CVE-2026-71205

changedetection.io - No Rate Limiting on /login Enables Unlimited Password Brute-Force

changedetection.io's /login route checks the submitted password against a single PBKDF2-HMAC-SHA256 hash with no per-IP or per-session rate limiting, failed-attempt counter, or lockout (no rate-limiting library is present in requirements.txt).

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Dgtlmoon

Products

Changedetection.io

CVE-2026-71204

changedetection.io - Omitted Checkbox in /settings Save Silently Disables API Key Enforcement

changedetection.io's /settings save handler builds an update dict from form.data['application'] and blind-merges it into the stored application settings via .update.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Dgtlmoon

Products

Changedetection.io

CVE-2026-71203

changedetection.io - Missing Authentication on /api/v1/full-spec Discloses Full OpenAPI Schema

changedetection.io's REST API resources are protected by an @auth.check_token decorator validating the caller's x-api-key header, except the Spec resource registered at /api/v1/full-spec (changedetectionio/api/Spec.py), whose get method carries neither @auth.check_token nor @validate_openapi_request.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Dgtlmoon

Products

Changedetection.io

CVE-2026-71202

raster - Integer Underflow in crop() Offset Handling Causes Capacity-Overflow Panic

The raster Rust crate's crop function (src/editor.rs) clamps the crop width/height against source dimensions but only clamps the offset_x/offset_y parameters against 0, never against the source width/height.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Kosinix

Products

Raster

CVE-2026-70378

imagecli - Negative carve Ratio Bypasses Bounds Check and Crashes Process via Reachable Panic

imagecli's pipeline operation (Carve::apply in src/image_ops.rs) only asserts , never validating that the ratio is positive. A negative ratio (e.g. -5) causes the computed target width to saturate to 0 via Rust's defined float-to-uint cast, which is then passed to imageproc::seam_carving::shrink_width — a function that panics when given a width below 2, crashing the process.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Theotherphil

Products

Imagecli

CVE-2026-70377

imagecli - Uncontrolled Memory Allocation via Unbounded scale Ratio Causes Denial of Service

imagecli's pipeline operation (Scale::apply in src/image_ops.rs) computes output width/height as (dimension as f32 * ratio) as u32 with no upper-bound validation on the CLI-supplied ratio, which is parsed via nom::number::complete::float with no range check. Any application embedding imagecli as a library and accepting user-controlled pipeline strings is remotely crashable with a single request.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Theotherphil

Products

Imagecli

CVE-2026-70376

Pluck CMS - CSRF via Spoofable Missing-Referer Bypass Leads to Stored XSS and RCE

Pluck CMS's admin panel relies solely on a Referer-header comparison (requestedByTheSameDomain in data/inc/functions.admin.php, gating every admin.php action) for CSRF protection, with no per-request anti-CSRF token anywhere in the admin area.

CVSS 3.1 · 9.6 Critical EPSS < 1% KEV · Not listed

Vendors

Pluck-cms

Products

Pluckcms

CVE-2026-70375

HashBrown CMS - OS Command Injection via Git Deployer Branch Field

HashBrown CMS through 1.4.6 contains an OS Command Injection vulnerability (CWE-78) in the Git deployer component. GitDeployer.pullRepo in src/Server/Entity/Deployer/GitDeployer.js executes AppService.exec, interpolating the configured branch value directly into a shell command with no escaping.

CVSS 3.1 · 8.8 High EPSS 1.9% KEV · Not listed

Vendors

Hashbrowncms

Products

Hashbrown Cms

CVE-2026-70374

HashBrown CMS - OS Command Injection in Media Upload Thumbnail Generation

HashBrown CMS through 1.4.6 contains an OS Command Injection vulnerability (CWE-78) in the media upload thumbnail generation routine. Media.generateThumbnail in src/Server/Entity/Resource/Media.js builds a temporary file path as 'thumbnail' + Path.extname(filename) and passes it, unescaped, into a shell command executed via AppService.exec ('convert ' + tempFile + ...).

CVSS 3.1 · 8.8 High EPSS 1.9% KEV · Not listed

Vendors

Hashbrowncms

Products

Hashbrown Cms

CVE-2026-70373

Koha - SQL Injection in reports/issues_stats.pl

Koha's reports/issues_stats.pl (the circulation statistics report) builds its calculation query in sub calculate by concatenating several user-controlled request parameters directly into the SQL string. The PeriodTypeSel, PeriodDaySel, and PeriodMonthSel parameters are interpolated raw into single-quoted equality and function-comparison fragments, and the Filter slots plus the Line and Column identifiers are likewise interpolated with no whitelist and no placeholder binding.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Koha-community

Products

Koha

CVE-2026-70372

Koha - SQL Injection in reports/bor_issues_top.pl

Koha's reports/bor_issues_top.pl builds dynamic SQL in sub calculate by concatenating several user-controlled request parameters directly into the query string. An authenticated staff user holding the reports module permission can inject arbitrary SQL and read any table reachable by the Koha database user, including borrowers (password hashes, two-factor secrets, personal data), api_keys, and sessions.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Koha-community

Products

Koha

CVE-2026-70371

Koha - SQL Injection in reports/issues_avg_stats.pl

Koha's reports/issues_avg_stats.pl builds dynamic SQL in sub calculate by concatenating several user-controlled request parameters directly into the query string. The Line and Column parameters are not validated against any whitelist and land verbatim in identifier positions (SELECT DISTINCTROW, GROUP BY, ORDER BY), and each Filter slot is concatenated raw into single-quoted LIKE, BETWEEN, and comparison fragments with no bound parameters.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Koha-community

Products

Koha

CVE-2026-70370

Koha - SQL Injection in reports/catalogue_stats.pl

Koha's reports/catalogue_stats.pl builds dynamic SQL in sub calculate by interpolating the user-controlled Line and Column request parameters directly into identifier positions of the query (SELECT DISTINCTROW, GROUP BY, ORDER BY) with no whitelist validation.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Koha-community

Products

Koha

CVE-2026-70369

Koha - SQL Injection in reports/acquisitions_stats.pl

Koha's reports/acquisitions_stats.pl builds its per-cell statistics query in sub calculate by interpolating the user-controlled Filter request parameters directly into WHERE fragments covering aqbasket.closedate, aqorders.datereceived, aqbooksellers.name, items.homebranch, items.ccode, biblioitems.itemtype, aqbudgets.budget_code, aqorders.sort1, and aqorders.sort2.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Koha-community

Products

Koha

CVE-2026-6428

Koha SQL Injection in reports/catalogue_out.pl via Filter URL Parameter

SQL Injection in reports/catalogue_out.pl in Koha Community Koha through 22.11.37, 23.x, 24.x before 24.11.16, 25.05.x before 25.05.11, 25.11.x before 25.11.05, 26.05.x before 26.05.01, and 26.11.x before 26.11.00 allows an authenticated staff user with the Reports module flag to read arbitrary data from the Koha application database via the Filter URL parameter when the Criteria parameter matches /branchcode/.

CVSS 4.0 · 5.6 Medium EPSS < 1% KEV · Not listed

Vendors

Koha-community

Products

Koha

CVE-2026-55747

PocketFlow - Path Traversal in pocketflow-coding-agent Cookbook Example File Tools

The pocketflow-coding-agent cookbook example in The-Pocket/PocketFlow implements a helper as a thin os.path.join(workdir, p) wrapper with no canonicalization or containment check, used unguarded by the ReadFile, ListFiles, PatchRead, and PatchApply file-access tools. Severity reflects that this affects an illustrative cookbook example rather than a core library API; applications that copy this pattern into production are affected.

CVSS 3.1 · 6.8 Medium EPSS < 1% KEV · Not listed

Vendors

The-pocket

Products

Pocketflow (pocketflow-coding-agent Cookbook Example)

CVE-2026-55746

Cotonti stored XSS via PFS folder title

Cotonti 1.0.0 (master branch, commit f43f1fc3) is vulnerable to stored Cross-Site Scripting in the Personal File Storage (PFS) module. A folder title (pff_title) is imported with the 'TXT' filter, which does not strip or encode HTML (the tag check in cot_import is disabled), so an authenticated user can store HTML/JavaScript in a folder title.

CVSS 4.0 · 7 High EPSS < 1% KEV · Not listed

Vendors

Cotonti

Products

Cotonti

CVE-2026-55745

Cotonti CSRF in PFS folder edit allows unauthorized folder modification

Cotonti 1.0.0 (master branch, commit f43f1fc3) is vulnerable to Cross-Site Request Forgery in the Personal File Storage (PFS) module. In modules/pfs/inc/pfs.editfolder.php, the folder update action ('a=update') updates folder metadata (title, description, public/gallery flags) without calling cot_check_xg to validate the anti-CSRF token.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Cotonti

Products

Cotonti

CVE-2026-55744

Cotonti CSRF in PFS allows forced arbitrary file upload

Cotonti 1.0.0 (master branch, commit f43f1fc3) is vulnerable to Cross-Site Request Forgery in the Personal File Storage (PFS) module. In modules/pfs/inc/pfs.main.php, the file upload action ('a=upload') processes uploaded files without calling cot_check_xg to validate the anti-CSRF token, even though sibling actions such as 'delete' (line 272) do.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed

Vendors

Cotonti

Products

Cotonti

CVE-2026-55743

OpenHuman desktop agent shell tool sandbox bypass leads to arbitrary command execution

The shell tool command allowlist in the SecurityPolicy of OpenHuman desktop agent through 0.54.0 (default Supervised security policy) can be bypassed to execute arbitrary OS commands with the privileges of the desktop user.

CVSS 4.0 · 9.4 Critical EPSS < 1% KEV · Not listed

Vendors

Tinyhumansai

Products

Openhuman