🚨 CVE-2026-52775
YesWiki is a wiki system written in PHP. Prior to version 4.6.6, YesWiki through the latest development branch contains a SQL injection vulnerability in ReactionManager::deleteUserReaction() that allows any authenticated user to inject arbitrary SQL via the {idreaction} and {id} URL path parameters. The parameters are concatenated directly into a SQL LIKE clause without escaping or parameterization. This issue has been patched in version 4.6.6.
🎖@cveNotify
YesWiki is a wiki system written in PHP. Prior to version 4.6.6, YesWiki through the latest development branch contains a SQL injection vulnerability in ReactionManager::deleteUserReaction() that allows any authenticated user to inject arbitrary SQL via the {idreaction} and {id} URL path parameters. The parameters are concatenated directly into a SQL LIKE clause without escaping or parameterization. This issue has been patched in version 4.6.6.
🎖@cveNotify
GitHub
fix(bazar): GHSA-4pf7-cc4r-g63h · YesWiki/yeswiki@90ca54f
YesWiki is a wiki system written in PHP, including extensions making collaboration more simple (databases, maps, easy editing, bootstrap themes,...). - fix(bazar): GHSA-4pf7-cc4r-g63h · YesWiki/yeswiki@90ca54f
🚨 CVE-2026-52777
YesWiki is a wiki system written in PHP. Prior to version 4.6.6, there is an authenticated PHP object injection vulnerability in BazarImportAction via unserialize. This issue has been patched in version 4.6.6.
🎖@cveNotify
YesWiki is a wiki system written in PHP. Prior to version 4.6.6, there is an authenticated PHP object injection vulnerability in BazarImportAction via unserialize. This issue has been patched in version 4.6.6.
🎖@cveNotify
GitHub
fix(bazar): GHSA-9369-69wj-7m2f · YesWiki/yeswiki@8f70a8d
YesWiki is a wiki system written in PHP, including extensions making collaboration more simple (databases, maps, easy editing, bootstrap themes,...). - fix(bazar): GHSA-9369-69wj-7m2f · YesWiki/yeswiki@8f70a8d
🚨 CVE-2026-86137
In libxml2 before 2.15.4, xmlFAParsePosCharGroup has an out-of-bounds read, aka an out-of-bounds read in the NXT macro in xmlregexp.
🎖@cveNotify
In libxml2 before 2.15.4, xmlFAParsePosCharGroup has an out-of-bounds read, aka an out-of-bounds read in the NXT macro in xmlregexp.
🎖@cveNotify
GitHub
xmlregexp: Prevent out-of-bounds read in NXT macro · GNOME/libxml2@76fe08d
Fixes: https://gitlab.gnome.org/GNOME/libxml2/-/issues/1099
🚨 CVE-2026-86138
In libxml2 before 2.15.4, xmlDictAddQString in dict.c has an integer overflow and resultant heap-based buffer overflow.
🎖@cveNotify
In libxml2 before 2.15.4, xmlDictAddQString in dict.c has an integer overflow and resultant heap-based buffer overflow.
🎖@cveNotify
GitHub
fix: add overflow checks to xmlDictAddQString in dict.c · GNOME/libxml2@a4cba4b
xmlDictAddString has overflow guards for pool size calculations, but its
sibling xmlDictAddQString lacks these entirely. The namelen + plen + 1
addition can overflow unsigned int, and 4 * (overflow...
sibling xmlDictAddQString lacks these entirely. The namelen + plen + 1
addition can overflow unsigned int, and 4 * (overflow...
🚨 CVE-2026-86139
In libxml2 before 2.15.4, xmlURIEscapeStr in uri.c has an integer overflow.
🎖@cveNotify
In libxml2 before 2.15.4, xmlURIEscapeStr in uri.c has an integer overflow.
🎖@cveNotify
GitHub
fix: add length check to xmlURIEscapeStr in uri.c · GNOME/libxml2@8edbbdb
Commit 538b2e38 fixed xmlBuildRelativeURISafe for the pattern where
xmlStrlen() returns 0 for strings longer than INT_MAX, but
xmlURIEscapeStr was not fixed. Without the check, len = 0 + 20, and
th...
xmlStrlen() returns 0 for strings longer than INT_MAX, but
xmlURIEscapeStr was not fixed. Without the check, len = 0 + 20, and
th...
🚨 CVE-2026-86140
In libxml2 before 2.15.4, xmlSnprintfElements in valid.c has a strcat stack-based buffer overflow.
🎖@cveNotify
In libxml2 before 2.15.4, xmlSnprintfElements in valid.c has a strcat stack-based buffer overflow.
🎖@cveNotify
GitHub
fix: add bounds checks to xmlSnprintfElements in valid.c · GNOME/libxml2@d1686f9
CVE-2025-24928 fixed xmlSnprintfElementContent for unchecked strcat()
writes, but the sibling function xmlSnprintfElements has the identical
unfixed pattern. The strcat(buf, "(") ...
writes, but the sibling function xmlSnprintfElements has the identical
unfixed pattern. The strcat(buf, "(") ...
🚨 CVE-2026-86141
xmlregexp in libxml2 before 2.15.4 has a NULL pointer dereference in xmlRegNewParserCtxt after a strdup failure, i.e., it does not calculate a string length after NULL checking.
🎖@cveNotify
xmlregexp in libxml2 before 2.15.4 has a NULL pointer dereference in xmlRegNewParserCtxt after a strdup failure, i.e., it does not calculate a string length after NULL checking.
🎖@cveNotify
GitHub
xmlregexp: Calc string length after null checking · GNOME/libxml2@e89a8aa
Fix https://gitlab.gnome.org/GNOME/libxml2/-/work_items/1107
🚨 CVE-2026-86142
In libxml2 before 2.15.4, there is a heap-based buffer overflow in xmlXPtrEvalXPtrPart because of xmlXPtrEval xpointer length saturation.
🎖@cveNotify
In libxml2 before 2.15.4, there is a heap-based buffer overflow in xmlXPtrEvalXPtrPart because of xmlXPtrEval xpointer length saturation.
🎖@cveNotify
GitHub
xpointer: Check overflow in xmlXPtrEvalXPtrPart · GNOME/libxml2@6b3a736
Fix https://gitlab.gnome.org/GNOME/libxml2/-/work_items/1113
🚨 CVE-2026-86143
In xmlIO in libxml2 before 2.15.4, an inconsistency in xmlOutputWriteCallback and xmlBufUse causes negative lengths to reach write callbacks, aka a lack of a check for integer overflow before calling writecallback. This has security relevance for many types of uses of that length value within a callback.
🎖@cveNotify
In xmlIO in libxml2 before 2.15.4, an inconsistency in xmlOutputWriteCallback and xmlBufUse causes negative lengths to reach write callbacks, aka a lack of a check for integer overflow before calling writecallback. This has security relevance for many types of uses of that length value within a callback.
🎖@cveNotify
GitHub
xmlIO: Check for int overflow before calling writecallback · GNOME/libxml2@90f293b
Fix https://gitlab.gnome.org/GNOME/libxml2/-/work_items/1111
🚨 CVE-2026-86144
In xinclude in libxml2 before 2.15.4, xmlXIncludeProcess and xmlXIncludeProcessTree do not propagate parseFlags. This has security relevance for, for example, the XML_PARSE_NONET flag, if (without it) a custom resource loader accesses the internet and triggers XML external entity injection, SSRF, or a denial of service (e.g., for an attacker-controlled internet resource that is intentionally slow).
🎖@cveNotify
In xinclude in libxml2 before 2.15.4, xmlXIncludeProcess and xmlXIncludeProcessTree do not propagate parseFlags. This has security relevance for, for example, the XML_PARSE_NONET flag, if (without it) a custom resource loader accesses the internet and triggers XML external entity injection, SSRF, or a denial of service (e.g., for an attacker-controlled internet resource that is intentionally slow).
🎖@cveNotify
GitHub
fix(xinclude): propagate parseFlags in xmlXIncludeProcess and xmlXInc… · GNOME/libxml2@b63cd51
…ludeProcessTree
🚨 CVE-2026-48707
InstantCMS is a free and open source content management system. Versions prior to 2.18.2 have a Server-Side Request Forgery (SSRF) vulnerability in the file upload functionality (`system/core/uploader.php` at lines 509-532). When the "upload from URL" feature follows an HTTP redirect, the redirected target URL bypasses the private IP address blacklist check. This allows authenticated users to scan and access internal network services. Version 2.18.2 contains a fix.
🎖@cveNotify
InstantCMS is a free and open source content management system. Versions prior to 2.18.2 have a Server-Side Request Forgery (SSRF) vulnerability in the file upload functionality (`system/core/uploader.php` at lines 509-532). When the "upload from URL" feature follows an HTTP redirect, the redirected target URL bypasses the private IP address blacklist check. This allows authenticated users to scan and access internal network services. Version 2.18.2 contains a fix.
🎖@cveNotify
GitHub
Fix SSRF redirect/DNS rebinding · instantsoft/icms2@04b8fe0
Self-hosted Site Management System. Contribute to instantsoft/icms2 development by creating an account on GitHub.
🚨 CVE-2026-54611
InstantCMS is a free and open source content management system. Versions prior to 2.18.2 have a Remote Code Execution (RCE) issue that allows remote authenticated attackers to execute any PHP code via the component installer. It is possible to upload a malicious component into the server, however, it won't be installed, but upload files will be executed. Normally all php files in upload folder are not executed, however, by uploading custom .htaccess it becomes possible. Version 2.18.2 contains a fix.
🎖@cveNotify
InstantCMS is a free and open source content management system. Versions prior to 2.18.2 have a Remote Code Execution (RCE) issue that allows remote authenticated attackers to execute any PHP code via the component installer. It is possible to upload a malicious component into the server, however, it won't be installed, but upload files will be executed. Normally all php files in upload folder are not executed, however, by uploading custom .htaccess it becomes possible. Version 2.18.2 contains a fix.
🎖@cveNotify
GitHub
Установка дополнений через временную директорию; отсутствует возможно… · instantsoft/icms2@44f3a9d
…сть доступа к распакованным файлам по URL; защита от Zip Slip; проверка и запрет символических ссылок (symlink) в ZIP-архивах; защита от Zip Bomb (лимит количества файлов, размера архива и размера...
🚨 CVE-2026-57098
Improper verification of cryptographic signature in Windows RDP Client allows an unauthorized attacker to disclose information over a network.
🎖@cveNotify
Improper verification of cryptographic signature in Windows RDP Client allows an unauthorized attacker to disclose information over a network.
🎖@cveNotify
🚨 CVE-2026-57099
Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.
🎖@cveNotify
Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.
🎖@cveNotify
🚨 CVE-2026-62762
Null pointer dereference in Active Directory Domain Services allows an authorized attacker to deny service over a network.
🎖@cveNotify
Null pointer dereference in Active Directory Domain Services allows an authorized attacker to deny service over a network.
🎖@cveNotify
🚨 CVE-2026-67376
Integer overflow or wraparound in SQL Server allows an unauthorized attacker to deny service over a network.
🎖@cveNotify
Integer overflow or wraparound in SQL Server allows an unauthorized attacker to deny service over a network.
🎖@cveNotify
🚨 CVE-2026-67383
Generation of error message containing sensitive information in SQL Server allows an authorized attacker to disclose information over a network.
🎖@cveNotify
Generation of error message containing sensitive information in SQL Server allows an authorized attacker to disclose information over a network.
🎖@cveNotify
🚨 CVE-2026-67386
Use of uninitialized resource in SQL Server allows an authorized attacker to disclose information over a network.
🎖@cveNotify
Use of uninitialized resource in SQL Server allows an authorized attacker to disclose information over a network.
🎖@cveNotify
🚨 CVE-2026-67389
Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a network.
🎖@cveNotify
Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a network.
🎖@cveNotify
🚨 CVE-2026-67629
Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a network.
🎖@cveNotify
Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a network.
🎖@cveNotify
🚨 CVE-2026-67630
Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a network.
🎖@cveNotify
Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a network.
🎖@cveNotify