Search vulnerabilities

Expected end of text, found ':' (at char 22), (line:1, col:23)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 425,897

CVE-2026-71214

NASA-AMMOS plandev - Client-Supplied session_variables Bypass Hasura-Origin Authorization in sequencing-server

The Aerie/PlanDev sequencing-server's authorization middleware (sequencing-server/src/app.ts) derives the caller's Hasura session role via getHasuraSession, which prefers a session_variables object taken directly from the client-supplied JSON request body over the Authorization header's JWT claims, with no verification that the request actually originated from Hasura.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Nasa-ammos
Products
Plandev (sequencing-server)
CVE-2026-71213

typemill - No Rate Limiting on Login Endpoint Enables Unlimited Password Brute-Force

Typemill's login endpoint (POST /tm/login, ControllerWebAuth::login) performs no rate-limiting, failed-attempt counting, or account lockout when captcha is disabled, which is the default configuration. An unauthenticated attacker can send unlimited password-guessing requests against any account, including administrators, with no throttling.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed
Vendors
Typemill
Products
Typemill
CVE-2026-71212

xidown - Argument Injection via Unterminated yt-dlp Command Line Construction

xidown (a yt-dlp/ffmpeg GUI wrapper) builds its yt-dlp command-line invocation (xidown/core/scanner.py and downloader.py) by appending the user-provided or scanned URL as a bare trailing positional argument, with no '--' end-of-options marker and no scheme validation anywhere in the codebase.

CVSS 3.1 · 4.4 Medium EPSS < 1% KEV · Not listed
Vendors
Indravoyager
Products
Xidown
CVE-2026-71211

mlflow - Unvalidated Gateway Secret api_base Enables SSRF via Gateway Proxy Endpoint

MLflow's AI Gateway accepts an auth_config.api_base value when creating a gateway secret (mlflow/server/handlers.py, _create_gateway_secret) with no validation of scheme, host, or IP range; the value is stored verbatim. The gateway proxy endpoint (mlflow/server/gateway_api.py, raw_proxy) subsequently issues an HTTP request to that stored api_base plus a caller-supplied path and returns the full response body.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Mlflow
Products
Mlflow
CVE-2026-71210

mealie - DNS-Rebinding TOCTOU in SSRF Guard Allows Internal Network and Cloud Metadata Access

Mealie's AsyncSafeTransport SSRF guard (mealie/pkgs/safehttp/transport.py) resolves a target hostname once, checks the resolved IP against private-range rules, but then issues the actual outbound HTTP request using the original hostname, which the underlying async transport re-resolves independently.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Mealie-recipes
Products
Mealie
CVE-2026-71209

audiobookshelf - %2F Encoding Discrepancy Bypasses Cover/Image Auth Exemption Regex, Enabling Unauthenticated Path Traversal

audiobookshelf's authentication-exemption check (server/routers/Auth.js) matches unauthenticated-allowed GET routes against req.path via a regex requiring a literal /items/:id/cover or /authors/:id/image shape, where req.path retains %2F sequences URL-encoded. CacheManager.handleCoverCache then joins this decoded value into a cache file path and streams the result before any database-backed ownership check.

CVSS 3.1 · 7.5 High EPSS 2.2% KEV · Not listed
Vendors
Advplyr
Products
Audiobookshelf
CVE-2026-71208

KubeSphere - SSRF via Unvalidated Cluster CRD Connection Endpoint in Cluster Reconciliation

KubeSphere's cluster-controller reconciliation (pkg/utils/clusterclient/clusterclient.go, addCluster) processes every Cluster custom resource's connection configuration and immediately calls Discovery.ServerVersion against the CRD-specified Kubernetes API endpoint, which is parsed only for URL syntax (url.Parse) with no allow/deny-list for loopback, RFC1918 private ranges, link-local, or cloud-metadata addresses (e.g. 169.254.169.254).

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Kubesphere
Products
Kubesphere
CVE-2026-71207

Stock-Inventory-Management-System - Unauthenticated SQL Injection and Hardcoded Credentials in login.php Enable Full Authentication Bypass

The Stock-Inventory-Management-System application's login.php assigns raw username/password values to and builds its authentication query by directly concatenating those session values into a SQL statement with no parameterization or escaping. The same script additionally contains hardcoded administrative credentials (admin/neola) in a post-login conditional check, providing a second, independent full-authentication-bypass path.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Swapnilsahu
Products
Stock Management System
CVE-2026-71206

shiori - JWT CheckToken Never Re-Validates Account State, Allowing Stale-Privilege Access After Deletion or Demotion

Shiori's CheckToken function (internal/domains/auth.go) validates only the JWT's HMAC signature and returns the embedded claims.Account object unmodified, never re-fetching the account from the database. No session store or token-revocation mechanism exists in the codebase.

CVSS 3.1 · 8.2 High EPSS < 1% KEV · Not listed
Vendors
Go-shiori
Products
Shiori
CVE-2026-71205

changedetection.io - No Rate Limiting on /login Enables Unlimited Password Brute-Force

changedetection.io's /login route checks the submitted password against a single PBKDF2-HMAC-SHA256 hash with no per-IP or per-session rate limiting, failed-attempt counter, or lockout (no rate-limiting library is present in requirements.txt).

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Dgtlmoon
Products
Changedetection.io
CVE-2026-71204

changedetection.io - Omitted Checkbox in /settings Save Silently Disables API Key Enforcement

changedetection.io's /settings save handler builds an update dict from form.data['application'] and blind-merges it into the stored application settings via .update.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Dgtlmoon
Products
Changedetection.io
CVE-2026-71203

changedetection.io - Missing Authentication on /api/v1/full-spec Discloses Full OpenAPI Schema

changedetection.io's REST API resources are protected by an @auth.check_token decorator validating the caller's x-api-key header, except the Spec resource registered at /api/v1/full-spec (changedetectionio/api/Spec.py), whose get method carries neither @auth.check_token nor @validate_openapi_request.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Dgtlmoon
Products
Changedetection.io
CVE-2026-71202

raster - Integer Underflow in crop() Offset Handling Causes Capacity-Overflow Panic

The raster Rust crate's crop function (src/editor.rs) clamps the crop width/height against source dimensions but only clamps the offset_x/offset_y parameters against 0, never against the source width/height.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Kosinix
Products
Raster
CVE-2026-70378

imagecli - Negative carve Ratio Bypasses Bounds Check and Crashes Process via Reachable Panic

imagecli's pipeline operation (Carve::apply in src/image_ops.rs) only asserts , never validating that the ratio is positive. A negative ratio (e.g. -5) causes the computed target width to saturate to 0 via Rust's defined float-to-uint cast, which is then passed to imageproc::seam_carving::shrink_width — a function that panics when given a width below 2, crashing the process.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Theotherphil
Products
Imagecli
CVE-2026-70377

imagecli - Uncontrolled Memory Allocation via Unbounded scale Ratio Causes Denial of Service

imagecli's pipeline operation (Scale::apply in src/image_ops.rs) computes output width/height as (dimension as f32 * ratio) as u32 with no upper-bound validation on the CLI-supplied ratio, which is parsed via nom::number::complete::float with no range check. Any application embedding imagecli as a library and accepting user-controlled pipeline strings is remotely crashable with a single request.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Theotherphil
Products
Imagecli
CVE-2026-70376

Pluck CMS - CSRF via Spoofable Missing-Referer Bypass Leads to Stored XSS and RCE

Pluck CMS's admin panel relies solely on a Referer-header comparison (requestedByTheSameDomain in data/inc/functions.admin.php, gating every admin.php action) for CSRF protection, with no per-request anti-CSRF token anywhere in the admin area.

CVSS 3.1 · 9.6 Critical EPSS < 1% KEV · Not listed
Vendors
Pluck-cms
Products
Pluckcms
CVE-2026-70375

HashBrown CMS - OS Command Injection via Git Deployer Branch Field

HashBrown CMS through 1.4.6 contains an OS Command Injection vulnerability (CWE-78) in the Git deployer component. GitDeployer.pullRepo in src/Server/Entity/Deployer/GitDeployer.js executes AppService.exec, interpolating the configured branch value directly into a shell command with no escaping.

CVSS 3.1 · 8.8 High EPSS 1.9% KEV · Not listed
Vendors
Hashbrowncms
Products
Hashbrown Cms
CVE-2026-70374

HashBrown CMS - OS Command Injection in Media Upload Thumbnail Generation

HashBrown CMS through 1.4.6 contains an OS Command Injection vulnerability (CWE-78) in the media upload thumbnail generation routine. Media.generateThumbnail in src/Server/Entity/Resource/Media.js builds a temporary file path as 'thumbnail' + Path.extname(filename) and passes it, unescaped, into a shell command executed via AppService.exec ('convert ' + tempFile + ...).

CVSS 3.1 · 8.8 High EPSS 1.9% KEV · Not listed
Vendors
Hashbrowncms
Products
Hashbrown Cms
CVE-2026-70373

Koha - SQL Injection in reports/issues_stats.pl

Koha's reports/issues_stats.pl (the circulation statistics report) builds its calculation query in sub calculate by concatenating several user-controlled request parameters directly into the SQL string. The PeriodTypeSel, PeriodDaySel, and PeriodMonthSel parameters are interpolated raw into single-quoted equality and function-comparison fragments, and the Filter slots plus the Line and Column identifiers are likewise interpolated with no whitelist and no placeholder binding.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Koha-community
Products
Koha
CVE-2026-70372

Koha - SQL Injection in reports/bor_issues_top.pl

Koha's reports/bor_issues_top.pl builds dynamic SQL in sub calculate by concatenating several user-controlled request parameters directly into the query string. An authenticated staff user holding the reports module permission can inject arbitrary SQL and read any table reachable by the Koha database user, including borrowers (password hashes, two-factor secrets, personal data), api_keys, and sessions.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Koha-community
Products
Koha