CVE Explorer

Exact snapshot results

353,537 CVE records

CVE ID descending · no relevance ranking

CVE-2026-35489

Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.4, the POST /api/food/{id}/shopping/ endpoint reads amount and unit directly from request.data and passes them without validation to ShoppingListEntry.objects.create(). Invalid amount values (non-numeric strings) cause an unhandled exception and HTTP 500. A unit ID from a different Space can be associated cross-space, leaking foreign-key references across tenant boundaries. All other

PUBLISHED

Vendor: TandoorRecipes
Product: recipes
Provider severity: HIGH
Conflicts: 1

CVE-2026-35488

Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.4, RecipeBookViewSet and RecipeBookEntryViewSet use CustomIsShared as an alternative permission class, but CustomIsShared.has_object_permission() returns True for all HTTP methods — including DELETE, PUT, and PATCH — without checking request.method in SAFE_METHODS. Any user who is in the shared list of a RecipeBook can delete or overwrite it, even though shared access is semantically

PUBLISHED

Vendor: TandoorRecipes
Product: recipes
Provider severity: HIGH
Conflicts: 0

CVE-2026-35487

text-generation-webui is an open-source web interface for running Large Language Models. Prior to 4.3, an unauthenticated path traversal vulnerability in load_prompt() allows reading any .txt file on the server filesystem. The file content is returned verbatim in the API response. This vulnerability is fixed in 4.3.

PUBLISHED

Vendor: oobabooga
Product: text-generation-webui
Provider severity: MEDIUM
Conflicts: 0

CVE-2026-35486

text-generation-webui is an open-source web interface for running Large Language Models. Prior to 4.3, he superbooga and superboogav2 RAG extensions fetch user-supplied URLs via requests.get() with zero validation — no scheme check, no IP filtering, no hostname allowlist. An attacker can access cloud metadata endpoints, steal IAM credentials, and probe internal services. The fetched content is exfiltrated through the RAG pipeline. This vulnerability is fixed in 4.3.

PUBLISHED

Vendor: oobabooga
Product: text-generation-webui
Provider severity: HIGH
Conflicts: 0

CVE-2026-35485

text-generation-webui is an open-source web interface for running Large Language Models. Prior to 4.3, an unauthenticated path traversal vulnerability in load_grammar() allows reading any file on the server filesystem with no extension restriction. Gradio does not server-side validate dropdown values, so an attacker can POST directory traversal payloads (e.g., ../../../etc/passwd) via the API and receive the full file contents in the response. This vulnerability is fixed in 4.3.

PUBLISHED

Vendor: oobabooga
Product: text-generation-webui
Provider severity: HIGH
Conflicts: 0

CVE-2026-35484

text-generation-webui is an open-source web interface for running Large Language Models. Prior to 4.3, an unauthenticated path traversal vulnerability in load_preset() allows reading any .yaml file on the server filesystem. The parsed YAML key-value pairs (including passwords, API keys, connection strings) are returned in the API response. This vulnerability is fixed in 4.3.

PUBLISHED

Vendor: oobabooga
Product: text-generation-webui
Provider severity: MEDIUM
Conflicts: 0

CVE-2026-35483

text-generation-webui is an open-source web interface for running Large Language Models. Prior to 4.3, an unauthenticated path traversal vulnerability in load_template() allows reading files with .jinja, .jinja2, .yaml, or .yml extensions from anywhere on the server filesystem. For .jinja files the content is returned verbatim; for .yaml files a parsed key is extracted. This vulnerability is fixed in 4.3.

PUBLISHED

Vendor: oobabooga
Product: text-generation-webui
Provider severity: MEDIUM
Conflicts: 0

CVE-2026-35482

alf.io is an open source ticket reservation system for conferences, trade shows, workshops, and meetups. Prior to version 2.0-M5-2606, a sandbox escape vulnerability in the alf.io extension script engine allows an authenticated administrator to execute arbitrary operating system commands on the server. The extension system is intended to execute restricted JavaScript in a sandboxed Rhino environment; however, a combination of an unguarded injected Java object (`returnClass`) and an incomplete AS

PUBLISHED

Vendor: alfio-event
Product: alf.io
Provider severity: HIGH
Conflicts: 0

CVE-2026-35480

go-ipld-prime is an implementation of the InterPlanetary Linked Data (IPLD) spec interfaces, a batteries-included codec implementations of IPLD for CBOR and JSON, and tooling for basic operations on IPLD objects. Prior to 0.22.0, the DAG-CBOR decoder uses collection sizes declared in CBOR headers as Go preallocation hints for maps and lists. The decoder does not cap these size hints or account for their cost in its allocation budget, allowing small payloads to cause excessive memory allocation.

PUBLISHED

Vendor: ipld
Product: go-ipld-prime
Provider severity: MEDIUM
Conflicts: 0

CVE-2026-3548

Two buffer overflow vulnerabilities existed in the wolfSSL CRL parser when parsing CRL numbers: a heap-based buffer overflow could occur when improperly storing the CRL number as a hexadecimal string, and a stack-based overflow for sufficiently sized CRL numbers. With appropriately crafted CRLs, either of these out of bound writes could be triggered. Note this only affects builds that specifically enable CRL support, and the user would need to load a CRL from an untrusted source.

PUBLISHED

Vendor: wolfSSL
Product: wolfSSL
Provider severity: HIGH
Conflicts: 1

CVE-2026-35479

InvenTree is an Open Source Inventory Management System. Prior to 1.2.7 and 1.3.0, any users who have staff access permissions can install plugins via the API, without requiring "superuser" account access. This level of permission requirement is out of alignment with other plugin actions (such as uninstalling) which do require superuser access. The vulnerability allows staff users (who may be considered to have a lower level of trust than a superuser account) to install arbitrary (and potentiall

PUBLISHED

Vendor: inventree
Product: InvenTree
Provider severity: MEDIUM
Conflicts: 0

CVE-2026-35478

InvenTree is an Open Source Inventory Management System. From 0.16.0 to before 1.2.7, any authenticated InvenTree user can create a valid API token attributed to any other user in the system — including administrators and superusers — by supplying the target's user ID in the user field of a POST /api/user/tokens/ request. The returned token is immediately usable for full API authentication as the target user, from any network location, with no further interaction required. This vulnerability is

PUBLISHED

Vendor: inventree
Product: InvenTree
Provider severity: HIGH
Conflicts: 0

CVE-2026-35477

InvenTree is an Open Source Inventory Management System. From 1.2.3 to 1.2.6, the fix for CVE-2026-27629 upgraded the PART_NAME_FORMAT validator to use jinja2.sandbox.SandboxedEnvironment. However, the actual renderer in part/helpers.py was not updated and still uses the non-sandboxed jinja2.Environment. Additionally, the validator uses a dummy Part instance with pk=None, which allows conditional template expressions to behave differently during validation versus production rendering. A staff us

PUBLISHED

Vendor: inventree
Product: InvenTree
Provider severity: MEDIUM
Conflicts: 0

CVE-2026-35476

InvenTree is an Open Source Inventory Management System. Prior to 1.2.7 and 1.3.0, a non-staff authenticated user can elevate their account to a staff level via a POST request against their user account endpoint. The write permissions on the API endpoint are improperly configured, allowing any user to change their staff status. This vulnerability is fixed in 1.2.7 and 1.3.0.

PUBLISHED

Vendor: inventree
Product: InvenTree
Provider severity: HIGH
Conflicts: 0

CVE-2026-35475

WeGIA is a Web manager for charitable institutions. Prior to 3.6.9, the redirect parameter is taken directly from $_GET with no URL validation or whitelist check, then used verbatim in a header("Location: ...") call. This vulnerability is fixed in 3.6.9.

PUBLISHED

Vendor: LabRedesCefetRJ
Product: WeGIA
Provider severity: MEDIUM
Conflicts: 0

CVE-2026-35474

WeGIA is a Web manager for charitable institutions. Prior to 3.6.9, open redirect has been found in WeGIA webapp. The redirect parameter is taken directly from $_GET with no URL validation or whitelist check, then used verbatim in a header("Location: ...") call. This vulnerability is fixed in 3.6.9.

PUBLISHED

Vendor: LabRedesCefetRJ
Product: WeGIA
Provider severity: MEDIUM
Conflicts: 0

CVE-2026-35473

WeGIA is a Web manager for charitable institutions. Prior to 3.6.9, an Open Redirect vulnerability was identified in the /WeGIA/controle/control.php endpoint of the WeGIA application, specifically through the nextPage parameter when combined with metodo=listarId and nomeClasse=IentradaControle. The application fails to validate or restrict the nextPage parameter, allowing attackers to redirect users to arbitrary external websites. This can be abused for phishing attacks, credential theft, malwar

PUBLISHED

Vendor: LabRedesCefetRJ
Product: WeGIA
Provider severity: MEDIUM
Conflicts: 1

CVE-2026-35472

WeGIA is a Web manager for charitable institutions. Prior to 3.6.9, an Open Redirect vulnerability was identified in the /WeGIA/controle/control.php endpoint of the WeGIA application, specifically through the nextPage parameter when combined with metodo=listarTodos and nomeClasse=EstoqueControle. The application fails to validate or restrict the nextPage parameter, allowing attackers to redirect users to arbitrary external websites. This can be abused for phishing attacks, credential theft, malw

PUBLISHED

Vendor: LabRedesCefetRJ
Product: WeGIA
Provider severity: MEDIUM
Conflicts: 0

CVE-2026-35471

goshs is a SimpleHTTPServer written in Go. Prior to 2.0.0-beta.3, tdeleteFile() missing return after path traversal check. This vulnerability is fixed in 2.0.0-beta.3.

PUBLISHED

Vendor: patrickhener
Product: goshs
Provider severity: CRITICAL
Conflicts: 0

CVE-2026-35470

OpenSTAManager is an open source management software for technical assistance and invoicing. Prior to 2.10.2, confronta_righe.php files across different modules in OpenSTAManager contain an SQL Injection vulnerability. The righe parameter received via $_GET['righe'] is directly concatenated into an SQL query without any sanitization, parameterization or validation. An authenticated attacker can inject arbitrary SQL statements to extract sensitive data from the database, including user credential

PUBLISHED

Vendor: devcode-it
Product: openstamanager
Provider severity: HIGH
Conflicts: 0

CVE-2026-3547

Out-of-bounds read in ALPN parsing due to incomplete validation. wolfSSL 5.8.4 and earlier contained an out-of-bounds read in ALPN handling when built with ALPN enabled (HAVE_ALPN / --enable-alpn). A crafted ALPN protocol list could trigger an out-of-bounds read, leading to a potential process crash (denial of service). Note that ALPN is disabled by default, but is enabled for these 3rd party compatibility features: enable-apachehttpd, enable-bind, enable-curl, enable-haproxy, enable-hitch, enab

PUBLISHED

Vendor: wolfSSL
Product: wolfSSL
Provider severity: HIGH
Conflicts: 0

CVE-2026-35469

spdystream is a Go library for multiplexing streams over SPDY connections. In versions 0.5.0 and below, the SPDY/3 frame parser does not validate attacker-controlled counts and lengths before allocating memory. Three allocation paths are affected: the SETTINGS frame entry count, the header count in parseHeaderValueBlock, and individual header field sizes — all read as 32-bit integers and used directly as allocation sizes with no bounds checking. Because SPDY header blocks are zlib-compressed, a

PUBLISHED

Vendor: Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, moby, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat
Product: Red Hat OpenShift Container Platform 4.22, Red Hat OpenShift Container Platform 4, Red Hat OpenShift Container Platform 4, Red Hat OpenShift Container Platform 4.16, cert-manager Operator for Red Hat OpenShift, Red Hat OpenShift Container Platform 4.17, Red Hat OpenShift Container Platform 4.2, Red Hat OpenShift Container Platform 4.14, Red Hat OpenShift Container Platform 4, Red Hat Openshift Data Foundation 4.22, Red Hat OpenShift Virtualization 4, Red Hat OpenShift Container Platform 4.19, Red Hat OpenShift Container Platform 4.19, Red Hat Advanced Cluster Management for Kubernetes 2.13, Red Hat OpenShift Container Platform 4.12, Red Hat OpenShift Container Platform 4, Red Hat Advanced Cluster Security 4, Red Hat OpenShift Virtualization 4, Red Hat OpenShift Container Platform 4.14, Dynamic Accelerator Slicer Operator for Red Hat OpenShift, spdystream, Red Hat OpenShift Container Platform 4.12, Red Hat OpenShift Container Platform 4, Red Hat OpenShift Container Platform 4, Red Hat OpenShift Container Platform 4.19, Red Hat OpenShift Container Platform 4, Red Hat OpenShift Container Platform 4, Red Hat Openshift Data Foundation 4.22, Red Hat OpenShift Container Platform 4, Red Hat OpenShift Container Platform 4, Red Hat OpenShift Container Platform 4, Zero Trust Workload Identity Manager, Red Hat Openshift Data Foundation 4.22, Dynamic Accelerator Slicer Operator for Red Hat OpenShift, Red Hat Advanced Cluster Management for Kubernetes 2, Red Hat OpenShift Virtualization 4, Red Hat OpenShift Container Platform 4.21, Red Hat OpenShift Container Platform 4, Red Hat OpenShift Container Platform 4, Red Hat OpenShift Container Platform 4.18, Red Hat OpenShift Virtualization 4, cert-manager Operator for Red Hat OpenShift, Red Hat OpenShift Container Platform 4, Red Hat OpenShift Container Platform 4.21, RHEM 1.1 for RHEL 9, Red Hat OpenShift Container Platform 4, Red Hat OpenShift Container Platform 4.12, Red Hat OpenShift Container Platform 4.18, Red Hat OpenShift for Windows Containers, Red Hat Container Native Virtualization 4.16, RHEM 1.0 for RHEL 9, Red Hat OpenShift Container Platform 4, Red Hat Container Native Virtualization 4.15, Red Hat OpenShift Container Platform 4.16, Logical Volume Manager Storage, multicluster engine for Kubernetes 2.11, multicluster engine for Kubernetes 2.8, Red Hat OpenShift Virtualization 4, Logical Volume Manager Storage, Red Hat OpenShift Container Platform 4, Red Hat OpenShift Container Platform 4, Red Hat OpenShift Container Platform 4.19, Red Hat Advanced Cluster Security 4, Red Hat OpenShift Container Platform 4.19, Red Hat OpenShift Container Platform 4, Red Hat OpenShift Container Platform 4, multicluster engine for Kubernetes 2.1, Red Hat OpenShift Container Platform 4.22, Red Hat OpenShift Container Platform 4, Red Hat Openshift Data Foundation 4.22, Red Hat OpenShift Container Platform 4, Red Hat OpenShift Container Platform 4.19, Red Hat OpenShift Container Platform 4.12, Red Hat OpenShift Container Platform 4.18, Red Hat OpenShift Virtualization 4, multicluster engine for Kubernetes 2.8, Dynamic Accelerator Slicer Operator for Red Hat OpenShift, Red Hat OpenShift Container Platform 4.12, Red Hat OpenShift Container Platform 4.2, Red Hat Container Native Virtualization 4.19, Red Hat OpenShift Container Platform 4.2, Red Hat OpenShift Container Platform 4, Red Hat OpenShift Container Platform 4, Red Hat Openshift Data Foundation 4.22, Red Hat OpenShift Container Platform 4.13, Red Hat OpenShift Container Platform 4, Red Hat OpenShift Container Platform 4, Red Hat OpenShift Container Platform 4, Red Hat OpenShift Container Platform 4.19, Red Hat OpenShift Container Platform 4, Red Hat OpenShift Container Platform 4.21, Red Hat OpenShift Container Platform 4, Red Hat Openshift Data Foundation 4.22, Red Hat OpenShift Container Platform 4.18, Red Hat Openshift Data Foundation 4.22, Red Hat OpenShift Container Platform 4.17, Red Hat OpenShift Container Platform 4, Red Hat OpenShift Container Platform 4.22, Red Hat OpenShift Container Platform 4.21, Red Hat Openshift Data Foundation 4.22, Red Hat OpenShift Container Platform 4.14, Red Hat OpenShift Container Platform 4.21, Red Hat Container Native Virtualization 4.2, Red Hat OpenShift Container Platform 4, Red Hat OpenShift Container Platform 4.2, Red Hat OpenShift Container Platform 4.21, Red Hat OpenShift Container Platform 4.19, Red Hat Openshift Data Foundation 4.22, Red Hat OpenShift Container Platform 4, Multicluster Engine for Kubernetes, Red Hat Openshift Data Foundation 4.22, Red Hat Advanced Cluster Security 4, Red Hat OpenShift Container Platform 4.22, Red Hat OpenShift Virtualization 4, Red Hat OpenShift Container Platform 4.22, Red Hat OpenShift Container Platform 4, Red Hat OpenShift Container Platform 4, Red Hat OpenShift Container Platform 4.19, Multicluster Engine for Kubernetes, Red Hat OpenShift Container Platform 4.16, Red Hat OpenShift Container Platform 4, Red Hat OpenShift Container Platform 4, Red Hat OpenShift Container Platform 4.16, Red Hat OpenShift Container Platform 4.17, Logical Volume Manager Storage, Red Hat OpenShift Container Platform 4.13, Red Hat OpenShift Container Platform 4.17, External Secrets Operator for Red Hat OpenShift, Dynamic Accelerator Slicer Operator for Red Hat OpenShift, Logical Volume Manager Storage, Red Hat Openshift Data Foundation 4.22, Red Hat OpenShift Container Platform 4.21, Red Hat Container Native Virtualization 4.22, Red Hat OpenShift Container Platform 4.15, Red Hat OpenShift Container Platform 4.2, Red Hat OpenShift Container Platform 4, Red Hat OpenShift Virtualization 4, Red Hat Openshift Data Foundation 4.22, Red Hat OpenShift Container Platform 4.15, Red Hat OpenShift Container Platform 4, cert-manager Operator for Red Hat OpenShift, Red Hat Advanced Cluster Security 4.9, Red Hat OpenShift Container Platform 4, Red Hat OpenShift Container Platform 4.13, Red Hat OpenShift Container Platform 4, Red Hat OpenShift Container Platform 4, Red Hat OpenShift Container Platform 4.18, Red Hat OpenShift Virtualization 4, Red Hat Openshift Data Foundation 4.22, Red Hat OpenShift Container Platform 4, Red Hat OpenShift Container Platform 4.16, Red Hat OpenShift Container Platform 4, Red Hat OpenShift Container Platform 4, Red Hat OpenShift Container Platform 4.14, cert-manager Operator for Red Hat OpenShift, Red Hat Container Native Virtualization 4.17, Red Hat Openshift Data Foundation 4.22, Red Hat OpenShift Container Platform 4.18, Red Hat OpenShift Container Platform 4.18, Red Hat OpenShift Container Platform 4, External Secrets Operator for Red Hat OpenShift, Red Hat OpenShift for Windows Containers, Red Hat Advanced Cluster Management for Kubernetes 2, Red Hat Openshift Data Foundation 4.22, Red Hat OpenShift Container Platform 4, Dynamic Accelerator Slicer Operator for Red Hat OpenShift, Red Hat OpenShift Container Platform 4.19, Red Hat Openshift Data Foundation 4.22, Red Hat OpenShift Container Platform 4, Red Hat OpenShift Container Platform 4, Red Hat OpenShift Container Platform 4.19, Red Hat OpenShift Container Platform 4, Red Hat OpenShift distributed tracing 3, Red Hat OpenShift Container Platform 4, Red Hat OpenShift Container Platform 4.13, Red Hat Advanced Cluster Management for Kubernetes 2.13, Red Hat OpenShift Container Platform 4.17, Red Hat OpenShift Container Platform 4.2, Red Hat Openshift Data Foundation 4.22, Red Hat OpenShift Virtualization 4, Red Hat OpenShift Container Platform 4.13, Red Hat OpenShift Container Platform 4, Red Hat OpenShift Container Platform 4, Red Hat OpenShift Container Platform 4.19, Red Hat OpenShift Container Platform 4.21, Red Hat Openshift Data Foundation 4.22, Red Hat Openshift Data Foundation 4.22, Red Hat OpenShift Container Platform 4, Red Hat OpenShift Container Platform 4, Red Hat OpenShift Container Platform 4, Red Hat OpenShift GitOps, Red Hat OpenShift Container Platform 4, Red Hat Container Native Virtualization 4.21, Red Hat OpenShift Virtualization 4, Red Hat OpenShift Container Platform 4, RHEM 1.1 for RHEL 10, Red Hat Openshift Data Foundation 4.22, Red Hat Openshift Data Foundation 4.22, Red Hat OpenShift Container Platform 4, Red Hat OpenShift Virtualization 4, Red Hat OpenShift Container Platform 4, Red Hat OpenShift Virtualization 4, Red Hat OpenShift Container Platform 4.16, Red Hat OpenShift Container Platform 4.18, Red Hat OpenShift Container Platform 4, Red Hat Openshift Data Foundation 4.22, Red Hat OpenShift Container Platform 4.18, Red Hat Openshift Data Foundation 4.22, Red Hat OpenShift Container Platform 4, Red Hat OpenShift Container Platform 4, Red Hat OpenShift Container Platform 4.18, Red Hat OpenShift Container Platform 4.15, Red Hat OpenShift Virtualization 4, Red Hat OpenShift Container Platform 4, Red Hat OpenShift Container Platform 4.15, Red Hat Openshift Data Foundation 4.22, Red Hat OpenShift Container Platform 4.17, Red Hat OpenShift Container Platform 4, Red Hat OpenShift Container Platform 4.2, External Secrets Operator for Red Hat OpenShift, Red Hat Advanced Cluster Security for Kubernetes 4.10, Red Hat OpenShift Container Platform 4, Red Hat Openshift Data Foundation 4.22, Red Hat OpenShift Container Platform 4.17, Red Hat OpenShift Container Platform 4, Red Hat Advanced Cluster Security 4.8, Red Hat OpenShift Container Platform 4.17, Red Hat OpenShift Container Platform 4.19, Red Hat Openshift Data Foundation 4.22, External Secrets Operator for Red Hat OpenShift, Red Hat OpenShift Container Platform 4.15, Red Hat OpenShift Container Platform 4, Multicluster Engine for Kubernetes, Red Hat OpenShift Container Platform 4.22, Red Hat Openshift Data Foundation 4.22, Red Hat OpenShift Container Platform 4.14, Red Hat OpenShift Container Platform 4
Provider severity: HIGH, MEDIUM
Conflicts: 3

CVE-2026-35468

nimiq/core-rs-albatross is a Rust implementation of the Nimiq Proof-of-Stake protocol based on the Albatross consensus algorithm. Prior to version 1.3.0, two peer-facing consensus request handlers assume that the history index is always available and call blockchain.history_store.history_index().unwrap() directly. That assumption is false by construction. HistoryStoreProxy::history_index() explicitly returns None for the valid HistoryStoreProxy::WithoutIndex state. when a full node is syncing or

PUBLISHED

Vendor: nimiq
Product: core-rs-albatross
Provider severity: MEDIUM
Conflicts: 0

CVE-2026-35467

The stored API keys in temporary browser client is not marked as protected allowing for JavScript console or other errors to allow for extraction of the encryption credentials.

PUBLISHED

Vendor: CERT/CC
Product: cveClient/encrypt-storage.js
Provider severity: HIGH
Conflicts: 0

CVE-2026-35466

XSS vulnerability in cveInterface.js allows for inject HTML to be passed to display, as cveInterface trusts input from CVE API services

PUBLISHED

Vendor: CERT/CC
Product: cveClient/cveInterface.js
Provider severity: MEDIUM
Conflicts: 0

CVE-2026-35465

SecureDrop Client is a desktop app for journalists to securely communicate with sources and handle submissions on the SecureDrop Workstation. In versions 0.17.4 and below, a compromised SecureDrop Server can achieve code execution on the Client's virtual machine (sd-app) by exploiting improper filename validation in gzip archive extraction, which permits absolute paths and enables overwriting critical files like the SQLite database. Exploitation requires prior compromise of the dedicated SecureD

PUBLISHED

Vendor: freedomofpress
Product: securedrop-client
Provider severity: HIGH
Conflicts: 1

CVE-2026-35464

pyLoad is a free and open-source download manager written in Python. The fix for CVE-2026-33509 added an ADMIN_ONLY_OPTIONS set to block non-admin users from modifying security-critical config options. The storage_folder option is not in this set and passes the existing path restriction because the Flask session directory is outside both PKGDIR and userdir. A user with SETTINGS and ADD permissions can redirect downloads to the Flask filesystem session store, plant a malicious pickle payload as a

PUBLISHED

Vendor: pyload
Product: pyload
Provider severity: HIGH
Conflicts: 1

CVE-2026-35463

pyLoad is a free and open-source download manager written in Python. In 0.5.0b3.dev96 and earlier, the ADMIN_ONLY_OPTIONS protection mechanism restricts security-critical configuration values (reconnect scripts, SSL certs, proxy credentials) to admin-only access. However, this protection is only applied to core config options, not to plugin config options. The AntiVirus plugin stores an executable path (avfile) in its config, which is passed directly to subprocess.Popen(). A non-admin user with

PUBLISHED

Vendor: pyload
Product: pyload
Provider severity: HIGH
Conflicts: 0

CVE-2026-35462

Papra is a minimalistic document management and archiving platform. Prior to 26.4.0, API keys with an expiresAt date are never validated against the current time during authentication. Any API key — regardless of its expiration date — is accepted indefinitely, allowing a user whose key has expired to continue accessing all protected endpoints as if the key were still valid. This vulnerability is fixed in 26.4.0.

PUBLISHED

Vendor: papra-hq
Product: papra
Provider severity: MEDIUM
Conflicts: 0

CVE-2026-35461

Papra is a minimalistic document management and archiving platform. Prior to 26.4.0, the Papra webhook system allows authenticated users to register arbitrary URLs as webhook endpoints with no validation of the destination address. The server makes outbound HTTP POST requests to registered URLs, including localhost, internal network ranges, and cloud provider metadata endpoints, on every document event. This vulnerability is fixed in 26.4.0.

PUBLISHED

Vendor: papra-hq
Product: papra
Provider severity: MEDIUM
Conflicts: 0

CVE-2026-35460

Papra is a minimalistic document management and archiving platform. Prior to 26.4.0, transactional email templates in Papra interpolate user.name directly into HTML without escaping or sanitization. An attacker who registers with a display name containing HTML tags will have those tags injected into the verification and password reset email bodies. Since emails are sent from the legitimate domain (e.g: auth@mail.papra.app), this enables convincing phishing attacks that appear to originate from o

PUBLISHED

Vendor: papra-hq
Product: papra
Provider severity: MEDIUM
Conflicts: 1

CVE-2026-3546

The e-shot form builder plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.0.2. The eshot_form_builder_get_account_data() function is registered as a wp_ajax_ AJAX handler accessible to all authenticated users. The function lacks any capability check (e.g., current_user_can('manage_options')) and does not verify a nonce. It directly queries the database for the e-shot API token stored in the eshotformbuilder_control table and returns it a

PUBLISHED

Vendor: forfront
Product: e-shot
Provider severity: MEDIUM
Conflicts: 0

CVE-2026-35459

pyLoad is a free and open-source download manager written in Python. In 0.5.0b3.dev96 and earlier, pyLoad has a server-side request forgery (SSRF) vulnerability. The fix for CVE-2026-33992 added IP validation to BaseDownloader.download() that checks the hostname of the initial download URL. However, pycurl is configured with FOLLOWLOCATION=1 and MAXREDIRS=10, causing it to automatically follow HTTP redirects. Redirect targets are never validated against the SSRF filter. An authenticated user wit

PUBLISHED

Vendor: pyload
Product: pyload
Provider severity: CRITICAL
Conflicts: 1

CVE-2026-35458

Gotenberg is an API for converting document formats. In 8.29.1 and earlier, Gotenberg uses dlclark/regexp2 to compile user-supplied scope patterns without setting a proper timeout. Users with access to features using this logic can hang workers indefinitely.

PUBLISHED

Vendor: gotenberg
Product: gotenberg
Provider severity: CRITICAL, HIGH
Conflicts: 1

CVE-2026-35457

libp2p-rust is the official rust language Implementation of the libp2p networking stack. Prior to 0.17.1, the rendezvous server stores pagination cookies without bounds. An unauthenticated peer can repeatedly issue DISCOVER requests and force unbounded memory growth. This vulnerability is fixed in 0.17.1.

PUBLISHED

Vendor: libp2p
Product: rust-libp2p
Provider severity: HIGH
Conflicts: 0

CVE-2026-35455

immich is a high performance self-hosted photo and video management solution. Prior to 2.7.0, sStored Cross-Site Scripting (XSS) in the 360° panorama viewer allows any authenticated user to execute arbitrary JavaScript in the browser of any other user who views the malicious panorama with the OCR overlay enabled. The attacker uploads an equirectangular image containing crafted text; OCR extracts it, and the panorama viewer renders it via innerHTML without sanitization. This enables session hijac

PUBLISHED

Vendor: immich-app
Product: immich
Provider severity: HIGH
Conflicts: 0

CVE-2026-35454

The Code Extension Marketplace is an open-source alternative to the VS Code Marketplace. Prior to 2.4.2, Zip Slip vulnerability in coder/code-marketplace allowed a malicious VSIX file to write arbitrary files outside the extension directory. ExtractZip passed raw zip entry names to a callback that wrote files via filepath.Join with no boundary check; filepath.Join resolved .. components but did not prevent the result from escaping the base path. This vulnerability is fixed in 2.4.2.

PUBLISHED

Vendor: coder
Product: code-marketplace
Provider severity: HIGH
Conflicts: 0

CVE-2026-35453

PhpSpreadsheet is a library for reading and writing spreadsheet files. In versions 1.30.3 and earlier, 2.0.0 through 2.1.15, 2.2.0 through 2.4.4, 3.3.0 through 3.10.4, and 4.0.0 through 5.6.0, the HTML Writer skips htmlspecialchars() output escaping when a cell uses a custom number format containing the @ text placeholder with additional literal text (e.g., @ "items"). The escaping is only applied when the formatted output strictly equals the original cell value. When the format code contains @

PUBLISHED

Vendor: PHPOffice
Product: PhpSpreadsheet
Provider severity: MEDIUM
Conflicts: 0

CVE-2026-35452

WWBN AVideo is an open source video platform. In versions 26.0 and prior, the plugin/CloneSite/client.log.php endpoint serves the clone operation log file without any authentication. Every other endpoint in the CloneSite plugin directory enforces User::isAdmin(). The log contains internal filesystem paths, remote server URLs, and SSH connection metadata.

PUBLISHED

Vendor: WWBN
Product: AVideo
Provider severity: MEDIUM
Conflicts: 0

CVE-2026-35451

Twenty is an open source CRM. Prior to 1.20.6, a Stored Cross-Site Scripting (XSS) vulnerability exists in the BlockNote editor component. Due to a lack of protocol validation in the FileBlock component and insufficient server-side inspection of block content, an attacker can inject a javascript: URI into the url property of a file block. This allows the execution of arbitrary JavaScript when a user clicks on the malicious file attachment. This vulnerability is fixed in 1.20.6.

PUBLISHED

Vendor: twentyhq
Product: twenty
Provider severity: MEDIUM
Conflicts: 0

CVE-2026-35450

WWBN AVideo is an open source video platform. In versions 26.0 and prior, the plugin/API/check.ffmpeg.json.php endpoint probes the FFmpeg remote server configuration and returns connectivity status without any authentication. All sibling FFmpeg management endpoints (kill.ffmpeg.json.php, list.ffmpeg.json.php, ffmpeg.php) require User::isAdmin().

PUBLISHED

Vendor: WWBN
Product: AVideo
Provider severity: MEDIUM
Conflicts: 0

CVE-2026-3545

Insufficient data validation in Navigation in Google Chrome prior to 145.0.7632.159 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

PUBLISHED

Vendor: Google
Product: Chrome
Provider severity: CRITICAL
Conflicts: 1

CVE-2026-35449

WWBN AVideo is an open source video platform. In versions 26.0 and prior, the install/test.php diagnostic script has its CLI-only access guard disabled by commenting out the die() statement. The script remains accessible via HTTP after installation, exposing video viewer statistics including IP addresses, session IDs, and user agents to unauthenticated visitors.

PUBLISHED

Vendor: WWBN
Product: AVideo
Provider severity: MEDIUM
Conflicts: 0

CVE-2026-35448

WWBN AVideo is an open source video platform. In versions 26.0 and prior, the BlockonomicsYPT plugin's check.php endpoint returns payment order data for any Bitcoin address without requiring authentication. The endpoint was designed as an AJAX polling helper for the authenticated invoice.php page, but it performs no access control checks of its own. Since Bitcoin addresses are publicly visible on the blockchain, an attacker can query payment records for any address used on the platform.

PUBLISHED

Vendor: WWBN
Product: AVideo
Provider severity: LOW
Conflicts: 0

CVE-2026-35447

NamelessMC is website software for Minecraft servers. In version 2.2.4, the profile page (modules/Core/pages/profile.php) processes wall post submissions and replies before verifying whether the viewer is authorized to access the profile. This allows any user with the profile.post permission to write wall posts to private or blocking profiles. Additionally, the reply branch does not verify that the target wall post belongs to the current profile, enabling attackers to inject replies into arbitra

PUBLISHED

Vendor: NamelessMC
Product: Nameless
Provider severity: MEDIUM
Conflicts: 0

CVE-2026-35446

LORIS (Longitudinal Online Research and Imaging System) is a self-hosted web application that provides data- and project-management for neuroimaging research. From 24.0.0 to before 27.0.3 and 28.0.1, an incorrect order of operations in the FilesDownloadHandler could result in an attacker escaping the intended download directories. This vulnerability is fixed in 27.0.3 and 28.0.1.

PUBLISHED

Vendor: aces
Product: Loris
Provider severity: HIGH
Conflicts: 0

CVE-2026-35444

SDL_image is a library to load images of various formats as SDL surfaces. In do_layer_surface() in src/IMG_xcf.c, pixel index values from decoded XCF tile data are used directly as colormap indices without validating them against the colormap size (cm_num). A crafted .xcf file with a small colormap and out-of-range pixel indices causes heap out-of-bounds reads of up to 762 bytes past the colormap allocation. Both IMAGE_INDEXED code paths are affected (bpp=1 and bpp=2). The leaked heap bytes are

PUBLISHED

Vendor: libsdl-org
Product: SDL_image
Provider severity: HIGH
Conflicts: 0

CVE-2026-35443

NamelessMC is website software for Minecraft servers. In version 2.2.4, `modules/Forum/classes/ForumPostReactionContext.php` only verifies that the caller can view the forum, but it does not re-enforce topic-level `view_other_topics` authorization. As a result, in forums where users may enter the forum but may only view their own topics, reactions can still be read and modified on other users' topics. Version 2.2.5 fixes the issue.

PUBLISHED

Vendor: NamelessMC
Product: Nameless
Provider severity: MEDIUM
Conflicts: 0

CVE-2026-35442

Directus is a real-time API and App dashboard for managing SQL database content. Prior to 11.17.0, aggregate functions (min, max) applied to fields with the conceal special type incorrectly return raw database values instead of the masked placeholder. When combined with groupBy, any authenticated user with read access to the affected collection can extract concealed field values, including static API tokens and two-factor authentication secrets from directus_users. This vulnerability is fixed in

PUBLISHED

Vendor: directus
Product: directus
Provider severity: HIGH
Conflicts: 1

CVE-2026-35441

Directus is a real-time API and App dashboard for managing SQL database content. Prior to 11.17.0, Directus' GraphQL endpoints (/graphql and /graphql/system) did not deduplicate resolver invocations within a single request. An authenticated user could exploit GraphQL aliasing to repeat an expensive relational query many times in a single request, forcing the server to execute a large number of independent complex database queries concurrently, multiplying database load linearly with the number o

PUBLISHED

Vendor: directus
Product: directus
Provider severity: MEDIUM
Conflicts: 1