CVE-2026-71234

Documize Community - Attachment Download Authorization Bypass via Non-Validated secure Token

Documize Community's attachment download route (domain/attachment/endpoint.go, Download function, registered via AddPublic with no auth middleware) accepts a query parameter and grants access whenever the parameter is simply non-empty (len(secureToken) > 0), without comparing it to any server-stored value.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Documize

Products

Community

CVE-2026-71233

InvoiceNinja - Stored XSS via Invoice/Quote Terms Field

InvoiceNinja v5-stable renders an invoice or quote's "terms" field in the client portal using Laravel Blade's raw output directive {!! ->terms !!} (resources/views/portal/ninja2020/invoices/includes/terms.blade.php) with no HTML sanitization.

CVSS 3.1 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Invoiceninja

Products

Invoice Ninja

CVE-2026-71232

MacCMS10 - Incomplete Function Blacklist in Template Editor Enables Authenticated RCE

MacCMS10's admin template editor (application/admin/controller/Template.php) blocks dangerous PHP functions in template content via a blacklist regex, but the blacklist omitted exec, passthru, popen, show_source, create_function, register_shutdown_function, register_tick_function, and error_log.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

Magicblack

Products

Maccms

CVE-2026-71231

IOTSmartHome - Unauthenticated SQL Injection via lastLogin Cookie

IOTSmartHome's gui/login.php checkCookie function builds an authentication query as SELECT * FROM users WHERE ID='<decoded lastLogin cookie>' after base64-decoding the client-supplied lastLogin cookie via safe_decode, which performs URL-safe base64 decoding with no sanitization of the decoded value before it is concatenated into the SQL string.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Thebradleysanders

Products

Iotsmarthome

CVE-2026-71215

art-template - Path Traversal in Sub-Template Resolution via include()/extend()

art-template's sub-template resolution logic (src/compile/adapter/resolve-filename.js), used by both the include and extend template directives, resolves the target file path via path.resolve(root, filename) with no check afterward that the result remains inside root.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Art-template

Products

Art-template

CVE-2026-71214

NASA-AMMOS plandev - Client-Supplied session_variables Bypass Hasura-Origin Authorization in sequencing-server

The Aerie/PlanDev sequencing-server's authorization middleware (sequencing-server/src/app.ts) derives the caller's Hasura session role via getHasuraSession, which prefers a session_variables object taken directly from the client-supplied JSON request body over the Authorization header's JWT claims, with no verification that the request actually originated from Hasura.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Nasa-ammos

Products

Plandev (sequencing-server)

CVE-2026-71213

typemill - No Rate Limiting on Login Endpoint Enables Unlimited Password Brute-Force

Typemill's login endpoint (POST /tm/login, ControllerWebAuth::login) performs no rate-limiting, failed-attempt counting, or account lockout when captcha is disabled, which is the default configuration. An unauthenticated attacker can send unlimited password-guessing requests against any account, including administrators, with no throttling.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed

Vendors

Typemill

Products

Typemill

CVE-2026-71212

xidown - Argument Injection via Unterminated yt-dlp Command Line Construction

xidown (a yt-dlp/ffmpeg GUI wrapper) builds its yt-dlp command-line invocation (xidown/core/scanner.py and downloader.py) by appending the user-provided or scanned URL as a bare trailing positional argument, with no '--' end-of-options marker and no scheme validation anywhere in the codebase.

CVSS 3.1 · 4.4 Medium EPSS < 1% KEV · Not listed

Vendors

Indravoyager

Products

Xidown

CVE-2026-71211

mlflow - Unvalidated Gateway Secret api_base Enables SSRF via Gateway Proxy Endpoint

MLflow's AI Gateway accepts an auth_config.api_base value when creating a gateway secret (mlflow/server/handlers.py, _create_gateway_secret) with no validation of scheme, host, or IP range; the value is stored verbatim. The gateway proxy endpoint (mlflow/server/gateway_api.py, raw_proxy) subsequently issues an HTTP request to that stored api_base plus a caller-supplied path and returns the full response body.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Mlflow

Products

Mlflow

CVE-2026-71210

mealie - DNS-Rebinding TOCTOU in SSRF Guard Allows Internal Network and Cloud Metadata Access

Mealie's AsyncSafeTransport SSRF guard (mealie/pkgs/safehttp/transport.py) resolves a target hostname once, checks the resolved IP against private-range rules, but then issues the actual outbound HTTP request using the original hostname, which the underlying async transport re-resolves independently.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Mealie-recipes

Products

Mealie

CVE-2026-71209

audiobookshelf - %2F Encoding Discrepancy Bypasses Cover/Image Auth Exemption Regex, Enabling Unauthenticated Path Traversal

audiobookshelf's authentication-exemption check (server/routers/Auth.js) matches unauthenticated-allowed GET routes against req.path via a regex requiring a literal /items/:id/cover or /authors/:id/image shape, where req.path retains %2F sequences URL-encoded. CacheManager.handleCoverCache then joins this decoded value into a cache file path and streams the result before any database-backed ownership check.

CVSS 3.1 · 7.5 High EPSS 2.2% KEV · Not listed

Vendors

Advplyr

Products

Audiobookshelf

CVE-2026-71208

KubeSphere - SSRF via Unvalidated Cluster CRD Connection Endpoint in Cluster Reconciliation

KubeSphere's cluster-controller reconciliation (pkg/utils/clusterclient/clusterclient.go, addCluster) processes every Cluster custom resource's connection configuration and immediately calls Discovery.ServerVersion against the CRD-specified Kubernetes API endpoint, which is parsed only for URL syntax (url.Parse) with no allow/deny-list for loopback, RFC1918 private ranges, link-local, or cloud-metadata addresses (e.g. 169.254.169.254).

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Kubesphere

Products

Kubesphere

CVE-2026-71207

Stock-Inventory-Management-System - Unauthenticated SQL Injection and Hardcoded Credentials in login.php Enable Full Authentication Bypass

The Stock-Inventory-Management-System application's login.php assigns raw username/password values to and builds its authentication query by directly concatenating those session values into a SQL statement with no parameterization or escaping. The same script additionally contains hardcoded administrative credentials (admin/neola) in a post-login conditional check, providing a second, independent full-authentication-bypass path.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Swapnilsahu

Products

Stock Management System

CVE-2026-71206

shiori - JWT CheckToken Never Re-Validates Account State, Allowing Stale-Privilege Access After Deletion or Demotion

Shiori's CheckToken function (internal/domains/auth.go) validates only the JWT's HMAC signature and returns the embedded claims.Account object unmodified, never re-fetching the account from the database. No session store or token-revocation mechanism exists in the codebase.

CVSS 3.1 · 8.2 High EPSS < 1% KEV · Not listed

Vendors

Go-shiori

Products

Shiori

CVE-2026-71205

changedetection.io - No Rate Limiting on /login Enables Unlimited Password Brute-Force

changedetection.io's /login route checks the submitted password against a single PBKDF2-HMAC-SHA256 hash with no per-IP or per-session rate limiting, failed-attempt counter, or lockout (no rate-limiting library is present in requirements.txt).

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Dgtlmoon

Products

Changedetection.io

CVE-2026-71204

changedetection.io - Omitted Checkbox in /settings Save Silently Disables API Key Enforcement

changedetection.io's /settings save handler builds an update dict from form.data['application'] and blind-merges it into the stored application settings via .update.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Dgtlmoon

Products

Changedetection.io

CVE-2026-71203

changedetection.io - Missing Authentication on /api/v1/full-spec Discloses Full OpenAPI Schema

changedetection.io's REST API resources are protected by an @auth.check_token decorator validating the caller's x-api-key header, except the Spec resource registered at /api/v1/full-spec (changedetectionio/api/Spec.py), whose get method carries neither @auth.check_token nor @validate_openapi_request.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Dgtlmoon

Products

Changedetection.io

CVE-2026-71202

raster - Integer Underflow in crop() Offset Handling Causes Capacity-Overflow Panic

The raster Rust crate's crop function (src/editor.rs) clamps the crop width/height against source dimensions but only clamps the offset_x/offset_y parameters against 0, never against the source width/height.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Kosinix

Products

Raster

CVE-2026-70378

imagecli - Negative carve Ratio Bypasses Bounds Check and Crashes Process via Reachable Panic

imagecli's pipeline operation (Carve::apply in src/image_ops.rs) only asserts , never validating that the ratio is positive. A negative ratio (e.g. -5) causes the computed target width to saturate to 0 via Rust's defined float-to-uint cast, which is then passed to imageproc::seam_carving::shrink_width — a function that panics when given a width below 2, crashing the process.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Theotherphil

Products

Imagecli

CVE-2026-70377

imagecli - Uncontrolled Memory Allocation via Unbounded scale Ratio Causes Denial of Service

imagecli's pipeline operation (Scale::apply in src/image_ops.rs) computes output width/height as (dimension as f32 * ratio) as u32 with no upper-bound validation on the CLI-supplied ratio, which is parsed via nom::number::complete::float with no range check. Any application embedding imagecli as a library and accepting user-controlled pipeline strings is remotely crashable with a single request.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Theotherphil

Products

Imagecli