๐จ CVE-2026-75853
ArcadeDB's Gremlin wire-protocol plugin (com.arcadedb:arcadedb-gremlin) in versions <= 26.7.3 enforces authentication (SASL PLAIN) but performs no authorization: it never checks database access permissions (canAccessToDatabase) and never binds the authenticated principal into the engine. As a result, any valid server credential โ even one provisioned for zero or one unrelated database โ can read, write, and drop data in any database on the server by selecting a target database via a traversal-source alias, completely bypassing the engine's per-type/read-only/UPDATE_SCHEMA ACLs. The issue is fixed in version 26.8.1.
๐@cveNotify
ArcadeDB's Gremlin wire-protocol plugin (com.arcadedb:arcadedb-gremlin) in versions <= 26.7.3 enforces authentication (SASL PLAIN) but performs no authorization: it never checks database access permissions (canAccessToDatabase) and never binds the authenticated principal into the engine. As a result, any valid server credential โ even one provisioned for zero or one unrelated database โ can read, write, and drop data in any database on the server by selecting a target database via a traversal-source alias, completely bypassing the engine's per-type/read-only/UPDATE_SCHEMA ACLs. The issue is fixed in version 26.8.1.
๐@cveNotify
GitHub
Gremlin wire protocol enforces authentication but no authorization, allowing cross-database read/write and engine ACL bypass
## Summary
ArcadeDB's Gremlin wire-protocol plugin enforces authentication (SASL PLAIN) but performs NO authorization: it never checks `canAccessToDatabase` and never binds the authenticated p...
ArcadeDB's Gremlin wire-protocol plugin enforces authentication (SASL PLAIN) but performs NO authorization: it never checks `canAccessToDatabase` and never binds the authenticated p...
๐จ CVE-2026-75854
ArcadeDB versions before 26.8.1 contain a missing authentication vulnerability in the Redis wire-protocol plugin that allows unauthenticated attackers to read, write, and delete data. Attackers can connect to the Redis port and execute arbitrary commands against any database on the server without providing credentials, bypassing all security gates.
๐@cveNotify
ArcadeDB versions before 26.8.1 contain a missing authentication vulnerability in the Redis wire-protocol plugin that allows unauthenticated attackers to read, write, and delete data. Attackers can connect to the Redis port and execute arbitrary commands against any database on the server without providing credentials, bypassing all security gates.
๐@cveNotify
GitHub
Redis wire-protocol plugin performs no authentication โ unauthenticated read/write/delete on all databases
# Security Advisory โ ArcadeDB
**Vulnerability Type:** Missing Authentication for Critical Function โ The Redis Wire-Protocol Plugin Performs No Credential Check At All, Granting Full Unauthenti...
**Vulnerability Type:** Missing Authentication for Critical Function โ The Redis Wire-Protocol Plugin Performs No Credential Check At All, Granting Full Unauthenti...
๐จ CVE-2026-75855
ArcadeDB versions before 26.8.1 fail to sanitize database names in the POST /api/v1/server endpoint's create database and drop database commands, allowing authenticated root users to write and delete arbitrary files outside the configured database directory. Attackers can supply database names containing ../ sequences to create databases at arbitrary filesystem paths or recursively delete directories the server process can access.
๐@cveNotify
ArcadeDB versions before 26.8.1 fail to sanitize database names in the POST /api/v1/server endpoint's create database and drop database commands, allowing authenticated root users to write and delete arbitrary files outside the configured database directory. Attackers can supply database names containing ../ sequences to create databases at arbitrary filesystem paths or recursively delete directories the server process can access.
๐@cveNotify
GitHub
Path Traversal in "create database" / "drop database" server commands allows arbitrary file write and delete outside the configuredโฆ
## Summary
The `POST /api/v1/server` endpoint's `create database` and `drop database` commands use the caller-supplied database name to build a filesystem path with no sanitization, normaliz...
The `POST /api/v1/server` endpoint's `create database` and `drop database` commands use the caller-supplied database name to build a filesystem path with no sanitization, normaliz...
๐จ CVE-2026-16309
Authorization bypass through User-Controlled key vulnerability in Netiket Information Technologies EdoWEB allows Accessing Functionality Not Properly Constrained by ACLs.
This issue affects EdoWEB: before 780-g7.
๐@cveNotify
Authorization bypass through User-Controlled key vulnerability in Netiket Information Technologies EdoWEB allows Accessing Functionality Not Properly Constrained by ACLs.
This issue affects EdoWEB: before 780-g7.
๐@cveNotify
siberguvenlik.gov.tr
T.C. Siber Gรผvenlik Baลkanlฤฑฤฤฑ
Tรผrkiye Cumhuriyeti Cumhurbaลkanlฤฑฤฤฑ Siber Gรผvenlik Baลkanlฤฑฤฤฑ resmi web sitesi.
๐จ CVE-2026-18751
External control of file name or path vulnerability in Citrix WorkSpace App on MacOS.
This issue affects WorkSpace App: 2607.
๐@cveNotify
External control of file name or path vulnerability in Citrix WorkSpace App on MacOS.
This issue affects WorkSpace App: 2607.
๐@cveNotify
๐จ CVE-2026-74951
Clickjacking issue in Firefox for Android. This vulnerability was fixed in Firefox 154.
๐@cveNotify
Clickjacking issue in Firefox for Android. This vulnerability was fixed in Firefox 154.
๐@cveNotify
bugzilla.mozilla.org
Access Denied
You are not authorized to access bug 1978587. To see this bug, you must
first log in to an account with the appropriate permissions.
first log in to an account with the appropriate permissions.
๐จ CVE-2026-74975
Spoofing issue in the Downloads component in Firefox for Android. This vulnerability was fixed in Firefox 154.
๐@cveNotify
Spoofing issue in the Downloads component in Firefox for Android. This vulnerability was fixed in Firefox 154.
๐@cveNotify
bugzilla.mozilla.org
1842361 - (CVE-2026-74975) Download confirmation notification can be overlaid over other origins.
RESOLVED (giorga) in Firefox for Android - Downloads. Last updated 2026-08-17.
๐จ CVE-2026-74980
Clickjacking issue in the Downloads component in Firefox for Android. This vulnerability was fixed in Firefox 154.
๐@cveNotify
Clickjacking issue in the Downloads component in Firefox for Android. This vulnerability was fixed in Firefox 154.
๐@cveNotify
bugzilla.mozilla.org
Access Denied
You are not authorized to access bug 2049034. To see this bug, you must
first log in to an account with the appropriate permissions.
first log in to an account with the appropriate permissions.
๐จ CVE-2026-75778
A vulnerability was identified in code-projects Task Management System 1.0. This affects the function Operation::select_with_multiple_condition of the file /index.php of the component Login Form. Such manipulation of the argument email leads to sql injection. It is possible to launch the attack remotely. The exploit is publicly available and might be used.
๐@cveNotify
A vulnerability was identified in code-projects Task Management System 1.0. This affects the function Operation::select_with_multiple_condition of the file /index.php of the component Login Form. Such manipulation of the argument email leads to sql injection. It is possible to launch the attack remotely. The exploit is publicly available and might be used.
๐@cveNotify
๐จ CVE-2026-75783
A security vulnerability has been detected in TRENDnet TEW-WLC100P 12.07b01. Affected by this vulnerability is an unknown functionality of the file /sbin/netifd of the component DHCP blobmsg Handler. The manipulation leads to stack-based buffer overflow. The attack must be carried out from within the local network. The exploit has been disclosed publicly and may be used.
๐@cveNotify
A security vulnerability has been detected in TRENDnet TEW-WLC100P 12.07b01. Affected by this vulnerability is an unknown functionality of the file /sbin/netifd of the component DHCP blobmsg Handler. The manipulation leads to stack-based buffer overflow. The attack must be carried out from within the local network. The exploit has been disclosed publicly and may be used.
๐@cveNotify
GitHub
CVE/team15_20260702/01_wlc100p-netifd/poc/poc-netifd-overflow.py at main ยท meishigana/CVE
for_my_cve. Contribute to meishigana/CVE development by creating an account on GitHub.
๐จ CVE-2026-17084
The "stringprep" module didn't process characters from RFC 3454 tables
B.2 or B.3 correctly: the latest Unicode codepoint attributes were used
instead of the specified Unicode 3.2.0. This behavior would cause
mismatches when processing domain names using IDNA 2003 (the "idna"
codec) and the in_table_b2() function of the "stringprep" module. This
only affects domain names containing characters that were not previously
registered or had their Unicode attributes such as case-folding
behavior updated since Unicode 3.2.0.
๐@cveNotify
The "stringprep" module didn't process characters from RFC 3454 tables
B.2 or B.3 correctly: the latest Unicode codepoint attributes were used
instead of the specified Unicode 3.2.0. This behavior would cause
mismatches when processing domain names using IDNA 2003 (the "idna"
codec) and the in_table_b2() function of the "stringprep" module. This
only affects domain names containing characters that were not previously
registered or had their Unicode attributes such as case-folding
behavior updated since Unicode 3.2.0.
๐@cveNotify
GitHub
[3.14] gh-155292: Don't consider Unicode codepoint attributes outsideโฆ ยท python/cpython@1e54caa
โฆ RFC 3454 (GH-155293) (GH-156020)
Due to a bug, some Unicode codepoint attributes were considered
for characters not yet defined in Unicode 3.2.0 or attributes
which changed in later Unicode vers...
Due to a bug, some Unicode codepoint attributes were considered
for characters not yet defined in Unicode 3.2.0 or attributes
which changed in later Unicode vers...
๐จ CVE-2026-24301
Improper neutralization of special elements used in a command ('command injection') in Microsoft Copilot allows an unauthorized attacker to disclose information over a network.
๐@cveNotify
Improper neutralization of special elements used in a command ('command injection') in Microsoft Copilot allows an unauthorized attacker to disclose information over a network.
๐@cveNotify
๐จ CVE-2026-28192
Unauthenticated Arbitrary File Upload in Piotnet Addons For Elementor Pro <= 7.1.67 versions.
๐@cveNotify
Unauthenticated Arbitrary File Upload in Piotnet Addons For Elementor Pro <= 7.1.67 versions.
๐@cveNotify
Patchstack
Arbitrary File Upload in WordPress Piotnet Addons For Elementor Pro Plugin
Patchstack is the leading open source vulnerability research organization. Find information and protection for all WordPress and Drupal security issues.
๐จ CVE-2026-28567
Unauthenticated Broken Access Control in WP Sort Order <= 1.3.5 versions.
๐@cveNotify
Unauthenticated Broken Access Control in WP Sort Order <= 1.3.5 versions.
๐@cveNotify
Patchstack
Broken Access Control in WordPress WP Sort Order Plugin
Patchstack is the leading open source vulnerability research organization. Find information and protection for all WordPress and Drupal security issues.
๐จ CVE-2026-28568
Unauthenticated Cross Site Scripting (XSS) in Quill Forms <= 5.7.1 versions.
๐@cveNotify
Unauthenticated Cross Site Scripting (XSS) in Quill Forms <= 5.7.1 versions.
๐@cveNotify
Patchstack
Cross Site Scripting (XSS) in WordPress Quill Forms Plugin
Patchstack is the leading open source vulnerability research organization. Find information and protection for all WordPress and Drupal security issues.
๐จ CVE-2026-28569
Unauthenticated Cross Site Scripting (XSS) in SSL Zen <= 4.7.43 versions.
๐@cveNotify
Unauthenticated Cross Site Scripting (XSS) in SSL Zen <= 4.7.43 versions.
๐@cveNotify
Patchstack
Cross Site Scripting (XSS) in WordPress SSL Zen Plugin
Patchstack is the leading open source vulnerability research organization. Find information and protection for all WordPress and Drupal security issues.
๐จ CVE-2026-28570
Unauthenticated Local File Inclusion in Vavo Core <= 2.3.0 versions.
๐@cveNotify
Unauthenticated Local File Inclusion in Vavo Core <= 2.3.0 versions.
๐@cveNotify
Patchstack
Local File Inclusion in WordPress Vavo Core Plugin
Patchstack is the leading open source vulnerability research organization. Find information and protection for all WordPress and Drupal security issues.
๐จ CVE-2026-28571
Unauthenticated Broken Access Control in FormyChat <= 2.15.7 versions.
๐@cveNotify
Unauthenticated Broken Access Control in FormyChat <= 2.15.7 versions.
๐@cveNotify
Patchstack
Broken Access Control in WordPress FormyChat Plugin
Patchstack is the leading open source vulnerability research organization. Find information and protection for all WordPress and Drupal security issues.
๐จ CVE-2026-32333
Unauthenticated Cross Site Scripting (XSS) in Mayosis Core <= 5.4.7 versions.
๐@cveNotify
Unauthenticated Cross Site Scripting (XSS) in Mayosis Core <= 5.4.7 versions.
๐@cveNotify
Patchstack
Cross Site Scripting (XSS) in WordPress Mayosis Core Plugin
Patchstack is the leading open source vulnerability research organization. Find information and protection for all WordPress and Drupal security issues.
๐จ CVE-2026-32444
Contributor Remote Code Execution (RCE) in Cwicly <= 1.4.4 versions.
๐@cveNotify
Contributor Remote Code Execution (RCE) in Cwicly <= 1.4.4 versions.
๐@cveNotify
Patchstack
Remote Code Execution (RCE) in WordPress Cwicly Plugin
Patchstack is the leading open source vulnerability research organization. Find information and protection for all WordPress and Drupal security issues.
๐จ CVE-2026-32463
Contributor Arbitrary File Upload in Sync Post With Other Site <= 1.9.3 versions.
๐@cveNotify
Contributor Arbitrary File Upload in Sync Post With Other Site <= 1.9.3 versions.
๐@cveNotify
Patchstack
Arbitrary File Upload in WordPress Sync Post With Other Site Plugin
Patchstack is the leading open source vulnerability research organization. Find information and protection for all WordPress and Drupal security issues.