CVE-2026-51251

Buffer Overflow in ESP32‑audioI2S MP3 Decoder due to Missing Size Validation

DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.

CVSS n/a EPSS n/a KEV · Not listed

Vendors

Schreibfaul1

Products

Esp32-audioi2s

CVE-2026-51252

Buffer Overflow in MP3 Decoder of schreibfaul1 ESP32‑audioI2S Enables Remote Code Execution

DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.

CVSS n/a EPSS n/a KEV · Not listed

Vendors

Schreibfaul1

Products

Esp32-audioi2s

CVE-2026-51261

Race Condition in ESP32-audioI2S Allows Heap Out-of-Bounds Write and Arbitrary Code Execution

DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.

CVSS n/a EPSS n/a KEV · Not listed

Vendors

Schreibfaul1

Products

Esp32-audioi2s

CVE-2026-51266

ESP32-audioI2S Heap-Based Buffer Overflow Allowing Remote Code Execution

DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.

CVSS n/a EPSS n/a KEV · Not listed

Vendors

Schreibfaul1

Products

Esp32-audioi2s

CVE-2026-51268

Heap‑Based Buffer Overflow in ESP32‑audioI2S 3.4.5 Host Parsing

DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.

CVSS n/a EPSS n/a KEV · Not listed

Vendors

Schreibfaul1

Products

Esp32-audioi2s

CVE-2026-51271

Heap Overflow in ESP32‑audioI2S WAV Header Parsing

DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.

CVSS n/a EPSS n/a KEV · Not listed

Vendors

Schreibfaul1

Products

Esp32-audioi2s

CVE-2026-51273

Heap‑Based Buffer Overflow in ESP32‑audioI2S ID3 Tag Parsing Function

DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.

CVSS n/a EPSS n/a KEV · Not listed

Vendors

Schreibfaul1

Products

Esp32-audioi2s

CVE-2026-51274

Heap‑Based Buffer Overflow in ESP32‑audioI2S ID3v2 SYLT Lyrics Parser

DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.

CVSS n/a EPSS n/a KEV · Not listed

Vendors

Schreibfaul1

Products

Esp32-audioi2s

CVE-2026-51270

Heap‑Based Buffer Overflow in ESP32‑audioI2S Leading to Remote Code Execution

DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.

CVSS n/a EPSS n/a KEV · Not listed

Vendors

Schreibfaul1

Products

Esp32-audioi2s

CVE-2026-17524

Directory Traversal in zip-lib via Caching Path Validation

Versions of the package zip-lib before 1.1.0 are vulnerable to Directory Traversal via the caching mechanism for path validation during the extraction process. An attacker can bypass security checks designed to prevent directory traversal. The intended security function, isOutsideTargetFolder, only checks and caches the path status when the initial directory symlink is created during the first extraction.

CVSS 4.0 · 8.7 High EPSS 1.2% KEV · Not listed

Vendors

Fpsqdb

Products

Zip-lib

CVE-2026-45377

Decidim: Private exports can be downloaded through reusable links

Decidim is a participatory democracy framework. Prior to 0.30.9, from 0.31.0 before 0.31.5, and in 0.32.0.rc1 before 0.32.0.rc2, the normal download_your_data flow requires the requester to be logged in as the export owner, but the resulting Active Storage blob redirect URL can be replayed without authentication by anyone who obtains it. This is because Decidim::DownloadYourDataController#download_file authenticates the export owner but redirects to a signed Active Storage blob URL that is no longer bound to the owner session. This issue is fixed in versions 0.30.9, 0.31.5, and 0.32.0.rc2.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Decidim

Products

Decidim

CVE-2026-55825

Contao: Possible path traversal in job download URIs

Contao is an Open Source CMS. In versions 5.7.0 through 5.7.6, an authenticated backend user who can access one job can request an attachment identifier containing ../ segments and make the job attachment download endpoint read a file from another job directory inside var/job-attachments. The controller authorizes only the jobUuid route parameter. The later attachment lookup joins that authorized job UUID with the attacker-controlled identifier, then passes the combined path to the virtual filesystem. VirtualFilesystem::resolve() canonicalizes the whole path and only rejects paths that escape the filesystem mount, so authorized-job/../victim-job/debug_log.csv becomes victim-job/debug_log.csv. This is a cross-job authorization bypass for known job attachment paths. It is not a practical brute-force against unknown jobs because job directories are UUID v4 values.

CVSS 3.1 · 3.1 Low EPSS < 1% KEV · Not listed

Vendors

Contao

Products

Contao

CVE-2026-5056

GStreamer qtdemux Stack-based Buffer Overflow Remote Code Execution Vulnerability

GStreamer qtdemux Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on the implementation. The specific flaw exists within the parsing of UncompressedFrameConfigBox structures. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-29392.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Gstreamer

Products

Gstreamer

CVE-2026-54707

OnionShare Receive mode writes uploaded files even when file uploads are disabled

OnionShare is an open source tool that lets you securely and anonymously share files, host websites, and chat with friends using the Tor network. Prior to 2.6.4, OnionShare CLI/Desktop does not enforce the Receive mode disable_files setting in cli/onionshare_cli/web/receive_mode.py, where ReceiveModeRequest._get_file_stream() writes multipart file[] data to disk despite the text-only setting. This issue is fixed in version 2.6.4.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Onionshare

Products

Onionshare

CVE-2026-67350

Serendipity < 2.6.1 Open Redirect via exit.php

Serendipity before 2.6.1 contains an open redirect vulnerability in exit.php that allows unauthenticated attackers to redirect users to arbitrary external sites by supplying a malicious Base64-encoded url parameter when the Track Exits plugin is configured with commentredirection set to s9y. Attackers can craft trusted-looking URLs leveraging the legitimate blog domain to conduct phishing, deliver malware, or bypass URL reputation filters.

CVSS 4.0 · 2.1 Low EPSS < 1% KEV · Not listed

Vendors

S9y

Products

Serendipity

CVE-2026-17567

Fluent Forms <= 6.2.8 - Unauthenticated Sensitive Information Exposure via Insecure Direct Object Reference and Weak Transaction Hash in 'transaction' Parameter

The Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 6.2.8 via the 'transaction' parameter due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to brute-force valid transaction hashes and view sensitive payment receipt data including customer name, email address, billing address, order items, payment method, and payment status belonging to other users. Because submission ID, form ID, and transaction creation time are either observable or guessable by an attacker, the effective brute-force space is bounded to approximately 900 candidates per second per (submission, form) pair, making exploitation practical without any prior authentication or account.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Wordpress Wpmanageninja

Products

Wordpress Fluent Forms

CVE-2026-55499

Cloudreve: Broken access control in file event stream leaks activity events for unshared siblings to single-file share recipients

Cloudreve is a self-hosted file management and sharing system. Prior to 4.17.0, a single-file share event-stream subscription resolves the share root to the owner’s parent folder and subscribes to that folder topic, allowing an authenticated share recipient to receive names, paths, rename targets, event types, and hashed identifiers for unshared sibling files and folders. This issue is fixed in version 4.17.0.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Cloudreve

Products

Cloudreve

CVE-2026-62246

Kamaji: TenantControlPlane namespace/name collision binds two tenants to the same SQL datastore schema + DB user, breaking per-tenant isolation

Kamaji is the Hosted Control Plane Manager for Kubernetes. Prior to 26.7.4-edge, Kamaji derives a TenantControlPlane datastore schema, database user, and etcd key prefix from a lossy namespace-and-name normalization in GetDefaultDatastoreSchema() and GetDefaultDatastoreUsername(), allowing distinct tenants with colliding normalized identifiers to share control-plane state and read, modify, or destroy another tenant's Kubernetes data. This issue is fixed in version 26.7.4-edge.

CVSS 3.1 · 8.5 High EPSS < 1% KEV · Not listed

Vendors

Clastix

Products

Kamaji

CVE-2026-67528

OpenProject: Improper Access Control through /api/v3/custom_options/:id via Path "id" leads to Sensitive Data Exposure

OpenProject is open-source, web-based project management software. Prior to 17.6.0, GET /api/v3/custom_options/:id resolved CustomOption records by global numeric id and allowed UserCustomField and GroupCustomField options without checking visible(current_user), so authenticated non-admin users could enumerate sequential custom option ids and read labels belonging to admin_only user or group custom fields. This issue is fixed in 17.6.0.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Opf

Products

Openproject

CVE-2026-10700

Broken Access Control Vulnerabilities in Langflow 1.0.0 - 1.8.4 File Handling API Allowed Unauthorized Access to User Files

IBM Langflow OSS 1.0.0 through 1.8.4 contains multiple broken access control vulnerabilities in its file handling API that allow unauthorized access to user files.The /api/v1/files/images/{flow_id}/{file_name} endpoint does not enforce authentication or authorization checks, allowing unauthenticated remote attackers to retrieve image files associated with any flow by specifying a valid flow_id and file_name.Additionally, the /api/v1/files/download/{flow_id}/{file_name} endpoint requires authentication but fails to properly validate ownership of the requested resource. As a result, an authenticated user can access files belonging to other users by supplying arbitrary identifiers, leading to an authorization bypass (IDOR).Successful exploitation may result in unauthorized disclosure of sensitive data, including files stored in private flows. This issue breaks tenant isolation in multi-user deployments.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Ibm Langflow

Products

Langflow Oss Langflow