference vulnerability exists in the HTTP request parsing functionality of TL-MR6400 v7. An unauthenticated remote attacker can trigger the vulnerability by sending a specially crafted HTTP request containing a malformed session cookie header. Successful exploitation may cause...

CVE-2026-17250 Authenticated Remote Code Execution via Stack-Based Buffer Overflow in Firmware Update Handling

A stack-based buffer overflow vulnerability exists in the firmware update functionality of TL-MR6400 v7 due to unsafe processing of attacker-controlled metadata within a firmware image. Successful exploitation may allow an authenticated attacker to trigger memory corruption and execute arbitrary...

CVE-2026-39909 llama.cpp Use-After-Free in RPC GRAPH_RECOMPUTE Handler

llama.cpp before b8585 contains a use-after-free vulnerability in the RPC server's GRAPHRECOMPUTE handler that allows unauthenticated remote attackers to achieve arbitrary read and write access by storing a computation graph, freeing referenced buffers, and reclaiming freed memory with...

CVE-2026-54789 mod_auth_openidc has out-of-bounds read and write in state cookie parsing

modauthopenidc is an OpenID Certified authentication and authorization module for the Apache 2.x HTTP server that implements the OpenID Connect Relying Party functionality. Prior to 2.4.19.4, an out-of-bounds read and a one-byte out-of-bounds write exist in the state-cookie parser of...

CVE-2026-22681 OpenViking < 0.3.4 SSRF via /api/v1/resources

OpenViking before 0.3.4 contains a server-side request forgery vulnerability that allows authenticated low-privilege attackers to access internal network services by submitting arbitrary URLs to the resources API endpoint. Attackers can POST a crafted URL to /api/v1/resources, causing the server ...

CVE-2026-75933 Jet Admin Stored XSS

Jet Admin allows an authenticated attacker to inject JavaScript via the sign-in page's scripts and styles option. Injected script is executed in the context of any visiting user's domain...

CVE-2026-75932 Jet Admin tenant isolation failure

Jet Admin allows an attacker to create a malicious app and connect it to a target user's custom domain, edit the authentication configuration, and reroute traffic to the attacker-controlled app. Once connected to the target domain, the attacker's workspace is populated with the victim's OAuth...

CVE-2026-75928 Brushfire unauthenticated information disclosure

The Brushfire platform's video content streaming application https://online.brushfire.com exposes database path in requests to users, allowing a remote, unauthenticated attacker to read information about other users. Fixed February 2026...

CVE-2026-49114 ONNX symlink-following and path-traversal arbitrary file write

In ONNX before 1.21.0, the 'saveexternaldata' function builds the external-data file path from the model's externaldata location field and opens it for writing without 'ONOFOLLOW/OEXCL', after a non-atomic 'os.path.isfile' check. A local attacker with write access to the directory where a victim...

CVE-2026-69502 Azure SQL Database Elevation of Privilege Vulnerability

...

CVE-2026-77814 Infinite Image Browsing is_path_trusted Prefix Comparison Omits the Trailing Path Separator

ispathtrusted in scripts/iib/api.py compares the requested path against each allowed parent directory with path.startswithparentpath, without appending a path separator. A directory whose name merely begins with an allowed path therefore satisfies the comparison, so where /data/images is allowed ...