https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 08:31:38 +0000 https://cve.radiocsirt.org/vuln/cve-2026-47245 <p><strong>Affected:</strong> mybb</p> <p>MyBB is free and open source forum software. Prior to 1.8.40, the User CP Buddy/Ignore List component does not validate reciprocal buddy-list updates correctly. The usercp.php?action=do_editlists delete handler removes the selected entry from the acting user&#39;s list and then updates mybb_users.buddylist for the target account. The reciprocal update searches for the deleted target UID instead of the acting user&#39;s UID and uses the unchecked array_search() return value as an array key. A false result can be converted to index 0, removing the target account&#39;s first stored buddy while leaving the actual reciprocal entry unchanged. The uniquely identifying implementation details include false converted to index 0. This issue is fixed in version 1.8.40.</p> <p><strong>Affected:</strong> mybb</p> <p>MyBB is free and open source forum software. Prior to 1.8.40, the User CP Buddy/Ignore List component does not validate reciprocal buddy-list updates correctly. The usercp.php?action=do_editlists delete handler removes the selected entry from the acting user&#39;s list and then updates mybb_users.buddylist for the target account. The reciprocal update searches for the deleted target UID instead of the acting user&#39;s UID and uses the unchecked array_search() return value as an array key. A false result can be converted to index 0, removing the target account&#39;s first stored buddy while leaving the actual reciprocal entry unchanged. The uniquely identifying implementation details include false converted to index 0. This issue is fixed in version 1.8.40.</p> https://cve.radiocsirt.org/vuln/cve-2026-47245