CVE-2025-45871

LogicalDOC Enterprise, version 9.1.1 and below , is vulnerable to a blind SQL injection within the WorkflowsDataServlet component. This flaw allows an authenticated user to manipulate SQL queries by providing a crafted workflow template name . The impact involves unauthorized data access or manip...

CVE-2026-105786

The open source note-taking application Joplin is vulnerable to an unauthenticated account takeover in versions prior to 3.7.13 . The root cause lies in packages/server/src/models/ApplicationModel.ts, which accepts a caller-chosen application authorization identifier, and the public endpoint pack...

CVE-2026-105471

A SQL injection vulnerability exists in the Registration Handler component of the girishsaraf Online-Appointment-Booking-System (up to commit f427b4757128ca253d33d0cc4e87bbb9c999a4d5). The flaw is located in an unknown function within the signup.php file, where manipulating the fname argument all...

CVE-2026-82988

The ViewSonic ViewBoard smartboard, which uses an Android-based system, is vulnerable to an arbitrary file download in its vCast APK delivery mechanism . An unauthenticated remote attacker can trigger the installation of an unprivileged APK by serving a malicious URL through an unauthenticated do...

CVE-2026-82989

ViewSonic ViewBoard smartboards, which run on an Android-based system, are vulnerable to an input injection flaw in the vCast software suite. The vulnerability exists in exposed network services, allowing a remote, unauthenticated attacker to inject arbitrary input into service endpoints via HTTP...

CVE-2026-105785

Prior to Joplin Server 3.7.2 , a vulnerability exists in the TokenModel.ts and UserModel.ts components. The system stores CSRF, account-confirmation, email-change, and password-reset tokens without distinguishing their specific purposes. This allows an attacker to use a leaked CSRF or confirmatio...

CVE-2026-105784

The open-source note-taking application Joplin is vulnerable to CSS injection in versions prior to 3.7.13 . The root cause is the improper handling of jsoncanvas fences, where the TextNode.tsx and FileNode.tsx components render card content using the full Markdown renderer and insert the resultin...

CVE-2026-105783

The Joplin note-taking application (prior to version 3.7.13 ) is vulnerable to cross-origin theft of a permanent API token when the optional Web Clipper server is enabled. The root cause is located in packages/lib/ClipperServer.ts, where the server sends Access-Control-Allow-Origin: * and fails t...

CVE-2026-105782

The Scrapy web crawling framework (versions 1.4.0 through 2.14.1) is vulnerable to arbitrary module import via the Referrer-Policy response header. The RefererMiddleware in scrapy/spidermiddlewares/referer.py incorrectly treats values resembling Python import paths as referrer policy classes, imp...

CVE-2026-105764

In versions prior to 3.2.4 , Immich (a self-hosted photo and video management solution) is vulnerable to Remote Code Execution (RCE) . An authenticated non-admin user can upload crafted SVG files that bypass the libvips native loader and fall through to ImageMagick coders. By using attacker-contr...

CVE-2026-105763

The Twenty open-source CRM platform is vulnerable to plaintext password disclosure in versions 1.20.10 through 2.7.0 . The /metadata GraphQL connectedAccounts query returns connectionParameters for all connected accounts in a workspace without enforcing the calling user's identity or account visi...

CVE-2026-105762

The open-source LLM app development platform Dify is vulnerable to an unauthenticated Server-Side Request Forgery (SSRF) in the /console/api/remote-files/upload endpoint within api/controllers/web/remote_files.py. The vulnerability exists because the application accepts attacker-controlled URLs w...

CVE-2026-105761

The open-source LLM app development platform Dify contains an Insecure Direct Object Reference (IDOR) vulnerability in versions prior to 1.16.0 . The root cause is located in api/controllers/console/app/mcp_server.py, where the PUT /console/api/apps//server endpoint uses AppMCPServerController.pu...

CVE-2026-105760

The vLLM inference and serving engine for large language models is vulnerable to CPU and memory exhaustion in versions prior to 0.30.0 . An attacker can use the media_io_kwargs field to select the GLMGA video backend and provide large values for the fps and max_frames options. Because there is no...

CVE-2026-105759

The vLLM inference and serving engine for large language models is vulnerable to a Denial of Service (DoS) attack in versions prior to 0.30.0 . The root cause lies in the Rust frontend's track_http_metrics middleware, which records raw HTTP method tokens as Prometheus labels without validation or...

CVE-2026-104852

The GraphQL Tools utils package is vulnerable to prototype pollution in the mergeDeep function prior to version 12.0.1 . The root cause is that the function follows inherited properties and fails to exclude __proto__, constructor, or prototype keys during recursive merging. An unauthenticated Gra...

CVE-2026-105758

The vLLM inference engine (versions 0.24.0 through 0.30.0 ) is vulnerable to a resource exhaustion issue within the Qwen2VLVideoBackend and Qwen3VLVideoBackend classes. The software fails to enforce server-side ceilings on media_io_kwargs.video.max_frames and media_io_kwargs.video.fps fields prov...

CVE-2026-105757

The vLLM inference and serving engine for large language models is vulnerable to a denial of service (DoS) condition in versions prior to 0.30.0 . The root cause is that structured-output request failures can escape request-scoped validation and reach the EngineCore fatal-error path. Specific tri...

CVE-2026-105756

Prior to version 0.30.0 , the vLLM inference and serving engine is vulnerable to a denial of service via an uncaught ValueError . The root cause is improper input validation of the cache_salt value in OpenAI-compatible request models. On deployments using the LMCache-MP connector, providing a sal...

CVE-2026-105755

The vLLM inference and serving engine (prior to version 0.30.0 ) is vulnerable to a cross-request integrity break in its flash late-interaction scoring at the /score and /rerank endpoints. The root cause is that the system derives the query_key value from the caller-controlled X-Request-Id header...