Thu, Jun 25 · 10:16 PM CDTCVE-2025-71338
10.0/10 · Must read/watchNVDvuln
Summary
Flowise through 2.2.7 fails to sanitize path segments in the document-store loader endpoint, allowing unauthenticated attackers to write files outside the storage directory. Attackers can use parent-directory sequences to escape the storage directory and overwrite application files loaded at boot for remote code execut
CVECVE-2025-71338
SeverityCRITICAL
TypeUPDATED
PublishedThu, Jun 25 · 10:16 PM CDT
ModifiedThu, Sep 17 · 07:16 PM CDT
CVE-2026-66012
10.0/10 · Must read/watchNVDvuln
Summary
SiYuan before v3.7.2 contains a missing authorization vulnerability in the POST /mcp kernel endpoint, which is gated only by a general auth check (model.CheckAuth) with no admin-role or read-only enforcement. This exposes 31 MCP tools, including a file tool with list/read/write/delete/rename/copy actions across the ent
CVECVE-2026-66012
SeverityCRITICAL
TypeUPDATED
PublishedSat, Jul 25 · 11:17 AM CDT
ModifiedThu, Sep 17 · 06:17 PM CDT
CVE-2025-56005
9.8/10 · Must read/watchNVDvuln
Summary
An undocumented and unsafe feature in the PLY (Python Lex-Yacc) library 3.11 allows Remote Code Execution (RCE) via the `picklefile` parameter in the `yacc()` function. This parameter accepts a `.pkl` file that is deserialized with `pickle.load()` without validation. Because `pickle` allows execution of embedded code v
CVECVE-2025-56005
SeverityCRITICAL
TypeUPDATED
PublishedTue, Jan 20 · 07:15 PM CST
ModifiedThu, Sep 17 · 12:17 PM CDT
CVE-2026-28474
9.8/10 · Must read/watchNVDvuln
Summary
OpenClaw's Nextcloud Talk plugin versions prior to 2026.2.6 accept equality matching on the mutable actor.name display name field for allowlist validation, allowing attackers to bypass DM and room allowlists. An attacker can change their Nextcloud display name to match an allowlisted user ID and gain unauthorized acces
CVECVE-2026-28474
SeverityCRITICAL
TypeUPDATED
PublishedThu, Mar 05 · 10:16 PM CST
ModifiedThu, Sep 17 · 06:16 PM CDT
CVE-2026-53176
9.8/10 · Must read/watchNVDvuln
Summary
In the Linux kernel, the following vulnerability has been resolved: IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN In drivers/infiniband/ulp/isert/ib_isert.c, isert_login_recv_done() computes the login request payload length as wc->byte_len minus ISER_HEADERS_LEN with no lower bound, and login_req_len is a s
CVECVE-2026-53176
SeverityCRITICAL
TypeUPDATED
PublishedThu, Jun 25 · 09:16 AM CDT
ModifiedThu, Sep 17 · 12:18 PM CDT
CVE-2026-39821
9.6/10 · Must read/watchNVDvuln
Summary
The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode("xn--example-.com") incorrectly returns the name "example.com" rather than an error. This behavior can lead to privilege escalation in programs using the idna package. For example, a
CVECVE-2026-39821
SeverityCRITICAL
TypeUPDATED
PublishedFri, May 22 · 04:16 PM CDT
ModifiedThu, Sep 17 · 12:18 PM CDT
CVE-2026-65605
9.6/10 · Must read/watchNVDvuln
Summary
SiYuan before v3.7.2 contains a stored cross-site scripting vulnerability in Attribute View (database) cell rendering. A Template column value is rendered as HTML via text/template without auto-escaping, and EscapeHTML is only applied when HasUnclosedHtmlTag returns true; because balanced self-closing tags such as are
CVECVE-2026-65605
SeverityCRITICAL
TypeUPDATED
PublishedThu, Jul 23 · 12:18 PM CDT
ModifiedThu, Sep 17 · 06:17 PM CDT
CVE-2026-65606
9.6/10 · Must read/watchNVDvuln
Summary
SiYuan before v3.7.2 contains a cross-site scripting vulnerability in the siyuan:// protocol handler. When a siyuan://plugins/ link references a name that is not an installed plugin, the application opens a custom tab and inserts the link's icon parameter into the tab header via innerHTML without escaping it (app/src/l
CVECVE-2026-65606
SeverityCRITICAL
TypeUPDATED
PublishedThu, Jul 23 · 12:18 PM CDT
ModifiedThu, Sep 17 · 06:17 PM CDT
CVE-2026-66395
9.6/10 · Must read/watchNVDvuln
Summary
SiYuan desktop before v3.7.2 contains a reflected cross-site scripting vulnerability in the bazaar plugin readme handler that allows attackers to execute arbitrary code by crafting a malicious siyuan:// deep link. Attackers can inject HTML payloads via the plugin name parameter that execute with full Node.js access thr
CVECVE-2026-66395
SeverityCRITICAL
TypeUPDATED
PublishedMon, Jul 27 · 04:18 PM CDT
ModifiedThu, Sep 17 · 06:17 PM CDT
CVE-2026-44172
9.1/10 · Must read/watchNVDvuln
Summary
MariaDB server is a community developed fork of MySQL server. In versions 3.3.18 and 3.4.8, an application that was taking non-validated user input, escaping it with mysql_real_escape_string() and sending it to the database using text protocol and big5 character set was vulnerable to SQL injections, even though mysql_r
CVECVE-2026-44172
SeverityCRITICAL
TypeUPDATED
PublishedFri, Jun 12 · 06:16 PM CDT
ModifiedThu, Sep 17 · 12:18 PM CDT
CVE-2026-55196
9.1/10 · Must read/watchNVDvuln
Summary
Hermes WebUI before 0.51.409 contains an authentication bypass vulnerability in passkey registration endpoints that allows unauthenticated remote attackers to register arbitrary passkeys. When HERMES_WEBUI_PASSKEY=1 is enabled with no existing credentials, POST /api/auth/passkey/register/options and POST /api/auth/pass
CVECVE-2026-55196
SeverityCRITICAL
TypeUPDATED
PublishedWed, Jun 17 · 07:18 PM CDT
ModifiedThu, Sep 17 · 06:16 PM CDT
CVE-2026-4408
9.0/10 · Must read/watchNVDvuln
Summary
A flaw was found in Samba. A remote attacker can exploit a misconfiguration in Samba file servers and classic domain controllers that use the "check password script" feature. If this script is configured with the %u substitution character, the client-controlled username is passed without proper escaping of shell meta-c
CVECVE-2026-4408
SeverityCRITICAL
TypeUPDATED
PublishedThu, May 28 · 09:16 AM CDT
ModifiedThu, Sep 17 · 07:16 PM CDT
CVE-2026-43112
8.8/10 · Worth your timeNVDvuln
Summary
In the Linux kernel, the following vulnerability has been resolved: fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath When cifs_sanitize_prepath is called with an empty string or a string containing only delimiters (e.g., "/"), the current logic attempts to check *(cursor2 - 1) before cursor2 has advanced.
CVECVE-2026-43112
SeverityHIGH
TypeUPDATED
PublishedWed, May 06 · 10:16 AM CDT
ModifiedThu, Sep 17 · 12:18 PM CDT
CVE-2026-65013
8.8/10 · Worth your timeNVDvuln
Summary
Onlook through 0.2.32, fixed in commit 423e2e9, contains a broken object level authorization vulnerability that allows authenticated attackers to access and manipulate other users' resources by supplying arbitrary UUID values to tRPC API procedures including project.get, member.remove, and chat.conversation.delete. Att
CVECVE-2026-65013
SeverityHIGH
TypeUPDATED
PublishedWed, Jul 22 · 05:16 PM CDT
ModifiedThu, Sep 17 · 06:16 PM CDT
CVE-2026-56223
8.7/10 · Worth your timeNVDvuln
Summary
Capgo before 12.128.2 contains a cross-domain SSO account takeover vulnerability in the provision-user endpoint that allows attackers to merge arbitrary victim accounts based on email match without validating SSO provider domain authorization. An attacker with enterprise org admin access and a malicious IdP can forge S
CVECVE-2026-56223
SeverityHIGH
TypeUPDATED
PublishedWed, Jun 24 · 01:16 PM CDT
ModifiedThu, Sep 17 · 06:16 PM CDT
CVE-2024-21626
8.6/10 · Worth your timeNVDvuln
Summary
runc is a CLI tool for spawning and running containers on Linux according to the OCI specification. In runc 1.1.11 and earlier, due to an internal file descriptor leak, an attacker could cause a newly-spawned container process (from runc exec) to have a working directory in the host filesystem namespace, allowing for a
CVECVE-2024-21626
SeverityHIGH
TypeUPDATED
PublishedWed, Jan 31 · 10:15 PM CST
ModifiedThu, Sep 17 · 12:17 PM CDT
CVE-2026-20012
8.6/10 · Worth your timeNVDvuln
Summary
A vulnerability in the Internet Key Exchange version 2 (IKEv2) feature of Cisco IOS Software, Cisco IOS XE Software, Cisco Secure Firewall Adaptive Security Appliance (ASA) Software, and Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to trigger a memory leak, resulti
CVECVE-2026-20012
SeverityHIGH
TypeUPDATED
PublishedWed, Mar 25 · 04:16 PM CDT
ModifiedThu, Sep 17 · 07:25 PM CDT
CVE-2026-63764
8.6/10 · Worth your timeNVDvuln
Summary
LMDeploy through 0.14.0, fixed in commit 03c3130, contains a server-side request forgery (SSRF) vulnerability in the _load_http_url function within the connection.py media handler, where the private-IP guard validates only the original URL without re-validating hosts after HTTP redirects. An unauthenticated attacker ca
CVECVE-2026-63764
SeverityHIGH
TypeUPDATED
PublishedTue, Jul 21 · 09:16 PM CDT
ModifiedThu, Sep 17 · 06:16 PM CDT
CVE-2026-66396
8.4/10 · Worth your timeNVDvuln
Summary
SiYuan before v3.7.2 fails to escape the title-img Individual Attribute List value when rendering Gallery and Kanban cover images, allowing stored cross-site scripting via unescaped style attribute interpolation. Attackers with editor permissions can inject onload handlers that execute arbitrary code in the Electron re
CVECVE-2026-66396
SeverityHIGH
TypeUPDATED
PublishedMon, Jul 27 · 04:18 PM CDT
ModifiedThu, Sep 17 · 06:17 PM CDT
CVE-2026-59258
8.3/10 · Worth your timeNVDvuln
Summary
immich before 3.0.3 contains a broken access control vulnerability in the PUT /albums/:id/user/:userId endpoint that allows shared album editors to modify member roles without owner-only restrictions. Attackers with editor access can demote the album owner to editor and promote themselves to owner in sequential request
CVECVE-2026-59258
SeverityHIGH
TypeUPDATED
PublishedWed, Jul 15 · 06:16 PM CDT
ModifiedThu, Sep 17 · 06:16 PM CDT
CVE-2026-33810
8.2/10 · Worth your timeNVDvuln
Summary
When verifying a certificate chain containing excluded DNS constraints, these constraints are not correctly applied to wildcard DNS SANs which use a different case than the constraint. This only affects validation of otherwise trusted certificate chains, issued by a root CA in the VerifyOptions.Roots CertPool, or in th
CVECVE-2026-33810
SeverityHIGH
TypeUPDATED
PublishedWed, Apr 08 · 02:16 AM CDT
ModifiedThu, Sep 17 · 12:17 PM CDT
CVE-2026-63765
8.2/10 · Worth your timeNVDvuln
Summary
Chatwoot before 4.16.0 contains an authentication bypass vulnerability in the direct uploads controller that allows unauthenticated attackers to create arbitrary ActiveStorage blobs in any tenant account. Attackers can exploit missing authentication checks to resolve any account and conversation, then obtain signed PUT
CVECVE-2026-63765
SeverityHIGH
TypeUPDATED
PublishedThu, Jul 23 · 07:17 PM CDT
ModifiedThu, Sep 17 · 06:16 PM CDT
CVE-2026-53871
8.1/10 · Worth your timeNVDvuln
Summary
Hermes WebUI before 0.51.368 contains an authorization bypass vulnerability in the get_profile_cookie() function that accepts unauthenticated profile names from the hermes_profile cookie. An authenticated attacker can forge the hermes_profile cookie value to bypass profile-scoped authorization checks and access session
CVECVE-2026-53871
SeverityHIGH
TypeUPDATED
PublishedWed, Jun 17 · 07:18 PM CDT
ModifiedThu, Sep 17 · 06:16 PM CDT
CVE-2026-55200
8.1/10 · Worth your timeNVDvuln
Summary
libssh2 through 1.11.1, fixed in commit 7acf3df contains an out-of-bounds write vulnerability in ssh2_transport_read() that fails to enforce upper bounds on packet_length field. Remote attackers can send crafted SSH packets with excessively large packet_length values to corrupt heap memory and achieve remote code execu
CVECVE-2026-55200
SeverityHIGH
TypeUPDATED
PublishedWed, Jun 17 · 08:17 PM CDT
ModifiedThu, Sep 17 · 05:04 PM CDT
CVE-2026-59712
8.1/10 · Worth your timeNVDvuln
Summary
Leantime's Users::getUser method in the JSON-RPC API lacks proper authorization checks, allowing authenticated users to retrieve full user credential rows including password hashes, TOTP secrets, and session tokens. Attackers can exploit this by calling users.getUser with arbitrary user IDs to enumerate all accounts an
CVECVE-2026-59712
SeverityHIGH
TypeUPDATED
PublishedMon, Jul 06 · 09:16 PM CDT
ModifiedThu, Sep 17 · 06:16 PM CDT
