Baitaphish
Security intelligence
SearchLatest briefing
Data & Insights

CVE Explorer

Search one exact, source-linked CVE snapshot by CVE ID or explicit vendor and product tokens. Provider severity, KEV, conflicts, and stale state remain separate observations—not a Baitaphish risk rating.
Snapshot urn:baitaphish:cve-read-model-snapshot:v3:f2c3f72dcc196f8e7d63aa2d29709ad8b3fea39110eb2d563da5ce9b6fa9da89Released 2026-08-05T02:00:00Z
Exact snapshot results

353,537 CVE records

CVE ID descending · no relevance ranking

CVE-2026-30934

FileBrowser Quantum is a free, self-hosted, web-based file manager. Prior to 1.3.1-beta and 1.2.2-stable, Stored XSS is possible via share metadata fields (e.g., title, description) that are rendered into HTML for /public/share/<hash> without context-aware escaping. The server uses text/template instead of html/template, allowing injected scripts to execute when victims visit the share URL. This vulnerability is fixed in 1.3.1-beta and 1.2.2-stable.

PUBLISHED
Vendor
gtsteffaniak
Product
filebrowser
Provider severity
HIGH
Conflicts
0

CVE-2026-30933

FileBrowser Quantum is a free, self-hosted, web-based file manager. Prior to 1.3.1-beta and 1.2.2-stable, the remediation for CVE-2026-27611 is incomplete. Password protected shares still disclose tokenized downloadURL via /public/api/share/info. This vulnerability is fixed in 1.3.1-beta and 1.2.2-stable.

PUBLISHED
Vendor
gtsteffaniak
Product
filebrowser
Provider severity
HIGH
Conflicts
1

CVE-2026-30932

Froxlor is open source server administration software. Prior to version 2.3.5, the DomainZones.add API endpoint (accessible to customers with DNS enabled) does not validate the content field for several DNS record types (LOC, RP, SSHFP, TLSA). An attacker can inject newlines and BIND zone file directives (e.g. $INCLUDE) into the zone file that gets written to disk when the DNS rebuild cron job runs. This issue has been patched in version 2.3.5.

PUBLISHED
Vendor
froxlor
Product
froxlor
Provider severity
HIGH
Conflicts
0

CVE-2026-30931

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-16, a heap-based buffer overflow in the UHDR encoder can happen due to truncation of a value and it would allow an out of bounds write. This vulnerability is fixed in 7.1.2-16.

PUBLISHED
Vendor
ImageMagick
Product
ImageMagick
Provider severity
MEDIUM
Conflicts
0

CVE-2026-30930

Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.1, The TimescaleDB export module constructs SQL queries using string concatenation with unsanitized system monitoring data. The normalize() method wraps string values in single quotes but does not escape embedded single quotes, making SQL injection trivial via attacker-controlled data such as process names, filesystem mount points, network interface names, or container names. This vulnerability is fixed in 4.5.1.

PUBLISHED
Vendor
nicolargo
Product
glances
Provider severity
HIGH
Conflicts
0

CVE-2026-3093

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 14.0 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under certain conditions could have allowed an attacker to execute arbitrary JavaScript in another user's browser via a crafted URL, due to improper sanitization of user-controlled input.

PUBLISHED
Vendor
GitLab
Product
GitLab
Provider severity
MEDIUM
Conflicts
0

CVE-2026-30929

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-16 and 6.9.13-41, MagnifyImage uses a fixed-size stack buffer. When using a specific image it is possible to overflow this buffer and corrupt the stack. This vulnerability is fixed in 7.1.2-16 and 6.9.13-41.

PUBLISHED
Vendor
ImageMagick
Product
ImageMagick
Provider severity
HIGH
Conflicts
1

CVE-2026-30928

Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.1, the /api/4/config REST API endpoint returns the entire parsed Glances configuration file (glances.conf) via self.config.as_dict() with no filtering of sensitive values. The configuration file contains credentials for all configured backend services including database passwords, API tokens, JWT signing keys, and SSL key passwords. This vulnerability is fixed in 4.5.1.

PUBLISHED
Vendor
nicolargo
Product
glances
Provider severity
HIGH
Conflicts
0

CVE-2026-30927

Admidio is an open-source user management solution. Prior to 5.0.6, in modules/events/events_function.php, the event participation logic allows any user who can participate in an event to register OTHER users by manipulating the user_uuid GET parameter. The condition uses || (OR), meaning if possibleToParticipate() returns true (event is open for participation), ANY user - not just leaders - can specify a different user_uuid and register/cancel participation for that user. The code then operates

PUBLISHED
Vendor
Admidio
Product
admidio
Provider severity
MEDIUM
Conflicts
0

CVE-2026-30926

SiYuan is a personal knowledge management system. Prior to 3.5.10, a privilege escalation vulnerability exists in the publish service of SiYuan Note that allows low-privilege publish accounts (RoleReader) to modify notebook content via the /api/block/appendHeadingChildren API endpoint. The endpoint requires only the model.CheckAuth role, which accepts RoleReader sessions, but it does not enforce stricter checks, such as CheckAdminRole or CheckReadonly. This allows remote authenticated publish us

PUBLISHED
Vendor
siyuan-note
Product
siyuan
Provider severity
HIGH
Conflicts
1

CVE-2026-30925

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.5.0-alpha.14 and 8.6.11, a malicious client can subscribe to a LiveQuery with a crafted $regex pattern that causes catastrophic backtracking, blocking the Node.js event loop. This makes the entire Parse Server unresponsive, affecting all clients. Any Parse Server deployment with LiveQuery enabled is affected. The attacker only needs the application ID and JavaScript key, both of whi

PUBLISHED
Vendor
parse-community
Product
parse-server
Provider severity
HIGH
Conflicts
0

CVE-2026-30924

qui is a web interface for managing qBittorrent instances. Versions 1.14.1 and below use a permissive CORS policy that reflects arbitrary origins while also returning Access-Control-Allow-Credentials: true, effectively allowing any external webpage to make authenticated requests on behalf of a logged-in user. An attacker can exploit this by tricking a victim into loading a malicious webpage, which silently interacts with the application using the victim's session and potentially exfiltrating sen

PUBLISHED
Vendor
autobrr
Product
qui
Provider severity
CRITICAL
Conflicts
0

CVE-2026-30923

ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. Libmodsecurity is one component of the ModSecurity v3 project. A segmentation fault occurs when a rule using the t:hexDecode transformation inspects a query string parameter containing a single character. An attacker can exploit this to crash worker processes, causing a denial of service. Service resumes once the attack stops as worker processes recover from the segfault. All versions b

PUBLISHED
Vendor
owasp-modsecurity
Product
ModSecurity
Provider severity
HIGH
Conflicts
0

CVE-2026-30922

pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.3, the `pyasn1` library is vulnerable to a Denial of Service (DoS) attack caused by uncontrolled recursion when decoding ASN.1 data with deeply nested structures. An attacker can supply a crafted payload containing thousands of nested `SEQUENCE` (`0x30`) or `SET` (`0x31`) tags with "Indefinite Length" (`0x80`) markers. This forces the decoder to recursively call itself until the Python interpreter crashes with a `RecursionError` or consu

PUBLISHED
Vendor
Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, pyasn1, Red Hat, Red Hat, Red Hat, Red Hat
Product
Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support, Red Hat Enterprise Linux 10, Red Hat OpenShift AI 3.3, Red Hat OpenShift AI (RHOAI), Red Hat Ansible Automation Platform 2.6 for RHEL 9, Red Hat Ansible Automation Platform 2.6, Red Hat OpenShift Container Platform 4, Red Hat OpenStack 1.5, Red Hat Enterprise Linux AI 3.3, Red Hat Ansible Automation Platform 2, Red Hat Enterprise Linux 8.8 Telecommunications Update Service, Red Hat OpenStack 1.5, Red Hat OpenShift AI 3.3, Red Hat OpenShift AI 3.3, Red Hat Ansible Automation Platform 2, Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions, Red Hat OpenShift AI 3.3, Red Hat Enterprise Linux 8, Red Hat OpenStack 1.5, Red Hat Ansible Automation Platform 2.5 for RHEL 9, Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support, Red Hat OpenShift AI 3.3, Red Hat Quay 3.1, Red Hat Ansible Automation Platform 2, Red Hat AI Inference Server, Red Hat Enterprise Linux AI 3.3, Red Hat OpenShift AI (RHOAI), Red Hat Ansible Automation Platform 2, Red Hat OpenShift AI 3.3, Red Hat Ansible Automation Platform 2.5, Red Hat OpenShift AI (RHOAI), Red Hat Satellite 6, Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support, Red Hat OpenStack Platform 18.0, Red Hat Ansible Automation Platform 2, Red Hat Ansible Automation Platform 2.5, Red Hat Ansible Automation Platform 2.6, Red Hat OpenShift AI 3.3, Red Hat Ansible Automation Platform 2, Migration Toolkit for Containers, Red Hat Ansible Automation Platform 2, Red Hat Ansible Automation Platform 2, OpenShift Lightspeed, Red Hat Enterprise Linux 9.6 Extended Update Support, Red Hat Enterprise Linux 10.0 Extended Update Support, Migration Toolkit for Virtualization, Red Hat OpenShift AI 3.3, Red Hat Enterprise Linux 8.6 Telecommunications Update Service, Red Hat Ansible Automation Platform 2, Red Hat OpenShift AI (RHOAI), Red Hat Ansible Automation Platform 2.6, Red Hat OpenShift AI 3.3, Red Hat OpenShift Container Platform 4, Red Hat OpenShift AI 3.3, Red Hat Trusted Artifact Signer, Red Hat Ansible Automation Platform 2, Red Hat OpenShift AI (RHOAI), Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions, Red Hat Ansible Automation Platform 2.5 for RHEL 8, Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions, Red Hat Enterprise Linux 8.8 Telecommunications Update Service, OpenShift Lightspeed, Red Hat OpenShift AI (RHOAI), Red Hat Enterprise Linux 9, Red Hat Ansible Automation Platform 2, Red Hat OpenShift AI (RHOAI), Red Hat Ansible Automation Platform 2, Red Hat OpenShift AI (RHOAI), Red Hat OpenShift AI (RHOAI), Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions, Red Hat OpenShift AI 3.3, Red Hat Quay 3.12, Migration Toolkit for Virtualization, Red Hat Quay 3.15, OpenShift Service Mesh 3, Red Hat Trusted Artifact Signer 1.4, Red Hat OpenShift AI (RHOAI), Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On, Red Hat Ansible Automation Platform 2, Red Hat Ansible Automation Platform 2.6 for RHEL 9, Red Hat Enterprise Linux 8, Red Hat Quay 3.16, Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions, Red Hat Ansible Automation Platform 2.5 for RHEL 8, Red Hat AI Inference Server 3.3, Red Hat Migration Toolkit 1.8, Red Hat OpenShift AI (RHOAI), Red Hat OpenShift AI (RHOAI), Red Hat OpenShift AI 3.3, Red Hat OpenShift AI (RHOAI), Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions, Red Hat OpenShift AI 2.25, Red Hat Satellite 6, Red Hat OpenShift AI (RHOAI), Red Hat Quay 3.9, Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On, Red Hat OpenShift AI 3.3, Red Hat OpenShift AI 3.3, Red Hat Ansible Automation Platform 2.5, Red Hat OpenShift Container Platform 4, Red Hat Enterprise Linux 8.6 Telecommunications Update Service, Red Hat Ansible Automation Platform 2, Red Hat Ansible Automation Platform 2.5 for RHEL 9, pyasn1, Red Hat Ansible Automation Platform 2.6, Red Hat OpenShift AI 3.3, Red Hat OpenShift AI 3.3, Red Hat Ansible Automation Platform 2
Provider severity
HIGH
Conflicts
2

CVE-2026-30921

OneUptime is a solution for monitoring and managing online services. Prior to 10.0.20, OneUptime Synthetic Monitors allow low-privileged project users to submit custom Playwright code that is executed on the oneuptime-probe service. In the current implementation, this untrusted code is run inside Node's vm and is given live host Playwright objects such as browser and page. This creates a distinct server-side RCE primitive: the attacker does not need the classic this.constructor.constructor(...)

PUBLISHED
Vendor
OneUptime
Product
oneuptime
Provider severity
CRITICAL
Conflicts
0

CVE-2026-30920

OneUptime is a solution for monitoring and managing online services. Prior to 10.0.19, OneUptime's GitHub App callback trusts attacker-controlled state and installation_id values and updates Project.gitHubAppInstallationId with isRoot: true without validating that the caller is authorized for the target project. This allows an attacker to overwrite another project's GitHub App installation binding. Related GitHub endpoints also lack effective authorization, so a valid installation ID can be used

PUBLISHED
Vendor
OneUptime
Product
oneuptime
Provider severity
HIGH
Conflicts
1

CVE-2026-30919

facileManager is a modular suite of web apps built with the sysadmin in mind. Prior to 6.0.4 , stored XSS (also known as persistent or second-order XSS) occurs when an application receives data from an untrusted source and includes that data in its subsequent HTTP responses in an unsafe manner. This vulnerability was found in the fmDNS module. This vulnerability is fixed in 6.0.4.

PUBLISHED
Vendor
facileManager
Product
facileManager
Provider severity
HIGH
Conflicts
0

CVE-2026-30918

facileManager is a modular suite of web apps built with the sysadmin in mind. Prior to 6.0.4 , a reflected XSS occurs when an application receives data from an untrusted source and uses it in its HTTP responses in a way that could lead to vulnerabilities. It is possible to inject malicious JavaScript code into a URL by adding a script in a parameter. This vulnerability was found in the fmDNS module. The parameter that is vulnerable to an XSS attack is log_search_query. This vulnerability is fixe

PUBLISHED
Vendor
facileManager
Product
facileManager
Provider severity
HIGH
Conflicts
0

CVE-2026-30917

Bucket is a MediaWiki extension to store and retrieve structured data on articles. Prior to 2.1.1, a stored XSS can be inserted into any Bucket table field that has a PAGE type, which will execute whenever a user views that table's corresponding Bucket namespace page. This vulnerability is fixed in 2.1.1.

PUBLISHED
Vendor
weirdgloop
Product
mediawiki-extensions-Bucket
Provider severity
HIGH
Conflicts
0

CVE-2026-30915

SFTPGo is an open source, event-driven file transfer solution. SFTPGo versions before v2.7.1 contain an input validation issue in the handling of dynamic group paths, for example, home directories or key prefixes. When a group is configured with a dynamic home directory or key prefix using placeholders like %username%, the value replacing the placeholder is not strictly sanitized against relative path components. Consequently, if a user is created with a specially crafted username the resulting

PUBLISHED
Vendor
drakkan
Product
sftpgo
Provider severity
MEDIUM
Conflicts
0

CVE-2026-30914

SFTPGo is an open source, event-driven file transfer solution. In SFTPGo versions prior to 2.7.1, a path normalization discrepancy between the protocol handlers and the internal Virtual Filesystem routing can lead to an authorization bypass. An authenticated attacker can craft specific file paths to bypass folder-level permissions or escape the boundaries of a configured Virtual Folder. This vulnerability is fixed in 2.7.1.

PUBLISHED
Vendor
drakkan
Product
sftpgo
Provider severity
MEDIUM
Conflicts
0

CVE-2026-30913

Flarum is open-source forum software. When the flarum/nicknames extension is enabled, a registered user can set their nickname to a string that email clients interpret as a hyperlink. The nickname is inserted verbatim into plain-text notification emails, and recipients may be misled into visiting attacker-controlled domains.

PUBLISHED
Vendor
flarum
Product
nicknames
Provider severity
MEDIUM
Conflicts
0

CVE-2026-30912

In case of SQL errors, exception/stack trace of errors was exposed in API even if "api/expose_stack_traces" was set to false. That could lead to exposing additional information to potential attacker. Users are recommended to upgrade to Apache Airflow 3.2.0, which fixes the issue.

PUBLISHED
Vendor
Apache Software Foundation
Product
Apache Airflow
Provider severity
HIGH
Conflicts
0

CVE-2026-30911

Apache Airflow versions 3.1.0 through 3.1.7 missing authorization vulnerability in the Execution API's Human-in-the-Loop (HITL) endpoints that allows any authenticated task instance to read, approve, or reject HITL workflows belonging to any other task instance. Users are recommended to upgrade to Apache Airflow 3.1.8 or later, which resolves this issue.

PUBLISHED
Vendor
Apache Software Foundation
Product
Apache Airflow
Provider severity
HIGH
Conflicts
0

CVE-2026-30910

Crypt::Sodium::XS versions through 0.001000 for Perl has potential integer overflows. Combined aead encryption, combined signature creation, and bin2hex functions do not check that output size will be less than SIZE_MAX, which could lead to integer wraparound causing an undersized output buffer. This can cause a crash in bin2hex and encryption algorithms other than aes256gcm. For aes256gcm encryption and signatures, an undersized buffer could lead to buffer overflow. Encountering this issue is

PUBLISHED
Vendor
IAMB
Product
Crypt::Sodium::XS
Provider severity
HIGH
Conflicts
0

CVE-2026-3091

An uncontrolled search path element vulnerability in Synology Presto Client before 2.1.3-0672 allows local users to read or write arbitrary files and conduct denial-of-service during installation by placing a malicious DLL in advance in the same directory as the installer.

PUBLISHED
Vendor
Synology
Product
Synology Presto Client
Provider severity
MEDIUM
Conflicts
0

CVE-2026-30909

Crypt::NaCl::Sodium versions through 2.002 for Perl has potential integer overflows. bin2hex, encrypt, aes256gcm_encrypt_afternm and seal functions do not check that output size will be less than SIZE_MAX, which could lead to integer wraparound causing an undersized output buffer. Encountering this issue is unlikely as the message length would need to be very large. For bin2hex() the bin_len would have to be > SIZE_MAX / 2 For encrypt() the msg_len would need to be > SIZE_MAX - 16U For aes256

PUBLISHED
Vendor
TIMLEGGE
Product
Crypt::NaCl::Sodium
Provider severity
CRITICAL
Conflicts
0

CVE-2026-30906

Untrusted search path in the installer for Zoom Rooms for Windows before version 7.0.0 may allow an authenticated user to enable an escalation of privilege via local access.

PUBLISHED
Vendor
Zoom Communications
Product
Zoom Rooms
Provider severity
HIGH
Conflicts
0

CVE-2026-30905

External Control of File Name or Path in the Zoom Workplace VDI Plugin Windows Universal Installer before version 6.6.11 may allow an authenticated user to conduct an escalation of privilege via local access.

PUBLISHED
Vendor
Zoom Communications
Product
Zoom Workplace VDI Plugin
Provider severity
HIGH
Conflicts
0

CVE-2026-30904

Protection Mechanism Failure in Zoom Workplace for iOS before version 7.0.0 may allow an authenticated user to conduct a disclosure of information via physical access.

PUBLISHED
Vendor
Zoom Communications
Product
Zoom Workplace
Provider severity
LOW
Conflicts
0

CVE-2026-30903

External Control of File Name or Path in the Mail feature of Zoom Workplace for Windows before 6.6.0 may allow an unauthenticated user to conduct an escalation of privilege via network access.

PUBLISHED
Vendor
Zoom Communications
Product
Zoom Workplace
Provider severity
CRITICAL
Conflicts
0

CVE-2026-30902

Improper Privilege Management in certain Zoom Clients for Windows may allow an authenticated user to conduct an escalation of privilege via local access.

PUBLISHED
Vendor
Zoom Communications Inc.
Product
Zoom Workplace
Provider severity
HIGH
Conflicts
0

CVE-2026-30901

Improper Input Validation in Zoom Rooms for Windows before 6.6.5 in Kiosk Mode may allow an authenticated user to conduct an escalation of privilege via local access.

PUBLISHED
Vendor
Zoom Communications Inc.
Product
Zoom Rooms
Provider severity
HIGH
Conflicts
0

CVE-2026-30900

Improper Check of minimum version in update functionality of certain Zoom Clients for Windows may allow an authenticated user to conduct an escalation of privilege via local access.

PUBLISHED
Vendor
Zoom Communications Inc.
Product
Zoom Workplace
Provider severity
HIGH
Conflicts
0

CVE-2026-3090

The Post SMTP – Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘event_type’ parameter in all versions up to, and including, 3.8.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The vulnerability is only expl

PUBLISHED
Vendor
saadiqbal
Product
Post SMTP – Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App
Provider severity
HIGH
Conflicts
0

CVE-2026-30898

An example of BashOperator in Airflow documentation suggested a way of passing dag_run.conf in the way that could cause unsanitized user input to be used to escalate privileges of UI user to allow execute code on worker. Users should review if any of their own DAGs have adopted this incorrect advice.

PUBLISHED
Vendor
Apache Software Foundation
Product
Apache Airflow
Provider severity
HIGH
Conflicts
0

CVE-2026-30897

A stack-based buffer overflow vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.3, FortiWeb 7.6.0 through 7.6.6, FortiWeb 7.4.0 through 7.4.11, FortiWeb 7.2 all versions, FortiWeb 7.0 all versions may allow a remote authenticated attacker who can bypass stack protection and ASLR to execute arbitrary code or commands via crafted HTTP requests.

PUBLISHED
Vendor
Fortinet
Product
FortiWeb
Provider severity
MEDIUM
Conflicts
0

CVE-2026-30896

The installer for Qsee Client versions 1.0.1 and prior insecurely load Dynamic Link Libraries (DLLs). When a user is directed to place some malicious DLL to the same directory and execute the affected installer, then arbitrary code may be executed with the administrative privilege.

PUBLISHED
Vendor
Qsee
Product
Qsee Client
Provider severity
HIGH
Conflicts
1

CVE-2026-30895

Lack of output escaping leads to a XSS vector in the readmore links for com_content.

PUBLISHED
Vendor
Joomla! Project
Product
Joomla! CMS
Provider severity
MEDIUM
Conflicts
0

CVE-2026-30894

Lack of output escaping leads to a XSS vector in the content history component.

PUBLISHED
Vendor
Joomla! Project
Product
Joomla! CMS
Provider severity
MEDIUM
Conflicts
0

CVE-2026-30893

Wazuh is a free and open source platform used for threat prevention, detection, and response. From version 4.4.0 to before version 4.14.4, a path traversal vulnerability in Wazuh's cluster synchronization extraction routine allows an authenticated cluster peer to write arbitrary files outside the intended extraction directory on other cluster nodes. This can be escalated to code execution in the Wazuh service context by overwriting Python modules loaded by Wazuh components (proof of concept avai

PUBLISHED
Vendor
wazuh
Product
wazuh
Provider severity
CRITICAL
Conflicts
1

CVE-2026-30892

crun is an open source OCI Container Runtime fully written in C. In versions 1.19 through 1.26, the `crun exec` option `-u` (`--user`) is incorrectly parsed. The value `1` is interpreted as UID 0 and GID 0 when it should have been UID 1 and GID 0. The process thus runs with higher privileges than expected. Version 1.27 patches the issue.

PUBLISHED
Vendor
containers
Product
crun
Provider severity
NONE
Conflicts
0

CVE-2026-30891

Discourse is an open-source discussion platform. Prior to versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2, a user could access another user's private activity due to insufficient authorization checks in the user actions endpoint. Versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2 contain a patch.

PUBLISHED
Vendor
discourse
Product
discourse
Provider severity
MEDIUM
Conflicts
0

CVE-2026-3089

Actual Sync Server allows authenticated users to upload files through POST /sync/upload-user-file. In versions prior to 26.3.0, improper validation of the user-controlled x-actual-file-id header means that traversal segments (../) can escape the intended directory and write files outside userFiles.This issue affects prior versions of Actual Sync Server 26.3.0.

PUBLISHED
Vendor
Actual
Product
Actual Sync Server
Provider severity
MEDIUM
Conflicts
0

CVE-2026-30889

Discourse is an open-source discussion platform. Prior to versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2, a moderator could exploit insufficient authorization checks to access metadata of posts they should not have permission to view. Versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2 contain a patch.

PUBLISHED
Vendor
discourse
Product
discourse
Provider severity
MEDIUM
Conflicts
0

CVE-2026-30888

Discourse is an open-source discussion platform. Versions prior to 2026.3.0-latest.1, 2026.2.1, and 2026.1.2 allow a moderator to edit site policy documents (ToS, guidelines, privacy policy) that they are explicitly prohibited from modifying. Versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2 contain a patch. No known workarounds are available.

PUBLISHED
Vendor
discourse
Product
discourse
Provider severity
LOW
Conflicts
0

CVE-2026-30887

OneUptime is a solution for monitoring and managing online services. Prior to 10.0.18, OneUptime allows project members to run custom Playwright/JavaScript code via Synthetic Monitors to test websites. However, the system executes this untrusted user code inside the insecure Node.js vm module. By leveraging a standard prototype-chain escape (this.constructor.constructor), an attacker can bypass the sandbox, gain access to the underlying Node.js process object, and execute arbitrary system comman

PUBLISHED
Vendor
OneUptime
Product
oneuptime
Provider severity
CRITICAL
Conflicts
0

CVE-2026-30886

New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system. Prior to version 0.11.4-alpha.2, an Insecure Direct Object Reference (IDOR) vulnerability in the video proxy endpoint (`GET /v1/videos/:task_id/content`) allows any authenticated user to access video content belonging to other users and causes the server to authenticate to upstream AI providers (Google Gemini, OpenAI) using credentials derived from tasks they do not own. The missing authoriza

PUBLISHED
Vendor
QuantumNous
Product
new-api
Provider severity
MEDIUM
Conflicts
0

CVE-2026-30885

WWBN AVideo is an open source video platform. Prior to 25.0, the /objects/playlistsFromUser.json.php endpoint returns all playlists for any user without requiring authentication or authorization. An unauthenticated attacker can enumerate user IDs and retrieve playlist information including playlist names, video IDs, and playlist status for any user on the platform. This vulnerability is fixed in 25.0.

PUBLISHED
Vendor
WWBN
Product
AVideo
Provider severity
MEDIUM
Conflicts
1

CVE-2026-30884

mdjnelson/moodle-mod_customcert is a Moodle plugin for creating dynamically generated certificates with complete customization via the web browser. Prior to versions 4.4.9 and 5.0.3, a teacher who holds `mod/customcert:manage` in any single course can read and silently overwrite certificate elements belonging to any other course in the Moodle installation. The `core_get_fragment` callback `editelement` and the `mod_customcert_save_element` web service both fail to verify that the supplied `eleme

PUBLISHED
Vendor
mdjnelson
Product
moodle-mod_customcert
Provider severity
CRITICAL
Conflicts
0