Akaunting version 3.3.0 contains a stored cross-site scripting (XSS) vulnerability in its XLSX item-import workflow. An authenticated Manager can import an item with a name containing malicious HTML markup. When another authenticated user selects this item while creating a document, the stored name is rendered using Vue's v-html directive, leading to execution of attacker-controlled code within the victim's Akaunting session.
Sleipnir Mobile for iPhone and iPad, including the Black Edition provided by Fenrir Inc., is vulnerable to improper certificate verification. This vulnerability relates to the application's failure to correctly validate SSL/TLS certificates, which could undermine secure communications.
A path traversal vulnerability (CWE-22) exists in the TwigView plugin for CakePHP versions prior to 1.3.3 and 2.1.2. This flaw allows arbitrary file reading when unvalidated user input is passed to the FileLoader::findTemplate() function. The issue has been fixed in versions 1.3.3 and 2.1.2.
The TwigView plugin for CakePHP versions prior to 1.3.3 and 2.1.2 contains a deserialization vulnerability due to unrestricted use of the unserialize filter. This flaw allows deserialization of untrusted data, potentially enabling remote code execution. The issue has been fixed in versions 1.3.3 and 2.1.2.
CVE-2026-61810 is a vulnerability in libspdm version 1.4.0 where the FINISH request and response messages include new fields (OpaqueDataLength and OpaqueData) that are not covered by the signature or HMAC verification. This omission allows an active attacker to modify the opaque data in transit without detection. The issue was addressed in libspdm version 1.4.1.
OpenSearch Dashboards versions 2.14.0 to before 2.19.6 and 3.0.0 to before 3.7.0 contain a Server-Side Request Forgery (SSRF) vulnerability in the fetchDataSourceMetaData route. This flaw allows an authenticated user to supply internal or loopback endpoints to probe internal network resources because this route does not validate URLs against configured deny or allow lists. The vulnerability has been fixed in versions 2.19.6 and 3.7.0.
CVE-2026-64678 is a critical deserialization vulnerability in nitrite-java versions prior to 4.4.1. The vulnerability arises from unsafe deserialization of legacy database files without any class allowlist or filtering, allowing arbitrary classes on the application classpath to be instantiated during deserialization. This can enable remote code execution if a suitable gadget class is present. The issue is fixed in version 4.4.1.
The npm package 'chalks-log' contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected system should be rotated immediately from a separate, secure machine. Removing the package alone does not guarantee removal of all malicious software, as the attacker may have gained full control of the system.
The npm package @solana-trade/core contains malicious code that compromises any computer on which it is installed or running. Installation of this package can lead to full system compromise, including unauthorized access to secrets and keys stored on the affected machine. Immediate removal of the package and rotation of all secrets and keys from a separate, uncompromised system is strongly advised.
The termchalk npm package contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected machine should be rotated immediately from a separate, secure device. Removal of the package alone does not guarantee elimination of the malicious software, as full control may have been granted to an external attacker.
The npm package 'prettlog' contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected system should be rotated immediately from a different, trusted machine. Removal of the package alone may not eliminate all malicious software introduced by its installation, as full control of the system may have been granted to an attacker.
AstroBlocks versions prior to 3.4.0 contain a critical vulnerability due to a hard-coded fallback JWT secret and a mismatched environment variable name. This flaw allows an attacker who knows the public fallback secret to forge admin session tokens with owner-level privileges, enabling full administrative control over the CMS. The vulnerability is patched in version 3.4.0.
CVE-2026-64669 is an improper authorization vulnerability in pam_usb versions 0.8.0 through before 0.9.3. The flaw arises from incorrect IPv6 address detection in the deny_remote feature, causing remote tmux sessions from compressed IPv6 addresses to be undetected. This allows remote clients to bypass the intended restriction. The issue is fixed in version 0.9.3.
The npm package 'kbmathlessons' contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected computer should be rotated immediately from a different, trusted machine. Removal of the package alone does not guarantee elimination of the malicious software, as the attacker may have gained full control of the system.
CVE-2026-64667 is an out-of-bounds read vulnerability in pam_usb versions prior to 0.9.3. The flaw occurs in the function pusb_get_tty_from_display_server, which reads the /proc/<pid>/cmdline file into a fixed-size buffer without ensuring a null terminator when exactly 4096 bytes are read. This can cause subsequent string operations to read beyond the buffer boundary. The vulnerability is triggered during PAM authentication when the DISPLAY environment variable is set. The impact is limited to potential information disclosure and a possible crash (SIGSEGV) of the PAM process. The issue is fixed in pam_usb version 0.9.3.
A vulnerability in pam_usb prior to version 0.9.3 allows an attacker to bypass the XRDP session denial rule by manipulating the XRDP_SESSION environment variable. This occurs because pam_usb uses the insecure getenv(3) function instead of secure_getenv(3) to read XRDP_SESSION, enabling environment-based detection to be defeated. The issue is fixed in version 0.9.3.
CVE-2026-64668 is an improper authorization vulnerability in pam_usb versions 0.8.0 through before 0.9.3. The flaw arises from incorrect detection of remote tmux sessions due to a regex mismatch caused by IPv6 zone indices in multi-homed Linux systems. This leads to unauthorized access being granted when remote sessions are present. The issue is fixed in version 0.9.3.
Waline versions 3.15.2 and earlier contain a stored cross-site scripting (XSS) vulnerability in the comment editor's live preview feature. The vulnerability arises because the preview uses the marked library without sanitization and injects HTML via v-html. When an administrator edits a comment, the raw, unsanitized comment body is rendered, allowing an unauthenticated attacker to execute stored XSS in the administrator's session by tricking them into clicking Edit on a malicious comment. No patches are publicly available at the time of disclosure.
Waline versions 3.15.2 and earlier contain a stored cross-site scripting (XSS) vulnerability in the @waline/client UserList widget. The widget inserts commenter nicknames and links directly into the DOM without HTML escaping, allowing an unauthenticated attacker to inject malicious scripts via the link field. This script executes automatically in the browsers of all visitors viewing the UserList widget. No patches are publicly available at the time of disclosure.
Padloc versions from 4.0.0 up to but not including 4.3.1 contain an authentication bypass vulnerability in the legacy retrieveMFAToken handler. This flaw allows unauthenticated attackers who know a victim's email address to brute force the 6-digit multi-factor authentication code without incrementing the attempt limit. Successful brute forcing can yield verification tokens that are usable in signup, login, and account recovery processes.