CVE-2026-58486

CVE-2026-58486: HedgeDoc prior to 1.11.0 is vulnerable to a YAML alias bomb in note frontmatter. HedgeDoc parses frontmatter with js-yaml.load (js-yaml v3) via @hedgedoc/meta-marked, resolving YAML anchors and potentially expanding a malicious payload into a huge object, consuming CPU on each req...

CVE-2026-39259

Technical details for CVE-2026-39259 are not publicly available in the provided documents. No affected products, vectors, or remediation are described. Monitor for updates.

CVE-2026-38165

Technical details for CVE-2026-38165 are not publicly available in the provided documents. Monitor for updates.

CVE-2026-54337

Technical details for CVE-2026-54337 are not publicly available in the provided documents. Monitor for updates and new disclosures.

CVE-2323-41892

Technical details for CVE-2323-41892 are not publicly available in the provided documents. Monitor for updates as new information may be released.

CVE-2026-36851

Technical details about CVE-2026-36851 are not publicly available in the provided documents. Monitor for updates.

CVE-2026-15598

The CVE affects antv layout 2.0.0, specifically the setNestedValue function in lib/util/object.js. A manipulation of the argument path can lead to prototype pollution, allowing remote modification of object prototype attributes. The advisory notes the attack can be launched remotely, with low att...

CVE-2026-25194

Technical details for CVE-2026-25194 are not publicly available in the provided documents. No affected products, vulnerable components, or remediation information are specified. Monitor for updates as the entry is reserved/placeholder.

CVE-2026-54520

Technical details for CVE-2026-54520 are not provided in the supplied documents. The entry is reserved with no public details yet. Monitor for updates as information becomes available.

CVE-2026-52658

Technical details are not publicly available in the provided documents. Monitor for updates.

CVE-2026-54519

Technical details for CVE-2026-54519 are not publicly available in the provided documents. Monitor for updates as more information is released.

CVE-2026-50980

Technical details for CVE-2026-50980 are not publicly available in the provided documents. No affected products, impact, or remediation are disclosed. Monitor for updates as information is released.

CVE-2026-55494

Technical details for CVE-2026-55494 are not publicly available in the provided documents. Monitor for updates; no information on affected products, root cause, impact, or remediation is available here.

CVE-2026-58487

HedgeDoc before version 1.11.0 is vulnerable to stored HTML injection via the local-part of registered email addresses. An attacker could register a specially crafted email, reuse the local-part as the display name, and inject HTML into pages viewed by others (publish, slide views, and collaborat...

CVE-2026-56877

The CVE-2026-56877 issue affects Skillable/SCORM lab launch endpoint (scorm.skillable.com). The root cause is that the server does not validate the client-supplied userId against the authenticated session token, allowing an authenticated user to substitute arbitrary userId values. This can bypass...

CVE-2026-15597

CVE-2026-15597 affects SourceCodester Class and Exam Timetabling System (1.0/2.php). The vulnerability is an SQL injection in the /edit_exam2.php script triggered by manipulating the ID parameter, enabling remote attackers to potentially impact confidentiality, integrity, and availability. Techni...

CVE-2026-58488

CVE-2026-58488 affects HedgeDoc versions prior to 1.11.0. The vulnerability arises from the login/register rate-limit logic which, when a cf-connecting-ip header is present, uses that header instead of the user’s real IP—even if requests did not originate from Cloudflare. This allowed an attacker...

CVE-2026-62328

Summary: CVE-2026-62328 affects 9Router up to version 0.4.41 and describes an unauthenticated information-disclosure vulnerability exposed via unprotected API endpoints. Attackers can remotely query the request-logs and request-details routes (which lack authentication middleware) to enumerate pa...

CVE-2026-62327

The vulnerability concerns 9Router up to version 0.4.41. An unauthenticated request to the Next.js API route /api/usage/stats is possible due to missing authentication middleware, leading to exposure of plaintext API keys for all connected AI provider accounts, along with token counts, costs and ...

CVE-2026-15680

CVE-2026-15680 affects Lorex 2K Indoor Wi‑Fi Security Camera. The vulnerability is in the sonia binary’s JSON request parsing, where lack of validation of a user‑supplied string used as a format specifier can allow a network‑adjacent attacker to execute arbitrary code with root privileges. Authen...