CVE-2026-73xxx records
Browse official CVE Program records with vulnerability descriptions, affected products, CVSS scores and source references. Browse by the year and numeric range in each CVE ID; publication and update dates appear on each record.
823 records · Page 6 of 9
- CVE-2026-73390: WordPress Total Donations plugin <= 2.0.5 - Privilege Escalation vulnerability 9.8 Critical
Unauthenticated Privilege Escalation in Total Donations <= 2.0.5 versions.
Updated - CVE-2026-73389: WordPress Kalles Addons plugin <= 1.0.6 - PHP Object Injection vulnerability 9.8 Critical
Unauthenticated PHP Object Injection in Kalles Addons <= 1.0.6 versions.
Updated Unauthenticated SQL Injection in Nikstore Core <= 1.5 versions.
UpdatedUnauthenticated Local File Inclusion in Resido <= 1.5 versions.
UpdatedUnauthenticated Sensitive Data Exposure in Track Geolocation Of Users Using Contact Form 7 <= 3.0.2 versions.
UpdatedUnauthenticated Broken Access Control in Outranking Plugin Options <= 1.1.3 versions.
UpdatedUnauthenticated Sensitive Data Exposure in Pay with Contact Form 7 <= 1.0.4 versions.
Updated- CVE-2026-73383: WordPress CTX Feed plugin <= 6.6.47 - Arbitrary File Download vulnerability 4.9 Medium
Shop manager Arbitrary File Download in CTX Feed <= 6.6.47 versions.
Updated - CVE-2026-73382: WordPress Site Reviews plugin <= 8.2.0 - Cross Site Scripting (XSS) vulnerability 7.1 High
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Gemini Labs Site Reviews site-reviews allows Stored XSS.This issue affects Site Reviews: from n/a through 8.2.0.
Updated - CVE-2026-73381: WordPress Popup by Supsystic plugin <= 1.13.0 - Broken Authentication vulnerability 9.1 Critical
Unauthenticated Broken Authentication in Popup by Supsystic <= 1.13.0 versions.
Updated - CVE-2026-73380: WordPress Popup by Supsystic plugin <= 1.13.0 - PHP Object Injection vulnerability 9.8 Critical
Unauthenticated PHP Object Injection in Popup by Supsystic <= 1.13.0 versions.
Updated Unauthenticated Bypass Vulnerability in Contact Form by Supsystic < 1.10.0 versions.
UpdatedUnauthenticated Cross Site Scripting (XSS) in Contact Form by Supsystic < 1.10.0 versions.
UpdatedUnauthenticated Broken Access Control in Ultimate Maps by Supsystic < 1.5.0 versions.
Updated- CVE-2026-73376: WordPress Ultimate Maps by Supsystic plugin < 1.5.0 - PHP Object Injection vulnerability 9.8 Critical
Unauthenticated PHP Object Injection in Ultimate Maps by Supsystic < 1.5.0 versions.
Updated Unauthenticated Cross Site Scripting (XSS) in Ultimate Maps by Supsystic < 1.5.0 versions.
UpdatedA stored cross-site scripting (XSS) vulnerability existed in Vulnerability-Lookup in the render_tag_badges Jinja filter used to display reference tags associated with vulnerability records. Values from containers.cna.references[].tags[] were directly interpolated into HTML badge elements and the resulting string was wrapped in markupsafe.Markup. Because Markup marks the generated content as safe,
UpdatedJoomla! Core - [20260810] - Unrestricted uploads of SHTML files in Joomla 1.0.0-5.4.7, 6.0.0-6.1.2 - The default list of dangerous files did not include SHTML files. On servers that executed these files, that could lead to code execution.
UpdatedJoomla! Core - [20260809] - Improper ACL checks when injection schema.org contact data in Joomla 5.1.0-5.4.7 and 6.0.0-6.1.2 - An improper access check injects contact information for unaccessible contact items into schema.org snippets.
UpdatedJoomla! Core - [20260808] - Improper ACL checks for batch copy actions in Joomla 4.0.0-5.4.7, 6.0.0-6.1.2 - An improper access check allows unauthorized users to perform copy batch operations on uneditable items.
UpdatedIncorrect Authorization vulnerability in Apache Syncope. Delegated administration security checks performed by Reconciliation service's pull and push, being incomplete, could accept calls by administrator not provided with adequate entitlements. This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 Through 4.0.7, from 4.1.0-M0 through 4.1.2. Users are recommended
Updated- CVE-2026-73369: Adobe Campaign Classic (ACC) | Improper Control of Generation of Code ('Code Injection') (CWE-94) 10.0 Critical
Adobe Campaign Classic (ACC) is affected by an Improper Control of Generation of Code ('Code Injection') vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.
Updated - CVE-2026-73367: WordPress Easy Google Maps plugin < 1.14.2 - Remote File Inclusion vulnerability 7.2 High
Unauthenticated Remote File Inclusion in Easy Google Maps < 1.14.2 versions.
Updated - CVE-2026-73366: WordPress Easy Google Maps plugin <= 1.13.0 - PHP Object Injection vulnerability 9.8 Critical
Unauthenticated PHP Object Injection in Easy Google Maps <= 1.13.0 versions.
Updated Unauthenticated SQL Injection in JetAppointment <= 2.5.2 versions.
Updated- CVE-2026-73364: WordPress Flexible Subscriptions plugin <= 1.8.1 - PHP Object Injection vulnerability 9.8 Critical
Customer PHP Object Injection in Flexible Subscriptions <= 1.8.1 versions.
Updated Unauthenticated Broken Access Control in Taxi Booking Manager for WooCommerce < 2.0.8 versions.
Updated- CVE-2026-73362: WordPress URL Shortify plugin <= 2.5.0 - Cross Site Scripting (XSS) vulnerability 7.1 High
Unauthenticated Cross Site Scripting (XSS) in URL Shortify <= 2.5.0 versions.
Updated Unauthenticated Cross Site Scripting (XSS) in Recipe Card Blocks for Gutenberg & Elementor <= 3.4.18 versions.
Updated- CVE-2026-73360: WordPress Chaty Pro plugin <= 3.5.8 - Cross Site Scripting (XSS) vulnerability 7.1 High
Unauthenticated Cross Site Scripting (XSS) in Chaty Pro <= 3.5.8 versions.
Updated Subscriber Cross Site Scripting (XSS) in WP Cookie Notice for GDPR, CCPA & ePrivacy Consent <= 4.3.9 versions.
UpdatedUnauthenticated Cross Site Scripting (XSS) in Affiliates Manager <= 2.9.53 versions.
Updated- CVE-2026-73357: WordPress GiveWP plugin < 4.16.6 - Cross Site Scripting (XSS) vulnerability 6.5 Medium
Donor Cross Site Scripting (XSS) in GiveWP < 4.16.6 versions.
Updated - CVE-2026-73356: WordPress Breeze plugin <= 2.5.12 - Arbitrary Content Deletion vulnerability 8.2 High
Unauthenticated Arbitrary Content Deletion in Breeze <= 2.5.12 versions.
Updated - CVE-2026-73355: WordPress Affiliates Manager plugin <= 2.9.53 - SQL Injection vulnerability 9.3 Critical
Unauthenticated SQL Injection in Affiliates Manager <= 2.9.53 versions.
Updated Unauthenticated Cross Site Scripting (XSS) in SimplyRETS Real Estate IDX <= 3.2.8 versions.
UpdatedUnauthenticated Broken Access Control in Revolut Gateway for WooCommerce < 4.22.10 versions.
Updated- CVE-2026-73352: WordPress GiveWP plugin <= 4.16.5.1 - Broken Access Control vulnerability 6.5 Medium
Unauthenticated Broken Access Control in GiveWP <= 4.16.5.1 versions.
Updated Unauthenticated Cross Site Scripting (XSS) in WordPress Social Login and Register <= 7.8.1 versions.
Updated- CVE-2026-73350: WordPress SupportCandy plugin <= 3.5.1 - Broken Authentication vulnerability 8.2 High
Unauthenticated Broken Authentication in SupportCandy <= 3.5.1 versions.
Updated Unauthenticated Broken Access Control in GiveWP < 4.16.6 versions.
UpdatedUnauthenticated Broken Access Control in GiveWP < 4.16.6 versions.
Updated- CVE-2026-73347: WordPress TrueBooker plugin <= 1.2.6 - Privilege Escalation vulnerability 9.8 Critical
Unauthenticated Privilege Escalation in TrueBooker <= 1.2.6 versions.
Updated - CVE-2026-73346: WordPress MailChimp For WooCommerce plugin < 6.2 - SQL Injection vulnerability 7.6 High
Administrator SQL Injection in MailChimp For WooCommerce < 6.2 versions.
Updated Customer SQL Injection in License Manager for WooCommerce <= 3.0.18 versions.
Updated- CVE-2026-73344: WordPress WP Data Access plugin <= 5.5.79 - Cross Site Scripting (XSS) vulnerability 5.9 Medium
Author Cross Site Scripting (XSS) in WP Data Access <= 5.5.79 versions.
Updated - CVE-2026-73343: WordPress WP Compress plugin < 7.20.01 - Remote Code Execution (RCE) vulnerability 10.0 Critical
Unauthenticated Remote Code Execution (RCE) in WP Compress < 7.20.01 versions.
Updated - CVE-2026-73342: WordPress WP Multilang plugin <= 2.4.31 - Cross Site Scripting (XSS) vulnerability 7.1 High
Unauthenticated Cross Site Scripting (XSS) in WP Multilang <= 2.4.31 versions.
Updated - CVE-2026-73341: WordPress RegistrationMagic plugin <= 6.0.9.7 - PHP Object Injection vulnerability 9.8 Critical
Unauthenticated PHP Object Injection in RegistrationMagic <= 6.0.9.7 versions.
Updated Contributor Cross Site Scripting (XSS) in Featured Image from URL <= 5.3.3 versions.
Updated- CVE-2026-73339: WordPress Modern Events Calendar plugin < 7.35.0 - SQL Injection vulnerability 9.3 Critical
Unauthenticated SQL Injection in Modern Events Calendar < 7.35.0 versions.
Updated - CVE-2026-73338: WordPress Autopay plugin <= 5.0.0 - Cross Site Scripting (XSS) vulnerability 7.1 High
Unauthenticated Cross Site Scripting (XSS) in Autopay <= 5.0.0 versions.
Updated Joomla! Core - [20260807] - MFA Authentication Bypass in Joomla 4.0.0-5.4.7 and 6.0.0-6.1.2 - Insufficient state checks lead to a vector that allows to bypass 2FA checks.
UpdatedJoomla! Core - [20260806] - XSS through schema.org outputs in Joomla 5.1.0-5.4.7, 6.0.0-6.1.2 - Improper escaping flags lead to an XSS vector in schema.org markup outputs.
UpdatedAndroid application "Myna Point" is vulnerable to Improper Authorization in Handler for Custom URL Scheme (CWE-939). A malicious application installed on the user's Android device may exploit the affected application's functionality through an Intent, potentially allowing arbitrary JavaScript to be executed within the affected application.
UpdatedPotential problem for users of the org.apache.parquet.crypto.keytools package in Apache Parquet, versions 1.12 to 1.18. This package enables users to encrypt Parquet files via an envelope encryption mechanism that wraps (encrypts) data keys via a Key Management Service (KMS). On the reader side, the KMS URL can be application-controlled or file-controlled. If the user does not leverage applicati
UpdatedCamaleonCMS contains a stored cross-site scripting vulnerability in the cama_contact_form plugin that allows low-privileged authenticated attackers to inject arbitrary HTML by submitting unsanitized content to the before_html field through the contact form edit endpoint, which lacks proper authorization controls. Attackers can persist malicious script payloads into the database that execute in vic
UpdatedCamaleonCMS 2.9.1 contains an authenticated SQL injection vulnerability that allows authenticated attackers with post creation or editing privileges to submit a crafted slug value containing SQL syntax that the database backend evaluates as part of an inadequately parameterized query. Attackers can supply malicious slug payloads using boolean- or union-style blind SQL injection techniques to extra
UpdatedCamaleonCMS 2.9.1 contains a server-side template injection vulnerability that allows authenticated administrators to execute arbitrary commands by embedding ERB tags in the email parameter of the test_email settings action, which are evaluated when an SMTP rejection reflects the recipient address back in the exception message rendered as an inline ERB template. Attackers can submit a crafted emai
UpdatedCamaleonCMS contains a stored cross-site scripting vulnerability that allows authenticated low-privileged users to execute arbitrary JavaScript in an administrator's browser by injecting unsanitized HTML payloads into the post title parameter during draft creation. Attackers can submit a malicious HTML payload as a draft title through the drafts creation endpoint, which is persisted to the databas
UpdatedThis CVE ID has been rejected or withdrawn by its CVE Numbering Authority as the reported behavior is intentional. The update process is designed to write files to disk and is restricted to the highest-privilege users working with cryptographically verified Joomla archives.
Updated · Rejected recordCamaleonCMS contains a missing authorization vulnerability that allows any authenticated low-privileged user to access and modify plugin settings by reaching four unprotected plugin-administration endpoints without administrator-level authorization. Attackers can manipulate plugin configuration parameters at runtime across the attack, front_cache, cama_meta_tag, and cama_contact_form plugins to al
UpdatedFujitsu Research's OneCompression library before 1.2.1 contains an unsafe deserialization vulnerability that allows attackers to execute arbitrary code by supplying a crafted model.pt checkpoint file, as QuantizedModelLoader.load_quantized_model_pt() unconditionally calls torch.load with weights_only=False, invoking Python's pickle machinery during deserialization. Attackers can embed malicious __
Updated- CVE-2026-73324: VLC media player 3.0.0 through 3.0.23 information disclosure vulnerability 5.3 Medium
Certain VLC media player builds in versions 3.0.0 through 3.0.23 contain a memory-safety vulnerability reachable when processing media from an attacker-controlled network source. Exploitation requires user interaction and may disclose a limited, layout-dependent amount of VLC process memory. Exposure depends on build configuration.
Updated This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
Updated · Rejected recordIncorrect Authorization vulnerability in the single-stage query engine of Apache Pinot. When broker access control is enabled, the single-stage query engine authorizes only the table named in the query's FROM clause. The lookup() transform function identifies its dimension table with a string literal argument rather than through the FROM clause, so that table was never included in the authorizati
UpdatedXenForo before 2.3.13 contains an uncontrolled recursion vulnerability in the BBCode parser that allows authenticated attackers to cause persistent denial of service by submitting a post with deeply nested BBCode tags. Attackers can craft a single malicious post with sufficient nesting depth to exceed PHP's stack limit, causing fatal errors that repeatedly terminate PHP-FPM workers for all visitor
Updated- CVE-2026-73320: XenForo < 2.3.13 Unauthenticated Information Disclosure via Unfurl Endpoint 5.1 Medium
XenForo before 2.3.13 contains an unauthenticated information disclosure vulnerability that allows unauthenticated attackers to retrieve private unfurl records by supplying predictable auto-increment primary key IDs to the unfurl endpoint. Attackers can enumerate or predict result IDs and query the endpoint without any session, user, or visibility checks to obtain rendered preview HTML, original U
Updated XenForo before 2.3.13 contains a cross-site scripting vulnerability in the dynamic redirect handler that allows unauthenticated attackers to execute arbitrary JavaScript in the board origin by crafting a malicious javascript: URI that bypasses host validation. Attackers can embed the board hostname in the URI authority component and use percent-encoded newlines to evade server-side filters, causin
UpdatedXenForo before 2.3.13 contains a missing authorization vulnerability in the force-agreement controller that allows any ACP administrator to access and submit force-agreement forms regardless of their assigned permissions. Attackers can bypass the option permission declared in the navigation configuration to update the global policy last-updated timestamp, forcing all users to re-agree to the priva
UpdatedXenForo before 2.3.13 contains a missing authorization vulnerability in the ACP cache-rebuild dispatcher that allows limited administrators with only the rebuildCache permission to perform unauthorized approval queue actions by supplying an arbitrary job class and actor user ID in the POST body. Attackers can invoke the approval queue job under any user identity to approve queued user registration
UpdatedXenForo before 2.3.13 contains a payment replay vulnerability in the PayPal REST payment provider that allows attackers to process the same webhook payload multiple times by exploiting a missing duplicate transaction ID check. Attackers can replay a valid webhook payload to trigger duplicate payment events, resulting in repeated subscription activations and unauthorized account upgrades.
UpdatedXenForo before 2.3.13 contains a server-side request forgery vulnerability in the PayPal REST webhook handler that allows unauthenticated attackers to cause the server to make outbound HTTP requests to arbitrary destinations by supplying a crafted certificate URL in webhook headers without scheme, hostname, or allowlist validation. Attackers can submit a crafted POST to the PayPal webhook callback
UpdatedXenForo before 2.3.13 contains a signature verification logic error in the PayPal REST webhook handler that allows unauthenticated attackers to bypass payment signature validation by submitting a webhook request with an unsupported auth_algo header value. When the algorithm cannot be mapped to a supported hash function, the verification function incorrectly returns true instead of failing, causing
UpdatedXenForo before 2.3.13 contains a multi-factor authentication bypass vulnerability in the passkey TFA provider that allows an authenticated attacker to complete login as another user by submitting their own registered passkey credential during the WebAuthn assertion step. The passkey verification path performs a global credential lookup without validating that the matched credential belongs to the
UpdatedXenForo before 2.3.13 contains a refresh token replay vulnerability that allows attackers to reuse a refresh token multiple times by exploiting the failure to mark tokens as consumed when the parent access token has expired. Attackers can repeatedly submit the same refresh token to generate additional independent token pairs, achieving persistent unauthorized access for the token's full lifetime.
UpdatedXenForo before 2.3.13 contains an OAuth2 authorization code reuse vulnerability that allows attackers to obtain unauthorized token pairs by submitting a previously used authorization code. Attackers can exploit the failure to invalidate or mark authorization codes as consumed after initial token issuance to receive an independent token pair for the same user and scopes, bypassing the single-use gu
Updated- CVE-2026-73310: XenForo < 2.3.13 OAuth2 Authorization Code Token Theft via redirect_uri Bypass 8.2 High
XenForo before 2.3.13 contains an authorization flaw in the OAuth2 token endpoint that allows attackers controlling any allowlisted redirect URI to bypass redirect URI binding by submitting a different allowlisted URI than the one recorded at authorization time. Attackers can exchange an intercepted authorization code using a mismatched redirect URI to steal OAuth2 tokens from intercepted authoriz
Updated XenForo before 2.3.13 contains an authentication bypass vulnerability in the OAuth2 token endpoint that allows unauthenticated attackers to obtain valid token pairs by submitting empty values for client_secret and code_verifier parameters. Attackers can exploit PHP truthy evaluation logic, which treats empty strings as false and skips client secret validation and PKCE code verifier validation, to
UpdatedBudibase is an open-source low-code platform. Prior to 3.39.25, packages/server/src/api/controllers/automation.ts returned automation test results containing trigger.outputs.user.oauth2, broadcast BuilderSocketEvent.AutomationTestProgress to the app room, and stored progress in packages/server/src/automations/testProgress.ts without user scoping. A co-builder could receive or poll another SSO-auth
UpdatedBudibase is an open-source low-code platform. Prior to 3.39.4, uploadUrl in packages/server/src/utilities/fileUtils.ts used a bare server-side fetch for string attachment values passed by processAttachments in packages/server/src/sdk/workspace/ai/helpers/rows.ts. A builder with the AI table-generation feature could cause an attachment value to reference an internal service or cloud metadata endpoi
UpdatedBudibase is an open-source low-code platform. Prior to 3.39.25, POST /api/global/auth/:tenantId/login incremented the failure counter in packages/worker/src/api/controllers/global/auth.ts only for existing users, while packages/worker/src/middleware/emailLockout.ts returned X-Account-Locked and Retry-After only for locked identifiers. An unauthenticated attacker could compare the response after re
UpdatedBudibase is an open-source low-code platform. Prior to 3.39.24, POST /api/public/v1/roles/assign called validateGlobalRoleUpdate without checking appBuilder.appId or role.appId in packages/server/src/api/controllers/public/globalRoleValidation.ts. An app-scoped builder could scope the request to an app they control and then grant themselves builder access or an arbitrary role in another app, expos
Updated- CVE-2026-73304: Budibase: SSO OAuth2 Token Leakage via User Metadata Endpoints to Power-Role Users 4.9 Medium
Budibase is an open-source low-code platform. Prior to 3.39.25, GET /api/users/metadata and GET /api/users/metadata/:id returned user objects processed by packages/server/src/utilities/global.ts without removing oauth2.accessToken or oauth2.refreshToken. A user with the POWER role could retrieve the identity-provider credentials of SSO-authenticated users and use the refresh tokens for persistent
Updated Budibase is an open-source low-code platform. Prior to 3.40.0, POST /api/v2/email on account.budibase.app accepted a client-controlled accountId without binding it to the authenticated session, while checking only currentEmail. An authenticated attacker who obtains a victim account identifier can start the email-change workflow for the victim, receive and submit the verification code through POST
UpdatedBudibase is an open-source low-code platform. Prior to 3.39.30, the OIDC flow in packages/backend-core/src/middleware/passport/sso/oidc.ts resolved an email without getEmailVerified or an email_verified requirement, and packages/backend-core/src/middleware/passport/sso/sso.ts then used users.getGlobalUserByEmail as a fallback account-linking key. An attacker who can authenticate through a configur
UpdatedBudibase is an open-source low-code platform. Prior to 3.39.25, the GET /api/global/groups endpoint in packages/worker/src/api/routes/global/groups.ts omitted auth.builderOrAdmin, allowing an authenticated BASIC role user to enumerate tenant groups, role mappings and user memberships, builder permissions, and default-group flags. The disclosure exposes the tenant access-control structure to users
UpdatedBudibase is an open-source low-code platform. Prior to 3.40.0, the MySQL integration component in Budibase is configured with multipleStatements: true, enabling execution of multiple SQL statements in a single query. Attackers can inject malicious SQL commands through user input fields, leading to complete database compromise. This vulnerability is fixed in 3.40.0.
Updated- CVE-2026-73299: Prompty: Server-Side Template Injection to Remote Code Execution in the @prompty/core Nunjucks Renderer 10.0 Critical
Prompty is a markdown file format (.prompty) for LLM prompts. Prior to 0.1.5 and 2.0.0-beta.5, the TypeScript Nunjucks renderer evaluated untrusted .prompty template bodies with unrestricted JavaScript member access. An attacker-controlled template could traverse constructor and prototype properties to execute JavaScript in the host Node.js process. This issue is fixed in versions 0.1.5 and 2.0.0-
Updated The Microsoft Container Migration Solution Accelerator is a multi-service application that provides a multi-agent, AI-driven migration solution for moving container service configurations to Azure Kubernetes Service. In version 2.1.2 and earlier, a security vulnerability was identified in the Container Migration Solution Accelerator, specifically an authenticated IDOR (Insecure Direct Object Refer
Updated- CVE-2026-73297: Microsoft UFO: IPv6 transition address bypass of SSRF guard in URL validation 6.9 Medium
Microsoft UFO open-source framework for intelligent automation across devices and platforms. Prior to 3.0.8, _is_blocked_ip in ufo/utils/url_security.py did not block NAT64 prefixes 64:ff9b::/96 and 64:ff9b:1::/48, the 6to4 prefix 2002::/16, or the Teredo prefix 2001::/32 and did not re-check embedded IPv4 destinations, allowing an unauthenticated remote attacker who can influence URLs processed b
Updated Microsoft UFO open-source framework for intelligent automation across devices and platforms. Prior to 3.0.8, create_mobile_data_collection_server and create_mobile_action_server in ufo/client/mcp/http_servers/mobile_mcp_server.py exposed Streamable HTTP MCP services on TCP ports 8020 and 8021 without authentication, allowing an unauthenticated remote attacker to invoke capture_screenshot, get_ui_t
UpdatedMaterial for MkDocs is a powerful documentation framework built on top of MkDocs. From 7.2.0 until 9.7.7, the mountSearchSuggest function in src/templates/assets/javascripts/components/search/suggest/index.ts contains a DOM-based cross-site scripting vulnerability in the optional search.suggest feature that allows a crafted q URL parameter to execute JavaScript in a documentation site's origin aft
Updated- CVE-2026-73294: Semaphore U: OS Command Injection 9.9 Critical
Semaphore UI is a web interface for managing DevOps tools. Prior to 2.18.17 and 2.19.5-beta2, repository git_url handling passes an attacker-controlled --upload-pack option to CmdGitClient.GetLastRemoteCommitHash through POST /api/project/{id}/repositories and scheduled commit-hash polling, allowing a project Manager or Owner to execute arbitrary OS commands in the Semaphore server process. This i
Updated - CVE-2026-73293: Semaphore UI: Manager-to-owner privilege escalation via custom-role slug collision 8.8 High
Semaphore UI is a web interface for managing DevOps tools. Prior to 2.18.19 and from 2.19.0-alpha3 until 2.19.5-beta5, ProjectMiddleware and GetProjectOrGlobalRoleBySlug allow a project manager to use POST /api/project/{id}/roles to create a custom manager role with permission bitmask 15, overriding the built-in manager permissions and granting CanUpdateProject and CanManageProjectUsers owner cap
Updated Semaphore UI is a web interface for managing DevOps tools. Prior to 2.18.21, the /api/users/{id}/password endpoint accepts a cross-site request using the authenticated user's semaphore session cookie without CSRF protection or current-password confirmation, allowing an unauthenticated attacker to change an administrator's or another user's password after user interaction. This issue is fixed in ve
UpdatedSeerr is an open-source media request and discovery manager for Jellyfin, Plex, and Emby. Prior to version 3.4.0, Seerr's ImageProxy in server/lib/imageproxy.ts uses the upstream ETag and Content-Type response headers to build a cache filename for the unauthenticated GET /avatarproxy/:jellyfinUserId route, allowing a malicious or compromised Jellyfin or Emby server, or a man-in-the-middle attacker
UpdatedRustFS is a distributed object storage system built in Rust. Prior to 1.0.0-beta.12, an anonymous ListObjectVersions request in rustfs/src/storage/access.rs that lacks a direct bucket-policy grant falls back to an s3:ListBucket check and returns before the policy_allowed path applies deny_anonymous_table_data_plane_if_needed and RestrictPublicBuckets, so a bucket that permits anonymous listing can
UpdatedRustFS is a distributed object storage system built in Rust. Prior to 1.0.0-beta.12, RustFS evaluates the ForAllValues: and ForAnyValue: set qualifiers with the negated string operators StringNotEquals, StringNotEqualsIgnoreCase, StringNotLike, ArnNotEquals, and ArnNotLike using each other's semantics because crates/policy/src/policy/function/string.rs negates the aggregate result after eval or ev
UpdatedRustFS is a distributed object storage system built in Rust. Prior to 1.0.0-rc.1, RustFS Object Lock enforcement in crates/ecstore/src/bucket/object_lock/objectlock_sys.rs lets check_object_lock_for_deletion, delete_prefix, and lifecycle and scanner sweeps treat ConfigNotFound, unreadable .metadata.bin data, or unparseable metadata as no lock configuration, allowing objects under COMPLIANCE retent
Updated