CVE-2026-71244

Paperless-ngx - Mail Account Test Connection Leaks Stored IMAP/OAuth Credentials to Attacker-Controlled Host

Paperless-ngx's MailAccountViewSet.test action, when called with an existing account's ID and a masked password field, reuses the stored password, account_type, refresh_token, and expiration from that existing account while allowing the caller to supply a different imap_server, imap_port, and imap_security in the same request.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Paperless-ngx

Products

Paperless-ngx

CVE-2026-71243

backmeup (npm) - OS Command Injection via Backup Option Values

The backmeup npm package assembles shell command strings by directly concatenating its option values (name, source, destination, filter) - e.g. cmd = "mkdir -p " + path.join(info.destination, info.name) + "; " - and executes the resulting string through a shell via ssh2-exec (locally via child_process, or remotely via SSH when an ssh handle is supplied), rather than using execFile/spawn with an argument array.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Adaltas

Products

Backmeup

CVE-2026-71242

Crater - Cross-Company IDOR on Notes via Missing Company-Ownership Check in NotePolicy

Crater's NotePolicy checks only a blanket Bouncer ability (manage-all-notes / view-all-notes) with no company-ownership comparison, unlike InvoicePolicy and other sibling policies which additionally verify ->hasCompany(->company_id). Any authenticated user of one company can read, edit, or delete another company's notes by ID.

CVSS 3.1 · 8.2 High EPSS < 1% KEV · Not listed

Vendors

Crater-invoice-inc

Products

Crater

CVE-2026-71241

Book-Management-System - Unauthenticated Disclosure of Student PII and Borrowing History

Book-Management-System's Flask API endpoints /student, /record, /books, /find_stu_book, and /find_not_return_book are missing the @login_required decorator that protects sibling routes (/search_student, /storage) in the same file. Because card_id values are sequential integers, the entire student database can be enumerated without authentication.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Lyric777

Products

Book-management-system

CVE-2026-71240

DjangoCRM - Unauthenticated Open Redirect via toggle_default_sorting next_url Parameter

DjangoCRM's toggle_default_sorting view is the only route in common/urls.py that is not wrapped in login_required or staff_member_required, and it redirects to a caller-supplied next_url GET parameter after only checking secure_url(next_url), which merely verifies the target host matches the current site's domain (blocking only cross-domain redirects) while allowing any same-site path with no authentication required to reach the view.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Djangocrm

Products

Django-crm

CVE-2026-71239

DjangoCRM - Server-Side Template Injection in Mass Mail Message Rendering

DjangoCRM's massmail module renders user-controlled EmlMessage fields (subject, content) through Django's Template constructor with no sanitization, in at least three locations: message_previews.py builds an f-string embedding message.subject/message.content directly into a Template call; email_creators.py passes eml_message.subject directly as a template string to Template; and helpers.py contains the same f-string interpolation pattern.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Djangocrm

Products

Django-crm

CVE-2026-71238

DjangoCRM - Hardcoded Django SECRET_KEY Enables Session and CSRF Token Forgery

DjangoCRM ships with its Django SECRET_KEY hardcoded directly in the committed webcrm/settings.py rather than read from an environment variable. Since this key is used for session signing, CSRF token generation, and password reset tokens, anyone who reads the public repository can forge valid session cookies (including for the superadmin account), forge CSRF tokens, and forge password reset tokens, achieving full account takeover.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed

Vendors

Djangocrm

Products

Django-crm

CVE-2026-71237

Miantang IoT-PHP - Unauthenticated SQL Injection in /userlogin

Miantang/IoT-PHP's index.php implements a POST /userlogin route that reads the password directly from ['pwd'] with no sanitization and concatenates it into a raw SQL string: mysql_query("select * from userlists where username='' and password='' limit 1"). An unauthenticated attacker can submit a payload such as pwd=' OR '1'='1 to bypass authentication and, via UNION-based injection, extract arbitrary data from the database.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Miantang

Products

Iot-php

CVE-2026-71236

Grocy - Stored XSS via HTMLPurifier Output Double-Decode

Grocy's API request-body parser (controllers/Api/BaseApiController.php, GetParsedAndFilteredRequestBody) purifies incoming field values with HTMLPurifier, then manually reverses HTML-entity encoding of the resulting output by replacing &amp;lt;, &amp;gt;, and &amp;amp; back to <, >, and & immediately after purification.

CVSS 3.1 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Grocy

Products

Grocy

CVE-2026-71235

Magistrala IoT Platform - Unrestricted Go/Lua Script Execution in Rules Engine

Magistrala's Rules Engine allows authenticated users to create rules with embedded Go or Lua scripts executed server-side when IoT messages arrive. The Lua script engine (re/lua.go) performs no input validation at all and preloads dangerous libraries: db (arbitrary database access), ioutil (file I/O), an HTTP client (SSRF), and filepath (traversal).

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Absmach

Products

Magistrala

CVE-2026-71234

Documize Community - Attachment Download Authorization Bypass via Non-Validated secure Token

Documize Community's attachment download route (domain/attachment/endpoint.go, Download function, registered via AddPublic with no auth middleware) accepts a query parameter and grants access whenever the parameter is simply non-empty (len(secureToken) > 0), without comparing it to any server-stored value.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Documize

Products

Community

CVE-2026-71233

InvoiceNinja - Stored XSS via Invoice/Quote Terms Field

InvoiceNinja v5-stable renders an invoice or quote's "terms" field in the client portal using Laravel Blade's raw output directive {!! ->terms !!} (resources/views/portal/ninja2020/invoices/includes/terms.blade.php) with no HTML sanitization.

CVSS 3.1 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Invoiceninja

Products

Invoice Ninja

CVE-2026-71232

MacCMS10 - Incomplete Function Blacklist in Template Editor Enables Authenticated RCE

MacCMS10's admin template editor (application/admin/controller/Template.php) blocks dangerous PHP functions in template content via a blacklist regex, but the blacklist omitted exec, passthru, popen, show_source, create_function, register_shutdown_function, register_tick_function, and error_log.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

Magicblack

Products

Maccms

CVE-2026-71231

IOTSmartHome - Unauthenticated SQL Injection via lastLogin Cookie

IOTSmartHome's gui/login.php checkCookie function builds an authentication query as SELECT * FROM users WHERE ID='<decoded lastLogin cookie>' after base64-decoding the client-supplied lastLogin cookie via safe_decode, which performs URL-safe base64 decoding with no sanitization of the decoded value before it is concatenated into the SQL string.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Thebradleysanders

Products

Iotsmarthome

CVE-2026-71215

art-template - Path Traversal in Sub-Template Resolution via include()/extend()

art-template's sub-template resolution logic (src/compile/adapter/resolve-filename.js), used by both the include and extend template directives, resolves the target file path via path.resolve(root, filename) with no check afterward that the result remains inside root.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Art-template

Products

Art-template

CVE-2026-71214

NASA-AMMOS plandev - Client-Supplied session_variables Bypass Hasura-Origin Authorization in sequencing-server

The Aerie/PlanDev sequencing-server's authorization middleware (sequencing-server/src/app.ts) derives the caller's Hasura session role via getHasuraSession, which prefers a session_variables object taken directly from the client-supplied JSON request body over the Authorization header's JWT claims, with no verification that the request actually originated from Hasura.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Nasa-ammos

Products

Plandev (sequencing-server)

CVE-2026-71213

typemill - No Rate Limiting on Login Endpoint Enables Unlimited Password Brute-Force

Typemill's login endpoint (POST /tm/login, ControllerWebAuth::login) performs no rate-limiting, failed-attempt counting, or account lockout when captcha is disabled, which is the default configuration. An unauthenticated attacker can send unlimited password-guessing requests against any account, including administrators, with no throttling.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed

Vendors

Typemill

Products

Typemill

CVE-2026-71212

xidown - Argument Injection via Unterminated yt-dlp Command Line Construction

xidown (a yt-dlp/ffmpeg GUI wrapper) builds its yt-dlp command-line invocation (xidown/core/scanner.py and downloader.py) by appending the user-provided or scanned URL as a bare trailing positional argument, with no '--' end-of-options marker and no scheme validation anywhere in the codebase.

CVSS 3.1 · 4.4 Medium EPSS < 1% KEV · Not listed

Vendors

Indravoyager

Products

Xidown

CVE-2026-71211

mlflow - Unvalidated Gateway Secret api_base Enables SSRF via Gateway Proxy Endpoint

MLflow's AI Gateway accepts an auth_config.api_base value when creating a gateway secret (mlflow/server/handlers.py, _create_gateway_secret) with no validation of scheme, host, or IP range; the value is stored verbatim. The gateway proxy endpoint (mlflow/server/gateway_api.py, raw_proxy) subsequently issues an HTTP request to that stored api_base plus a caller-supplied path and returns the full response body.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Mlflow

Products

Mlflow

CVE-2026-71210

mealie - DNS-Rebinding TOCTOU in SSRF Guard Allows Internal Network and Cloud Metadata Access

Mealie's AsyncSafeTransport SSRF guard (mealie/pkgs/safehttp/transport.py) resolves a target hostname once, checks the resolved IP against private-range rules, but then issues the actual outbound HTTP request using the original hostname, which the underlying async transport re-resolves independently.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Mealie-recipes

Products

Mealie