FacturaScripts vulnerable to stored XSS via product reference in sales/purchases

CVE-2026-42877

## Summary A stored Cross-Site Scripting (XSS) vulnerability exists in the product search modal of sales and purchases

历史摘要 · 未重新核验 · GitHub Advisory

FacturaScripts Vulnerable to Unstripped Image Metadata (EXIF) Leakage via Library Module File Upload/Download

CVE-2026-27892

## Summary **Fectura Scripts** is an open-source ERP application, a **sensitive information disclosure vulnerability**

历史摘要 · 未重新核验 · GitHub Advisory

A Remote Code Execution vulnerability was found in CODEASTRO Membership Management System v1.0 in...

CVE-2026-36387

A Remote Code Execution vulnerability was found in CODEASTRO Membership Management System v1.0 in /add_members.php. This

历史摘要 · 未重新核验 · GitHub Advisory

Cross-Site Scripting (XSS) vulnerability exists in Webkul Krayin CRM v2.1.5. The application...

CVE-2026-36341

Cross-Site Scripting (XSS) vulnerability exists in Webkul Krayin CRM v2.1.5. The application fails to sanitize user-supp

历史摘要 · 未重新核验 · GitHub Advisory

A Cross-Site Scripting (XSS) vulnerability was found in PHPGurukal Hospital Management System v4...

CVE-2026-36388

A Cross-Site Scripting (XSS) vulnerability was found in PHPGurukal Hospital Management System v4.0 in the /hospital/hms/

历史摘要 · 未重新核验 · GitHub Advisory

BentoML has Information Disclosure in `bentoml build` via symlink traversal in the build context

CVE-2026-40610

### Summary BentoML's `bentoml build` packaging workflow follows attacker-controlled symlinks inside the build context a

历史摘要 · 未重新核验 · GitHub Advisory

vm2 Host Promise Resolution Preserves Object Identity Across Sandbox Boundary

CVE-2026-44000

### Summary A sandbox boundary violation in **vm2** allows host object identity to cross into the sandbox through host

历史摘要 · 未重新核验 · GitHub Advisory

Bandit HTTP/2 Frame Size Limit Bypass via Late Buffer Check Enables Memory Exhaustion

CVE-2026-42788

### Summary Bandit's HTTP/2 parser checks frame size *after* it has already buffered the full body, instead of when it

历史摘要 · 未重新核验 · GitHub Advisory

Bandit trusts client-supplied URI scheme on plaintext connections

CVE-2026-39807

### Summary Bandit reflects the client-supplied URI scheme into `conn.scheme` without verifying the actual transport. Ov

历史摘要 · 未重新核验 · GitHub Advisory

Bandit is vulnerable to CL.CL request smuggling via unrejected duplicate `Content-Length` header

CVE-2026-39805

### Summary Bandit is vulnerable to CL.CL HTTP request smuggling: it silently accepts requests with two `Content-Length

历史摘要 · 未重新核验 · GitHub Advisory

gittuf's policy can be rolled back to prior valid versions

CVE-2026-44544

## Summary An attacker with push access to gittuf's Reference State Log (RSL) can roll back the current policy to any p

历史摘要 · 未重新核验 · GitHub Advisory

The Appointment Booking Calendar plugin for WordPress is vulnerable to Missing Authorization in...

CVE-2026-4807

The Appointment Booking Calendar plugin for WordPress is vulnerable to Missing Authorization in versions up to and inclu

历史摘要 · 未重新核验 · GitHub Advisory

The Forminator Forms plugin for WordPress is vulnerable to Missing Authorization in versions up...

CVE-2026-6222

The Forminator Forms plugin for WordPress is vulnerable to Missing Authorization in versions up to and including 1.51.1.

历史摘要 · 未重新核验 · GitHub Advisory

ZTE ZX297520V3 BootROM contains a vulnerability that allows arbitrary memory writes via USB....

CVE-2026-40003

ZTE ZX297520V3 BootROM contains a vulnerability that allows arbitrary memory writes via USB. Attackers can exploit the l

历史摘要 · 未重新核验 · GitHub Advisory

FileBrowser Vulnerable to Stored XSS via SVG File in Public Share (Missing CSP Header)

## Summary FileBrowser Quantum serves inline SVG files without a `Content-Security-Policy` header, allowing embedded Ja

历史摘要 · 未重新核验 · GitHub Advisory

docling-graph has SSRF via Missing Internal IP Validation in URLInputHandler

CVE-2026-44520

### Impact The `URLInputHandler` class in `docling_graph/core/input/handlers.py` makes HTTP requests to user-supplied U

历史摘要 · 未重新核验 · GitHub Advisory

imageproc: integer overflow in kernel size check leads to out-of-bounds read

A bounds verification of a slice storage of a 2-dimensional matrix's coefficients (a kernel) would compare the total siz

历史摘要 · 未重新核验 · GitHub Advisory

imageproc: Out-of-bounds read via NaN coordinates in bilinear/bicubic sampling

A bounds check was performed in floating points before a cast to the index passed to an unchecked access function. This

历史摘要 · 未重新核验 · GitHub Advisory

imageproc has fragile bounds check when sampling from image

A read of pixels was coded as modifying coordinates to lie within the image bounds. It would calculate a coordinate by a

历史摘要 · 未重新核验 · GitHub Advisory

ShellHub has cross-tenant IDOR in `GET /api/namespaces/:tenant` via API Key bypasses membership check

CVE-2026-44426

## Summary `GET /api/namespaces/:tenant` returns the full namespace object — including the members list (user IDs, e-mai

历史摘要 · 未重新核验 · GitHub Advisory