BACnet Stack is a BACnet open source protocol stack C library for embedded systems. From versions 1.4.0 to before 1.4.6, 1.5.0 to before 1.5.1, and 1.6.0 to before 1.6.1, the BACnet MS/TP receive path decodes COBS frames into an output pointer inside the same fixed input buffer, but passes the full input-buffer size as the decode capacity. A long valid COBS payload can therefore write past the end of the actual remaining buffer. This issue has been patched in versions 1.4.6, 1.5.1, 1.6.1, and 1.7.0.
CVE-2026-62977 is an improper access control vulnerability in the BACnet Stack open source protocol library prior to version 1.5.1. It allows remote attackers to change the size of a read-only RAMFS-backed stream-access FILE object without proper authorization. This can lead to exposure of uninitialized or stale memory contents when reading the enlarged file region, or unauthorized truncation of read-only content. The issue is fixed in versions 1.5.1 and later.
Astro versions up to 7.4.4 have a reflected or stored cross-site scripting (XSS) vulnerability via attribute injection in dynamic tag names. When a dynamic tag resolves to a string containing a slash (/), Astro's filtering failed to prevent injection of attributes, allowing crafted tag names like 'img/src/onerror=alert(1)' to render as elements with malicious attributes. This affects applications that use untrusted input directly as element names. The issue is fixed in Astro 7.4.5, which properly restricts dynamic tag names to valid element names and throws errors for invalid ones.
An out-of-bounds read vulnerability exists in bacnet-stack versions prior to 1.5.1. The issue arises from the RAMFS-backed FILE object implementation where record-counting logic incorrectly reads beyond the allocated heap buffer during consecutive AtomicWriteFile append requests. This flaw has been fixed in version 1.5.1.
CVE-2026-62975 is a medium severity vulnerability in the bacnet-stack open source BACnet protocol stack library. Versions prior to 1.5.1 contain a heap out-of-bounds read flaw in the RAMFS-backed FILE implementation when processing AtomicWriteFile requests that replace existing records with shorter data. This occurs because the backend uses a stale length value after shrinking the heap allocation, leading to reading beyond the allocated buffer. The issue is fixed in version 1.5.1.
AutoMapper is a convention-based object-object mapper in .NET. Prior to 15.1.4 and from 16.0.0 until 16.3.0, AutoMapper increments type depth only after creating the destination, so recursive mapping performed through constructor parameters occurs before MaxDepth is counted. Destinations built through positional records or other constructors, and recursive ConstructUsing mappings that call context.Mapper, can therefore bypass explicit MaxDepth values and the default limit of 64. Deep attacker-influenced input can throw an uncatchable StackOverflowException and terminate the process. This issue is fixed in versions 15.1.4 and 16.3.0.
A path validation flaw in the /_image endpoint of the @astrojs/node adapter allows reading image files from directories that differ only by letter case from the build output directory on case-sensitive filesystems. This occurs because the path check was case-insensitive, permitting access to files outside the intended directory if a case-variant sibling directory exists. The issue affects astro versions from 5.14.3 up to 7.4.6 and is fixed in 7.4.7.
AutoMapper versions prior to 15.1.4 and from 16.0.0 up to but not including 16.3.0 contain an uncontrolled recursion vulnerability. This occurs when mapping polymorphic graphs or certain complex object types, potentially causing an uncatchable StackOverflowException that terminates the process. The issue is fixed in versions 15.1.4 and 16.3.0.
An out-of-bounds write vulnerability exists in the autoprogramming interface of SpaceCom and Space Battery pack with WiFi due to missing input validation. This flaw could allow an attacker to cause a denial of service on the affected communication device. The vulnerability has a medium severity rating with a CVSS score of 6.9. No patch or remediation information is currently available.
An improper privilege management vulnerability exists in the SpaceCom and Space Battery pack SP with WiFi, which could allow an attacker with limited privileges to escalate their privileges. This vulnerability is identified as CVE-2026-97361 and has a high severity rating with a CVSS score of 8.5. No specific affected versions or patches are currently documented.
Omnispace Agora Project versions up to 26.10.0 have a broken access control vulnerability in the isAutor() function. This function grants access rights based solely on object authorship without verifying if the user still belongs to the object's space. As a result, former members who authored objects can retain unauthorized read access after removal, causing persistent information disclosure.
CVE-2026-97358 is a high-severity vulnerability in SpaceCom where inclusion of web functionality from an untrusted source could lead to remote code execution. The vulnerability is publicly known but no exploits in the wild have been reported. No affected versions or patch information are provided.
EdgeEver versions from 1.9.0 up to but not including 2.13.0 contain a stored cross-site scripting (XSS) vulnerability in the backup restore endpoint. This flaw allows authenticated users to exploit the PUT /api/v1/restores/json/resources/:id endpoint by submitting a resource of kind image with a text/html MIME type without proper validation. Exploitation can lead to victim browsers executing malicious scripts that mint non-expiring API tokens, granting attackers read and write access to the victim's notes.
NginxPulse versions from 1.5.0 up to but not including 1.6.26 contain an unauthenticated SQL injection vulnerability in the /api/stats/:type endpoint. This flaw allows remote attackers to manipulate the id and locationType parameters to execute arbitrary SQL commands. Exploitation can lead to reading database contents and reading or writing server files via PostgreSQL superuser functions.
Dromara free-fs versions 2.0.1 through 2.3.1 contain a stored cross-site scripting (XSS) vulnerability. This flaw allows registered users to upload HTML files that are served inline as text/html, enabling script execution in the context of the application. Attackers can exploit this by sending victims a crafted preview link, which can lead to exposure of the victim's files and account information via API calls.
PMail versions 2.5.0 through 2.9.8 have a stored cross-site scripting (XSS) vulnerability. Authenticated users can inject malicious scripts via unsanitized HTML in the /api/email/send endpoint. These scripts can execute when administrators view the message, potentially allowing attackers to perform privileged API actions such as changing passwords and taking over accounts.
Keep versions 0.34.10 through 0.55.0 contain a blind SQL injection vulnerability in the CEL-to-SQL converter. This flaw allows authenticated users with read:alert permission to craft CEL expressions that exploit unescaped bracket-indexed JSON keys in JSON path expressions for SQLite, PostgreSQL, and MySQL. Exploitation can lead to unauthorized extraction of other tenants' alerts and password hashes by using result counts as a boolean oracle.
Tactical RMM versions 0.17.0 through 1.6.1 have an arbitrary file read vulnerability in the /reporting/templates/preview/ endpoint. This occurs because WeasyPrint processes file:// links in user-supplied templates and embeds the referenced files into generated PDFs. Users with report management permissions can exploit this to read sensitive files, including the Django SECRET_KEY, which is reused as the NATS password, enabling them to execute runscript commands on all managed agents.
Seafile SeaDoc converter versions 2.0.4 before 2.0.11 and 3.0.0 before 3.0.8 contain an absolute path traversal vulnerability. This flaw allows unauthenticated attackers with a public share token to execute arbitrary code by supplying an absolute filename to a specific API endpoint, leading to extraction of a ZIP file into the Python library path and subsequent module import triggering code execution.
FileCodeBox versions 2.2.1 through 2.8.4 have a stored cross-site scripting (XSS) vulnerability in the renderMarkdownPreview function. This flaw occurs because the function returns unsanitized text when the marked parser throws an error. Unauthenticated attackers can exploit this by sharing text containing thousands of nested blockquote markers followed by malicious HTML payloads, which execute scripts that steal the admin token from localStorage.