Vulnerability feed

CVE and vendor PSIRT advisories from 13 sources, last 30 days. Updated hourly, last run Oct 26 01:05 UTC

Critical in the last 24 hours

1603 in 30 days

Newly known exploited

In the last 24 hours, CISA KEV and vendor reports

Sources checked

Every hour, see the list

New in the last 24 hours

133-78% vs 7-day avg of 597

2 critical, 34 high, 58 medium, 19 low

17337 advisories Export 25 shown as CSV

Expand	Severity	Score	Advisory	Title	Source	Published
	Low	1.9	CVE-2026-116096	A weakness has been identified in ggml-org llama.cpp ggml-orgggml-org llama.cpp	NVD	Oct 25 23:17 UTC
CVE-2026-116096A weakness has been identified in ggml-org llama.cpp Executive summary The advisory describes a weakness in ggml-org llama.cpp, a C/C++ library for running large language models. The text provided is mostly repository content and does not describe the weakness, its severity, or a vendor fix, so these points are not stated. Technical summary The advisory does not state the vulnerability class, attack vector, or preconditions. It does not list affected or fixed versions, workarounds, CVSS score, or exploitation status. The only identifiable reference is to the llama.cpp master branch repository page, which is not a version statement. Defenders should consult the NVD entry at the provided URL or the upstream project's security policy for the specific details. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from https://github.com/ggml-org/llama.cpp/ Impact if exploited ConfidentialityLow IntegrityLow AvailabilityLow How it is exploited Attack vector Local Attack complexity Low Attack requirements None Privileges required Low User interaction None CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects ggml-org ggml-org llama.cpp NIST National Vulnerability DatabasePublished Oct 25, 2026 23:17 UTC Read the advisory
	Medium	5.5	CVE-2026-116095	A vulnerability was identified in smg-project smg 1.7.0/1.8.0/1.9.0/1.10.0/1.10.1 smg-projectsmg-project smg	NVD	Oct 25 23:17 UTC
CVE-2026-116095A vulnerability was identified in smg-project smg 1.7.0/1.8.0/1.9.0/1.10.0/1.10.1 Executive summary The advisory describes a flaw in smg-project smg versions 1.7.0 through 1.10.1 that appears to involve a crafted JPEG image causing excessive memory allocation. The advisory text is mostly a copied GitHub gist page and does not state a severity rating or a fixed version. No vendor recommendation is stated in the text provided. Technical summary The advisory text is a copied gist page containing a proof-of-concept Python script that writes JPEG files declaring dimensions of 65500x65500 and 20000x20000, which the script says would require a large byte allocation in a decoder, and PNG control files. The vulnerability class is not explicitly stated, though the script comments suggest resource exhaustion through image dimension handling. The attack vector and preconditions are implied to be supplying a crafted image to the affected software, but this is not explicitly stated. Affected versions are listed as 1.7.0/1.8.0/1.9.0/1.10.0/1.10.1, and fixed versions, workarounds, CVSS score, and detection guidance are not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from https://gist.github.com/Yunzez/24a1bf4c226fbc324ea8da1d202c6d9b Impact if exploited ConfidentialityNone IntegrityNone AvailabilityLow How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required None User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects smg-project smg-project smg NIST National Vulnerability DatabasePublished Oct 25, 2026 23:17 UTC Read the advisory
	Medium	5.5	CVE-2026-116094	A vulnerability was determined in EyouCMS up to 1.8.3 EyouCMSEyouCMS	NVD	Oct 25 22:16 UTC
CVE-2026-116094A vulnerability was determined in EyouCMS up to 1.8.3 Executive summary A vulnerability was reported in EyouCMS up to version 1.8.3, a content management system. The advisory describes a server-side request forgery flaw that can be triggered from the public site, but it does not state a severity rating. Technical summary The advisory describes server-side request forgery caused by a missing SSRF check in the remote_file_to_local() function, which can be reached from the front end. It states the affected range as up to 1.8.3, but no fixed version is stated. Attack preconditions, CVSS score, and exploitation in the wild are not stated. No workaround is stated. No detection guidance is stated; the text mainly consists of repository file listings and references to a reproduction document and vulnerability report that are not included here. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from https://github.com/yy-t1/security-reports/tree/main/web/EyouCMS1.8.2/remote_file_to_local()%E7%BC%BA%E5%A4%B1%20SSRF%20%E6%A0%A1%E9%AA%8C%E5%AF%BC%E8%87%B4%E5%89%8D%E5%8F%B0%20SSRF Impact if exploited ConfidentialityLow IntegrityLow AvailabilityLow How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required None User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects EyouCMS EyouCMS NIST National Vulnerability DatabasePublished Oct 25, 2026 22:16 UTC Read the advisory
	Medium	6.0	CVE-2026-115635	Incorrect Authorization vulnerability in ash-project ash_postgres allows a user to read another tenant's record through a skipped upsert. When Ash.bulk_create/4 or a single... ash-projectash-project ash_postgres	NVD	Oct 25 20:16 UTC
CVE-2026-115635Incorrect Authorization vulnerability in ash-project ash_postgres allows a user to read another tenant's record through a skipped upsert. When Ash.bulk_create/4 or a single... Executive summary A flaw in AshPostgres, a database library used with the Ash framework, can let one tenant read another tenant's record in a multi-tenant application. The advisory rates it MEDIUM with a CVSS 4.0 base score of 6.0. The advisory points to a fix in version 2.15.2 and the fix commit 8aa8122, and it does not state any workaround. Technical summary This is an Incorrect Authorization flaw (CWE-863) in the ash_postgres data layer. When an upsert is skipped during Ash.bulk_create/4 or a single create with return_skipped_upsert?: true, the lookup of the existing row did not apply attribute multitenancy, so a user could receive another tenant's record that shares the same identity values. The advisory says the affected range is from 2.6.22 before 2.15.2 on Hex, and from commit af0903f up to commit 8aa8122 on GitHub. The CVSS vector is CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N, which requires low privileges and a resource that uses attribute multitenancy with return_skipped_upsert?: true. The advisory does not state any workaround or in-the-wild exploitation, and it gives no specific detection guidance beyond the affected routines. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from https://cna.erlef.org/cves/CVE-2026-115635.html Impact if exploited ConfidentialityHigh IntegrityNone AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Attack requirements Present Privileges required Low User interaction None CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects ash-project ash-project ash_postgres NIST National Vulnerability DatabasePublished Oct 25, 2026 20:16 UTC Read the advisory
	Medium	6.0	CVE-2026-115627	Incorrect Authorization vulnerability in ash-project ash_postgres allows a user to load destination records linked to a source record only through another tenant's join... ash-projectash-project ash_postgres	NVD	Oct 25 20:16 UTC
CVE-2026-115627Incorrect Authorization vulnerability in ash-project ash_postgres allows a user to load destination records linked to a source record only through another tenant's join... Executive summary A flaw in the ash_postgres library, used with the Elixir Ash framework, lets a user in one tenant see records that belong to other tenants' data when certain relationships are loaded. The advisory rates it MEDIUM with a CVSS 4.0 score of 6.0. The advisory states the affected range is from 0.38.0 before 2.15.2 on Hex, and the fix is in commit 8c25c94 on GitHub; it does not explicitly state an upgrade recommendation beyond that fix. Technical summary This is an Incorrect Authorization flaw (CWE-863) where AshPostgres builds lateral join queries for many_to_many and through relationships without running the resource's read action, so attribute multitenancy is not applied to the join resource. The attack requires an authenticated user with low privileges (PR:L) and network access, and the preconditions are that the join resource uses :attribute multitenancy with rows from several tenants and that the relationship is loaded with a lateral join, such as with a limit, offset or sort. The advisory states the affected Hex versions as 0.38.0 up to but not including 2.15.2, and the GitHub affected range as commit 7115bec up to but not including 8c25c94. A workaround is not stated in the advisory. Detection guidance is not stated beyond the affected function names lateral_join_query/3, through_step_queries/4 and run_query_with_lateral_join/4 in lib/data_layer.ex. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from https://cna.erlef.org/cves/CVE-2026-115627.html Impact if exploited ConfidentialityHigh IntegrityNone AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Attack requirements Present Privileges required Low User interaction None CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects ash-project ash-project ash_postgres NIST National Vulnerability DatabasePublished Oct 25, 2026 20:16 UTC Read the advisory
	Medium	6.0	CVE-2026-114214	Incorrect Authorization vulnerability in ash-project ash allows a client to read destination records unrelated to the source record through a through relationship. When a... ash-projectash-project ash	NVD	Oct 25 20:16 UTC
CVE-2026-114214Incorrect Authorization vulnerability in ash-project ash allows a client to read destination records unrelated to the source record through a through relationship. When a... Executive summary A flaw in the Ash framework, an Elixir library from ash-project, lets a client read destination records that should only be reachable through a specific relationship. The advisory rates it MEDIUM with a CVSS 4.0 score of 6.0. The vendor's fix is in version 3.37.1, and the advisory says affected versions are 3.24.0 before 3.37.1. Technical summary This is an Incorrect Authorization flaw (CWE-863) in the Ash read relationships code, specifically lateral_join?/4 in lib/ash/actions/read/relationships.ex. When a has_many through relationship is loaded for a single record with a limit of 1, or an unsorted has_one through relationship is loaded with a limit of 1, the query omits the filter linking destination records to the source, so the load returns unrelated records; paging with an offset can enumerate more of them. The attack vector is network with low complexity, and the CVSS vector requires low privileges and no user interaction, with high confidentiality impact. The advisory states the affected range as 3.24.0 up to but not including 3.37.1, with fix commit e374633, and says the vulnerable Git range is 24f41e2 to e374633. The advisory does not state a workaround or any detection guidance, and does not state whether the flaw has been exploited in the wild. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from https://cna.erlef.org/cves/CVE-2026-114214.html Impact if exploited ConfidentialityHigh IntegrityNone AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Attack requirements Present Privileges required Low User interaction None CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects ash-project ash-project ash NIST National Vulnerability DatabasePublished Oct 25, 2026 20:16 UTC Read the advisory
	Low	2.0	CVE-2026-116063	A weakness has been identified in DedeCMS up to 5.7.118 DedeCMSDedeCMS	NVD	Oct 25 18:16 UTC
CVE-2026-116063A weakness has been identified in DedeCMS up to 5.7.118 Executive summary A remote code execution weakness has been reported in DedeCMS up to version 5.7.118, a content management system. The advisory rates it 7.2 under CVSS v3.1 base and 8.8 for the other listed score, and it lists a code injection flaw in the update guide script. Technical summary The advisory describes a code injection flaw in dede/update_guide.php that can lead to remote code execution, mapped to CWE-94, CWE-96, and CWE-352. The table lists CVSS v3.1 scores of 7.2 / 8.8 without stating which score is the base score, and it does not state the attack vector, required privileges, or user interaction in plain terms. The advisory does not state a fixed version, a workaround, or any detection guidance. It also does not state whether exploitation has been observed in the wild. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from https://github.com/SDshadow/cve Impact if exploited ConfidentialityLow IntegrityLow AvailabilityLow How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required High User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects DedeCMS DedeCMS NIST National Vulnerability DatabasePublished Oct 25, 2026 18:16 UTC Read the advisory
	Medium	5.5	CVE-2026-116062	A security flaw has been discovered in SourceCodester Performance Indicator System 1.0 SourceCodesterSourceCodester Performance Indicator System	NVD	Oct 25 18:16 UTC
CVE-2026-116062A security flaw has been discovered in SourceCodester Performance Indicator System 1.0 Executive summary A SQL injection flaw has been reported in the Performance Indicator System 1.0 from SourceCodester, a PHP and MySQLi web application. The advisory says an attacker can exploit it without logging in to read, change, or delete database data. The advisory does not state a severity rating, a fixed version, or a vendor patch. Technical summary The flaw is SQL injection in the 'contact' parameter of /opils/staff/save_profile.php, where user input is placed directly into SQL queries without validation. The advisory describes it as time-based blind and says no login or authorization is required. The affected version is listed as V1.0, and no fixed version is stated. No workaround is stated beyond the suggested repair of using prepared statements with parameter binding, strict input validation, least-privilege database accounts, and regular audits. The advisory gives no detection guidance, no CVSS score, and does not say whether exploitation in the wild has been observed. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from https://github.com/hubdk01/cve/issues/13 Impact if exploited ConfidentialityLow IntegrityLow AvailabilityLow How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required None User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects SourceCodester SourceCodester Performance Indicator System NIST National Vulnerability DatabasePublished Oct 25, 2026 18:16 UTC Read the advisory
	Medium	5.5	CVE-2026-116061	A vulnerability was identified in SourceCodester Performance Indicator System 1.0 SourceCodesterSourceCodester Performance Indicator System	NVD	Oct 25 18:16 UTC
CVE-2026-116061A vulnerability was identified in SourceCodester Performance Indicator System 1.0 Executive summary A SQL injection flaw has been reported in the Performance Indicator System 1.0 from SourceCodester, a PHP and MySQLi application. The advisory says an attacker needs no login to exploit it, which could expose or change database contents. The advisory does not state a vendor fix or official severity score, and it recommends using prepared statements, input validation, least-privilege database accounts, and regular security audits. Technical summary The flaw is SQL injection in the 'contact' parameter of /opils/staff/edit_dealer.php, which the advisory says is passed directly into SQL queries without validation. The advisory describes it as time-based blind injection, reproduced with sqlmap, and says no login or authorization is required. The affected version is listed as V1.0; a fixed version is not stated. No workaround beyond the suggested code fixes (prepared statements, input validation, minimal database permissions) is given, and no CVSS score or detection guidance is stated. Exploitation in the wild is not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from https://github.com/hubdk01/cve/issues/12 Impact if exploited ConfidentialityLow IntegrityLow AvailabilityLow How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required None User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects SourceCodester SourceCodester Performance Indicator System NIST National Vulnerability DatabasePublished Oct 25, 2026 18:16 UTC Read the advisory
	Medium	5.5	CVE-2026-116060	A vulnerability was determined in SourceCodester Performance Indicator System 1.0 SourceCodesterSourceCodester Performance Indicator System	NVD	Oct 25 17:17 UTC
CVE-2026-116060A vulnerability was determined in SourceCodester Performance Indicator System 1.0 Executive summary A SQL injection flaw has been reported in the Performance Indicator System 1.0 from SourceCodester, a PHP and MySQLi application. The advisory says an attacker who needs no login could read, change, or delete database data and potentially disrupt the service. The advisory does not state a severity score or a vendor fix, and it recommends prepared statements, input validation, and least-privilege database accounts. Technical summary The flaw is a SQL injection in the 'contact' parameter of /opils/staff/adddealer.php, reached through a multipart/form-data POST request. The advisory states no login or authorization is required, and it describes a time-based blind variant that was confirmed with sqlmap. The affected version is listed as V1.0, and no fixed version is stated. No vendor patch, workaround beyond the suggested code fixes, CVSS score, or exploitation in the wild is stated. The suggested repair is to use prepared statements with parameter binding, validate and filter input, restrict database account privileges, and run regular security audits. The advisory gives no specific detection guidance such as log signatures. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from https://github.com/hubdk01/cve/issues/11 Impact if exploited ConfidentialityLow IntegrityLow AvailabilityLow How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required None User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects SourceCodester SourceCodester Performance Indicator System NIST National Vulnerability DatabasePublished Oct 25, 2026 17:17 UTC Read the advisory
	Unknown	n/a	CVE-2026-115825	HTTP::Server::PSGI versions before 1.0056 for Perl allow a single request to crash the server by declaring a large Content-Length. The request body is read with sysread()... HTTP::Server::PSGIHTTP::Server::PSGI	NVD	Oct 25 17:17 UTC
CVE-2026-115825HTTP::Server::PSGI versions before 1.0056 for Perl allow a single request to crash the server by declaring a large Content-Length. The request body is read with sysread()... Executive summary HTTP::Server::PSGI for Perl, in versions before 1.0056, can be crashed by a single request that declares a very large Content-Length. The advisory describes this as a denial of service that makes the server run out of memory, and it says a fix caps body reads at 64 KiB. The advisory does not state a CVSS score or an explicit vendor recommendation beyond the fix in the patch. Technical summary The flaw is a resource exhaustion (denial of service) issue in HTTP::Server::PSGI, where the whole remaining Content-Length is passed to sysread and Perl grows the buffer to that size before reading, causing an "Out of memory!" failure on Linux. The attack needs only a single crafted HTTP request declaring a large Content-Length; no authentication is mentioned in the advisory. Affected versions are stated as before 1.0056, and the fixed version is stated as 1.0056 by the vendor's description of the affected range. The fix reads the body in chunks of at most 64 KiB, and the added test checks that a huge Content-Length does not produce a sysread larger than MAX_REQUEST_SIZE. No workarounds, CVSS score, exploitation status, or detection guidance is stated in the advisory. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from https://github.com/plack/Plack/commit/11545871cadc5df1b744cebb429cfeb4ebc1069a.patch Score No CVSS score published. Affects HTTP::Server::PSGI HTTP::Server::PSGI NIST National Vulnerability DatabasePublished Oct 25, 2026 17:17 UTC Read the advisory
	Unknown	n/a	CVE-2026-115824	Starman versions before 0.4019 for Perl allow memory exhaustion via unbounded buffering of chunked request bodies. The chunked body decoder keeps each chunk in memory until... StarmanStarman	NVD	Oct 25 17:17 UTC
CVE-2026-115824Starman versions before 0.4019 for Perl allow memory exhaustion via unbounded buffering of chunked request bodies. The chunked body decoder keeps each chunk in memory until... Executive summary Starman, a Perl web server, has a flaw that lets an attacker exhaust server memory by sending chunked request bodies that the server keeps buffering without limit. The advisory does not state a severity rating or CVSS score. The fix is included in version 0.4019, and the advisory indicates the patch is available in the repository. Technical summary The advisory describes unbounded buffering of chunked request bodies in the chunk decoder, which can cause memory exhaustion, and the commit message also describes a quadratic-backtracking regex in chunk-size line parsing (CVE-2026-115822) that consumes CPU. The attack requires sending crafted chunked HTTP requests to a Starman server; the advisory does not state authentication or other preconditions. Affected versions are stated as those before 0.4019, and the fixed version is 0.4019. The fix replaces the regex with index() and an anchored parser, limits chunk-size lines to 4096 bytes, rejects sizes over 13 hex digits with 400 and closes the connection, and makes _prepare_env return an error status so bad bodies are not dispatched. No workarounds are stated, and no detection guidance or exploitation status is stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from https://github.com/miyagawa/Starman/commit/0f33f9b132b5e410d6cce722ff71988e22476acf.patch Score No CVSS score published. Affects Starman Starman NIST National Vulnerability DatabasePublished Oct 25, 2026 17:17 UTC Read the advisory
	Unknown	n/a	CVE-2026-115823	Starman versions before 0.4019 for Perl send response bodies for HEAD requests, desynchronizing responses on keep-alive connections. For a HEAD request Starman omits chunked... StarmanStarman	NVD	Oct 25 17:17 UTC
CVE-2026-115823Starman versions before 0.4019 for Perl send response bodies for HEAD requests, desynchronizing responses on keep-alive connections. For a HEAD request Starman omits chunked... Executive summary Starman, a Perl web server, sends response bodies for HEAD requests and for 1xx, 204 and 304 responses, which can cause response desynchronization on keep-alive connections. The advisory does not state a severity rating or an exploitation status, and the fix is in Starman versions 0.4019 and later. Technical summary The flaw is a response desynchronization issue (HTTP response smuggling class) in Starman before 0.4019 for Perl, where bodies are written for HEAD, 1xx, 204 and 304 responses even though those responses must not carry a body. On keep-alive or pipelined connections, the extra bytes are read as the start of the next response, and a front end that pools upstream connections can be affected. The advisory does not state a CVSS score, attack preconditions beyond keep-alive or pipelined connections, or a workaround. The fix is in commit 91c47c529cd1e100f938486896ea9083ec3ec7bf, which skips body output for these responses and closes object bodies without reading them, and it adds a test file t/no_body_response.t. Detection guidance is not stated, and the advisory names no specific fixed release beyond the version threshold of 0.4019. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from https://github.com/miyagawa/Starman/commit/91c47c529cd1e100f938486896ea9083ec3ec7bf.patch Score No CVSS score published. Affects Starman Starman NIST National Vulnerability DatabasePublished Oct 25, 2026 17:17 UTC Read the advisory
	Unknown	n/a	CVE-2026-115822	Starman versions before 0.4019 for Perl allow CPU exhaustion via quadratic regex backtracking when parsing chunked request bodies. Starman decodes chunked request bodies... StarmanStarman	NVD	Oct 25 17:17 UTC
CVE-2026-115822Starman versions before 0.4019 for Perl allow CPU exhaustion via quadratic regex backtracking when parsing chunked request bodies. Starman decodes chunked request bodies... Executive summary The advisory says Starman, a Perl web server, is affected by a flaw that lets a remote sender exhaust CPU on the server by sending chunked request bodies with long runs of hex digits. The advisory does not give a severity rating or CVSS score. The vendor-side fix is a code change that rejects malformed or overly long chunk-size lines with a 400 error, and the advisory says versions before 0.4019 are affected. Technical summary The flaw is a regular expression backtracking problem (quadratic complexity, a form of algorithmic CPU exhaustion) in parsing the chunk-size line of chunked request bodies, which the commit message says ran again over the whole buffer after every read. The attacker needs only to send an HTTP request with Transfer-Encoding: chunked; the advisory says 32 KiB of input cost about 1.7 seconds of worker CPU. The fix bounds chunk-size lines to 4096 bytes, parses them with an anchored linear-time pattern, rejects sizes with more than 13 significant hex digits, and returns 400 and closes the connection on malformed input. The advisory states affected versions as before 0.4019, but it does not state a fixed version number explicitly, and no workaround is stated. No detection guidance or evidence of exploitation in the wild is stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from https://github.com/miyagawa/Starman/commit/0f33f9b132b5e410d6cce722ff71988e22476acf.patch Score No CVSS score published. Affects Starman Starman NIST National Vulnerability DatabasePublished Oct 25, 2026 17:17 UTC Read the advisory
	Unknown	n/a	CVE-2026-115817	Starman versions before 0.4019 for Perl allow a stalled request body to hold a worker indefinitely, as read_timeout covers only the headers. Content-Length and chunked request... StarmanStarman	NVD	Oct 25 17:17 UTC
CVE-2026-115817Starman versions before 0.4019 for Perl allow a stalled request body to hold a worker indefinitely, as read_timeout covers only the headers. Content-Length and chunked request... Executive summary Starman, a Perl web server, has a flaw where a client that sends a request body and then stalls can keep a server worker busy indefinitely, which can exhaust workers with only a few connections. The advisory describes the severity only in terms of workers being taken; a CVSS score is not stated. The fix adds a total time limit for reading request bodies, and the advisory's guidance is to update Starman to a release at or after 0.4019 (the fixed version is stated as 0.4019 in the advisory's wording of affected versions before 0.4019). Technical summary The weakness is a resource exhaustion issue (missing timeout on request body reads): read_timeout applied only to request headers, so a Content-Length or chunked body could stall or trickle indefinitely. The attack requires only network access to the Starman listener and a few open connections to tie up workers, and no authentication is mentioned. Affected versions are stated as before 0.4019 and the fix adds a --body-timeout option (body_timeout, default 300 seconds, 0 disables) that responds with 408 Request Timeout and closes the connection. The advisory does not state a CVSS score, a CWE, exploitation in the wild, or detection guidance beyond the timeout behavior, and it recommends a reverse proxy that buffers request bodies as a mitigation. Workaround details beyond setting body_timeout are not otherwise stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from https://github.com/miyagawa/Starman/commit/89dffd3bdc9baa1cbe1b48a43615586ba2588558.patch Score No CVSS score published. Affects Starman Starman NIST National Vulnerability DatabasePublished Oct 25, 2026 17:17 UTC Read the advisory
	Medium	5.3	CVE-2026-116058	A vulnerability was found in Alfresco Activiti up to 7.21.0-rc.692 AlfrescoAlfresco Activiti	NVD	Oct 25 16:16 UTC
CVE-2026-116058A vulnerability was found in Alfresco Activiti up to 7.21.0-rc.692 Executive summary A vulnerability has been reported in Alfresco Activiti, a workflow product, affecting versions up to 7.21.0-rc.692. The advisory says it can be exploited remotely to inject code, and the vendor did not respond when contacted about it. The advisory does not state a severity score or a fix. Technical summary The flaw is described as code injection in the JuelScriptEngine.eval function of JuelScriptEngine.java, which is reached by performing a manipulation that the advisory does not specify. The attack can be initiated remotely. The advisory does not state any required privileges or user interaction, and it does not state a CVSS score. The advisory affects versions up to and including 7.21.0-rc.692, and no fixed version is stated. No workaround or detection guidance is stated. The vendor was contacted early but did not respond. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Impact if exploited ConfidentialityLow IntegrityLow AvailabilityLow How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required Low User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects Alfresco Alfresco Activiti NIST National Vulnerability DatabasePublished Oct 25, 2026 16:16 UTC Read the advisory
	Low	2.1	CVE-2026-116057	A vulnerability has been found in KodCloud KodExplorer up to 4.55 KodCloudKodCloud KodExplorer	NVD	Oct 25 16:16 UTC
CVE-2026-116057A vulnerability has been found in KodCloud KodExplorer up to 4.55 Executive summary KodCloud KodExplorer, a web-based file manager, is affected by a vulnerability in versions up to 4.55. The advisory says the flaw can be exploited remotely and that exploit details are public, but it does not state a severity score. The advisory does not state any vendor-recommended fix, and the vendor did not respond to early disclosure. Technical summary The flaw is an unrestricted upload issue in the Online Editor Save Endpoint, located in app/controller/editor.class.php, where manipulation of the path/filestr argument is reported. It can be attacked remotely, and the advisory says an exploit has been publicly disclosed and may be used. Affected versions are stated only as up to 4.55, and no fixed version is stated. No workaround, detection guidance, CVSS score, or authentication requirement is stated in the advisory. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Impact if exploited ConfidentialityLow IntegrityLow AvailabilityLow How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required Low User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects KodCloud KodCloud KodExplorer NIST National Vulnerability DatabasePublished Oct 25, 2026 16:16 UTC Read the advisory
	Medium	5.3	CVE-2026-116056	A flaw has been found in KodCloud KodExplorer up to 4.56 KodCloudKodCloud KodExplorer	NVD	Oct 25 16:16 UTC
CVE-2026-116056A flaw has been found in KodCloud KodExplorer up to 4.56 Executive summary A flaw has been found in KodCloud KodExplorer, a file management product, up to version 4.56. The advisory describes it as a server-side request forgery issue that can be triggered remotely. The vendor did not respond when contacted about the disclosure, and no fix or vendor recommendation is stated. Technical summary The flaw is server-side request forgery in the request_url_safe function of app/function/web.function.php, within the Remote Download component. An attacker can trigger it remotely by manipulating input to that function. The advisory states affected versions as up to 4.56 but does not state any fixed version. No workaround, exploitation status, CVSS score, or detection guidance is stated. The vendor was contacted early but did not respond. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Impact if exploited ConfidentialityLow IntegrityLow AvailabilityLow How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required Low User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects KodCloud KodCloud KodExplorer NIST National Vulnerability DatabasePublished Oct 25, 2026 16:16 UTC Read the advisory
	Low	2.1	CVE-2026-116055	A vulnerability was detected in SourceCodester Performance Indicator System 1.0 SourceCodesterSourceCodester Performance Indicator System	NVD	Oct 25 15:17 UTC
CVE-2026-116055A vulnerability was detected in SourceCodester Performance Indicator System 1.0 Executive summary A SQL injection flaw was reported in the Performance Indicator System 1.0 from SourceCodester, a PHP and MySQLi web application. The advisory says an attacker needs no login to exploit it, which could expose or change database contents and disrupt the service. The advisory does not state a fixed version or a vendor patch, and it recommends code fixes such as prepared statements and input validation. Technical summary The flaw is SQL injection in the 'id' parameter of /opils/admin/deleteproduct.php, where user input is placed directly into SQL queries without validation. The advisory states that no login or authorization is required, and it provides a POST request example. Boolean-based blind and time-based blind techniques were demonstrated with sqlmap. The affected version is listed as V1.0, and no fixed version is stated. No vendor workaround is stated beyond the suggested remediation of parameterized queries, input filtering, least-privilege database accounts, and security audits. No detection guidance or CVSS score is stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from https://github.com/hubdk01/cve/issues/5 Impact if exploited ConfidentialityLow IntegrityLow AvailabilityLow How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required Low User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects SourceCodester SourceCodester Performance Indicator System NIST National Vulnerability DatabasePublished Oct 25, 2026 15:17 UTC Read the advisory
	Low	1.2	CVE-2026-116054	A security vulnerability has been detected in SH3 SH3SH3 Módulo de Gestão/Módulo de Arrecadação	NVD	Oct 25 15:17 UTC
CVE-2026-116054A security vulnerability has been detected in SH3 Executive summary A weakness has been reported in SH3, a product whose Gestão and Arrecadação management modules are affected. The advisory says the flaw is hard to exploit remotely, but a public exploit has been disclosed and may be used. The vendor's recommendation is to upgrade the affected component to version 2026.0.2.0. Technical summary The flaw is classified as a password hash computed with insufficient computational effort, which weakens protection of stored credentials if an attacker obtains the hashes. The attack can be carried out remotely, but the advisory says it is highly complex and rated difficult to exploit. A public exploit has been disclosed. The advisory states that upgrading to version 2026.0.2.0 mitigates the issue; it does not state the vulnerable version range. No workaround, CVSS score, or detection guidance is stated in the advisory. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Impact if exploited ConfidentialityLow IntegrityNone AvailabilityNone How it is exploited Attack vector Network Attack complexity High Attack requirements None Privileges required High User interaction None CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects SH3 SH3 Módulo de Gestão/Módulo de Arrecadação NIST National Vulnerability DatabasePublished Oct 25, 2026 15:17 UTC Read the advisory
	High	8.8	CVE-2026-116211	YesWiki 4.5.0 before 4.7.0 contains an SQL injection vulnerability in PageManager::save(), where the date_maj_fiche field of a Bazar entry-creation request is concatenated... YesWikiyeswiki	NVD	Oct 25 14:17 UTC
CVE-2026-116211YesWiki 4.5.0 before 4.7.0 contains an SQL injection vulnerability in PageManager::save(), where the date_maj_fiche field of a Bazar entry-creation request is concatenated... Executive summary YesWiki versions from 4.5.0 before 4.7.0 contain an SQL injection flaw in the Bazar entry creation feature, where a date field from the request is inserted into a database query without escaping. The advisory rates it High with a CVSS score of 8.2 and says the fix is in version 4.7.0, so users should upgrade to 4.7.0 or later. Technical summary The flaw is CWE-89 SQL injection in PageManager::save(), where the date_maj_fiche POST field is concatenated raw into an INSERT SET statement via the forcedDate parameter instead of being escaped like the other columns. The advisory describes a network attack with low complexity and no privileges required on the authenticated path, and says an unauthenticated path via action=saisir_fiche works on a default install, with confidentiality impact rated High. Affected versions are stated as >= 4.5.0, < 4.7.0 in the package data and <= 4.6.7 in the description, and the patched version is 4.7.0. The advisory suggests escaping $forcedDate at the sink or validating date_maj_fiche as a strict datetime, but does not state any other workaround. Detection guidance is not stated, and whether the flaw is exploited in the wild is not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from https://github.com/YesWiki/yeswiki/security/advisories/GHSA-wjf7-hrf3-9gcx Impact if exploited ConfidentialityHigh IntegrityLow AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required None User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects YesWiki yeswiki NIST National Vulnerability DatabasePublished Oct 25, 2026 14:17 UTC Read the advisory
	High	7.2	CVE-2026-116208	YesWiki from 4.6.2 before 4.7.0 contains a missing authorization vulnerability in ActivityPubService::syncActorPosts that lets malicious ActivityPub servers manipulate other... YesWikiyeswiki	NVD	Oct 25 14:17 UTC
CVE-2026-116208YesWiki from 4.6.2 before 4.7.0 contains a missing authorization vulnerability in ActivityPubService::syncActorPosts that lets malicious ActivityPub servers manipulate other... Executive summary YesWiki, a wiki package used with ActivityPub federation, has a missing authorization flaw in its sync feature. A malicious federated server can cause a YesWiki administrator's routine sync to delete, overwrite, or create entries that belong to other federated actors. The advisory rates it High (8.1 CVSS) and states the fix status is not fixed, with the affected range given as versions 4.6.2 through 4.6.7; the advisory does not state a patched version for the sync path. Technical summary The flaw is CWE-862 (missing authorization) in ActivityPubService::syncActorPosts, which processes Delete, Update, and Create activities from a remote outbox without the assertOwns() and sameHost() checks used by the inbox handler, and runs a host-scoped garbage-collection delete. Exploitation requires an administrator to trigger the sync action (a GET request with no CSRF token), and the attacker needs no privileges on the wiki; the CVSS vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H. The advisory lists the affected range as >= 4.6.2 and <= 4.6.7 in the body, while the metadata says '< 4.7.0' and the patched version is listed as 4.7.0, but it also says the fix status is 'not fixed' for the sync path. Workarounds are stated as avoiding sync with untrusted actors and adding a CSRF token to the sync action, which the advisory suggests but does not confirm as implemented. No detection guidance is stated, and no exploitation in the wild is stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from https://github.com/YesWiki/yeswiki/security/advisories/GHSA-cr64-h6xp-9g2j Impact if exploited ConfidentialityNone IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required None User interaction Passive CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects YesWiki yeswiki NIST National Vulnerability DatabasePublished Oct 25, 2026 14:17 UTC Read the advisory
	High	8.8	CVE-2026-116207	YesWiki 4.6.0 before 4.7.0 and 5.0.0-alpha1 before 5.0.0-alpha4 contains an unauthenticated SQL injection vulnerability in SearchManager::prepareSearchRequest() YesWikiyeswiki	NVD	Oct 25 14:17 UTC
CVE-2026-116207YesWiki 4.6.0 before 4.7.0 and 5.0.0-alpha1 before 5.0.0-alpha4 contains an unauthenticated SQL injection vulnerability in SearchManager::prepareSearchRequest() Executive summary YesWiki, a wiki platform, has a critical flaw that lets anyone on the network read data from its database, including user credentials, without logging in. It can also be used to make the site unavailable by overloading the database. The advisory recommends updating to 4.7.0 or 5.0.0-alpha4, and restricting network access to the public Bazar entries API until then. Technical summary The flaw is an unauthenticated SQL injection (CWE-89) in the Bazar entries search API, reachable through GET /api/forms/{formId}/entries and /api/entries/bazarlist. A backtick in the query or searchfields field name breaks out of a backtick-quoted SQL alias, because the code uses mysqli_real_escape_string, which does not escape backticks. Injected SELECT subqueries can read any table the database user can access, and results are returned in the JSON response, while SLEEP-based subqueries can exhaust database connections. The advisory states the vector is network with low complexity and no privileges or user interaction, and gives CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H with a score of 9.1. Fixed versions are stated as 4.7.0 and 5.0.0-alpha4, while the affected range is inconsistently described as 4.6.0 before 4.7.0 and 5.0.0-alpha1 before 5.0.0-alpha4 in one place and as 4.6.7 through 5.0.0-alpha3 in the detailed text. Recommended interim mitigation is restricting network access to the public Bazar endpoints. Detection guidance is not stated, and no in-the-wild exploitation is mentioned. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from https://github.com/YesWiki/yeswiki/security/advisories/GHSA-ccp2-6q93-hggh Impact if exploited ConfidentialityHigh IntegrityNone AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required None User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects YesWiki yeswiki NIST National Vulnerability DatabasePublished Oct 25, 2026 14:17 UTC Read the advisory
	Medium	5.3	CVE-2026-116206	YesWiki from 4.2.0 before 4.7.0 contains a stored cross-site scripting vulnerability that allows authenticated users to inject script into comment bodies using the wakka... YesWikiyeswiki	NVD	Oct 25 14:17 UTC
CVE-2026-116206YesWiki from 4.2.0 before 4.7.0 contains a stored cross-site scripting vulnerability that allows authenticated users to inject script into comment bodies using the wakka... Executive summary YesWiki, a wiki package distributed through Composer, has a stored cross-site scripting flaw affecting versions from 4.2.0 up to but not including 4.7.0. The advisory rates it Moderate (CVSS 6.4) and says any logged-in user who can comment on a page can run scripts in the browsers of everyone who views that page, including administrators. The advisory lists 4.7.0 as the patched version, but its body says no fix exists in any published release, so administrators should confirm the status with the vendor before relying on an upgrade. Technical summary The flaw is CWE-79 stored cross-site scripting in comment bodies. Comments are saved with only whitespace trimming and are rendered with the Twig raw filter, and the wiki raw-HTML syntax is enabled by default through allow_raw_html set to true, so any authenticated user with comment access on a page can inject script through POST /api/comments. The CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N, and the advisory says no user interaction beyond viewing the page is needed. The header lists affected versions as >= 4.2.0, < 4.7.0 and patched version as 4.7.0, but the body says the confirmed affected range is >= 4.2.0, <= 4.6.7 and that the fix status is not fixed. The advisory suggests sanitizing comment bodies at storage or setting allow_raw_html to false as an interim step, but it does not state a fixed release that the body confirms. No detection guidance or indicators of exploitation in the wild are stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from https://github.com/YesWiki/yeswiki/security/advisories/GHSA-wq96-vjjh-hfc6 Impact if exploited ConfidentialityLow IntegrityLow AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required Low User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects YesWiki yeswiki NIST National Vulnerability DatabasePublished Oct 25, 2026 14:17 UTC Read the advisory
	Medium	6.9	CVE-2026-116205	YesWiki before 4.7.0 contains an unauthenticated server-side request forgery vulnerability that allows remote attackers to fetch arbitrary URLs by supplying [[\|URL]] wiki... YesWikiyeswiki	NVD	Oct 25 14:17 UTC
CVE-2026-116205YesWiki before 4.7.0 contains an unauthenticated server-side request forgery vulnerability that allows remote attackers to fetch arbitrary URLs by supplying [[\|URL]] wiki... Executive summary YesWiki versions before 4.7.0 contain an unauthenticated server-side request forgery flaw. Any anonymous visitor can make the YesWiki server fetch arbitrary internal or external URLs and read the responses back. The advisory rates it Moderate with a CVSS 3.1 base score of 5.3, and the fix is to upgrade to version 4.7.0. Technical summary The flaw is CWE-918 server-side request forgery in the wiki raw-inclusion syntax [[\|URL]], which fetches attacker-supplied URLs without scheme, host, or IP validation and echoes the response body. It is reachable without authentication through the page render handler using the content parameter, and also stored via a page body saved by a registered editor that fires when anonymous visitors view it. The advisory states the affected versions are less than 4.7.0 and the patched version is 4.7.0. The CVSS vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. A workaround is not stated, and no detection guidance beyond the proof of concept's access log observation is provided. No CVE ID is listed in the advisory, and exploitation in the wild is not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from https://github.com/YesWiki/yeswiki/security/advisories/GHSA-x9j5-r988-9jcc Impact if exploited ConfidentialityLow IntegrityNone AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required None User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects YesWiki yeswiki NIST National Vulnerability DatabasePublished Oct 25, 2026 14:17 UTC Read the advisory

Example	Finds
	Every word appears somewhere: title, summaries, IDs, vendor, or product
	An exact phrase
	One vendor. product: for a product, vp: for either
	Commas mean any of them, in every field
	Severity: critical, high, medium, low, or unknown
	CVSS score, with >, >=, <, or <=
	A score range
	Known exploited. is:kev works too, and kev:no leaves them out
	One source, by name
	Confidentiality impact: high, low, none, or any (low or high)
	Integrity and availability work the same way
	An advisory or CVE ID, or part of one
	A minus sign leaves out whatever the term matches

Vulnerability feed

Executive summary

Technical summary

Impact if exploited

How it is exploited

Affects

Executive summary

Technical summary

Impact if exploited

How it is exploited

Affects

Executive summary

Technical summary

Impact if exploited

How it is exploited

Affects

Executive summary

Technical summary

Impact if exploited

How it is exploited

Affects

Executive summary

Technical summary

Impact if exploited

How it is exploited

Affects

Executive summary

Technical summary

Impact if exploited

How it is exploited

Affects

Executive summary

Technical summary

Impact if exploited

How it is exploited

Affects

Executive summary

Technical summary

Impact if exploited

How it is exploited

Affects

Executive summary

Technical summary

Impact if exploited

How it is exploited

Affects

Executive summary

Technical summary

Impact if exploited

How it is exploited

Affects

Executive summary

Technical summary

Score

Affects

Executive summary

Technical summary

Score

Affects

Executive summary

Technical summary

Score

Affects

Executive summary

Technical summary

Score

Affects

Executive summary

Technical summary

Score

Affects

Executive summary

Technical summary

Impact if exploited

How it is exploited

Affects

Executive summary

Technical summary

Impact if exploited

How it is exploited