CVE-2026-85740 - LightRAG: SSRF via IPv6-transition address bypass (NAT64, IPv4-compatible, 6to4) of the native-markdown image-download guard
CVE ID :CVE-2026-85740
Published : Sept. 22, 2026, 4:20 p.m. | 51 minutes ago
Description :LightRAG provides simple and fast retrieval-augmented generation. Prior to 1.5.5, _validated_addresses in lightrag/parser/markdown/parser.py evaluates the literal resolved address with ipaddress.is_global without consistently classifying an IPv4 address embedded in an IPv6 transition wrapper. A caller who can upload a Markdown or textpack document can supply an external image URL using NAT64 64:ff9b::/96 or an IPv4-compatible form that embeds a loopback, private, or cloud-metadata IPv4 address. On a deployment with compatible NAT64 or DNS64 routing, _download and _build_guarded_opener accept the wrapper and fetch the internal resource, whose body is then ingested. Current interpreter behavior already blocks some RFC 8215 and 6to4 forms, but the fixed guard handles all documented wrappers without becoming more permissive than the standard library. This issue is fixed in version 1.5.5.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-85740
Published : Sept. 22, 2026, 4:20 p.m. | 51 minutes ago
Description :LightRAG provides simple and fast retrieval-augmented generation. Prior to 1.5.5, _validated_addresses in lightrag/parser/markdown/parser.py evaluates the literal resolved address with ipaddress.is_global without consistently classifying an IPv4 address embedded in an IPv6 transition wrapper. A caller who can upload a Markdown or textpack document can supply an external image URL using NAT64 64:ff9b::/96 or an IPv4-compatible form that embeds a loopback, private, or cloud-metadata IPv4 address. On a deployment with compatible NAT64 or DNS64 routing, _download and _build_guarded_opener accept the wrapper and fetch the internal resource, whose body is then ingested. Current interpreter behavior already blocks some RFC 8215 and 6to4 forms, but the fixed guard handles all documented wrappers without becoming more permissive than the standard library. This issue is fixed in version 1.5.5.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-86062 - LightRAG: Stored Cross-Site Scripting (XSS) in the LightRAG WebUI chat/answer renderer via ingested content
CVE ID :CVE-2026-86062
Published : Sept. 22, 2026, 4:21 p.m. | 50 minutes ago
Description :LightRAG provides simple and fast retrieval-augmented generation. Prior to 1.5.5, lightrag_webui/src/components/retrieval/ChatMessage.tsx renders answer and thinking content with react-markdown, rehypeRaw, and skipHtml=false without an HTML sanitizer. An attacker who can add a document can store raw HTML that is returned through the query path and rendered as active content by MessageMarkdown. A user who later retrieves the content can execute attacker-controlled JavaScript through elements such as an iframe srcdoc; the additional Mermaid securityLevel: loose rendering path also injects generated SVG through innerHTML. The script runs in the LightRAG WebUI origin and can read the API token in localStorage and perform API actions as the victim. This issue is fixed in version 1.5.5.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-86062
Published : Sept. 22, 2026, 4:21 p.m. | 50 minutes ago
Description :LightRAG provides simple and fast retrieval-augmented generation. Prior to 1.5.5, lightrag_webui/src/components/retrieval/ChatMessage.tsx renders answer and thinking content with react-markdown, rehypeRaw, and skipHtml=false without an HTML sanitizer. An attacker who can add a document can store raw HTML that is returned through the query path and rendered as active content by MessageMarkdown. A user who later retrieves the content can execute attacker-controlled JavaScript through elements such as an iframe srcdoc; the additional Mermaid securityLevel: loose rendering path also injects generated SVG through innerHTML. The script runs in the LightRAG WebUI origin and can read the API token in localStorage and perform API actions as the victim. This issue is fixed in version 1.5.5.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-83803 - Sentry: Unsafe pickle deserialization in Relocation Feature
CVE ID :CVE-2026-83803
Published : Sept. 22, 2026, 4:24 p.m. | 47 minutes ago
Description :Sentry is an error tracking and performance monitoring tool. From 23.11.0 until 26.7.0, Sentry instances with the relocation feature enabled unsafely deserialize a legacy database field while importing a user-supplied relocation archive. An authenticated user can craft an archive that causes arbitrary code execution in the import worker process. Self-hosted installations using the default configuration are not affected because the relocation feature is disabled by default. This issue is fixed in version 26.7.0.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-83803
Published : Sept. 22, 2026, 4:24 p.m. | 47 minutes ago
Description :Sentry is an error tracking and performance monitoring tool. From 23.11.0 until 26.7.0, Sentry instances with the relocation feature enabled unsafely deserialize a legacy database field while importing a user-supplied relocation archive. An authenticated user can craft an archive that causes arbitrary code execution in the import worker process. Self-hosted installations using the default configuration are not affected because the relocation feature is disabled by default. This issue is fixed in version 26.7.0.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-76803 - Nuclei: Local File Read via MySQL Client Sandbox Bypass
CVE ID :CVE-2026-76803
Published : Sept. 22, 2026, 4:27 p.m. | 43 minutes ago
Description :Nuclei is a vulnerability scanner built on a simple YAML-based DSL. From 3.0.0 until 3.10.0, the nuclei/mysql JavaScript library does not enforce the local-file sandbox when a JavaScript template supplies the allowAllFiles MySQL DSN option. An untrusted javascript: template scanning an attacker-controlled MySQL-compatible endpoint can cause the server to issue LOAD DATA LOCAL INFILE requests for arbitrary paths, after which the scanner's MySQL client reads the files and returns their contents to the server even though -allow-local-file-access is disabled. JavaScript templates can run unsigned and without the -code flag on affected versions, and the bypass affects CLI and SDK deployments that accept untrusted templates. This issue is fixed in version 3.10.0.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-76803
Published : Sept. 22, 2026, 4:27 p.m. | 43 minutes ago
Description :Nuclei is a vulnerability scanner built on a simple YAML-based DSL. From 3.0.0 until 3.10.0, the nuclei/mysql JavaScript library does not enforce the local-file sandbox when a JavaScript template supplies the allowAllFiles MySQL DSN option. An untrusted javascript: template scanning an attacker-controlled MySQL-compatible endpoint can cause the server to issue LOAD DATA LOCAL INFILE requests for arbitrary paths, after which the scanner's MySQL client reads the files and returns their contents to the server even though -allow-local-file-access is disabled. JavaScript templates can run unsigned and without the -code flag on affected versions, and the bypass affects CLI and SDK deployments that accept untrusted templates. This issue is fixed in version 3.10.0.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-76804 - Nuclei: Local File Read via Workflow File-Protocol Gate Bypass
CVE ID :CVE-2026-76804
Published : Sept. 22, 2026, 4:41 p.m. | 30 minutes ago
Description :Nuclei is a vulnerability scanner built on a simple YAML-based DSL. From 3.0.0 until 3.10.0, the workflow template loading path does not enforce the -file capability gate when resolving file: protocol templates referenced by a workflow. An untrusted unsigned workflow can therefore load a file-protocol template and read local files from the scanner host even when the operator has not enabled file templates. The issue affects CLI users running workflows with -w and SDK integrations that accept end-user workflows while relying on the default file-access restriction. This issue is fixed in version 3.10.0.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-76804
Published : Sept. 22, 2026, 4:41 p.m. | 30 minutes ago
Description :Nuclei is a vulnerability scanner built on a simple YAML-based DSL. From 3.0.0 until 3.10.0, the workflow template loading path does not enforce the -file capability gate when resolving file: protocol templates referenced by a workflow. An untrusted unsigned workflow can therefore load a file-protocol template and read local files from the scanner host even when the operator has not enabled file templates. The issue affects CLI users running workflows with -w and SDK integrations that accept end-user workflows while relying on the default file-access restriction. This issue is fixed in version 3.10.0.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-76819 - Nuclei: Arbitrary Code Execution via Goja JavaScript Engine Vulnerability
CVE ID :CVE-2026-76819
Published : Sept. 22, 2026, 4:43 p.m. | 28 minutes ago
Description :Nuclei is a vulnerability scanner built on a simple YAML-based DSL. From 3.0.0 until 3.10.0, the Goja JavaScript runtime embedded in the javascript: protocol under pkg/js/ contains an out-of-bounds heap write that can corrupt memory during template evaluation and allow native code execution on the scanner host. A malicious untrusted JavaScript template can trigger the flaw during a normal scan, including from a template init section that runs during initialization. JavaScript templates execute without the -code flag and unsigned JavaScript templates run by default on affected versions, exposing CLI and SDK deployments that accept third-party templates. This issue is fixed in version 3.10.0.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-76819
Published : Sept. 22, 2026, 4:43 p.m. | 28 minutes ago
Description :Nuclei is a vulnerability scanner built on a simple YAML-based DSL. From 3.0.0 until 3.10.0, the Goja JavaScript runtime embedded in the javascript: protocol under pkg/js/ contains an out-of-bounds heap write that can corrupt memory during template evaluation and allow native code execution on the scanner host. A malicious untrusted JavaScript template can trigger the flaw during a normal scan, including from a template init section that runs during initialization. JavaScript templates execute without the -code flag and unsigned JavaScript templates run by default on affected versions, exposing CLI and SDK deployments that accept third-party templates. This issue is fixed in version 3.10.0.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-87902 - WordPress Local File Inclusion Vulnerability
CVE ID :CVE-2026-87902
Published : Sept. 22, 2026, 4:44 p.m. | 27 minutes ago
Description :An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.php` file outside the active theme directories. If relevant pre-conditions for both the server and the active theme are met, this can lead to RCE.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-87902
Published : Sept. 22, 2026, 4:44 p.m. | 27 minutes ago
Description :An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.php` file outside the active theme directories. If relevant pre-conditions for both the server and the active theme are met, this can lead to RCE.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-76802 - Nuclei: Arbitrary Command Execution via DAST Code Signature Bypass
CVE ID :CVE-2026-76802
Published : Sept. 22, 2026, 4:47 p.m. | 24 minutes ago
Description :Nuclei is a vulnerability scanner built on a simple YAML-based DSL. From 3.0.0 until 3.10.0, the DAST template loading branch does not apply the unsigned code-template signature check before accepting a template that contains both a fuzzing: block and an unsigned code: block. When an operator enables -dast, an untrusted multiprotocol template can place an unsigned code request into the execution queue and run arbitrary shell commands even without -code or a valid cryptographic signature. The issue affects CLI DAST scans and SDK integrations that enable DAST while accepting attacker-supplied templates. This issue is fixed in version 3.10.0.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-76802
Published : Sept. 22, 2026, 4:47 p.m. | 24 minutes ago
Description :Nuclei is a vulnerability scanner built on a simple YAML-based DSL. From 3.0.0 until 3.10.0, the DAST template loading branch does not apply the unsigned code-template signature check before accepting a template that contains both a fuzzing: block and an unsigned code: block. When an operator enables -dast, an untrusted multiprotocol template can place an unsigned code request into the execution queue and run arbitrary shell commands even without -code or a valid cryptographic signature. The issue affects CLI DAST scans and SDK integrations that enable DAST while accepting attacker-supplied templates. This issue is fixed in version 3.10.0.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-76805 - Nuclei: Environment Variable Disclosure via Response-Derived Data in DAST/Fuzz Mode
CVE ID :CVE-2026-76805
Published : Sept. 22, 2026, 4:48 p.m. | 23 minutes ago
Description :Nuclei is a vulnerability scanner built on a simple YAML-based DSL. From 3.0.0 until 3.10.0, the DAST/fuzz payload path in pkg/fuzz/parts.go can evaluate substituted runtime data more than once, creating a second evaluation pass that allows response content captured by an internal: true extractor in one protocol step to be reinterpreted as template syntax in a later fuzz step. This vulnerability is an incomplete fix for CVE-2026-41645: the prior remediation made expressions.Evaluate() single-pass within one call but did not prevent DAST/fuzz callers from evaluating substituted output again. When -env-vars is enabled, a malicious scan target can return marker-shaped content that resolves against the template variable map and discloses scanner-host environment variables such as credentials, API keys, or tokens. The vulnerability requires a multi-step DAST or fuzz template, response data reused through an internal extractor, and explicit environment-variable expansion; users who do not enable -env-vars are not affected by the sensitive-information disclosure. This issue is fixed in version 3.10.0.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-76805
Published : Sept. 22, 2026, 4:48 p.m. | 23 minutes ago
Description :Nuclei is a vulnerability scanner built on a simple YAML-based DSL. From 3.0.0 until 3.10.0, the DAST/fuzz payload path in pkg/fuzz/parts.go can evaluate substituted runtime data more than once, creating a second evaluation pass that allows response content captured by an internal: true extractor in one protocol step to be reinterpreted as template syntax in a later fuzz step. This vulnerability is an incomplete fix for CVE-2026-41645: the prior remediation made expressions.Evaluate() single-pass within one call but did not prevent DAST/fuzz callers from evaluating substituted output again. When -env-vars is enabled, a malicious scan target can return marker-shaped content that resolves against the template variable map and discloses scanner-host environment variables such as credentials, API keys, or tokens. The vulnerability requires a multi-step DAST or fuzz template, response data reused through an internal extractor, and explicit environment-variable expansion; users who do not enable -env-vars are not affected by the sensitive-information disclosure. This issue is fixed in version 3.10.0.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-95818 - AT_SECURE program buffer overflow via $ORIGIN processing
CVE ID :CVE-2026-95818
Published : Sept. 22, 2026, 4:50 p.m. | 21 minutes ago
Description :A stack-based buffer overflow in the dynamic loader (ld.so) of the GNU C Library (glibc) versions 2.14 through 2.44 allows a local attacker to crash or corrupt the memory of setuid/setgid (AT_SECURE) programs. When such a program's DT_RPATH or DT_RUNPATH begins with $ORIGIN and is followed by NUL or '/' the loader both reads past the end of the path buffer and writes past the end of a stack-allocated internal buffer. The corrupted loader stack can lead to a loader crash (denial of service) and limited disclosure of process memory.
Severity: 3.6 | LOW
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-95818
Published : Sept. 22, 2026, 4:50 p.m. | 21 minutes ago
Description :A stack-based buffer overflow in the dynamic loader (ld.so) of the GNU C Library (glibc) versions 2.14 through 2.44 allows a local attacker to crash or corrupt the memory of setuid/setgid (AT_SECURE) programs. When such a program's DT_RPATH or DT_RUNPATH begins with $ORIGIN and is followed by NUL or '/' the loader both reads past the end of the path buffer and writes past the end of a stack-allocated internal buffer. The corrupted loader stack can lead to a loader crash (denial of service) and limited disclosure of process memory.
Severity: 3.6 | LOW
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-84301 - FastGPT safe axios SSRF guard still allows DNS rebinding TOCTOU on protected outbound requests
CVE ID :CVE-2026-84301
Published : Sept. 22, 2026, 4:50 p.m. | 21 minutes ago
Description :FastGPT is an open-source LLM platform for building AI applications on a knowledge base. Prior to 4.15.2, the safe Axios request interceptor in packages/service/common/api/axios.ts validates a hostname with isInternalAddress() before a later HTTP connection performs an independent DNS lookup, creating a DNS rebinding window, allowing an attacker-controlled hostname to resolve publicly during the check and to a loopback, private, link-local, or metadata address during connection. An authenticated attacker who can supply a URL to a safe-Axios-backed HTTP tool, workflow HTTP node, external file fetch, or other server-side integration can use this time-of-check/time-of-use gap to reach services that direct private-address inputs would block. The same independent re-resolution occurs after manual redirect hops because each redirect target is checked before a separate connection lookup. This issue is fixed in version 4.15.2.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-84301
Published : Sept. 22, 2026, 4:50 p.m. | 21 minutes ago
Description :FastGPT is an open-source LLM platform for building AI applications on a knowledge base. Prior to 4.15.2, the safe Axios request interceptor in packages/service/common/api/axios.ts validates a hostname with isInternalAddress() before a later HTTP connection performs an independent DNS lookup, creating a DNS rebinding window, allowing an attacker-controlled hostname to resolve publicly during the check and to a loopback, private, link-local, or metadata address during connection. An authenticated attacker who can supply a URL to a safe-Axios-backed HTTP tool, workflow HTTP node, external file fetch, or other server-side integration can use this time-of-check/time-of-use gap to reach services that direct private-address inputs would block. The same independent re-resolution occurs after manual redirect hops because each redirect target is checked before a separate connection lookup. This issue is fixed in version 4.15.2.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-13087 - Kernel: heap out-of-bounds write in the linux kernel rpc-over-rdma server reply path...
CVE ID :CVE-2026-13087
Published : Sept. 22, 2026, 4:51 p.m. | 20 minutes ago
Description :A heap out-of-bounds write vulnerability was found in the Linux kernel's RPC-over-RDMA server reply path in net/sunrpc/xprtrdma/svc_rdma_sendto.c. When a crafted RPC-over-RDMA client sends a large NFS READ request with an empty Write list and no Reply chunk, the server linearizes the entire multi-page reply into a fixed-size 4096-byte heap buffer without bounds checking, resulting in a kernel heap overflow. This can lead to denial of service via kernel crash or potential code execution through corruption of adjacent kernel heap objects.
Severity: 8.8 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-13087
Published : Sept. 22, 2026, 4:51 p.m. | 20 minutes ago
Description :A heap out-of-bounds write vulnerability was found in the Linux kernel's RPC-over-RDMA server reply path in net/sunrpc/xprtrdma/svc_rdma_sendto.c. When a crafted RPC-over-RDMA client sends a large NFS READ request with an empty Write list and no Reply chunk, the server linearizes the entire multi-page reply into a fixed-size 4096-byte heap buffer without bounds checking, resulting in a kernel heap overflow. This can lead to denial of service via kernel crash or potential code execution through corruption of adjacent kernel heap objects.
Severity: 8.8 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-83599 - Netdata: WebSocket Decompression Bomb
CVE ID :CVE-2026-83599
Published : Sept. 22, 2026, 4:54 p.m. | 16 minutes ago
Description :Netdata is an open source observability tool. Prior to 2.11.0, Netdata's unauthenticated WebSocket server negotiates permessage-deflate before authentication, and src/web/websocket/websocket-compression.c allows websocket_client_decompress_message() to grow decompressed output toward WS_MAX_DECOMPRESSED_SIZE without enforcing a compressed-to-decompressed ratio. Small highly compressed frames can therefore cause large server-side allocations, and repeated concurrent connections can exhaust memory and terminate monitoring. This vulnerability is fixed in 2.11.0.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-83599
Published : Sept. 22, 2026, 4:54 p.m. | 16 minutes ago
Description :Netdata is an open source observability tool. Prior to 2.11.0, Netdata's unauthenticated WebSocket server negotiates permessage-deflate before authentication, and src/web/websocket/websocket-compression.c allows websocket_client_decompress_message() to grow decompressed output toward WS_MAX_DECOMPRESSED_SIZE without enforcing a compressed-to-decompressed ratio. Small highly compressed frames can therefore cause large server-side allocations, and repeated concurrent connections can exhaust memory and terminate monitoring. This vulnerability is fixed in 2.11.0.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-83602 - Netdata: Unauthenticated remote PUT to /api/v3/settings bypasses IP allowlist controls via HTTP_ACL_NOCHECK
CVE ID :CVE-2026-83602
Published : Sept. 22, 2026, 4:56 p.m. | 14 minutes ago
Description :Netdata is an open source observability tool. From 2.0.0 until 2.11.0, Netdata registers /api/v3/settings in src/web/api/v3/web_api_v3.c with HTTP_ACL_NOCHECK and HTTP_ACCESS_ANONYMOUS_DATA, causing unauthenticated PUT requests handled by src/web/api/v3/api_v3_settings.c to bypass operator-configured allow dashboard from IP restrictions. A network-reachable caller can persist attacker-controlled JSON in {varlib}/settings/default.json, manipulate its version counter, and use repeated near-20 MiB writes to consume disk space, although the file does not control collection or security policy. This vulnerability is fixed in 2.11.0.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-83602
Published : Sept. 22, 2026, 4:56 p.m. | 14 minutes ago
Description :Netdata is an open source observability tool. From 2.0.0 until 2.11.0, Netdata registers /api/v3/settings in src/web/api/v3/web_api_v3.c with HTTP_ACL_NOCHECK and HTTP_ACCESS_ANONYMOUS_DATA, causing unauthenticated PUT requests handled by src/web/api/v3/api_v3_settings.c to bypass operator-configured allow dashboard from IP restrictions. A network-reachable caller can persist attacker-controlled JSON in {varlib}/settings/default.json, manipulate its version counter, and use repeated near-20 MiB writes to consume disk space, although the file does not control collection or security policy. This vulnerability is fixed in 2.11.0.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-88416 - MCMS SQL Injection Vulnerability
CVE ID :CVE-2026-88416
Published : Sept. 22, 2026, 8:17 p.m. | 55 minutes ago
Description :MCMS 6.1.1 through 6.2.1 has a SQL injection vulnerability in the custom model/form import feature.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-88416
Published : Sept. 22, 2026, 8:17 p.m. | 55 minutes ago
Description :MCMS 6.1.1 through 6.2.1 has a SQL injection vulnerability in the custom model/form import feature.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-88418 - CMSimple Cross-Site Request Forgery to Remote Code Execution
CVE ID :CVE-2026-88418
Published : Sept. 22, 2026, 8:17 p.m. | 55 minutes ago
Description :CMSimple 5.24 ships with CSRF protection disabled by default, which turns csrfProtection() into a no-op on every state-changing admin request, and it does not send the csrf_token hidden field in admin forms. Because administrator authentication is cookie-only and no CSRF token is enforced, an unauthenticated attacker can induce a logged-in administrator's browser to issue a forged content-save request with a text payload containing a scripting marker. The marker is stored verbatim into content/content.php; on every subsequent page view evaluate_cmsimple_scripting() (functions.php) executes the marker body with PHP eval() — for all visitors, including unauthenticated ones. This yields persistent remote code execution on the web server.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-88418
Published : Sept. 22, 2026, 8:17 p.m. | 55 minutes ago
Description :CMSimple 5.24 ships with CSRF protection disabled by default, which turns csrfProtection() into a no-op on every state-changing admin request, and it does not send the csrf_token hidden field in admin forms. Because administrator authentication is cookie-only and no CSRF token is enforced, an unauthenticated attacker can induce a logged-in administrator's browser to issue a forged content-save request with a text payload containing a scripting marker. The marker is stored verbatim into content/content.php; on every subsequent page view evaluate_cmsimple_scripting() (functions.php) executes the marker body with PHP eval() — for all visitors, including unauthenticated ones. This yields persistent remote code execution on the web server.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-88419 - WuzhiCMS Unrestricted File Upload Vulnerability
CVE ID :CVE-2026-88419
Published : Sept. 22, 2026, 8:17 p.m. | 55 minutes ago
Description :An unrestricted upload of files with a dangerous type in the thumbnail-upload endpoint (/index.php?m=member&f=article&v=thumbUpload) of WuzhiCMS 5.0.0 allows an authenticated low-privileged member to upload a crafted .php file and execute arbitrary PHP code on the server, because the stored file extension is taken verbatim from the client-supplied filename with no extension allowlist or content validation and the file is written to the web-accessible uploadfile/ directory, from which the web server executes PHP.
Severity: 8.8 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-88419
Published : Sept. 22, 2026, 8:17 p.m. | 55 minutes ago
Description :An unrestricted upload of files with a dangerous type in the thumbnail-upload endpoint (/index.php?m=member&f=article&v=thumbUpload) of WuzhiCMS 5.0.0 allows an authenticated low-privileged member to upload a crafted .php file and execute arbitrary PHP code on the server, because the stored file extension is taken verbatim from the client-supplied filename with no extension allowlist or content validation and the file is written to the web-accessible uploadfile/ directory, from which the web server executes PHP.
Severity: 8.8 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-88624 - openCode Worktree Path Traversal Arbitrary Directory Deletion
CVE ID :CVE-2026-88624
Published : Sept. 22, 2026, 8:17 p.m. | 55 minutes ago
Description :Missing path validation in the Worktree.remove component of openCode v1.18.26 allows attackers to execute arbitrary recursive directory deletion via a crafted payload.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-88624
Published : Sept. 22, 2026, 8:17 p.m. | 55 minutes ago
Description :Missing path validation in the Worktree.remove component of openCode v1.18.26 allows attackers to execute arbitrary recursive directory deletion via a crafted payload.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-89281 - CVE-2026-89281
CVE ID :CVE-2026-89281
Published : Sept. 22, 2026, 8:17 p.m. | 55 minutes ago
Description :The Apache Lounge Windows distribution of Apache HTTP Server build contains a hardcoded configuration path vulnerability within openssl.cnf path that can allow local code execution.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-89281
Published : Sept. 22, 2026, 8:17 p.m. | 55 minutes ago
Description :The Apache Lounge Windows distribution of Apache HTTP Server build contains a hardcoded configuration path vulnerability within openssl.cnf path that can allow local code execution.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-89282 - CVE-2026-89282
CVE ID :CVE-2026-89282
Published : Sept. 22, 2026, 8:17 p.m. | 55 minutes ago
Description :The Apache Lounge Windows distribution of Apache HTTP Server build contains an insecure installation directory permissions vulnerability through its default install directory on C:\, which inherits write access for Authenticated Users.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-89282
Published : Sept. 22, 2026, 8:17 p.m. | 55 minutes ago
Description :The Apache Lounge Windows distribution of Apache HTTP Server build contains an insecure installation directory permissions vulnerability through its default install directory on C:\, which inherits write access for Authenticated Users.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-94574 - CVE-2026-94574
CVE ID :CVE-2026-94574
Published : Sept. 22, 2026, 8:17 p.m. | 55 minutes ago
Description :A local cross-user code execution vulnerability exists in GNU wget (Windows builds from eternallybored.org) due to a hardcoded configuration file path (C:\msys64) that is writable by unprivileged users, allowing for arbitrary code execution via the use_askpass directive, potentially allowing local privilege escalation.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-94574
Published : Sept. 22, 2026, 8:17 p.m. | 55 minutes ago
Description :A local cross-user code execution vulnerability exists in GNU wget (Windows builds from eternallybored.org) due to a hardcoded configuration file path (C:\msys64) that is writable by unprivileged users, allowing for arbitrary code execution via the use_askpass directive, potentially allowing local privilege escalation.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...