🚨 CVE-2026-75844
ArcadeDB versions before 26.8.1 contain a server-side request forgery vulnerability in the IMPORT DATABASE command where the security validator resolves and checks hostnames but the subsequent connection re-resolves the raw URL and follows redirects. Authenticated attackers can bypass the validator using DNS rebinding or HTTP redirects to access cloud metadata endpoints, internal services, or read arbitrary local files on default installations.
🎖@cveNotify
ArcadeDB versions before 26.8.1 contain a server-side request forgery vulnerability in the IMPORT DATABASE command where the security validator resolves and checks hostnames but the subsequent connection re-resolves the raw URL and follows redirects. Authenticated attackers can bypass the validator using DNS rebinding or HTTP redirects to access cloud metadata endpoints, internal services, or read arbitrary local files on default installations.
🎖@cveNotify
GitHub
Incomplete fix of CVE-2026-54077 - the IMPORT DATABASE SSRF validator resolves-and-discards
## Summary
Incomplete fix of CVE-2026-54077: the IMPORT DATABASE SSRF validator resolves and checks the hostname but the subsequent connection re-resolves the raw URL and follows redirects, so D...
Incomplete fix of CVE-2026-54077: the IMPORT DATABASE SSRF validator resolves and checks the hostname but the subsequent connection re-resolves the raw URL and follows redirects, so D...
🚨 CVE-2026-75851
ArcadeDB server (com.arcadedb:arcadedb-server) in versions 26.7.3 and earlier fails to propagate the authenticated principal to asynchronous command worker threads. When an HTTP command is submitted with awaitResponse:false, it executes on an async worker whose DatabaseContext has no bound user, causing the scripting authorization gate to become a no-op. A user with only read access to a single database can submit an asynchronous JavaScript (language=js) command via the /api/v1/command endpoint to run code with unrestricted host access (e.g., database.getSecurity().createUser) and create a server-wide administrator, escalating to full administrative control. Fixed in 26.8.1.
🎖@cveNotify
ArcadeDB server (com.arcadedb:arcadedb-server) in versions 26.7.3 and earlier fails to propagate the authenticated principal to asynchronous command worker threads. When an HTTP command is submitted with awaitResponse:false, it executes on an async worker whose DatabaseContext has no bound user, causing the scripting authorization gate to become a no-op. A user with only read access to a single database can submit an asynchronous JavaScript (language=js) command via the /api/v1/command endpoint to run code with unrestricted host access (e.g., database.getSecurity().createUser) and create a server-wide administrator, escalating to full administrative control. Fixed in 26.8.1.
🎖@cveNotify
GitHub
HTTP async command path bypasses scripting authorization gate, allowing reader to escalate to server admin
## Summary
A user with only read access to one database can escalate to server-wide administrator by submitting an asynchronous JavaScript command over HTTP. When a command is submitted with `awai...
A user with only read access to one database can escalate to server-wide administrator by submitting an asynchronous JavaScript command over HTTP. When a command is submitted with `awai...
🚨 CVE-2026-75852
ArcadeDB versions before 26.8.1 fail to enforce SASL authentication on data commands in the MongoDB wire-protocol plugin. Unauthenticated attackers can issue insert, find, update, delete, and create commands against any database by connecting to port 27017 without credentials.
🎖@cveNotify
ArcadeDB versions before 26.8.1 fail to enforce SASL authentication on data commands in the MongoDB wire-protocol plugin. Unauthenticated attackers can issue insert, find, update, delete, and create commands against any database by connecting to port 27017 without credentials.
🎖@cveNotify
GitHub
MongoDB wire protocol does not enforce authentication on the data path, allowing unauthenticated cross-database read/write
## Summary
ArcadeDB's MongoDB wire-protocol plugin implements SASL authentication but does not enforce it on the data path. A client that never authenticates can issue `insert`/`find`/`update`...
ArcadeDB's MongoDB wire-protocol plugin implements SASL authentication but does not enforce it on the data path. A client that never authenticates can issue `insert`/`find`/`update`...
🚨 CVE-2026-18751
External control of file name or path vulnerability in Citrix WorkSpace App on MacOS.
This issue affects WorkSpace App: 2607.
🎖@cveNotify
External control of file name or path vulnerability in Citrix WorkSpace App on MacOS.
This issue affects WorkSpace App: 2607.
🎖@cveNotify
🚨 CVE-2026-1199
Zabbix API and Frontend login lockout mechanism has a flaw where several unsuccessful login requests are not properly counted towards the block counter if sent simultaneously, potentially allowing for more password guesses than intended.
🎖@cveNotify
Zabbix API and Frontend login lockout mechanism has a flaw where several unsuccessful login requests are not properly counted towards the block counter if sent simultaneously, potentially allowing for more password guesses than intended.
🎖@cveNotify
🚨 CVE-2026-23929
Prototype pollution vulnerability in searchParamsToObject() is leading to a persistent XSS in Maps. URL parameter processing was not filtering dangerous properties like __proto__, combined with jQuery's unsafe element creation that traversed the prototype chain.
🎖@cveNotify
Prototype pollution vulnerability in searchParamsToObject() is leading to a persistent XSS in Maps. URL parameter processing was not filtering dangerous properties like __proto__, combined with jQuery's unsafe element creation that traversed the prototype chain.
🎖@cveNotify
🚨 CVE-2026-23930
An unauthenticated user is able to cause disproportionate CPU load on the Frontend webserver by sending specifically crafted requests to the Frontend popup.testtriggerexpr action, leading to potential denial of service.
🎖@cveNotify
An unauthenticated user is able to cause disproportionate CPU load on the Frontend webserver by sending specifically crafted requests to the Frontend popup.testtriggerexpr action, leading to potential denial of service.
🎖@cveNotify
🚨 CVE-2026-23931
The frontend validatate.api.exists action can be exploited by authenticated users to extract plaintext user macro values leading to potential loss of confidentiality.
🎖@cveNotify
The frontend validatate.api.exists action can be exploited by authenticated users to extract plaintext user macro values leading to potential loss of confidentiality.
🎖@cveNotify
🚨 CVE-2026-23933
In Zabbix 7.4 the cryptographic key used for signing Frontend sessions has been erroneously written to the database seed. Currently the only known exploitation scenario is for deployments that utilize both - SAML authentication and guest users. In such cases the key can be used to forge valid session cookies, potentially leading to unauthorized access. For other Zabbix deployments this does not have a known impact.
🎖@cveNotify
In Zabbix 7.4 the cryptographic key used for signing Frontend sessions has been erroneously written to the database seed. Currently the only known exploitation scenario is for deployments that utilize both - SAML authentication and guest users. In such cases the key can be used to forge valid session cookies, potentially leading to unauthorized access. For other Zabbix deployments this does not have a known impact.
🎖@cveNotify
🚨 CVE-2026-23934
An authenticated user is able to cause disproportionate CPU load on the Frontend webserver by sending specifically crafted requests to the Frontend validate.api.exists action, leading to potential denial of service.
🎖@cveNotify
An authenticated user is able to cause disproportionate CPU load on the Frontend webserver by sending specifically crafted requests to the Frontend validate.api.exists action, leading to potential denial of service.
🎖@cveNotify
🚨 CVE-2026-23935
A Zabbix administrator is able to read out of bounds memory by utilizing a flaw in script item/preprocessing (JavaScript) HttpRequest logic, leading to potential confidentiality loss.
🎖@cveNotify
A Zabbix administrator is able to read out of bounds memory by utilizing a flaw in script item/preprocessing (JavaScript) HttpRequest logic, leading to potential confidentiality loss.
🎖@cveNotify
🚨 CVE-2026-23937
The Zabbix API host.get action can be exploited by authenticated users to extract a host's PSK key leading to potential loss of data integrity.
🎖@cveNotify
The Zabbix API host.get action can be exploited by authenticated users to extract a host's PSK key leading to potential loss of data integrity.
🎖@cveNotify
🚨 CVE-2026-23938
An authenticated administrator is able to crash Zabbix server or proxy by creating specifically crafted preprocessing/script item JavaScript scripts, leading to potential denial of service.
🎖@cveNotify
An authenticated administrator is able to crash Zabbix server or proxy by creating specifically crafted preprocessing/script item JavaScript scripts, leading to potential denial of service.
🎖@cveNotify
🚨 CVE-2026-59781
When Zabbix Agent was installed on Windows into a custom installation directory, the installer did not verify whether the selected directory had secure access permissions. If the target directory allowed unauthorized users to modify its contents, an attacker could place a malicious DLL that could later be loaded by the application, resulting in DLL sideloading. The installer has been hardened to detect potentially unsafe installation directories and now requires explicit user confirmation before proceeding with installation in such locations. This reduces the risk of accidental installation into directories with inappropriate permissions while preserving compatibility with existing deployment scenarios.
🎖@cveNotify
When Zabbix Agent was installed on Windows into a custom installation directory, the installer did not verify whether the selected directory had secure access permissions. If the target directory allowed unauthorized users to modify its contents, an attacker could place a malicious DLL that could later be loaded by the application, resulting in DLL sideloading. The installer has been hardened to detect potentially unsafe installation directories and now requires explicit user confirmation before proceeding with installation in such locations. This reduces the risk of accidental installation into directories with inappropriate permissions while preserving compatibility with existing deployment scenarios.
🎖@cveNotify
🚨 CVE-2026-75783
A security vulnerability has been detected in TRENDnet TEW-WLC100P 12.07b01. Affected by this vulnerability is an unknown functionality of the file /sbin/netifd of the component DHCP blobmsg Handler. The manipulation leads to stack-based buffer overflow. The attack must be carried out from within the local network. The exploit has been disclosed publicly and may be used.
🎖@cveNotify
A security vulnerability has been detected in TRENDnet TEW-WLC100P 12.07b01. Affected by this vulnerability is an unknown functionality of the file /sbin/netifd of the component DHCP blobmsg Handler. The manipulation leads to stack-based buffer overflow. The attack must be carried out from within the local network. The exploit has been disclosed publicly and may be used.
🎖@cveNotify
GitHub
CVE/team15_20260702/01_wlc100p-netifd/poc/poc-netifd-overflow.py at main · meishigana/CVE
for_my_cve. Contribute to meishigana/CVE development by creating an account on GitHub.
🚨 CVE-2026-17084
The "stringprep" module didn't process characters from RFC 3454 tables
B.2 or B.3 correctly: the latest Unicode codepoint attributes were used
instead of the specified Unicode 3.2.0. This behavior would cause
mismatches when processing domain names using IDNA 2003 (the "idna"
codec) and the in_table_b2() function of the "stringprep" module. This
only affects domain names containing characters that were not previously
registered or had their Unicode attributes such as case-folding
behavior updated since Unicode 3.2.0.
🎖@cveNotify
The "stringprep" module didn't process characters from RFC 3454 tables
B.2 or B.3 correctly: the latest Unicode codepoint attributes were used
instead of the specified Unicode 3.2.0. This behavior would cause
mismatches when processing domain names using IDNA 2003 (the "idna"
codec) and the in_table_b2() function of the "stringprep" module. This
only affects domain names containing characters that were not previously
registered or had their Unicode attributes such as case-folding
behavior updated since Unicode 3.2.0.
🎖@cveNotify
GitHub
stringprep and IDNA 2003 incorrectly handles some characters · Issue #155292 · python/cpython
Linked PRs gh-155293 gh-156017
🚨 CVE-2026-24301
Improper neutralization of special elements used in a command ('command injection') in Microsoft Copilot allows an unauthorized attacker to disclose information over a network.
🎖@cveNotify
Improper neutralization of special elements used in a command ('command injection') in Microsoft Copilot allows an unauthorized attacker to disclose information over a network.
🎖@cveNotify
🚨 CVE-2026-28192
Unauthenticated Arbitrary File Upload in Piotnet Addons For Elementor Pro <= 7.1.67 versions.
🎖@cveNotify
Unauthenticated Arbitrary File Upload in Piotnet Addons For Elementor Pro <= 7.1.67 versions.
🎖@cveNotify
Patchstack
Arbitrary File Upload in WordPress Piotnet Addons For Elementor Pro Plugin
Patchstack is the leading open source vulnerability research organization. Find information and protection for all WordPress, Drupal and Joomla security issues.
🚨 CVE-2026-28567
Unauthenticated Broken Access Control in WP Sort Order <= 1.3.5 versions.
🎖@cveNotify
Unauthenticated Broken Access Control in WP Sort Order <= 1.3.5 versions.
🎖@cveNotify
Patchstack
Broken Access Control in WordPress WP Sort Order Plugin
Patchstack is the leading open source vulnerability research organization. Find information and protection for all WordPress, Drupal and Joomla security issues.
🚨 CVE-2026-28568
Unauthenticated Cross Site Scripting (XSS) in Quill Forms <= 5.7.1 versions.
🎖@cveNotify
Unauthenticated Cross Site Scripting (XSS) in Quill Forms <= 5.7.1 versions.
🎖@cveNotify
Patchstack
Cross Site Scripting (XSS) in WordPress Quill Forms Plugin
Patchstack is the leading open source vulnerability research organization. Find information and protection for all WordPress, Drupal and Joomla security issues.
🚨 CVE-2026-28569
Unauthenticated Cross Site Scripting (XSS) in SSL Zen <= 4.7.43 versions.
🎖@cveNotify
Unauthenticated Cross Site Scripting (XSS) in SSL Zen <= 4.7.43 versions.
🎖@cveNotify
Patchstack
Cross Site Scripting (XSS) in WordPress SSL Zen Plugin
Patchstack is the leading open source vulnerability research organization. Find information and protection for all WordPress, Drupal and Joomla security issues.