Search: 7.3.1.1

CherryTree versions through 1.7.2 have an OS command injection vulnerability in the CtActions::link_clicked function. This flaw allows attackers to execute arbitrary commands on the victim's system by embedding shell metacharacters in web link URLs. The vulnerability is triggered when the non-default Custom Web Link Clicked Action option is enabled, enabling crafted document links to pass unquoted shell commands to std::system. This results in command execution with the privileges of the user clicking the link.

Multiple security issues were addressed in the trufflehog-3.99.7-1.1 package included in the GA media of openSUSE Tumbleweed. The update fixes vulnerabilities present in prior versions of the package. No specific details about the nature of the vulnerabilities or their impact are provided.

A moderate security vulnerability (CVE-2026-8932) in curl's libcurl library allows a security feature bypass due to improper mutual TLS (mTLS) connection reuse. This issue affects curl versions prior to 7.76.1-40.el9_8.9. A fixed version is available from Red Hat. The vulnerability could impact the security of mTLS connections by bypassing intended security features.

An issue in IDrive IDrive Backup for Windows Version 7.0.1.1 and below affected, remediated in Version 7.0.1.2 allows a local attacker to execute arbitrary code via the id_service.exe component

An issue in IDrive IDrive Backup for Windows Version 7.0.1.1 and below affected, remediated in Version 7.0.1.2 allows a local attacker to execute arbitrary code via the id_service.exe component

DB-GPT v0.7.5 and 0.8.0 contains directory traversal in use_example_file (packages/dbgpt-app/src/dbgpt_app/openapi/api_v1/examples_api.py:129). A remote attacker can use the validated exploitation path to write files outside the intended workspace or storage boundary.

CVE-2026-118578 is an information disclosure vulnerability in maotoumao MusicFreeDesktop versions 0.0.6, 0.0.7, and 0.0.8. The flaw exists in an unknown function of the Request Forwarder component and can be exploited only from the local network. Public exploit code has been released, but there is no vendor response or patch available yet. The vulnerability has a medium severity rating with a CVSS 4.0 score of 5.3.

InvoicePlane versions prior to 1.7.2-beta-1 contain an authorization bypass vulnerability allowing guest users to approve or reject quotes belonging to clients other than their own. This occurs because certain methods do not properly restrict access based on client assignment, enabling unauthorized quote status changes and email notifications. Additionally, guest users can mark other clients' quotes as viewed. These issues are resolved in version 1.7.2-beta-1 and later.

A vulnerability was identified in maotoumao MusicFreeDesktop 0.0.6/0.0.7/0.0.8. Impacted is an unknown function of the component Request Forwarder. The manipulation leads to server-side request forgery. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. The identifier of the patch is b0d3876247a0a64fa0e430e4b21870e41f503182. It is recommended to apply a patch to fix this issue.

CVE-2026-93851 is a path traversal vulnerability in Mattermost versions 11.7.x through 11.9.1 affecting the Agents plugin's mention reminder component. An authenticated user with posting permissions in a channel visible to a system administrator can craft a post with a forged mention reminder. If the administrator clicks this mention, it triggers an unintended API request that replaces an installed plugin, enabling code execution on the server.

Coder versions before 2.29.21, 2.30.0 before 2.34.12, 2.35.0 before 2.35.9, 2.36.0 before 2.36.7, and 2.37.0 before 2.37.4 do not validate the audience claim of Google Cloud Engine (GCE) instance-identity JWTs at a specific API endpoint. This flaw allows attackers who obtain a valid identity token intended for another relying party to replay it and gain unauthorized access to a workspace agent's session token, which remains valid until the next workspace build. The vulnerability has a CVSS score of 6.5, indicating a medium severity level.

SiYuan versions 3.8.7 through 3.8.8 have a vulnerability where Windows GLOBALROOT device-namespace aliases are not normalized, allowing attackers to bypass the IsSensitivePath denylist. This flaw enables attackers with appropriate privileges to invoke importStdMd with a specially crafted GLOBALROOT-prefixed path, resulting in unauthorized copying of sensitive files such as the API token and TLS private key into a publicly accessible directory.

A vulnerability in Wasmtime's Cranelift backend on aarch64 allows a conditional branch in a large Wasm br_table instruction to jump to an incorrect target. This can lead to arbitrary code execution and sandbox escapes. The issue affects all Wasmtime versions supporting aarch64 since 2020 before specific patched releases. Fixes are available in Wasmtime versions 36.0.19, 48.0.7, and 49.0.4.

CherryTree versions up to 1.7.2 have an absolute path traversal vulnerability in the CtStorageXmlHelper::_create_image_from_xml function. This flaw allows attackers to craft malicious XML documents with embedded file 'filename' attributes that specify absolute or home directory paths, potentially causing sensitive files like ~/.ssh/id_rsa to be embedded when the document is saved.

CVE-2026-118691 is a missing authorization vulnerability in GuDong2003's xianyu-auto-reply-fix up to version 2.0.7. It allows unauthenticated attackers to send messages on behalf of other users by exploiting a publicly known default API secret in the POST /send-message endpoint. Attackers can use the hard-coded api_key along with another user's cookie_id and chosen message parameters to send arbitrary messages from that merchant account.

The Autobahn Python library's permessage-brotli extension inflates entire frames before enforcing the maxMessagePayloadSize limit, allowing a small compressed frame to cause excessive memory allocation. This can lead to a denial-of-service (DoS) condition by exhausting server memory. The issue affects versions from 26.7.1 up to but not including 26.10.1 and was fixed in version 26.10.1.

A vulnerability in filelock versions 3.22.0 through 4.2.0 allows a local user with write access to a lock marker file to forge the process ID (PID) recorded in the marker. This causes another process, running as the lock owner or root, to mistakenly consider the lock stale and remove the live marker, resulting in two processes concurrently holding the lock. The issue arises when the marker file is group- or other-writable due to explicit mode settings or permissive umask values in sticky or non-removable directories. The vulnerability has a medium severity with a CVSS score of 4.7 and impacts integrity but not confidentiality or availability. A fix is available in version 4.2.1.

CVE-2026-61542 is a high-severity vulnerability in drhelius Gearboy emulator version prior to 3.8.7. The Gearsystem component's optional --mcp-http mode accepts unauthenticated MCP requests from any network peer, allowing remote peers to invoke emulator and debugging operations without authentication. The vulnerability arises because the MCP server binds to all interfaces and does not enforce authorization checks on POST requests to /mcp. The impact is limited to the emulator process, debugging state, and local files used as media, with no demonstrated host code execution. Gearboy 3.8.7 includes a patch that fixes this issue.