CVE-2026-57942 is an IP spoofing vulnerability in LibreTranslate versions up to 1.9.7. The flaw exists in the get_remote_address() function, which fails to properly validate the X-Forwarded-For header from untrusted sources. This allows unauthenticated attackers to spoof client IP addresses, bypassing per-IP rate limiting and flood bans, potentially enabling unlimited API abuse. The issue was fixed in a commit identified as 397fd22.
CVE-2026-56780 is an authorization bypass vulnerability in modoboa versions before 2.9.0. It affects the PUT /api/v1/accounts/{pk}/password/ endpoint, allowing domain administrators to change any user's password, including superadmin accounts. This flaw enables attackers with domain admin privileges to bypass object-level access controls and achieve full account takeover by resetting superadmin passwords.
CVE-2026-56790 is an off-by-one global buffer overflow vulnerability in CANBoat versions up to 6.22. It occurs in the searchForPgn() function in analyzer/pgn.c and can be triggered by a crafted NMEA-2000 message with an out-of-range PGN value sent over CAN bus or N2K-over-IP. This vulnerability allows remote attackers to cause an application crash, resulting in denial of service.
CVE-2026-56774 is an authorization bypass vulnerability in Kanboard versions up to 1.2.52. It allows authenticated users to delete other users' persistent 'Remember Me' sessions by exploiting improper validation of session IDs. Attackers can enumerate session IDs to mass-invalidate sessions, including those of administrators, causing denial of service by forcing re-authentication.
Crawl4AI versions before 0.8.7 have an authentication bypass vulnerability in the monitor router endpoints. This flaw allows unauthenticated remote attackers to invoke the /monitor/actions/cleanup endpoint, enabling them to manipulate monitoring state and disrupt service. The issue is fixed in version 0.8.7.
Crawl4AI versions before 0.8.7 contain a stored cross-site scripting (XSS) vulnerability in the monitor dashboard. This flaw arises because crawl URLs and error messages are rendered using innerHTML without proper escaping. An attacker can exploit this by submitting a crafted crawl request containing malicious markup, which executes in the operator's browser when viewing the dashboard.
Crawl4AI versions before 0.8.7 have a critical server-side request forgery (SSRF) vulnerability in multiple endpoints that accept user-supplied URLs without proper validation. Attackers can exploit this flaw to bypass internal address blocklists using IPv6-mapped IPv4 addresses, potentially accessing internal services and cloud metadata endpoints without authentication. This vulnerability is fixed in version 0.8.7.
Chainlit versions before 2.10.1 have a session hijacking vulnerability that allows unauthenticated attackers to restore and inherit authenticated user sessions by presenting a valid sessionId during WebSocket session restoration without verifying ownership. This enables attackers to assume the victim's permissions and roles, potentially invoking tools and accessing data restricted to the authenticated user.
CVE-2026-56397 is a critical cross-site scripting (XSS) vulnerability in SiYuan versions before 3.6.1. It arises from improper sanitization of package metadata and README content in the Bazaar marketplace, allowing malicious package authors to inject arbitrary HTML and JavaScript. Exploitation can lead to remote code execution on any user browsing the Bazaar by leveraging Electron's nodeIntegration setting to execute OS commands.
phpMyFAQ versions before 4.1.4 have missing authorization vulnerabilities in the editUser() and updateUserRights() endpoints. These flaws allow authenticated administrators who are not SuperAdmins but have edit_user permission to escalate their privileges by setting the is_superadmin flag or granting themselves arbitrary rights. This leads to unauthorized SuperAdmin access.
CVE-2026-56367 is an integer overflow vulnerability in ImageMagick's PSB (PSD v2) RLE decoding path affecting versions before 7.1.2-15 and 6.9.13-40. This flaw causes a heap out-of-bounds read on 32-bit builds when processing crafted PSB files, potentially leading to information disclosure or application crashes.
CVE-2026-56299 is an authentication bypass vulnerability in Capgo versions before 12.128.2 affecting the /build/upload/:jobId/* endpoint. It allows unauthenticated attackers to send OPTIONS requests that bypass authentication middleware and trigger consistent 500 errors. This enables attackers to flood requests and cause denial of service. The vulnerability is fixed in version 12.128.2.
Crawl4AI versions before 0.8.7 have an authentication bypass vulnerability caused by a hardcoded default JWT signing key in the Docker API server. This flaw allows attackers who know the default key to forge valid authentication tokens for any user, bypassing authentication controls and gaining full access to protected features. The issue is fixed in version 0.8.7.
CVE-2026-56253 is an improper access control vulnerability in Capgo versions before 12.128.2. It affects the public.get_org_members RPC function, allowing unauthenticated attackers to enumerate organization members by using a public sb_publishable_* key and an organization UUID. Sensitive information such as email addresses, user IDs, roles, and pending invitations can be retrieved. The vulnerability has a high severity with a CVSS score of 8.7 and was fixed in version 12.128.2.
CVE-2026-56251 is a vulnerability in Capgo versions before 12.128.2 involving a broken row level security policy on the org_users table. This flaw allows authenticated users to escalate their privileges from admin to super_admin, potentially compromising system security. The issue is fixed in version 12.128.2.
CVE-2026-56242 is a vulnerability in Capgo versions before 12.128.2 where an unauthenticated RPC function allows attackers to verify API key validity and disclose user identities. This flaw enables attackers to confirm whether API keys are valid and map them to user IDs. Subsequently, attackers can use other exposed RPCs to retrieve organization membership details and management email personally identifiable information (PII).
CVE-2026-56239 is a privilege escalation vulnerability in Capgo versions before 12.128.2. The issue exists in the public.apply_usage_overage SECURITY DEFINER function, which performs billing operations without proper internal authorization checks. Because this function executes with the owner's privileges and bypasses Row Level Security, an authenticated user with EXECUTE permission can manipulate billing data for any organization, potentially causing unauthorized credit depletion and fraudulent overage event insertion.
CVE-2026-56229 is an authorization bypass vulnerability in Capgo versions before 12.128.2. It affects the /build/status and /build/logs API endpoints, allowing attackers with limited API keys restricted to a single app to access build jobs from other applications by supplying mismatched app_id and job_id parameters. This exposure can leak sensitive build information including logs, metadata, and potentially credentials.
CVE-2025-71378 is a high-severity vulnerability in picklescan versions before 0.0.30. The tool fails to detect cProfile.runctx function calls within pickle file reduce methods, allowing malicious pickle files to bypass detection. When such files are loaded using pickle.load(), they can execute arbitrary remote code.
CVE-2025-71357 is a deserialization vulnerability in picklescan versions before 0.0.30. The tool fails to detect malicious pickle files that use idlelib.pyshell.ModifiedInterpreter.runcommand in reduce methods. This allows attackers to embed code in pickle files that executes remote commands when loaded.