🚨 CVE-2026-104606
A security flaw has been discovered in itsourcecode Online Admission System Project 1.0. The impacted element is an unknown function of the file confirm.php. The manipulation of the argument ID results in sql injection. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks.
🎖@cveNotify
A security flaw has been discovered in itsourcecode Online Admission System Project 1.0. The impacted element is an unknown function of the file confirm.php. The manipulation of the argument ID results in sql injection. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks.
🎖@cveNotify
GitHub
itsourcecode Online Admission System V1.0 SQL Injection Vulnerability · Issue #1 · ylc2024/cve
itsourcecode Online Admission System V1.0 SQL Injection Vulnerability NAME OF AFFECTED PRODUCT(S) Online Admission System Vendor Homepage https://itsourcecode.com/free-projects/php-project/online-a...
🚨 CVE-2026-59666
Cross-Site Scripting vulnerability in the Repasat application. Successful exploitation of this vulnerability could allow an attacker to trick a user into executing arbitrary code in the victim’s browser. The “nomOrigen” parameter is affected – endpoint “/es/origins/store”.
🎖@cveNotify
Cross-Site Scripting vulnerability in the Repasat application. Successful exploitation of this vulnerability could allow an attacker to trick a user into executing arbitrary code in the victim’s browser. The “nomOrigen” parameter is affected – endpoint “/es/origins/store”.
🎖@cveNotify
www.incibe.es
Multiple vulnerabilities in the Repasat application
INCIBE has coordinated the publication of 15 medium-severity vulnerabilities affecting the Repasat app
🚨 CVE-2026-59667
Cross-Site Scripting vulnerability in the Repasat application. Successful exploitation of this vulnerability could allow an attacker to trick a user into executing arbitrary code in the victim’s browser. The “nomTamano” parameter is affected – endpoint “/es/companysizemployees/update”.
🎖@cveNotify
Cross-Site Scripting vulnerability in the Repasat application. Successful exploitation of this vulnerability could allow an attacker to trick a user into executing arbitrary code in the victim’s browser. The “nomTamano” parameter is affected – endpoint “/es/companysizemployees/update”.
🎖@cveNotify
www.incibe.es
Multiple vulnerabilities in the Repasat application
INCIBE has coordinated the publication of 15 medium-severity vulnerabilities affecting the Repasat app
🚨 CVE-2026-59668
Cross-Site Scripting vulnerability in the Repasat application. Successful exploitation of this vulnerability could allow an attacker to trick a user into executing arbitrary code in the victim’s browser. The “nomTamano” parameter is affected – endpoint “/es/companysizebills/store”.
🎖@cveNotify
Cross-Site Scripting vulnerability in the Repasat application. Successful exploitation of this vulnerability could allow an attacker to trick a user into executing arbitrary code in the victim’s browser. The “nomTamano” parameter is affected – endpoint “/es/companysizebills/store”.
🎖@cveNotify
www.incibe.es
Multiple vulnerabilities in the Repasat application
INCIBE has coordinated the publication of 15 medium-severity vulnerabilities affecting the Repasat app
🚨 CVE-2026-91135
Heap-based buffer overflow vulnerability in Apache Thrift C++ THeaderTransport.
When an application enables the ZLIB transform for the frames it sends, THeaderTransport::transform() copies the compressed frame into the write buffer without making sure it fits. Data that does not compress, such as content a remote peer supplied, grows under compression, so the copy writes past the end of the heap buffer by an amount that grows with the size of the frame, and for large frames it also reads past the end of the transform buffer.
This issue affects Apache Thrift: before 0.25.0.
Users are recommended to upgrade to version 0.25.0, which fixes the issue.
🎖@cveNotify
Heap-based buffer overflow vulnerability in Apache Thrift C++ THeaderTransport.
When an application enables the ZLIB transform for the frames it sends, THeaderTransport::transform() copies the compressed frame into the write buffer without making sure it fits. Data that does not compress, such as content a remote peer supplied, grows under compression, so the copy writes past the end of the heap buffer by an amount that grows with the size of the frame, and for large frames it also reads past the end of the transform buffer.
This issue affects Apache Thrift: before 0.25.0.
Users are recommended to upgrade to version 0.25.0, which fixes the issue.
🎖@cveNotify
🚨 CVE-2026-97876
A local attacker with control over GRUB's configuration can bypass lockdown restrictions when booting with Secure Boot and load an unsigned GRUB module, while GRUB continues to report lockdown is enabled.
The vulnerability is caused by insufficient validation of the MMIO base address passed to the GRUB serial command. GRUB does not validate that the base address corresponds to a UART device, rather than being an arbitrary memory address. This allows an attacker to trick GRUB into writing non-arbitrary data at an attacker-controlled address, including resetting the grub_file_verifiers list in a way that disables the subsequent verification of loaded modules.
🎖@cveNotify
A local attacker with control over GRUB's configuration can bypass lockdown restrictions when booting with Secure Boot and load an unsigned GRUB module, while GRUB continues to report lockdown is enabled.
The vulnerability is caused by insufficient validation of the MMIO base address passed to the GRUB serial command. GRUB does not validate that the base address corresponds to a UART device, rather than being an arbitrary memory address. This allows an attacker to trick GRUB into writing non-arbitrary data at an attacker-controlled address, including resetting the grub_file_verifiers list in a way that disables the subsequent verification of loaded modules.
🎖@cveNotify
GitLab
term/serial: Reject caller-supplied port addresses under lockdown (26beaa3b) · Commits · gnu-grub / GRUB · GitLab
The serial command is available in lockdown mode and the port option accepts a raw port address or a raw mmio base address. This can be misused to allow an...
🚨 CVE-2026-104410
SiYuan before 3.8.5 contains an information disclosure vulnerability that allows publish readers to read password-protected and publish-disabled database rows via the /api/export/preview endpoint. Attackers can request an export preview of a public document embedding a database view to obtain protected rows' primary-key text and cell values.
🎖@cveNotify
SiYuan before 3.8.5 contains an information disclosure vulnerability that allows publish readers to read password-protected and publish-disabled database rows via the /api/export/preview endpoint. Attackers can request an export preview of a public document embedding a database view to obtain protected rows' primary-key text and cell values.
🎖@cveNotify
GitHub
Publish reader reads password-protected and publish-disabled database rows via /api/export/preview
## Summary
A publish reader can read the full contents of database (attribute-view) rows whose bound documents the owner marked password-protected or publish-disabled. The publish endpoint `POST...
A publish reader can read the full contents of database (attribute-view) rows whose bound documents the owner marked password-protected or publish-disabled. The publish endpoint `POST...
🚨 CVE-2026-104412
Ghost 0.5.0 before 6.64.0 does not correctly restrict staff role assignment, allowing users with the Editor or Super Editor role to assign their own role to other staff despite lacking permission to do so. An authenticated Editor or Super Editor can promote Author and Contributor users to Editor or Super Editor.
🎖@cveNotify
Ghost 0.5.0 before 6.64.0 does not correctly restrict staff role assignment, allowing users with the Editor or Super Editor role to assign their own role to other staff despite lacking permission to do so. An authenticated Editor or Super Editor can promote Author and Contributor users to Editor or Super Editor.
🎖@cveNotify
GitHub
Editors Could Promote Staff Users to Their Own Role
### Impact
Staff users with the Editor or Super Editor role were able to assign their own role to Author and Contributor users, despite not having permission to assign that role.
### Vulnerab...
Staff users with the Editor or Super Editor role were able to assign their own role to Author and Contributor users, despite not having permission to assign that role.
### Vulnerab...
🚨 CVE-2026-104413
Ghost from 5.94.0 before 6.64.0 contains a stored cross-site scripting vulnerability that allows staff users, including Contributors, to host arbitrary HTML by abusing bookmark card image fetching. Attackers can create bookmark cards that store non-image files from external websites as icons or thumbnails to compromise other staff users' admin sessions.
🎖@cveNotify
Ghost from 5.94.0 before 6.64.0 contains a stored cross-site scripting vulnerability that allows staff users, including Contributors, to host arbitrary HTML by abusing bookmark card image fetching. Attackers can create bookmark cards that store non-image files from external websites as icons or thumbnails to compromise other staff users' admin sessions.
🎖@cveNotify
GitHub
Stored XSS via Bookmark Card Images
### Impact
When creating a bookmark card, Ghost could store non-image files fetched from an external website as bookmark icons or thumbnails. This allowed any staff user, including Contributors,...
When creating a bookmark card, Ghost could store non-image files fetched from an external website as bookmark icons or thumbnails. This allowed any staff user, including Contributors,...
🚨 CVE-2026-104414
Ghost from 2.5.0 before 6.64.0 contains a stored cross-site scripting vulnerability that allows attackers to inject untrusted scripts into post content via oEmbed photo responses. Attackers can host malicious oEmbed photo responses so that embedding their URL stores scripts that run in the Ghost editor, published site, and newsletter emails, compromising staff admin sessions.
🎖@cveNotify
Ghost from 2.5.0 before 6.64.0 contains a stored cross-site scripting vulnerability that allows attackers to inject untrusted scripts into post content via oEmbed photo responses. Attackers can host malicious oEmbed photo responses so that embedding their URL stores scripts that run in the Ghost editor, published site, and newsletter emails, compromising staff admin sessions.
🎖@cveNotify
GitHub
Stored XSS via oEmbed Photo Responses
### Impact
Embedding a URL from an attacker-controlled website could result in untrusted scripts being stored in post content. These scripts could run in the Ghost editor, on the published site,...
Embedding a URL from an attacker-controlled website could result in untrusted scripts being stored in post content. These scripts could run in the Ghost editor, on the published site,...
🚨 CVE-2026-104415
Ghost from 0.7.2 before 6.64.0 contains an information disclosure vulnerability in the Admin API that allows staff-level users to determine the relative ordering of other staff users' password hashes. Authenticated staff users can query the Admin API to infer hash ordering, though this does not directly reveal hashes or enable practical password recovery.
🎖@cveNotify
Ghost from 0.7.2 before 6.64.0 contains an information disclosure vulnerability in the Admin API that allows staff-level users to determine the relative ordering of other staff users' password hashes. Authenticated staff users can query the Admin API to infer hash ordering, though this does not directly reveal hashes or enable practical password recovery.
🎖@cveNotify
GitHub
Password Hash Ordering Disclosure in Ghost Admin API
### Impact
Any staff-level user was able to determine the relative ordering of other staff users' hashed passwords. This does not directly disclose password hashes, and does not provide a pr...
Any staff-level user was able to determine the relative ordering of other staff users' hashed passwords. This does not directly disclose password hashes, and does not provide a pr...
🚨 CVE-2026-104416
Ghost from 4.39.0 before 6.64.0 contains an information disclosure vulnerability in the Admin API that allows staff users to view secret tokens of pending staff invites. Staff users with invite viewing permission can accept pending invites for higher-privileged roles to escalate their privileges.
🎖@cveNotify
Ghost from 4.39.0 before 6.64.0 contains an information disclosure vulnerability in the Admin API that allows staff users to view secret tokens of pending staff invites. Staff users with invite viewing permission can accept pending invites for higher-privileged roles to escalate their privileges.
🎖@cveNotify
GitHub
Invite Token Disclosure in Ghost Admin API
### Impact
Staff users with permission to view staff invites were able to discover the secret token of pending invites, including invites for roles with higher privileges than their own. This co...
Staff users with permission to view staff invites were able to discover the secret token of pending invites, including invites for roles with higher privileges than their own. This co...
🚨 CVE-2026-104417
Ghost from 1.20.0 before 6.64.0 contains a path traversal vulnerability in theme translation file loading that allows authenticated administrators to read JSON files outside the active theme directory. Attackers can manipulate the locale setting to load JSON files elsewhere on the server, exposing server configuration secrets.
🎖@cveNotify
Ghost from 1.20.0 before 6.64.0 contains a path traversal vulnerability in theme translation file loading that allows authenticated administrators to read JSON files outside the active theme directory. Attackers can manipulate the locale setting to load JSON files elsewhere on the server, exposing server configuration secrets.
🎖@cveNotify
GitHub
Path Traversal via Locale Setting
### Impact
A vulnerability in how Ghost loads theme translation files allowed an authenticated Administrator to read JSON files outside of the active theme's directory, potentially exposing ...
A vulnerability in how Ghost loads theme translation files allowed an authenticated Administrator to read JSON files outside of the active theme's directory, potentially exposing ...
🚨 CVE-2026-104418
Ghost from 6.10.3 before 6.64.0 contains a remote code execution vulnerability that allows authenticated administrators to run code by abusing theme translation file loading. Attackers with administrator access can upload a crafted theme containing malicious translation files to execute arbitrary code on the Ghost server.
🎖@cveNotify
Ghost from 6.10.3 before 6.64.0 contains a remote code execution vulnerability that allows authenticated administrators to run code by abusing theme translation file loading. Attackers with administrator access can upload a crafted theme containing malicious translation files to execute arbitrary code on the Ghost server.
🎖@cveNotify
GitHub
Remote Code Execution via Theme Translation Files
### Impact
A vulnerability in how Ghost loads theme translation files allowed an authenticated Administrator to execute arbitrary code on the server via a crafted theme.
### Vulnerable versio...
A vulnerability in how Ghost loads theme translation files allowed an authenticated Administrator to execute arbitrary code on the server via a crafted theme.
### Vulnerable versio...
🚨 CVE-2026-104419
Zebra (zebrad) 4.5.0 before 6.3.0 discards which peer supplied the block hashes in FindBlocks responses, then assigns 100 misbehavior points, the ban threshold, to whichever peer serves a requested block more than 50,000 heights above the tip. A remote peer can return real far-ahead hashes to a syncing node so that honest peers get banned, eroding its peer set and raising eclipse risk.
🎖@cveNotify
Zebra (zebrad) 4.5.0 before 6.3.0 discards which peer supplied the block hashes in FindBlocks responses, then assigns 100 misbehavior points, the ban threshold, to whichever peer serves a requested block more than 50,000 heights above the tip. A remote peer can return real far-ahead hashes to a syncing node so that honest peers get banned, eroding its peer set and raising eclipse risk.
🎖@cveNotify
GitHub
Far-ahead FindBlocks hashes cause Zebra to ban honest peers that serve requested blocks
| Field | Content |
|---|---|
| Severity | Medium |
| CVSS 3.1 | `AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L` = 4.8 (Medium) |
| Conditional (self-healing / negligible amplification) | Reclassify as h...
|---|---|
| Severity | Medium |
| CVSS 3.1 | `AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L` = 4.8 (Medium) |
| Conditional (self-healing / negligible amplification) | Reclassify as h...
🚨 CVE-2026-104420
Zebra before 6.3.0 contains a protection mechanism failure that allows unauthenticated peers to evade misbehavior scoring by supplying invalid gossiped blocks. The inbound cleanup step wrongly downcasts RouterError to VerifyBlockError and discards the score, so attackers can repeatedly force block download and Equihash verification without being banned.
🎖@cveNotify
Zebra before 6.3.0 contains a protection mechanism failure that allows unauthenticated peers to evade misbehavior scoring by supplying invalid gossiped blocks. The inbound cleanup step wrongly downcasts RouterError to VerifyBlockError and discards the score, so attackers can repeatedly force block download and Equihash verification without being banned.
🎖@cveNotify
GitHub
Invalid gossiped blocks bypass peer misbehavior scoring
| Field | Content |
|---|---|
| Severity | Medium |
| CVSS 3.1 | `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L` = 5.3 (Medium). |
| CWE | CWE-253 (Incorrect Check of Function Return Value) / C...
|---|---|
| Severity | Medium |
| CVSS 3.1 | `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L` = 5.3 (Medium). |
| CWE | CWE-253 (Incorrect Check of Function Return Value) / C...
🚨 CVE-2026-104421
Zebra before 6.2.1 contains an incomplete cleanup vulnerability that allows unauthenticated peers to block downloading of valid blocks by leaving rejected hashes in SentHashes. Attackers can send a contextually invalid block sharing an honest block's header hash, causing Request::KnownBlock to skip the honest block and keep nodes behind the tip.
🎖@cveNotify
Zebra before 6.2.1 contains an incomplete cleanup vulnerability that allows unauthenticated peers to block downloading of valid blocks by leaving rejected hashes in SentHashes. Attackers can send a contextually invalid block sharing an honest block's header hash, causing Request::KnownBlock to skip the honest block and keep nodes behind the tip.
🎖@cveNotify
GitHub
Poisoned blocks can delay download of valid blocks (SentHashes lockout on the KnownBlock path)
# Poisoned blocks can delay download of valid blocks (SentHashes lockout on the KnownBlock path)
| Field | Content |
|---|---|
| Severity | Medium |
| CVSS 3.1 | AV:N/AC:L/PR:N/UI:N/S:U/C:N/...
| Field | Content |
|---|---|
| Severity | Medium |
| CVSS 3.1 | AV:N/AC:L/PR:N/UI:N/S:U/C:N/...
🚨 CVE-2026-104422
The block sync download path in Zebra (zebrad) before 6.3.0 reads a block's height from its unvalidated coinbase scriptSig and drops blocks that appear too far behind the tip before consensus validation, without penalizing the supplying peer. Because V5 transaction IDs exclude the scriptSig, a malicious peer can repeatedly serve a canonical block whose coinbase claims height 1 while keeping the requested hash, delaying the node's discovery of the newest block.
🎖@cveNotify
The block sync download path in Zebra (zebrad) before 6.3.0 reads a block's height from its unvalidated coinbase scriptSig and drops blocks that appear too far behind the tip before consensus validation, without penalizing the supplying peer. Because V5 transaction IDs exclude the scriptSig, a malicious peer can repeatedly serve a canonical block whose coinbase claims height 1 while keeping the requested hash, delaying the node's discovery of the newest block.
🎖@cveNotify
GitHub
Coinbase scriptSig rewrite drops a required block during sync without penalizing the supplying peer
# Coinbase scriptSig rewrite drops a required block during sync without penalizing the supplying peer
| Field | Content |
|---|---|
| Severity | High |
| CVSS 3.1 | `AV:N/AC:L/PR:N/UI:N/S:U/C...
| Field | Content |
|---|---|
| Severity | High |
| CVSS 3.1 | `AV:N/AC:L/PR:N/UI:N/S:U/C...
🚨 CVE-2026-104423
Zebra (zebrad) before 6.2.1 contains an asymmetric resource consumption vulnerability that allows unauthenticated peers to stall block verification by pushing V6 mempool transactions with invalid Halo2 proofs. Attackers can flood the shared unprioritized Halo2 verification queue with zero-fee transactions carrying zero-filled Orchard and Ironwood proofs, causing nodes to fall behind the chain tip.
🎖@cveNotify
Zebra (zebrad) before 6.2.1 contains an asymmetric resource consumption vulnerability that allows unauthenticated peers to stall block verification by pushing V6 mempool transactions with invalid Halo2 proofs. Attackers can flood the shared unprioritized Halo2 verification queue with zero-fee transactions carrying zero-filled Orchard and Ironwood proofs, causing nodes to fall behind the chain tip.
🎖@cveNotify
GitHub
Uncapped shielded verification cost lets peer-pushed V6 transactions stall block verification
# Uncapped shielded verification cost lets peer-pushed V6 transactions stall block verification
| Field | Value |
|---|---|
| Severity | High |
| CVSS 3.1 | AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:...
| Field | Value |
|---|---|
| Severity | High |
| CVSS 3.1 | AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:...
🚨 CVE-2026-104424
Zebra before 6.1.0 contains an incorrect calculation vulnerability in its ZIP-317 block template selector that omits header and transaction-count size from the block budget. Attackers can place valid selectable transactions in a victim miner's mempool to shape templates into oversized blocks, causing rejection and wasted proof-of-work.
🎖@cveNotify
Zebra before 6.1.0 contains an incorrect calculation vulnerability in its ZIP-317 block template selector that omits header and transaction-count size from the block budget. Attackers can place valid selectable transactions in a victim miner's mempool to shape templates into oversized blocks, causing rejection and wasted proof-of-work.
🎖@cveNotify
GitHub
Block template omits header and transaction-count size, allowing oversized invalid blocks and wasted mining work
# Block template omits header and transaction-count size, allowing oversized invalid blocks and wasted mining work
| Field | Value |
|---|---|
| Severity | Low |
| CVSS 3.1 | AV:N/AC:H/PR:N/U...
| Field | Value |
|---|---|
| Severity | Low |
| CVSS 3.1 | AV:N/AC:H/PR:N/U...
🚨 CVE-2026-104425
ZcashFoundation Zebra before 6.1.0 contains a resource exhaustion vulnerability that allows unauthenticated peers to degrade block processing by pushing transactions with invalid Orchard proofs without being misbehavior-scored. Attackers can repeatedly push invalid proofs into the shared halo2 batch verifier, forcing honest block proofs onto the slow individual-verification path and slowing block processing roughly sevenfold.
🎖@cveNotify
ZcashFoundation Zebra before 6.1.0 contains a resource exhaustion vulnerability that allows unauthenticated peers to degrade block processing by pushing transactions with invalid Orchard proofs without being misbehavior-scored. Attackers can repeatedly push invalid proofs into the shared halo2 batch verifier, forcing honest block proofs onto the slow individual-verification path and slowing block processing roughly sevenfold.
🎖@cveNotify
GitHub
Unattributed pushed-transaction verification failures allow sustained batch-verification poisoning of block processing
# Unattributed pushed-transaction verification failures allow sustained batch-verification poisoning of block processing
| Field | Value |
|---|---|
| Severity | Moderate |
| CVSS 3.1 | AV:N/...
| Field | Value |
|---|---|
| Severity | Moderate |
| CVSS 3.1 | AV:N/...