Tagged “cve.org”
CVEs tagged cve.org, newest first.
46499 CVEsRSS
CVE-2026-63224High· 7.2PoCOpenRemote has authenticated SQL injection in crosstab datapoint exports
OpenRemote is an open-source internet-of-things platform. Prior to 1.26.0, the `datapoint export` API constructs `CSV crosstab` SQL by concatenating an `asset name` and `attribute name` into a `COPY` query that uses `crosstab` and stream…
CVE-2026-62968High· 8.7Dream Displays has command-line argument injection in yt-dlp invocation
Dream Displays provides in-game screens for streaming videos in Minecraft. From 1.5.0 until 1.8.2, user-controlled input can influence arguments passed to `yt-dlp` under specific conditions. Unintended command-line options may be interpr…
CVE-2026-118938High· 8.8Fickling check_safety() bypass: dotted __qualname__ in STACK_GLOBAL resolves a class-method attribute path that evades call analysis
In Trail of Bits fickling through 0.1.12, a pickle STACK_GLOBAL operand carrying a dotted __qualname__ (for example "Values.read_file") is resolved by pickle's find_class through _getattribute to an arbitrary attribute path rather than t…
CVE-2026-55146Medium· 4.3LORIS has incorrect access checks in issue_tracker
LORIS (Longitudinal Online Research and Imaging System) is a self-hosted web application that provides data- and project-management for neuroimaging research. In versions from 16.0.0 prior to 27.0.4 and from 28.0.0 prior to 28.0.2, the `…
CVE-2026-63182High· 8.1PoCLightSAML: Signature reference wrapping permits unsigned assertion claims
LightSAML implements SAML 2.0 data model classes, XML serialization and deserialization, XML security, certificate support, and message bindings. Prior to 4.7.1 and 5.0.1, LightSAML and xmlseclibs disagree about which assertion an inboun…
CVE-2026-55614Medium· 6.9uhttpd vulnerable to HTTP request smuggling via case-sensitive Transfer-Encoding matching
uhttpd is a small HTTP server. In unpatched repository snapshots, `client_parse_header()` in `client.c` lowercases header names but compares the `Transfer-Encoding` value to `chunked` using case-sensitive `strcmp`. A mixed-case transfer-…
CVE-2026-59993Medium· 6.5Picotls has NULL pointer dereference during handshake, when running as a client
Picotls is a TLS protocol library that allows users select different crypto backends based on their use case. In affected revisions through 44bc503, when picotls is used as a `client-side TLS stack`, a peer can send a `HelloRetryRequest`…
CVE-2026-16760High· 8.8Fickling check_safety() bypass: likely_safe_imports grants module-origin trust to unvalidated standard library callables
In Trail of Bits fickling through 0.1.12, the _process_import() method in fickle.py adds an imported name to the likely_safe_imports set whenever the source module is present in sys.stdlib_module_names and the name is absent from the UNS…
CVE-2026-62860Medium· 5.3PoCPicsou vulnerable to login timing attack
Picsou is a self-hosted personal finance dashboard. In the affected login implementation, the `/api/auth/login` endpoint reveals whether a username exists through a timing discrepancy. In `backend/src/main/java/com/picsou/controller/Auth…
CVE-2026-107311Low· 3.7Permissions by Term - Moderately critical - Information disclosure - SA-CONTRIB-2026-214
Improper Check for Unusual or Exceptional Conditions vulnerability in Drupal Permissions by Term allows Forceful Browsing. This issue affects Permissions by Term versions: from 0.0.0 to 3.1.41.
CVE-2026-62966High· 7.5ESPAsyncWebServer multipart parser has null-pointer write
ESPAsyncWebServer is an asynchronous HTTP and WebSocket server library for ESP32, ESP8266, RP2040 and RP2350. Prior to version 3.11.2, the multipart parser in `src/WebRequest.cpp` frees `_itemBuffer` and sets it to NULL when `BOUNDARY_OR…
CVE-2026-107312Medium· 4.3Examples for Developers - Less critical - Allocation of resources without limits or throttling - SA-CONTRIB-2026-215
Allocation of Resources Without Limits or Throttling vulnerability in Drupal Examples for Developers allows Excessive Allocation. This issue affects Examples for Developers versions: from 0.0.0 to 4.0.7.
CVE-2026-107262Medium· 5.3Advanced Filesystem - Moderately critical - Cross-Site Request Forgery - SA-CONTRIB-2026-217
Cross-Site Request Forgery (CSRF) vulnerability in Drupal Advanced Filesystem allows Cross Site Request Forgery. This issue affects Advanced Filesystem versions: from 0.0.0 to 1.0.28.
CVE-2026-107310Medium· 4.3Freelinking - Moderately critical - Information Disclosure - SA-CONTRIB-2026-213
Server-Side Request Forgery (SSRF) vulnerability in Drupal Freelinking allows Server Side Request Forgery. This issue affects Freelinking versions: from 0.0.0 to 4.0.3.
CVE-2026-107309Low· 3.7Easy Breadcrumb - Moderately critical - Information disclosure - SA-CONTRIB-2026-212
Missing Authorization vulnerability in Drupal Easy Breadcrumb allows Forceful Browsing. This issue affects Easy Breadcrumb versions: from 0.0.0 to 2.0.11.
CVE-2026-62853Critical· 9.9ThingLinks vulnerable to authenticated remote code execution via Groovy script registration in ThingLinks
ThingLinks is an enterprise IoT platform. Prior to 1.4.0, the `/groovyScriptTest/registerScript` endpoint accepts user-supplied Groovy script content and passes it to an unsandboxed `Groovy compilation and loading` flow. An authenticated…
CVE-2026-107308Low· 3.1Country - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-211
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Country allows Cross-Site Scripting (XSS). This issue affects Country versions: from 0.0.0 to 2.1.3, from 2.2.0 to 2.2.1.
CVE-2026-62863Critical· 9.6PoCMoLing: unauthenticated SSE and wildcard CORS expose tool sessions
MoLing is a computer-use and browser-use based MCP server. Prior to 0.5.0, when MoLing runs in SSE mode using `-l`, its `/sse` and `/message` HTTP endpoints do not authenticate requests and the `mcp-go` dependency sets `Access-Control-Al…
CVE-2026-117666Critical· 9.1ssl_verify_fun: partial-label wildcard certificate matches hostnames across a label boundary
Improper Validation of Certificate with Host Mismatch vulnerability in deadtrickster ssl_verify_fun allows an adversary in the middle to impersonate a TLS peer via a certificate that carries a partial-label wildcard. try_match_wildcard/4…
CVE-2026-117645Medium· 5.3Phoenix.HTML vulnerable to attribute injection via unvalidated attribute names in attributes_escape/1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in phoenixframework phoenix_html allows an attacker who controls attribute names to inject attributes and script into rendered HTML via Ph…
CVE-2026-107307Medium· 4.3SmartLinker AI - Moderately critical - Information disclosure - SA-CONTRIB-2026-210
Incorrect Authorization vulnerability in Drupal SmartLinker AI allows Forceful Browsing. This issue affects SmartLinker AI versions: from 0.0.0 to 1.0.3.
CVE-2026-107306Low· 3.8Menu Link Attributes - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-209
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Menu Link Attributes allows Stored XSS. This issue affects Menu Link Attributes versions: from 0.0.0 to 1.8.0.
CVE-2026-58412High· 8.2PoCFilecoin Pin: Fork bypass in the privileged GitHub Actions workflow
Filecoin Pin is an IPFS Pinning Service API implementation that pins to Filecoin's PDP service. Prior to 1.1.0, the upload GitHub Action's fork detection in `upload-action/src/build.js` checks only `event.pull_request`. In the documented…
CVE-2026-59387High· 8.8Broken access control restriction in Cloud Controller API
The Nginx routing configuration for Cloud Controller blocks unauthenticated access to /internal/v4/ and /internal/v5/ endpoints but omits an equivalent deny rule for /internal/v3/. As a result, the staging callback endpoints /internal/v3…
CVE-2026-59396Medium· 4.9DoS Vulnerability in UAA Related to JWKS URI Handling
A denial-of-service vulnerability exists in UAA's private_key_jwt client-authentication mechanism. When UAA retrieves a remote JWKS URI, it caches the response. Invalid authentication attempts can trigger full deserialization of this cac…
CVE-2026-119337High· 7.1PoCRAGFlow: OpenAI-compatible agent completion bypasses private canvas authorization
RAGFlow is an open-source RAG (Retrieval-Augmented Generation) engine. From 0.25.2 until 0.27.3, POST /api/v1/agents/chat/completions invokes completion_openai and returns through the openai-compatible branch before UserCanvasService.acc…
CVE-2026-107268Medium· 4.3PoCTwo Factor Authentication - TFA / Passwordless Login - Moderately critical - Information disclosure - SA-CONTRIB-2026-207
Insertion of Sensitive Information Into Sent Data vulnerability in Drupal Two Factor Authentication - TFA / Passwordless Login allows Forceful Browsing. This issue affects Two Factor Authentication - TFA / Passwordless Login versions: fr…
CVE-2026-107267Medium· 5.3DKAN - Moderately critical - Access bypass - SA-CONTRIB-2026-208
Missing Authorization vulnerability in Drupal DKAN allows Forceful Browsing. This issue affects DKAN versions: from 0.0.0 to 4.0.4, from 4.1.0 to 4.1.5.
CVE-2026-96389Medium· 6.5Xray Audit - Moderately critical - Access bypass - SA-CONTRIB-2026-206
Missing Authorization vulnerability in Drupal Xray Audit allows Forceful Browsing. This issue affects Xray Audit versions: from 0.0.0 to 1.6.3, from 2.0.0 to 2.0.4, from 3.0.0 to 3.1.1.
CVE-2026-107265Medium· 5.4Leaflet - Moderately critical - Cross site scripting - SA-CONTRIB-2026-204
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Leaflet allows Stored XSS. This issue affects Leaflet versions: from 0.0.0 to 10.4.13.