CVE-2026-46412

CVE-2026-46412 affects @beproduct/nestjs-auth versions 0.1.2–0.1.19. An attacker published malicious builds via a compromised npm publish token, deploying a Mini Shai-Hulud worm payload. The postinstall script harvested secrets (npm tokens from ~/.npmrc, GitHub PATs and OAuth tokens, Actions OIDC...

CVE-2026-62418

Apache Syncope is affected by CVE-2026-62418, a low-privileged authenticated SSRF via the Connectors and Resources check. Affected versions are 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.6, and 4.1.0-M0 through 4.1.1. The issue is mitigated by upgrading to version 4.0.7 or 4.1.2, which fixes t...

CVE-2026-46516

CVE-2026-46516 affects Frogman (headless FreePBX control). Before v1.6.6, the chat-console markdown formatter in assets/js/chat.js (formatMarkdown) inserted regex capture groups as raw HTML in four template patterns (inline code, bold, markdown links, download links). Tool responses containing us...

CVE-2026-62183

CVE-2026-62183 affects Apache Syncope through multiple releases (3.0.0-M0–3.0.16, 4.0.0-M0–4.0.6, 4.1.0-M0–4.1.1). The issue is an Improper Privilege Management where, when using the all-Java user workflow adapter or the Flowable user workflow adapter with a BPMN definition that bypasses admin ap...

CVE-2026-63091

ProFTPD mod_sftp in versions before 1.3.9c and 1.3.10rc3 contains a signed integer overflow in the SCP size-record parser. An authenticated, low-privilege attacker can send a crafted file size (UINT64_MAX) to produce a negative off_t, convert to uint32_t, and trigger ~4 GB read length, causing th...

CVE-2026-63090

ProFTPD mod_sftp in fxp.c suffers a heap-based buffer overflow when oversized SFTP packet fragments exceed the 16 KB reassembly buffer. In ProFTPD 1.3.9c and 1.3.10rc3, authenticated low-priv attackers can cause arbitrary code execution by manipulating reallocation and memory, including overwriti...

CVE-2026-57308

Apache Syncope is affected by an SQL injection vulnerability (CVE-2026-57308) in the Audit Events search. The issue allows an administrator with adequate entitlements to execute arbitrary SQL via stacked queries caused by unsanitized sort parameters. Affected ranges are 3.0.0-M0 through 3.0.16, 4...

CVE-2026-53421

Apache Syncope is affected by a Remote Code Execution (RCE) vulnerability (CVE-2026-53421) in the scripted connectors subsystem. An administrator with adequate entitlements can leverage scripted connectors (REST and SQL) to run Groovy scripts, enabling RCE. Affected versions include 3.0.0-M0–3.0....

CVE-2026-54910

FileBrowser Quantum is vulnerable to a path traversal flaw in the subtitlesHandler endpoint (GET /api/media/subtitles) prior to v1.4.3-beta. The vulnerability arises from two user-controlled parameters, path and name, used in filesystem operations without sanitization. The path parameter is passe...

CVE-2026-53405

CVE-2026-53405 affects Apache Syncope 3.0.0-M0 to 3.0.16, 4.0.0-M0 to 4.0.6, and 4.1.0-M0 to 4.1.1. An administrator can import BPMN process definitions containing a Groovy scriptTask; when started, the script executes on the server with no sandbox, enabling remote code execution. Remediation is ...

CVE-2026-63071

Apache Syncope is affected by an RCE in Groovy Sandbox due to improper isolation. The issue affects 3.0.0-M0–3.0.16, 4.0.0-M0–4.0.6, and 4.1.0-M0–4.1.1, exploitable by a privileged administrator who can craft a malicious Groovy class to bypass the sandbox. Remedy: upgrade to 4.0.7 or 4.1.2, which...

CVE-2026-12701

The Pulpcore CVE-2026-12701 vulnerability affects the relative_path_validator used in FilesystemExport. An authenticated administrator can supply a crafted relative_path containing embedded directory traversal sequences (for example, look­ing/normal/../../../../etc/shadow) that bypasses checks an...

CVE-2026-54685

FileBrowser Quantum exposes a timing-side-channel in the /api/auth/login endpoint prior to version 1.3.2-beta, allowing unauthenticated users to distinguish valid usernames from invalid ones via response-time differences (bcrypt path for valid usernames). A PoC demonstrates the attack, and the is...

CVE-2026-46410

FileBrowser Quantum exposes sensitive share information (source and path) to unauthenticated users. Affected versions are prior to 1.3.2-stable and 1.4.1-beta. The issue is fixed in 1.3.2-stable and 1.4.1-beta. No public workarounds are documented in the provided sources. Remediation: upgrade to ...

CVE-2026-45270

CI4MS (ci4-cms-erp/ci4ms) has a stored-XSS vulnerability in its Pages module due to html_purify mutating the input by reference, while the DB stores raw content and the public renderer outputs it without escaping. The issue affects language-keyed page content; administrators and visitors can exec...

CVE-2026-16277

The CVE describes a stack-based buffer overflow in rpcbind’s rpcinfo utility. When querying a remote rpcbind service with rpcinfo -l, the server-provided address information is copied into a fixed-size buffer without sufficient bounds checking, enabling a potential crash of the rpcinfo client and...

CVE-2026-16252

CVE-2026-16252 affects Beijing Shenzhou Shihan Technology Multimedia Integrated Business Display System version 8.2.2. The vulnerability is a SQL injection in an unknown function within the file path /admin/system/structure/updateStructure/deflate/Insecure/Staffshinel Ds.jsp?Shine ID=aaa, trigger...

CVE-2026-45139

Summary of CVE-2026-45139 (CI4MS Fileeditor) : The Fileeditor module fails to validate the source path extension for two destructive endpoints, deleteFileOrFolder and renameFile, allowing a backend user with file-editor permissions to delete or rename arbitrary files inside the project root (e.g....

CVE-2026-59238

CVE-2026-59238 describes a Stored XSS in Pentestify prior to 1.1.0. The vulnerability is in the client-side report rendering functions (renderPreview, renderEditor, renderAuditData in js/app.js), where payloads placed in a finding’s images array or a report’s client_logo array are interpolated in...

CVE-2026-57311

Windu CMS is affected by CVE-2026-57311 due to lack of validation for uploaded file types. An authenticated attacker can upload arbitrary files, including PHP, which can lead to Remote Code Execution. The vulnerability has been confirmed in version 4.1 and may affect other versions; the available...