π¨ CVE-2026-93340
Gladys Assistant before 5.1.0 contains a password reset link poisoning vulnerability that allows unauthenticated remote attackers to obtain valid password reset tokens for any account by exploiting the client-supplied origin parameter in the forgot_password endpoint without server-side validation. Attackers can send a crafted request specifying an attacker-controlled origin, causing the victim to receive a poisoned reset link that discloses the session token to the attacker, enabling full account takeover including administrator accounts.
π@cveNotify
Gladys Assistant before 5.1.0 contains a password reset link poisoning vulnerability that allows unauthenticated remote attackers to obtain valid password reset tokens for any account by exploiting the client-supplied origin parameter in the forgot_password endpoint without server-side validation. Attackers can send a crafted request specifying an attacker-controlled origin, causing the victim to receive a poisoned reset link that discloses the session token to the attacker, enabling full account takeover including administrator accounts.
π@cveNotify
GitHub
Release v5.1.0 Β· GladysAssistant/Gladys
What's Changed
Publish each release to Gladys Plus from the release workflow by @Pierre-Gilles in #3091
docs: recommend linking the forum topic or GitHub issue in pull requests by @Pierre-Gill...
Publish each release to Gladys Plus from the release workflow by @Pierre-Gilles in #3091
docs: recommend linking the forum topic or GitHub issue in pull requests by @Pierre-Gill...
π¨ CVE-2026-94536
lamp-cloud through 5.10.0 fails to validate the employeeId parameter in the /anyone/visible/resource endpoint, allowing authenticated users to read any employee's roles and permissions. Attackers can supply arbitrary employeeId values to enumerate other employees' role codes, permission codes, and complete front-end router trees without authorization checks.
π@cveNotify
lamp-cloud through 5.10.0 fails to validate the employeeId parameter in the /anyone/visible/resource endpoint, allowing authenticated users to read any employee's roles and permissions. Attackers can supply arbitrary employeeId values to enumerate other employees' role codes, permission codes, and complete front-end router trees without authorization checks.
π@cveNotify
GitHub
cve-request-poc/lamp/poc-05-anyone-visible-resource-bola.py at master Β· LinYuanyi1/cve-request-poc
poc repo. Contribute to LinYuanyi1/cve-request-poc development by creating an account on GitHub.
π¨ CVE-2026-93342
MarketKing plugin for WordPress before 2.1.72 contains a missing authorization vulnerability in the marketking_duplicate_product AJAX action that allows authenticated attackers with subscriber-level access or higher to duplicate any vendor's product by supplying an arbitrary product ID. Attackers can bypass ownership verification to copy any vendor's product listings, including private product metadata, and assign the duplicated copy to their own vendor account without the victim's knowledge or consent.
π@cveNotify
MarketKing plugin for WordPress before 2.1.72 contains a missing authorization vulnerability in the marketking_duplicate_product AJAX action that allows authenticated attackers with subscriber-level access or higher to duplicate any vendor's product by supplying an arbitrary product ID. Attackers can bypass ownership verification to copy any vendor's product listings, including private product metadata, and assign the duplicated copy to their own vendor account without the victim's knowledge or consent.
π@cveNotify
MarketKing
Changelog - MarketKing
π¨ CVE-2026-80145
Lantronix SLC8000 before firmware v9.7.0.2, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmware versions of SLB882/SLCx-03/SLCx-02 contain a command injection vulnerability that allows authenticated attackers with the services permission to execute arbitrary shell commands as root by exploiting the set cifs password command that passes unsanitized user input to a system() call. Attackers with the services permission can authenticate to the terminal or CLI interface and inject malicious commands through the unsanitized parameter to achieve complete loss of confidentiality, integrity, and availability on the affected device and potentially impact downstream serial-attached devices.
π@cveNotify
Lantronix SLC8000 before firmware v9.7.0.2, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmware versions of SLB882/SLCx-03/SLCx-02 contain a command injection vulnerability that allows authenticated attackers with the services permission to execute arbitrary shell commands as root by exploiting the set cifs password command that passes unsanitized user input to a system() call. Attackers with the services permission can authenticate to the terminal or CLI interface and inject malicious commands through the unsanitized parameter to achieve complete loss of confidentiality, integrity, and availability on the affected device and potentially impact downstream serial-attached devices.
π@cveNotify
RE/VRb LLC
REVRB-LANTERN: Security Research on Lantronix Autonomous Out-of-Band Devices
RE/VRb LLC conducts independent research to improve cyber infrastructure security. The following report details research conducted without contract or bounty, representing over four months of discovery and coordination by a single researcher. You can supportβ¦
π¨ CVE-2026-80150
Lantronix SLC8000 before firmware v9.7.0.3, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmware versions of SLB882 contain a server-side request forgery vulnerability in the WebSSH/WebTelnet listener that allows unauthenticated attackers to cause the affected device to establish Telnet connections to attacker-controlled endpoints. The custom shellinaboxd uses the rooturl parameter from the web connection to determine its own IP address; by modifying this parameter an attacker redirects the Telnet terminal connection to an arbitrary host or IP. Attackers can use this capability to enumerate or communicate with internal network endpoints that would otherwise be inaccessible.
π@cveNotify
Lantronix SLC8000 before firmware v9.7.0.3, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmware versions of SLB882 contain a server-side request forgery vulnerability in the WebSSH/WebTelnet listener that allows unauthenticated attackers to cause the affected device to establish Telnet connections to attacker-controlled endpoints. The custom shellinaboxd uses the rooturl parameter from the web connection to determine its own IP address; by modifying this parameter an attacker redirects the Telnet terminal connection to an arbitrary host or IP. Attackers can use this capability to enumerate or communicate with internal network endpoints that would otherwise be inaccessible.
π@cveNotify
RE/VRb LLC
REVRB-LANTERN: Security Research on Lantronix Autonomous Out-of-Band Devices
RE/VRb LLC conducts independent research to improve cyber infrastructure security. The following report details research conducted without contract or bounty, representing over four months of discovery and coordination by a single researcher. You can supportβ¦
π¨ CVE-2026-80156
Lantronix SLC8000 before firmware v9.7.0.5, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmware versions of SLB882/SLCx-03/SLCx-02 contain a path traversal vulnerability in the web management portal upload endpoint that allows authenticated attackers to write arbitrary data to any location on the device's filesystem, leading to remote code execution. The upload filename validation strips backslash characters but does not subsequently check for forward slashes when a backslash is detected; by supplying a filename containing both characters an attacker writes outside the intended upload directory to any writable path. Attackers can use this vulnerability to achieve complete loss of confidentiality, integrity, and availability on the affected device and potentially impact downstream serial-connected devices.
π@cveNotify
Lantronix SLC8000 before firmware v9.7.0.5, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmware versions of SLB882/SLCx-03/SLCx-02 contain a path traversal vulnerability in the web management portal upload endpoint that allows authenticated attackers to write arbitrary data to any location on the device's filesystem, leading to remote code execution. The upload filename validation strips backslash characters but does not subsequently check for forward slashes when a backslash is detected; by supplying a filename containing both characters an attacker writes outside the intended upload directory to any writable path. Attackers can use this vulnerability to achieve complete loss of confidentiality, integrity, and availability on the affected device and potentially impact downstream serial-connected devices.
π@cveNotify
RE/VRb LLC
REVRB-LANTERN: Security Research on Lantronix Autonomous Out-of-Band Devices
RE/VRb LLC conducts independent research to improve cyber infrastructure security. The following report details research conducted without contract or bounty, representing over four months of discovery and coordination by a single researcher. You can supportβ¦
π¨ CVE-2026-43641
Softaculous Virtualizor before 3.2.9 (Patch 9) and 3.0.0 contains an OS command injection vulnerability in the billing module handler that allows unauthenticated remote attackers to execute arbitrary commands as root by bypassing authentication through specific parameter combinations. Attackers can deserialize a crafted billing_data POST field and inject shell payloads through the uid field, which is passed unmodified to proc_open() via vexec(), yielding complete control of the host and all managed VPS instances.
π@cveNotify
Softaculous Virtualizor before 3.2.9 (Patch 9) and 3.0.0 contains an OS command injection vulnerability in the billing module handler that allows unauthenticated remote attackers to execute arbitrary commands as root by bypassing authentication through specific parameter combinations. Attackers can deserialize a crafted billing_data POST field and inject shell payloads through the uid field, which is passed unmodified to proc_open() via vexec(), yielding complete control of the host and all managed VPS instances.
π@cveNotify
π¨ CVE-2026-47116
LTSecurity LTK3500SF contains a hard-coded credentials vulnerability where the root and guest account passwords are stored in /etc/shadow as weak hashes recoverable with dictionary-based cracking tools. The recovered credentials authenticate against the device's Telnet and SSH services and grant root-level access to the operating system. These services are not confirmed to start automatically at boot, so exploitation requires Telnet or SSH to be running, whether enabled by the device configuration or started manually.
π@cveNotify
LTSecurity LTK3500SF contains a hard-coded credentials vulnerability where the root and guest account passwords are stored in /etc/shadow as weak hashes recoverable with dictionary-based cracking tools. The recovered credentials authenticate against the device's Telnet and SSH services and grant root-level access to the operating system. These services are not confirmed to start automatically at boot, so exploitation requires Telnet or SSH to be running, whether enabled by the device configuration or started manually.
π@cveNotify
GitHub
GitHub - AndreaLandriscina/Hardcoded-Credentials-in-LTSecurity-LTK3500SF: LTSecurity LTK3500SF (firmware AC3F_V1.1.0_build191121)β¦
LTSecurity LTK3500SF (firmware AC3F_V1.1.0_build191121) was discovered to contain a hardcoded password for the root account, stored in /etc/shadow. - AndreaLandriscina/Hardcoded-Credentials-in-LTSe...
π¨ CVE-2026-88339
A NULL pointer dereference vulnerability exists in the gf_sg_vrml_field_clone() function of GPAC 2d7da22e (26.08-DEV). The vulnerability occurs when cloning a PROTO default SFImage field with a NULL source pointer. An attacker can provide a specially crafted input file that triggers the condition, resulting in application crash and denial of service.
π@cveNotify
A NULL pointer dereference vulnerability exists in the gf_sg_vrml_field_clone() function of GPAC 2d7da22e (26.08-DEV). The vulnerability occurs when cloning a PROTO default SFImage field with a NULL source pointer. An attacker can provide a specially crafted input file that triggers the condition, resulting in application crash and denial of service.
π@cveNotify
GitHub
[Bug]NULL-pointer source in gf_sg_vrml_field_clone() SFImage clone leads to crash when cloning a PROTO default field (CWE-476)β¦
Summary When the BIFS scene decoder clones a PROTO node's default value for an SFImage-typed field, gf_sg_vrml_field_clone() enters the GF_SG_VRML_SFIMAGE branch and does memcpy(dest->pixels...
π¨ CVE-2026-77987
A server-side request forgery (SSRF) vulnerability was identified in the notebook viewer of GitHub Enterprise Server. The notebook viewer validated the scheme and host of a user-supplied URL but did not validate the port, allowing requests to be directed to internal services listening on other ports of the same appliance. Response bodies were not returned to the requester, but response timing acted as an oracle that allowed instance secrets to be extracted character by character. An extracted secret could then be used in a separate interaction with an internal service to obtain remote code execution on the appliance. Exploitation required network access to the instance and was unauthenticated when private mode was disabled, or required any authenticated user when private mode was enabled. This vulnerability affected GitHub Enterprise Server versions 3.17 through 3.22 and was fixed in versions 3.22.1, 3.21.6, 3.20.8, 3.19.12, 3.18.15, and 3.17.21. This vulnerability was reported through the GitHub Bug Bounty program.
π@cveNotify
A server-side request forgery (SSRF) vulnerability was identified in the notebook viewer of GitHub Enterprise Server. The notebook viewer validated the scheme and host of a user-supplied URL but did not validate the port, allowing requests to be directed to internal services listening on other ports of the same appliance. Response bodies were not returned to the requester, but response timing acted as an oracle that allowed instance secrets to be extracted character by character. An extracted secret could then be used in a separate interaction with an internal service to obtain remote code execution on the appliance. Exploitation required network access to the instance and was unauthenticated when private mode was disabled, or required any authenticated user when private mode was enabled. This vulnerability affected GitHub Enterprise Server versions 3.17 through 3.22 and was fixed in versions 3.22.1, 3.21.6, 3.20.8, 3.19.12, 3.18.15, and 3.17.21. This vulnerability was reported through the GitHub Bug Bounty program.
π@cveNotify
GitHub Docs
Release notes - GitHub Enterprise Server 3.17 Docs
Detailed information for all releases of the currently selected version of GitHub Enterprise Server.
π¨ CVE-2026-95812
ClipBucket v5 before 5.5.3-#182 contains a reflected cross-site scripting vulnerability in the sort_link() helper function that fails to sanitize cat, sort, and time query parameters. Attackers can craft malicious requests with injected script payloads in these parameters to execute arbitrary JavaScript in victims' browsers under the application origin.
π@cveNotify
ClipBucket v5 before 5.5.3-#182 contains a reflected cross-site scripting vulnerability in the sort_link() helper function that fails to sanitize cat, sort, and time query parameters. Attackers can craft malicious requests with injected script payloads in these parameters to execute arbitrary JavaScript in victims' browsers under the application origin.
π@cveNotify
GitHub
GitHub - MacWarrior/clipbucket-v5: Open source video hosting with PHP
Open source video hosting with PHP. Contribute to MacWarrior/clipbucket-v5 development by creating an account on GitHub.
π¨ CVE-2026-18161
IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote authenticated attacker to falsify transaction audit logs due to improper validation of a client-supplied HTTP header.
π@cveNotify
IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote authenticated attacker to falsify transaction audit logs due to improper validation of a client-supplied HTTP header.
π@cveNotify
Ibm
Security Bulletin: IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities
IBM Financial Transaction Manager (FTM) has addressed the following vulnerabilities.
π¨ CVE-2026-96271
Photoview through 2.4.0 contains an authorization bypass vulnerability in the shareAlbum GraphQL mutation that allows authenticated users to create share links for albums owned by other users. Attackers can supply arbitrary album IDs to generate working share tokens for victim albums, exposing photos and sub-albums to anyone with the link while retaining indefinite control over token settings.
π@cveNotify
Photoview through 2.4.0 contains an authorization bypass vulnerability in the shareAlbum GraphQL mutation that allows authenticated users to create share links for albums owned by other users. Attackers can supply arbitrary album IDs to generate working share tokens for victim albums, exposing photos and sub-albums to anyone with the link while retaining indefinite control over token settings.
π@cveNotify
GitHub
GitHub - photoview/photoview: Photo gallery for self-hosted personal servers
Photo gallery for self-hosted personal servers. Contribute to photoview/photoview development by creating an account on GitHub.
π¨ CVE-2026-91797
Foxit PDF Editor/Reader failed to validate the directory traversal path in the attachment file name, resulting in malicious attachments being able to be written to directories outside the expected secure area when the PDF is opened.
π@cveNotify
Foxit PDF Editor/Reader failed to validate the directory traversal path in the attachment file name, resulting in malicious attachments being able to be written to directories outside the expected secure area when the PDF is opened.
π@cveNotify
Foxit
Security Bulletins & Vulnerability Updates | Foxit
Access Foxit security bulletins and vulnerability updates, including CVEs, affected products, and recommended security fixes for enterprise users.
π¨ CVE-2026-91808
A heap-based out-of-bounds read vulnerability exists in Foxit PDF Editor Readerβs handling of PDF image objects with inconsistent compression metadata. Insufficient validation during image decoding may result in an undersized buffer and an out-of-bounds read during rendering, causing an application crash.
π@cveNotify
A heap-based out-of-bounds read vulnerability exists in Foxit PDF Editor Readerβs handling of PDF image objects with inconsistent compression metadata. Insufficient validation during image decoding may result in an undersized buffer and an out-of-bounds read during rendering, causing an application crash.
π@cveNotify
Foxit
Security Bulletins & Vulnerability Updates | Foxit
Access Foxit security bulletins and vulnerability updates, including CVEs, affected products, and recommended security fixes for enterprise users.
π¨ CVE-2026-91809
A use-after-free vulnerability exists in Foxit PDF Editor/Readerβs handling of malformed PDF form fields. Improper validation during field-name traversal may cause the application to access a released object, resulting in an application crash.
π@cveNotify
A use-after-free vulnerability exists in Foxit PDF Editor/Readerβs handling of malformed PDF form fields. Improper validation during field-name traversal may cause the application to access a released object, resulting in an application crash.
π@cveNotify
Foxit
Security Bulletins & Vulnerability Updates | Foxit
Access Foxit security bulletins and vulnerability updates, including CVEs, affected products, and recommended security fixes for enterprise users.
π¨ CVE-2026-42801
NULL pointer dereference vulnerability in ASR CraneοΌFalcon on Linux (as_rrc module) allows Pointer Manipulation.
This vulnerability is associated with program file 3g.mod/lib/src/urrsir.c.
π@cveNotify
NULL pointer dereference vulnerability in ASR CraneοΌFalcon on Linux (as_rrc module) allows Pointer Manipulation.
This vulnerability is associated with program file 3g.mod/lib/src/urrsir.c.
π@cveNotify
Asrmicro
Security Center
ASR Microelectronics Co., Ltd. οΌASR, 688220.SHοΌwas established in April 2015 and is headquartered at Zhang Jiang Hi-tech Park, Shanghai. It operates development and support centers in Beijing, Nanjing, Shenzhen, Hefei, Dalian, Chengdu, Xiβan and other mar
π¨ CVE-2026-94243
A vulnerability in Apache Sling Security Bundle: the ReferrerFilter accepts weaker-than-orgin evidence.
This issue affects Apache Sling Security Bundle: before 1.3.2.
Users are recommended to upgrade to version 1.3.2, which fixes the issue.
π@cveNotify
A vulnerability in Apache Sling Security Bundle: the ReferrerFilter accepts weaker-than-orgin evidence.
This issue affects Apache Sling Security Bundle: before 1.3.2.
Users are recommended to upgrade to version 1.3.2, which fixes the issue.
π@cveNotify
π¨ CVE-2026-96443
Insufficient validation of the JDBC driver URL in Apache Doris allows a privileged user to achieve remote code execution on the FE.
π@cveNotify
Insufficient validation of the JDBC driver URL in Apache Doris allows a privileged user to achieve remote code execution on the FE.
π@cveNotify
π¨ CVE-2026-73581
Improper Check for Certificate Revocation vulnerability in Apache Tomcat. Both the OpenSSL and OpenSSL-FFM TLS implementations ignore CRLs when certificate uses a keystore.
This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.58, from 9.0.0-M1 through 9.0.121.
The following versions were EOL at the time the CVE was created but are
known to be affected: from 8.5.0 through 8.5.100. Other unsupported versions may also be affected.
Users are recommended to upgrade to version 11.0.26, 10.1.59, 9.0.122, which fixes the issue.
π@cveNotify
Improper Check for Certificate Revocation vulnerability in Apache Tomcat. Both the OpenSSL and OpenSSL-FFM TLS implementations ignore CRLs when certificate uses a keystore.
This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.58, from 9.0.0-M1 through 9.0.121.
The following versions were EOL at the time the CVE was created but are
known to be affected: from 8.5.0 through 8.5.100. Other unsupported versions may also be affected.
Users are recommended to upgrade to version 11.0.26, 10.1.59, 9.0.122, which fixes the issue.
π@cveNotify
π¨ CVE-2026-75973
Improper Authentication vulnerability in Apache Tomcat. When Jakarta Authentication was configured with SimpleAuthConfigProvider as the default provider and multiple web application used that provider, the realm for the first web application to authenticate a request would be used for all web applications.
This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.59, from 9.0.0.M4 through 9.0.121.
The following versions were EOL at the time the CVE was created but are
known to be affected: from 8.5.0 through 8.5.100. Other unsupported versions may also be affected.
Users are recommended to upgrade to version 11.0.26, 10.1.60, 9.0.122, which fixes the issue.
π@cveNotify
Improper Authentication vulnerability in Apache Tomcat. When Jakarta Authentication was configured with SimpleAuthConfigProvider as the default provider and multiple web application used that provider, the realm for the first web application to authenticate a request would be used for all web applications.
This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.59, from 9.0.0.M4 through 9.0.121.
The following versions were EOL at the time the CVE was created but are
known to be affected: from 8.5.0 through 8.5.100. Other unsupported versions may also be affected.
Users are recommended to upgrade to version 11.0.26, 10.1.60, 9.0.122, which fixes the issue.
π@cveNotify