Reserved but Public CVEs

First seen Jul 15, 2026

First seen Jul 15, 2026

First seen Jul 15, 2026

First seen Jul 15, 2026

First seen Jul 15, 2026

First seen Jul 15, 2026

CVE-2026-47253 is a vulnerability in Anyquery that was remediated in version 0.4.5 by adding sandboxing. Anyquery is a SQL-based query engine built on SQLite and extended through plugins. Available information indicates that the vulnerability was serious enough to require a sandboxing control, which strongly suggests that plugin execution or related functionality could perform unsafe operations outside intended isolation boundaries. However, the currently available information does not identify the specific vulnerable function, root cause, or exact exploitation mechanism.

CVE-2026-47253First seen Jun 11, 2026

A code injection vulnerability affects Anyquery macOS browser-tab plugins for Chromium-based and Safari browsers. The vulnerable behavior stems from SQL-controlled URL values being interpolated into AppleScript or JXA script templates that are then executed through osascript. Because the input is not safely passed as a separate argument or correctly escaped before script execution, an attacker who can influence INSERT or UPDATE operations against the affected plugin tables can inject unintended script content and trigger arbitrary command execution on the macOS host. The issue affects the browser-tab plugin implementations referenced in the fixed plugin version changes associated with CVE-2026-47252.

CVE-2026-47252First seen Jun 9, 2026

CVE-2026-45262 is an authenticated SQL injection vulnerability in the FacturaScripts REST API filter parameter. The issue stems from improper handling of parenthesized field names in the Where::sqlColumn() logic, which allows attacker-controlled input to be incorporated into SQL expressions without sufficient validation. An attacker with a low-privileged API key and GET access to at least one API resource can abuse crafted filter parameters to query arbitrary columns from other tables, bypass intended model-level field restrictions, and access sensitive data across resources. The flaw affects API routes that process filter keys, including standard resource endpoints and attached file handling, and can be leveraged as a cross-resource data exfiltration primitive that may lead to broader application compromise.

CVE-2026-45262First seen Jul 15, 2026

First seen Jul 14, 2026

First seen Jul 14, 2026

CVE-2026-47677 is an authentication bypass vulnerability in FacturaScripts affecting the two-factor authentication flow. The issue resides in the login endpoint handling two-factor validation, where the application accepts TOTP verification attempts without adequately binding the request to a successfully completed primary password-authentication step. As a result, an unauthenticated attacker who knows a target user's nick can directly submit repeated TOTP guesses against the two-factor validation action. The vulnerable flow also lacks sufficient request validation and pre-verification abuse controls, enabling brute-force attempts against 2FA codes. The weakness can lead to full compromise of accounts protected by two-factor authentication, including administrative accounts.

CVE-2026-47677First seen Jul 14, 2026

CVE-2026-52828 is an authorization flaw in Kimai affecting export template management. The vulnerability is caused by missing permission enforcement in ExportController functions responsible for creating and editing export templates. Specifically, users holding the ROLE_TEAMLEAD role can create or modify global export templates even though those actions should be restricted to principals granted the create_export_template permission. This results in a privilege boundary bypass in which lower-privileged users can perform administrator-level template management operations.

CVE-2026-52828First seen Jun 11, 2026

CVE-2026-61667 is an authenticated remote code execution vulnerability in the DIRAC FileCatalog DatasetManager. The flaw is described as an SQL injection condition in which attacker-controlled data is ultimately passed into eval, resulting in execution of arbitrary code on the server. The issue affects DIRAC deployments prior to the fixed releases on the supported branches. Because untrusted input reaches dynamic code evaluation, a successful attacker can move from application-level input control to server-side command execution within the DIRAC environment.

CVE-2026-61667First seen Jul 13, 2026

CVE-2026-45579 is a remote code execution vulnerability in DIRAC RequestManager. The flaw is caused by the use of eval on untrusted input within the export_getRequestCountersWeb and RequestDB code paths. Because attacker-controlled input is evaluated as code, an authenticated user can trigger execution of arbitrary Python code or system commands on the DIRAC server in the security context of the account running DIRAC services.

CVE-2026-45579First seen Jul 13, 2026

CVE-2026-54072 is an open redirect vulnerability in the Authorizer /authorize endpoint. The endpoint accepts attacker-controlled redirect_uri values without applying the same origin validation used elsewhere, allowing an attacker to supply an arbitrary redirection target during the OAuth2 authorization flow. When a victim who is already authenticated is induced to visit a crafted authorization request, the server can issue a 302 redirect to the attacker-controlled destination while including OAuth tokens in the redirect. This can expose access tokens, ID tokens, and refresh tokens to the attacker. The issue affects the authorization flow logic rather than requiring prior authentication by the attacker.

CVE-2026-54072First seen Jul 10, 2026

First seen Jul 10, 2026

First seen Jul 10, 2026

CVE-2026-57825 is a directory traversal vulnerability in OPAM, the package manager for OCaml. The flaw arises from insufficient restriction of directives in .install files during package installation. OPAM did not properly validate symlink resolution on the target path when installing files, allowing crafted package metadata to cause writes outside the intended package area. By leveraging symlink-based path traversal, a malicious package could escape the package installation boundary and place files in unintended filesystem locations.

CVE-2026-57825First seen Jul 10, 2026

First seen Jul 10, 2026

First seen Jul 10, 2026

First seen Jul 10, 2026

First seen Jul 10, 2026

CVE-2026-52777 is an authenticated PHP object injection vulnerability in YesWiki affecting the Bazar import workflow. The issue stems from unsafe deserialization of attacker-controlled input in BazarImportAction, where serialized PHP data is accepted and passed to unserialize without adequate restrictions. Because the import path also lacks effective CSRF protection, an attacker can induce a privileged user to submit a crafted import request, allowing attacker-supplied serialized objects to be processed by the server. If a suitable gadget chain is present in the application or its dependencies, successful exploitation can result in remote code execution on the YesWiki host.

CVE-2026-52777First seen Jun 14, 2026

CVE-2026-52766 is an authorization flaw in YesWiki affecting the erasespamedcomments action. The vulnerable behavior stems from missing authorization checks combined with permissive default action ACL handling, allowing the action to be invoked without proper access control enforcement. As a result, an unauthenticated attacker can trigger deletion of arbitrary wiki pages rather than being limited to spam-comment cleanup. The issue can affect high-value content such as the front page, administrative pages, and pages owned by other users, and the deletion process also removes associated records from multiple database tables.

CVE-2026-52766First seen Jun 14, 2026