CVE-2026-54174

CVE-2026-54174 affects melange (Chainguard's declarative APK package builder), specifically the Apko component (chainguard.dev/apko). Prior to Apko 1.2.9 (corresponding to melange 0.50.4), the tool verified the control section hash (.PKGINFO etc.) against the signed APKINDEX but never verified th...

CVE-2026-47773

ArduinoBLE (the Arduino library providing Bluetooth Low Energy connectivity on certain Arduino models) is vulnerable to memory corruption in versions prior to 2.0.2 . The root cause is a missing bounds check in the ATT layer write request handler, allowing a remote, unauthenticated BLE client to ...

CVE-2026-48490

ArduinoCore-avr (the source code and configuration files of the Arduino AVR Boards platform) contains a stack-based buffer overflow in its floating-point concatenation path. Versions prior to 1.8.8 are affected. Passing values near the extremes of the float or double range to String::concat(float...

CVE-2026-54165

Dobase , an open-source self-hosted workspace, is affected by a one-click stored DOM-based XSS in its public shared-folder image gallery. The root cause is that a file's name attribute is fully attacker-controlled and never sanitized; it is round-tripped through an ERB-escaped data-name attribute...

CVE-2026-56827

Shopper is an open-source e-commerce platform for Laravel. This vulnerability affects five Filament groupedBulkActions blocks across admin Livewire pages (Attribute, Tag, Brand, Category, Supplier) that omit the ->authorize(...) permission gate. A staff user holding only a read-only browse_* p...

CVE-2026-49439

OpenRemote (open-source IoT platform) has a missing authorization flaw in its predicted datapoint write endpoint (PUT /api/{realm}/asset/predicted/{assetId}/{attributeName}). The implementation checks READ_ASSETS instead of requiring write:assets before calling assetPredictedDatapointService.upda...

CVE-2026-50025

Mousehole is a background service that updates a seedbox IP for MyAnonamouse (MAM) and provides a web management interface. Prior to version 0.4.05 , its HTTP/WebSocket management boundary is reachable without application-layer authentication or browser/LAN provenance checks. The root cause is th...

CVE-2026-59971

CVE-2026-59971 affects the MySQL MCP Server (mysql_mcp_server) in its SSE/HTTP transport mode . The SseServerTransport is constructed without security_settings, disabling the MCP Python SDK's DNS-rebinding protection (Origin/Host header validation). Combined with no CORS/TrustedHost middleware, u...

CVE-2026-49464

The nl.nl-portal:taak package in NL Portal Backend Libraries (Dutch government portals) has an insecure direct object reference (IDOR) in the submitTaakV2 GraphQL mutation. Versions 1.5.0 through 3.0.0 fail to verify task ownership: the resolver fetches a task by UUID and transitions it to comple...

CVE-2026-81907

Concrete CMS 9.5.2 and below is affected by a CSRF vulnerability in the Express "Clear Entries" function (POST /index.php/dashboard/system/express/entities/delete_entries). The root cause is that the controller records but does not enforce a failed CSRF token check, allowing the destructive opera...

CVE-2026-81918

Concrete CMS versions below 9.5.3 are affected by a Stored XSS vulnerability in the Date Format field of the Page Attribute Display block . A user holding edit_page_contents permissions can store a payload that executes in the browser of any visitor who views a page where the block is configured ...

CVE-2026-81917

Concrete CMS versions below 9.5.3 contain a Stored XSS vulnerability in the Document Library block . The block controller returned the file description and tags values without applying the h() HTML-escaping function (already used for the title column), and the block view template wrote those valu...

CVE-2026-68535

Concrete CMS versions 9.2.0 through 9.5.2 are affected by a missing authorization check in the Area REST API block-create endpoint. The endpoint failed to invoke the block type controller's validate() method, which is responsible for authorizing referenced files against the user's file-manager vi...

CVE-2026-81916

Concrete CMS before 9.5.3 contains an authorization bypass in the Express entry submission flow. The dashboard submit route resolved the target entity from an attacker-controlled route ID, while the permission check validated the independently posted form's entity — the two were never compared. A...

CVE-2026-19248

CVE-2026-19248 is currently reserved with no publicly available technical details. A single sighting has been observed, but the affected product, root cause, and impact remain unknown. Monitor for updates as the holder publicizes the vulnerability.

CVE-2026-49462

NL Portal Backend Libraries (used in Dutch government portals) ships a default configuration in versions up to and including 3.0.0 that exposes two GraphQL developer features without requiring authentication: the GraphiQL playground at the /graphiql endpoint and schema introspection . Together, t...

CVE-2024-56344

This candidate has been reserved by an organization or individual " "that will use it when announcing a new security problem. When the candidate has been " "publicized, the details for this candidate will be provided...

CVE-2026-89772

CVE-2026-89772 affects the btrfs filesystem in the Linux kernel . A patch (commit 095be159f3eb) replaced the folio_clear_dirty_for_io() call in extent_write_cache_pages() with a plain folio_test_dirty() check, losing the write-protection of shared mmap PTEs during data writeback. Without this pro...

CVE-2026-89773

CVE-2026-89773 affects the drm/amd/display driver in the Linux kernel. The root cause is that the HDCP configuration routine was being invoked during a transition state , in which no valid dm_stream_ctx exists. The fix skips updating HDCP configuration unless a valid stream has been created, as r...

CVE-2026-89771

CVE-2026-89771 is a race condition in the Linux kernel ring-buffer subsystem. The trace_buffer field subbuf_size is read lockless in ring_buffer_read_page() and ring_buffer_read_start(), while it can be concurrently resized via ring_buffer_subbuf_order_set(). Even with resize_disabled, a race wit...