Latest CVE Feed

Vulnerabilities published in the last 30 days. Filter by severity, exploit status, or attack vector.

Score
Vulnerability
Published
7.5 HIGH
CVE-2026-61891 — Eclipse Theia Filesystem Path Traversal and Authentication Bypass

In Eclipse Theia versions up to and including 1.73.1, the `@theia/filesystem` backend exposes HTTP file-download endpoints (`GET /file`, `GET /files/`, `PUT /files/`) that convert a client-supplied U…

theia | Remote | Path Traversal
Aug 05, 2026 Aug 05, 2026
Aug 05, 2026
Aug 05, 2026
7.5 HIGH
CVE-2026-46581 — Eclipse Mojarra Server-Side Request Forgery

In Eclipse Mojarra versions 2.3 and following, URL handing in `DefaultFaceletFactory` does not properly sanitize and/or block remote URLs, allowing an attacker to specify a URL to a remote Facelet wh…

mojarra | Remote | Server-Side Request Forgery
Aug 05, 2026 Aug 05, 2026
Aug 05, 2026
Aug 05, 2026
7.2 HIGH
CVE-2026-18933 — wp-downloadmanager: Unrestricted File Upload via Missing Extension/MIME Validation and Pa…

The wp-downloadmanager WordPress plugin, in version 1.68.11 (also affecting the 6.9.4 release line), allows an admin-privileged user (current_user_can('manage_downloads')) to upload arbitrary files v…

Remote | Misconfiguration
Aug 05, 2026 Aug 05, 2026
Aug 05, 2026
Aug 05, 2026
8.2 HIGH
CVE-2026-71252 — toner-management: Unauthenticated State-Changing Admin Actions

toner-management's admin state-changing handlers (add.php, edit.php, delete.php under admin/toners, admin/toner-brands, admin/printers, and related admin subdirectories) executed INSERT/UPDATE/DELETE…

Remote | Authentication
Aug 05, 2026 Aug 05, 2026
Aug 05, 2026
Aug 05, 2026
6.5 MEDIUM
CVE-2026-71251 — Akaunting: Cross-Company Media IDOR in Customer Portal Download Endpoint

Akaunting's shared download route (app/Http/Controllers/Common/Uploads.php::download(), reachable at uploads/{id}/download behind only generic auth middleware) fetched the requested Media record by I…

Remote | Authorization
Aug 05, 2026 Aug 05, 2026
Aug 05, 2026
Aug 05, 2026
4.3 MEDIUM
CVE-2026-71250 — Firefly III: Webhook URL Validation Explicitly Allows Loopback and Is Bypassable via DNS …

Firefly III's webhook URL validator (IsValidWebhookUrl.php) filters most private/reserved IPv4 ranges but contains an explicit early-return that allows any resolved address in 127.0.0.0/8, permitting…

Remote | Server-Side Request Forgery
Aug 05, 2026 Aug 05, 2026
Aug 05, 2026
Aug 05, 2026
6.1 MEDIUM
CVE-2026-71249 — 299Ko: Unauthenticated Reflected XSS in Public Contact Form

299Ko's public contact form (plugin/contact/controllers/ContactController.php, home()) sets raw POST field values (name, firstname, email, message) into the page template with no sanitization. The te…

Remote | Cross-Site Scripting
Aug 05, 2026 Aug 05, 2026
Aug 05, 2026
Aug 05, 2026
9.8 CRITICAL
CVE-2026-71248 — Inventory-Management-System-PHP: Unauthenticated SQL Injection in Login and Product Delet…

Inventory-Management-System-PHP's login.php constructs its authentication query via direct string concatenation of raw POST parameters: $sql = "select * from user where email = '$email' and password …

Remote | Injection
Aug 05, 2026 Aug 05, 2026
Aug 05, 2026
Aug 05, 2026
6.5 MEDIUM
CVE-2026-71247 — Documenso: Assistant Recipient Can Forge Another Signer's Signature in Sequential-Signing…

Documenso's sign-field-with-token.ts, used by the live document-signing UI, allows a recipient with the ASSISTANT role to fetch and complete fields belonging to any later-or-equal-order, not-yet-sign…

Remote | Authorization
Aug 05, 2026 Aug 05, 2026
Aug 05, 2026
Aug 05, 2026
4.3 MEDIUM
CVE-2026-71246 — Pixelfed: Authenticated SSRF via Remote URL Search

Pixelfed's SearchController (behind the auth middleware) accepts a URL via its remote-search parameters and fetches it server-side through ActivityPubFetchService, whose validateUrl() only blocks the…

Remote | Server-Side Request Forgery
Aug 05, 2026 Aug 05, 2026
Aug 05, 2026
Aug 05, 2026
7.1 HIGH
CVE-2026-71245 — Mautic: SQL Injection via field Parameter in Lead-by-Field-Value AJAX Endpoint

Mautic's getLeadIdsByFieldValueAction (LeadBundle/Controller/AjaxController.php) reads a field parameter from the request, sanitizes it only with InputHelper::clean() (which HTML-entity-encodes quote…

Remote | Injection
Aug 05, 2026 Aug 05, 2026
Aug 05, 2026
Aug 05, 2026
6.5 MEDIUM
CVE-2026-71244 — Paperless-ngx: Mail Account Test Connection Leaks Stored IMAP/OAuth Credentials to Attack…

Paperless-ngx's MailAccountViewSet.test() action, when called with an existing account's ID and a masked password field, reuses the stored password, account_type, refresh_token, and expiration from t…

Remote | Authentication
Aug 05, 2026 Aug 05, 2026
Aug 05, 2026
Aug 05, 2026
8.8 HIGH
CVE-2026-71243 — backmeup (npm): OS Command Injection via Backup Option Values

The backmeup npm package assembles shell command strings by directly concatenating its option values (name, source, destination, filter) - e.g. cmd = "mkdir -p " + path.join(info.destination, info.na…

Remote | Injection
Aug 05, 2026 Aug 05, 2026
Aug 05, 2026
Aug 05, 2026
8.3 HIGH
CVE-2026-71242 — Crater: Cross-Company IDOR on Notes via Missing Company-Ownership Check in NotePolicy

Crater's NotePolicy checks only a blanket Bouncer ability (manage-all-notes / view-all-notes) with no company-ownership comparison, unlike InvoicePolicy and other sibling policies which additionally …

Remote | Authorization
Aug 05, 2026 Aug 05, 2026
Aug 05, 2026
Aug 05, 2026
7.5 HIGH
CVE-2026-71241 — Book-Management-System: Unauthenticated Disclosure of Student PII and Borrowing History

Book-Management-System's Flask API endpoints /student, /record, /books, /find_stu_book, and /find_not_return_book are missing the @login_required decorator that protects sibling routes (/search_stude…

Remote | Authentication
Aug 05, 2026 Aug 05, 2026
Aug 05, 2026
Aug 05, 2026
4.3 MEDIUM
CVE-2026-71240 — DjangoCRM: Unauthenticated Open Redirect via toggle_default_sorting next_url Parameter

DjangoCRM's toggle_default_sorting view is the only route in common/urls.py that is not wrapped in login_required or staff_member_required, and it redirects to a caller-supplied next_url GET paramete…

Remote | Authentication
Aug 05, 2026 Aug 05, 2026
Aug 05, 2026
Aug 05, 2026
8.1 HIGH
CVE-2026-71239 — DjangoCRM: Server-Side Template Injection in Mass Mail Message Rendering

DjangoCRM's massmail module renders user-controlled EmlMessage fields (subject, content) through Django's Template() constructor with no sanitization, in at least three locations: message_previews.py…

Remote | Cross-Site Scripting
Aug 05, 2026 Aug 05, 2026
Aug 05, 2026
Aug 05, 2026
9.1 CRITICAL
CVE-2026-71238 — DjangoCRM: Hardcoded Django SECRET_KEY Enables Session and CSRF Token Forgery

DjangoCRM ships with its Django SECRET_KEY hardcoded directly in the committed webcrm/settings.py rather than read from an environment variable. Since this key is used for session signing, CSRF token…

Remote | Authentication
Aug 05, 2026 Aug 05, 2026
Aug 05, 2026
Aug 05, 2026
9.8 CRITICAL
CVE-2026-71237 — Miantang IoT-PHP: Unauthenticated SQL Injection in /userlogin

Miantang/IoT-PHP's index.php implements a POST /userlogin route that reads the password directly from $_POST['pwd'] with no sanitization and concatenates it into a raw SQL string: mysql_query("select…

Remote | Injection
Aug 05, 2026 Aug 05, 2026
Aug 05, 2026
Aug 05, 2026
8.7 HIGH
CVE-2026-71236 — Grocy: Stored XSS via HTMLPurifier Output Double-Decode

Grocy's API request-body parser (controllers/Api/BaseApiController.php, GetParsedAndFilteredRequestBody) purifies incoming field values with HTMLPurifier, then manually reverses HTML-entity encoding …

Remote | Cross-Site Scripting
Aug 05, 2026 Aug 05, 2026
Aug 05, 2026
Aug 05, 2026
Showing 20 of 9765 Results