Search: 1.2.4.4

Volmarg Personal Management System versions up to 2.1.0 contain an OS command injection vulnerability. Authenticated users can exploit this flaw by creating directories with shell metacharacters in the upload/files path and then moving or copying them, resulting in arbitrary shell command execution as the web server user.

PiWeb Disable payment method / Partial payment for WooCommerce versions before 1.1.10.9 contains a missing authorization vulnerability in the update_fees AJAX handler. This flaw allows unauthenticated attackers to modify and read other customers' orders by reusing a nonce from their own order-pay page and supplying sequential order_id values. The vulnerability enables attackers to change payment methods, recalculate fees, and disclose order details such as line items and totals.

CVE-2026-118590 is a medium severity vulnerability in the nipy nibabel library versions 5.4.0, 5.4.1, and 5.4.2. It involves uncontrolled memory allocation in the array_from_file function within nibabel/volumeutils.py, which can be triggered remotely. A fix has been proposed but is not yet accepted.

Share to Clipboard version 1.14.1 (versionCode 32) has insecure permissions that allow unauthorized attackers to overwrite another user's clipboard content.

CVE-2026-118586 is a server-side request forgery (SSRF) vulnerability in the dfm feedfinder2 project affecting versions 0.0.1 through 0.0.4. The flaw exists in the find_feeds function of feedfinder2.py, allowing remote attackers to manipulate requests and potentially cause the server to make unintended requests. The vulnerability has a medium severity rating with a CVSS score of 6.9. No patch or vendor response has been reported yet.

CVE-2026-118579 is a critical vulnerability in the D-Link DIR-505 router version 1.10B02. It involves a backdoor in the Web Management CGI component, specifically in the main function of /secmark1524.cgi. This backdoor can be triggered remotely by manipulating certain arguments, allowing unauthorized access. Public exploit code is available, increasing the risk of exploitation.

Tornado HTTP servers prior to version 6.6 are vulnerable to event loop blocking and excessive memory use when processing HTTP/1.1 chunked transfer encoded bodies composed of many small chunks. An attacker can send a request body with millions of 1-byte chunks, causing the server's event loop to block for extended periods (up to a minute for bodies near 100 MB), impacting all connections served by the process. This vulnerability also affects Tornado's SimpleAsyncHTTPClient when reading responses from malicious servers. The issue is fixed in Tornado 6.6, which introduces periodic yielding to the event loop and more efficient chunk handling.

Crass, a CSS tokenizer, incorrectly handles bad URL tokens when a closing parenthesis follows an escaped backslash, causing it to consume more input than browsers do. This flaw can cause CSS sanitizers that rely on Crass to mistakenly allow malicious CSS declarations, style rules, or at-rules such as @import to pass through. The vulnerability affects CSS sanitizers like Sanitize, Loofah, and rails-html-sanitizer, enabling attackers to smuggle CSS that can be used for UI redress, loading attacker-controlled resources, or CSS-based data exfiltration. The issue does not enable script execution in modern browsers. The vulnerability is fixed in Crass version 1.0.8.

A vulnerability in maykinmedia's open-object API versions 2.4.3 to before 2.5.1, 3.0.0 to before 3.6.2, 4.0.0-rc.1 to before 4.0.2, and 4.1.0 to before 4.1.1 allows an API token scoped to read one ObjectType to access full versioned records of objects of other ObjectTypes via the history-detail endpoint. This bypasses authorization checks that normally restrict access, potentially exposing sensitive data such as citizen or case records in government deployments. The issue is fixed in versions 2.5.1, 3.6.2, 4.0.2, and 4.1.1.

MailWatch for MailScanner is a web-based front-end to MailScanner. Prior to 1.2.27, any authenticated MailWatch user, including the U/user, D/domain-admin, and H/host roles, can release to inbox or permanently delete the quarantined mail of any other user or domain by supplying an arbitrary message `id` to `mailscanner/quarantine_action.php`. The action path calls `quarantine_list_items()` in `mailscanner/functions.php`, which selects from `maillog` by the supplied identifier without the per-role `global_filter` applied by listing and read views. The action requires a valid session and CSRF token, but the caller can submit a token from the caller's own session; ownership of the requested message is never checked. Message identifiers are enumerable, allowing a low-privilege user to invoke `quarantine_release()` or `quarantine_delete()` for other users' or domains' quarantined messages, force-delivering mail held by the quarantine or permanently deleting it. This issue is fixed in version 1.2.27.

The DB Tools rely on the TLS implementation in Golang’s standard library, which generally uses the system CA store. However, the crypto/x509 package also has its own internal denylist of known-bad CA certificates. Golang 1.27.3 adds the eMudhra certificates to this list. DB Tools version 100.19.0 was compiled with Golang 1.26.8, which does not include this check. The issue is resolved by updating to Golang 1.27.3 in DB Tools 100.20.0

CVE-2026-61564 is a critical code injection vulnerability in WWBN AVideo-Encoder versions prior to 8.1.0. The unauthenticated installer endpoint 'install/checkConfiguration.php' improperly interpolates request parameters into PHP string literals without escaping, allowing attackers to inject and execute arbitrary PHP code as the web-server user. Exploitation requires the absence of the 'videos/configuration.php' file, which is typical on fresh deployments or after file removal. The vulnerability also enables arbitrary file read/write and a secondary SQL injection via unsanitized INSERT statements. This issue is fixed in version 8.1.0.

CVE-2026-57448 is a server-side request forgery (SSRF) vulnerability in the mrblomblo blombooru application prior to version 1.40.0. The vulnerability exists in the administrator-only GET /proxy-image endpoint, which fetches URLs server-side without proper validation. This allows an authenticated administrator to access internal network services and cloud instance metadata, potentially exposing sensitive credentials. The issue is fixed in version 1.40.0.

Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10 fail to validate the target post ID in the Agents plugin's mention reminder component, which allows an authenticated user who can post in a channel visible to a system administrator to cause the administrator's browser to send an unintended API request, resulting in replacement of an installed plugin and code execution on the server, via a crafted post containing a forged mention reminder that the administrator clicks. Mattermost Advisory ID: MMSA-2026-00742

A server-side request forgery (SSRF) vulnerability exists in n8n versions before 1.123.83, 2.41.4, and 2.42.1 in the Slack Trigger webhook. This flaw allows unauthenticated attackers to bypass signature verification when no signing secret is set, enabling them to exfiltrate Slack workspace access tokens by causing the node to send these tokens to an attacker-controlled host.

MONAI versions prior to 1.6.1 have a vulnerability in the check_hash() function where integrity verification is insufficient. Specifically, if the hash value is None, the function silently returns True, and MD5 is used as the default hash type. This flaw allows attackers who can perform man-in-the-middle or registry compromise attacks to substitute bundles, datasets, or model archives downloaded without hashes. Such substitution can lead to malicious file delivery and potential code execution.

MONAI versions from 1.2.0 up to but not including 1.6.1 contain a remote code execution vulnerability in the ConfigWorkflow.__init__ method. This vulnerability arises because the method passes a bundle's configs/logging.conf file to logging.config.fileConfig, which uses eval() on handler class and args fields. An attacker can exploit this by publishing a malicious bundle with a crafted logging.conf that executes arbitrary Python code when the victim loads or runs the bundle.

A vulnerability in n8n Local Gateway desktop app versions before 2.41.4 and 2.42.x before 2.42.1 allows an attacker to silently re-pair the app with a malicious n8n instance via a crafted deep-link. This can cause the app to connect to an attacker-controlled instance without user confirmation, inheriting previously granted permissions and enabling unauthorized actions through the gateway.