CVE-2026-57989
Origin validation error in Microsoft Edge (Chromium-based) allows an unauthorized attacker to disclose information over a network.
PUBLISHED
- Vendor
- Microsoft
- Product
- Microsoft Edge (Chromium-based)
- Provider severity
- HIGH
- Conflicts
- 0
Data & Insights
CVE Explorer
Search one exact, source-linked CVE snapshot by CVE ID or explicit vendor and product tokens. Provider severity, KEV, conflicts, and stale state remain separate observations—not a Baitaphish risk rating.
Exact snapshot results
353,537 CVE records
CVE-2026-57988
Relative path traversal in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.
PUBLISHED
- Vendor
- Microsoft
- Product
- Microsoft Edge (Chromium-based)
- Provider severity
- HIGH
- Conflicts
- 0
CVE-2026-57987
Server-side request forgery (ssrf) in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network.
PUBLISHED
- Vendor
- Microsoft
- Product
- Microsoft Edge (Chromium-based)
- Provider severity
- MEDIUM
- Conflicts
- 0
CVE-2026-57986
Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.
PUBLISHED
- Vendor
- Microsoft
- Product
- Microsoft Edge (Chromium-based)
- Provider severity
- HIGH
- Conflicts
- 0
CVE-2026-57985
Improper input validation in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.
PUBLISHED
- Vendor
- Microsoft
- Product
- Microsoft Edge (Chromium-based)
- Provider severity
- HIGH
- Conflicts
- 0
CVE-2026-57984
Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.
PUBLISHED
- Vendor
- Microsoft
- Product
- Microsoft Edge (Chromium-based)
- Provider severity
- HIGH
- Conflicts
- 0
CVE-2026-57983
Improper authorization in Microsoft Edge (Chromium-based) allows an unauthorized attacker to bypass a security feature over a network.
PUBLISHED
- Vendor
- Microsoft
- Product
- Microsoft Edge (Chromium-based)
- Provider severity
- HIGH
- Conflicts
- 0
CVE-2026-57982
Use of uninitialized resource in Windows RDP allows an authorized attacker to disclose information over a network.
PUBLISHED
- Vendor
- Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft
- Product
- Windows Server 2025 (Server Core installation), Windows 10 Version 22H2, Windows Server 2019 (Server Core installation), Windows Server 2016, Windows Server 2012 R2 (Server Core installation), Windows Server 2012, Windows Server 2012 R2, Windows 10 Version 1809, Windows 11 version 26H1, Windows Server 2016 (Server Core installation), Windows 11 Version 25H2, Windows 10 Version 1607, Windows Server 2012 (Server Core installation), Windows 11 Version 24H2, Windows Server 2019, Windows Server 2025, Windows 10 Version 21H2, Windows Server 2022
- Provider severity
- MEDIUM
- Conflicts
- 1
CVE-2026-57981
Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.
PUBLISHED
- Vendor
- Microsoft
- Product
- Microsoft Edge (Chromium-based)
- Provider severity
- HIGH
- Conflicts
- 0
CVE-2026-57980
Authentication bypass using an alternate path or channel in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform tampering over a network.
PUBLISHED
- Vendor
- Microsoft
- Product
- Microsoft Edge (Chromium-based)
- Provider severity
- MEDIUM
- Conflicts
- 0
CVE-2026-5798
Unsafe object reference (IDOR) in Stel Order v3.25.1 and earlier versions, specifically in the ‘/app/FrontController’ endpoint, through manipulation of the ‘employeeID’ parameter. An authenticated attacker could exploit this vulnerability to access information about any employee (first names, last names, roles, job titles, and vacation records, among others) by modifying that identifier in requests sent to the server.
PUBLISHED
- Vendor
- Stel Order
- Product
- Stel Order
- Provider severity
- HIGH
- Conflicts
- 0
CVE-2026-57979
Out-of-bounds read in Windows RDP allows an unauthorized attacker to disclose information over a network.
PUBLISHED
- Vendor
- Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft
- Product
- Windows Server 2016 (Server Core installation), Windows Server 2016, Windows 11 version 26H1, Windows Server 2012 R2 (Server Core installation), Windows Server 2019 (Server Core installation), Windows Server 2019, Windows 10 Version 1607, Windows 10 Version 22H2, Windows 10 Version 21H2, Windows Server 2025 (Server Core installation), Windows 11 Version 24H2, Windows Server 2012 R2, Windows 11 Version 25H2, Windows Server 2025, Windows Server 2022, Windows 10 Version 1809
- Provider severity
- MEDIUM
- Conflicts
- 1
CVE-2026-57978
Origin validation error in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network.
PUBLISHED
- Vendor
- Microsoft
- Product
- Microsoft Edge (Chromium-based)
- Provider severity
- MEDIUM
- Conflicts
- 0
CVE-2026-57977
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network.
PUBLISHED
- Vendor
- Microsoft
- Product
- Microsoft Edge (Chromium-based)
- Provider severity
- HIGH
- Conflicts
- 0
CVE-2026-57976
Null pointer dereference in Active Directory Domain Services allows an authorized attacker to deny service over a network.
PUBLISHED
- Vendor
- Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft
- Product
- Windows Server 2016, Windows Server 2025 (Server Core installation), Windows Server 2025, Windows 11 version 26H1, Windows Server 2012 R2, Windows 10 Version 1809, Windows Server 2012, Windows Server 2022, Windows 10 Version 21H2, Windows Server 2012 (Server Core installation), Windows Server 2019, Windows Server 2019 (Server Core installation), Windows Server 2012 R2 (Server Core installation), Windows 11 Version 25H2, Windows 11 Version 24H2, Windows 10 Version 22H2, Windows Server 2016 (Server Core installation), Windows 10 Version 1607
- Provider severity
- MEDIUM
- Conflicts
- 1
CVE-2026-57975
Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.
PUBLISHED
- Vendor
- Microsoft
- Product
- Microsoft Edge (Chromium-based)
- Provider severity
- HIGH
- Conflicts
- 0
CVE-2026-57974
Integer overflow or wraparound in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.
PUBLISHED
- Vendor
- Microsoft
- Product
- Microsoft Edge (Chromium-based)
- Provider severity
- HIGH
- Conflicts
- 0
CVE-2026-57973
Time-of-check time-of-use (toctou) race condition in Windows Subsystem for Linux allows an authorized attacker to perform tampering locally.
PUBLISHED
- Vendor
- Microsoft
- Product
- Windows Subsystem for Linux (WSL2)
- Provider severity
- MEDIUM
- Conflicts
- 0
CVE-2026-5797
The Quiz And Survey Master plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in versions up to and including 11.1.0. This is due to insufficient input sanitization and the execution of do_shortcode() on user-submitted quiz answer text. User-submitted answers pass through sanitize_text_field() and htmlspecialchars(), which only strip HTML tags but do not encode or remove shortcode brackets [ and ]. When quiz results are displayed, the plugin calls do_shortcode() on the entire re
PUBLISHED
- Vendor
- expresstech
- Product
- Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker
- Provider severity
- MEDIUM
- Conflicts
- 0
CVE-2026-57969
Missing authentication for critical function in Azure CycleCloud allows an authorized attacker to elevate privileges over a network.
PUBLISHED
- Vendor
- Microsoft
- Product
- Azure CycleCloud 8.9.1
- Provider severity
- HIGH
- Conflicts
- 0
CVE-2026-57968
Buffer over-read in Windows Subsystem for Linux allows an authorized attacker to elevate privileges locally.
PUBLISHED
- Vendor
- Microsoft
- Product
- Windows Subsystem for Linux (WSL2)
- Provider severity
- HIGH
- Conflicts
- 0
CVE-2026-57966
A path traversal vulnerability was found in spice-vdagent. This flaw allows a malicious or compromised SPICE host to write arbitrary files to any location on the guest operating system. This occurs because the filename provided by the SPICE host during file transfers is not properly sanitized before being used. An attacker could exploit this to write to sensitive locations with the privileges of the spice-vdagent process, typically the logged-in user. This issue requires the SPICE host to be unt
PUBLISHED
- Vendor
- Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat
- Product
- Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 9
- Provider severity
- MEDIUM
- Conflicts
- 1
CVE-2026-57965
A flaw was found in spice-vdagent. A malicious or compromised SPICE host can trigger an integer overflow by sending a specially crafted message. This vulnerability can lead to a heap buffer overflow, causing the spice-vdagent daemon to crash and resulting in a Denial of Service (DoS) for the virtual machine. This issue requires the SPICE host to be untrusted or compromised for exploitation.
PUBLISHED
- Vendor
- Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat
- Product
- Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 9
- Provider severity
- MEDIUM
- Conflicts
- 1
CVE-2026-57963
An attacker who can send HTML chat messages (via Matrix or XMPP) can inject arbitrary styled content, phishing links, and CSS that manipulates the chat UI. This vulnerability was fixed in Thunderbird 152.0.1 and Thunderbird 140.12.1.
PUBLISHED
- Vendor
- Mozilla
- Product
- Thunderbird
- Provider severity
- MEDIUM
- Conflicts
- 0
CVE-2026-57962
A malicious LDAP server, which a Thunderbird user is configured to query for address-book autocomplete, can stash arbitrarily large amounts of attacker-supplied data into the Thunderbird LDAP client until it crashes due to memory exhaustion. This vulnerability was fixed in Thunderbird 152.0.1 and Thunderbird 140.12.1.
PUBLISHED
- Vendor
- Mozilla
- Product
- Thunderbird
- Provider severity
- MEDIUM
- Conflicts
- 0
CVE-2026-57961
phpMyFAQ before 4.1.5 contains a potential authenticated path traversal vulnerability in the concatenatePaths() function within src/phpMyFAQ/Export/Pdf/Wrapper.php. A user with FAQ editing privileges can store HTML containing crafted image paths that are processed during PDF generation. The path resolution logic locates the substring "content" within a user-controlled path using strpos(); when "content" is absent, strpos() returns false, which becomes 0 when cast to an integer, preserving the en
PUBLISHED
- Vendor
- phpMyFAQ
- Product
- phpMyFAQ
- Provider severity
- LOW, MEDIUM
- Conflicts
- 1
CVE-2026-57960
Hi.Events through 1.9.0 public check-in list endpoints use short_id as sole access control, allowing unauthenticated access to retrieve full attendee lists including emails and personal information. Attackers with knowledge of the short_id can call GET /api/public/check-in-lists/{short_id}/attendees to read attendee data and create or delete check-in records without authentication.
PUBLISHED
- Vendor
- HiEventsDev
- Product
- Hi.Events
- Provider severity
- HIGH, MEDIUM
- Conflicts
- 1
CVE-2026-5796
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.6 before 18.11.6, 19.0 before 19.0.3, and 19.1 before 19.1.1 that under certain conditions could have allowed an authenticated user with Reporter-level group permissions to view package metadata from projects with the Package Registry disabled due to incorrect authorization checks in the group packages feature.
PUBLISHED
- Vendor
- GitLab
- Product
- GitLab
- Provider severity
- MEDIUM
- Conflicts
- 0
CVE-2026-57959
Hi.Events through 1.9.0 contains a promo code validation vulnerability where reservation validates usage count before asynchronous UpdateEventStatisticsJob increments it, allowing attackers to redeem limited promo codes unlimited times. Attackers can sequentially reserve multiple orders with the same restricted promo code, each reading order_usage_count=0 and passing validation, then complete them all at discounted prices without concurrent requests.
PUBLISHED
- Vendor
- HiEventsDev
- Product
- Hi.Events
- Provider severity
- HIGH, MEDIUM
- Conflicts
- 1
CVE-2026-57958
Mixpost through 2.6.0 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to execute arbitrary JavaScript in authenticated users' browsers by crafting malicious OAuth callback URLs with unsanitized error query parameters. Attackers can exploit the OAuth callback controller's failure to sanitize error parameters before rendering them through Laravel flash messages via the Vue v-html directive to hijack authenticated user sessions or perform unauthorized a
PUBLISHED
- Vendor
- inovector
- Product
- mixpost
- Provider severity
- MEDIUM
- Conflicts
- 1
CVE-2026-57957
Papermark through 0.22.0 contains a cross-origin resource sharing (CORS) misconfiguration vulnerability that allows unauthenticated remote attackers to perform credentialed cross-origin requests by exploiting the TUS-based viewer upload endpoint reflecting arbitrary request Origins with Access-Control-Allow-Credentials set to true. Attackers can lure authenticated victims to malicious pages that silently issue credentialed cross-origin requests to upload arbitrary files into victim datarooms and
PUBLISHED
- Vendor
- papermark
- Product
- papermark
- Provider severity
- LOW, MEDIUM
- Conflicts
- 1
CVE-2026-57956
SigNoz before 0.133.0 contains a broken access control vulnerability that allows authenticated users to access other organizations' alert rules by supplying a target rule UUID, as the alert rule store predicates fail to filter by organization ID. Attackers can read, edit, and delete alert rules belonging to other organizations by exploiting the missing tenant isolation check, bypassing multi-tenant access controls.
PUBLISHED
- Vendor
- SigNoz
- Product
- signoz
- Provider severity
- MEDIUM
- Conflicts
- 1
CVE-2026-57955
SigNoz through 0.130.1 contains a SQL injection vulnerability that allows authenticated attackers to execute arbitrary ClickHouse queries by injecting URL-encoded quotes into the rule ID path parameter of the alert-history endpoints. Attackers can manipulate the unsanitized rule ID interpolated into ClickHouse queries to read all stored traces, logs, and metrics, or abuse the url() function to perform server-side request forgery.
PUBLISHED
- Vendor
- SigNoz
- Product
- signoz
- Provider severity
- HIGH
- Conflicts
- 1
CVE-2026-57954
Elide through 7.1.17 fails to enforce @ReadPermission on client-supplied sort expressions in SortingImpl.getValidSortingRules, allowing attackers to sort collections by forbidden fields. Attackers can infer hidden field values through row ordering analysis, leaking relative field ordering across all rows via both JSON:API and GraphQL read paths.
PUBLISHED
- Vendor
- yahoo
- Product
- elide
- Provider severity
- MEDIUM
- Conflicts
- 1
CVE-2026-57953
Mythic before 3.4.0.60 contains an authorization bypass vulnerability that allows authenticated spectator-role users to perform unauthorized write operations by accessing the eventing_import_automatic_webhook endpoint registered under spectator-permitted middleware. Attackers with spectator role can exploit this misconfigured access control to create and delete automation workflows, making unauthorized modifications to operation automation configuration and EventGroups.
PUBLISHED
- Vendor
- its-a-feature
- Product
- Mythic
- Provider severity
- MEDIUM
- Conflicts
- 1
CVE-2026-57952
Mythic before 3.4.0.60 contains an authorization bypass vulnerability in four REST endpoints (c2profile_config_check_webhook, c2profile_redirect_rules_webhook, c2profile_get_ioc_webhook, c2profile_sample_message_webhook) that fail to verify payload ownership. An operator in one operation can invoke these endpoints with a known payload UUID from another operation to access that operation's C2 profile configuration including encryption keys and callback parameters.
PUBLISHED
- Vendor
- its-a-feature
- Product
- Mythic
- Provider severity
- MEDIUM
- Conflicts
- 1
CVE-2026-57951
Mythic before 3.4.0.60 contains a broken hasura permission filter on the payload_build_step table with an always-satisfied _or condition that bypasses operation-scoped access controls. Authenticated operators and spectators can query payload_build_step to read step_stdout, step_stderr, step_name, and step_description across all operations on the server.
PUBLISHED
- Vendor
- its-a-feature
- Product
- Mythic
- Provider severity
- HIGH, MEDIUM
- Conflicts
- 1
CVE-2026-57950
ruoyi-vue-pro through 2026.05, fixed in commit 5d1fd70 contains a broken access control vulnerability in ErpSaleOrderController that allows attackers with erp:sale-out permissions to gain unauthorized access to sale order operations by exploiting an incorrect permission namespace enforcement. Attackers holding shipment-level permissions can perform unauthorized create, update, delete, and read operations on financially sensitive sale orders due to the controller enforcing erp:sale-out instead of
PUBLISHED
- Vendor
- Yunai
- Product
- ruoyi-vue-pro
- Provider severity
- HIGH
- Conflicts
- 1
CVE-2026-5795
In Eclipse Jetty, the class JASPIAuthenticator initiates the authentication checks, which set two ThreadLocal variable. Upon returning from the initial checks, there are conditions that cause an early return from the JASPIAuthenticator code without clearing those ThreadLocals. A subsequent request using the same thread inherits the ThreadLocal values, leading to a broken access control and privilege escalation.
PUBLISHED
- Vendor
- Red Hat, Red Hat, Red Hat, Red Hat, Eclipse Foundation, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat
- Product
- Red Hat JBoss Enterprise Application Platform 8, Red Hat Offline Knowledge Portal 1.2.5, Red Hat OpenShift Dev Spaces, Red Hat JBoss Enterprise Application Platform Expansion Pack, Eclipse Jetty, Red Hat JBoss Enterprise Application Platform Expansion Pack, Red Hat build of Apache Camel 4.18.1 for Spring Boot 3.5.14, Red Hat JBoss Enterprise Application Platform 8, Red Hat JBoss Enterprise Application Platform Expansion Pack, Red Hat JBoss Enterprise Application Platform 8, Red Hat OpenShift Dev Spaces, Red Hat JBoss Enterprise Application Platform Expansion Pack, streams for Apache Kafka 3, Red Hat JBoss Enterprise Application Platform 8, Red Hat JBoss Enterprise Application Platform Expansion Pack, Red Hat JBoss Enterprise Application Platform 8, Red Hat JBoss Enterprise Application Platform Expansion Pack, Red Hat JBoss Enterprise Application Platform Expansion Pack, streams for Apache Kafka 3, Red Hat JBoss Enterprise Application Platform Expansion Pack, Red Hat JBoss Enterprise Application Platform Expansion Pack, Red Hat JBoss Enterprise Application Platform Expansion Pack, Red Hat JBoss Enterprise Application Platform 8, Red Hat JBoss Enterprise Application Platform Expansion Pack, Red Hat JBoss Enterprise Application Platform 8, Red Hat JBoss Enterprise Application Platform 8, Red Hat JBoss Enterprise Application Platform Expansion Pack, Red Hat JBoss Enterprise Application Platform Expansion Pack, Red Hat JBoss Enterprise Application Platform 8, Red Hat JBoss Enterprise Application Platform 8, Red Hat JBoss Enterprise Application Platform Expansion Pack, Red Hat JBoss Enterprise Application Platform 8, Red Hat JBoss Enterprise Application Platform Expansion Pack, Red Hat build of Apache Camel 4.18.1 for Spring Boot 3.5.14, Red Hat JBoss Enterprise Application Platform 8, HawtIO HawtIO 4.4.0, Red Hat JBoss Enterprise Application Platform Expansion Pack, Red Hat JBoss Enterprise Application Platform 8, Red Hat JBoss Enterprise Application Platform 8, Red Hat JBoss Enterprise Application Platform 8, Red Hat Data Grid 8, Red Hat JBoss Enterprise Application Platform 8
- Provider severity
- HIGH
- Conflicts
- 2
CVE-2026-57949
ruoyi-vue-pro through 2026.05, fixed in commit c779a47, contains a missing authorization vulnerability in the CRM module's GET /admin-api/crm/follow-up-record/get endpoint that allows authenticated users to read any follow-up record by iterating sequential numeric IDs. Attackers can exploit this by sending requests with arbitrary ID parameters to access other users' follow-up notes, file attachments, scheduling information, and business entity references without proper authorization checks.
PUBLISHED
- Vendor
- Yunai
- Product
- ruoyi-vue-pro
- Provider severity
- HIGH, MEDIUM
- Conflicts
- 1
CVE-2026-57948
Pinpoint through version 3.1.0 contains an insecure session management vulnerability that allows attackers to access the pinpointJwt session cookie due to missing HttpOnly and Secure attributes, enabling JavaScript access via document.cookie and cleartext transmission over HTTP. Attackers can exploit stored or reflected cross-site scripting vulnerabilities to exfiltrate the session token or intercept it through network sniffing to perform session hijacking.
PUBLISHED
- Vendor
- pinpoint-apm
- Product
- pinpoint
- Provider severity
- HIGH, MEDIUM
- Conflicts
- 2
CVE-2026-57947
Pinpoint through 3.1.0 contains a server-side request forgery vulnerability in the webhook registration endpoint that allows authenticated users to register internal URLs due to missing SSRF protection. Attackers can trigger alarm threshold breaches to force the server to issue POST requests to internal hosts and metadata endpoints, enabling unauthorized access to internal network resources.
PUBLISHED
- Vendor
- pinpoint-apm
- Product
- pinpoint
- Provider severity
- HIGH, MEDIUM
- Conflicts
- 1
CVE-2026-57946
Invidious before version 2.20260626.0 contains a broken access control vulnerability that allows unauthenticated attackers to retrieve private playlist contents by accessing the RSS feed playlist endpoint without authentication. Attackers can supply a playlist ID to the feed endpoint to obtain the full playlist contents, owner email address, and associated video entries without any authentication.
PUBLISHED
- Vendor
- iv-org
- Product
- Invidious
- Provider severity
- LOW, MEDIUM
- Conflicts
- 1
CVE-2026-57945
PhotoPrism before 260601-a7d098548 contains a broken access control vulnerability that allows authenticated non-admin users to modify other users' profile information by sending requests to arbitrary user endpoints. Attackers can exploit the missing session-to-user identifier validation in the PUT users API endpoint to overwrite another user's profile details without authorization.
PUBLISHED
- Vendor
- photoprism
- Product
- photoprism
- Provider severity
- MEDIUM
- Conflicts
- 1
CVE-2026-57943
LibrePhotos before 1.0.0 contains a broken object level authorization vulnerability in the SetPhotosShared endpoint that allows authenticated users to grant themselves access to other users' private photos by bypassing ownership validation. Attackers can manipulate shared_to relations without proper owner checks to read arbitrary private photos belonging to other users.
PUBLISHED
- Vendor
- LibrePhotos
- Product
- librephotos
- Provider severity
- MEDIUM
- Conflicts
- 1
CVE-2026-57942
LibreTranslate through 1.9.7, fixed in commit 397fd22, contains an IP spoofing vulnerability in the get_remote_address() function that allows unauthenticated attackers to spoof client IP addresses by injecting arbitrary values into the X-Forwarded-For header without trusted proxy validation. Attackers can bypass per-IP rate limiting and flood bans by supplying forged addresses in the X-Forwarded-For header to enable unlimited API abuse.
PUBLISHED
- Vendor
- LibreTranslate
- Product
- LibreTranslate
- Provider severity
- MEDIUM
- Conflicts
- 1
CVE-2026-57940
HTMLy 3.1.1 contains a Server-Side Request Forgery (SSRF) vulnerability in the RSS feed import functionality. The function get_feed() in system/admin/admin.php passes user-supplied $feed_url directly to file_get_contents() without any validation. An authenticated attacker with administrative privileges can exploit this by entering a crafted URL (e.g., http://dnslog.example.com, file:///etc/passwd, or http://169.254.169.254 in cloud contexts) via Tools -> Import RSS. The server will then make a r
PUBLISHED
- Vendor
- danpros
- Product
- HTMLy
- Provider severity
- LOW
- Conflicts
- 0
CVE-2026-5794
A vulnerability affecting the detailed versions of Cryptobox allows a legitimate user to prevent another to login by triggering an account lockout via sending a specially crafted request.
PUBLISHED
- Vendor
- Ercom
- Product
- Cryptobox
- Provider severity
- MEDIUM
- Conflicts
- 0
CVE-2026-5793
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Inrove Software and Internet Services BiEticaret allows Reflected XSS. This issue affects BiEticaret: before v3.3.57.
PUBLISHED
- Vendor
- Inrove Software and Internet Services
- Product
- BiEticaret
- Provider severity
- MEDIUM
- Conflicts
- 0
CVE-2026-57926
In JetBrains YouTrack before 2026.2.16593 the websandbox bridge was vulnerable to a prototype pollution attack
PUBLISHED
- Vendor
- JetBrains
- Product
- YouTrack
- Provider severity
- LOW
- Conflicts
- 1