🚨 CVE-2024-6541
The Class Mediator fails to correctly validate or sanitize `messageContext` properties when they are used to populate dynamic values. This allows authenticated users to potentially access or modify data across different system invocations that should be isolated.
This weakness can lead to the disclosure of sensitive information belonging to other users or the unintended modification of system data by authenticated users. The exact impact depends on how `messageContext` properties are utilized within the affected WSO2 products.
🎖@cveNotify
The Class Mediator fails to correctly validate or sanitize `messageContext` properties when they are used to populate dynamic values. This allows authenticated users to potentially access or modify data across different system invocations that should be isolated.
This weakness can lead to the disclosure of sensitive information belonging to other users or the unintended modification of system data by authenticated users. The exact impact depends on how `messageContext` properties are utilized within the affected WSO2 products.
🎖@cveNotify
Wso2
Security Advisory WSO2-2024-3520/CVE-2024-6541 - WSO2 Security and Compliance Documentation
WSO2 security advisories, CVE justifications, cloud security bulletins, secure coding and deployment guidelines, and how to report a vulnerability.
🚨 CVE-2025-12317
When internal roles are removed from a user within the WSO2 product, the system fails to invalidate any previously issued authentication tokens associated with that user.
This vulnerability could allow users to retain their previous access privileges even after their roles have been revoked. As a result, a user can continue to perform unauthorized actions or access restricted resources until the expired tokens naturally expire.
🎖@cveNotify
When internal roles are removed from a user within the WSO2 product, the system fails to invalidate any previously issued authentication tokens associated with that user.
This vulnerability could allow users to retain their previous access privileges even after their roles have been revoked. As a result, a user can continue to perform unauthorized actions or access restricted resources until the expired tokens naturally expire.
🎖@cveNotify
Wso2
Security Advisory WSO2-2025-4672/CVE-2025-12317 - WSO2 Security and Compliance Documentation
WSO2 security advisories, CVE justifications, cloud security bulletins, secure coding and deployment guidelines, and how to report a vulnerability.
🚨 CVE-2025-14561
In multi-tenant deployments, the Publisher REST APIs fail to enforce tenant isolation correctly. This allows a user in one tenant, possessing sufficient privileges to invoke these APIs, to perform operations that impact other tenants.
The vulnerability allows a privileged user to perform publisher operations such as exposing or modifying API Metadata in another tenant environment. This impact is only realized in multi-tenant deployments.
🎖@cveNotify
In multi-tenant deployments, the Publisher REST APIs fail to enforce tenant isolation correctly. This allows a user in one tenant, possessing sufficient privileges to invoke these APIs, to perform operations that impact other tenants.
The vulnerability allows a privileged user to perform publisher operations such as exposing or modifying API Metadata in another tenant environment. This impact is only realized in multi-tenant deployments.
🎖@cveNotify
Wso2
Security Advisory WSO2-2025-4918/CVE-2025-14561 - WSO2 Security and Compliance Documentation
WSO2 security advisories, CVE justifications, cloud security bulletins, secure coding and deployment guidelines, and how to report a vulnerability.
🚨 CVE-2025-6508
The Swagger UI Try-out console within the API Publisher documentation allows an external Swagger API definition URL to be loaded, overriding the existing API definitions within the Publisher portal.
By exploiting this vulnerability, malicious actors can deceive users into interacting with these overwritten API definitions. This could lead to the exposure of sensitive information or the initiation of unintended requests to backend services.
🎖@cveNotify
The Swagger UI Try-out console within the API Publisher documentation allows an external Swagger API definition URL to be loaded, overriding the existing API definitions within the Publisher portal.
By exploiting this vulnerability, malicious actors can deceive users into interacting with these overwritten API definitions. This could lead to the exposure of sensitive information or the initiation of unintended requests to backend services.
🎖@cveNotify
Wso2
Security Advisory WSO2-2025-4306/CVE-2025-6508 - WSO2 Security and Compliance Documentation
WSO2 security advisories, CVE justifications, cloud security bulletins, secure coding and deployment guidelines, and how to report a vulnerability.
🚨 CVE-2026-3415
The XML and schema validation functionalities within the SchemaValidator Mediator process XML input as part of validation flows. Under certain conditions, the XML parser allows the resolution of external entities when handling user-supplied XML content during validation operations. This behavior can occur when an attacker supplies crafted XML payloads to the relevant mediator flows with sufficient privileges.
Successful exploitation may allow a highly privileged actor to read files accessible within the server hosting the affected product. Additionally, it may be possible to trigger outbound requests to unintended internal or external locations, depending on the server environment and network configuration. Specially crafted XML payloads can also lead to excessive resource consumption during parsing, impacting the availability of the product.
🎖@cveNotify
The XML and schema validation functionalities within the SchemaValidator Mediator process XML input as part of validation flows. Under certain conditions, the XML parser allows the resolution of external entities when handling user-supplied XML content during validation operations. This behavior can occur when an attacker supplies crafted XML payloads to the relevant mediator flows with sufficient privileges.
Successful exploitation may allow a highly privileged actor to read files accessible within the server hosting the affected product. Additionally, it may be possible to trigger outbound requests to unintended internal or external locations, depending on the server environment and network configuration. Specially crafted XML payloads can also lead to excessive resource consumption during parsing, impacting the availability of the product.
🎖@cveNotify
Wso2
Security Advisory WSO2-2026-5001/CVE-2026-3415 - WSO2 Security and Compliance Documentation
WSO2 security advisories, CVE justifications, cloud security bulletins, secure coding and deployment guidelines, and how to report a vulnerability.
🚨 CVE-2026-3418
The System REST API accepts user-supplied file uploads without enforcing sufficient validation on the file type or destination, allowing files to be written to arbitrary server-accessible locations. Exploitation requires authenticated administrative access with publisher privileges.
Successful exploitation permits an authenticated publisher to upload files to server-accessible locations. Depending on the deployment environment and how uploaded files are handled, this could lead to the execution of uploaded content, potentially resulting in remote code execution.
🎖@cveNotify
The System REST API accepts user-supplied file uploads without enforcing sufficient validation on the file type or destination, allowing files to be written to arbitrary server-accessible locations. Exploitation requires authenticated administrative access with publisher privileges.
Successful exploitation permits an authenticated publisher to upload files to server-accessible locations. Depending on the deployment environment and how uploaded files are handled, this could lead to the execution of uploaded content, potentially resulting in remote code execution.
🎖@cveNotify
Wso2
Security Advisory WSO2-2026-5146/CVE-2026-3418 - WSO2 Security and Compliance Documentation
WSO2 security advisories, CVE justifications, cloud security bulletins, secure coding and deployment guidelines, and how to report a vulnerability.
🚨 CVE-2026-11430
Grav CMS's scheduler-webhook plugin contains an authentication bypass in the webhook token check. When the webhook feature is enabled but no webhookToken is configured, a compound conditional short-circuits and skips token validation, so an unauthenticated remote attacker who can reach POST /scheduler/webhook can trigger the operator's already-configured scheduled jobs by sending a single request. The primitive is triggering-existing-jobs, not attacker-chosen command execution: the attacker controls when the jobs run and which one runs (via ?job=), but does not control what the jobs do. Code execution follows only when the operator has configured a job that shells out, and even then the attacker controls timing rather than payload. Not a default-install issue: reaching the endpoint requires the separate scheduler-webhook GPM plugin to be installed, scheduler.modern.webhook.enabled to be true (default false), and no webhookToken to be configured; a stock Grav or Grav-Admin install exposes nothing here.
🎖@cveNotify
Grav CMS's scheduler-webhook plugin contains an authentication bypass in the webhook token check. When the webhook feature is enabled but no webhookToken is configured, a compound conditional short-circuits and skips token validation, so an unauthenticated remote attacker who can reach POST /scheduler/webhook can trigger the operator's already-configured scheduled jobs by sending a single request. The primitive is triggering-existing-jobs, not attacker-chosen command execution: the attacker controls when the jobs run and which one runs (via ?job=), but does not control what the jobs do. Code execution follows only when the operator has configured a job that shells out, and even then the attacker controls timing rather than payload. Not a default-install issue: reaching the endpoint requires the separate scheduler-webhook GPM plugin to be installed, scheduler.modern.webhook.enabled to be true (default false), and no webhookToken to be configured; a stock Grav or Grav-Admin install exposes nothing here.
🎖@cveNotify
GitHub
GitHub - getgrav/grav: Modern, Crazy Fast, Ridiculously Easy and Amazingly Powerful Flat-File CMS powered by PHP, Markdown, Twig…
Modern, Crazy Fast, Ridiculously Easy and Amazingly Powerful Flat-File CMS powered by PHP, Markdown, Twig, and Symfony - getgrav/grav
🚨 CVE-2026-59090
A flaw was found in GIMP's PSD file format plugin. This vulnerability, an unsigned integer underflow in the `block_rem` variable, occurs when a user opens a specially crafted `.psd` image file. The underflow leads to parser confusion, enabling an attacker to inject arbitrary data as layer resource blocks. This can ultimately result in arbitrary code execution, allowing the attacker to run malicious code on the victim's system.
🎖@cveNotify
A flaw was found in GIMP's PSD file format plugin. This vulnerability, an unsigned integer underflow in the `block_rem` variable, occurs when a user opens a specially crafted `.psd` image file. The underflow leads to parser confusion, enabling an attacker to inject arbitrary data as layer resource blocks. This can ultimately result in arbitrary code execution, allowing the attacker to run malicious code on the victim's system.
🎖@cveNotify
🚨 CVE-2026-50770
An issue in Squirro Cognitive Search before v.3.14.2 allows a remote attacker to escalate privileges via a crafted request.
🎖@cveNotify
An issue in Squirro Cognitive Search before v.3.14.2 allows a remote attacker to escalate privileges via a crafted request.
🎖@cveNotify
Squirro Documentation
Squirro Search
Introduction: Accessing the correct information quickly is increasingly difficult in a world filled with siloed data. End users can’t search all of their connected data sources easily, and their se...
🚨 CVE-2026-50772
An issue in Squirro Cognitive Search < 3.14.2 allows a remote attacker to execute arbitrary code via a crafted payload to the password reset function.
🎖@cveNotify
An issue in Squirro Cognitive Search < 3.14.2 allows a remote attacker to execute arbitrary code via a crafted payload to the password reset function.
🎖@cveNotify
Squirro Documentation
Squirro Search
Introduction: Accessing the correct information quickly is increasingly difficult in a world filled with siloed data. End users can’t search all of their connected data sources easily, and their se...
🚨 CVE-2026-50773
An issue in CGM Germany - CompuGroup Medical CGM ISIS MED 2510.1.0.20 allows a remote attacker to execute arbtirary code via a crafted .dll file.
🎖@cveNotify
An issue in CGM Germany - CompuGroup Medical CGM ISIS MED 2510.1.0.20 allows a remote attacker to execute arbtirary code via a crafted .dll file.
🎖@cveNotify
GitHub
CVEs/CVE-2026-50773 at main · Henkel-CyberVM/CVEs
CVE reports created by Henkel AG & Co. KGaA's Cyber Defense team. - Henkel-CyberVM/CVEs
🚨 CVE-2026-67678
File Upload vulnerability in RainyGao-Hithub DocSys v.2.02.80 allows a remote attacker to execute arbitrary code
🎖@cveNotify
File Upload vulnerability in RainyGao-Hithub DocSys v.2.02.80 allows a remote attacker to execute arbitrary code
🎖@cveNotify
GitHub
[Security] DocSys V2.02.80 存在任意文件上传漏洞 · Issue #49 · RainyGao-GitHub/DocSys
漏洞版本 V2.02.80 漏洞描述 用户通过认证后，攻击者可以上传任意文件到服务器，导致服务器被用户接管。 漏洞证明 这个漏洞是后台的，而且需要是管理员权限，在/uploadDoc.do 接口中： 如果传递的 usage 不为空的话，就会判断当前的用户是否具备管理员的权限。后续就不会存在任何的文件校验，且文件名是用户自己可以控制的！ 这里我们要分析的是，能否无需管理员权限，或者无需登录就可...
🚨 CVE-2026-67925
Cross Site Scripting vulnerability in JeecgBoot v.3.9.2 allows a remote attacker to execute arbitrary code via the endpoint /airag/chat/upload
🎖@cveNotify
Cross Site Scripting vulnerability in JeecgBoot v.3.9.2 allows a remote attacker to execute arbitrary code via the endpoint /airag/chat/upload
🎖@cveNotify
GitHub
High Risk Stored XSS Vulnerability in JeecgBoot 3.9.2 · Issue #9773 · jeecgboot/JeecgBoot
版本号： JeecgBoot 3.9.2（26.x/ 4.6 系列） 分支： 问题描述： JeecgBoot 存在未授权文件上传引发的存储型 XSS 漏洞。匿名可直接调用免登上传接口/airag/chat/upload，后端文件校验允许 SVG、HTML 等支持 JS 脚本的文件格式，上传文件持久存储至服务器磁盘，框架静态资源路由将上传目录对外开放，任意用户均可直接访问上传文件。 攻击者上传...
🚨 CVE-2026-67926
An issue in JeecgBoot v.3.9.2 allows a remote attacker to execute arbitrary code via the files Parameter in JeecgBoot AI Chat Module
🎖@cveNotify
An issue in JeecgBoot v.3.9.2 allows a remote attacker to execute arbitrary code via the files Parameter in JeecgBoot AI Chat Module
🎖@cveNotify
GitHub
Unauthenticated SSRF Triggered by files Parameter in JeecgBoot AI Chat Module · Issue #9774 · jeecgboot/JeecgBoot
版本号： JeecgBoot v3.9.2 问题描述： JeecgBoot /airag/chat/send 接口存在 SSRF 漏洞，接口未对传入的files参数做内网 IP、本地地址访问限制，攻击者可构造恶意 URL 传入 files 数组，服务端会主动发起网络请求。利用该漏洞可扫描内网资产、访问内网服务、读取本地文件，无身份校验即可触发，危害内网安全。 The /airag/chat/...
🚨 CVE-2026-67965
An issue in Tneda W20E v.16.01.0.6(2782) allows a remote attacker to execute arbitrary code via the url_need_login function
🎖@cveNotify
An issue in Tneda W20E v.16.01.0.6(2782) allows a remote attacker to execute arbitrary code via the url_need_login function
🎖@cveNotify
GitHub
GitHub - H0111mes/Tenda-W20E-Vulnerability-Disclosure
Contribute to H0111mes/Tenda-W20E-Vulnerability-Disclosure development by creating an account on GitHub.
🚨 CVE-2026-42163
Mahara before 25.04.5 and 26.04.0 is vulnerable to unauthorized access to internal accounts via Learning Tools Interoperability (LTI) under certain circumstances. This applies to LTI 1.1 and LTI 1.3 Advantage.
🎖@cveNotify
Mahara before 25.04.5 and 26.04.0 is vulnerable to unauthorized access to internal accounts via Learning Tools Interoperability (LTI) under certain circumstances. This applies to LTI 1.1 and LTI 1.3 Advantage.
🎖@cveNotify
mahara.org
Security announcements - Security maintenance releases Mahara 25.04.7 and Mahara 26.04.1 - Mahara ePortfolio System
Mahara is an open source ePortfolio and social networking web application.
It provides people with tools to create and maintain a digital portfolio of their learning and social networking features to allow them to interact with each other.
It provides people with tools to create and maintain a digital portfolio of their learning and social networking features to allow them to interact with each other.
🚨 CVE-2026-51977
An issue in Trueview T18061 WiFi 3MP Robot Pan-Tilt Security Camera Version 1.0 allows a physically proximate attacker to escalate privileges via the RSA private key component
🎖@cveNotify
An issue in Trueview T18061 WiFi 3MP Robot Pan-Tilt Security Camera Version 1.0 allows a physically proximate attacker to escalate privileges via the RSA private key component
🎖@cveNotify
GitHub
CVE/CVE-2026-51977/README.md at main · EmbdCDACHyd/CVE
Research repository focused on security vulnerabilities (CVEs) in IoT devices, firmware, communication protocols, and embedded systems. - EmbdCDACHyd/CVE
🚨 CVE-2026-67854
SQL Injection vulnerability in Qcms v.6.0.6 allows a remote attacker to execute arbitrary code
🎖@cveNotify
SQL Injection vulnerability in Qcms v.6.0.6 allows a remote attacker to execute arbitrary code
🎖@cveNotify
JiuZero's Blog
QCMS tableField_Action Backend SQL Injection Vulnerability White-box Audit Report
This content is encrypted, please enter the password to view.
🚨 CVE-2026-67960
An issue in PbootCMS v.3.2.15 allows an attacker to execute arbitrary code via the MemberController.php, UserController.php, CommentController.php, ContentController.php, and helper.php components
🎖@cveNotify
An issue in PbootCMS v.3.2.15 allows an attacker to execute arbitrary code via the MemberController.php, UserController.php, CommentController.php, ContentController.php, and helper.php components
🎖@cveNotify
🚨 CVE-2026-42162
Mahara before 25.04.5 and 26.04.0 is vulnerable to artefacts being accessible to others under certain circumstances when the file path to an artefact in a page is manipulated.
🎖@cveNotify
Mahara before 25.04.5 and 26.04.0 is vulnerable to artefacts being accessible to others under certain circumstances when the file path to an artefact in a page is manipulated.
🎖@cveNotify
mahara.org
Home - Mahara ePortfolio System
Mahara is an open source ePortfolio and social networking web application.
It provides people with tools to create and maintain a digital portfolio of their learning and social networking features to allow them to interact with each other.
It provides people with tools to create and maintain a digital portfolio of their learning and social networking features to allow them to interact with each other.
🚨 CVE-2026-42164
Mahara before 25.04.5 and 26.04.0 is vulnerable in the Text block/section functionality when a call is crafted in a certain way that allows it to recall the backed-up content from another Text section.
🎖@cveNotify
Mahara before 25.04.5 and 26.04.0 is vulnerable in the Text block/section functionality when a call is crafted in a certain way that allows it to recall the backed-up content from another Text section.
🎖@cveNotify
mahara.org
Home - Mahara ePortfolio System
Mahara is an open source ePortfolio and social networking web application.
It provides people with tools to create and maintain a digital portfolio of their learning and social networking features to allow them to interact with each other.
It provides people with tools to create and maintain a digital portfolio of their learning and social networking features to allow them to interact with each other.