CVE-2026-92592

Craft CMS 4.8.0–4.18.5 and 5.0.0–5.10.12 are affected by a remote code execution vulnerability (CVSS 3.1 score 8.8 High ). The root cause is that the HMAC signature for the license-shun cookie is not bound to its purpose—Yii's cookieValidationKey derives from the same Craft securityKey used for s...

CVE-2026-92591

Craft CMS versions 5.0.0 through 5.10.12 misinterpret a database connection failure as the application being uninstalled, exposing anonymous installer actions (e.g., install/validate-site) on a production site. The installer's site-name field is serialized through Site::getName(), which expands $...

CVE-2026-92590

Craft CMS versions 5.7.0 through 5.10.12 are affected by a stored cross-site scripting (XSS) vulnerability in the Generated Fields feature. The root cause is the disabling of Twig autoescaping combined with a failure to encode cached values , allowing content editors to inject malicious JavaScrip...

CVE-2026-92589

Craft CMS versions 5.0.0 through 5.10.12 contain a broken access control flaw in the actions/nested-elements/reorder endpoint. Unlike the corresponding delete endpoint, this endpoint trusts the manageNestedElements::::field: session flag alone and never rechecks the caller's savePeerEntries permi...

CVE-2026-92588

n8n is a workflow automation platform. In versions before 1.123.76 , 2.37.7 , and 2.38.2 , the source control push endpoint derived the set of files to push from client-supplied file paths and status rather than from server-side status computed for the requesting user. An authenticated project-sc...

CVE-2026-92587

n8n (workflow automation platform) contains a sandbox escape in its Git node affecting versions before 1.123.76 , 2.37.7 , and 2.38.2 . The root cause is a validation/resolution mismatch: a relative remote URL is checked against the configured repositoryPath, but git actually resolves it from its...

CVE-2026-92586

AVideo through 29.0 (commit c3edcc274c389816d434acadac07ee78eaf330c1) contains an authorization bypass in the set_api_comment function. The function fails to verify video access permissions, allowing authenticated users to post comments on password-protected and group-restricted videos by submitt...

CVE-2026-92585

AVideo through 29.0 (commit c3edcc274c389816d434acadac07ee78eaf330c1) fails to validate video access permissions in its API like endpoint. The root cause is a missing authorization check in the set.json.php endpoint when called with APIName parameters, allowing any logged-in user to submit like o...

CVE-2026-92584

AVideo through version 29.0 (revision e01e41ecc) is affected by a stored cross-site scripting vulnerability in the unauthenticated view-counter endpoint objects/videoAddViewCount.json.php. The attacker-supplied User-Agent header is written into the videos_statistics.app column via VideoStatistic:...

CVE-2026-92583

AVideo through 29.0 contains a race condition in the enforceRateLimit() function that fails to atomically increment rate limit counters. An unauthenticated remote attacker can bypass all rate limits , including the documented 30-attempts-per-5-minutes login brute-force protection , by issuing con...

CVE-2026-92582

AVideo (WWBN/AVideo) through 29.0 is vulnerable to cross-site request forgery (CSRF) in objects/videoAddNew.json.php. The file disables AVideo's automatic CSRF guard and untrusted-request check solely because user and pass parameters are present in the request; their values are never validated an...

CVE-2026-92581

In AVideo through 29.0 , the Like::__construct() method performs counter arithmetic on raw request values before validation. This allows array-typed parameters to desynchronize stored votes from denormalized counters. An authenticated attacker can send array-typed like parameters followed by ordi...

CVE-2026-92580

AVideo through 29.0 in the CloneSite plugin is vulnerable to stored OS command injection. In plugin/CloneSite/cloneClient.json.php (~line 270), the stored SSH password is substituted into the command sshpass -p '{password}' rsync ... via a plain str_replace with no escaping, so a single quote bre...

CVE-2026-92579

AVideo through version 29.0 is affected by a broken access control flaw in its autoCSRFGuard() function. The function maintains a hardcoded allowlist of exempt basenames that are tested without directory context, meaning plugin files whose filenames match core filenames inadvertently inherit CSRF...

CVE-2026-92578

WWBN AVideo (through version 29.0) contains an authentication bypass vulnerability. The root cause is that the stored users.password hash is accepted as a valid login credential through two independent code paths: loginFromRequest() and encryptPasswordVerify() . An attacker who obtains the stored...

CVE-2026-92577

AVideo through version 29.0 contains a broken access control vulnerability in the get_api_video API endpoint. The flaw resides in the clean_title branch, which fails to enforce user-group restrictions, allowing anonymous callers to query videos by their public slug and retrieve owner PII fields i...

CVE-2026-92576

HKUDS nanobot before version 0.3.0 is affected by a server-side request forgery (SSRF) vulnerability in the WebFetchTool component. The root cause is the _validate_url() function failing to block internal IP ranges and private addresses, allowing attackers to send messages instructing the bot to ...

CVE-2026-89034

TCH QRing smart ring model R20_B006 (firmware RT09R20_1.00.00_250318) contains an unauthenticated Bluetooth Low Energy vulnerability. The exposed Nordic UART Service enforces no client authentication or command authorization, allowing any nearby attacker within BLE range to connect directly, bypa...

CVE-2026-64684

RMCP , the official Rust SDK for the Model Context Protocol, is affected in StreamableHttpClientTransport (prior to version 2.1.0). The custom_headers configured via StreamableHttpClientTransportConfig are applied to the reqwest client without being marked as sensitive. When a malicious or compro...

CVE-2026-92828

This CVE entry is currently reserved , meaning technical details about the affected product, vulnerability type, and impact are not yet publicly available. Red Hat lists the entry but has not published a description. Monitor for updates once the assigning organization publishes full details.