CVE Notifier

CVE-2026-54613 CWE-22 5.4

Vvveb: Path Traversal in Revision Backup Reader/Deleter via Unsanitized theme Parameter

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.5, getThemeFolder() in admin/controller/editor/revisions.php returns the attacker-controlled theme pa…

cve.org givanz:Vvveb 2 hari lalu

CVE-2026-93307 CWE-789 4.3

O-RAN-SC SMO OAM VES Collector memory allocation

A vulnerability has been found in O-RAN-SC SMO OAM 2025-06-10. Affected is an unknown function of the component VES Collector. Such manipulation of the argument additionalFields.padding leads to uncontrolled memory alloc…

cve.org O-RAN-SC:SMO · OAM 2 hari lalu

CVE-2026-54507 CWE-918 N/A

Vvveb oEmbedProxy vulnerable to server-side request forgery

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.5, the oEmbedProxy() handler in admin/controller/editor/editor.php accepts an attacker-controlled url…

cve.org givanz:Vvveb 2 hari lalu

CVE-2026-50158 CWE-73 7.7

yutu: Arbitrary File Write via MCP `caption-download` Tool

yutu is an AI-powered toolkit for managing and growing YouTube channels. Prior to 0.10.9, the caption-download MCP tool accepts a caller-controlled file parameter through cmd/caption/download.go and passes it to Caption.…

cve.org eat-pray-ai:yutu 2 hari lalu

CVE-2026-53534 CWE-78 N/A

JabRef CAYW Sublime Text integration permits operating-system command injection

JabRef is a desktop application for managing BibTeX and BibLaTeX libraries. Prior to 6.0-alpha.6, when jabsrv or JabRef's built-in HTTP server is enabled, the GET /better-bibtex/cayw endpoint accepts an external command …

cve.org JabRef:jabref 2 hari lalu

CVE-2026-53557 CWE-89 N/A

SQLBot: Second-Order SQL Injection via Excel Datasource Leading to Remote Command Execution

SQLBot is an intelligent Text-to-SQL system based on large language models and RAG. Prior to 1.9.0, an authenticated user can supply a crafted sheet["tableName"] value in the Excel datasource configuration submitted thro…

cve.org dataease:SQLBot 2 hari lalu

CVE-2026-53555 CWE-79 N/A

Stored XSS via SVG Upload

SQLBot is an intelligent Text-to-SQL system based on large language models and RAG. Prior to 1.9.0, an authenticated uploader can submit an image/svg+xml assistant UI logo through PATCH /api/v1/system/assistant/ui, and S…

cve.org dataease:SQLBot 2 hari lalu

CVE-2026-53556 CWE-89 N/A

SQLBot: Authenticated SQL Injection in previewData Resulting in Arbitrary File Read

SQLBot is an intelligent Text-to-SQL system based on large language models and RAG. Prior to 1.9.0, the POST /api/v1/datasource/previewData endpoint in backend/apps/datasource/crud/datasource.py incorporates the client-c…

cve.org dataease:SQLBot 2 hari lalu

CVE-2026-53554 CWE-22 N/A

SQLBot: Arbitrary File Write via parseExcel Leading to Code Execution Through Alembic Import Processing

SQLBot is an intelligent Text-to-SQL system based on large language models and RAG. Prior to 1.9.0, the POST /api/v1/datasource/parseExcel endpoint in backend/apps/datasource/api/datasource.py uses attacker-controlled mu…

cve.org dataease:SQLBot 2 hari lalu

CVE-2026-54633 CWE-125 N/A

PoDoFo: Heap Out-of-Bounds Read in Indexed Color Space Image Decoding (FetchScanLine)

PoDoFo is a C++17 PDF manipulation library. From version 1.0.0 until 1.1.1, processing a crafted PDF with an Indexed color-space image can cause a heap out-of-bounds read in PdfColorSpaceFilterIndexed::FetchScanLine in s…

cve.org podofo:podofo 2 hari lalu

CVE-2026-54343 CWE-22 N/A

Frappe LMS: Path Traversal in SCORM File Serving

Frappe Learning Management System (LMS) is a learning system that helps users structure their content. Prior to version 2.52.1, a remote attacker can request a traversal path handled by SCORMRenderer.render in lms/page_r…

cve.org frappe:lms 2 hari lalu

CVE-2026-50291 CWE-125 5.5

OpenImageIO: Segmentation Fault in BmpInput::read_native_scanline (bmpinput.cpp:399)

OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to versions 3.0.16.0 and 3.1.11.0, processing a crafted BMP file through oiiotool or…

cve.org AcademySoftwareFoundation:OpenImageIO 2 hari lalu