CVE-2026-92578

WWBN AVideo (through version 29.0) contains an authentication bypass vulnerability. The root cause is that the stored users.password hash is accepted as a valid login credential through two independent code paths: loginFromRequest() and encryptPasswordVerify() . An attacker who obtains the stored...

CVE-2026-92579

AVideo through version 29.0 is affected by a broken access control flaw in its autoCSRFGuard() function. The function maintains a hardcoded allowlist of exempt basenames that are tested without directory context, meaning plugin files whose filenames match core filenames inadvertently inherit CSRF...

CVE-2026-92577

AVideo through version 29.0 contains a broken access control vulnerability in the get_api_video API endpoint. The flaw resides in the clean_title branch, which fails to enforce user-group restrictions, allowing anonymous callers to query videos by their public slug and retrieve owner PII fields i...

CVE-2026-92576

HKUDS nanobot before version 0.3.0 is affected by a server-side request forgery (SSRF) vulnerability in the WebFetchTool component. The root cause is the _validate_url() function failing to block internal IP ranges and private addresses, allowing attackers to send messages instructing the bot to ...

CVE-2026-89034

TCH QRing smart ring model R20_B006 (firmware RT09R20_1.00.00_250318) contains an unauthenticated Bluetooth Low Energy vulnerability. The exposed Nordic UART Service enforces no client authentication or command authorization, allowing any nearby attacker within BLE range to connect directly, bypa...

CVE-2026-64684

RMCP , the official Rust SDK for the Model Context Protocol, is affected in StreamableHttpClientTransport (prior to version 2.1.0). The custom_headers configured via StreamableHttpClientTransportConfig are applied to the reqwest client without being marked as sensitive. When a malicious or compro...

CVE-2026-92828

This CVE entry is currently reserved , meaning technical details about the affected product, vulnerability type, and impact are not yet publicly available. Red Hat lists the entry but has not published a description. Monitor for updates once the assigning organization publishes full details.

CVE-2026-85469

quay-builder-qemu contains a flaw in its release workflow, where the third-party GitHub Action Noelware/docker-manifest-action is pinned to a mutable @master branch . Because the reference is not fixed to a specific commit, a remote attacker who compromises the upstream action repository can inje...

CVE-2026-62997

Kedro-Datasets (data connectors for the Kedro framework) contains a remote code execution vulnerability in its opt-in kedro_datasets_experimental component, specifically the PyTorchDataset class. From version 5.0.0 through 9.5.0 , .pt model files are loaded via torch.load without enforcing weight...

CVE-2026-75513

Marten is a .NET transactional document database and event store on PostgreSQL. Versions 7.0.0 through 9.13.0 are affected by a SQL injection vulnerability in several LINQ and tenant-management code paths that interpolate runtime strings into single-quoted SQL literals without escaping or paramet...

CVE-2026-81871

OpenTelemetry-Go prior to version 0.21.0 contains a TLS configuration bug in the exporters/otlp/otlplog/otlploggrpc package. Environment variables for TLS certificates (OTEL_EXPORTER_OTLP_LOGS_CERTIFICATE, OTEL_EXPORTER_OTLP_CERTIFICATE, and related client certificate vars) are loaded via loadEnv...

CVE-2026-81872

OpenTelemetry-Go (the Go implementation of OpenTelemetry) has a denial-of-service vulnerability in its go.opentelemetry.io/otel/sdk/log BatchingProcessor . When attacker-driven log emission fills the asynchronous export buffer while the exporter is backpressured, a failed non-blocking EnqueueExpo...

CVE-2026-81869

OpenTelemetry-Go versions 1.10.0 through 1.33.0 contain a flaw in the sdk/trace/span.go attribute truncation path. When a string or string-slice attribute contains the valid Unicode replacement character U+FFFD , the safeTruncateValidUTF8 function misidentifies it as invalid UTF-8 and returns the...

CVE-2026-92816

ComfyUI versions before 0.30.0 contain a path traversal vulnerability in dataset save nodes (comfy_extras/nodes_dataset.py). The folder_name input is not properly sanitized, allowing an attacker to write files to arbitrary paths outside the intended output directory. By loading a crafted workflow...

CVE-2026-92815

changedetection.io through 0.60.6 is vulnerable to an unauthenticated SSRF via the browser-step Goto URL action. The root cause is that the SSRF guard is only applied to the main watch URL and is bypassed in browser step Goto URLs, allowing attackers to supply arbitrary internal URLs in the optio...

CVE-2026-92814

changedetection.io through version 0.60.6 contains a stored markup injection vulnerability in its watch_title notification token. The scraped page title is not HTML-escaped before being rendered in notification templates (see notification/handler.py), allowing an attacker to embed arbitrary marku...

CVE-2026-92812

decap-server , the local server component of the decap-cms content management system, is affected by a path traversal vulnerability in its local proxy containment guard. The guard performs a plain string prefix comparison without validating path separators, allowing attackers to access sibling di...

CVE-2026-92813

Metabase (through 0.63.18 ) is vulnerable to a Server-Side Request Forgery (SSRF) caused by improper validation of the unspecified address 0.0.0.0 in custom GeoJSON URLs . An unauthenticated attacker can save a malicious GeoJSON entry using 0.0.0.0 and trigger server-side requests that reach loop...

CVE-2026-92811

browserless versions 1.44.0 through 2.56.7 contain a file protocol restriction bypass in its Playwright websocket endpoints. Despite the ALLOW_FILE_PROTOCOL setting defaulting to false, authenticated token holders can navigate Playwright-driven browsers to file:// scheme URLs, enabling arbitrary ...

CVE-2026-92809

CVE-2026-92809 affects the PrestaShop psgdpr module (versions through 1.4.3 ). The vulnerability is an IDOR (Insecure Direct Object Reference) in GDPR consent logging: the module fails to validate that submitted consent log entries belong to the authenticated customer. An authenticated attacker c...