Vulnerabilities

OS command injection in the WireGuard CLI Handler's sub_419DA8 function of WAVLINK WN553X1-B allows remote manipulation of the file_id argument in /bin/ioos. This can lead to arbitrary command execution. Attackers can trigger it remotely without authentication. Affected are users of the device running firmware…

Do: Apply WAVLINK's update for CVE-2026-120239. No workaround provided.

A security flaw has been discovered in ag-ui-protocol ag-ui up to 0.0.58. This affects an unknown function of the file sdks/typescript/packages/client/src/agent/http.ts of the component HttpAgent. Performing a manipulation results in information disclosure. The attack can be initiated remotely. The exploit has been…

Google::Auth for Perl versions 0.11 through 0.12 accepts authorization code from any local process as gcloud-auth login callback does not check OAuth state. A local attacker can submit an authorization code for their own Google account. The CLI exchanges it and stores the refresh token as the user's credentials…

Do: Upgrade Google::Auth Perl to a fixed version. Apply Google's update for CVE-2026-74760.

Stored XSS in WordPress File Upload wp-file-upload allows improper neutralization of input during web page generation. Attackers trigger it by submitting malicious payloads through the plugin with user interaction. This gives code execution in victim browsers. Affected are all users of versions through 5.2.1.

Do: Apply Nickboss's update for CVE-2026-66570. Fixed version not stated.

SQL injection flaw in StellarWP BookIt plugin allows remote unauthenticated attackers to execute arbitrary SQL queries on WordPress sites. Triggered via network without authentication or user interaction. Attacker gains high confidentiality impact and low availability impact. Affects BookIt from n/a through 2.6.0.6.

Do: Upgrade BookIt to a fixed version. Apply Patchstack update for CVE-2026-62048.

Prefab Generative UI runs caller-supplied Python code inside a Pyodide sandbox with unrestricted Deno permissions. Any client able to call the generate_prefab_ui tool can trigger it, including on unauthenticated FastMCP servers. An attacker gains full file read/write access as the server OS user and can persist…

Do: Upgrade to Prefab UI 0.21.0. No workaround available.

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Crocoblock JetFormBuilder jetformbuilder allows Path Traversal.This issue affects JetFormBuilder: from n/a through 3.6.7.1.

Memory corruption in Horizon DataSys Reboot Restore Standard up to 13.2 kernel driver via manipulation of sub_23908 in shield.sys. Local users can trigger it from the local environment. Attackers gain memory corruption. Systems running the vulnerable version are affected.

Do: Upgrade to the fixed version in the upcoming release. No workaround provided.

OS command injection in del_vlan_group function of WAVLINK WN701AE ioos Web Backend via vlan_name manipulation. Remote unprivileged attack possible over network. Attacker executes arbitrary commands. Public exploit available. Affected: WAVLINK WN701AE 260105.

Do: Upgrade WAVLINK WN701AE to latest version. No workaround provided.

Improper Check for Unusual or Exceptional Conditions vulnerability in the pattern and patternProperties keywords in lud jsv allows an unauthenticated remote attacker to bypass schema validation via a string that matches a schema regex only after heavy backtracking. JSV.Helpers.RegexExt.bounded_match?/2 runs schema…

When a Beta9 tenant deploys a function, endpoint, or task queue, the gateway builds a host volume path from the workspace name and a volume identifier in the stub configuration without checking that the workspace owns that volume. Parent-directory segments in the identifier collapse the path to the worker filesystem…

Do: Upgrade the gateway to 0.1.776 and the worker to 0.1.756, which validate volume identifiers and mount paths and reject volumes the workspace does not own.

The Beta9 worker serves its sandbox file API outside the container. getHostPathFromContainerPath joins a tenant path onto a mount source or the container root after a prefix check, so parent-directory segments and absolute symlinks escape onto the worker filesystem. A tenant with a workspace token and one running…

Do: Upgrade the Beta9 worker to 0.1.756, which opens sandbox file and workspace-sync paths with os.OpenRoot.

WAVLINK WN701AE firmware M01AE_V260105 has an OS command injection flaw in del_staticrule within static_route_setting.sh, part of the ioos web backend. A remote attacker with low privileges can manipulate the rule_name argument and inject operating-system commands, compromising the device. A public exploit is…

Do: No fixed version is listed for CVE-2026-120227. Until WAVLINK publishes an update, limit remote access to the ioos web backend to trusted administrators.

A security vulnerability has been detected in Hangzhou Xiongmai Technology P2PAPI.dll 1.3.3.32 on Windows. Affected by this issue is the function P2PAPI_Connect of the component P2P SDK. Such manipulation of the argument input as part of String leads to buffer overflow. An attack has to be approached locally. The…

HTTP::Session before 0.54 for Perl allows memcached command injection in HTTP::Session::Store::CHI. The flaw stems from unfiltered session IDs from client cookies, which include control characters like CR and LF. These characters terminate the initial cache command and allow injection of further commands into the…

Do: Upgrade to HTTP::Session 0.54. No workaround given.

A flaw in Oray Pugongying X5 Pro up to 7.6.1 in the API Authorization component allows improper authorization through run_apis_by_json and run_async_task functions. Attackers can trigger it remotely without authentication. This may enable unauthorized access or system control. All users of affected versions are at…

Do: Upgrade to version 7.6.1 or later; no workaround provided by vendor.

When `[oauth2_client].ACCOUNT_LINKING` is set to `auto` (not the default) and registration is enabled, the link-account sign-up form looked up the existing account to link by the user name or email submitted in the form instead of the identity asserted by the OAuth2 provider. An attacker with an account on a…

The web profile and RSS/Atom feed routes of users and organizations checked only whether a signed-in viewer could see a limited-visibility owner, without considering the `public-only` restriction of the personal access token used to authenticate. Any user holding a public-only token could send it over HTTP Basic…

The `/{username}` web route accepted personal access tokens over HTTP Basic authentication without checking their scope. A token confined to an unrelated scope, such as `read:issue`, could read its owner's private activity through the user RSS/Atom feed and the profile activity tab, and other members' activity in a…

Repository and organization project boards listed the pull requests that reference each issue on the board without checking whether the viewer can read them. When a private pull request mentions an issue on a board the viewer can open, the board revealed the private repository's path and the pull request's number…

`DELETE /api/v1/orgs/{org}/repos` deletes all repositories of an organization, but it did not enforce the public-only restriction of access tokens: the route only checked that the organization itself was public. A public-only token of an owner of a public organization could therefore permanently delete the…

The web interface blocks issue and pull request changes on archived repositories, but several issue routes of the REST API did not check whether the repository is archived. A user allowed to change issues of an archived repository could use the API to edit, close or delete issues, change labels and deadlines, add or…

Gitea 1.27.3 stopped personal access tokens restricted to public resources (`public-only`) from creating repositories through `POST /api/v1/user/repos` and `POST /api/v1/repos/migrate`, but `POST /api/v1/org/{org}/repos`, `POST /api/v1/orgs/{org}/repos`, `POST /api/v1/orgs` and `POST…

The OAuth2 userinfo endpoint (`/login/oauth/userinfo`) decided whether to limit the `groups` claim to public organizations by re-parsing the `Authorization` header as an OAuth2 access token instead of using the scope of the credential that authenticated the request. When a public-only OAuth2 token was sent as a query…

Workflows triggered by a pull request review were read from the commit named in the review's `commit_id`, while the fork restrictions were decided by the reviewed pull request, and the commit was not checked to belong to that pull request. A user with read access to a repository could place a commit of their own in…

The OCI registry's cross-repository blob mount checked the target package against the token's `public-only` restriction, but checked the source blob only against the full account permissions of the token owner. A `public-only` token with `write:package` scope, whose owner can read a private package and write to a…

When parsing an uploaded Helm chart, Gitea decompressed the archive and read every tar entry while looking for `Chart.yaml` without limiting the decompressed size, and did so before the package size quota was checked; the quota only considers the compressed upload size. A user with package write access to an owner…

The issue timeline API and the web issue page hid cross-reference events that point at issues the reader cannot access, but not "dependency added" and "dependency removed" events. When a readable issue had been linked as a dependency to an issue in a repository the reader cannot access, for example a private…

The repositories, stars and watching tabs of user profiles and the repository list of organization home pages included private repositories for every signed-in request without checking whether the request used a personal access token restricted to public resources (`public-only`). A holder of such a token could list…

The `/api/v1/admin` route group did not enforce the `public-only` restriction of personal access tokens. A public-only token with admin scope issued by a site administrator could therefore list private organizations and the email addresses of all users, create organizations, obtain runner registration tokens and…

The `GITEA_TOKEN` of a Gitea Actions job authenticates as the `gitea-actions` system user, and the `/api/v1/user` email and GPG key endpoints accepted that user, so a job could register an email address and a GPG key on it; without required email confirmation (the default) the address is stored as activated. Commit…

GitHub API routes for releases, assets, milestones and labels did not reject changes to archived repositories. Users with write access or write-scoped tokens could replace or delete release assets (URLs stayed valid), delete releases and tags, and edit milestones and labels on read-only repos. This affects all GitHub…

Do: Apply GitHub's update for CVE-2026-116296. No workaround named.

`GET /api/v1/users/{username}/heatmap` computed the contribution heatmap with the repository access of the token owner and ignored the public-only restriction of the access token, unlike the activity feed endpoints. A holder of a user's public-only token could read contribution counts and their 15-minute time buckets…

Legacy (v1 to v3) Actions artifact uploads stored the request's `Content-Encoding` header unchecked in the column that is served as the artifact's `Content-Type` on download, and a value starting with `video/` or `audio/` also removed the sandboxing Content-Security-Policy. A user who can run an Actions job could…

Gitea Actions task tokens authenticate to the REST API as a shared system user with a negative ID, which repository, organization, project and key filters treated as having no owner restriction, and the token carried no API scope to restrict user-scoped routes. A user who can run a workflow could use the job's token…

Typemill through 2.26.0 has a cross-site scripting flaw in ControllerApiImage::saveImage (system/typemill/Models/SvgSanitizer.php). A remote, low-privileged user can trigger it by manipulating image save handling; a victim must interact for the script to run. Impact is limited integrity on the site. Sites running…

Do: Upgrade Typemill to 2.27.0 (patch 9ca43c4a7b6764c5a6ac11a2ccc099b036ee3cef).

A vulnerability was detected in Delgan loguru 0.7.3. The affected element is the function AnsiParser.feed of the file loguru/_colorizer.py of the component ANSI Color-Markup Parser. Performing a manipulation results in inefficient regular expression complexity. The attack is possible to be carried out remotely. The…

WAVLINK WL-WN530BE1-A firmware V251117 has a command injection flaw in con_check_read_finish in /protocol.csp. An unauthenticated remote attacker can trigger it by manipulating the group_name or IP-FROM argument, with no user interaction. Successful exploitation can run commands on the device. A public exploit has…

Do: WAVLINK has not listed a fixed version; the vendor was contacted about the disclosure. No workaround is named.

The MapPress WordPress plugin before 2.97.15 does not restrict which user's data its front-end map embed handler renders, allowing unauthenticated visitors to retrieve the email address and display name of any user on the site by enumerating user IDs.

The Media Library Assistant WordPress plugin before 3.44 does not escape one of its shortcode attributes before outputting it in an attribute of generated links, allowing users with the Contributor role and above to perform Stored Cross-Site Scripting attacks.