🚨 CVE-2026-73524
Cypht before 2.12.2 contains a cross-site scripting vulnerability in the contacts module that allows remote attackers to execute arbitrary script content by embedding malicious payloads within angle brackets in the FROM email header. The sanitization logic removes only the first occurrence of each angle bracket character, leaving additional angle brackets intact, which attackers exploit by delivering a crafted email whose FROM header executes script in the victim's browser when the user opens the message and accesses the Add Local Contacts function.
🎖@cveNotify
Cypht before 2.12.2 contains a cross-site scripting vulnerability in the contacts module that allows remote attackers to execute arbitrary script content by embedding malicious payloads within angle brackets in the FROM email header. The sanitization logic removes only the first occurrence of each angle bracket character, leaving additional angle brackets intact, which attackers exploit by delivering a crafted email whose FROM header executes script in the victim's browser when the user opens the message and accesses the Add Local Contacts function.
🎖@cveNotify
GitHub
Merge pull request #2072 from IrAlfred/fix-stored-xss-from-header · cypht-org/cypht@3723437
fix(module/contacts): escape From header values in add-contact popup
🚨 CVE-2023-54391
Proxmox Virtual Environment (VE) 7.0 through 8.0 contains an authentication bypass vulnerability in libpve-access-control before 8.0.4 that allows unauthenticated attackers to authenticate as any existing enabled user without a configured second factor by supplying an arbitrary tfa-challenge value in the API login endpoint. Attackers can send a POST request to the access ticket API endpoint with any value in the tfa-challenge parameter to completely skip password verification, gaining unauthorized access including to the root@pam account. All affected releases are end of life.
🎖@cveNotify
Proxmox Virtual Environment (VE) 7.0 through 8.0 contains an authentication bypass vulnerability in libpve-access-control before 8.0.4 that allows unauthenticated attackers to authenticate as any existing enabled user without a configured second factor by supplying an arbitrary tfa-challenge value in the API login endpoint. Attackers can send a POST request to the access ticket API endpoint with any value in the tfa-challenge parameter to completely skip password verification, gaining unauthorized access including to the root@pam account. All affected releases are end of life.
🎖@cveNotify
Proxmox Support Forum
Proxmox Virtual Environment - Security Advisories
Subject: PSA-2026-00037-1: SCTPhantom Local Privilege Escalation issue
Advisory date: 2026-08-10
Packages: proxmox-kernel-*
Details:
A use-after-free issue in the Linux kernels SCTP code...
Advisory date: 2026-08-10
Packages: proxmox-kernel-*
Details:
A use-after-free issue in the Linux kernels SCTP code...
🚨 CVE-2026-84208
AVideo through version 29.0 contains an unauthenticated SQL injection vulnerability in the User_Location plugin's regions.json.php and cities.json.php endpoints. The country and region GET parameters are passed directly into SQL queries without escaping or prepared statement binding, allowing unauthenticated attackers to execute UNION-based SQL injection to read arbitrary database contents including password hashes and sensitive data.
🎖@cveNotify
AVideo through version 29.0 contains an unauthenticated SQL injection vulnerability in the User_Location plugin's regions.json.php and cities.json.php endpoints. The country and region GET parameters are passed directly into SQL queries without escaping or prepared statement binding, allowing unauthenticated attackers to execute UNION-based SQL injection to read arbitrary database contents including password hashes and sensitive data.
🎖@cveNotify
GitHub
Unauthenticated SQL Injection in User_Location Plugin
### Summary
`plugin/User_Location/regions.json.php` and `cities.json.php` pass the `country` and `region` GET parameters directly into SQL queries with no escaping, no binding, and no authentica...
`plugin/User_Location/regions.json.php` and `cities.json.php` pass the `country` and `region` GET parameters directly into SQL queries with no escaping, no binding, and no authentica...
🚨 CVE-2026-84476
WWBN AVideo fails to validate trusted proxies before accepting X-Real-IP and X-Forwarded-For headers, allowing attackers to spoof the client address used by enforceRateLimit(). Attackers can rotate the header value per request to bypass login rate limiting and perform unlimited credential guessing attacks.
🎖@cveNotify
WWBN AVideo fails to validate trusted proxies before accepting X-Real-IP and X-Forwarded-For headers, allowing attackers to spoof the client address used by enforceRateLimit(). Attackers can rotate the header value per request to bypass login rate limiting and perform unlimited credential guessing attacks.
🎖@cveNotify
GitHub
Client-supplied X-Real-IP / X-Forwarded-For is trusted without any trusted-proxy check, letting a caller choose the address en…
### Summary
`getRealIpAddr()` accepts the client's own `X-Real-IP` or `X-Forwarded-For` header whenever `REMOTE_ADDR` merely looks private:
```php
// objects/functions.php:220
function ...
`getRealIpAddr()` accepts the client's own `X-Real-IP` or `X-Forwarded-For` header whenever `REMOTE_ADDR` merely looks private:
```php
// objects/functions.php:220
function ...
🚨 CVE-2026-84477
AVideo Live_schedule::setTitle() and setDescription() store POST input without sanitization, allowing users with streaming permission to inject malicious scripts. Unauthenticated attackers can access remindMe.php to execute stored XSS payloads in victim browsers without requiring authentication.
🎖@cveNotify
AVideo Live_schedule::setTitle() and setDescription() store POST input without sanitization, allowing users with streaming permission to inject malicious scripts. Unauthenticated attackers can access remindMe.php to execute stored XSS payloads in victim browsers without requiring authentication.
🎖@cveNotify
GitHub
Stored XSS in live-schedule title and description: Live_schedule::setTitle() and setDescription() store $_POST verbatim, and p…
### Summary
`Live_schedule::setTitle()` and `setDescription()` store their input exactly as received:
```php
// plugin/Live/Objects/Live_schedule.php:268
public function setTitle($title)
{...
`Live_schedule::setTitle()` and `setDescription()` store their input exactly as received:
```php
// plugin/Live/Objects/Live_schedule.php:268
public function setTitle($title)
{...
🚨 CVE-2026-84478
WWBN AVideo contains a path traversal vulnerability in the API get_api_login_code endpoint that allows unauthenticated attackers to delete arbitrary .log files by supplying directory traversal sequences in the code parameter. Attackers can exploit this to destroy audit logs and probe for file existence on the server, with the vulnerability enabling both file deletion and information disclosure about the filesystem.
🎖@cveNotify
WWBN AVideo contains a path traversal vulnerability in the API get_api_login_code endpoint that allows unauthenticated attackers to delete arbitrary .log files by supplying directory traversal sequences in the code parameter. Attackers can exploit this to destroy audit logs and probe for file existence on the server, with the vulnerability enabling both file deletion and information disclosure about the filesystem.
🎖@cveNotify
GitHub
Unauthenticated arbitrary .log file deletion and file-existence disclosure in API::get_api_login_code(): the code parameter reaches…
### Summary
`API::get_api_login_code()` builds a filesystem path from the caller's `code` parameter with no validation, and deletes whatever it finds there before checking that the file is a...
`API::get_api_login_code()` builds a filesystem path from the caller's `code` parameter with no validation, and deletes whatever it finds there before checking that the file is a...
🚨 CVE-2026-84479
WWBN AVideo (current e01e41ecc and earlier) makes three login-time security controls depend solely on the client-supplied User-Agent header. The isAVideoEncoder()/isAVideoMobileApp() checks match HTTP_USER_AGENT against a hardcoded literal ("AVideoEncoder"/"AVideoMobileApp") with no IP check or shared secret. An attacker who submits valid credentials and sets User-Agent: AVideoEncoder bypasses two-factor authentication, skips brute-force captcha escalation, and avoids being recorded in the login/device audit history. No patch is available at the time of publication.
🎖@cveNotify
WWBN AVideo (current e01e41ecc and earlier) makes three login-time security controls depend solely on the client-supplied User-Agent header. The isAVideoEncoder()/isAVideoMobileApp() checks match HTTP_USER_AGENT against a hardcoded literal ("AVideoEncoder"/"AVideoMobileApp") with no IP check or shared secret. An attacker who submits valid credentials and sets User-Agent: AVideoEncoder bypasses two-factor authentication, skips brute-force captcha escalation, and avoids being recorded in the login/device audit history. No patch is available at the time of publication.
🎖@cveNotify
GitHub
2FA, brute-force captcha and login audit logging are all disabled by sending User-Agent: AVideoEncoder
### Summary
Three login-time security controls are switched off by the caller's `User-Agent` header:
- the brute-force captcha escalation in `User::login()` (`objects/user.php:1285`)
- t...
Three login-time security controls are switched off by the caller's `User-Agent` header:
- the brute-force captcha escalation in `User::login()` (`objects/user.php:1285`)
- t...
🚨 CVE-2026-84480
WWBN AVideo fails to validate password recovery token expiration in userRecoverPassSave.json.php, allowing attackers to use expired tokens to reset account passwords indefinitely. Attackers who obtain a recovery token can use it at any time to change the target account's password and gain full account access.
🎖@cveNotify
WWBN AVideo fails to validate password recovery token expiration in userRecoverPassSave.json.php, allowing attackers to use expired tokens to reset account passwords indefinitely. Attackers who obtain a recovery token can use it at any time to change the target account's password and gain full account access.
🎖@cveNotify
GitHub
Password recovery tokens never expire: userRecoverPassSave.json.php skips the validity check, allowing account takeover with an…
### Summary
`objects/userRecoverPassSave.json.php` accepts a password-recovery token by comparing it directly to the stored value:
```php
} elseif ($user->getRecoverPass() !== $_POST['...
`objects/userRecoverPassSave.json.php` accepts a password-recovery token by comparing it directly to the stored value:
```php
} elseif ($user->getRecoverPass() !== $_POST['...
🚨 CVE-2026-84481
WWBN AVideo through 30.0 contains an information disclosure vulnerability in the MobileManager plugin getConfiguration endpoint that returns sensitive configuration data to unauthenticated visitors. Attackers can send an unauthenticated GET request to plugin/MobileManager/getConfiguration.json.php to obtain TLS private key file paths, socket configuration details, platform version, and debug flags enabling further targeted attacks.
🎖@cveNotify
WWBN AVideo through 30.0 contains an information disclosure vulnerability in the MobileManager plugin getConfiguration endpoint that returns sensitive configuration data to unauthenticated visitors. Attackers can send an unauthenticated GET request to plugin/MobileManager/getConfiguration.json.php to obtain TLS private key file paths, socket configuration details, platform version, and debug flags enabling further targeted attacks.
🎖@cveNotify
GitHub
Unauthenticated MobileManager configuration disclosure exposes TLS key paths and socket config
WWBN/AVideo: `plugin/MobileManager/getConfiguration.json.php` returns the full MobileManager / YPTSocket configuration to any unauthenticated visitor.
Root cause: the endpoint only checks that the...
Root cause: the endpoint only checks that the...
🚨 CVE-2026-84482
WWBN AVideo through commit 9c39d8c8 contains a cross-site request forgery vulnerability in the get_domain() and isSameDomain() functions that fail to properly validate referer origins. Attackers can forge requests from sibling subdomains or unparseable long-gTLD origins to perform administrative ObjectYPT writes including live server configuration changes.
🎖@cveNotify
WWBN AVideo through commit 9c39d8c8 contains a cross-site request forgery vulnerability in the get_domain() and isSameDomain() functions that fail to properly validate referer origins. Attackers can forge requests from sibling subdomains or unparseable long-gTLD origins to perform administrative ObjectYPT writes including live server configuration changes.
🎖@cveNotify
GitHub
CSRF: broken `get_domain()` / `isSameDomain()` collapses Referer authenticity so sibling-subdomain and long-gTLD origins pass admin…
## Summary
`get_domain()` in `objects/functions.php:2539-2555` extracts a "registrable" host with the regex `(?P<domain>[a-z0-9][a-z0-9\-]{1,63}\.[a-z\.]{2,6})$`. That pattern both...
`get_domain()` in `objects/functions.php:2539-2555` extracts a "registrable" host with the regex `(?P<domain>[a-z0-9][a-z0-9\-]{1,63}\.[a-z\.]{2,6})$`. That pattern both...
🚨 CVE-2026-84483
WWBN AVideo through commit 9c39d8c8 contains an incomplete authentication bypass in encryptPass.json.php that allows unauthenticated attackers to compute valid HMAC tokens using the public site URL and current time. Attackers can forge authentication tokens by computing hash_hmac with the site's base URL as the key and submit arbitrary passwords to receive encrypted hashes, enabling offline precomputation attacks against stolen password databases.
🎖@cveNotify
WWBN AVideo through commit 9c39d8c8 contains an incomplete authentication bypass in encryptPass.json.php that allows unauthenticated attackers to compute valid HMAC tokens using the public site URL and current time. Attackers can forge authentication tokens by computing hash_hmac with the site's base URL as the key and submit arbitrary passwords to receive encrypted hashes, enabling offline precomputation attacks against stolen password databases.
🎖@cveNotify
GitHub
Incomplete fix for GHSA-px7x-gq96-rmp5: `objects/encryptPass.json.php` keys its HMAC gate with `$global['webSiteRootURL']`, so…
## Summary
This is an incomplete fix for `GHSA-px7x-gq96-rmp5`, "Unauthenticated Password Hash Oracle via encryptPass.json.php". That advisory reported that `objects/encryptPass.json.php...
This is an incomplete fix for `GHSA-px7x-gq96-rmp5`, "Unauthenticated Password Hash Oracle via encryptPass.json.php". That advisory reported that `objects/encryptPass.json.php...
🚨 CVE-2026-84695
BookStack before 26.05.4 contains a stored cross-site scripting vulnerability in the drawing upload endpoint that accepts unvalidated base64 content and stores it without content inspection. Attackers with editor permissions can upload SVG files containing scripts that execute in administrator browsers when accessed through the image gallery API without content-type validation or CSP headers.
🎖@cveNotify
BookStack before 26.05.4 contains a stored cross-site scripting vulnerability in the drawing upload endpoint that accepts unvalidated base64 content and stores it without content inspection. Attackers with editor permissions can upload SVG files containing scripts that execute in administrator browsers when accessed through the image gallery API without content-type validation or CSP headers.
🎖@cveNotify
GitHub
GitHub - BookStackApp/BookStack: NOW MANAGED ON CODEBERG
NOW MANAGED ON CODEBERG. Contribute to BookStackApp/BookStack development by creating an account on GitHub.
🚨 CVE-2024-35585
Oxford Nanopore MinKNOW before 24.06 relies on a client's source IP address for authentication.
🎖@cveNotify
Oxford Nanopore MinKNOW before 24.06 relies on a client's source IP address for authentication.
🎖@cveNotify
🚨 CVE-2025-46418
Westermo WeOS 5.x starting from 5.24 allows OS command injection via a media definition.
🎖@cveNotify
Westermo WeOS 5.x starting from 5.24 allows OS command injection via a media definition.
🎖@cveNotify
🚨 CVE-2026-75136
UpSignOn for Windows before 7.19.0 contains an insecure credential storage vulnerability that allows local attackers to retrieve the biometric unlock key stored in the Windows PasswordVault API without triggering any authentication prompt. Attackers can access the stored biometric key from a standard local process within the same Windows session to decrypt the protected vault files and export the entire password manager contents in cleartext.
🎖@cveNotify
UpSignOn for Windows before 7.19.0 contains an insecure credential storage vulnerability that allows local attackers to retrieve the biometric unlock key stored in the Windows PasswordVault API without triggering any authentication prompt. Attackers can access the stored biometric key from a standard local process within the same Windows session to decrypt the protected vault files and export the entire password manager contents in cleartext.
🎖@cveNotify
upsignon.eu
Notes de version
Notes de version détaillées des différents composants d'UpSignOn (application, extension de navigateur, serveur PRO, console de supervision PRO).
🚨 CVE-2026-75137
UpSignOn for Windows before 7.19.0 contains a sensitive data exposure vulnerability that allows local attackers to recover cleartext vault data from process memory even after the application has been locked. Attackers can use the PROCESS_VM_READ permission to read the memory space of UpSignOn.exe and extract sensitive fields including entry names, URLs, usernames, passwords, TOTP secrets, and notes.
🎖@cveNotify
UpSignOn for Windows before 7.19.0 contains a sensitive data exposure vulnerability that allows local attackers to recover cleartext vault data from process memory even after the application has been locked. Attackers can use the PROCESS_VM_READ permission to read the memory space of UpSignOn.exe and extract sensitive fields including entry names, URLs, usernames, passwords, TOTP secrets, and notes.
🎖@cveNotify
upsignon.eu
Notes de version
Notes de version détaillées des différents composants d'UpSignOn (application, extension de navigateur, serveur PRO, console de supervision PRO).
🚨 CVE-2026-85089
FreeRDP versions 3.0.0 through 3.30.0 (before 3.31.0) transmit uninitialized heap memory in Save Session Info PDU reserved padding fields. Three PDU writers in libfreerdp/core/info.c (rdp_write_logon_info_v2, rdp_write_logon_info_plain, and rdp_write_logon_info_ex) use Stream_Seek instead of Stream_Zero for reserved pad bytes (up to 576 bytes), leaving previously freed heap contents in the outgoing PDU. Because the send buffer is allocated with malloc (not zeroed), stale heap data — which may include cleartext credentials from prior sessions — can be sent to the receiving peer. FreeRDP-based servers using rdpUpdate::SaveSessionInfo and freerdp-proxy (which forwards these PDUs) are affected, allowing disclosure of server/proxy process memory to a downstream client.
🎖@cveNotify
FreeRDP versions 3.0.0 through 3.30.0 (before 3.31.0) transmit uninitialized heap memory in Save Session Info PDU reserved padding fields. Three PDU writers in libfreerdp/core/info.c (rdp_write_logon_info_v2, rdp_write_logon_info_plain, and rdp_write_logon_info_ex) use Stream_Seek instead of Stream_Zero for reserved pad bytes (up to 576 bytes), leaving previously freed heap contents in the outgoing PDU. Because the send buffer is allocated with malloc (not zeroed), stale heap data — which may include cleartext credentials from prior sessions — can be sent to the receiving peer. FreeRDP-based servers using rdpUpdate::SaveSessionInfo and freerdp-proxy (which forwards these PDUs) are affected, allowing disclosure of server/proxy process memory to a downstream client.
🎖@cveNotify
GitHub
GitHub - FreeRDP/FreeRDP: FreeRDP is a free remote desktop protocol library and clients
FreeRDP is a free remote desktop protocol library and clients - FreeRDP/FreeRDP
🚨 CVE-2026-85090
FreeRDP before 3.31.0 contains a heap out-of-bounds read vulnerability in the general_ChromaV1ToYUV444 function during AVC444 chroma plane reconstruction. A malicious RDP server can craft a RFX_AVC444_BITMAP_STREAM with specific frame geometry to trigger an out-of-bounds memory read past the allocated luma plane.
🎖@cveNotify
FreeRDP before 3.31.0 contains a heap out-of-bounds read vulnerability in the general_ChromaV1ToYUV444 function during AVC444 chroma plane reconstruction. A malicious RDP server can craft a RFX_AVC444_BITMAP_STREAM with specific frame geometry to trigger an out-of-bounds memory read past the allocated luma plane.
🎖@cveNotify
GitHub
GitHub - FreeRDP/FreeRDP: FreeRDP is a free remote desktop protocol library and clients
FreeRDP is a free remote desktop protocol library and clients - FreeRDP/FreeRDP
🚨 CVE-2026-85154
WWBN AVideo contains an authentication failure vulnerability where the video_id_hash credential is a non-expiring, non-revocable bearer token that grants full administrator session access to the video owner's account. Attackers who obtain a video_id_hash can replay it indefinitely to authenticate as the video owner with full privileges, and the credential remains valid even after the owner changes their password.
🎖@cveNotify
WWBN AVideo contains an authentication failure vulnerability where the video_id_hash credential is a non-expiring, non-revocable bearer token that grants full administrator session access to the video owner's account. Attackers who obtain a video_id_hash can replay it indefinitely to authenticate as the video owner with full privileges, and the credential remains valid even after the owner changes their password.
🎖@cveNotify
GitHub
Identification and Authentication Failure: the encoder video_id_hash is a non-expiring, non-revocable bearer credential that is…
### Summary
`video_id_hash` is documented as proof that an encoder is authorised to touch one specific video. It is in fact a bearer credential that is exchanged for a **full logged-in session a...
`video_id_hash` is documented as proof that an encoder is authorised to touch one specific video. It is in fact a bearer credential that is exchanged for a **full logged-in session a...
🚨 CVE-2026-85155
WWBN AVideo contains a SQL injection vulnerability in the sort column parameter of the get.json.php endpoint with APIName=channels that allows unauthenticated attackers to order results by arbitrary database columns including users.password and users.recoverPass. Attackers can exploit this ordering oracle to infer password hash values and recovery tokens, and trigger SQL errors that disclose the full query statement and database schema.
🎖@cveNotify
WWBN AVideo contains a SQL injection vulnerability in the sort column parameter of the get.json.php endpoint with APIName=channels that allows unauthenticated attackers to order results by arbitrary database columns including users.password and users.recoverPass. Attackers can exploit this ordering oracle to infer password hash values and recovery tokens, and trigger SQL errors that disclose the full query statement and database schema.
🎖@cveNotify
GitHub
SQL Injection (ORDER BY identifier) in get.json.php?APIName=channels: an unauthenticated caller selects the sort column, yielding…
### Summary
`/plugin/API/get.json.php?APIName=channels` lets an unauthenticated caller choose the column the query is sorted by. The column name is taken from the request and reaches `ORDER BY` ...
`/plugin/API/get.json.php?APIName=channels` lets an unauthenticated caller choose the column the query is sorted by. The column name is taken from the request and reaches `ORDER BY` ...
🚨 CVE-2026-85156
WWBN AVideo fails to properly validate access controls on the public channel page, allowing unauthenticated visitors to view unlisted and group-restricted videos through hardcoded visibility flags and an undefined property. Attackers can access the channel endpoint to retrieve sensitive video content that should be hidden, including full URLs to unlisted videos and thumbnails of member-only content, regardless of the operator's hidePrivateVideos setting.
🎖@cveNotify
WWBN AVideo fails to properly validate access controls on the public channel page, allowing unauthenticated visitors to view unlisted and group-restricted videos through hardcoded visibility flags and an undefined property. Attackers can access the channel endpoint to retrieve sensitive video content that should be hidden, including full URLs to unlisted videos and thumbnails of member-only content, regardless of the operator's hidePrivateVideos setting.
🎖@cveNotify
GitHub
Broken Access Control: public channel page returns unlisted and group-restricted videos to unauthenticated visitors, and an unset…
### Summary
The public channel page (`/channel/<name>`) discloses unlisted and group-restricted videos to anonymous visitors, and it does so even when the operator has switched the "h...
The public channel page (`/channel/<name>`) discloses unlisted and group-restricted videos to anonymous visitors, and it does so even when the operator has switched the "h...