Reserved but Public CVEs

CVE-2026-53932 is an OS command injection vulnerability in the wnx/laravel-backup-restore package during database restore operations. The flaw occurs when crafted backup archive filenames placed under the database dump portion of a backup are passed to shell-invoked restore logic in a way that allows shell metacharacters in the filename to be interpreted as commands. If a malicious backup archive is restored, attacker-controlled input can break out of the intended command context and trigger arbitrary command execution on the host running the Laravel application.

CVE-2026-53932First seen Jul 10, 2026

CVE-2026-52763 is a stored SQL injection vulnerability in YesWiki affecting the `recentchanges` action. The flaw is caused by insufficient validation and sanitization of the `period` action argument before it is incorporated into a database query. An attacker able to save wiki content containing a crafted `recentchanges` invocation can persist malicious input in a page. When that page is later rendered, the application executes the injected SQL in the context of the backend database connection, allowing unauthorized query manipulation and exposure of database contents.

CVE-2026-52763First seen Jun 14, 2026

CVE-2026-53956 is a path traversal vulnerability in rattler_cache and py-rattler. The flaw allows package contents obtained from a malicious or otherwise untrusted conda channel to be written outside the configured package cache directory by using a crafted conda package build string containing path separators or traversal sequences. During package cache materialization, insufficient neutralization of path elements in package metadata can cause the resulting filesystem write operations to escape the intended cache boundary.

CVE-2026-53956First seen Jun 12, 2026

CVE-2026-49837 is a boundary validation flaw in GoBGP's parsing of BGP OPEN capabilities. The vulnerability affects the capability parser in github.com/osrg/gobgp/v4, where concrete capability decoders may read capability values beyond the declared capability length (CapLen) boundary. As a result, a malformed BGP OPEN message can cause the parser to consume bytes from subsequent capability fields as though they belonged to the current capability value. In the case of the 4-octet AS capability, this can interfere with peer AS validation and capability negotiation logic during BGP session establishment.

CVE-2026-49837First seen Jul 10, 2026

CVE-2026-53638 is an authorization bypass vulnerability in Sylius affecting the shop account orders API. An authenticated customer can modify the payment method associated with their own placed but unpaid order and select any globally enabled payment method, even when that payment method is not permitted for the order's sales channel. The flaw results from insufficient authorization and business-rule enforcement during payment method changes, allowing channel-based payment method restrictions to be bypassed.

CVE-2026-53638First seen Jul 10, 2026

CVE-2026-50553 is a path traversal vulnerability in Note Mark's migration export functionality. The flaw affects export operations that use book and note slug values to construct filesystem paths without sufficient sanitization or strict validation. Unsanitized slug values can contain traversal sequences that escape the configured export directory, allowing files and directories to be created in unintended filesystem locations. The issue affects administrative export commands, including the migrate export workflows, where attacker-controlled or user-supplied metadata is later processed by a higher-privileged export routine. The vulnerable behavior stems from improper restriction of path components before path joining, enabling directory traversal during file write operations.

CVE-2026-50553First seen Jun 12, 2026

CVE-2026-52771 is a second-order SQL injection vulnerability in YesWiki affecting versions 4.2.0 through 4.6.5. The flaw is present in the page deletion API, specifically in ApiController::deletePage, where attacker-controlled page tag data can be stored first and later reused in an unsafe SQL context during page deletion. Because the malicious input is persisted before exploitation is triggered, the issue is second-order rather than direct SQL injection. A low-privilege authenticated user can create or modify a page tag containing SQL payloads and subsequently trigger arbitrary SQL execution when the affected deletion workflow processes that stored value. Successful exploitation can enable unauthorized database manipulation and data access within the privileges of the application’s database account.

CVE-2026-52771First seen Jun 14, 2026

CVE-2026-53760 is a cross-site request forgery vulnerability in Admidio's plugin management functionality within modules/plugins.php. State-changing plugin install, uninstall, and update actions are exposed through unprotected GET requests and are not validated with a CSRF token. As a result, an attacker can cause an authenticated administrator's browser to issue unintended requests that perform administrative plugin operations. The uninstall workflow is particularly dangerous because plugin uninstall routines may execute destructive database operations, including table deletion, which can lead to irreversible loss of application data.

CVE-2026-53760First seen Jun 12, 2026

CVE-2026-50554 is an information disclosure vulnerability in the note-mark backend affecting the notes listing endpoint for public books. An unauthenticated attacker can request note listings with the deleted=true parameter and enumerate metadata for soft-deleted notes that should only be visible to the owning user. The exposed data includes note identifiers, titles, slugs, and timestamps associated with deleted notes. The flaw stems from improper authorization logic in which requests for soft-deleted notes are incorrectly allowed through the public-book authorization path instead of being restricted to owner-only access. The vulnerability does not expose the body or content of the deleted notes, but it defeats the intended privacy and deletion semantics for note metadata.

CVE-2026-50554First seen Jun 12, 2026

CVE-2026-52769 is an unauthenticated server-side request forgery vulnerability in YesWiki affecting versions 4.6.2 through 4.6.5. The flaw is present in the ActivityPub inbox handling path exposed through the public actor inbox endpoint, where the application processes the HTTP Signature `keyId` parameter without sufficient validation of the referenced remote resource. By supplying an attacker-controlled `keyId` value, a remote attacker can cause the YesWiki server to initiate outbound HTTP requests to arbitrary destinations reachable from the host.

CVE-2026-52769First seen Jun 14, 2026

CVE-2026-55252 is an open redirect vulnerability in the Go package github.com/openrundev/openrun. The flaw is caused by a redirect URL validation bypass in which crafted protocol-relative URLs using a double-slash form can evade intended same-host and same-scheme validation logic. As a result, application code relying on the affected validation can incorrectly treat an external destination as acceptable and issue a redirect to an attacker-controlled site.

CVE-2026-55252First seen Jul 10, 2026

CVE-2026-48737 is a server-side request forgery protection bypass in pyload-ng. The flaw arises from incorrect handling of IPv6 transition address formats, specifically 6to4 and NAT64-style addresses that embed IPv4 destinations. pyload-ng's SSRF guard treats these crafted IPv6 addresses as globally routable without first unwrapping and evaluating the embedded IPv4 target. As a result, an attacker can supply an IPv6 address that resolves to an internal IPv4 destination while bypassing checks intended to block access to non-public addresses. This can allow requests to internal services, including loopback and RFC1918 space, and potentially cloud instance metadata endpoints, through application functionality that performs outbound fetches on behalf of a user.

CVE-2026-48737First seen Jul 10, 2026

CVE-2026-53602 is an authorization flaw in nebula-mesh in which certificate issuance and renewal logic does not properly re-evaluate current authorization and revocation state before signing Nebula certificates. As a result, hosts that have been blocked or offboarded can still obtain new valid certificates through re-enrollment, and hosts originally provisioned by an operator whose privileges were later disabled can continue to renew certificates. The weakness stems from missing or insufficient authorization checks in the enrollment and renewal paths, including failure to enforce blocklist and host-status validation and failure to re-validate operator and certificate authority status at renewal time.

CVE-2026-53602First seen Jul 10, 2026

CVE-2026-53637 is an integrity flaw in Sylius affecting the Cart FormComponent's handling of stale cart state after checkout completion. An authenticated user who retains and submits an outdated cart page can interact with an order that has already been completed, allowing post-checkout modification or deletion of data that should no longer be mutable. The issue stems from insufficient validation of order state during cart form processing, enabling operations against an already-finalized order object.

CVE-2026-53637First seen Jul 10, 2026

CVE-2026-49838 is a denial-of-service vulnerability in GoBGP affecting BGP UPDATE processing for confederation validation. When handling an UPDATE from a confederation eBGP neighbor, the implementation accesses the first element of the AS_PATH attribute without first verifying that the attribute contains any entries. A malformed UPDATE carrying a zero-length AS_PATH can therefore trigger a panic during validation instead of being rejected as invalid input. The issue is caused by improper handling of exceptional input conditions in AS_PATH parsing and validation logic.

CVE-2026-49838First seen Jul 10, 2026

CVE-2026-53720 is a heap buffer overflow vulnerability in pymonocypher affecting the argon2i_32 function. The flaw is caused by missing validation that the caller-supplied nb_blocks buffer is large enough before the function writes to it. When a buffer smaller than required is provided, argon2i_32 can write past the end of the allocated heap buffer, resulting in out-of-bounds memory corruption. The issue arises from improper bounds checking on a size-sensitive output or working buffer used by the Argon2i implementation.

CVE-2026-53720First seen Jul 10, 2026

CVE-2026-52762 is a stored server-side template injection vulnerability in YesWiki Bazar semantic templates affecting versions prior to 4.6.6. An authenticated administrator can place malicious Twig template expressions into Bazar semantic template fields. When those stored templates are later processed by public semantic endpoints, the attacker-controlled Twig code is rendered on the server, resulting in server-side execution of unintended template logic. Validated exploitation demonstrated escalation from template execution to operating-system command execution and full compromise of the underlying server.

CVE-2026-52762First seen Jun 14, 2026

CVE-2026-49463 is an improper authorization flaw in NL Portal Backend Libraries affecting document access controls in the documenten-api and related GraphQL resolvers. According to the provided advisories, authenticated users could access document content and, in related GraphQL functionality, enumerate and read other users' decision records, audit trails, and attached documents because per-document or per-user authorization checks were missing or incomplete. One advisory states that an incomplete fix left a REST endpoint and GraphQL query able to return document contents without verifying that the caller was authorized for the specific document. Another states that the GraphQL implementation failed to bind authenticated user context correctly in the resolver, allowing cross-user access to protected data.

CVE-2026-49463First seen Jun 19, 2026

CVE-2026-54700 affects org.connectbot.sshlib:sshlib. According to the provided advisory, the library contains an input validation flaw in SSH protocol parsing in which attacker-controlled inner length fields and repeated-element count fields are not properly bounded against the containing stream. A malicious or compromised SSH server can supply malformed SSH packets whose declared internal sizes cause the client to attempt excessive heap allocation during parsing. The issue is described as affecting length-prefixed fields as well as repeated-element counts, with additional fixes covering transport and agent frame length validation and SSH padding constraints. The vulnerability is therefore an improper input validation issue in packet parsing that can be triggered by malicious protocol data from the remote endpoint.

CVE-2026-54700First seen Jul 9, 2026

CVE-2026-54697 affects org.connectbot.sshlib:sshlib through version 0.3.0. The vulnerability is in DER private-key parsing logic used by key-handling APIs including SshClient.authenticatePublicKey(), SshKeys.decodePemPrivateKey(), SshSigning.sign(), and SshSigning.getPublicKey(). A malformed private key can supply invalid DER length fields that trigger integer wraparound during length accumulation or conversion, leading to incorrect size calculations, excessive memory allocation attempts, parsing failures, or an uncaught OutOfMemoryError. The issue is described as stemming from insufficient DER length validation and unsafe integer handling during parsing.

CVE-2026-54697First seen Jul 9, 2026

async-tar contains a flaw in handling tar PAX and related extension headers that can desynchronize parser state during archive parsing and extraction. Specifically, buffered PAX metadata records can be incorrectly applied when the current raw header is itself another extension header, including GNU longname/longlink or PAX local/global headers (L/K/x/g), rather than being reserved only for the subsequent file entry. This causes async-tar to interpret archive structure differently from POSIX-correct parsers such as GNU tar, enabling crafted tar streams to smuggle entries or content past validation and into extraction workflows.

CVE-2026-53600First seen Jul 9, 2026

CVE-2026-49464 is an insecure direct object reference (IDOR) vulnerability in the NL Portal taak component. According to the provided advisory, the flaw allows any authenticated user to complete and tamper with another user's task and to view previously entered form data. The issue affects task submission handling in the submitTaakV2 GraphQL mutation, where authorization was not properly enforced before processing task submission requests. As a result, an authenticated user could reference another user's task object and interact with it without sufficient access control validation.

CVE-2026-49464First seen Jul 9, 2026

CVE-2026-54334 is a heap out-of-bounds write in the native Tiano/EFI decompressor implementation used by the uefi-firmware parser. According to the provided advisory, the flaw is located in the ReadCLen function. A crafted firmware or compressed input processed by the parser can cause the decompressor to write beyond the bounds of a heap-allocated buffer, resulting in memory corruption during parsing.

CVE-2026-54334First seen Jul 9, 2026

DSpace's ORE Ingestion Crosswalk fails to validate URI schemes for non-web resources when ingesting aggregated ORE resources by URI. A malicious or compromised remote OAI endpoint can supply crafted ORE XML that references local resources using schemes such as file://. During ingestion, DSpace may retrieve and ingest those local files from the server filesystem as bitstreams. This results in a local file inclusion condition leading to disclosure of server-local files and data.

CVE-2026-49830First seen Jul 9, 2026

CVE-2026-49456 is an open redirect vulnerability in the npm package Waku affecting the unstable_redirect helper. Based on the provided advisory, the vulnerable behavior is that unvalidated, user-controlled input can be reflected directly into the HTTP Location header. This allows attacker-supplied redirect targets to be returned to the client without sufficient validation or restriction to local application paths. The advisory also notes a defense-in-depth concern regarding control-character and CRLF handling across non-Node runtimes, which suggests redirect input should also be sanitized to prevent malformed header behavior in alternate runtime environments.

CVE-2026-49456First seen Jul 9, 2026