CVE-2026-70377

imagecli - Uncontrolled Memory Allocation via Unbounded scale Ratio Causes Denial of Service

imagecli's pipeline operation (Scale::apply in src/image_ops.rs) computes output width/height as (dimension as f32 * ratio) as u32 with no upper-bound validation on the CLI-supplied ratio, which is parsed via nom::number::complete::float with no range check. Any application embedding imagecli as a library and accepting user-controlled pipeline strings is remotely crashable with a single request.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Theotherphil

Products

Imagecli

CVE-2026-70376

Pluck CMS - CSRF via Spoofable Missing-Referer Bypass Leads to Stored XSS and RCE

Pluck CMS's admin panel relies solely on a Referer-header comparison (requestedByTheSameDomain in data/inc/functions.admin.php, gating every admin.php action) for CSRF protection, with no per-request anti-CSRF token anywhere in the admin area.

CVSS 3.1 · 9.6 Critical EPSS < 1% KEV · Not listed

Vendors

Pluck-cms

Products

Pluckcms

CVE-2026-70375

HashBrown CMS - OS Command Injection via Git Deployer Branch Field

HashBrown CMS through 1.4.6 contains an OS Command Injection vulnerability (CWE-78) in the Git deployer component. GitDeployer.pullRepo in src/Server/Entity/Deployer/GitDeployer.js executes AppService.exec, interpolating the configured branch value directly into a shell command with no escaping.

CVSS 3.1 · 8.8 High EPSS 1.9% KEV · Not listed

Vendors

Hashbrowncms

Products

Hashbrown Cms

CVE-2026-70374

HashBrown CMS - OS Command Injection in Media Upload Thumbnail Generation

HashBrown CMS through 1.4.6 contains an OS Command Injection vulnerability (CWE-78) in the media upload thumbnail generation routine. Media.generateThumbnail in src/Server/Entity/Resource/Media.js builds a temporary file path as 'thumbnail' + Path.extname(filename) and passes it, unescaped, into a shell command executed via AppService.exec ('convert ' + tempFile + ...).

CVSS 3.1 · 8.8 High EPSS 1.9% KEV · Not listed

Vendors

Hashbrowncms

Products

Hashbrown Cms

CVE-2026-70373

Koha - SQL Injection in reports/issues_stats.pl

Koha's reports/issues_stats.pl (the circulation statistics report) builds its calculation query in sub calculate by concatenating several user-controlled request parameters directly into the SQL string. The PeriodTypeSel, PeriodDaySel, and PeriodMonthSel parameters are interpolated raw into single-quoted equality and function-comparison fragments, and the Filter slots plus the Line and Column identifiers are likewise interpolated with no whitelist and no placeholder binding.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Koha-community

Products

Koha

CVE-2026-70372

Koha - SQL Injection in reports/bor_issues_top.pl

Koha's reports/bor_issues_top.pl builds dynamic SQL in sub calculate by concatenating several user-controlled request parameters directly into the query string. An authenticated staff user holding the reports module permission can inject arbitrary SQL and read any table reachable by the Koha database user, including borrowers (password hashes, two-factor secrets, personal data), api_keys, and sessions.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Koha-community

Products

Koha

CVE-2026-70371

Koha - SQL Injection in reports/issues_avg_stats.pl

Koha's reports/issues_avg_stats.pl builds dynamic SQL in sub calculate by concatenating several user-controlled request parameters directly into the query string. The Line and Column parameters are not validated against any whitelist and land verbatim in identifier positions (SELECT DISTINCTROW, GROUP BY, ORDER BY), and each Filter slot is concatenated raw into single-quoted LIKE, BETWEEN, and comparison fragments with no bound parameters.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Koha-community

Products

Koha

CVE-2026-70370

Koha - SQL Injection in reports/catalogue_stats.pl

Koha's reports/catalogue_stats.pl builds dynamic SQL in sub calculate by interpolating the user-controlled Line and Column request parameters directly into identifier positions of the query (SELECT DISTINCTROW, GROUP BY, ORDER BY) with no whitelist validation.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Koha-community

Products

Koha

CVE-2026-70369

Koha - SQL Injection in reports/acquisitions_stats.pl

Koha's reports/acquisitions_stats.pl builds its per-cell statistics query in sub calculate by interpolating the user-controlled Filter request parameters directly into WHERE fragments covering aqbasket.closedate, aqorders.datereceived, aqbooksellers.name, items.homebranch, items.ccode, biblioitems.itemtype, aqbudgets.budget_code, aqorders.sort1, and aqorders.sort2.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Koha-community

Products

Koha

CVE-2026-6428

Koha SQL Injection in reports/catalogue_out.pl via Filter URL Parameter

SQL Injection in reports/catalogue_out.pl in Koha Community Koha through 22.11.37, 23.x, 24.x before 24.11.16, 25.05.x before 25.05.11, 25.11.x before 25.11.05, 26.05.x before 26.05.01, and 26.11.x before 26.11.00 allows an authenticated staff user with the Reports module flag to read arbitrary data from the Koha application database via the Filter URL parameter when the Criteria parameter matches /branchcode/.

CVSS 4.0 · 5.6 Medium EPSS < 1% KEV · Not listed

Vendors

Koha-community

Products

Koha

CVE-2026-55747

PocketFlow - Path Traversal in pocketflow-coding-agent Cookbook Example File Tools

The pocketflow-coding-agent cookbook example in The-Pocket/PocketFlow implements a helper as a thin os.path.join(workdir, p) wrapper with no canonicalization or containment check, used unguarded by the ReadFile, ListFiles, PatchRead, and PatchApply file-access tools. Severity reflects that this affects an illustrative cookbook example rather than a core library API; applications that copy this pattern into production are affected.

CVSS 3.1 · 6.8 Medium EPSS < 1% KEV · Not listed

Vendors

The-pocket

Products

Pocketflow (pocketflow-coding-agent Cookbook Example)

CVE-2026-55746

Cotonti stored XSS via PFS folder title

Cotonti 1.0.0 (master branch, commit f43f1fc3) is vulnerable to stored Cross-Site Scripting in the Personal File Storage (PFS) module. A folder title (pff_title) is imported with the 'TXT' filter, which does not strip or encode HTML (the tag check in cot_import is disabled), so an authenticated user can store HTML/JavaScript in a folder title.

CVSS 4.0 · 7 High EPSS < 1% KEV · Not listed

Vendors

Cotonti

Products

Cotonti

CVE-2026-55745

Cotonti CSRF in PFS folder edit allows unauthorized folder modification

Cotonti 1.0.0 (master branch, commit f43f1fc3) is vulnerable to Cross-Site Request Forgery in the Personal File Storage (PFS) module. In modules/pfs/inc/pfs.editfolder.php, the folder update action ('a=update') updates folder metadata (title, description, public/gallery flags) without calling cot_check_xg to validate the anti-CSRF token.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Cotonti

Products

Cotonti

CVE-2026-55744

Cotonti CSRF in PFS allows forced arbitrary file upload

Cotonti 1.0.0 (master branch, commit f43f1fc3) is vulnerable to Cross-Site Request Forgery in the Personal File Storage (PFS) module. In modules/pfs/inc/pfs.main.php, the file upload action ('a=upload') processes uploaded files without calling cot_check_xg to validate the anti-CSRF token, even though sibling actions such as 'delete' (line 272) do.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed

Vendors

Cotonti

Products

Cotonti

CVE-2026-55743

OpenHuman desktop agent shell tool sandbox bypass leads to arbitrary command execution

The shell tool command allowlist in the SecurityPolicy of OpenHuman desktop agent through 0.54.0 (default Supervised security policy) can be bypassed to execute arbitrary OS commands with the privileges of the desktop user.

CVSS 4.0 · 9.4 Critical EPSS < 1% KEV · Not listed

Vendors

Tinyhumansai

Products

Openhuman

CVE-2026-55742

Cotonti CSRF in admin.rights.php allows privilege escalation

Cotonti 1.0.0 (master branch, commit f43f1fc3) is vulnerable to Cross-Site Request Forgery in the administration rights handler. In system/admin/admin.rights.php, the rights update action ('a=update') modifies group access rights (including via cot_auth_add_group) without calling cot_check_xg to validate the anti-CSRF token.

CVSS 4.0 · 9.4 Critical EPSS < 1% KEV · Not listed

Vendors

Cotonti

Products

Cotonti

CVE-2026-55741

Cotonti CSRF in admin.config.php allows unauthorized configuration changes

Cotonti 1.0.0 (master branch, commit f43f1fc3) is vulnerable to Cross-Site Request Forgery in the administration configuration handler. In system/admin/admin.config.php, the configuration update action ('a=update') processes POST data via cot_config_update_options without calling cot_check_xg to validate the anti-CSRF token (the 'x' parameter), unlike other admin handlers (e.g. admin.structure.php, admin.cache.php).

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Cotonti

Products

Cotonti

CVE-2026-55740

SQL Injection in Nur-Alam39 bus-ticket bus_info.php via busid parameter

Nur-Alam39 bus-ticket (no released versions; latest commit 459cabdbeb99c00225b26e46e3c2c30ae1de7bad) contains an unauthenticated SQL injection vulnerability in bus_info.php. The busid parameter received via HTTP POST is concatenated directly into a MySQL query (select * from bus_info where id=) without sanitization, escaping, or parameterization, and in a numeric (unquoted) context.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Nur-alam39

Products

Bus-ticket

CVE-2026-55739

Crater - Missing Tenant-Ownership Check in CustomerPolicy Allows Cross-Company Customer Data Theft and Deletion

Crater isolates data per company_id, and its Invoice/Estimate/Payment/Expense policies enforce both a Bouncer ability check and ->hasCompany(->company_id). CustomerPolicy's view/update/delete methods omit the company-ownership check entirely, checking only the blanket ability. Route-model-bound customer lookups and the bulk Customer::deleteCustomers method are similarly unscoped (self::find with no company filter).

CVSS 3.1 · 8.2 High EPSS < 1% KEV · Not listed

Vendors

Crater-invoice-inc

Products

Crater

CVE-2026-55738

Stack Buffer Overflow in rxi/microtar raw_to_header() via non-null-terminated TAR name field

A stack-based buffer overflow exists in the raw_to_header function in src/microtar.c in rxi microtar 0.1.0. The function copies the 100-byte name and linkname fields of a TAR header with strcpy without guaranteeing null termination of the source.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Rxi

Products

Microtar