Threat database

CVE-2026-108931 is a cross-site scripting (XSS) vulnerability in Netcore NR268 version 1.7.121109. It affects the eval function in the dhcp_dynamicip_show.cgi file within the DHCP Handler component. The vulnerability arises from improper handling of the Hostname argument, allowing remote attackers to inject malicious scripts. The exploit code has been publicly disclosed. The vendor has not responded to the disclosure, and no patch or remediation information is available.

CVE-2026-84317 is an improper input validation vulnerability in the 0xJacky nginx-ui product. The vulnerability arises because the MCP tool 'nginx_config_add' does not enforce validation on user-supplied nginx configuration content, unlike other config-write paths. This allows an authenticated user to inject dangerous nginx directives such as 'js_*', 'perl_*', 'load_module', and 'user root', potentially leading to nginx code execution with root privileges if the njs/perl modules are available. The issue is due to an incomplete hardening patch that missed adding validation to the 'nginx_config_add' path. A proof of concept demonstrates remote code execution via JavaScript in the nginx worker running as root. The vulnerability affects versions prior to 2.4.1 and has a CVSS 3.1 score of 8.8 (high severity).

Fire-Boltt BSW013 smartwatch firmware versions up to 0.0.8 contain a missing authentication vulnerability that allows unpaired Bluetooth Low Energy devices to subscribe to the Heart Rate Measurement characteristic. This enables attackers within Bluetooth range to receive live heart rate data without pairing or user confirmation. The vulnerability has a low severity score and no known exploits in the wild. No patch or remediation information is currently available.

Fire-Boltt BSW013 smartwatch firmware versions up to 0.0.8 have a missing authentication vulnerability that allows unpaired attackers within Bluetooth range to inject notifications. This is possible because the proprietary BLE command characteristic accepts commands protected only by a CRC-16/ARC checksum, which does not provide authentication. Exploitation can cause the watch to vibrate and display spoofed alert text, potentially enabling phishing attacks.

CVE-2026-109569 is a critical container escape vulnerability in Th0rgal sandboxed.sh up to version 1.3.0. The issue arises because nsenter is used without the --root option, allowing code running inside container workspaces to access and modify the host filesystem. This bypasses the intended isolation between container and host environments.

Shaark versions 1.2.13 through 1.2.44 have an authorization bypass vulnerability in several API controllers. Authenticated non-admin users can exploit this flaw by sending PUT or DELETE requests with numeric IDs to overwrite or delete content owned by other users, including private items. This occurs due to missing ownership checks in the Link, Story, Chest, and Album API controllers.

CVE-2026-109567 is an improper privilege management vulnerability in zofe rapyd-admin versions 9.0.0 up to but not including 9.20.0. It affects the UsersEdit Livewire component, allowing users with the edit users permission to assign themselves the admin role. This enables privilege escalation by bypassing tenant scoping and per-record authorization, potentially allowing impersonation of other users.

Rapyd Admin versions 9.0.0 up to but not including 9.20.0 contain a hard-coded credentials vulnerability. An admin account with fixed credentials (admin@laravel / 'admin') is created during setup and can be recreated by certain commands. This allows remote unauthenticated attackers to gain super-admin access, bypassing authorization and tenant scoping controls.

Rapyd Admin versions from 9.4.0 up to but not including 9.20.0 contain a stored cross-site scripting (XSS) vulnerability. This flaw allows unauthenticated attackers to inject malicious scripts via self-registered display names. The injected scripts are rendered unescaped in the Activity log Author filter, potentially executing in an administrator's session. The vulnerability has a medium severity rating with a CVSS 4.0 score of 5.3.

N3.js versions before 2.11.1 have a regular expression denial of service (ReDoS) vulnerability in the N3Lexer number pattern. This flaw causes quadratic backtracking on long digit sequences that do not terminate a number, allowing attackers to supply crafted Turtle or N3 input that blocks the Node.js event loop and results in denial of service.

SnapOtter versions 1.15.10 through 2.2.0 have a missing authorization vulnerability that permits any authenticated user with minimal privileges to access certain API endpoints without proper permission checks. This flaw allows attackers with a settings:read-scoped API key to upload arbitrary files beyond storage quotas, which can be served without authentication and potentially exploit image and video decoders.

CVE-2026-109561 is an authorization bypass vulnerability in the aaif-goose goose software versions 1.28.0 up to but not including 1.44.0. The flaw allows tools to execute without user approval in Manual Approval mode due to persisted read-only annotations not being cleared properly. This enables prompt-injected calls to run without prompting the user after a session uses Smart Approval mode, bypassing the intended approval mechanism. The vulnerability has a low severity score of 2.3.

Continue CLI versions up to and including 1.5.47 contain a permission bypass vulnerability that allows attackers to execute unauthorized commands by chaining them after allowed Bash prefix rules. This occurs because the application appends attacker-controlled commands after shell command separators such as ;, &&, or |, enabling code execution as the user running the agent.

EdgeEver Desktop versions 1.6.26 through 1.112.0 have a navigation allowlist bypass vulnerability. This flaw allows attackers to load arbitrary origins in the main window by exploiting string-prefix URL matching. By embedding a link with userinfo syntax after the dev-server prefix, attackers can access sensitive components such as the edgeeverDesktop bridge, session token, sidecar RPC, and ACP channels. The vulnerability has a high severity score of 8.4 CVSS v4.0.

EdgeEver versions 1.6.0 through 1.112.0 contain a stored cross-site scripting (XSS) vulnerability in the TemplatesPane.tsx component. This vulnerability arises because template contentMarkdown is rendered with raw HTML using dangerouslySetInnerHTML without proper sanitization. An attacker can exploit this by writing templates with malicious HTML event handlers via an API or MCP token, enabling script execution during preview and potentially accessing the privileged window.edgeeverDesktop bridge.

EdgeEver versions from 0.1.0 up to and including 1.112.0 contain a stored cross-site scripting (XSS) vulnerability in the setMemoDragPreview function. This flaw allows attackers to inject malicious scripts via notebook names or memo titles, which execute when dragging these elements. Exploitation requires the attacker to set malicious names through MCP create_notebook, rename_notebook, or create_memo tools. The injected script can access the desktop bridge's session token, posing a significant security risk.

EdgeEver Desktop versions 1.92.0 through 1.112.0 have a remote code execution vulnerability in the desktop:acp-probe IPC handler. This handler fails to verify the sender and executes a caller-supplied executable path. Attackers able to run scripts in a renderer context, such as via stored cross-site scripting in certain preview features, can exploit this to launch local executables with the user's privileges.

modern-tar versions 0.3.5 through 0.8.5 have a memory exhaustion vulnerability due to improper validation of entry sizes parsed by the readOctal() function. Attackers can craft archives with negative entry sizes using non-octal bytes, causing the unpackTar() function to buffer data indefinitely and exhaust process memory.

Cockpit CMS version 2.14.1 has a timing discrepancy vulnerability in its authentication endpoint /auth/check. This flaw allows unauthenticated attackers to enumerate valid usernames and email addresses by measuring response times of login attempts. The vulnerability arises because existing accounts trigger two bcrypt operations, while non-existing accounts trigger only one, causing a measurable timing difference.

ERPNext versions 9.0.0 through 16.50.0 have a missing authorization vulnerability that allows authenticated users, including customer portal users, to access stock quantity information via certain whitelisted batch methods. This exposure enables attackers to list item batches with per-warehouse quantities without proper permission checks.