Vulnerability feed

CVE and vendor PSIRT advisories from 13 sources, last 30 days. Updated hourly, last run Oct 26 01:05 UTC

Critical in the last 24 hours

1603 in 30 days

Newly known exploited

In the last 24 hours, CISA KEV and vendor reports

Sources checked

Every hour, see the list

New in the last 24 hours

136-77% vs 7-day avg of 597

2 critical, 34 high, 59 medium, 21 low

17332 advisories Export 50 shown as CSV

Expand	Severity	Score	Advisory	Title	Source	Published
	Low	2.1	CVE-2026-116099	A flaw has been found in Fusion Creators Studio SCP Containment Breach Multiplayer up to 1.295 Fusion Creators StudioFusion Creators Studio SCP Containment Breach Multiplayer	NVD	Oct 26 00:17 UTC
CVE-2026-116099A flaw has been found in Fusion Creators Studio SCP Containment Breach Multiplayer up to 1.295 Executive summary A flaw has been reported in Fusion Creators Studio SCP Containment Breach Multiplayer, affecting versions up to 1.295. The advisory text describes a buffer overflow that could allow remote code execution, and it links to a public exploit repository. The advisory does not state a severity rating, and no vendor fix or recommendation is provided in the text. Technical summary The advisory describes a buffer overflow vulnerability that allows arbitrary remote code execution. The stated preconditions are subscribing to a malicious addon on the workshop or connecting to a server that runs the RCE addon, and then playing the game. The affected version is stated as up to 1.295 in the title, and no fixed version is stated. No workaround, CVSS score, or vendor patch guidance is stated. Detection guidance is not stated, and the referenced repository includes a proof-of-concept exploit file named Exploit.gs. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from https://github.com/drbloop2000/SCP-CBM-RCE/tree/main Impact if exploited ConfidentialityLow IntegrityLow AvailabilityLow How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required None User interaction Passive CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects Fusion Creators Studio Fusion Creators Studio SCP Containment Breach Multiplayer NIST National Vulnerability DatabasePublished Oct 26, 2026 00:17 UTC Read the advisory
	Medium	5.3	CVE-2026-116098	A vulnerability was detected in SteelRaven7 Ravenfield 25407073 SteelRaven7SteelRaven7 Ravenfield	NVD	Oct 26 00:17 UTC
CVE-2026-116098A vulnerability was detected in SteelRaven7 Ravenfield 25407073 Executive summary The advisory reports a vulnerability in SteelRaven7 Ravenfield, but the text provided is a Steam Community web page and contains no description of the flaw itself. The severity and vendor recommendations are not stated. Technical summary The advisory text only says a vulnerability was detected in SteelRaven7 Ravenfield 25407073, followed by boilerplate Steam Community page content. The vulnerability class, attack vector, and preconditions are not stated. Affected and fixed versions are not stated beyond the version string 25407073 shown in the title. No workaround, detection guidance, CVSS score, or evidence of exploitation is stated. Defenders should consult the NVD entry and the vendor for technical details. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from https://steamcommunity.com/app/636480/events/590690402783479125 Impact if exploited ConfidentialityLow IntegrityLow AvailabilityLow How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required None User interaction Passive CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects SteelRaven7 SteelRaven7 Ravenfield NIST National Vulnerability DatabasePublished Oct 26, 2026 00:17 UTC Read the advisory
	Low	2.1	CVE-2026-116097	A security vulnerability has been detected in CloudClassroom-PHP-Project CloudClassroom-PHP-ProjectCloudClassroom-PHP-Project, CloudClassroom-PHP-Project addnewstudent.php	NVD	Oct 26 00:17 UTC
CVE-2026-116097A security vulnerability has been detected in CloudClassroom-PHP-Project Executive summary A stored cross-site scripting flaw affects CloudClassroom-PHP-Project version 1.0 and prior, in the addnewstudent.php and studentdetails.php components. The advisory rates it Medium with a CVSS score of 6.1 and says the product is unpatched with no fix available yet. The advisory's recommended mitigations are output encoding, input validation, restricting access to the affected component, and reviewing sessions and credentials. Technical summary The flaw is stored (persistent) cross-site scripting (CWE-79) in addnewstudent.php, where the fname, lname, faname, addrs and course fields are saved without sanitization and echoed back without HTML encoding, and the name is rendered unencoded in studentdetails.php. The advisory states that no authentication is needed to inject the data, that a victim admin or faculty user must view the record (user interaction required), and that the attack is remote over the network via POST. Affected versions are listed as 1.0 (and prior), and the fixed version is listed as None. The advisory gives workarounds: htmlspecialchars encoding with ENT_QUOTES, input validation, Content-Security-Policy, prepared statements, network ACLs and WAF rules, and session invalidation. It provides log search indicators for suspicious values such as script, onerror, onload and svg tags. It does not state a CVE identifier, an official vendor response, or any evidence of exploitation in the wild. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from https://github.com/vinniboy021-blip/Advisory/blob/main/addnewstudent-stored-xss.md Impact if exploited ConfidentialityNone IntegrityLow AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required None User interaction Passive CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects CloudClassroom-PHP-Project CloudClassroom-PHP-Project CloudClassroom-PHP-Project addnewstudent.php NIST National Vulnerability DatabasePublished Oct 26, 2026 00:17 UTC Read the advisory
	Low	1.9	CVE-2026-116096	A weakness has been identified in ggml-org llama.cpp ggml-orgggml-org llama.cpp	NVD	Oct 25 23:17 UTC
CVE-2026-116096A weakness has been identified in ggml-org llama.cpp Executive summary The advisory describes a weakness in ggml-org llama.cpp, a C/C++ library for running large language models. The text provided is mostly repository content and does not describe the weakness, its severity, or a vendor fix, so these points are not stated. Technical summary The advisory does not state the vulnerability class, attack vector, or preconditions. It does not list affected or fixed versions, workarounds, CVSS score, or exploitation status. The only identifiable reference is to the llama.cpp master branch repository page, which is not a version statement. Defenders should consult the NVD entry at the provided URL or the upstream project's security policy for the specific details. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from https://github.com/ggml-org/llama.cpp/ Impact if exploited ConfidentialityLow IntegrityLow AvailabilityLow How it is exploited Attack vector Local Attack complexity Low Attack requirements None Privileges required Low User interaction None CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects ggml-org ggml-org llama.cpp NIST National Vulnerability DatabasePublished Oct 25, 2026 23:17 UTC Read the advisory
	Medium	5.5	CVE-2026-116095	A vulnerability was identified in smg-project smg 1.7.0/1.8.0/1.9.0/1.10.0/1.10.1 smg-projectsmg-project smg	NVD	Oct 25 23:17 UTC
CVE-2026-116095A vulnerability was identified in smg-project smg 1.7.0/1.8.0/1.9.0/1.10.0/1.10.1 Executive summary The advisory describes a flaw in smg-project smg versions 1.7.0 through 1.10.1 that appears to involve a crafted JPEG image causing excessive memory allocation. The advisory text is mostly a copied GitHub gist page and does not state a severity rating or a fixed version. No vendor recommendation is stated in the text provided. Technical summary The advisory text is a copied gist page containing a proof-of-concept Python script that writes JPEG files declaring dimensions of 65500x65500 and 20000x20000, which the script says would require a large byte allocation in a decoder, and PNG control files. The vulnerability class is not explicitly stated, though the script comments suggest resource exhaustion through image dimension handling. The attack vector and preconditions are implied to be supplying a crafted image to the affected software, but this is not explicitly stated. Affected versions are listed as 1.7.0/1.8.0/1.9.0/1.10.0/1.10.1, and fixed versions, workarounds, CVSS score, and detection guidance are not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from https://gist.github.com/Yunzez/24a1bf4c226fbc324ea8da1d202c6d9b Impact if exploited ConfidentialityNone IntegrityNone AvailabilityLow How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required None User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects smg-project smg-project smg NIST National Vulnerability DatabasePublished Oct 25, 2026 23:17 UTC Read the advisory
	Medium	5.5	CVE-2026-116094	A vulnerability was determined in EyouCMS up to 1.8.3 EyouCMSEyouCMS	NVD	Oct 25 22:16 UTC
CVE-2026-116094A vulnerability was determined in EyouCMS up to 1.8.3 Executive summary A vulnerability was reported in EyouCMS up to version 1.8.3, a content management system. The advisory describes a server-side request forgery flaw that can be triggered from the public site, but it does not state a severity rating. Technical summary The advisory describes server-side request forgery caused by a missing SSRF check in the remote_file_to_local() function, which can be reached from the front end. It states the affected range as up to 1.8.3, but no fixed version is stated. Attack preconditions, CVSS score, and exploitation in the wild are not stated. No workaround is stated. No detection guidance is stated; the text mainly consists of repository file listings and references to a reproduction document and vulnerability report that are not included here. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from https://github.com/yy-t1/security-reports/tree/main/web/EyouCMS1.8.2/remote_file_to_local()%E7%BC%BA%E5%A4%B1%20SSRF%20%E6%A0%A1%E9%AA%8C%E5%AF%BC%E8%87%B4%E5%89%8D%E5%8F%B0%20SSRF Impact if exploited ConfidentialityLow IntegrityLow AvailabilityLow How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required None User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects EyouCMS EyouCMS NIST National Vulnerability DatabasePublished Oct 25, 2026 22:16 UTC Read the advisory
	Medium	6.0	CVE-2026-115635	Incorrect Authorization vulnerability in ash-project ash_postgres allows a user to read another tenant's record through a skipped upsert. When Ash.bulk_create/4 or a single... ash-projectash-project ash_postgres	NVD	Oct 25 20:16 UTC
CVE-2026-115635Incorrect Authorization vulnerability in ash-project ash_postgres allows a user to read another tenant's record through a skipped upsert. When Ash.bulk_create/4 or a single... Executive summary A flaw in AshPostgres, a database library used with the Ash framework, can let one tenant read another tenant's record in a multi-tenant application. The advisory rates it MEDIUM with a CVSS 4.0 base score of 6.0. The advisory points to a fix in version 2.15.2 and the fix commit 8aa8122, and it does not state any workaround. Technical summary This is an Incorrect Authorization flaw (CWE-863) in the ash_postgres data layer. When an upsert is skipped during Ash.bulk_create/4 or a single create with return_skipped_upsert?: true, the lookup of the existing row did not apply attribute multitenancy, so a user could receive another tenant's record that shares the same identity values. The advisory says the affected range is from 2.6.22 before 2.15.2 on Hex, and from commit af0903f up to commit 8aa8122 on GitHub. The CVSS vector is CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N, which requires low privileges and a resource that uses attribute multitenancy with return_skipped_upsert?: true. The advisory does not state any workaround or in-the-wild exploitation, and it gives no specific detection guidance beyond the affected routines. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from https://cna.erlef.org/cves/CVE-2026-115635.html Impact if exploited ConfidentialityHigh IntegrityNone AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Attack requirements Present Privileges required Low User interaction None CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects ash-project ash-project ash_postgres NIST National Vulnerability DatabasePublished Oct 25, 2026 20:16 UTC Read the advisory
	Medium	6.0	CVE-2026-115627	Incorrect Authorization vulnerability in ash-project ash_postgres allows a user to load destination records linked to a source record only through another tenant's join... ash-projectash-project ash_postgres	NVD	Oct 25 20:16 UTC
CVE-2026-115627Incorrect Authorization vulnerability in ash-project ash_postgres allows a user to load destination records linked to a source record only through another tenant's join... Executive summary A flaw in the ash_postgres library, used with the Elixir Ash framework, lets a user in one tenant see records that belong to other tenants' data when certain relationships are loaded. The advisory rates it MEDIUM with a CVSS 4.0 score of 6.0. The advisory states the affected range is from 0.38.0 before 2.15.2 on Hex, and the fix is in commit 8c25c94 on GitHub; it does not explicitly state an upgrade recommendation beyond that fix. Technical summary This is an Incorrect Authorization flaw (CWE-863) where AshPostgres builds lateral join queries for many_to_many and through relationships without running the resource's read action, so attribute multitenancy is not applied to the join resource. The attack requires an authenticated user with low privileges (PR:L) and network access, and the preconditions are that the join resource uses :attribute multitenancy with rows from several tenants and that the relationship is loaded with a lateral join, such as with a limit, offset or sort. The advisory states the affected Hex versions as 0.38.0 up to but not including 2.15.2, and the GitHub affected range as commit 7115bec up to but not including 8c25c94. A workaround is not stated in the advisory. Detection guidance is not stated beyond the affected function names lateral_join_query/3, through_step_queries/4 and run_query_with_lateral_join/4 in lib/data_layer.ex. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from https://cna.erlef.org/cves/CVE-2026-115627.html Impact if exploited ConfidentialityHigh IntegrityNone AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Attack requirements Present Privileges required Low User interaction None CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects ash-project ash-project ash_postgres NIST National Vulnerability DatabasePublished Oct 25, 2026 20:16 UTC Read the advisory
	Medium	6.0	CVE-2026-114214	Incorrect Authorization vulnerability in ash-project ash allows a client to read destination records unrelated to the source record through a through relationship. When a... ash-projectash-project ash	NVD	Oct 25 20:16 UTC
CVE-2026-114214Incorrect Authorization vulnerability in ash-project ash allows a client to read destination records unrelated to the source record through a through relationship. When a... Executive summary A flaw in the Ash framework, an Elixir library from ash-project, lets a client read destination records that should only be reachable through a specific relationship. The advisory rates it MEDIUM with a CVSS 4.0 score of 6.0. The vendor's fix is in version 3.37.1, and the advisory says affected versions are 3.24.0 before 3.37.1. Technical summary This is an Incorrect Authorization flaw (CWE-863) in the Ash read relationships code, specifically lateral_join?/4 in lib/ash/actions/read/relationships.ex. When a has_many through relationship is loaded for a single record with a limit of 1, or an unsorted has_one through relationship is loaded with a limit of 1, the query omits the filter linking destination records to the source, so the load returns unrelated records; paging with an offset can enumerate more of them. The attack vector is network with low complexity, and the CVSS vector requires low privileges and no user interaction, with high confidentiality impact. The advisory states the affected range as 3.24.0 up to but not including 3.37.1, with fix commit e374633, and says the vulnerable Git range is 24f41e2 to e374633. The advisory does not state a workaround or any detection guidance, and does not state whether the flaw has been exploited in the wild. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from https://cna.erlef.org/cves/CVE-2026-114214.html Impact if exploited ConfidentialityHigh IntegrityNone AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Attack requirements Present Privileges required Low User interaction None CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects ash-project ash-project ash NIST National Vulnerability DatabasePublished Oct 25, 2026 20:16 UTC Read the advisory
	Low	2.0	CVE-2026-116063	A weakness has been identified in DedeCMS up to 5.7.118 DedeCMSDedeCMS	NVD	Oct 25 18:16 UTC
CVE-2026-116063A weakness has been identified in DedeCMS up to 5.7.118 Executive summary A remote code execution weakness has been reported in DedeCMS up to version 5.7.118, a content management system. The advisory rates it 7.2 under CVSS v3.1 base and 8.8 for the other listed score, and it lists a code injection flaw in the update guide script. Technical summary The advisory describes a code injection flaw in dede/update_guide.php that can lead to remote code execution, mapped to CWE-94, CWE-96, and CWE-352. The table lists CVSS v3.1 scores of 7.2 / 8.8 without stating which score is the base score, and it does not state the attack vector, required privileges, or user interaction in plain terms. The advisory does not state a fixed version, a workaround, or any detection guidance. It also does not state whether exploitation has been observed in the wild. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from https://github.com/SDshadow/cve Impact if exploited ConfidentialityLow IntegrityLow AvailabilityLow How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required High User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects DedeCMS DedeCMS NIST National Vulnerability DatabasePublished Oct 25, 2026 18:16 UTC Read the advisory
	Medium	5.5	CVE-2026-116062	A security flaw has been discovered in SourceCodester Performance Indicator System 1.0 SourceCodesterSourceCodester Performance Indicator System	NVD	Oct 25 18:16 UTC
CVE-2026-116062A security flaw has been discovered in SourceCodester Performance Indicator System 1.0 Executive summary A SQL injection flaw has been reported in the Performance Indicator System 1.0 from SourceCodester, a PHP and MySQLi web application. The advisory says an attacker can exploit it without logging in to read, change, or delete database data. The advisory does not state a severity rating, a fixed version, or a vendor patch. Technical summary The flaw is SQL injection in the 'contact' parameter of /opils/staff/save_profile.php, where user input is placed directly into SQL queries without validation. The advisory describes it as time-based blind and says no login or authorization is required. The affected version is listed as V1.0, and no fixed version is stated. No workaround is stated beyond the suggested repair of using prepared statements with parameter binding, strict input validation, least-privilege database accounts, and regular audits. The advisory gives no detection guidance, no CVSS score, and does not say whether exploitation in the wild has been observed. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from https://github.com/hubdk01/cve/issues/13 Impact if exploited ConfidentialityLow IntegrityLow AvailabilityLow How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required None User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects SourceCodester SourceCodester Performance Indicator System NIST National Vulnerability DatabasePublished Oct 25, 2026 18:16 UTC Read the advisory
	Medium	5.5	CVE-2026-116061	A vulnerability was identified in SourceCodester Performance Indicator System 1.0 SourceCodesterSourceCodester Performance Indicator System	NVD	Oct 25 18:16 UTC
CVE-2026-116061A vulnerability was identified in SourceCodester Performance Indicator System 1.0 Executive summary A SQL injection flaw has been reported in the Performance Indicator System 1.0 from SourceCodester, a PHP and MySQLi application. The advisory says an attacker needs no login to exploit it, which could expose or change database contents. The advisory does not state a vendor fix or official severity score, and it recommends using prepared statements, input validation, least-privilege database accounts, and regular security audits. Technical summary The flaw is SQL injection in the 'contact' parameter of /opils/staff/edit_dealer.php, which the advisory says is passed directly into SQL queries without validation. The advisory describes it as time-based blind injection, reproduced with sqlmap, and says no login or authorization is required. The affected version is listed as V1.0; a fixed version is not stated. No workaround beyond the suggested code fixes (prepared statements, input validation, minimal database permissions) is given, and no CVSS score or detection guidance is stated. Exploitation in the wild is not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from https://github.com/hubdk01/cve/issues/12 Impact if exploited ConfidentialityLow IntegrityLow AvailabilityLow How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required None User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects SourceCodester SourceCodester Performance Indicator System NIST National Vulnerability DatabasePublished Oct 25, 2026 18:16 UTC Read the advisory
	Medium	5.5	CVE-2026-116060	A vulnerability was determined in SourceCodester Performance Indicator System 1.0 SourceCodesterSourceCodester Performance Indicator System	NVD	Oct 25 17:17 UTC
CVE-2026-116060A vulnerability was determined in SourceCodester Performance Indicator System 1.0 Executive summary A SQL injection flaw has been reported in the Performance Indicator System 1.0 from SourceCodester, a PHP and MySQLi application. The advisory says an attacker who needs no login could read, change, or delete database data and potentially disrupt the service. The advisory does not state a severity score or a vendor fix, and it recommends prepared statements, input validation, and least-privilege database accounts. Technical summary The flaw is a SQL injection in the 'contact' parameter of /opils/staff/adddealer.php, reached through a multipart/form-data POST request. The advisory states no login or authorization is required, and it describes a time-based blind variant that was confirmed with sqlmap. The affected version is listed as V1.0, and no fixed version is stated. No vendor patch, workaround beyond the suggested code fixes, CVSS score, or exploitation in the wild is stated. The suggested repair is to use prepared statements with parameter binding, validate and filter input, restrict database account privileges, and run regular security audits. The advisory gives no specific detection guidance such as log signatures. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from https://github.com/hubdk01/cve/issues/11 Impact if exploited ConfidentialityLow IntegrityLow AvailabilityLow How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required None User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects SourceCodester SourceCodester Performance Indicator System NIST National Vulnerability DatabasePublished Oct 25, 2026 17:17 UTC Read the advisory
	Unknown	n/a	CVE-2026-115825	HTTP::Server::PSGI versions before 1.0056 for Perl allow a single request to crash the server by declaring a large Content-Length. The request body is read with sysread()... HTTP::Server::PSGIHTTP::Server::PSGI	NVD	Oct 25 17:17 UTC
CVE-2026-115825HTTP::Server::PSGI versions before 1.0056 for Perl allow a single request to crash the server by declaring a large Content-Length. The request body is read with sysread()... Executive summary HTTP::Server::PSGI for Perl, in versions before 1.0056, can be crashed by a single request that declares a very large Content-Length. The advisory describes this as a denial of service that makes the server run out of memory, and it says a fix caps body reads at 64 KiB. The advisory does not state a CVSS score or an explicit vendor recommendation beyond the fix in the patch. Technical summary The flaw is a resource exhaustion (denial of service) issue in HTTP::Server::PSGI, where the whole remaining Content-Length is passed to sysread and Perl grows the buffer to that size before reading, causing an "Out of memory!" failure on Linux. The attack needs only a single crafted HTTP request declaring a large Content-Length; no authentication is mentioned in the advisory. Affected versions are stated as before 1.0056, and the fixed version is stated as 1.0056 by the vendor's description of the affected range. The fix reads the body in chunks of at most 64 KiB, and the added test checks that a huge Content-Length does not produce a sysread larger than MAX_REQUEST_SIZE. No workarounds, CVSS score, exploitation status, or detection guidance is stated in the advisory. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from https://github.com/plack/Plack/commit/11545871cadc5df1b744cebb429cfeb4ebc1069a.patch Score No CVSS score published. Affects HTTP::Server::PSGI HTTP::Server::PSGI NIST National Vulnerability DatabasePublished Oct 25, 2026 17:17 UTC Read the advisory
	Unknown	n/a	CVE-2026-115824	Starman versions before 0.4019 for Perl allow memory exhaustion via unbounded buffering of chunked request bodies. The chunked body decoder keeps each chunk in memory until... StarmanStarman	NVD	Oct 25 17:17 UTC
CVE-2026-115824Starman versions before 0.4019 for Perl allow memory exhaustion via unbounded buffering of chunked request bodies. The chunked body decoder keeps each chunk in memory until... Executive summary Starman, a Perl web server, has a flaw that lets an attacker exhaust server memory by sending chunked request bodies that the server keeps buffering without limit. The advisory does not state a severity rating or CVSS score. The fix is included in version 0.4019, and the advisory indicates the patch is available in the repository. Technical summary The advisory describes unbounded buffering of chunked request bodies in the chunk decoder, which can cause memory exhaustion, and the commit message also describes a quadratic-backtracking regex in chunk-size line parsing (CVE-2026-115822) that consumes CPU. The attack requires sending crafted chunked HTTP requests to a Starman server; the advisory does not state authentication or other preconditions. Affected versions are stated as those before 0.4019, and the fixed version is 0.4019. The fix replaces the regex with index() and an anchored parser, limits chunk-size lines to 4096 bytes, rejects sizes over 13 hex digits with 400 and closes the connection, and makes _prepare_env return an error status so bad bodies are not dispatched. No workarounds are stated, and no detection guidance or exploitation status is stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from https://github.com/miyagawa/Starman/commit/0f33f9b132b5e410d6cce722ff71988e22476acf.patch Score No CVSS score published. Affects Starman Starman NIST National Vulnerability DatabasePublished Oct 25, 2026 17:17 UTC Read the advisory
	Unknown	n/a	CVE-2026-115823	Starman versions before 0.4019 for Perl send response bodies for HEAD requests, desynchronizing responses on keep-alive connections. For a HEAD request Starman omits chunked... StarmanStarman	NVD	Oct 25 17:17 UTC
CVE-2026-115823Starman versions before 0.4019 for Perl send response bodies for HEAD requests, desynchronizing responses on keep-alive connections. For a HEAD request Starman omits chunked... Executive summary Starman, a Perl web server, sends response bodies for HEAD requests and for 1xx, 204 and 304 responses, which can cause response desynchronization on keep-alive connections. The advisory does not state a severity rating or an exploitation status, and the fix is in Starman versions 0.4019 and later. Technical summary The flaw is a response desynchronization issue (HTTP response smuggling class) in Starman before 0.4019 for Perl, where bodies are written for HEAD, 1xx, 204 and 304 responses even though those responses must not carry a body. On keep-alive or pipelined connections, the extra bytes are read as the start of the next response, and a front end that pools upstream connections can be affected. The advisory does not state a CVSS score, attack preconditions beyond keep-alive or pipelined connections, or a workaround. The fix is in commit 91c47c529cd1e100f938486896ea9083ec3ec7bf, which skips body output for these responses and closes object bodies without reading them, and it adds a test file t/no_body_response.t. Detection guidance is not stated, and the advisory names no specific fixed release beyond the version threshold of 0.4019. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from https://github.com/miyagawa/Starman/commit/91c47c529cd1e100f938486896ea9083ec3ec7bf.patch Score No CVSS score published. Affects Starman Starman NIST National Vulnerability DatabasePublished Oct 25, 2026 17:17 UTC Read the advisory
	Unknown	n/a	CVE-2026-115822	Starman versions before 0.4019 for Perl allow CPU exhaustion via quadratic regex backtracking when parsing chunked request bodies. Starman decodes chunked request bodies... StarmanStarman	NVD	Oct 25 17:17 UTC
CVE-2026-115822Starman versions before 0.4019 for Perl allow CPU exhaustion via quadratic regex backtracking when parsing chunked request bodies. Starman decodes chunked request bodies... Executive summary The advisory says Starman, a Perl web server, is affected by a flaw that lets a remote sender exhaust CPU on the server by sending chunked request bodies with long runs of hex digits. The advisory does not give a severity rating or CVSS score. The vendor-side fix is a code change that rejects malformed or overly long chunk-size lines with a 400 error, and the advisory says versions before 0.4019 are affected. Technical summary The flaw is a regular expression backtracking problem (quadratic complexity, a form of algorithmic CPU exhaustion) in parsing the chunk-size line of chunked request bodies, which the commit message says ran again over the whole buffer after every read. The attacker needs only to send an HTTP request with Transfer-Encoding: chunked; the advisory says 32 KiB of input cost about 1.7 seconds of worker CPU. The fix bounds chunk-size lines to 4096 bytes, parses them with an anchored linear-time pattern, rejects sizes with more than 13 significant hex digits, and returns 400 and closes the connection on malformed input. The advisory states affected versions as before 0.4019, but it does not state a fixed version number explicitly, and no workaround is stated. No detection guidance or evidence of exploitation in the wild is stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from https://github.com/miyagawa/Starman/commit/0f33f9b132b5e410d6cce722ff71988e22476acf.patch Score No CVSS score published. Affects Starman Starman NIST National Vulnerability DatabasePublished Oct 25, 2026 17:17 UTC Read the advisory
	Unknown	n/a	CVE-2026-115817	Starman versions before 0.4019 for Perl allow a stalled request body to hold a worker indefinitely, as read_timeout covers only the headers. Content-Length and chunked request... StarmanStarman	NVD	Oct 25 17:17 UTC
CVE-2026-115817Starman versions before 0.4019 for Perl allow a stalled request body to hold a worker indefinitely, as read_timeout covers only the headers. Content-Length and chunked request... Executive summary Starman, a Perl web server, has a flaw where a client that sends a request body and then stalls can keep a server worker busy indefinitely, which can exhaust workers with only a few connections. The advisory describes the severity only in terms of workers being taken; a CVSS score is not stated. The fix adds a total time limit for reading request bodies, and the advisory's guidance is to update Starman to a release at or after 0.4019 (the fixed version is stated as 0.4019 in the advisory's wording of affected versions before 0.4019). Technical summary The weakness is a resource exhaustion issue (missing timeout on request body reads): read_timeout applied only to request headers, so a Content-Length or chunked body could stall or trickle indefinitely. The attack requires only network access to the Starman listener and a few open connections to tie up workers, and no authentication is mentioned. Affected versions are stated as before 0.4019 and the fix adds a --body-timeout option (body_timeout, default 300 seconds, 0 disables) that responds with 408 Request Timeout and closes the connection. The advisory does not state a CVSS score, a CWE, exploitation in the wild, or detection guidance beyond the timeout behavior, and it recommends a reverse proxy that buffers request bodies as a mitigation. Workaround details beyond setting body_timeout are not otherwise stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from https://github.com/miyagawa/Starman/commit/89dffd3bdc9baa1cbe1b48a43615586ba2588558.patch Score No CVSS score published. Affects Starman Starman NIST National Vulnerability DatabasePublished Oct 25, 2026 17:17 UTC Read the advisory
	Medium	5.3	CVE-2026-116058	A vulnerability was found in Alfresco Activiti up to 7.21.0-rc.692 AlfrescoAlfresco Activiti	NVD	Oct 25 16:16 UTC
CVE-2026-116058A vulnerability was found in Alfresco Activiti up to 7.21.0-rc.692 Executive summary A vulnerability has been reported in Alfresco Activiti, a workflow product, affecting versions up to 7.21.0-rc.692. The advisory says it can be exploited remotely to inject code, and the vendor did not respond when contacted about it. The advisory does not state a severity score or a fix. Technical summary The flaw is described as code injection in the JuelScriptEngine.eval function of JuelScriptEngine.java, which is reached by performing a manipulation that the advisory does not specify. The attack can be initiated remotely. The advisory does not state any required privileges or user interaction, and it does not state a CVSS score. The advisory affects versions up to and including 7.21.0-rc.692, and no fixed version is stated. No workaround or detection guidance is stated. The vendor was contacted early but did not respond. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Impact if exploited ConfidentialityLow IntegrityLow AvailabilityLow How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required Low User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects Alfresco Alfresco Activiti NIST National Vulnerability DatabasePublished Oct 25, 2026 16:16 UTC Read the advisory
	Low	2.1	CVE-2026-116057	A vulnerability has been found in KodCloud KodExplorer up to 4.55 KodCloudKodCloud KodExplorer	NVD	Oct 25 16:16 UTC
CVE-2026-116057A vulnerability has been found in KodCloud KodExplorer up to 4.55 Executive summary KodCloud KodExplorer, a web-based file manager, is affected by a vulnerability in versions up to 4.55. The advisory says the flaw can be exploited remotely and that exploit details are public, but it does not state a severity score. The advisory does not state any vendor-recommended fix, and the vendor did not respond to early disclosure. Technical summary The flaw is an unrestricted upload issue in the Online Editor Save Endpoint, located in app/controller/editor.class.php, where manipulation of the path/filestr argument is reported. It can be attacked remotely, and the advisory says an exploit has been publicly disclosed and may be used. Affected versions are stated only as up to 4.55, and no fixed version is stated. No workaround, detection guidance, CVSS score, or authentication requirement is stated in the advisory. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Impact if exploited ConfidentialityLow IntegrityLow AvailabilityLow How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required Low User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects KodCloud KodCloud KodExplorer NIST National Vulnerability DatabasePublished Oct 25, 2026 16:16 UTC Read the advisory
	Medium	5.3	CVE-2026-116056	A flaw has been found in KodCloud KodExplorer up to 4.56 KodCloudKodCloud KodExplorer	NVD	Oct 25 16:16 UTC
CVE-2026-116056A flaw has been found in KodCloud KodExplorer up to 4.56 Executive summary A flaw has been found in KodCloud KodExplorer, a file management product, up to version 4.56. The advisory describes it as a server-side request forgery issue that can be triggered remotely. The vendor did not respond when contacted about the disclosure, and no fix or vendor recommendation is stated. Technical summary The flaw is server-side request forgery in the request_url_safe function of app/function/web.function.php, within the Remote Download component. An attacker can trigger it remotely by manipulating input to that function. The advisory states affected versions as up to 4.56 but does not state any fixed version. No workaround, exploitation status, CVSS score, or detection guidance is stated. The vendor was contacted early but did not respond. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Impact if exploited ConfidentialityLow IntegrityLow AvailabilityLow How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required Low User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects KodCloud KodCloud KodExplorer NIST National Vulnerability DatabasePublished Oct 25, 2026 16:16 UTC Read the advisory
	Low	2.1	CVE-2026-116055	A vulnerability was detected in SourceCodester Performance Indicator System 1.0 SourceCodesterSourceCodester Performance Indicator System	NVD	Oct 25 15:17 UTC
CVE-2026-116055A vulnerability was detected in SourceCodester Performance Indicator System 1.0 Executive summary A SQL injection flaw was reported in the Performance Indicator System 1.0 from SourceCodester, a PHP and MySQLi web application. The advisory says an attacker needs no login to exploit it, which could expose or change database contents and disrupt the service. The advisory does not state a fixed version or a vendor patch, and it recommends code fixes such as prepared statements and input validation. Technical summary The flaw is SQL injection in the 'id' parameter of /opils/admin/deleteproduct.php, where user input is placed directly into SQL queries without validation. The advisory states that no login or authorization is required, and it provides a POST request example. Boolean-based blind and time-based blind techniques were demonstrated with sqlmap. The affected version is listed as V1.0, and no fixed version is stated. No vendor workaround is stated beyond the suggested remediation of parameterized queries, input filtering, least-privilege database accounts, and security audits. No detection guidance or CVSS score is stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from https://github.com/hubdk01/cve/issues/5 Impact if exploited ConfidentialityLow IntegrityLow AvailabilityLow How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required Low User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects SourceCodester SourceCodester Performance Indicator System NIST National Vulnerability DatabasePublished Oct 25, 2026 15:17 UTC Read the advisory
	Low	1.2	CVE-2026-116054	A security vulnerability has been detected in SH3 SH3SH3 Módulo de Gestão/Módulo de Arrecadação	NVD	Oct 25 15:17 UTC
CVE-2026-116054A security vulnerability has been detected in SH3 Executive summary A weakness has been reported in SH3, a product whose Gestão and Arrecadação management modules are affected. The advisory says the flaw is hard to exploit remotely, but a public exploit has been disclosed and may be used. The vendor's recommendation is to upgrade the affected component to version 2026.0.2.0. Technical summary The flaw is classified as a password hash computed with insufficient computational effort, which weakens protection of stored credentials if an attacker obtains the hashes. The attack can be carried out remotely, but the advisory says it is highly complex and rated difficult to exploit. A public exploit has been disclosed. The advisory states that upgrading to version 2026.0.2.0 mitigates the issue; it does not state the vulnerable version range. No workaround, CVSS score, or detection guidance is stated in the advisory. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Impact if exploited ConfidentialityLow IntegrityNone AvailabilityNone How it is exploited Attack vector Network Attack complexity High Attack requirements None Privileges required High User interaction None CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects SH3 SH3 Módulo de Gestão/Módulo de Arrecadação NIST National Vulnerability DatabasePublished Oct 25, 2026 15:17 UTC Read the advisory
	High	8.8	CVE-2026-116211	YesWiki 4.5.0 before 4.7.0 contains an SQL injection vulnerability in PageManager::save(), where the date_maj_fiche field of a Bazar entry-creation request is concatenated... YesWikiyeswiki	NVD	Oct 25 14:17 UTC
CVE-2026-116211YesWiki 4.5.0 before 4.7.0 contains an SQL injection vulnerability in PageManager::save(), where the date_maj_fiche field of a Bazar entry-creation request is concatenated... Executive summary YesWiki versions from 4.5.0 before 4.7.0 contain an SQL injection flaw in the Bazar entry creation feature, where a date field from the request is inserted into a database query without escaping. The advisory rates it High with a CVSS score of 8.2 and says the fix is in version 4.7.0, so users should upgrade to 4.7.0 or later. Technical summary The flaw is CWE-89 SQL injection in PageManager::save(), where the date_maj_fiche POST field is concatenated raw into an INSERT SET statement via the forcedDate parameter instead of being escaped like the other columns. The advisory describes a network attack with low complexity and no privileges required on the authenticated path, and says an unauthenticated path via action=saisir_fiche works on a default install, with confidentiality impact rated High. Affected versions are stated as >= 4.5.0, < 4.7.0 in the package data and <= 4.6.7 in the description, and the patched version is 4.7.0. The advisory suggests escaping $forcedDate at the sink or validating date_maj_fiche as a strict datetime, but does not state any other workaround. Detection guidance is not stated, and whether the flaw is exploited in the wild is not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from https://github.com/YesWiki/yeswiki/security/advisories/GHSA-wjf7-hrf3-9gcx Impact if exploited ConfidentialityHigh IntegrityLow AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required None User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects YesWiki yeswiki NIST National Vulnerability DatabasePublished Oct 25, 2026 14:17 UTC Read the advisory
	High	7.2	CVE-2026-116208	YesWiki from 4.6.2 before 4.7.0 contains a missing authorization vulnerability in ActivityPubService::syncActorPosts that lets malicious ActivityPub servers manipulate other... YesWikiyeswiki	NVD	Oct 25 14:17 UTC
CVE-2026-116208YesWiki from 4.6.2 before 4.7.0 contains a missing authorization vulnerability in ActivityPubService::syncActorPosts that lets malicious ActivityPub servers manipulate other... Executive summary YesWiki, a wiki package used with ActivityPub federation, has a missing authorization flaw in its sync feature. A malicious federated server can cause a YesWiki administrator's routine sync to delete, overwrite, or create entries that belong to other federated actors. The advisory rates it High (8.1 CVSS) and states the fix status is not fixed, with the affected range given as versions 4.6.2 through 4.6.7; the advisory does not state a patched version for the sync path. Technical summary The flaw is CWE-862 (missing authorization) in ActivityPubService::syncActorPosts, which processes Delete, Update, and Create activities from a remote outbox without the assertOwns() and sameHost() checks used by the inbox handler, and runs a host-scoped garbage-collection delete. Exploitation requires an administrator to trigger the sync action (a GET request with no CSRF token), and the attacker needs no privileges on the wiki; the CVSS vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H. The advisory lists the affected range as >= 4.6.2 and <= 4.6.7 in the body, while the metadata says '< 4.7.0' and the patched version is listed as 4.7.0, but it also says the fix status is 'not fixed' for the sync path. Workarounds are stated as avoiding sync with untrusted actors and adding a CSRF token to the sync action, which the advisory suggests but does not confirm as implemented. No detection guidance is stated, and no exploitation in the wild is stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from https://github.com/YesWiki/yeswiki/security/advisories/GHSA-cr64-h6xp-9g2j Impact if exploited ConfidentialityNone IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required None User interaction Passive CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects YesWiki yeswiki NIST National Vulnerability DatabasePublished Oct 25, 2026 14:17 UTC Read the advisory
	High	8.8	CVE-2026-116207	YesWiki 4.6.0 before 4.7.0 and 5.0.0-alpha1 before 5.0.0-alpha4 contains an unauthenticated SQL injection vulnerability in SearchManager::prepareSearchRequest() YesWikiyeswiki	NVD	Oct 25 14:17 UTC
CVE-2026-116207YesWiki 4.6.0 before 4.7.0 and 5.0.0-alpha1 before 5.0.0-alpha4 contains an unauthenticated SQL injection vulnerability in SearchManager::prepareSearchRequest() Executive summary YesWiki, a wiki platform, has a critical flaw that lets anyone on the network read data from its database, including user credentials, without logging in. It can also be used to make the site unavailable by overloading the database. The advisory recommends updating to 4.7.0 or 5.0.0-alpha4, and restricting network access to the public Bazar entries API until then. Technical summary The flaw is an unauthenticated SQL injection (CWE-89) in the Bazar entries search API, reachable through GET /api/forms/{formId}/entries and /api/entries/bazarlist. A backtick in the query or searchfields field name breaks out of a backtick-quoted SQL alias, because the code uses mysqli_real_escape_string, which does not escape backticks. Injected SELECT subqueries can read any table the database user can access, and results are returned in the JSON response, while SLEEP-based subqueries can exhaust database connections. The advisory states the vector is network with low complexity and no privileges or user interaction, and gives CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H with a score of 9.1. Fixed versions are stated as 4.7.0 and 5.0.0-alpha4, while the affected range is inconsistently described as 4.6.0 before 4.7.0 and 5.0.0-alpha1 before 5.0.0-alpha4 in one place and as 4.6.7 through 5.0.0-alpha3 in the detailed text. Recommended interim mitigation is restricting network access to the public Bazar endpoints. Detection guidance is not stated, and no in-the-wild exploitation is mentioned. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from https://github.com/YesWiki/yeswiki/security/advisories/GHSA-ccp2-6q93-hggh Impact if exploited ConfidentialityHigh IntegrityNone AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required None User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects YesWiki yeswiki NIST National Vulnerability DatabasePublished Oct 25, 2026 14:17 UTC Read the advisory
	Medium	5.3	CVE-2026-116206	YesWiki from 4.2.0 before 4.7.0 contains a stored cross-site scripting vulnerability that allows authenticated users to inject script into comment bodies using the wakka... YesWikiyeswiki	NVD	Oct 25 14:17 UTC
CVE-2026-116206YesWiki from 4.2.0 before 4.7.0 contains a stored cross-site scripting vulnerability that allows authenticated users to inject script into comment bodies using the wakka... Executive summary YesWiki, a wiki package distributed through Composer, has a stored cross-site scripting flaw affecting versions from 4.2.0 up to but not including 4.7.0. The advisory rates it Moderate (CVSS 6.4) and says any logged-in user who can comment on a page can run scripts in the browsers of everyone who views that page, including administrators. The advisory lists 4.7.0 as the patched version, but its body says no fix exists in any published release, so administrators should confirm the status with the vendor before relying on an upgrade. Technical summary The flaw is CWE-79 stored cross-site scripting in comment bodies. Comments are saved with only whitespace trimming and are rendered with the Twig raw filter, and the wiki raw-HTML syntax is enabled by default through allow_raw_html set to true, so any authenticated user with comment access on a page can inject script through POST /api/comments. The CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N, and the advisory says no user interaction beyond viewing the page is needed. The header lists affected versions as >= 4.2.0, < 4.7.0 and patched version as 4.7.0, but the body says the confirmed affected range is >= 4.2.0, <= 4.6.7 and that the fix status is not fixed. The advisory suggests sanitizing comment bodies at storage or setting allow_raw_html to false as an interim step, but it does not state a fixed release that the body confirms. No detection guidance or indicators of exploitation in the wild are stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from https://github.com/YesWiki/yeswiki/security/advisories/GHSA-wq96-vjjh-hfc6 Impact if exploited ConfidentialityLow IntegrityLow AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required Low User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects YesWiki yeswiki NIST National Vulnerability DatabasePublished Oct 25, 2026 14:17 UTC Read the advisory
	Medium	6.9	CVE-2026-116205	YesWiki before 4.7.0 contains an unauthenticated server-side request forgery vulnerability that allows remote attackers to fetch arbitrary URLs by supplying [[\|URL]] wiki... YesWikiyeswiki	NVD	Oct 25 14:17 UTC
CVE-2026-116205YesWiki before 4.7.0 contains an unauthenticated server-side request forgery vulnerability that allows remote attackers to fetch arbitrary URLs by supplying [[\|URL]] wiki... Executive summary YesWiki versions before 4.7.0 contain an unauthenticated server-side request forgery flaw. Any anonymous visitor can make the YesWiki server fetch arbitrary internal or external URLs and read the responses back. The advisory rates it Moderate with a CVSS 3.1 base score of 5.3, and the fix is to upgrade to version 4.7.0. Technical summary The flaw is CWE-918 server-side request forgery in the wiki raw-inclusion syntax [[\|URL]], which fetches attacker-supplied URLs without scheme, host, or IP validation and echoes the response body. It is reachable without authentication through the page render handler using the content parameter, and also stored via a page body saved by a registered editor that fires when anonymous visitors view it. The advisory states the affected versions are less than 4.7.0 and the patched version is 4.7.0. The CVSS vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. A workaround is not stated, and no detection guidance beyond the proof of concept's access log observation is provided. No CVE ID is listed in the advisory, and exploitation in the wild is not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from https://github.com/YesWiki/yeswiki/security/advisories/GHSA-x9j5-r988-9jcc Impact if exploited ConfidentialityLow IntegrityNone AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required None User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects YesWiki yeswiki NIST National Vulnerability DatabasePublished Oct 25, 2026 14:17 UTC Read the advisory
	High	7.2	CVE-2026-116204	YesWiki before 4.7.0 contains a cross-site request forgery vulnerability in the despam action (tools/security/actions/despam.php) that lets unauthenticated attackers delete or... YesWikiyeswiki	NVD	Oct 25 14:17 UTC
CVE-2026-116204YesWiki before 4.7.0 contains a cross-site request forgery vulnerability in the despam action (tools/security/actions/despam.php) that lets unauthenticated attackers delete or... Executive summary YesWiki, a wiki package distributed through Composer, has a cross-site request forgery flaw in its admin despam action. An unauthenticated attacker who gets a logged-in administrator to view a planted wiki page could permanently delete pages or restore old revisions, with the front page and configuration pages at risk. The advisory rates it High (CVSS 8.1) and recommends adding CSRF token checks, but it contradicts itself on which versions are fixed. Technical summary The flaw is CWE-352 in tools/security/actions/despam.php, where the destructive clean (suppr[]) and revision-restore (rev[]) branches are guarded only by a session-based UserIsAdmin() check, with no CSRF token, Origin, or Referer verification. The advisory describes the attack as requiring default configuration (default_write_acl='*', allow_raw_html=true), an attacker-created wiki page containing an auto-submitting form, and an administrator visiting that page; the session cookie's SameSite=Lax setting still allows the same-site POST. Affected versions conflict within the advisory: the header lists affected versions as before 4.7.0 with patched version 4.7.0, while the body states a confirmed affected range of <= 4.6.8 and says the fix status is not fixed. The advisory also says the v5 pre-release 5.0.0.0-alpha3 is affected, though it is outside the stable range it scopes. The stated CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H with a base score of 8.1. Recommended fixes are to require a CSRF token on the clean and revision-restore branches, with CSP script-src and form-action 'self' and a permissions.action entry for despam as defense-in-depth. Detection guidance and exploitation in the wild are not stated, and the advisory notes no CVE is assigned. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from https://github.com/YesWiki/yeswiki/security/advisories/GHSA-cv88-hx5q-vq72 Impact if exploited ConfidentialityNone IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required None User interaction Passive CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects YesWiki yeswiki NIST National Vulnerability DatabasePublished Oct 25, 2026 14:17 UTC Read the advisory
	Medium	5.3	CVE-2026-116203	YesWiki before 4.7.0 contains a stored cross-site scripting vulnerability in the filtertags action, which echoes attacker-controlled token values without output encoding YesWikiyeswiki	NVD	Oct 25 14:17 UTC
CVE-2026-116203YesWiki before 4.7.0 contains a stored cross-site scripting vulnerability in the filtertags action, which echoes attacker-controlled token values without output encoding Executive summary YesWiki versions before 4.7.0 contain a stored cross-site scripting flaw in the filtertags action. An anonymous visitor who can create or edit a page could store script that runs for every later viewer of that page. The advisory rates it High and says the fix is to upgrade to version 4.7.0. Technical summary The flaw is stored cross-site scripting (CWE-79) in the filtertags action, where attacker-controlled token values are echoed into page HTML without output encoding, including the button inner text, the title parameter, and the tagbadges value. The payload is injected through the action attribute syntax, which the wakka formatter processes before its allow_raw_html check, so it bypasses that control. Preconditions stated are that default page ACLs on a fresh install are read=* and write=*, and the advisory reports anonymous exploitation using a hashcash token fetched without authentication. Affected versions are stated as before 4.7.0 and the patched version as 4.7.0. The advisory does not state a workaround. It recommends output-encoding the echo sites in tools/tags/actions/filtertags.php. Detection guidance is not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from https://github.com/YesWiki/yeswiki/security/advisories/GHSA-f53x-3gqx-xq76 Impact if exploited ConfidentialityNone IntegrityNone AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required None User interaction Passive CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects YesWiki yeswiki NIST National Vulnerability DatabasePublished Oct 25, 2026 14:17 UTC Read the advisory
	Medium	5.1	CVE-2026-116202	YesWiki before 4.7.0 contains a stored cross-site scripting vulnerability that allows low-privilege authenticated users to upload unsanitized SVG files through the bazar... YesWikiyeswiki	NVD	Oct 25 14:17 UTC
CVE-2026-116202YesWiki before 4.7.0 contains a stored cross-site scripting vulnerability that allows low-privilege authenticated users to upload unsanitized SVG files through the bazar... Executive summary A stored cross-site scripting flaw in YesWiki lets a low-privilege authenticated user upload a malicious SVG file through an image field, and the script runs for people who open the entry or the stored file. The advisory says the earlier fix for a related form-upload issue did not cover this image field, so the flaw remains on the patched version. The advisory lists the affected version as before 4.7.0 and the patched version as 4.7.0, and it recommends applying the same upload sanitization to the image field. Technical summary This is a stored cross-site scripting issue (CWE-79) caused by unrestricted SVG upload through the ImageField class in tools/bazar/fields/ImageField.php, which stores files without the sanitizer that the sibling FileField class received in the earlier fix. The attacker needs a valid authenticated account (PR:L) and user interaction (UI:R), and posts a multipart request to /api/entries/{formId} with an SVG file that is then served as image/svg+xml on the wiki origin. The advisory states the affected versions as less than 4.7.0 and the patched version as 4.7.0, and it says the fix for this specific field is not yet present. No workaround is stated. No detection guidance is stated beyond the proof-of-concept description. The advisory does not state any exploitation in the wild or a CVSS score. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from https://github.com/YesWiki/yeswiki/security/advisories/GHSA-c5q6-7233-3v6g Impact if exploited ConfidentialityNone IntegrityNone AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required Low User interaction Passive CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects YesWiki yeswiki NIST National Vulnerability DatabasePublished Oct 25, 2026 14:17 UTC Read the advisory
	High	8.7	CVE-2026-116201	Snipe-IT before 8.5.0 contains a SAML assertion replay vulnerability that allows attackers to reuse captured assertions by exploiting a non-atomic nonce check in the SAML acs... grokability, Snipe-ITgrokability snipe-it, Snipe-IT	NVD	Oct 25 14:17 UTC
CVE-2026-116201Snipe-IT before 8.5.0 contains a SAML assertion replay vulnerability that allows attackers to reuse captured assertions by exploiting a non-atomic nonce check in the SAML acs... Executive summary Snipe-IT versions before 8.5.0 contain a flaw that lets an attacker reuse a captured SAML login assertion to obtain multiple valid sessions for the same user. The advisory rates the severity as Moderate and says the fix is in version 8.5.0. Technical summary This is a race condition (TOCTOU, CWE-367) in the SAML assertion nonce check, enabling capture-replay (CWE-294). The nonce check and insert were not atomic and the saml_nonces.nonce column had a non-unique index, so two concurrent POST /saml/acs requests with the same captured assertion could both log in. Affected versions are stated as <= 8.4.1 and the patched version is 8.5.0, with fixes in commit 5b0a779c07 and a unique index migration that runs saml:clear_expired_nonces first. Preconditions are SAML SSO enabled with valid IdP metadata, an attacker holding one valid assertion, and the ability to submit it twice within a sub-second race window. No workaround is stated. Exploitation in the wild is not stated, and no CVE ID is listed (the advisory says No known CVE). Specific detection guidance is not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from https://github.com/grokability/snipe-it/security/advisories/GHSA-w49g-f2jc-qxhg Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required Low User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects grokability Snipe-IT grokability snipe-it Snipe-IT NIST National Vulnerability DatabasePublished Oct 25, 2026 14:17 UTC Read the advisory
	High	8.2	CVE-2026-116200	Snipe-IT before 8.6.3 ignores the ldap_start_tls() return value in Ldap::connectToLdap(), allowing on-path attackers to force cleartext LDAP binds grokability, Snipe-ITgrokability snipe-it, Snipe-IT	NVD	Oct 25 14:17 UTC
CVE-2026-116200Snipe-IT before 8.6.3 ignores the ldap_start_tls() return value in Ldap::connectToLdap(), allowing on-path attackers to force cleartext LDAP binds Executive summary Snipe-IT versions up to and including 8.6.2 can send LDAP login credentials, including the service account password and end-user passwords, in cleartext when an attacker on the network path interferes with the encrypted connection setup. The advisory rates the issue Moderate and recommends upgrading to version 8.6.3 or later, which fixes the flaw. Technical summary The flaw is a cleartext transmission of sensitive information issue (CWE-319) caused by an algorithm downgrade during negotiation (CWE-757). In Ldap::connectToLdap(), the return value of ldap_start_tls() was ignored, so when StartTLS failed, the code still performed an ldap_bind() in cleartext. Exploitation requires LDAP authentication enabled with ldap_tls = 1, and an attacker on the network path between Snipe-IT and the LDAP server, who answers the StartTLS request with a Protocol error or the server does not offer StartTLS. Affected versions are stated as <= 8.6.2 and the patched version is 8.6.3, fixed in commit 91ea06904f. The advisory does not state any workaround. It does not state whether exploitation has occurred in the wild, and no CVSS score is given. No detection guidance is provided beyond the stated exploitability conditions. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from https://github.com/grokability/snipe-it/security/advisories/GHSA-wx48-r3qh-jvh5 Impact if exploited ConfidentialityHigh IntegrityNone AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Attack requirements Present Privileges required None User interaction None CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects grokability Snipe-IT grokability snipe-it Snipe-IT NIST National Vulnerability DatabasePublished Oct 25, 2026 14:17 UTC Read the advisory
	Critical	9.2	CVE-2026-116199	Snipe-IT before 8.6.3 contains an authentication bypass in GoogleAuthController::handleGoogleCallback, which logs in the user whose username matches the Google account email... grokability, Snipe-ITgrokability snipe-it, Snipe-IT	NVD	Oct 25 14:17 UTC
CVE-2026-116199Snipe-IT before 8.6.3 contains an authentication bypass in GoogleAuthController::handleGoogleCallback, which logs in the user whose username matches the Google account email... Executive summary A flaw in Snipe-IT, an IT asset management application, lets users who have been deactivated sign in through Google single sign-on if their Google account is still active. The advisory rates it Moderate and says it affects versions 8.6.2 and earlier. The vendor recommends upgrading to version 8.6.3 or later. Technical summary The Google SSO callback in GoogleAuthController::handleGoogleCallback looks up the local user by username matching the Google account email and logs them in without checking the activated flag, which is a missing authorization check (CWE-285) and an improper authentication weakness (CWE-287). The advisory says exploitation requires Google SSO to be enabled, a deployment that uses email-as-username or an email-shaped username on the account, a deactivated account, and a still-live Google identity. Affected versions are stated as 8.6.2 and earlier, and the fix is in 8.6.3 (commit 5fea2fadc0), which checks the activated flag after lookup. The advisory does not state a CVE ID, a CVSS score, or any workaround other than upgrading. It does not state whether exploitation has been observed in the wild, and it gives no specific detection guidance. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from https://github.com/grokability/snipe-it/security/advisories/GHSA-xf36-wx48-5rqp Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Attack requirements Present Privileges required None User interaction None CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects grokability Snipe-IT grokability snipe-it Snipe-IT NIST National Vulnerability DatabasePublished Oct 25, 2026 14:17 UTC Read the advisory
	Medium	5.3	CVE-2026-116198	Snipe-IT before 8.7.0 contains a missing encryption vulnerability in Api\AssetsController::store that writes plaintext into encrypted-flagged custom-field columns when callers... grokability, Snipe-ITgrokability snipe-it, Snipe-IT	NVD	Oct 25 14:17 UTC
CVE-2026-116198Snipe-IT before 8.7.0 contains a missing encryption vulnerability in Api\AssetsController::store that writes plaintext into encrypted-flagged custom-field columns when callers... Executive summary Snipe-IT versions 8.6.3 and earlier have a flaw in the API asset-creation path that can store sensitive custom field values as plaintext when the caller lacks the permission needed to write encrypted fields. The advisory rates the issue Low and says it is fixed in version 8.7.0, which the vendor recommends installing. Technical summary The flaw is classified as missing encryption of sensitive data (CWE-311) and an always-incorrect control flow implementation (CWE-670) in Api\AssetsController::store. When the caller lacks assets.view.encrypted_custom_fields, the encryption call is skipped and the unencrypted value is written to the database column because the block lacks a continue statement, unlike the update path. The advisory states the affected versions are 8.6.3 and earlier and the fixed version is 8.7.0, with the fix in commit 34dafe9eed. The advisory does not state a CVE ID, a CVSS score, or any workaround. It also does not state whether exploitation has been observed or provide specific detection guidance beyond the description of the impact. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from https://github.com/grokability/snipe-it/security/advisories/GHSA-jh4g-98fm-jcqc Impact if exploited ConfidentialityNone IntegrityLow AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required Low User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects grokability Snipe-IT grokability snipe-it Snipe-IT NIST National Vulnerability DatabasePublished Oct 25, 2026 14:17 UTC Read the advisory
	Low	2.1	CVE-2026-116197	Edgeless Systems Contrast from 1.21.0 before 1.25.0 contains a non-deterministic registry selection flaw in imagepuller that can prefer wildcard configuration entries over... edgelesssys, Edgeless Systemsedgelesssys contrast, Edgeless Systems Contrast	NVD	Oct 25 14:17 UTC
CVE-2026-116197Edgeless Systems Contrast from 1.21.0 before 1.25.0 contains a non-deterministic registry selection flaw in imagepuller that can prefer wildcard configuration entries over... Executive summary Edgeless Systems Contrast versions from 1.21.0 before 1.25.0 contain a flaw in the imagepuller component that can select the wrong registry configuration when both a concrete domain and its parent wildcard are configured. The advisory rates it Low, with a CVSS v3.1 base score of 2.6, and the vendor's fix is to upgrade to 1.25.0 or later. Technical summary The flaw is classified as CWE-1289, improper validation of unsafe equivalence in input, in the imagepuller registry selection logic. It is exploitable only when the registry pull configuration contains both a concrete domain (for example registry.example.com) and its parent domain as a wildcard (for example .example.com), which the advisory describes as very unlikely in practice. The advisory lists affected versions as 1.21.0 through 1.24.1 and the patched version as 1.25.0, with the fix made in pull request #2682. The CVSS v3.1 vector is AV:A/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N, giving a score of 2.6. The advisory states a workaround: replace the wildcard entry with a list of concrete entries. No detection guidance is stated, and no CVE identifier is stated (the advisory says No known CVE). Exploitation in the wild is not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from https://github.com/edgelesssys/contrast/security/advisories/GHSA-w4p9-c7h8-jvgr Impact if exploited ConfidentialityLow IntegrityNone AvailabilityNone How it is exploited Attack vector Adjacent network Attack complexity High Attack requirements Present Privileges required Low User interaction None CVSS:4.0/AV:A/AC:H/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects edgelesssys Edgeless Systems edgelesssys contrast Edgeless Systems Contrast NIST National Vulnerability DatabasePublished Oct 25, 2026 14:17 UTC Read the advisory
	Medium	6.0	CVE-2026-116196	Rclone before v1.75.2 contains a credential exposure vulnerability in the b2 backend that leaks the live account Authorization token and SSE-C keys on HTTP redirects from... rclone, Backblazerclone, Backblaze B2	NVD	Oct 25 14:17 UTC
CVE-2026-116196Rclone before v1.75.2 contains a credential exposure vulnerability in the b2 backend that leaks the live account Authorization token and SSE-C keys on HTTP redirects from... Executive summary Rclone, an open-source tool for copying and syncing files to cloud storage, has a credential exposure flaw in its Backblaze B2 backend. When a custom download host is configured, the live account authorization token and SSE-C encryption keys can be sent over cleartext or to another host during an HTTP redirect, and the advisory rates it Moderate with a CVSS 3.1 base score of 5.3. The advisory says the fix is to update to v1.75.2, with workarounds that include enforcing HTTPS on the download URL and using least-privilege application keys. Technical summary This is a cleartext transmission of sensitive information issue (CWE-319) in the rclone b2 backend, where the default Go HTTP client follows redirects from the custom --b2-download-url host. A same-host HTTPS-to-HTTP redirect causes the Authorization header to be resent in cleartext, and the SSE-C customer key headers are forwarded to any redirect target host. The advisory lists rclone versions before v1.75.2 and states affected versions as <= v1.75.0 with patched version v1.75.2. The attack vector is Adjacent with high complexity, no privileges or user interaction required, and CVSS 3.1 vector AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N. The Remediation section says to update to v1.75.1, which conflicts with the patched version v1.75.2 listed elsewhere in the advisory. Workarounds are to enforce an explicit https:// scheme on --b2-download-url, block plaintext redirects at the CDN, unset the download URL, and use scoped application keys. No CVE identifier is stated in the advisory, and no detection guidance or evidence of exploitation in the wild is stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from https://github.com/rclone/rclone/security/advisories/GHSA-gpw7-77cq-9f72 Impact if exploited ConfidentialityHigh IntegrityNone AvailabilityNone How it is exploited Attack vector Adjacent network Attack complexity High Attack requirements Present Privileges required None User interaction None CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects rclone Backblaze rclone Backblaze B2 NIST National Vulnerability DatabasePublished Oct 25, 2026 14:17 UTC Read the advisory
	High	7.0	CVE-2026-116195	Rclone before 1.75.2 contains a path traversal vulnerability in the local backend's translateLink function, which trims the .rclonelink suffix from a path after the containment... rclone, github.com/rclone/rclonerclone	NVD	Oct 25 14:16 UTC
CVE-2026-116195Rclone before 1.75.2 contains a path traversal vulnerability in the local backend's translateLink function, which trims the .rclonelink suffix from a path after the containment... Executive summary A flaw in the rclone file sync tool lets an attacker who can create a specially named directory in the source tree change ownership and timestamps of a directory outside the destination the operator chose. The advisory rates it Moderate, with a CVSS score of 7.4 for the root-run case and a conservative estimate of about 6.8. The advisory recommends fixing the trimming logic so the name is checked after trimming, and it notes the affected versions are 1.75.1 and earlier, with 1.75.2 as the patched version. Technical summary This is a path traversal (CWE-22, CWE-59) in rclone's local backend, where translateLink trims the .rclonelink suffix from the OS path after the containment check, so validated paths can be shifted one directory up. It requires a local destination with -l and --metadata, and an attacker who can create a directory named .rclonelink in the copied tree. The advisory reports the escape affects metadata only (ownership, timestamps, xattrs) because content writes are blocked by os.Root hardening, and that a root-run case allows ownership change. It lists affected versions as <= 1.75.1 and patched version 1.75.2, but also states that v1.75.0 and master HEAD 4479a3b are affected by its own testing. The suggested fix is to trim the remote name before confinement and re-validate the final path. The advisory does not state a workaround, and it does not state any detection guidance. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from https://github.com/rclone/rclone/security/advisories/GHSA-55qp-jrwr-x827 Impact if exploited ConfidentialityNone IntegrityHigh AvailabilityNone How it is exploited Attack vector Network Attack complexity High Attack requirements Present Privileges required None User interaction Passive CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects rclone github.com/rclone/rclone rclone NIST National Vulnerability DatabasePublished Oct 25, 2026 14:16 UTC Read the advisory
	High	7.6	CVE-2026-116194	Rclone from 1.52.0 before 1.75.2 contains a cross-site request forgery vulnerability in the pCloud backend's localhost OAuth callback, which disables the state check and trusts... rclone, pCloudrclone, pCloud backend	NVD	Oct 25 14:16 UTC
CVE-2026-116194Rclone from 1.52.0 before 1.75.2 contains a cross-site request forgery vulnerability in the pCloud backend's localhost OAuth callback, which disables the state check and trusts... Executive summary Rclone versions from 1.52.0 before 1.75.2 contain a cross-site request forgery flaw in the pCloud backend's localhost OAuth setup callback. A malicious web page open in a user's browser during the pCloud authorization flow can silently point the user's pCloud remote at an attacker-controlled host, causing later file transfers to go to that host. The advisory rates it Moderate with a CVSS score of 6.8, and the fix is to upgrade to v1.75.2. Technical summary The flaw is a missing state check (CWE-352 cross-site request forgery) on rclone's localhost OAuth callback at 127.0.0.1:53682 for the pCloud backend, combined with trust in an unauthenticated hostname parameter (CWE-346). An attacker needs a victim to load a malicious page while rclone config or rclone authorize pcloud is running, and the advisory notes Chrome Private Network Access can block subresource requests while top-level navigation is not blocked. Affected versions are stated as >= 1.52.0 and <= 1.75.1, with patched version v1.75.2. The advisory does not state a workaround. Detection guidance beyond the proof of concept is not stated, and no CVE identifier is listed. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from https://github.com/rclone/rclone/security/advisories/GHSA-hvpr-p4pv-4f46 Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityNone How it is exploited Attack vector Network Attack complexity High Attack requirements Present Privileges required None User interaction Passive CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects rclone pCloud rclone pCloud backend NIST National Vulnerability DatabasePublished Oct 25, 2026 14:16 UTC Read the advisory
	Medium	6.9	CVE-2026-116193	Rclone from 1.64.0 before 1.75.2 contains an authentication bypass vulnerability in serve webdav that lets unauthenticated attackers skip authentication by sending OPTIONS requests rclonerclone	NVD	Oct 25 14:16 UTC
CVE-2026-116193Rclone from 1.64.0 before 1.75.2 contains an authentication bypass vulnerability in serve webdav that lets unauthenticated attackers skip authentication by sending OPTIONS requests Executive summary The advisory says rclone, an open-source file synchronization tool, has an authentication bypass in its serve webdav feature affecting versions from 1.64.0 before 1.75.2. An unauthenticated remote attacker can learn whether arbitrary paths exist and whether they are files or folders, though file contents and writes are not reachable. The advisory rates it Moderate with a CVSS v3 base score of 5.3 and recommends upgrading to 1.75.2. Technical summary The flaw is missing authentication (CWE-306) caused by the basicAuth and MiddlewareAuthCustom HTTP middlewares in lib/http skipping all OPTIONS requests rather than only genuine CORS preflights. An unauthenticated network attacker can send OPTIONS requests to rclone serve webdav and read the Allow header, which differs for existing files, existing collections, and missing paths, enabling namespace enumeration. The advisory states the affected range as >= 1.64.0 and <= 1.75.1, with patched version 1.75.2. No workaround is stated. The advisory does not state whether the issue is exploited in the wild, and it gives no detection guidance beyond the proof of concept. The advisory says rclone serve http and other listed servers are not affected. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from https://github.com/rclone/rclone/security/advisories/GHSA-gj73-fh6v-92fj Impact if exploited ConfidentialityLow IntegrityNone AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required None User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects rclone rclone NIST National Vulnerability DatabasePublished Oct 25, 2026 14:16 UTC Read the advisory
	High	8.2	CVE-2026-116192	rclone from 1.37 before 1.74.2 contains a server-side request forgery vulnerability that allows unauthenticated attackers to redirect http and netstorage backend requests by... rclone, ncwrclone	NVD	Oct 25 14:16 UTC
CVE-2026-116192rclone from 1.37 before 1.74.2 contains a server-side request forgery vulnerability that allows unauthenticated attackers to redirect http and netstorage backend requests by... Executive summary Rclone versions from 1.37 before 1.74.2 contain a server-side request forgery flaw that lets unauthenticated attackers, when the optional --rc-serve feature is enabled without RC authentication, redirect HTTP and NetStorage backend requests to hosts they choose. The advisory rates it Moderate with a recommended CVSS 3.1 score of 5.9. The vendor-side fix is to upgrade to version 1.74.2, which the advisory lists as the patched version. Technical summary This is a server-side request forgery (CWE-918) caused by a scheme-relative named-remote root, such as //host/path, that replaces the configured URL authority for the http and netstorage backends. Exploitation requires --rc-serve enabled, no RC HTTP authentication, a reachable RC listener, and knowledge of an existing http or netstorage remote name; the advisory notes the default bind is loopback and that --rc-no-auth is not set in the tested configuration. Affected versions are stated as 1.37 or later up to and including 1.74.1, with patched version 1.74.2. The advisory says the attacker can cause same-scheme HEAD and GET requests to attacker-selected hosts with response bodies returned, send configured HTTP headers to those hosts, and obtain time-bound NetStorage signatures, but no write primitive is demonstrated. A proposed origin-check patch is described, but the advisory does not state a workaround, and no detection guidance is given. Whether the issue is exploited in the wild is not stated, and no CVE identifier is listed on the advisory. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from https://github.com/rclone/rclone/security/advisories/GHSA-xqmq-v4wj-rw5m Impact if exploited ConfidentialityHigh IntegrityNone AvailabilityNone How it is exploited Attack vector Network Attack complexity High Attack requirements Present Privileges required None User interaction None CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects rclone ncw rclone NIST National Vulnerability DatabasePublished Oct 25, 2026 14:16 UTC Read the advisory
	High	8.7	CVE-2026-116191	Rclone before 1.75.2 contains a path traversal vulnerability in serve webdav that allows unauthenticated attackers to write above the served root by sending an unvalidated '..'... rclone, ncwrclone, ncw rclone	NVD	Oct 25 14:16 UTC
CVE-2026-116191Rclone before 1.75.2 contains a path traversal vulnerability in serve webdav that allows unauthenticated attackers to write above the served root by sending an unvalidated '..'... Executive summary Rclone versions before 1.75.2 contain a path traversal flaw in its WebDAV server (rclone serve webdav) that lets an unauthenticated remote client create, overwrite, and move files and directories above the folder that rclone is configured to serve. The advisory rates it High with a CVSS 3.1 base score of 7.5, and it describes the impact as integrity and availability rather than data disclosure. The vendor's fix is upgrading to version 1.75.2. Technical summary The flaw is a CWE-22 path traversal caused by unvalidated '..' path elements in WebDAV requests, such as MKCOL /. which plants a directory node whose backend path is '..'. The attack needs no authentication, which the advisory says is the default for rclone serve webdav, and requires two HTTP requests (an MKCOL followed by a PUT). The advisory says it applies when the served remote has a non-empty root and the backend joins root and remote before encoding, such as webdav, ftp, sftp, http, or memory, and that local and s3 backends are not affected. Affected versions are stated as <= 1.75.1 and the patched version as 1.75.2; the advisory says the lower bound is not established. Workarounds stated: running with --read-only blocks the attack (the advisory reports MKCOL returning 405), and the advisory proposes code fixes that add path checks. Detection guidance beyond the proof-of-concept request sequence is not stated, and no CVE identifier is stated in the advisory. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from https://github.com/rclone/rclone/security/advisories/GHSA-44pm-2q5p-fm63 Impact if exploited ConfidentialityNone IntegrityHigh AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required None User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects rclone ncw rclone ncw rclone NIST National Vulnerability DatabasePublished Oct 25, 2026 14:16 UTC Read the advisory
	Medium	6.3	CVE-2026-116190	rclone from v1.56.0 before v1.75.2 contains an information disclosure vulnerability in the WebDAV backend that forwards operator-configured custom credential headers to... rclonerclone	NVD	Oct 25 14:16 UTC
CVE-2026-116190rclone from v1.56.0 before v1.75.2 contains an information disclosure vulnerability in the WebDAV backend that forwards operator-configured custom credential headers to... Executive summary The rclone tool's WebDAV backend can send a custom credential header to a different host when the configured WebDAV server issues a cross-host redirect, which could expose a reusable login credential. The advisory rates it Low, with a CVSS 3.7 score and a note that no CVE is assigned. The advisory states that affected versions are v1.56.0 through v1.75.1 and that v1.75.2 is the patched version. Technical summary This is an information disclosure flaw, classified as CWE-200 and CWE-522, in which operator-configured custom headers set via the WebDAV headers option are re-sent on cross-host HTTP 3xx redirects. Exploitation requires that an attacker can influence the server's redirect response, such as through an open redirect, a malicious or compromised endpoint, or an on-path position on a cleartext or same-host hop. The advisory states the fixed version is v1.75.2 and that the default configuration is affected, independent of the auth_redirect option. Standard Authorization headers are stripped by Go across registrable domains, but custom-named headers are not. The advisory does not state a workaround beyond avoiding reusable secret headers on remotes that may redirect to other hosts, and it does not state any detection guidance or known exploitation in the wild. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from https://github.com/rclone/rclone/security/advisories/GHSA-3rqf-7h69-gg5v Impact if exploited ConfidentialityLow IntegrityNone AvailabilityNone How it is exploited Attack vector Network Attack complexity High Attack requirements Present Privileges required None User interaction None CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects rclone rclone NIST National Vulnerability DatabasePublished Oct 25, 2026 14:16 UTC Read the advisory
	High	7.7	CVE-2026-116189	rclone from 1.55.0 before 1.75.2 contains a signature verification bypass in stable selfupdate that trusts checksums from unsigned bytes preceding the PGP-clearsigned... rclone, ncwrclone	NVD	Oct 25 14:16 UTC
CVE-2026-116189rclone from 1.55.0 before 1.75.2 contains a signature verification bypass in stable selfupdate that trusts checksums from unsigned bytes preceding the PGP-clearsigned... Executive summary A flaw in the stable self-update feature of rclone, a command-line file sync tool, lets an attacker who already controls the trusted release download path install a malicious replacement program, affecting versions 1.55.0 through 1.75.1. The advisory rates the issue High, with a CVSS 3.1 score of 7.5. The advisory recommends applying the proposed fix, which resolves the checksum only from the signed portion of the response, but it states that no upstream fixed release was available at the time of testing and the listed patched version is 1.75.2. Technical summary The vulnerability is an improper verification of a cryptographic signature (CWE-347). The verifier checks a PGP clearsigned SHA256SUMS block but then looks up the archive hash in the original response buffer, which can include unsigned bytes before the signed block, so an attacker-supplied unsigned checksum line is accepted. The attack requires control of authenticated responses from the stable release distribution path, such as origin, CDN, or TLS termination compromise, or interception with a trusted certificate, and user interaction in running stable selfupdate without --check. Affected versions are stated as >= 1.55.0 and <= 1.75.1, with patched version 1.75.2. The advisory states a proposed fix of resolving the hash from block.Bytes, which was tested but is not described as shipped upstream. Workarounds are not stated. Detection guidance beyond the proof-of-concept test is not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from https://github.com/rclone/rclone/security/advisories/GHSA-w33h-3qgq-8mv8 Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity High Attack requirements Present Privileges required None User interaction Passive CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects rclone ncw rclone NIST National Vulnerability DatabasePublished Oct 25, 2026 14:16 UTC Read the advisory
	Medium	6.9	CVE-2026-116188	rclone serve s3 versions 1.75.0 before 1.75.2 contain an integer overflow vulnerability in multipart reorder-memory accounting that bypasses the configured buffer limit rclonerclone	NVD	Oct 25 14:16 UTC
CVE-2026-116188rclone serve s3 versions 1.75.0 before 1.75.2 contain an integer overflow vulnerability in multipart reorder-memory accounting that bypasses the configured buffer limit Executive summary The advisory says rclone serve s3 versions 1.75.0 before 1.75.2 contain an integer overflow that lets an unauthenticated network client bypass the configured memory limit for multipart uploads, which can exhaust memory on the host running the service. The severity is rated Moderate, and the advisory lists 1.75.2 as the patched version. Users should upgrade to 1.75.2 or later. Technical summary This is an integer overflow (CWE-190) combined with unbounded resource allocation (CWE-770) in the multipart reorder-memory accounting of rclone serve s3. An attacker who can reach the S3 listener opens two concurrent multipart PUT requests for the current part, each declaring 5,000,000,000,000,000,000 bytes, and withholds the bodies, so the signed int64 accounting field wraps negative and out-of-order parts later pass the capacity check. The advisory says affected versions are 1.75.0 up to but not including 1.75.2, with the patched version listed as 1.75.2. Exploitation needs no credentials when serve s3 runs without --auth-key or --auth-proxy, and authenticated deployments require an accepted S3 credential. The advisory states that no workaround is available beyond binding to a trusted interface, which it says does not fix the arithmetic, and that disabling streaming is not a safe mitigation. Detection guidance is not stated, and the CVSS v3.1 base vector given is AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L, with an overall score shown as 5.3. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from https://github.com/rclone/rclone/security/advisories/GHSA-qjw8-8hmp-c3m6 Impact if exploited ConfidentialityNone IntegrityNone AvailabilityLow How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required None User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects rclone rclone NIST National Vulnerability DatabasePublished Oct 25, 2026 14:16 UTC Read the advisory
	Medium	6.1	CVE-2026-116187	Rclone from v1.68.0 before v1.75.2 contains an authorization bypass vulnerability in serve s3 --auth-proxy that allows authenticated tenants to manipulate other tenants'... rclone, ncwrclone	NVD	Oct 25 14:16 UTC
CVE-2026-116187Rclone from v1.68.0 before v1.75.2 contains an authorization bypass vulnerability in serve s3 --auth-proxy that allows authenticated tenants to manipulate other tenants'... Executive summary Rclone versions from v1.68.0 before v1.75.2 contain an authorization bypass in its S3 server when run with --auth-proxy, letting one authenticated tenant interfere with another tenant's in-flight multipart uploads. The advisory rates it Moderate with a CVSS score of 6.4, and the recommended fix is to upgrade to v1.75.2. Technical summary The flaw is CWE-639, an authorization bypass through a user-controlled key. The multipart operations UploadPart, CompleteMultipartUpload and AbortMultipartUpload look up uploads by upload ID alone and do not check the caller's tenant, so a tenant who learns another tenant's bucket, object and uploadID can inject data into, complete or abort that upload. The advisory says the attacker must be an authenticated tenant on a server using --auth-proxy with several keys, and must obtain the victim's tuple, which it demonstrates through ListMultipartUploads while owning a same-named bucket. Affected versions are stated as >=v1.68.0 <= 1.75.1, with patched version v1.75.2. The advisory does not state a workaround, and detection guidance is not stated. It notes that at-rest content is not read and the destination key is set by the victim at initiate. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from https://github.com/rclone/rclone/security/advisories/GHSA-35g6-9fjv-rmx5 Impact if exploited ConfidentialityHigh IntegrityLow AvailabilityLow How it is exploited Attack vector Network Attack complexity High Attack requirements Present Privileges required Low User interaction None CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects rclone ncw rclone NIST National Vulnerability DatabasePublished Oct 25, 2026 14:16 UTC Read the advisory
	Low	2.3	CVE-2026-116186	OpenRemote core (openremote-manager) before 1.31.0 does not perform realm or gateway-descendant authorization on inbound edge gateway events and maps event asset IDs only... openremoteopenremote core, openremote-manager	NVD	Oct 25 14:16 UTC
CVE-2026-116186OpenRemote core (openremote-manager) before 1.31.0 does not perform realm or gateway-descendant authorization on inbound edge gateway events and maps event asset IDs only... Executive summary The advisory says OpenRemote core (openremote-manager) before 1.31.0 lets a registered edge gateway write and delete assets in any realm, breaking tenant isolation. The advisory gives two different severity ratings: it reports the finding as High, with a base score of 9.6 (Critical) under CVSS v3.1, while the NVD record and the GitHub advisory list it as Low. The fix is to upgrade to version 1.31.0. Technical summary The flaw is an authorization bypass through a user-controlled key: inbound gateway events skip the standard client event authorization, and the only mapping of gateway asset IDs (mapAssetId) shifts the first two characters by a per-gateway offset, which is reversible by anyone who knows the gateway ID. The attacker needs a registered, enabled gateway's service-user credentials, which a realm administrator can obtain, and then can send crafted AttributeEvent or DELETE AssetEvent messages over the gateway session to change attributes or delete leaf assets in other realms. The advisory states the affected versions as less than 1.31.0 and the patched version as 1.31.0, and it says the issue is present in all releases up to 1.26.1. It does not state a workaround. The advisory includes a proof-of-concept that is a standalone re-implementation of the ID transform and does not run against a live system, and it states that a full dynamic test was not performed. No detection guidance is stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from https://github.com/openremote/core/security/advisories/GHSA-8pjc-wq2p-3xr4 Impact if exploited ConfidentialityNone IntegrityLow AvailabilityNone How it is exploited Attack vector Network Attack complexity High Attack requirements None Privileges required Low User interaction None CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects openremote openremote core openremote-manager NIST National Vulnerability DatabasePublished Oct 25, 2026 14:16 UTC Read the advisory
	Medium	5.3	CVE-2026-116185	OpenRemote core before 1.31.0 contains an authorization bypass vulnerability that allows authenticated users to read other realms' gateway tunnel information via... openremoteopenremote core, openremote-manager	NVD	Oct 25 14:16 UTC
CVE-2026-116185OpenRemote core before 1.31.0 contains an authorization bypass vulnerability that allows authenticated users to read other realms' gateway tunnel information via... Executive summary OpenRemote core versions before 1.31.0 contain an authorization bypass that lets an authenticated user in one realm read active gateway tunnel information belonging to another realm. The advisory rates this Moderate (CVSS 5.0) and states that the fix is to upgrade to version 1.31.0. The attacker must already know or guess a gateway asset ID in the victim realm. Technical summary The flaw is an authorization bypass (CWE-639, CWE-284) in the REST endpoint GET /gateway/tunnel/{realm}/{id}, where getGatewayActiveTunnelInfos does not filter returned tunnels by realm, unlike its sibling methods. Any authenticated non-restricted user can exploit it over the network by passing their own realm in the path and a gateway ID from another realm, leaking target host, target port, and gateway routing data. Affected versions are stated as less than 1.31.0 (package io.openremote:openremote-manager), with the patched version given as 1.31.0. The advisory states no workaround. It also states that exploitation in the wild is not stated, and that the finding was confirmed by static source comparison only, not dynamically executed. Detection guidance beyond the proof-of-concept request pattern is not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from https://github.com/openremote/core/security/advisories/GHSA-p5wh-9wx4-w5f3 Impact if exploited ConfidentialityLow IntegrityNone AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required Low User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects openremote openremote core openremote-manager NIST National Vulnerability DatabasePublished Oct 25, 2026 14:16 UTC Read the advisory
	Low	2.1	CVE-2026-116184	OpenRemote before 1.31.0 contains an authorization bypass vulnerability that allows realm admins to impersonate gateways in other realms because GatewayService only checks the... openremoteopenremote core, openremote-manager	NVD	Oct 25 14:16 UTC
CVE-2026-116184OpenRemote before 1.31.0 contains an authorization bypass vulnerability that allows realm admins to impersonate gateways in other realms because GatewayService only checks the... Executive summary OpenRemote versions before 1.31.0 contain an authorization bypass that lets a user with admin rights in one realm impersonate a gateway that belongs to a different realm. The advisory rates it Low, with a CVSS v4 base score of 2.1, and the patched version is 1.31.0. Technical summary The flaw is an authorization bypass (CWE-639, with CWE-862 also listed) in GatewayService, where gateway websocket events are routed using only the gateway ID and are not checked against the realm of the GatewayConnector. An attacker needs a realm admin account with WRITE:ADMIN in one realm and knowledge of a gateway ID in another realm; they then create a service user named gateway-GATEWAY_ID in their own realm and connect over websocket. The advisory says the attacker could create SSH tunnels during initial sync and overwrite descendant assets of the Gateway asset, though it cannot read existing assets. Affected versions are stated as less than 1.31.0 and the patched version is 1.31.0. No workaround is stated, and no detection guidance is stated. The advisory states no known CVE ID exists, and it does not state whether the flaw is exploited in the wild. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from https://github.com/openremote/core/security/advisories/GHSA-2j4x-qh6q-q8mm Impact if exploited ConfidentialityLow IntegrityLow AvailabilityLow How it is exploited Attack vector Network Attack complexity High Attack requirements None Privileges required High User interaction None CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects openremote openremote core openremote-manager NIST National Vulnerability DatabasePublished Oct 25, 2026 14:16 UTC Read the advisory
	High	8.7	CVE-2026-116183	phpMyFAQ before 4.1.10 contains an object-level authorization bypass vulnerability that allows unauthenticated attackers to modify or delete any visitor question by supplying... thorsten, phpMyFAQthorsten phpMyFAQ, phpMyFAQ	NVD	Oct 25 14:16 UTC
CVE-2026-116183phpMyFAQ before 4.1.10 contains an object-level authorization bypass vulnerability that allows unauthenticated attackers to modify or delete any visitor question by supplying... Executive summary An unauthenticated visitor can modify or delete any visitor-submitted question in phpMyFAQ versions before 4.1.10 (the advisory lists affected versions as up to and including 4.2.0-beta). The advisory rates it High at CVSS 7.5 under the default configuration, and Critical at 9.1 when the option to delete open questions after answering is enabled. The advisory recommends upgrading to 4.1.10, which is listed as the patched version. Technical summary The flaw is an object-level authorization bypass (CWE-639) in POST /api/faq/create, where the client-supplied openQuestionID is cast to an integer and used directly as the key for UPDATE or DELETE queries on the faqquestions table, with no ownership, visibility, or permission check. Exploitation requires no account or CSRF token, only solving the graphical CAPTCHA, and the advisory states no user interaction is needed. With records.enableDeleteQuestion false (the shipped default), the attacker can rewrite a question's category and answer link (CVSS 7.5, integrity impact only); with it true, the question is permanently deleted (CVSS 9.1). The advisory lists the affected versions as <= 4.2.0-beta and the patched version as 4.1.10. Workarounds are not stated beyond the suggested code fix, and no detection guidance is given. No CVE ID is assigned in the advisory (it says 'No known CVE'). Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-9m55-g84r-x6v7 Impact if exploited ConfidentialityNone IntegrityHigh AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required None User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects thorsten phpMyFAQ thorsten phpMyFAQ phpMyFAQ NIST National Vulnerability DatabasePublished Oct 25, 2026 14:16 UTC Read the advisory

Example	Finds
	Every word appears somewhere: title, summaries, IDs, vendor, or product
	An exact phrase
	One vendor. product: for a product, vp: for either
	Commas mean any of them, in every field
	Severity: critical, high, medium, low, or unknown
	CVSS score, with >, >=, <, or <=
	A score range
	Known exploited. is:kev works too, and kev:no leaves them out
	One source, by name
	Confidentiality impact: high, low, none, or any (low or high)
	Integrity and availability work the same way
	An advisory or CVE ID, or part of one
	A minus sign leaves out whatever the term matches

Vulnerability feed

Executive summary

Technical summary

Impact if exploited

How it is exploited

Affects

Executive summary

Technical summary

Impact if exploited

How it is exploited

Affects

Executive summary

Technical summary

Impact if exploited

How it is exploited

Affects

Executive summary

Technical summary

Impact if exploited

How it is exploited

Affects

Executive summary

Technical summary

Impact if exploited

How it is exploited

Affects

Executive summary

Technical summary

Impact if exploited

How it is exploited

Affects

Executive summary

Technical summary

Impact if exploited

How it is exploited

Affects

Executive summary

Technical summary

Impact if exploited

How it is exploited

Affects

Executive summary

Technical summary

Impact if exploited

How it is exploited

Affects

Executive summary

Technical summary

Impact if exploited

How it is exploited

Affects

Executive summary

Technical summary

Impact if exploited

How it is exploited

Affects

Executive summary

Technical summary

Impact if exploited

How it is exploited

Affects

Executive summary

Technical summary

Impact if exploited

How it is exploited

Affects

Executive summary

Technical summary

Score

Affects

Executive summary

Technical summary

Score

Affects

Executive summary

Technical summary

Score

Affects

Executive summary

Technical summary