Explore CVE records

HighPublished 22 Aug 2026, 02:32 WIB

CVE-2026-30866

Combodo iTop: Insecured access to uploaded images via sniffed url

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, unauthenticated users can access uploaded sensitive via sniffed url. This issue has been fixed in version 3.2.3.

Excerpt language: en.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated26 Aug 2026, 00:28 WIB

Official record

HighPublished 22 Aug 2026, 02:29 WIB

CVE-2026-50288

@asymmetric-effort/specifyjs: URL parse failure silently allows request

SpecifyJS is a declarative TypeScript user interface framework. Prior to version 0.2.136, when `new URL()` throws a parse error, the `assertSecureUrl` function returned without throwing, silently allowing the request to proceed without HTTPS validation. Starting in version 0.2.136, the catch block now throws an error i…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

MedPublished 22 Aug 2026, 02:23 WIB

CVE-2026-67361

Joomla Extension - j2commerce.com - Unauthenticated file upload with missing directory protection in J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5

Joomla Extension - j2commerce.com - Unauthenticated file upload with missing directory protection in J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5 - The file upload endpoint accepted POST requests from unauthenticated visitors with no CSRF token. Compounding this, the installer manifest omitted the upload and invoice…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated22 Aug 2026, 03:11 WIB

Official record

HighPublished 22 Aug 2026, 02:21 WIB

CVE-2026-74252

Joomla Extension - j2commerce.com - Stored XSS in Guest checkout in J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5

Joomla Extension - j2commerce.com - Stored XSS in Guest checkout in J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5 - J2Commerce 4.1.5 is vulnerable to Stored Cross-Site Scripting (XSS) through the guest checkout billing address fields. An unauthenticated attacker exploits a filter bypass in Joomla's Input::getArray() …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS8.6v4.0KEVNot listedEPSSPresentUpdated22 Aug 2026, 03:09 WIB

Official record

MedPublished 22 Aug 2026, 02:20 WIB

CVE-2026-67358

Joomla Extension - j2commerce.com - Download quota manipulation in J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5

Joomla Extension - j2commerce.com - Download quota manipulation in J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5 - An authenticated user with a valid order token could increment the download limit counter on a download record belonging to a different order. The endpoint also lacked a CSRF token.

Excerpt language: en.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated22 Aug 2026, 03:26 WIB

Official record

MedPublished 22 Aug 2026, 02:19 WIB

CVE-2026-67362

Joomla Extension - j2commerce.com - Open redirect in cart controller in J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5

Joomla Extension - j2commerce.com - Open redirect in cart controller in J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5 - Four task handlers accepted a base64-encoded URL from user input and redirected to it without validating the destination host, enabling phishing using the shop's trusted domain. No authentication re…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated22 Aug 2026, 03:25 WIB

Official record

HighPublished 22 Aug 2026, 02:18 WIB

CVE-2026-67359

Joomla Extension - j2commerce.com - Order content disclosure J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5

Joomla Extension - j2commerce.com - Order content disclosure J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5 - An unauthenticated visitor could supply any order_id as a query parameter to render the full checkout confirmation page for that order, including line items, prices, and totals.

Excerpt language: en.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated22 Aug 2026, 03:24 WIB

Official record

MedPublished 22 Aug 2026, 02:16 WIB

CVE-2026-67360

Joomla Extension - j2commerce.com - Cross-customer order replication in J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5

Joomla Extension - j2commerce.com - Cross-customer order replication in J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5 - An authenticated user could supply another customer's order_id to copy their cart contents and address data into the attacker's session. The CSRF token was validated but ownership was not checked.

Excerpt language: en.

CVSS6.3v4.0KEVNot listedEPSSPresentUpdated22 Aug 2026, 03:22 WIB

Official record

HighPublished 22 Aug 2026, 01:55 WIB

CVE-2026-54071

BabelDOC: Arbitrary Code Execution via CMap Pickle Deserialization in babeldoc/pdfminer/cmapdb.py

BabelDOC is a document translation tool. Prior to 0.6.3, BabelDOC's vendored PDF parser in babeldoc/pdfminer/cmapdb.py deserializes untrusted pickle data when CMapDB._load_data() loads CMap files. PDF-controlled Encoding or CMapName values and embedded PostScript usecmap operators can reach this sink after path separat…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated22 Aug 2026, 04:43 WIB

Official record

MedPublished 22 Aug 2026, 01:51 WIB

CVE-2026-54073

VeraCrypt: Hidden volume quick format weakens plausible deniability

VeraCrypt provides disk encryption with strong security based on TrueCrypt. From 1.26.6 until 1.26.29, file-hosted hidden volume creation forces quick format and the FormatNoFs function in src/Common/Format.c and FormatFat function in src/Common/Fat.c use WriteFile to place raw zeroed sectors at predictable 128 MiB int…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS4.6v4.0KEVNot listedEPSSPresentUpdated22 Aug 2026, 02:32 WIB

Official record

MedPublished 22 Aug 2026, 01:50 WIB

CVE-2026-53762

VeraCryp: wolfCrypt backend bypasses VeraCrypt PBKDF2 iteration count (non-default WOLFCRYPT=1 builds)

VeraCrypt provides disk encryption with strong security based on TrueCrypt. Prior to 1.26.29, non-default builds created with WOLFCRYPT=1 and WOLFCRYPT_BACKEND route SHA-256 and SHA-512 volume-header key derivation through derive_key_sha256 and derive_key_sha512 in src/Crypto/wolfCrypt.c, where the configured iteration…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS6.2v3.1KEVNot listedEPSSPresentUpdated27 Aug 2026, 00:35 WIB

Official record

MedPublished 22 Aug 2026, 01:41 WIB

CVE-2026-54681

DiscordChatExporter: HTML attribute injection via unescaped emoji name in HTML export

DiscordChatExporter saves Discord chat logs to a file. Prior to 2.47.2, the VisitEmojiAsync method in DiscordChatExporter.Core/Exporting/HtmlMarkdownVisitor.cs interpolates emoji.Name into the alt attribute and emoji.Code into the title attribute without HTML entity encoding. This affects HTML exports regardless of the…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS4.1v3.1KEVNot listedEPSSPresentUpdated22 Aug 2026, 02:04 WIB

Official record

HighPublished 22 Aug 2026, 01:40 WIB

CVE-2026-54682

DiscordChatExporter: Stored XSS in HTML export when markdown formatting is disabled

DiscordChatExporter saves Discord chat logs to a file. Prior to 2.47.2, HTML exports generated with markdown formatting disabled pass attacker-controlled content through FormatMarkdownAsync and FormatEmbedMarkdownAsync in DiscordChatExporter.Core/Exporting/MessageGroupTemplate.cshtml and render it without HTML entity e…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS8.2v3.1KEVNot listedEPSSPresentUpdated26 Aug 2026, 00:31 WIB

Official record

MedPublished 22 Aug 2026, 01:30 WIB

CVE-2026-55850

Element Web: A malicious homeserver can inject HTML in Element Web using its homepage

Element Web is a Matrix web client built using the Matrix React SDK. Prior to 1.12.22, EmbeddedPage in apps/web/src/components/structures/EmbeddedPage.tsx renders homeserver-supplied homepage content through dangerouslySetInnerHTML without passing it through sanitizedHtmlNode. A malicious homeserver can provide crafted…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated22 Aug 2026, 02:54 WIB

Official record

MedPublished 22 Aug 2026, 01:30 WIB

CVE-2026-77795

Dromara RuoYi-Vue-Plus Workflow Endpoint TestLeaveController improper authorization

A vulnerability was identified in Dromara RuoYi-Vue-Plus up to 5.6.2. This issue affects the function FlwInstanceController/FlwDefinitionController/FlwCategoryController/FlwSpelController/TestLeaveController of the component Workflow Endpoint. Such manipulation leads to improper authorization. The attack can be launche…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated22 Aug 2026, 02:36 WIB

Official record

HighPublished 22 Aug 2026, 01:28 WIB

CVE-2026-54134

OctoPrint: File exfiltration possible via query parameters on upload endpoints

OctoPrint provides a web interface for controlling consumer 3D printers. Prior to 1.11.8 and 2.0.0rc3, OctoPrint's custom Tornado upload handler and Flask with Werkzeug parse request parameters differently, allowing an attacker with FILE_UPLOAD permission to inject reserved internal upload fields through query paramete…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS7v4.0KEVNot listedEPSSPresentUpdated27 Aug 2026, 00:34 WIB

Official record

MedPublished 22 Aug 2026, 01:25 WIB

CVE-2026-35163

OctoPrint: XSS in Suppressed Command Notifications

OctoPrint provides a web interface for controlling consumer 3D printers. Prior to 1.11.8 and 2.0.0rc3, Suppressed Command notification popups use PNotify rendering for printer-controlled payload.command and payload.message values in src/octoprint/static/js/app/viewmodels/terminal.js without HTML escaping. An attacker w…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS4.6v4.0KEVNot listedEPSSPresentUpdated22 Aug 2026, 02:53 WIB

Official record

MedPublished 22 Aug 2026, 01:21 WIB

CVE-2026-63466

Unleash: Global Mustache.escape override disables HTML escaping process-wide, enabling Slack/Teams link-injection via unrestricted username

Unleash is an open-source feature management platform. Prior to 8.0.3, FeatureEventFormatterMd.format in src/lib/addons/feature-event-formatter-md.ts assigns Mustache.escape to an identity function before rendering action and path templates. Because Mustache.escape is process-wide, the assignment disables escaping for …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS4.1v3.1KEVNot listedEPSSPresentUpdated22 Aug 2026, 04:43 WIB

Official record

HighPublished 22 Aug 2026, 01:12 WIB

CVE-2026-63462

Unleash: Unauthenticated single-request DoS via OpenAPI validation error formatter

Unleash is an open-source feature management platform. Prior to 7.5.2, 7.6.5, and 8.0.2, the shared OpenAPI validation error path in src/lib/error/bad-data-error.ts passes a raw request value from lodash.get to JSON.stringify in genericErrorMessage and fromOpenApiValidationErrors without guarding stack exhaustion. An u…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated26 Aug 2026, 00:33 WIB

Official record

MedPublished 22 Aug 2026, 01:05 WIB

CVE-2026-63004

Unleash: Addon webhook URL is dialed server-side with no internal-address filtering, enabling SSRF to internal services / cloud metadata and exfiltration of configured request headers

Unleash is an open-source feature management platform. Prior to 7.5.2, 7.6.5, and 8.0.2, the addon and integration subsystem passes the operator-controlled parameters.url value from src/lib/addons/webhook.ts and the Slack, Microsoft Teams, Datadog, and New Relic integrations to Addon.fetchRetry in src/lib/addons/addon.…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS5.5v3.1KEVNot listedEPSSPresentUpdated22 Aug 2026, 02:22 WIB

Official record

Find the CVE cohort

Severity

Matching records by UTC month

Signal coverage

Find the CVE cohort

Matching cohort composition

Severity

Matching records by UTC month

Signal coverage