CVEs published by TuranSec

CVEs published by TuranSec (CVE Numbering Authority). 144 tracked.

• CVE-2026-70369 HIGH 8.8 Koha's reports/acquisitions_stats.pl builds its per-cell statistics query in sub calculate by interpolating th
• CVE-2026-70370 HIGH 8.8 Koha's reports/catalogue_stats.pl builds dynamic SQL in sub calculate by interpolating the user-controlled Lin
• CVE-2026-70371 HIGH 8.8 Koha's reports/issues_avg_stats.pl builds dynamic SQL in sub calculate by concatenating several user-controlle
• CVE-2026-70372 HIGH 8.8 Koha's reports/bor_issues_top.pl builds dynamic SQL in sub calculate by concatenating several user-controlled
• CVE-2026-70373 HIGH 8.8 Koha's reports/issues_stats.pl (the circulation statistics report) builds its calculation query in sub calcula
• CVE-2026-71289 CRITICAL 9.8 The NASA-AMMOS Asynchronous Network Management System (ANMS) reference implementation's default docker-compose
• CVE-2026-71207 CRITICAL 9.8 The Stock-Inventory-Management-System application's login.php assigns raw username/password values to and buil
• CVE-2026-71231 CRITICAL 9.8 IOTSmartHome's gui/login.php checkCookie function builds an authentication query as SELECT * FROM users WHERE
• CVE-2026-71278 CRITICAL 9.8 rust-iot-platform allows creating a "calc rule" via POST /calc-rule/create (api/src/controller/calc_rule_route
• CVE-2026-71209 HIGH 7.5 audiobookshelf's authentication-exemption check (server/routers/Auth.js) matches unauthenticated-allowed GET r
• CVE-2026-71254 CRITICAL 9.8 nanoMODBUS through v1.23.0 contains an out-of-bounds write in the Modbus server-side handle_read_file_record f
• CVE-2026-71256 CRITICAL 9.8 nanoMODBUS through v1.23.0 contains an out-of-bounds stack read leading to a wild-pointer write in nmbs_read_d
• CVE-2026-71267 CRITICAL 9.8 microtar's mtar_write_file_header and mtar_write_dir_header functions (src/microtar.c) copy a caller-supplied
• CVE-2026-71263 CRITICAL 9.1 The LINUXTCP port of FreeModbus contains an off-by-one bounds check in xMBPortTCPPool (demo/LINUXTCP/port/port
• CVE-2026-71214 CRITICAL 9.8 The Aerie/PlanDev sequencing-server's authorization middleware (sequencing-server/src/app.ts) derives the call
• CVE-2026-70374 HIGH 8.8 HashBrown CMS through 1.4.6 contains an OS Command Injection vulnerability (CWE-78) in the media upload thumbn
• CVE-2026-70375 HIGH 8.8 HashBrown CMS through 1.4.6 contains an OS Command Injection vulnerability (CWE-78) in the Git deployer compon
• CVE-2026-71238 CRITICAL 9.1 DjangoCRM ships with its Django SECRET_KEY hardcoded directly in the committed webcrm/settings.py rather than
• CVE-2026-71268 CRITICAL 9.9 OpenPLC Runtime v3's compile_program function (webserver/openplc.py) parses directives from uploaded Structure
• CVE-2026-71277 CRITICAL 9.1 rust-iot-platform's AuthToken request-guard implementation (api/src/main.rs) only checks whether the Authoriza
• CVE-2026-71252 HIGH 8.2 toner-management's admin state-changing handlers (add.php, edit.php, delete.php under admin/toners, admin/tone
• CVE-2026-71270 HIGH 8.6 Stirling-PDF's POST /api/v1/convert/url/pdf endpoint (ConvertWebsiteToPDF.java) was not updated with the Custo
• CVE-2026-71255 HIGH 8.6 nanoMODBUS through v1.23.0 contains an out-of-bounds write in the Modbus client-side recv_read_device_identifi
• CVE-2026-71235 HIGH 8.8 Magistrala's Rules Engine allows authenticated users to create rules with embedded Go or Lua scripts executed
• CVE-2026-71243 HIGH 8.8 The backmeup npm package assembles shell command strings by directly concatenating its option values (name, so
• CVE-2026-71288 HIGH 8.8 Koha's guided report builder (reports/guided_reports.pl) reads the CGI parameter and, for each value, a dynami
• CVE-2026-71291 HIGH 8.8 Bolt CMS renders content field values through Twig's full application-level Environment with no SandboxExtensi
• CVE-2026-70377 HIGH 7.5 imagecli's pipeline operation (Scale::apply in src/image_ops.rs) computes output width/height as (dimension as
• CVE-2026-70378 HIGH 7.5 imagecli's pipeline operation (Carve::apply in src/image_ops.rs) only asserts , never validating that the rati
• CVE-2026-71202 HIGH 7.5 The raster Rust crate's crop function (src/editor.rs) clamps the crop width/height against source dimensions b
• CVE-2026-71241 HIGH 7.5 Book-Management-System's Flask API endpoints /student, /record, /books, /find_stu_book, and /find_not_return_b
• CVE-2026-71281 HIGH 8.8 Hugging Face peft's LoRA-GA and CorDA initialization modules (src/peft/tuners/lora/corda.py lines ~102 and ~16
• CVE-2026-71264 HIGH 8.2 WLED's GET /json/cfg endpoint (registered in wled00/wled_server.cpp) calls serveJson with no settings-PIN chec
• CVE-2026-71279 HIGH 8.0 Zigbee2MQTT's ExternalJSExtension.getFilePath (lib/extension/externalJS.ts) joins a parameter received via an
• CVE-2026-71284 HIGH 7.2 Fledge's backup-restore upload handler, upload_backup (python/fledge/services/core/api/backup_restore.py), tak
• CVE-2026-71234 HIGH 7.5 Documize Community's attachment download route (domain/attachment/endpoint.go, Download function, registered v
• CVE-2026-55739 HIGH 8.3 Crater isolates data per company_id, and its Invoice/Estimate/Payment/Expense policies enforce both a Bouncer
• CVE-2026-71206 HIGH 8.3 Shiori's CheckToken function (internal/domains/auth.go) validates only the JWT's HMAC signature and returns th
• CVE-2026-71242 HIGH 8.3 Crater's NotePolicy checks only a blanket Bouncer ability (manage-all-notes / view-all-notes) with no company-
• CVE-2026-71292 HIGH 7.2 Subrion CMS's admin grid sorting helper, _gridGetSorting in includes/classes/ia.base.controller.admin.php, whi
• CVE-2026-54416 HIGH 7.2 Pluck CMS through 4.7.21 restricts dangerous file uploads in its admin file-management feature using a fixed b
• CVE-2026-70376 CRITICAL 9.6 Pluck CMS's admin panel relies solely on a Referer-header comparison (requestedByTheSameDomain in data/inc/fun
• CVE-2026-71232 HIGH 7.2 MacCMS10's admin template editor (application/admin/controller/Template.php) blocks dangerous PHP functions in
• CVE-2026-71239 HIGH 8.1 DjangoCRM's massmail module renders user-controlled EmlMessage fields (subject, content) through Django's Temp
• CVE-2026-71271 HIGH 8.5 Memos' webhook URL validation, isReservedIP (internal/webhook/validate.go), checks a candidate IP against a re
• CVE-2026-71285 HIGH 8.1 Uptime Kuma's Matomo analytics integration (server/analytics/matomo-analytics.js) injects the admin-configurab
• CVE-2026-71274 HIGH 8.5 OpenBK7231T's CHANNEL_SetLabel (src/cmnds/cmd_channels.c) stores channel labels received via the MQTT SetChann
• CVE-2026-71280 HIGH 8.5 go-shiori's DownloadBookmark (internal/core/download.go) fetches a caller-supplied bookmark URL using a plain
• CVE-2026-71272 HIGH 8.5 Memos' webhook dispatch function safeDialContext (internal/webhook/webhook.go) resolves the target hostname vi
• CVE-2026-71205 MEDIUM 6.5 changedetection.io's /login route checks the submitted password against a single PBKDF2-HMAC-SHA256 hash with
• CVE-2026-55747 MEDIUM 6.8 The pocketflow-coding-agent cookbook example in The-Pocket/PocketFlow implements a helper as a thin os.path.jo
• CVE-2026-71276 HIGH 7.1 Magistrala (formerly Mainflux)'s message-readers API reads a value from the HTTP query string (readers/api/htt
• CVE-2026-71203 MEDIUM 5.3 changedetection.io's REST API resources are protected by an @auth.check_token decorator validating the caller'
• CVE-2026-71261 HIGH 7.8 dr_libs dr_wav.h (all versions through current master) contains an integer overflow in W64 CUE chunk metadata
• CVE-2026-71266 HIGH 7.8 tinyobjloader-c's tinyobj_parse_and_index_mtl_file (tinyobj_loader_c.h) reads each line of a .mtl material fil
• CVE-2026-71293 MEDIUM 6.2 Statamic CMS's user-augmentation resolver, AugmentedUser::get in src/Auth/AugmentedUser.php, contains an expli
• CVE-2026-71204 MEDIUM 6.2 changedetection.io's /settings save handler builds an update dict from form.data['application'] and blind-merg
• CVE-2026-71283 MEDIUM 4.9 Fledge's backup-restore upload handler, upload_backup (python/fledge/services/core/api/backup_restore.py), cal
• CVE-2026-71286 MEDIUM 6.1 The render-template component of ember-dynamic-render-template (addon/components/render-template.js) passes it
• CVE-2026-71273 MEDIUM 6.5 OpenBK7231T's /cfg_wifi_set endpoint (src/httpserver/http_fns.c) accepts configuration changes via a plain GET
• CVE-2026-71210 MEDIUM 5.3 Mealie's AsyncSafeTransport SSRF guard (mealie/pkgs/safehttp/transport.py) resolves a target hostname once, ch
• CVE-2026-71275 MEDIUM 5.4 OpenBK7231T's http_fn_ota_exec() (src/httpserver/http_fns.c) reflects the `host` query parameter directly into
• CVE-2026-71240 MEDIUM 4.3 DjangoCRM's toggle_default_sorting view is the only route in common/urls.py that is not wrapped in login_requi
• CVE-2026-71212 MEDIUM 4.4 xidown (a yt-dlp/ffmpeg GUI wrapper) builds its yt-dlp command-line invocation (xidown/core/scanner.py and dow
• CVE-2026-72590 CRITICAL 9.8 An OS command injection vulnerability in alseambusher/crontab-ui through 0.4.2 allows an unauthenticated remot
• CVE-2026-72589 CRITICAL 9.8 An OS command injection vulnerability in alseambusher/crontab-ui through 0.4.2 allows an unauthenticated remot
• CVE-2026-72580 CRITICAL 9.8 An OS command injection vulnerability in duhow/xiaoai-patch through commit fb07049 allows a remote attacker to
• CVE-2026-72577 CRITICAL 9.8 Multiple vulnerabilities in NASA fprime-gds through 3.4.3 allow an unauthenticated remote attacker to achieve
• CVE-2026-72567 CRITICAL 9.8 An improper path validation vulnerability in AsyncFuncAI/deepwiki-open through commit 16f35a0 allows unauthent
• CVE-2026-72592 CRITICAL 9.8 An unrestricted file upload vulnerability in dulldusk/phpfm through 1.8.0 allows an unauthenticated remote att
• CVE-2026-72593 CRITICAL 9.8 A missing authentication vulnerability in dulldusk/phpfm through 1.8.0 allows an unauthenticated remote attack
• CVE-2026-72565 CRITICAL 9.8 A SQL injection vulnerability in Tencent APIJSON through 8.1.8 allows unauthenticated remote attackers to bypa
• CVE-2026-72572 HIGH 7.5 A path traversal vulnerability in o1lab/xmysql (all versions) allows an unauthenticated remote attacker to rea
• CVE-2026-72575 CRITICAL 9.1 An improper authorization vulnerability in daptin through v0.12.34 allows unauthenticated remote attackers to
• CVE-2026-72569 CRITICAL 9.1 A path traversal vulnerability in cube-root/directory-serve through 1.3.7 allows an unauthenticated remote att
• CVE-2026-72573 HIGH 8.8 An OS command injection vulnerability in 4xmen/pm2panel (all versions) allows an authenticated remote attacker
• CVE-2026-72571 HIGH 7.5 A path traversal vulnerability in mustafaakin/cast-localvideo (all versions) allows an unauthenticated remote
• CVE-2026-72581 HIGH 8.6 A server-side request forgery (SSRF) vulnerability in duhow/xiaoai-patch through commit fb07049 allows a remot
• CVE-2026-72586 HIGH 7.5 A missing authentication vulnerability in frangoteam/FUXA through 1.3.3 allows an unauthenticated remote attac
• CVE-2026-72691 HIGH 7.5 An authentication bypass vulnerability in OpenSignLabs opensignserver through 2.37.0 allows an unauthenticated
• CVE-2026-72564 CRITICAL 9.6 An improper authorization vulnerability in fosrl/pangolin through v1.20.0 allows an authenticated remote attac
• CVE-2026-72579 HIGH 7.5 An OS command injection vulnerability in NASA HyperCP (main branch) allows a network-adjacent attacker who can
• CVE-2026-72582 HIGH 7.5 A NULL pointer dereference vulnerability in fastschema through v0.15.1 allows an unauthenticated remote attack
• CVE-2026-72688 HIGH 7.5 A missing authentication vulnerability in OpenSignLabs opensignserver through 2.37.0 allows an unauthenticated
• CVE-2026-72689 HIGH 7.5 A broken object-level authorization vulnerability in OpenSignLabs opensignserver through 2.37.0 allows an unau
• CVE-2026-72692 HIGH 7.5 A missing authorization vulnerability in OpenSignLabs opensignserver through 2.37.0 allows an unauthenticated
• CVE-2026-72584 HIGH 7.4 A time-of-check/time-of-use (TOCTOU) race condition in fastschema through v0.15.1 allows an unauthenticated re
• CVE-2026-72578 HIGH 8.8 A cross-site request forgery (CSRF) vulnerability in FreePBX Framework 17.0 allows an unauthenticated remote a
• CVE-2026-72566 HIGH 7.7 A server-side request forgery (SSRF) vulnerability in automatisch through commit 41f3c56 allows a low-privileg
• CVE-2026-72591 HIGH 7.7 A server-side request forgery (SSRF) vulnerability in gabehf/Koito through v0.3.2 allows an authenticated user
• CVE-2026-72690 HIGH 7.1 An improper authorization vulnerability in Attendize through commit 9289acb allows an authenticated remote att
• CVE-2026-72588 MEDIUM 5.3 A user enumeration vulnerability in bluewave-labs/Checkmate through 2.1.0 allows an unauthenticated remote att
• CVE-2026-72594 HIGH 7.6 A stored cross-site scripting (XSS) vulnerability in lobehub/lobe-chat through v2.2.13 allows a low-privileged
• CVE-2026-72574 MEDIUM 6.1 A host header injection vulnerability in picocms/Pico through 2.1.4 allows an unauthenticated remote attacker
• CVE-2026-72587 MEDIUM 6.1 A cache poisoning vulnerability in CoreBunch/Instatic through 0.0.14 allows an unauthenticated remote attacker
• CVE-2026-72576 MEDIUM 5.4 A stored cross-site scripting (XSS) vulnerability in Bludit 4.0.0-beta allows a low-privileged authenticated u
• CVE-2026-72583 MEDIUM 5.4 A stored cross-site scripting (XSS) vulnerability in fastschema through v0.15.1 allows a low-privileged authen
• CVE-2026-72570 MEDIUM 5.4 A stored cross-site scripting (XSS) vulnerability in cube-root/directory-serve through 1.3.7 allows an attacke
• CVE-2026-72603 CRITICAL 9.9 An OS command injection vulnerability in wg-easy 15.3.0 allows users with the clients.create permission to exe
• CVE-2026-72550 CRITICAL 9.8 An SQL injection vulnerability in Friendica through the 2026.08-dev branch allows unauthenticated remote attac
• CVE-2026-72599 CRITICAL 9.8 An SQL injection vulnerability in e107 2.4.0 allows unauthenticated remote attackers to execute arbitrary SQL
• CVE-2026-72535 HIGH 8.6 A missing authentication vulnerability in Chaskiq through commit 46dfdd1 allows unauthenticated remote attacke
• CVE-2026-72536 HIGH 8.6 A missing authentication vulnerability in Chaskiq through commit 46dfdd1 allows unauthenticated remote attacke
• CVE-2026-72551 HIGH 8.8 A remote code execution vulnerability in Apioo Fusio 8.8.3 allows authenticated users with the Developer role
• CVE-2026-72556 HIGH 8.8 A remote code execution vulnerability in ZoneMinder 1.39.17 allows any authenticated user to execute OS comman
• CVE-2026-72538 HIGH 8.8 An argument injection vulnerability in PrefectHQ Prefect through 3.8.2 allows authenticated users to achieve r
• CVE-2026-72602 HIGH 7.5 A path traversal vulnerability in AsyncFuncAI deepwiki-open through commit 16f35a0 allows unauthenticated remo
• CVE-2026-72543 HIGH 7.5 An insecure direct object reference vulnerability in OpenSignLabs OpenSign through 2.37.0 allows unauthenticat
• CVE-2026-72548 HIGH 7.5 An information disclosure vulnerability in OpenSignLabs OpenSign through 2.37.0 allows unauthenticated remote
• CVE-2026-72552 HIGH 7.5 A server-side request forgery vulnerability in Dub as of 2026-07-10 allows unauthenticated remote attackers to
• CVE-2026-72600 HIGH 7.5 A broken access control vulnerability in Idurar IDURAR ERP CRM 4.1.0 allows unauthenticated remote attackers t
• CVE-2026-72601 HIGH 7.5 A broken access control vulnerability in CSZ CMS 1.3.2 allows unauthenticated remote attackers to read all for
• CVE-2026-72533 HIGH 8.8 An authentication bypass vulnerability in Portainer CE through 2.44.0 allows authenticated low-privileged user
• CVE-2026-72545 HIGH 7.5 An insecure direct object reference vulnerability in OpenSignLabs OpenSign through 2.37.0 allows unauthenticat
• CVE-2026-72605 HIGH 7.5 A missing authentication vulnerability in Swing Music 3.0.0 allows unauthenticated remote attackers to create
• CVE-2026-72557 HIGH 8.8 An unrestricted file upload vulnerability in Cockpit CMS 2.6.0 allows authenticated users to upload files of a
• CVE-2026-72606 HIGH 7.5 A server-side request forgery vulnerability in Pinry through 2.1.13 allows unauthenticated remote attackers to
• CVE-2026-72534 HIGH 8.8 A privilege escalation vulnerability in Authentik Security authentik through 2026.5.6 allows an attacker with
• CVE-2026-72558 HIGH 8.8 An SQL injection vulnerability in CiviCRM through 6.18.alpha1 allows authenticated staff to read the entire da
• CVE-2026-72561 HIGH 8.8 A broken access control vulnerability in Peppermint Lab Peppermint through commit ba6e217 allows any authentic
• CVE-2026-72562 HIGH 8.8 An SQL injection vulnerability in Pimcore admin-ui-classic-bundle through version 2.3 allows authenticated bac
• CVE-2026-72537 HIGH 8.8 A privilege escalation vulnerability in Authentik Security authentik through 2026.5.6 allows an attacker with
• CVE-2026-72555 HIGH 8.1 A broken access control vulnerability in Peppermint Lab Peppermint through commit ba6e217 exists because the C
• CVE-2026-72596 HIGH 8.1 A broken access control vulnerability in Ghost Foundation Ghost 5.x allows authenticated Author-role users to
• CVE-2026-72544 HIGH 7.5 An integrity verification vulnerability in OpenSignLabs OpenSign through 2.37.0 allows unauthenticated remote
• CVE-2026-72563 HIGH 8.1 A broken access control vulnerability in BadChoice Handesk as of 2026-07-10 allows any authenticated agent to
• CVE-2026-72595 HIGH 8.1 A broken access control vulnerability in BadChoice Handesk as of 2026-07-10 allows any authenticated agent to
• CVE-2026-72549 MEDIUM 5.3 An information disclosure vulnerability in OpenSignLabs OpenSign through 2.37.0 allows unauthenticated remote
• CVE-2026-72604 MEDIUM 6.5 A path traversal vulnerability in Intelliants Subrion CMS through 4.2.1 allows authenticated administrators to
• CVE-2026-72607 HIGH 7.1 A stored SQL injection vulnerability in Koha through 24.11.17, 25.05.12, 25.11.06, and 26.05.01 allows authent
• CVE-2026-72609 HIGH 7.1 An SQL injection vulnerability in Koha through 24.11.17, 25.05.12, 25.11.06, and 26.05.01 allows authenticated
• CVE-2026-72539 MEDIUM 6.5 An information disclosure vulnerability in Windmill Labs Windmill through 1.783.0 allows any authenticated wor
• CVE-2026-72546 HIGH 7.1 An insecure direct object reference vulnerability in Attendize through commit 9289acb allows any authenticated
• CVE-2026-72547 HIGH 7.1 An insecure direct object reference vulnerability in Attendize through commit 9289acb allows any authenticated
• CVE-2026-72554 MEDIUM 6.5 A broken access control vulnerability in Ladybird Web Solution Faveo Helpdesk 2.0.3 allows any self-registered
• CVE-2026-72598 MEDIUM 6.5 A server-side request forgery vulnerability in Apioo Fusio 8.8.3 allows authenticated consumer-role users to m
• CVE-2026-72608 MEDIUM 6.5 A stored SQL injection vulnerability in Koha through 24.11.17, 25.05.12, 25.11.06, and 26.05.01 allows authent
• CVE-2026-72560 MEDIUM 6.5 A server-side request forgery vulnerability in HumanSignal Label Studio through 1.24.0.dev0 exists because SSR
• CVE-2026-72597 MEDIUM 6.5 A server-side request forgery vulnerability in Friendica through the 2026.08-dev branch allows authenticated u
• CVE-2026-72541 MEDIUM 6.5 A missing authorization vulnerability in Windmill Labs Windmill through 1.783.0 allows any authenticated works
• CVE-2026-72542 MEDIUM 5.4 A missing authorization vulnerability in Windmill Labs Windmill through 1.783.0 allows authenticated operators
• CVE-2026-72553 MEDIUM 5.4 A stored cross-site scripting vulnerability in ElkArte Forum 2.0 Beta 1 allows any registered member to inject
• CVE-2026-72559 MEDIUM 5.4 A stored cross-site scripting vulnerability in HortusFox 5.9 allows authenticated workspace members to inject
• CVE-2026-72610 MEDIUM 4.3 A stored SQL injection vulnerability in Koha through 24.11.17, 25.05.12, 25.11.06, and 26.05.01 allows authent

← Back to latest CVEs