Recent Vulnerabilities
-
CVE-2026-69152 • published on August 3, 2026 The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.18, 2.1.4, 3.0.6, and 5.0.9, expand() does not apply maxLength while constructing comma-alternative intermediate arrays or padded sequences, allowing attacker-controlled input to exhaust memory or block the event loop. The fix for CVE-2026-14257 is bypassed by the vulnerability. This issue is fixed in versions 1.1.18, 2.1.4, 3.0.6, and 5.0.9.
-
CVE-2026-69149 • published on August 3, 2026 Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.27, 21.2.19, and 22.0.7, a Cross-Site Scripting (XSS) vulnerability exists in @angular/platform-server's DOM emulation dependency (domino) when serializing the content of fallback raw-content elements (iframe,
, <noframes>, and <noscript>). This issue is fixed in versions 20.3.27, 21.2.19, and 22.0.7.</small> </div> </li> <li class="result-item" onclick="window.location='/CVE-2026-69118'" style="cursor:pointer; display:flex; align-items:flex-start; border-radius: 8px; border: 1px solid #e2e6eb; box-shadow: 0 1px 4px rgba(0, 0, 0, 0.05); background-color: #ffffff; padding: 1.2rem 1.5rem; color: #3a3a3a;" > <div style="flex:1; display:flex; flex-direction:column;"> <span> CVE-2026-69118 <span class="separator">•</span> <small>published on August 10, 2026</small> </span> <small class="ellipsis-text">Cachet through 2.4.1 contains a server-side template injection vulnerability in incident template rendering that allows authenticated users to execute arbitrary PHP code. Attackers can create malicious incident templates with Blade directives or Twig filters that execute system commands when incidents are created, achieving remote code execution as the web server process.</small> </div> </li> <li class="result-item" onclick="window.location='/CVE-2026-69113'" style="cursor:pointer; display:flex; align-items:flex-start; border-radius: 8px; border: 1px solid #e2e6eb; box-shadow: 0 1px 4px rgba(0, 0, 0, 0.05); background-color: #ffffff; padding: 1.2rem 1.5rem; color: #3a3a3a;" > <div style="flex:1; display:flex; flex-direction:column;"> <span> CVE-2026-69113 <span class="separator">•</span> <small>published on August 11, 2026</small> </span> <small class="ellipsis-text">Cap v0.3.1 contains a broken access control vulnerability in the POST /api/video/comment endpoint that allows authenticated users to post comments on any private video without permission by supplying an arbitrary videoId in the request body. Attackers can inject comments into private video recordings belonging to other users, trigger comment notification emails to the video owner, and enumerate valid video IDs through response differences.</small> </div> </li> <li class="result-item" onclick="window.location='/CVE-2026-69112'" style="cursor:pointer; display:flex; align-items:flex-start; border-radius: 8px; border: 1px solid #e2e6eb; box-shadow: 0 1px 4px rgba(0, 0, 0, 0.05); background-color: #ffffff; padding: 1.2rem 1.5rem; color: #3a3a3a;" > <div style="flex:1; display:flex; flex-direction:column;"> <span> CVE-2026-69112 <span class="separator">•</span> <small>published on August 10, 2026</small> </span> <small class="ellipsis-text">Hugging Face Accelerate through 1.14.0 contains a path traversal vulnerability in load_checkpoint_in_model and load_checkpoint_and_dispatch functions that fail to sanitize weight_map entries from sharded checkpoint indexes. Attackers can supply relative paths with ../ sequences or absolute paths to read arbitrary files, or point shard entries at named pipes to cause indefinite blocking and denial of service.</small> </div> </li> <li class="result-item" onclick="window.location='/CVE-2026-69101'" style="cursor:pointer; display:flex; align-items:flex-start; border-radius: 8px; border: 1px solid #e2e6eb; box-shadow: 0 1px 4px rgba(0, 0, 0, 0.05); background-color: #ffffff; padding: 1.2rem 1.5rem; color: #3a3a3a;" > <div style="flex:1; display:flex; flex-direction:column;"> <span> CVE-2026-69101 <span class="separator">•</span> <small>published on August 14, 2026</small> </span> <small class="ellipsis-text">Datavane TIS v5.0.0 contains an XML external entity (XXE) injection vulnerability that allows authenticated attackers to perform server-side request forgery and out-of-band file exfiltration by supplying a crafted taskScript payload to the doEditWorkflow endpoint, which processes XML through an unhardened DocumentBuilderFactory with external entities and DTD loading enabled. Attackers can send a malicious XML document containing an external DTD reference to the edit_workflow action, causing the server to issue outbound HTTP requests to attacker-controlled infrastructure and exfiltrate local files readable by the TIS process user, including configuration files and Derby database credentials.</small> </div> </li> <li class="result-item" onclick="window.location='/CVE-2026-69098'" style="cursor:pointer; display:flex; align-items:flex-start; border-radius: 8px; border: 1px solid #e2e6eb; box-shadow: 0 1px 4px rgba(0, 0, 0, 0.05); background-color: #ffffff; padding: 1.2rem 1.5rem; color: #3a3a3a;" > <div style="flex:1; display:flex; flex-direction:column;"> <span> CVE-2026-69098 <span class="separator">•</span> <small>published on August 4, 2026</small> </span> <small class="ellipsis-text">kotaemon through 0.12.0 contains an insecure deserialization vulnerability in the check_connection endpoint that allows unauthenticated attackers to instantiate arbitrary Python classes by supplying crafted YAML/JSON input with a __type__ field. Attackers can exploit this to override the __type__ field with subprocess.check_output and arbitrary arguments, achieving remote code execution with application process privileges.</small> </div> </li> <li class="result-item" onclick="window.location='/CVE-2026-69097'" style="cursor:pointer; display:flex; align-items:flex-start; border-radius: 8px; border: 1px solid #e2e6eb; box-shadow: 0 1px 4px rgba(0, 0, 0, 0.05); background-color: #ffffff; padding: 1.2rem 1.5rem; color: #3a3a3a;" > <div style="flex:1; display:flex; flex-direction:column;"> <span> CVE-2026-69097 <span class="separator">•</span> <small>published on August 3, 2026</small> </span> <small class="ellipsis-text">GitPython before 3.1.53 fails to properly escape section names in git config files, allowing attackers to inject arbitrary configuration directives through malicious submodule names. Attackers can inject core.sshCommand or other dangerous config keys into the victim's .git/config via create_submodule or clone_from operations, achieving remote code execution when git performs ssh operations.</small> </div> </li> <li class="result-item" onclick="window.location='/CVE-2026-69089'" style="cursor:pointer; display:flex; align-items:flex-start; border-radius: 8px; border: 1px solid #e2e6eb; box-shadow: 0 1px 4px rgba(0, 0, 0, 0.05); background-color: #ffffff; padding: 1.2rem 1.5rem; color: #3a3a3a;" > <div style="flex:1; display:flex; flex-direction:column;"> <span> CVE-2026-69089 <span class="separator">•</span> <small>published on August 3, 2026</small> </span> <small class="ellipsis-text">Grav CMS 2.0.10 contains a path traversal vulnerability in ImageMedium::watermark(), which passes its unsanitized $image argument to RocketTheme\Toolbox\ResourceLocator\UniformResourceLocator::findResource(). Because the file:// scheme branch only lexically collapses '..' segments without a realpath/containment check, an editor authoring Markdown image syntax with traversal sequences can cause arbitrary image files outside Grav's media sandbox to be composited into a carrier image, which is then cached and served from a public, unauthenticated URL — disclosing those files to anonymous visitors.</small> </div> </li> <li class="result-item" onclick="window.location='/CVE-2026-69087'" style="cursor:pointer; display:flex; align-items:flex-start; border-radius: 8px; border: 1px solid #e2e6eb; box-shadow: 0 1px 4px rgba(0, 0, 0, 0.05); background-color: #ffffff; padding: 1.2rem 1.5rem; color: #3a3a3a;" > <div style="flex:1; display:flex; flex-direction:column;"> <span> CVE-2026-69087 <span class="separator">•</span> <small>published on August 3, 2026</small> </span> <small class="ellipsis-text">The Grav form plugin (getgrav/grav-plugin-form) before 9.1.13 contains an open redirect vulnerability. Since v9.1.11, the redirect process action evaluates user-supplied form data inside Twig expressions, and Grav::redirect() accepts external URLs without origin validation. When a form blueprint defines a redirect target such as redirect: "{{ form.value('next') }}" using an attacker-controllable field, an unauthenticated form submitter can supply a value like https://evil.com to cause a 302 redirect to an arbitrary external site, enabling phishing.</small> </div> </li> <li class="result-item" onclick="window.location='/CVE-2026-69085'" style="cursor:pointer; display:flex; align-items:flex-start; border-radius: 8px; border: 1px solid #e2e6eb; box-shadow: 0 1px 4px rgba(0, 0, 0, 0.05); background-color: #ffffff; padding: 1.2rem 1.5rem; color: #3a3a3a;" > <div style="flex:1; display:flex; flex-direction:column;"> <span> CVE-2026-69085 <span class="separator">•</span> <small>published on August 3, 2026</small> </span> <small class="ellipsis-text">SiYuan before v3.7.3 contains a SQL injection vulnerability in the /api/filetree/searchDocs endpoint, where the caller-supplied keyword parameter is concatenated directly into SQL statements with no escaping or parameter binding. The endpoint is reachable by a publish RoleReader token, or unauthenticated when publish mode is enabled with Publish.Auth.Enable set to false. Because the statement executes on a read-write SQLite handle via a driver that supports stacked (semicolon-separated) statements, an attacker can read and modify database content across all cleartext (non-encrypted) notebooks on the instance.</small> </div> </li> <li class="result-item" onclick="window.location='/CVE-2026-69082'" style="cursor:pointer; display:flex; align-items:flex-start; border-radius: 8px; border: 1px solid #e2e6eb; box-shadow: 0 1px 4px rgba(0, 0, 0, 0.05); background-color: #ffffff; padding: 1.2rem 1.5rem; color: #3a3a3a;" > <div style="flex:1; display:flex; flex-direction:column;"> <span> CVE-2026-69082 <span class="separator">•</span> <small>published on August 3, 2026</small> </span> <small class="ellipsis-text">CTI-Transmute contained a cross-site request forgery vulnerability in the administrative user deletion functionality. The /account/delete/id endpoint accepted HTTP GET requests for an operation that modified application state. An unauthenticated remote attacker could construct a malicious link or embed a request targeting this endpoint and induce an authenticated CTI-Transmute administrator to visit the attacker-controlled content. If the administrator had an active session, the browser would automatically include the administrator’s session credentials, causing the selected user account to be deleted without the administrator intentionally confirming the operation. Successful exploitation requires interaction from a currently authenticated administrator who has permission to delete users. The attacker does not need a CTI-Transmute account or administrative privileges because the forged request executes using the victim administrator’s session. The vulnerability could allow an attacker to delete arbitrary user accounts, resulting in unauthorized modification of application state and denial of access for affected users. Depending on whether administrators can delete other administrators or the final administrative account, exploitation could also disrupt administration of the CTI-Transmute instance. The patch resolves the issue by restricting the deletion endpoint to HTTP POST requests and submitting the deletion through a form containing a CSRF token.</small> </div> </li> <li class="result-item" onclick="window.location='/CVE-2026-69078'" style="cursor:pointer; display:flex; align-items:flex-start; border-radius: 8px; border: 1px solid #e2e6eb; box-shadow: 0 1px 4px rgba(0, 0, 0, 0.05); background-color: #ffffff; padding: 1.2rem 1.5rem; color: #3a3a3a;" > <div style="flex:1; display:flex; flex-direction:column;"> <span> CVE-2026-69078 <span class="separator">•</span> <small>published on August 3, 2026</small> </span> <small class="ellipsis-text">CTI-Transmute is affected by a server-side request forgery vulnerability in the evaluation report PDF-generation functionality. User-controlled CTI content, including conversion names, descriptions, and comments, is converted from Markdown to HTML and rendered as a PDF using WeasyPrint. Before the patch, the renderer used WeasyPrint’s default URL-fetching behavior without restricting the protocols or destinations that could be referenced by the generated HTML. An attacker able to supply content included in an evaluation report could inject crafted resource references using schemes such as http://, https://, or file://. When the report was rendered, CTI-Transmute could fetch these resources using the application server’s network connectivity and filesystem privileges. Successful exploitation could allow an attacker to: * access services available only from the CTI-Transmute server or its internal network; * probe internal hosts and service endpoints; * retrieve local files readable by the application process; and * expose fetched content through the generated PDF, depending on the referenced resource type and rendering context. The vulnerability is corrected by providing WeasyPrint with a restrictive URL fetcher that permits only self-contained data: URIs. The externally hosted Google Fonts stylesheet was also removed so that PDF generation performs no intentional network or filesystem fetches.</small> </div> </li> <li class="result-item" onclick="window.location='/CVE-2026-68969'" style="cursor:pointer; display:flex; align-items:flex-start; border-radius: 8px; border: 1px solid #e2e6eb; box-shadow: 0 1px 4px rgba(0, 0, 0, 0.05); background-color: #ffffff; padding: 1.2rem 1.5rem; color: #3a3a3a;" > <div style="flex:1; display:flex; flex-direction:column;"> <span> CVE-2026-68969 <span class="separator">•</span> <small>published on August 12, 2026</small> </span> <small class="ellipsis-text">Apache Airflow wrote Variable values and Connection `extra` contents to the audit log in cleartext when they were submitted through the bulk endpoints (`PATCH /api/v2/variables` and `PATCH /api/v2/connections`). The audit-log masking recognised only top-level request fields, and a bulk request nests its entities two levels below, so no masking was applied to them. Any authenticated user with audit-log read access -- who need not hold Variables or Connections read at all -- could recover those secrets verbatim, and the Connection `extra` copy is stored unencrypted in the log while the connection table encrypts it. The Airflow UI's *Import Variables* action posts to this endpoint, so an ordinary operator import wrote every secret in the file to the log. This is a different code path from CVE-2026-50204: that fix shipped in 3.3.0 and covers the single-entity endpoints only, so deployments that upgraded in response to that advisory remain affected and must upgrade again. Users are advised to upgrade to apache-airflow 3.3.1 or later.</small> </div> </li> <li class="result-item" onclick="window.location='/CVE-2026-68821'" style="cursor:pointer; display:flex; align-items:flex-start; border-radius: 8px; border: 1px solid #e2e6eb; box-shadow: 0 1px 4px rgba(0, 0, 0, 0.05); background-color: #ffffff; padding: 1.2rem 1.5rem; color: #3a3a3a;" > <div style="flex:1; display:flex; flex-direction:column;"> <span> CVE-2026-68821 <span class="separator">•</span> <small>published on August 11, 2026</small> </span> <small class="ellipsis-text">Improper privilege management in Windows Package Manager allows an authorized attacker to elevate privileges locally.</small> </div> </li> <li class="result-item" onclick="window.location='/CVE-2026-68810'" style="cursor:pointer; display:flex; align-items:flex-start; border-radius: 8px; border: 1px solid #e2e6eb; box-shadow: 0 1px 4px rgba(0, 0, 0, 0.05); background-color: #ffffff; padding: 1.2rem 1.5rem; color: #3a3a3a;" > <div style="flex:1; display:flex; flex-direction:column;"> <span> CVE-2026-68810 <span class="separator">•</span> <small>published on August 11, 2026</small> </span> <small class="ellipsis-text">Untrusted pointer dereference in Microsoft Office Excel allows an unauthorized attacker to execute code locally.</small> </div> </li> <li class="result-item" onclick="window.location='/CVE-2026-68807'" style="cursor:pointer; display:flex; align-items:flex-start; border-radius: 8px; border: 1px solid #e2e6eb; box-shadow: 0 1px 4px rgba(0, 0, 0, 0.05); background-color: #ffffff; padding: 1.2rem 1.5rem; color: #3a3a3a;" > <div style="flex:1; display:flex; flex-direction:column;"> <span> CVE-2026-68807 <span class="separator">•</span> <small>published on August 11, 2026</small> </span> <small class="ellipsis-text">Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.</small> </div> </li> <li class="result-item" onclick="window.location='/CVE-2026-6131'" style="cursor:pointer; display:flex; align-items:flex-start; border-radius: 8px; border: 1px solid #e2e6eb; box-shadow: 0 1px 4px rgba(0, 0, 0, 0.05); background-color: #ffffff; padding: 1.2rem 1.5rem; color: #3a3a3a;" > <div style="flex:1; display:flex; flex-direction:column;"> <span> CVE-2026-6131 <span class="separator">•</span> <small>published on April 12, 2026</small> </span> <small class="ellipsis-text">A vulnerability was found in Totolink A7100RU 7.4cu.2313_b20191024. Affected by this vulnerability is the function setTracerouteCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. The manipulation of the argument command results in os command injection. The attack may be launched remotely. The exploit has been made public and could be used.</small> </div> </li> <li class="result-item" onclick="window.location='/CVE-2026-6129'" style="cursor:pointer; display:flex; align-items:flex-start; border-radius: 8px; border: 1px solid #e2e6eb; box-shadow: 0 1px 4px rgba(0, 0, 0, 0.05); background-color: #ffffff; padding: 1.2rem 1.5rem; color: #3a3a3a;" > <div style="flex:1; display:flex; flex-direction:column;"> <span> CVE-2026-6129 <span class="separator">•</span> <small>published on April 12, 2026</small> </span> <small class="ellipsis-text">A vulnerability was detected in zhayujie chatgpt-on-wechat CowAgent up to 2.0.4. This affects an unknown function of the component Agent Mode Service. Performing a manipulation results in missing authentication. The attack can be initiated remotely. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet.</small> </div> </li> <li class="result-item" onclick="window.location='/CVE-2026-6124'" style="cursor:pointer; display:flex; align-items:flex-start; border-radius: 8px; border: 1px solid #e2e6eb; box-shadow: 0 1px 4px rgba(0, 0, 0, 0.05); background-color: #ffffff; padding: 1.2rem 1.5rem; color: #3a3a3a;" > <div style="flex:1; display:flex; flex-direction:column;"> <span> CVE-2026-6124 <span class="separator">•</span> <small>published on April 12, 2026</small> </span> <small class="ellipsis-text">A vulnerability was determined in Tenda F451 1.0.0.7. This vulnerability affects the function fromSafeMacFilter of the file /goform/SafeMacFilter of the component httpd. Executing a manipulation of the argument page/menufacturer can lead to stack-based buffer overflow. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized.</small> </div> </li> </ul> <div class="center-pagination"><div class="pagination"><a href="/">« Back to Start</a><a href="/?cursor=6a92213730144214f48a0d07">Next »</a></div></div> </div> <footer style="text-align: center; padding: 2em 1em 1em 1em; font-size: 0.9em; color: #666; margin-top: 2em;"> Data from cve.org<br> Compiled by Portend AI, Inc. </footer> <script> document.getElementById('advisorySearchForm').addEventListener('submit', function (e) { e.preventDefault(); const searchValue = document.getElementById('searchInput').value.trim(); if (searchValue) { window.location.href = '/' + encodeURIComponent(searchValue); } }); </script> </body> </html>