🚨 CVE-2026-84640
A maliciously constructed mail header could lead to a one byte read past the end of a buffer. This vulnerability was fixed in Thunderbird 155, Thunderbird 140.15, and Thunderbird 153.2.
🎖@cveNotify
A maliciously constructed mail header could lead to a one byte read past the end of a buffer. This vulnerability was fixed in Thunderbird 155, Thunderbird 140.15, and Thunderbird 153.2.
🎖@cveNotify
bugzilla.mozilla.org
Access Denied
You are not authorized to access bug 2063964. To see this bug, you must
first log in to an account with the appropriate permissions.
first log in to an account with the appropriate permissions.
🚨 CVE-2026-84641
A malicious IMAP server can trigger use-after-free and heap-memory disclosure by sending a crafted ID response. Heap contents can ultimately be persisted to prefs.js. This vulnerability was fixed in Thunderbird 155, Thunderbird 140.15, and Thunderbird 153.2.
🎖@cveNotify
A malicious IMAP server can trigger use-after-free and heap-memory disclosure by sending a crafted ID response. Heap contents can ultimately be persisted to prefs.js. This vulnerability was fixed in Thunderbird 155, Thunderbird 140.15, and Thunderbird 153.2.
🎖@cveNotify
bugzilla.mozilla.org
Access Denied
You are not authorized to access bug 2057805. To see this bug, you must
first log in to an account with the appropriate permissions.
first log in to an account with the appropriate permissions.
🚨 CVE-2026-84642
The values of the mail.allowed_attachment_hostnames advanced config setting were used in a regular expression without escaping. For some possible valid hostnames, this could allow certain unintended hostnames to also match and serve remote attachments. This vulnerability was fixed in Thunderbird 155 and Thunderbird 153.2.
🎖@cveNotify
The values of the mail.allowed_attachment_hostnames advanced config setting were used in a regular expression without escaping. For some possible valid hostnames, this could allow certain unintended hostnames to also match and serve remote attachments. This vulnerability was fixed in Thunderbird 155 and Thunderbird 153.2.
🎖@cveNotify
bugzilla.mozilla.org
Access Denied
You are not authorized to access bug 2060462. To see this bug, you must
first log in to an account with the appropriate permissions.
first log in to an account with the appropriate permissions.
🚨 CVE-2026-80205
NLTK versions before 3.10.0 contain a regular expression denial of service vulnerability in Text.findall() and TokenSearcher.findall() methods that accept user-supplied regular expressions without validation or timeout. Attackers can supply crafted regex patterns that cause catastrophic backtracking, resulting in indefinite CPU saturation and denial of service to all users of the Python process.
🎖@cveNotify
NLTK versions before 3.10.0 contain a regular expression denial of service vulnerability in Text.findall() and TokenSearcher.findall() methods that accept user-supplied regular expressions without validation or timeout. Attackers can supply crafted regex patterns that cause catastrophic backtracking, resulting in indefinite CPU saturation and denial of service to all users of the Python process.
🎖@cveNotify
GitHub
ReDoS in nltk.text.Text.findall() via unvalidated user-supplied regular expressions
### Summary
NLTK's `Text.findall()` and `TokenSearcher.findall()` methods accept user-supplied regular expressions and pass them to the Python `re` engine without timeout or validation, enabli...
NLTK's `Text.findall()` and `TokenSearcher.findall()` methods accept user-supplied regular expressions and pass them to the Python `re` engine without timeout or validation, enabli...
🚨 CVE-2026-84208
AVideo through version 29.0 contains an unauthenticated SQL injection vulnerability in the User_Location plugin's regions.json.php and cities.json.php endpoints. The country and region GET parameters are passed directly into SQL queries without escaping or prepared statement binding, allowing unauthenticated attackers to execute UNION-based SQL injection to read arbitrary database contents including password hashes and sensitive data.
🎖@cveNotify
AVideo through version 29.0 contains an unauthenticated SQL injection vulnerability in the User_Location plugin's regions.json.php and cities.json.php endpoints. The country and region GET parameters are passed directly into SQL queries without escaping or prepared statement binding, allowing unauthenticated attackers to execute UNION-based SQL injection to read arbitrary database contents including password hashes and sensitive data.
🎖@cveNotify
GitHub
Unauthenticated SQL Injection in User_Location Plugin
### Summary
`plugin/User_Location/regions.json.php` and `cities.json.php` pass the `country` and `region` GET parameters directly into SQL queries with no escaping, no binding, and no authentica...
`plugin/User_Location/regions.json.php` and `cities.json.php` pass the `country` and `region` GET parameters directly into SQL queries with no escaping, no binding, and no authentica...
🚨 CVE-2026-84423
A vulnerability has been found in Casdoor up to 4.0.0. This affects an unknown function of the file controllers/resource.go of the component upload-resource API. Such manipulation leads to missing authentication. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor deleted the GitHub issue for this vulnerability without any explanation. Afterwards the vendor was contacted early about this disclosure via email but did not respond in any way.
🎖@cveNotify
A vulnerability has been found in Casdoor up to 4.0.0. This affects an unknown function of the file controllers/resource.go of the component upload-resource API. Such manipulation leads to missing authentication. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor deleted the GitHub issue for this vulnerability without any explanation. Afterwards the vendor was contacted early about this disclosure via email but did not respond in any way.
🎖@cveNotify
GitHub
GitHub - casdoor/casdoor: An open-source Agent-first Identity and Access Management (IAM) /LLM MCP & agent gateway and auth server…
An open-source Agent-first Identity and Access Management (IAM) /LLM MCP & agent gateway and auth server with web UI supporting OpenClaw, MCP, OAuth, OIDC, SAML, CAS, LDAP, SCIM, WebAuthn, ...
🚨 CVE-2026-84476
WWBN AVideo fails to validate trusted proxies before accepting X-Real-IP and X-Forwarded-For headers, allowing attackers to spoof the client address used by enforceRateLimit(). Attackers can rotate the header value per request to bypass login rate limiting and perform unlimited credential guessing attacks.
🎖@cveNotify
WWBN AVideo fails to validate trusted proxies before accepting X-Real-IP and X-Forwarded-For headers, allowing attackers to spoof the client address used by enforceRateLimit(). Attackers can rotate the header value per request to bypass login rate limiting and perform unlimited credential guessing attacks.
🎖@cveNotify
GitHub
Client-supplied X-Real-IP / X-Forwarded-For is trusted without any trusted-proxy check, letting a caller choose the address en…
### Summary
`getRealIpAddr()` accepts the client's own `X-Real-IP` or `X-Forwarded-For` header whenever `REMOTE_ADDR` merely looks private:
```php
// objects/functions.php:220
function ...
`getRealIpAddr()` accepts the client's own `X-Real-IP` or `X-Forwarded-For` header whenever `REMOTE_ADDR` merely looks private:
```php
// objects/functions.php:220
function ...
🚨 CVE-2026-84477
AVideo Live_schedule::setTitle() and setDescription() store POST input without sanitization, allowing users with streaming permission to inject malicious scripts. Unauthenticated attackers can access remindMe.php to execute stored XSS payloads in victim browsers without requiring authentication.
🎖@cveNotify
AVideo Live_schedule::setTitle() and setDescription() store POST input without sanitization, allowing users with streaming permission to inject malicious scripts. Unauthenticated attackers can access remindMe.php to execute stored XSS payloads in victim browsers without requiring authentication.
🎖@cveNotify
GitHub
Stored XSS in live-schedule title and description: Live_schedule::setTitle() and setDescription() store $_POST verbatim, and p…
### Summary
`Live_schedule::setTitle()` and `setDescription()` store their input exactly as received:
```php
// plugin/Live/Objects/Live_schedule.php:268
public function setTitle($title)
{...
`Live_schedule::setTitle()` and `setDescription()` store their input exactly as received:
```php
// plugin/Live/Objects/Live_schedule.php:268
public function setTitle($title)
{...
🚨 CVE-2026-84478
WWBN AVideo contains a path traversal vulnerability in the API get_api_login_code endpoint that allows unauthenticated attackers to delete arbitrary .log files by supplying directory traversal sequences in the code parameter. Attackers can exploit this to destroy audit logs and probe for file existence on the server, with the vulnerability enabling both file deletion and information disclosure about the filesystem.
🎖@cveNotify
WWBN AVideo contains a path traversal vulnerability in the API get_api_login_code endpoint that allows unauthenticated attackers to delete arbitrary .log files by supplying directory traversal sequences in the code parameter. Attackers can exploit this to destroy audit logs and probe for file existence on the server, with the vulnerability enabling both file deletion and information disclosure about the filesystem.
🎖@cveNotify
GitHub
Unauthenticated arbitrary .log file deletion and file-existence disclosure in API::get_api_login_code(): the code parameter reaches…
### Summary
`API::get_api_login_code()` builds a filesystem path from the caller's `code` parameter with no validation, and deletes whatever it finds there before checking that the file is a...
`API::get_api_login_code()` builds a filesystem path from the caller's `code` parameter with no validation, and deletes whatever it finds there before checking that the file is a...
🚨 CVE-2026-84479
WWBN AVideo (current e01e41ecc and earlier) makes three login-time security controls depend solely on the client-supplied User-Agent header. The isAVideoEncoder()/isAVideoMobileApp() checks match HTTP_USER_AGENT against a hardcoded literal ("AVideoEncoder"/"AVideoMobileApp") with no IP check or shared secret. An attacker who submits valid credentials and sets User-Agent: AVideoEncoder bypasses two-factor authentication, skips brute-force captcha escalation, and avoids being recorded in the login/device audit history. No patch is available at the time of publication.
🎖@cveNotify
WWBN AVideo (current e01e41ecc and earlier) makes three login-time security controls depend solely on the client-supplied User-Agent header. The isAVideoEncoder()/isAVideoMobileApp() checks match HTTP_USER_AGENT against a hardcoded literal ("AVideoEncoder"/"AVideoMobileApp") with no IP check or shared secret. An attacker who submits valid credentials and sets User-Agent: AVideoEncoder bypasses two-factor authentication, skips brute-force captcha escalation, and avoids being recorded in the login/device audit history. No patch is available at the time of publication.
🎖@cveNotify
GitHub
2FA, brute-force captcha and login audit logging are all disabled by sending User-Agent: AVideoEncoder
### Summary
Three login-time security controls are switched off by the caller's `User-Agent` header:
- the brute-force captcha escalation in `User::login()` (`objects/user.php:1285`)
- t...
Three login-time security controls are switched off by the caller's `User-Agent` header:
- the brute-force captcha escalation in `User::login()` (`objects/user.php:1285`)
- t...
🚨 CVE-2026-84480
WWBN AVideo fails to validate password recovery token expiration in userRecoverPassSave.json.php, allowing attackers to use expired tokens to reset account passwords indefinitely. Attackers who obtain a recovery token can use it at any time to change the target account's password and gain full account access.
🎖@cveNotify
WWBN AVideo fails to validate password recovery token expiration in userRecoverPassSave.json.php, allowing attackers to use expired tokens to reset account passwords indefinitely. Attackers who obtain a recovery token can use it at any time to change the target account's password and gain full account access.
🎖@cveNotify
GitHub
Password recovery tokens never expire: userRecoverPassSave.json.php skips the validity check, allowing account takeover with an…
### Summary
`objects/userRecoverPassSave.json.php` accepts a password-recovery token by comparing it directly to the stored value:
```php
} elseif ($user->getRecoverPass() !== $_POST['...
`objects/userRecoverPassSave.json.php` accepts a password-recovery token by comparing it directly to the stored value:
```php
} elseif ($user->getRecoverPass() !== $_POST['...
🚨 CVE-2026-84481
WWBN AVideo through 30.0 contains an information disclosure vulnerability in the MobileManager plugin getConfiguration endpoint that returns sensitive configuration data to unauthenticated visitors. Attackers can send an unauthenticated GET request to plugin/MobileManager/getConfiguration.json.php to obtain TLS private key file paths, socket configuration details, platform version, and debug flags enabling further targeted attacks.
🎖@cveNotify
WWBN AVideo through 30.0 contains an information disclosure vulnerability in the MobileManager plugin getConfiguration endpoint that returns sensitive configuration data to unauthenticated visitors. Attackers can send an unauthenticated GET request to plugin/MobileManager/getConfiguration.json.php to obtain TLS private key file paths, socket configuration details, platform version, and debug flags enabling further targeted attacks.
🎖@cveNotify
GitHub
Unauthenticated MobileManager configuration disclosure exposes TLS key paths and socket config
WWBN/AVideo: `plugin/MobileManager/getConfiguration.json.php` returns the full MobileManager / YPTSocket configuration to any unauthenticated visitor.
Root cause: the endpoint only checks that the...
Root cause: the endpoint only checks that the...
🚨 CVE-2026-84482
WWBN AVideo through commit 9c39d8c8 contains a cross-site request forgery vulnerability in the get_domain() and isSameDomain() functions that fail to properly validate referer origins. Attackers can forge requests from sibling subdomains or unparseable long-gTLD origins to perform administrative ObjectYPT writes including live server configuration changes.
🎖@cveNotify
WWBN AVideo through commit 9c39d8c8 contains a cross-site request forgery vulnerability in the get_domain() and isSameDomain() functions that fail to properly validate referer origins. Attackers can forge requests from sibling subdomains or unparseable long-gTLD origins to perform administrative ObjectYPT writes including live server configuration changes.
🎖@cveNotify
GitHub
CSRF: broken `get_domain()` / `isSameDomain()` collapses Referer authenticity so sibling-subdomain and long-gTLD origins pass admin…
## Summary
`get_domain()` in `objects/functions.php:2539-2555` extracts a "registrable" host with the regex `(?P<domain>[a-z0-9][a-z0-9\-]{1,63}\.[a-z\.]{2,6})$`. That pattern both...
`get_domain()` in `objects/functions.php:2539-2555` extracts a "registrable" host with the regex `(?P<domain>[a-z0-9][a-z0-9\-]{1,63}\.[a-z\.]{2,6})$`. That pattern both...
🚨 CVE-2026-84483
WWBN AVideo through commit 9c39d8c8 contains an incomplete authentication bypass in encryptPass.json.php that allows unauthenticated attackers to compute valid HMAC tokens using the public site URL and current time. Attackers can forge authentication tokens by computing hash_hmac with the site's base URL as the key and submit arbitrary passwords to receive encrypted hashes, enabling offline precomputation attacks against stolen password databases.
🎖@cveNotify
WWBN AVideo through commit 9c39d8c8 contains an incomplete authentication bypass in encryptPass.json.php that allows unauthenticated attackers to compute valid HMAC tokens using the public site URL and current time. Attackers can forge authentication tokens by computing hash_hmac with the site's base URL as the key and submit arbitrary passwords to receive encrypted hashes, enabling offline precomputation attacks against stolen password databases.
🎖@cveNotify
GitHub
Incomplete fix for GHSA-px7x-gq96-rmp5: `objects/encryptPass.json.php` keys its HMAC gate with `$global['webSiteRootURL']`, so…
## Summary
This is an incomplete fix for `GHSA-px7x-gq96-rmp5`, "Unauthenticated Password Hash Oracle via encryptPass.json.php". That advisory reported that `objects/encryptPass.json.php...
This is an incomplete fix for `GHSA-px7x-gq96-rmp5`, "Unauthenticated Password Hash Oracle via encryptPass.json.php". That advisory reported that `objects/encryptPass.json.php...
🚨 CVE-2026-76193
Adobe Campaign Classic (ACC) is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.
🎖@cveNotify
Adobe Campaign Classic (ACC) is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.
🎖@cveNotify
Adobe
Adobe Security Bulletin
Security updates available for Adobe Campaign Classic | APSB26-134
🚨 CVE-2026-59322
The EmbeddedHeadersJsonMessageMapper defaults to an overly permissive header parsing posture in its constructor. When decodeNativeFormat processes raw byte payloads, it deserializes embedded JSON headers into a plain Map and constructs a GenericMessage with MutableMessageHeaders without sanitizing or filtering untrusted header names by default.
Spring Integration 7.1.0
Spring Integration 7.0.0 - 7.0.5
Spring Integration 6.5.0 - 6.5.10
Spring Integration 6.4.0 - 6.4.12
Spring Integration 5.5.21 and earlier
🎖@cveNotify
The EmbeddedHeadersJsonMessageMapper defaults to an overly permissive header parsing posture in its constructor. When decodeNativeFormat processes raw byte payloads, it deserializes embedded JSON headers into a plain Map and constructs a GenericMessage with MutableMessageHeaders without sanitizing or filtering untrusted header names by default.
Spring Integration 7.1.0
Spring Integration 7.0.0 - 7.0.5
Spring Integration 6.5.0 - 6.5.10
Spring Integration 6.4.0 - 6.4.12
Spring Integration 5.5.21 and earlier
🎖@cveNotify
EmbeddedHeadersJsonMessageMapper default gives wire peer full control of MessageHeaders
Level up your Java code and explore what Spring can do for you.
🚨 CVE-2026-59324
When an IntegrationFlow uses .fluxTransform() with an asynchronous/reordering fluxFunction that emits raw payloads, concurrent requests on the same FluxMessageChannel subscription have their reply headers (replyChannel, errorChannel, correlationId, any propagated security/tenant headers) copied from whichever message was most recently consumed upstream.
Spring Integration 7.1.0
Spring Integration 7.0.0 - 7.0.5
Spring Integration 6.5.0 - 6.5.10
Spring Integration 6.4.0 - 6.4.12
Spring Integration 5.5.21 and earlier
🎖@cveNotify
When an IntegrationFlow uses .fluxTransform() with an asynchronous/reordering fluxFunction that emits raw payloads, concurrent requests on the same FluxMessageChannel subscription have their reply headers (replyChannel, errorChannel, correlationId, any propagated security/tenant headers) copied from whichever message was most recently consumed upstream.
Spring Integration 7.1.0
Spring Integration 7.0.0 - 7.0.5
Spring Integration 6.5.0 - 6.5.10
Spring Integration 6.4.0 - 6.4.12
Spring Integration 5.5.21 and earlier
🎖@cveNotify
fluxTransform shared RequestMessageHolder causes cross-message header leakage under async fluxFunction
Level up your Java code and explore what Spring can do for you.
🚨 CVE-2026-70331
Improper neutralization of input used for llm prompting in Microsoft Edge for iOS allows an unauthorized attacker to perform spoofing over a network.
🎖@cveNotify
Improper neutralization of input used for llm prompting in Microsoft Edge for iOS allows an unauthorized attacker to perform spoofing over a network.
🎖@cveNotify
🚨 CVE-2026-72984
Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.
🎖@cveNotify
Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.
🎖@cveNotify
🚨 CVE-2026-21584
This High severity Improper Authorization vulnerability was introduced in versions 10.0.0, 10.1.0, 10.2.0, 11.0.0, 12.0.0, and 12.1.0 of Bamboo Data Center.
This Improper Authorization vulnerability, with a CVSS Score of 7.6, allows an authenticated attacker to gain unintended access and can lead to the exposure of resources or functionality, possibly providing attackers with sensitive information or even execute arbitrary code.
Atlassian recommends that Bamboo Data Center customers upgrade to latest version, if you are unable to do so, upgrade your instance to one of the specified supported fixed versions:
* Bamboo Data Center 10.2: Upgrade to a release greater than or equal to 10.2.22
* Bamboo Data Center 12.1: Upgrade to a release greater than or equal to 12.1.10
See the release notes (https://confluence.atlassian.com/bambooreleases/bamboo-release-notes-1189793869.html). You can download the latest version of Bamboo Data Center from the download center (https://www.atlassian.com/software/bamboo/download-archives).
This vulnerability was reported via our Penetration Testing program.
🎖@cveNotify
This High severity Improper Authorization vulnerability was introduced in versions 10.0.0, 10.1.0, 10.2.0, 11.0.0, 12.0.0, and 12.1.0 of Bamboo Data Center.
This Improper Authorization vulnerability, with a CVSS Score of 7.6, allows an authenticated attacker to gain unintended access and can lead to the exposure of resources or functionality, possibly providing attackers with sensitive information or even execute arbitrary code.
Atlassian recommends that Bamboo Data Center customers upgrade to latest version, if you are unable to do so, upgrade your instance to one of the specified supported fixed versions:
* Bamboo Data Center 10.2: Upgrade to a release greater than or equal to 10.2.22
* Bamboo Data Center 12.1: Upgrade to a release greater than or equal to 12.1.10
See the release notes (https://confluence.atlassian.com/bambooreleases/bamboo-release-notes-1189793869.html). You can download the latest version of Bamboo Data Center from the download center (https://www.atlassian.com/software/bamboo/download-archives).
This vulnerability was reported via our Penetration Testing program.
🎖@cveNotify
🚨 CVE-2026-14163
In affected versions of Octopus Server under certain circumstances it is possible for sensitive variables to be printed in the deployment variable snapshot in clear-text.
🎖@cveNotify
In affected versions of Octopus Server under certain circumstances it is possible for sensitive variables to be printed in the deployment variable snapshot in clear-text.
🎖@cveNotify
Octopus
Security Advisory Sa2026-07
2026-07 - Sensitive Variables exposed in Deployment Variable Snapshot JSON