CVE-2026-55746

Cotonti stored XSS via PFS folder title

Cotonti 1.0.0 (master branch, commit f43f1fc3) is vulnerable to stored Cross-Site Scripting in the Personal File Storage (PFS) module. A folder title (pff_title) is imported with the 'TXT' filter, which does not strip or encode HTML (the tag check in cot_import is disabled), so an authenticated user can store HTML/JavaScript in a folder title.

CVSS 4.0 · 7 High EPSS < 1% KEV · Not listed

Vendors

Cotonti

Products

Cotonti

CVE-2026-55745

Cotonti CSRF in PFS folder edit allows unauthorized folder modification

Cotonti 1.0.0 (master branch, commit f43f1fc3) is vulnerable to Cross-Site Request Forgery in the Personal File Storage (PFS) module. In modules/pfs/inc/pfs.editfolder.php, the folder update action ('a=update') updates folder metadata (title, description, public/gallery flags) without calling cot_check_xg to validate the anti-CSRF token.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Cotonti

Products

Cotonti

CVE-2026-55744

Cotonti CSRF in PFS allows forced arbitrary file upload

Cotonti 1.0.0 (master branch, commit f43f1fc3) is vulnerable to Cross-Site Request Forgery in the Personal File Storage (PFS) module. In modules/pfs/inc/pfs.main.php, the file upload action ('a=upload') processes uploaded files without calling cot_check_xg to validate the anti-CSRF token, even though sibling actions such as 'delete' (line 272) do.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed

Vendors

Cotonti

Products

Cotonti

CVE-2026-55743

OpenHuman desktop agent shell tool sandbox bypass leads to arbitrary command execution

The shell tool command allowlist in the SecurityPolicy of OpenHuman desktop agent through 0.54.0 (default Supervised security policy) can be bypassed to execute arbitrary OS commands with the privileges of the desktop user.

CVSS 4.0 · 9.4 Critical EPSS < 1% KEV · Not listed

Vendors

Tinyhumansai

Products

Openhuman

CVE-2026-55742

Cotonti CSRF in admin.rights.php allows privilege escalation

Cotonti 1.0.0 (master branch, commit f43f1fc3) is vulnerable to Cross-Site Request Forgery in the administration rights handler. In system/admin/admin.rights.php, the rights update action ('a=update') modifies group access rights (including via cot_auth_add_group) without calling cot_check_xg to validate the anti-CSRF token.

CVSS 4.0 · 9.4 Critical EPSS < 1% KEV · Not listed

Vendors

Cotonti

Products

Cotonti

CVE-2026-55741

Cotonti CSRF in admin.config.php allows unauthorized configuration changes

Cotonti 1.0.0 (master branch, commit f43f1fc3) is vulnerable to Cross-Site Request Forgery in the administration configuration handler. In system/admin/admin.config.php, the configuration update action ('a=update') processes POST data via cot_config_update_options without calling cot_check_xg to validate the anti-CSRF token (the 'x' parameter), unlike other admin handlers (e.g. admin.structure.php, admin.cache.php).

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Cotonti

Products

Cotonti

CVE-2026-55740

SQL Injection in Nur-Alam39 bus-ticket bus_info.php via busid parameter

Nur-Alam39 bus-ticket (no released versions; latest commit 459cabdbeb99c00225b26e46e3c2c30ae1de7bad) contains an unauthenticated SQL injection vulnerability in bus_info.php. The busid parameter received via HTTP POST is concatenated directly into a MySQL query (select * from bus_info where id=) without sanitization, escaping, or parameterization, and in a numeric (unquoted) context.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Nur-alam39

Products

Bus-ticket

CVE-2026-55739

Crater - Missing Tenant-Ownership Check in CustomerPolicy Allows Cross-Company Customer Data Theft and Deletion

Crater isolates data per company_id, and its Invoice/Estimate/Payment/Expense policies enforce both a Bouncer ability check and ->hasCompany(->company_id). CustomerPolicy's view/update/delete methods omit the company-ownership check entirely, checking only the blanket ability. Route-model-bound customer lookups and the bulk Customer::deleteCustomers method are similarly unscoped (self::find with no company filter).

CVSS 3.1 · 8.2 High EPSS < 1% KEV · Not listed

Vendors

Crater-invoice-inc

Products

Crater

CVE-2026-55738

Stack Buffer Overflow in rxi/microtar raw_to_header() via non-null-terminated TAR name field

A stack-based buffer overflow exists in the raw_to_header function in src/microtar.c in rxi microtar 0.1.0. The function copies the 100-byte name and linkname fields of a TAR header with strcpy without guaranteeing null termination of the source.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Rxi

Products

Microtar

CVE-2026-54419

PIAF-HMS multiple unauthenticated SQL injection vulnerabilities via mysql_query

claudiopizzillo PIAF-HMS (PBX-In-A-Flash Hotel Management System; no released versions, latest commit 389d2633441b65ced1c104212cd62be2bfca21e5) contains multiple unauthenticated SQL injection vulnerabilities. The application has no authentication mechanism and passes user-supplied HTTP parameters directly into deprecated mysql_query calls via string concatenation, without sanitization, escaping, or parameterization.

CVSS 4.0 · 9.3 Critical EPSS 1.5% KEV · Not listed

Vendors

Claudiopizzillo

Products

Piaf-hms

CVE-2026-54418

Leantime - Missing Authorization on TwoFA JSON-RPC Methods Allows Cross-Account 2FA Secret Disclosure and Bypass

Leantime through 3.6.2 exposes the JSON-RPC methods leantime.rpc.TwoFA.TwoFA.getSetupData, saveSecret, verifyAndEnable, and disable2FA, which act on a caller-supplied userId parameter with no ownership check, session pinning, or permission-attribute gate (unlike other RPC-exposed methods in the same dispatcher).

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Leantime

Products

Leantime

CVE-2026-54417

Integer Overflow in rxi/microtar mtar_next() Causes Infinite Loop DoS

An integer overflow in the mtar_next function in src/microtar.c in rxi microtar 0.1.0 allows a remote attacker to cause a denial of service (uncontrolled CPU consumption / infinite loop) via a crafted tar archive. mtar_next computes the offset to the next record as round_up(h.size, 512) + sizeof(mtar_raw_header_t) using 32-bit arithmetic.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Rxi

Products

Microtar

CVE-2026-54416

Pluck CMS - Unrestricted File Upload via Missing .php8 Extension in Upload Blacklist

Pluck CMS through 4.7.21 restricts dangerous file uploads in its admin file-management feature using a fixed blacklist in data/inc/files.php ('.php','php3','php4','php5','php6','php7','phtml','.phtm','.pht','.ph3','.ph4','.ph5','.asp','.cgi','.phar'), checked against the last 4-5 characters of the filename.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

Pluck-cms

Products

Pluckcms

CVE-2026-54415

Broken Access Control in Azuriom CMS Server Routes Allows Account Takeover

Missing Authorization in the server management routes (routes/admin.php) in Azuriom Azuriom CMS before 1.2.11 on all platforms allows an authenticated attacker with the admin.access permission to create AzLink server tokens and take over non-admin user accounts by changing their passwords and email addresses via crafted HTTP requests to /admin/servers/create and the AzLink API endpoints (/api/azlink/password, /api/azlink/email, /api/azlink/user/{id}).

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed

Vendors

Azuriom

Products

Azuriom

CVE-2026-54414

FileRise shared-folder upload path traversal allows arbitrary file write and admin takeover

FileRise before 3.16.0 is vulnerable to path traversal in the shared-folder upload endpoint (/api/folder/uploadToSharedFolder.php), leading to arbitrary file write and administrator account takeover. The upload filename is validated by FolderController with basename and REGEX_FILE_NAME, which permit URL-encoded sequences (the regex blocks / and \ but not %).

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Error311

Products

Filerise

CVE-2026-54413

iso14229 Integer Underflow and Out-of-Bounds Read in Handle_0x27_SecurityAccess()

driftregion iso14229 through 0.9.0 contains an integer underflow and downstream out-of-bounds read in the Handle_0x27_SecurityAccess function in iso14229.c that allows a remote unauthenticated attacker to crash a UDS server and potentially read memory past the receive buffer by sending a single-byte 0x27 SecurityAccess request that follows any earlier well-formed 0x27 message.

CVSS 4.0 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Driftregion

Products

Iso14229

CVE-2026-54411

Linux-PAM pam_userdb Observable Timing Discrepancy in Plaintext Password Comparison

Linux-PAM through 1.7.2 contains an observable timing discrepancy (CWE-208) in the pam_userdb module's plaintext-password comparison path in modules/pam_userdb/pam_userdb.c that allows a local or network-adjacent attacker able to repeatedly drive authentication through a calling service to recover the plaintext password of a target account by measuring response-timing differences.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Linux-pam

Products

Linux-pam

CVE-2026-54410

nanoMODBUS Off-by-One Buffer Overflow in recv_msg_header() via Crafted MBAP Length Field

nanoMODBUS through v1.23.0 contains an off-by-one buffer overflow in the recv_msg_header function of the Modbus/TCP server that allows remote unauthenticated attackers to write one attacker-controlled byte past the end of the 260-byte receive buffer by sending a crafted MBAP frame whose Length field is set to 255.

CVSS 4.0 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Debevv

Products

Nanomodbus

CVE-2026-4809

Unsafe Client MIME Type Handling Can Enable Arbitrary File Upload in plank/laravel-mediable

plank/laravel-mediable through version 6.4.0 can allow upload of a dangerous file type when an application using the package accepts or prefers a client-supplied MIME type during file upload handling. In that configuration, a remote attacker can submit a file containing executable PHP code while declaring a benign image MIME type, resulting in arbitrary file upload.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Plank

Products

Laravel-mediable

CVE-2026-3945

tinyproxy Integer Overflow in HTTP Chunked Transfer-Encoding Parser Leading to Denial of Service

An integer overflow vulnerability in the HTTP chunked transfer encoding parser in tinyproxy up to and including version 1.11.3 allows an unauthenticated remote attacker to cause a denial of service (DoS). The issue occurs because chunk size values are parsed using strtol without properly validating overflow conditions (e.g., errno == ERANGE).

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Tinyproxy

Products

Tinyproxy