AVideo: IDOR in PayPalYPT Plugin Allows Any Authenticated User to Cancel Arbitrary PayPal Subscription Agreements

CVE-2026-43883

## Summary `plugin/PayPalYPT/agreementCancel.json.php` cancels a PayPal billing agreement using an attacker-supplied `a

历史摘要 · 未重新核验 · GitHub Advisory

AVideo: Unauthenticated CRLF/ICS Injection in Scheduler downloadICS.php Allows Calendar Event Spoofing

CVE-2026-43882

## Summary The unauthenticated `plugin/Scheduler/downloadICS.php` endpoint passes attacker-controlled `title`, `descrip

历史摘要 · 未重新核验 · GitHub Advisory

AVideo: Unauthenticated User Enumeration in objects/users.json.php via isCompany Parameter Allows Bypass of the Admin-Only Listing Restriction

CVE-2026-43881

## Summary `objects/users.json.php` exposes two unauthenticated paths that disclose the full set of registered user acc

历史摘要 · 未重新核验 · GitHub Advisory

OpAMP client reads unbounded HTTP response bodies

CVE-2026-42348

### Summary When receiving responses from the OpAMP server over HTTP, the OpAMP client allocates an unbounded buffer to

历史摘要 · 未重新核验 · GitHub Advisory

AVideo: Unauthenticated Arbitrary Email Sending via sendEmail.json.php Enables Phishing from the Site’s Legitimate From Address

CVE-2026-43880

## Summary `objects/sendEmail.json.php` exposes two branches depending on whether `contactForm=1` is submitted. When th

历史摘要 · 未重新核验 · GitHub Advisory

Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display

### Impact In the Prometheus server's legacy web UI (enabled via the command-line flag `--enable-feature=old-ui`), the

历史摘要 · 未重新核验 · GitHub Advisory

GraphQL-Ruby's Ruby lexer does not count comment tokens for the purposes of max_query_string_tokens

GraphQL-Ruby's `max_query_string_tokens` configuration didn't count comment tokens against the limit, allowing strings t

历史摘要 · 未重新核验 · GitHub Advisory

ip-address has XSS in Address6 HTML-emitting methods

CVE-2026-42338

### Summary `Address6.group()` and `Address6.link()` do not HTML-escape attacker-controlled content before embedding it

历史摘要 · 未重新核验 · GitHub Advisory

AVideo has Blind SSRF in YPTWallet Donation Webhook via Missing isSSRFSafeURL() Check and CURLOPT_FOLLOWLOCATION Redirect Bypass

CVE-2026-43879

## Summary An authenticated user can configure their own donation-notification webhook URL to point at internal/loopbac

历史摘要 · 未重新核验 · GitHub Advisory

Kubewarden vulnerable to RBAC Reconnaissance via unchecked can_i host capability call

CVE-2026-42541

### Impact Kubewarden is a policy engine for Kubernetes. Kubewarden cluster operators can grant permissions to users to

历史摘要 · 未重新核验 · GitHub Advisory

Grav is Vulnerable to XXE via SVG Upload

Dear Grav Security Team, A security vulnerability was discovered in Grav CMS that allows authenticated attackers to rea

历史摘要 · 未重新核验 · GitHub Advisory

Dify before version 1.14.0 contains an authorization bypass vulnerability that allows...

CVE-2026-41950

Dify before version 1.14.0 contains an authorization bypass vulnerability that allows authenticated users to read the fu

历史摘要 · 未重新核验 · GitHub Advisory

Grav Vulnerable to Sensitive Information Disclosure via Accounts Service Bypass

CVE-2026-42610

## Summary Information disclosure exists in `Grav CMS v1.8.0-beta.29`. Despite previous security patches (notably in `v1

历史摘要 · 未重新核验 · GitHub Advisory

Grav Vulnerable to XSS via Taxonomy Field Values in Admin Panel

CVE-2026-42842

### Summary A Stored Cross-Site Scripting (XSS) vulnerability exists in the Grav CMS Form plugin's select field templat

历史摘要 · 未重新核验 · GitHub Advisory

Grav CMS vulnerable to stored XSS via Markdown media attribute() action

CVE-2026-42841

### Summary An authenticated user with page editing permissions can inject an executable JavaScript event-handler attri

历史摘要 · 未重新核验 · GitHub Advisory

PocketBase vulnerable to account pre-hijacking via OAuth2 unverfied->verified autolinking upgrade

CVE-2026-44166

A pre-hijacking issue was discovered with the OAuth2 autolinking by [Alardiians](https://github.com/Alardiians). In som

历史摘要 · 未重新核验 · GitHub Advisory

@evomap/evolver has an unbounded request body in proxy /asset/submit that causes persistent disk-exhaustion DoS

## Summary The EvoMap proxy daemon's HTTP body parser accepts requests of any size, and the `POST /asset/submit` route

历史摘要 · 未重新核验 · GitHub Advisory

PyLoad Vulnerable to Path Traversal via Package Folder Name

CVE-2026-42314

Insufficient sanitization of package folder names allows writing files outside the intended download directory. ## Affe

历史摘要 · 未重新核验 · GitHub Advisory

Ethyca Fides has a Privacy Request Identity Verification Bypass Vulnerability via Duplicate Detection

CVE-2026-42303

### Summary Fides deployments that enable both subject identity verification and duplicate privacy request detection ar

历史摘要 · 未重新核验 · GitHub Advisory

Kimai vulnerable to formula Injection via tag names in XLSX export

CVE-2026-42267

## Summary Any `ROLE_USER` can create a tag with a formula string as its name (e.g. `=SUM(54+51)`) via `POST /api/tags`

历史摘要 · 未重新核验 · GitHub Advisory