Threat database

CVE-2026-92263 is an OS command injection vulnerability in CodeWithCJ SparkyFitness, a self-hosted AI-powered health and fitness tracker. Versions prior to 1.6.0 have a flaw in the api/admin/backup/restore endpoint where an authenticated global administrator can upload a restore archive with a crafted filename containing shell metacharacters. This leads to arbitrary command execution with the server process privileges. The issue is fixed in version 1.6.0.

CVE-2026-68906 is a high-severity out-of-bounds read vulnerability in the mz-automation libiec61850 library prior to version 1.6.2. It occurs in the parseUserInformation function when handling malformed AARE PDUs during association, leading to an infinite CPU loop or a one-byte out-of-bounds read that can cause process abort. The flaw is due to improper validation of a negative buffer position returned by BerDecoder_decodeLength. This issue is fixed in version 1.6.2.

An out-of-bounds read vulnerability exists in libIEC61850 versions prior to 1.6.2 due to improper argument handling in the checkDataSetAccess function. This leads to reading beyond a stack buffer when processing a remote defineNamedVariableList request, causing potential server crashes and denial of service. The issue is fixed in version 1.6.2.

A vulnerability in libIEC61850 prior to version 1.6.2 allows a remote client to cause a server crash by triggering an invalid free of memory not on the heap. This occurs when an oversized RptID longer than 129 bytes is written, leading to improper handling and freeing of a stack-backed buffer during report serialization. The issue is fixed in version 1.6.2.

A double free vulnerability exists in mz-automation's libIEC61850 library versions 1.6.1 up to but not including 1.6.2. The flaw occurs during the MMS ObtainFile operation when a file handle is closed but a stale non-NULL value remains, leading to a second close attempt on the same handle if a subsequent request fails. This can cause the server to crash remotely. The issue is fixed in version 1.6.2.

A vulnerability in libIEC61850 prior to version 1.6.2 allows remote attackers to cause a denial of service via a NULL pointer dereference. The issue arises from improper validation of an alternate-access sub-array range in the MMS Read service, leading to a crash when handling out-of-range array indices in data models containing arrays.

CVE-2026-48503 is an integer underflow vulnerability in the MMS file service of libIEC61850 versions prior to 1.6.2. The flaw allows an unauthenticated remote client to cause an out-of-range initialPosition in fileOpen, leading to an oversized response that can disclose stale data from previous responses. This can result in information disclosure without authentication. The issue is fixed in version 1.6.2.

CVE-2026-111581 is a low-severity vulnerability in Red Hat Enterprise Linux 10 affecting the libblockdev library. The issue arises because the bd_fs_ntfs_set_label() and bd_fs_vfat_set_label() functions pass user-supplied label values directly as arguments to ntfslabel and fatlabel utilities without proper input validation or use of end-of-options separators. This allows labels starting with a dash ('-') to be interpreted as command-line flags, potentially causing unintended operations. The vulnerability can be exploited by unprivileged local users via the udisks2 Filesystem.SetLabel() D-Bus method without requiring administrator authentication.

CVE-2026-102941 is an out-of-bounds read vulnerability in the gomarkdown markdown Go library. The flaw occurs in the parser.IsSafeURL function when it slices a URL without verifying its length, which can cause a panic on short or malformed URLs. This panic can terminate the calling process, resulting in a denial of service condition. The vulnerability affects versions prior to 0.0.0-20260724235538-61af6e1e6971 and is fixed in that version.

CVE-2026-96425 is a medium severity vulnerability in UBports lomiri-download-manager where incorrect DBus policy allows an arbitrary user to execute commands as root. This issue arises from improper permission assignment for a critical resource, enabling privilege escalation via DBus. The vulnerability affects versions from 0.1.0 up to but not including 0.3.3.

CVE-2026-96424 is a high-severity vulnerability in UBports' lomiri-download-manager, specifically in the lomiri-upload-manager component. It involves incorrect DBus policy permissions that allow an arbitrary user to read any file as root via DBus. This affects versions from 0.1.0 up to but not including 0.3.3.

CVE-2026-57447 is a medium severity vulnerability in the discourse-doc-categories plugin for Discourse. The issue involves exposure of sensitive information where the doc category index refresh resolves linked titles for private messages or restricted category topics without enforcing viewer authorization. This allows a user with permission to edit the index topic to learn titles of topics they are not authorized to view, though access to the topic contents is not granted. The vulnerability has been addressed by a specific commit in the source code.

CVE-2026-95859 is a high-severity vulnerability in libp2p-rust prior to version 0.49.5. It involves the Gossipsub GRAFT control-message handling, which improperly adds attacker-supplied topic hashes to a peer's topic list without verifying prior subscription. This allows a remote unauthenticated attacker to cause unbounded memory growth per peer, potentially leading to denial of service by exhausting process memory. The issue is fixed in version 0.49.5.

Seanime versions 3.7.0 through 3.10.3 contain an argument injection vulnerability that allows unauthenticated LAN or Tailnet clients to bypass authorization controls. By setting the transcodeHwAccel parameter to custom and supplying attacker-controlled decodeFlags and encodeFlags, an attacker can inject arbitrary arguments into the ffmpeg command line. This can lead to arbitrary file write, file truncation, potential local file read, and data exfiltration as the user running Seanime.

Thermo Fisher Torrent Suite Software versions up to 5.18 contain a path traversal vulnerability (CWE-22) that allows an authenticated attacker to read arbitrary files accessible to the web service account on the Torrent Server. The vulnerability has a CVSS 3.1 base score of 6.5, indicating medium severity. There is no information about available patches or vendor advisories addressing this issue.

CVE-2026-105667 is a vulnerability in J4Care's dcm4chee-arc-light version 5.35.1 where the HL7 listener accepts ADT^A40 patient-merge messages without authenticating the sender. This allows a remote attacker to reassign medical studies and workflow records from one patient to another. The archive's unmerge functionality does not reverse this reassignment. The vulnerability has a CVSS score of 7.5, indicating high severity.

CVE-2026-105279 is a critical vulnerability in J4Care's dcm4chee-arc-light version 5.35.1. The default configuration allows the archive to accept DICOM associations from unregistered calling AEs, enabling remote attackers to enumerate and retrieve patient information and medical images via C-FIND and C-GET commands. Additionally, attackers can use C-STORE to file fabricated study content under existing patient identities.

CVE-2026-101021 is a vulnerability in J4Care's dcm4chee-arc-light version 5.35.1 where the MultipartInputStream component performs inefficient boundary matching and unnecessary buffer copying. This flaw allows crafted multipart input to cause excessive boundary comparisons and repeated copying, leading to a high-severity impact on availability.

CVE-2026-105273 is a high severity vulnerability in J4Care's dcm4chee-arc-light version 5.35.1. The issue arises from inadequate validation of MP4 box sizes in the MP4Parser component, which can cause the parser to fail to make forward progress and repeatedly process the same malformed input. This results in a denial of service condition due to resource exhaustion or application hang.

CVE-2026-107621 is a high-severity vulnerability in J4Care's dcm4chee-arc-light version 5.35.1. The JPEGParser component can enter an infinite loop when processing a specially crafted or truncated JPEG stream, leading to a denial of service condition.