๐จ CVE-2026-21551
In modem, there is a possible improper input validation. This could lead to remote denial of service with no additional execution privileges needed
๐@cveNotify
In modem, there is a possible improper input validation. This could lead to remote denial of service with no additional execution privileges needed
๐@cveNotify
๐จ CVE-2026-21552
In modem, there is a possible improper input validation. This could lead to remote denial of service with no additional execution privileges needed
๐@cveNotify
In modem, there is a possible improper input validation. This could lead to remote denial of service with no additional execution privileges needed
๐@cveNotify
๐จ CVE-2026-21553
In modem, there is a possible improper input validation. This could lead to remote denial of service with no additional execution privileges needed
๐@cveNotify
In modem, there is a possible improper input validation. This could lead to remote denial of service with no additional execution privileges needed
๐@cveNotify
๐จ CVE-2026-21554
In modem, there is a possible improper input validation. This could lead to remote denial of service with no additional execution privileges needed
๐@cveNotify
In modem, there is a possible improper input validation. This could lead to remote denial of service with no additional execution privileges needed
๐@cveNotify
๐จ CVE-2026-21555
In modem, there is a possible improper input validation. This could lead to remote denial of service with no additional execution privileges needed
๐@cveNotify
In modem, there is a possible improper input validation. This could lead to remote denial of service with no additional execution privileges needed
๐@cveNotify
๐จ CVE-2026-70374
HashBrown CMS through 1.4.6 contains an OS Command Injection vulnerability (CWE-78) in the media upload thumbnail generation routine. Media.generateThumbnail in src/Server/Entity/Resource/Media.js builds a temporary file path as 'thumbnail' + Path.extname(filename) and passes it, unescaped, into a shell command executed via AppService.exec ('convert ' + tempFile + ...).
๐@cveNotify
HashBrown CMS through 1.4.6 contains an OS Command Injection vulnerability (CWE-78) in the media upload thumbnail generation routine. Media.generateThumbnail in src/Server/Entity/Resource/Media.js builds a temporary file path as 'thumbnail' + Path.extname(filename) and passes it, unescaped, into a shell command executed via AppService.exec ('convert ' + tempFile + ...).
๐@cveNotify
๐จ CVE-2026-70375
HashBrown CMS through 1.4.6 contains an OS Command Injection vulnerability (CWE-78) in the Git deployer component. GitDeployer.pullRepo in src/Server/Entity/Deployer/GitDeployer.js executes AppService.exec, interpolating the configured branch value directly into a shell command with no escaping.
๐@cveNotify
HashBrown CMS through 1.4.6 contains an OS Command Injection vulnerability (CWE-78) in the Git deployer component. GitDeployer.pullRepo in src/Server/Entity/Deployer/GitDeployer.js executes AppService.exec, interpolating the configured branch value directly into a shell command with no escaping.
๐@cveNotify
๐จ CVE-2026-54416
Pluck CMS through 4.7.21 restricts dangerous file uploads in its admin file-management feature using a fixed blacklist in data/inc/files.php ('.php','php3','php4','php5','php6','php7','phtml','.phtm','.pht','.ph3','.ph4','.ph5','.asp','.cgi','.phar'), checked against the last 4-5 characters of the filename.
๐@cveNotify
Pluck CMS through 4.7.21 restricts dangerous file uploads in its admin file-management feature using a fixed blacklist in data/inc/files.php ('.php','php3','php4','php5','php6','php7','phtml','.phtm','.pht','.ph3','.ph4','.ph5','.asp','.cgi','.phar'), checked against the last 4-5 characters of the filename.
๐@cveNotify
GitHub
GitHub - pluck-cms/pluck: Central repo for pluck cms
Central repo for pluck cms. Contribute to pluck-cms/pluck development by creating an account on GitHub.
๐จ CVE-2026-54418
Leantime through 3.6.2 exposes the JSON-RPC methods leantime.rpc.TwoFA.TwoFA.getSetupData, saveSecret, verifyAndEnable, and disable2FA, which act on a caller-supplied userId parameter with no ownership check, session pinning, or permission-attribute gate (unlike other RPC-exposed methods in the same dispatcher).
๐@cveNotify
Leantime through 3.6.2 exposes the JSON-RPC methods leantime.rpc.TwoFA.TwoFA.getSetupData, saveSecret, verifyAndEnable, and disable2FA, which act on a caller-supplied userId parameter with no ownership check, session pinning, or permission-attribute gate (unlike other RPC-exposed methods in the same dispatcher).
๐@cveNotify
GitHub
GitHub - Leantime/leantime: Leantime is a goals focused project management system for non-project managers. Building with ADHDโฆ
Leantime is a goals focused project management system for non-project managers. Building with ADHD, Autism, and dyslexia in mind. - Leantime/leantime
๐จ CVE-2026-55739
Crater isolates data per company_id, and its Invoice/Estimate/Payment/Expense policies enforce both a Bouncer ability check and ->hasCompany(->company_id). CustomerPolicy's view/update/delete methods omit the company-ownership check entirely, checking only the blanket ability. Route-model-bound customer lookups and the bulk Customer::deleteCustomers method are similarly unscoped (self::find with no company filter).
๐@cveNotify
Crater isolates data per company_id, and its Invoice/Estimate/Payment/Expense policies enforce both a Bouncer ability check and ->hasCompany(->company_id). CustomerPolicy's view/update/delete methods omit the company-ownership check entirely, checking only the blanket ability. Route-model-bound customer lookups and the bulk Customer::deleteCustomers method are similarly unscoped (self::find with no company filter).
๐@cveNotify
GitHub
GitHub - crater-invoice-inc/crater: Open Source Invoicing Solution for Individuals & Businesses
Open Source Invoicing Solution for Individuals & Businesses - crater-invoice-inc/crater
๐จ CVE-2026-55747
The pocketflow-coding-agent cookbook example in The-Pocket/PocketFlow implements a helper as a thin os.path.join(workdir, p) wrapper with no canonicalization or containment check, used unguarded by the ReadFile, ListFiles, PatchRead, and PatchApply file-access tools. Severity reflects that this affects an illustrative cookbook example rather than a core library API; applications that copy this pattern into production are affected.
๐@cveNotify
The pocketflow-coding-agent cookbook example in The-Pocket/PocketFlow implements a helper as a thin os.path.join(workdir, p) wrapper with no canonicalization or containment check, used unguarded by the ReadFile, ListFiles, PatchRead, and PatchApply file-access tools. Severity reflects that this affects an illustrative cookbook example rather than a core library API; applications that copy this pattern into production are affected.
๐@cveNotify
GitHub
GitHub - The-Pocket/PocketFlow: Pocket Flow: 100-line LLM framework. Let Agents build Agents!
Pocket Flow: 100-line LLM framework. Let Agents build Agents! - The-Pocket/PocketFlow
๐จ CVE-2026-70376
Pluck CMS's admin panel relies solely on a Referer-header comparison (requestedByTheSameDomain in data/inc/functions.admin.php, gating every admin.php action) for CSRF protection, with no per-request anti-CSRF token anywhere in the admin area.
๐@cveNotify
Pluck CMS's admin panel relies solely on a Referer-header comparison (requestedByTheSameDomain in data/inc/functions.admin.php, gating every admin.php action) for CSRF protection, with no per-request anti-CSRF token anywhere in the admin area.
๐@cveNotify
GitHub
GitHub - pluck-cms/pluck: Central repo for pluck cms
Central repo for pluck cms. Contribute to pluck-cms/pluck development by creating an account on GitHub.
๐จ CVE-2026-70377
imagecli's pipeline operation (Scale::apply in src/image_ops.rs) computes output width/height as (dimension as f32 * ratio) as u32 with no upper-bound validation on the CLI-supplied ratio, which is parsed via nom::number::complete::float with no range check. Any application embedding imagecli as a library and accepting user-controlled pipeline strings is remotely crashable with a single request.
๐@cveNotify
imagecli's pipeline operation (Scale::apply in src/image_ops.rs) computes output width/height as (dimension as f32 * ratio) as u32 with no upper-bound validation on the CLI-supplied ratio, which is parsed via nom::number::complete::float with no range check. Any application embedding imagecli as a library and accepting user-controlled pipeline strings is remotely crashable with a single request.
๐@cveNotify
GitHub
[Security] Unbounded memory allocation in `Scale` operation leads to Denial of Service (Uncontrolled Resource Consumption) ยท Issueโฆ
Classification CWE-789: Memory Allocation with Excessive Size Value CWE-400: Uncontrolled Resource Consumption Severity: Medium (local DoS; High if this crate is used as a library behind any servic...
๐จ CVE-2026-70378
imagecli's pipeline operation (Carve::apply in src/image_ops.rs) only asserts , never validating that the ratio is positive. A negative ratio (e.g. -5) causes the computed target width to saturate to 0 via Rust's defined float-to-uint cast, which is then passed to imageproc::seam_carving::shrink_width โ a function that panics when given a width below 2, crashing the process.
๐@cveNotify
imagecli's pipeline operation (Carve::apply in src/image_ops.rs) only asserts , never validating that the ratio is positive. A negative ratio (e.g. -5) causes the computed target width to saturate to 0 via Rust's defined float-to-uint cast, which is then passed to imageproc::seam_carving::shrink_width โ a function that panics when given a width below 2, crashing the process.
๐@cveNotify
GitHub
[Security] Missing lower-bound validation in `Carve` operation causes reachable panic (Denial of Service) ยท Issue #67 ยท theotherphil/imagecli
Classification CWE-617: Reachable Assertion CWE-20: Improper Input Validation Severity: Medium (local DoS; High if used as a library behind a service accepting user-controlled pipeline strings โ se...
๐จ CVE-2026-71202
The raster Rust crate's crop function (src/editor.rs) clamps the crop width/height against source dimensions but only clamps the offset_x/offset_y parameters against 0, never against the source width/height.
๐@cveNotify
The raster Rust crate's crop function (src/editor.rs) clamps the crop width/height against source dimensions but only clamps the offset_x/offset_y parameters against 0, never against the source width/height.
๐@cveNotify
GitHub
Security Report: Integer Underflow in `raster::editor::crop()` Leads to Denial of Service ยท Issue #30 ยท kosinix/raster
Summary The crop() function in the raster crate (Rust, crates.io) computes the dimensions of the cropped output image using unchecked integer subtraction on caller-supplied offset values. When offs...
๐จ CVE-2026-71203
changedetection.io's REST API resources are protected by an @auth.check_token decorator validating the caller's x-api-key header, except the Spec resource registered at /api/v1/full-spec (changedetectionio/api/Spec.py), whose get method carries neither @auth.check_token nor @validate_openapi_request.
๐@cveNotify
changedetection.io's REST API resources are protected by an @auth.check_token decorator validating the caller's x-api-key header, except the Spec resource registered at /api/v1/full-spec (changedetectionio/api/Spec.py), whose get method carries neither @auth.check_token nor @validate_openapi_request.
๐@cveNotify
GitHub
GitHub - dgtlmoon/changedetection.io: Best and simplest tool for website change detection, web page monitoring, and website changeโฆ
Best and simplest tool for website change detection, web page monitoring, and website change alerts. Perfect for tracking content changes, price drops, restock alerts, and website defacement monito...
๐จ CVE-2026-0516
A improper neutralization of HTTP Headers for Scripting Syntax vulnerability in SonicOS could allow a remote attacker to manipulate the Host header and redirect firewall management users to arbitrary web domains.
๐@cveNotify
A improper neutralization of HTTP Headers for Scripting Syntax vulnerability in SonicOS could allow a remote attacker to manipulate the Host header and redirect firewall management users to arbitrary web domains.
๐@cveNotify
๐จ CVE-2026-15570
An improper restriction of URL schemes and destinations in the SmartCenter browserseturl command in the Telefunken TE24553B45V2DZ Smart TV running on the Vestel MB181 / Voltron181 / TiVo OS platform allows an attacker with access to the same local network to cause the embedded browser to issue requests to unintended loopback/internal destinations, including 127.0.0.1 addresses. In demonstrated scenarios, requests initiated through the SmartCenter browserseturl mechanism could reach an internal service and receive a successful response, although the same destination was not reachable through normal browser navigation. The issue affects firmware version V2.78.0.0 and is fixed in firmware version V2.85.2.0.
๐@cveNotify
An improper restriction of URL schemes and destinations in the SmartCenter browserseturl command in the Telefunken TE24553B45V2DZ Smart TV running on the Vestel MB181 / Voltron181 / TiVo OS platform allows an attacker with access to the same local network to cause the embedded browser to issue requests to unintended loopback/internal destinations, including 127.0.0.1 addresses. In demonstrated scenarios, requests initiated through the SmartCenter browserseturl mechanism could reach an internal service and receive a successful response, although the same destination was not reachable through normal browser navigation. The issue affects firmware version V2.78.0.0 and is fixed in firmware version V2.85.2.0.
๐@cveNotify
๐จ CVE-2026-66151
SonicWall Global VPN Client version 4.10.8.1108 and earlier is vulnerable to an out-of-bounds kernel memory read in the SWIPsec.sys driver, which could allow a local attacker to cause a system crash.
๐@cveNotify
SonicWall Global VPN Client version 4.10.8.1108 and earlier is vulnerable to an out-of-bounds kernel memory read in the SWIPsec.sys driver, which could allow a local attacker to cause a system crash.
๐@cveNotify
๐จ CVE-2026-72564
An improper authorization vulnerability in fosrl/pangolin through v1.20.0 allows an authenticated remote attacker to authenticate to any resource in any organization by reusing an access token issued for a different resource.
๐@cveNotify
An improper authorization vulnerability in fosrl/pangolin through v1.20.0 allows an authenticated remote attacker to authenticate to any resource in any organization by reusing an access token issued for a different resource.
๐@cveNotify
GitHub
GitHub - fosrl/pangolin: Modern networking and security platform providing secure access and connectivity to apps, infrastructureโฆ
Modern networking and security platform providing secure access and connectivity to apps, infrastructure, and AI workloads. Connect and protect your users. - fosrl/pangolin
๐จ CVE-2026-72565
A SQL injection vulnerability in Tencent APIJSON through 8.1.8 allows unauthenticated remote attackers to bypass per-table access control and read arbitrary database tables via the Map-form @having operator.
๐@cveNotify
A SQL injection vulnerability in Tencent APIJSON through 8.1.8 allows unauthenticated remote attackers to bypass per-table access control and read arbitrary database tables via the Map-form @having operator.
๐@cveNotify
GitHub
GitHub - Tencent/APIJSON: ๐ Real-Time no-code, powerful and secure ORM ๐ providing APIs and Docs without coding by Backend, andโฆ
๐ Real-Time no-code, powerful and secure ORM ๐ providing APIs and Docs without coding by Backend, and Frontend(Client) can customize response JSONs ๐ ๅฎๆถ ้ถไปฃ็ ใๅ
จๅ่ฝใๅผบๅฎๅ
จ ORM ๅบ ๐ ๅ็ซฏๆฅๅฃๅๆๆกฃ้ถไปฃ็ ๏ผๅ็ซฏ(ๅฎขๆท็ซฏ) ๅฎๅถ่ฟๅ...