⬡ Vulnerability Digest
Security Report
Total Findings
463
Critical
74
High
227
Actively Exploited
9
CISA-KEV9
NVD350
GitHub-GHSA104
Findings sorted by severity
CISA-KEV
CRITICAL
BeyondTrust Remote Support Authentication Bypass by Spoofing Vulnerability
BeyondTrust Remote Support Authentication Bypass by Spoofing Vulnerability
BeyondTrust Remote Support contains an authentication bypass by spoofing vulnerability that could allow a remote attacker to perform file operations on the appliance.
Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
CISA-KEV
CRITICAL
Fortinet Multiple Products Path Traversal Vulnerability
Fortinet Multiple Products Path Traversal Vulnerability
FortiOS, FortiPAM, FortiProxy, and FortiSwitchManager contain a path traversal vulnerability that may allow an authenticated attacker with admin profile and at least read-write permissions to write or delete arbitrary files via specific CLI commands.
Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
CISA-KEV
CRITICAL
Atlassian Multiple Products Files or Directories Accessible to External Parties Vulnerability
Atlassian Multiple Products Files or Directories Accessible to External Parties Vulnerability
Multiple Atlassian products (Bitbucket Data Center ,Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center, Crowd Data Center, Crucible and Fisheye) contain a files or directories accessible to external parties vulnerability which could allow an un…
Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
CISA-KEV
CRITICAL
Palo Alto Networks PAN-OS Code Injection Vulnerability
Palo Alto Networks PAN-OS Code Injection Vulnerability
Palo Alto Networks PAN-OS contains a code injection vulnerability that could allow an authenticated attacker with network access to execute arbitrary code with root privileges on the firewall.
Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
CISA-KEV
CRITICAL
Cisco Secure Email Gateway Relative Path Traversal Vulnerability
Cisco Secure Email Gateway Relative Path Traversal Vulnerability
Cisco Secure Email Gateway contains a relative path traversal vulnerability that could allow an unauthenticated, remote attacker to write arbitrary files on the underlying operating system.
Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
CISA-KEV
CRITICAL
Ahsay AhsayCBS Improper Authentication Vulnerability
Ahsay AhsayCBS Improper Authentication Vulnerability
Ahsay AhsayCBS contains an improper authentication vulnerability that could allow a remote attacker to bypass authentication via manipulation of the random parameter in the API component’s checkSysPwd function. This vulnerability can be chained with CVE-2026-105134.
Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
CISA-KEV
CRITICAL
Ahsay AhsayCBS Command Injection Vulnerability
Ahsay AhsayCBS Command Injection Vulnerability
Ahsay AhsayCBS contains a command injection vulnerability that could allow a remote attacker to execute operating system commands via manipulation of the random parameter in the Replication Receiver component’s /rps/api/json/UpdateReceivers.do endpoint. This vulnerability can be chained with CVE-2…
Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
CISA-KEV
CRITICAL
Ivanti Connect Secure Authentication Bypass by Spoofing Vulnerability
Ivanti Connect Secure Authentication Bypass by Spoofing Vulnerability
Ivanti Connect Secure contains an authentication bypass by spoofing vulnerability that allows a remote unauthenticated attacker to execute arbitrary commands.
Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
CISA-KEV
CRITICAL
Microsoft Windows Command Injection Vulnerability
Microsoft Windows Command Injection Vulnerability
Microsoft Windows Shell contains a command injection vulnerability that allows an unauthorized attacker to bypass a security feature over a network.
Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
GitHub-GHSA
CRITICAL
Podman: The `podman run` command can be instructed to disable almost all sandboxing by image annotation
Podman: The `podman run` command can be instructed to disable almost all sandboxing by image annotation
### Impact
Podman v4.4.0 added a feature where container checkpoints (from the `podman container checkpoint` command) could be distributed via OCI registry, and pulled from that registry and run via the `podman run` command. This allowed easy transfer of checkpoints between systems. However, checkpo…
Podman v4.4.0 added a feature where container checkpoints (from the `podman container checkpoint` command) could be distributed via OCI registry, and pulled from that registry and run via the `podman run` command. This allowed easy transfer of checkpoints between systems. However, checkpo…
CVE-2026-94603
NVD
CRITICAL
CVE-2026-65162
CVE-2026-65162
NVIDIA AIStore for Linux contains a vulnerability in the legacy ETL Kubernetes PodSpec initialization API where a remote attacker may supply Kubernetes host-namespace and container-security settings. A successful exploit may lead to code execution, privilege escalation, information disclosure, data …
CWE: CWE-250
NVD
CRITICAL
CVE-2026-97229
CVE-2026-97229
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server via a specially crafted regular expressi…
CWE: CWE-190
NVD
CRITICAL
CVE-2026-89111
CVE-2026-89111
The SAP Cloud SDK for Python contains an OAuth2 SSRF vulnerability affecting multi-tenant BTP applications. An attacker who controls the tenant_subdomain parameter can redirect OAuth2 token requests to an attacker-controlled server, causing client credentials to be exfiltrated.
CWE: CWE-918
NVD
CRITICAL
CVE-2026-105037
CVE-2026-105037
EnergizeLab station-middleware (NestJS) Docker images 1.6.5 through 1.8.2 allow any registered, low-privilege account to read arbitrary files from the server by supplying an attacker-controlled file path. This exposes middleware files and server secrets.
CWE: CWE-73
GitHub-GHSA
CRITICAL
KEDA: Privilege escalation from namespace admin to cluster admin via KEDA TriggerAuthentication
KEDA: Privilege escalation from namespace admin to cluster admin via KEDA TriggerAuthentication
## Summary
A namespace admin who creates a `TriggerAuthentication` and a `ScaledObject` in their own namespace can make the KEDA operator send its own ServiceAccount token to a tenant-controlled URL. That token holds `["*"]/["*"] get` cluster-wide, so it reads every Secret in every namespace, plus …
CVE-2026-77524
GitHub-GHSA
CRITICAL
Argo CD: AppProject destination-namespace and resource restrictions bypassed by PreDelete/PostDelete resource hooks
Argo CD: AppProject destination-namespace and resource restrictions bypassed by PreDelete/PostDelete resource hooks
### Impact
Argo CD checks an Application's AppProject before it creates resources during a sync. That check covers destination namespaces and servers, cluster-scoped resource allow and deny lists, and namespaced resource allow and deny lists, including resource names. PreDelete and PostDelete hooks…
CVE-2026-77459
NVD
CRITICAL
CVE-2026-77524
CVE-2026-77524
KEDA is a Kubernetes-based Event Driven Autoscaling component. In version 2.20.2 and earlier, a namespace administrator who can create TriggerAuthentication and ScaledObject resources can set hashiCorpVault.address to a tenant-controlled endpoint and select Kubernetes authentication without an expli…
CWE: CWE-269, CWE-918
NVD
CRITICAL
CVE-2026-77459
CVE-2026-77459
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From 2.10.0 until 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2, Argo CD creates PostDelete resource hooks without applying the AppProject destination and resource authorization checks used during ordinary synchronization. The omitted …
CWE: CWE-863
NVD
CRITICAL
CVE-2026-77366
CVE-2026-77366
obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. Prior to 1.3.1, tool dispatch does not compare the caller-controlled input.vault value with the vault bound to the caller, the JSON Web Token (JWT) has no vault claim, and the folder access-control list is shar…
CWE: CWE-639, CWE-863
NVD
CRITICAL
CVE-2026-111823
CVE-2026-111823
Mage OSS through 0.9.80 before 76c4f46 can proceed with session creation upon encountering an unknown OAuth provider.
CWE: CWE-390
GitHub-GHSA
CRITICAL
LMCache: Remote code execution via unsafe deserialization in multiprocess mode transport
LMCache: Remote code execution via unsafe deserialization in multiprocess mode transport
### Summary
LMCache is vulnerable to Unauthenticated Remote Code Execution via Pickle Deserialization on the Multiprocess ZMQ Transport
### Details
LMCache multiprocess mode, also called distributed mode, opens an unauthenticated ZeroMQ ROUTER so worker processes can register and share KV cache…
CVE-2026-105192
NVD
CRITICAL
CVE-2026-111692
CVE-2026-111692
DataBuff ai-apm-web through 0.1.10 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge admin session tokens by using the hardcoded HMAC secret in JwtTokenService. Attackers can sign a payload of admin and a future expiry with the default dev-secret to gain …
CWE: CWE-321
NVD
CRITICAL
CVE-2026-111690
CVE-2026-111690
Simple Admin Core through 1.8.7 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge super administrator tokens by using the hard-coded Auth.AccessSecret in api/etc/core.yaml. Attackers can sign a JWT with the public secret and roleId claim 001 to gain full …
CWE: CWE-321
NVD
CRITICAL
CVE-2026-111673
CVE-2026-111673
IceCMS through 4.1.5 contains a missing authentication vulnerability that allows unauthenticated attackers to modify, delete, or disable any account because /User/** is excluded from the Shiro jwt filter. Attackers can send PUT requests to /User/updateUser to set a new password and role on any userI…
CWE: CWE-306
NVD
CRITICAL
CVE-2026-111641
CVE-2026-111641
FastapiAdmin through 3.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to obtain sessions for any user by abusing unprotected auto-login endpoints. Attackers can list users via /api/v1/auth/auto-login/users, mint a superuser auto-login token, and exchange it f…
CWE: CWE-306
GitHub-GHSA
CRITICAL
Vitess vttablet /twopcz reflected XSS
Vitess vttablet /twopcz reflected XSS
From: xylove21
To: security@vitess.io
Subject: [Security Report] Vitess vttablet /twopcz reflected XSS
Date: Tue, 24 Jun 2026 14:30:00 +0800
To: security@vitess.io
Subject: [Security Report] Vitess vttablet /twopcz reflected XSS
Date: Tue, 24 Jun 2026 14:30:00 +0800
## Summary
The `twopczHandler` in
`go/vt/vttablet/tabletserver/twopcz.go` (line 185) reflects the `Action`
and `dtid` form values directly into the HTML resp…
CVE-2026-104252
NVD
CRITICAL
CVE-2026-55680
CVE-2026-55680
WeGIA is a web manager for charitable institutions. Prior to 3.8.6, unauthenticated POST requests to web/html/socio/sistema/cadastro_cobranca.php can place a quoted SQL expression in the codigo parameter, which extract($_REQUEST) passes into the WHERE codigo= clause of an UPDATE statement without va…
CWE: CWE-89
NVD
CRITICAL
CVE-2026-110650
CVE-2026-110650
The thumbnail Python package through 1.5 contains an OS command injection vulnerability in generate_thumbnail() that allows attackers to execute commands by supplying shell metacharacters in file paths. Attackers who control a file name passed to generate_thumbnail, such as an uploaded file, can inj…
CWE: CWE-78
NVD
CRITICAL
CVE-2026-110649
CVE-2026-110649
Stills before 25.24.2 contains an OS command injection vulnerability that allows attackers to execute shell commands by supplying crafted media file paths. Attackers can name a media file with $(…) or backticks to execute operating system commands with Node.js process privileges when ffmpeg, ffpro…
CWE: CWE-78
NVD
CRITICAL
CVE-2026-110645
CVE-2026-110645
Video-stitch before 2.0.0-beta.1 contains an OS command injection vulnerability that allows attackers to execute commands by supplying file names interpolated unquoted into shell-executed ffmpeg command lines. Attackers who influence file names passed to concat(), cut(), or merge() can inject shell …
CWE: CWE-78
NVD
CRITICAL
CVE-2026-110644
CVE-2026-110644
nodejs-whisper through 0.3.1 contains an OS command injection vulnerability in convertToWavType() that allows attackers to execute commands by supplying crafted audio file paths. Attackers can provide file names containing $() command substitution or closing quotes, which are interpolated into an ff…
CWE: CWE-78
NVD
CRITICAL
CVE-2026-110643
CVE-2026-110643
transcribe2texts through 1.0.6 contains an OS command injection vulnerability that allows attackers to execute commands by supplying crafted audioPath values to transcribeAudio(). Attackers can inject $() or backtick substitution or a closing quote into the unescaped path passed to child_process.exe…
CWE: CWE-78
NVD
CRITICAL
CVE-2026-110640
CVE-2026-110640
Whisper-node through 1.1.1 contains an OS command injection vulnerability that allows attackers to execute commands by supplying crafted filePath or whisperOptions.language values to whisper(). Attackers can inject shell metacharacters or $() substitution into the command string built by createCppCo…
CWE: CWE-78
NVD
CRITICAL
CVE-2026-110639
CVE-2026-110639
@mborne/extract before 0.2.1 contains an OS command injection vulnerability that allows attackers to execute commands by supplying shell metacharacters in archivePath or targetDir options. Attackers controlling these values passed to extract() can inject commands into unquoted shelljs exec() strings…
CWE: CWE-78
NVD
CRITICAL
CVE-2026-110638
CVE-2026-110638
doc-recog through 1.1.6 contains an OS command injection vulnerability that allows attackers to execute commands by supplying crafted document paths to recog() or tag(). Attackers can embed $(…) or backtick command substitution in the file path, which DocData._readPDF passes to a shell-based pdfto…
CWE: CWE-78
NVD
CRITICAL
CVE-2026-110636
CVE-2026-110636
pypdftk through 0.5 contains an OS command injection vulnerability in fill_form(), dump_data_fields(), and pdftk_cmd_util() that builds shell commands from caller-supplied paths. Attackers controlling pdf_path or out_file can inject shell metacharacters interpreted by subprocess.Popen with shell=Tru…
CWE: CWE-78
NVD
CRITICAL
CVE-2026-110635
CVE-2026-110635
webp-converter before 3.0.0 contains an OS command injection vulnerability in src/webpconverter.js helpers that run libwebp binaries via execFile with shell enabled. Attackers controlling file names or option strings passed to cwebp, dwebp, gwebp, or webpmux functions can inject shell metacharacters…
CWE: CWE-78
NVD
CRITICAL
CVE-2026-110634
CVE-2026-110634
git-diff before 2.0.7 contains an OS command injection vulnerability that allows attackers to execute shell commands by supplying crafted strings to the gitDiff API. Attackers who control a diffed document string can embed $(cmd) or backtick substitutions that shelljs.exec evaluates, running command…
CWE: CWE-78
NVD
CRITICAL
CVE-2026-110612
CVE-2026-110612
vlife through 2.0.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge JWTs using the hardcoded HS256 signing key in TokenUtil. Attackers can sign a token with superUser=true and arbitrary groupIds claims to gain super administrator access to any URL on vl…
CWE: CWE-321
NVD
CRITICAL
CVE-2020-37282
CVE-2020-37282
office-converter through 1.0.2 contains an OS command injection vulnerability that allows attackers to execute commands by supplying a crafted fileName to generatePdf() or generateHtml(). Attackers can embed $(…), backticks, or a closing quote with shell metacharacters in the file name, which is c…
CWE: CWE-78
NVD
CRITICAL
CVE-2026-93388
CVE-2026-93388
The Printcart Store (PCDesigner / NB Designer) plugin for WooCommerce is vulnerable to unauthenticated arbitrary file upload leading to remote code execution in all versions up to, and including, 2.9.1 The nbdesigner_copy_image_from_url AJAX action is registered for logged-out callers (wp_ajax_nopri…
CWE: CWE-434
NVD
CRITICAL
CVE-2026-49950
CVE-2026-49950
Xorbits Xoscar through 0.11.2 contains an unauthenticated deserialization vulnerability that allows remote attackers to execute arbitrary code by sending crafted data over the actor-pool TCP channel. Attackers can exploit SocketChannel.recv() passing unvalidated data to cloudpickle.loads(), which tr…
CWE: CWE-502
NVD
CRITICAL
CVE-2026-104252
CVE-2026-104252
Vitess is a database clustering system for horizontal scaling of MySQL. Prior to 23.0.5 and 24.0.2, twopczHandler in go/vt/vttablet/tabletserver/twopcz.go writes the Action and dtid form values from the vttablet and vtcombo /twopcz HTTP debug endpoint into a text/html response without HTML escaping.…
CWE: CWE-79
GitHub-GHSA
CRITICAL
Microsoft Security Advisory CVE-2026-105016 – Microsoft QUIC Remote Code Execution Vulnerability
Microsoft Security Advisory CVE-2026-105016 – Microsoft QUIC Remote Code Execution Vulnerability
## Executive summary
Microsoft is releasing this security advisory to provide information about a vulnerability in Microsoft QUIC as used by .NET 8.0, .NET 9.0, .NET 10.0, and .NET 11 RC2 on Windows. This advisory also provides guidance on what developers can do to update their applications to remo…
CVE-2026-105016
NVD
CRITICAL
CVE-2026-97816
CVE-2026-97816
Use after free in OpenSSH for Windows allows an unauthorized attacker to execute code over a network.
CWE: CWE-416
NVD
CRITICAL
CVE-2026-102210
CVE-2026-102210
Heap-based buffer overflow in Windows Text Shaping allows an unauthorized attacker to execute code over a network.
CWE: CWE-122
NVD
CRITICAL
CVE-2026-100202
CVE-2026-100202
Use after free in Windows Message Queuing Queue Manager allows an unauthorized attacker to execute code over a network.
CWE: CWE-416
NVD
CRITICAL
CVE-2026-53709
CVE-2026-53709
MCP Context Forge is an MCP gateway and administrative platform. Prior to 1.0.2, mcpgateway/config.py and .env.example ship a known JWT_SECRET_KEY, while verify_jwt_token() accepts HS256 tokens signed with that key and get_current_user() creates a platform administrator when the token subject matche…
CWE: CWE-287, CWE-321, CWE-798, CWE-1188
NVD
CRITICAL
CVE-2026-109575
CVE-2026-109575
In HAProxy Data Plane API 2.2.0 through 3.4.3 (and corresponding Enterprise Edition releases), Server.ConfigureAPI() has process-global authentication logic that improperly drops security controls across multiple transport types. When a TLS Certificate Authority (tls_ca) is configured and a numeric …
CWE: CWE-306
NVD
CRITICAL
CVE-2026-109390
CVE-2026-109390
AnyDesk before 8.0.3 allows unauthenticated remote attackers to execute arbitrary code via a heap-based buffer overflow, as demonstrated on Linux for command execution as root without the victim approving desktop control. In the stream packet handler for mode 5 in the session protocol, a payload len…
CWE: CWE-130
NVD
CRITICAL
CVE-2026-57169
CVE-2026-57169
Dockhand is a Docker management application. Prior to 1.0.34, the in-browser container terminal endpoint /api/containers/<id>/exec does not enforce authentication on the WebSocket upgrade request. When an unauthenticated attacker has network reach to Dockhand, knows a target container ID, and target…
CWE: CWE-306, CWE-862
NVD
CRITICAL
CVE-2026-105039
CVE-2026-105039
EnergizeLab station-middleware (NestJS) Docker images 1.6.5 through 1.8.2 do not check user roles on administrative APIs. Any authenticated low-privilege user can retrieve AI provider keys and change configuration and object-store contents.
CWE: CWE-862
NVD
CRITICAL
CVE-2026-110165
CVE-2026-110165
Use after free in Core in Google Chrome on on Android prior to 155.0.8059.79 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)
CWE: CWE-416
NVD
CRITICAL
CVE-2026-110161
CVE-2026-110161
Use after free in Network in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code outside the sandbox via crafted network traffic. (Chromium security severity: Critical)
CWE: CWE-416
NVD
CRITICAL
CVE-2026-110159
CVE-2026-110159
Incorrect authorization in Updater in Google Chrome prior to 155.0.8059.79 allowed a local attacker to execute arbitrary code outside the sandbox via a local program. (Chromium security severity: High)
CWE: CWE-863
NVD
CRITICAL
CVE-2026-110152
CVE-2026-110152
Buffer overflow in ANGLE in Google Chrome on on Android prior to 155.0.8059.79 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)
CWE: CWE-122
NVD
CRITICAL
CVE-2026-110149
CVE-2026-110149
Use after free in Browser in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)
CWE: CWE-416
NVD
CRITICAL
CVE-2026-110142
CVE-2026-110142
Use after free in FileSystem in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
CWE: CWE-416
NVD
CRITICAL
CVE-2026-110136
CVE-2026-110136
Use after free in PDF in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)
CWE: CWE-416
GitHub-GHSA
CRITICAL
Microsoft Security Advisory CVE-2026-88092 – ASP.NET Core Security Feature Bypass Vulnerability
Microsoft Security Advisory CVE-2026-88092 – ASP.NET Core Security Feature Bypass Vulnerability
## Executive summary
Microsoft is releasing this security advisory to provide information about a vulnerability in Microsoft.AspNetCore.Server.Kestrel.Core. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability.
An aborted Kestrel …
CVE-2026-88092
GitHub-GHSA
CRITICAL
TanStack Router: Unauthenticated reflected XSS in TanStack Start server-function responses
TanStack Router: Unauthenticated reflected XSS in TanStack Start server-function responses
## Impact
An unauthenticated attacker can craft a URL to a server function in an affected TanStack Start app. If someone opens the link, the app can return attacker-controlled HTML from its own origin and run the attacker's JavaScript there. The script can access same-origin data available to that …
CVE-2026-102989
NVD
CRITICAL
CVE-2026-102946
CVE-2026-102946
joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption (JOSE) standards. Prior to 1.7.4, joserfc.jws.deserialize_json() accepts a JWS General JSON Serialization with an empty signatures array as authenticated. The verify_general_json() loop performs…
CWE: CWE-290, CWE-345, CWE-347
NVD
CRITICAL
CVE-2026-110862
CVE-2026-110862
Better Auth from 1.4.0-beta.18 before 1.7.7 contains an authentication bypass vulnerability that allows unauthenticated attackers to sign in as other users by reusing OAuth state values as Magic Link tokens. Attackers can start an OAuth sign-in with a victim's email and submit the returned state to …
CWE: CWE-287
NVD
CRITICAL
CVE-2026-85714
CVE-2026-85714
Stirling-PDF is a locally hosted web application that facilitates various operations on PDF files. Prior to 2.13.2, an authenticated administrator using the default H2 database and security mode can upload a crafted SQL file to POST /api/v1/database/import-database. DatabaseService.validateSqlConten…
CWE: CWE-94
GitHub-GHSA
CRITICAL
Microsoft Security Advisory CVE-2026-70188 – ASP.NET Core Security Feature Bypass Vulnerability
Microsoft Security Advisory CVE-2026-70188 – ASP.NET Core Security Feature Bypass Vulnerability
## Executive summary
Microsoft is releasing this security advisory to provide information about a vulnerability in Microsoft.AspNetCore.Server.Kestrel.Core. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability.
Kestrel accepts new…
CVE-2026-70188
NVD
CRITICAL
CVE-2026-65173
CVE-2026-65173
NVIDIA AIStore for Linux contains a missing authentication vulnerability in the token-revocation endpoint where an unauthenticated remote attacker may submit crafted token-revocation lists. A successful exploit may lead to data tampering and denial of service.
CWE: CWE-306
NVD
CRITICAL
CVE-2026-92120
CVE-2026-92120
OAuth1 Request Replay Attack vulnerability in Apache Allura.
This issue affects Apache Allura: through 1.21.0.
Users are recommended to upgrade to version 1.22.0 which fixes the issue.
CWE: CWE-294
NVD
CRITICAL
CVE-2026-92116
CVE-2026-92116
OAuth1 callback validation vulnerability in Apache Allura.
This issue affects Apache Allura: through 1.21.0.
Users are recommended to upgrade to version 1.22.0, which fixes the issue.
CWE: CWE-601
NVD
CRITICAL
CVE-2026-109321
CVE-2026-109321
Grav Login OAuth plugin (grav-plugin-login-oauth) before 1.4.3 provisions OAuth accounts as ordinary Grav users with a deterministic <provider>.<id> username and an unsalted MD5 hash of the provider identifier as the password, without disabling password login. Unauthenticated remote attackers who le…
CWE: CWE-1391
NVD
CRITICAL
CVE-2026-91881
CVE-2026-91881
Dell Terraform Provider for Redfish, versions prior to 1.6.2, contains an Improper Certificate Validation vulnerability in the HTTP transport component. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to information exposure and unauthorized acces…
CWE: CWE-295
NVD
CRITICAL
CVE-2026-86002
CVE-2026-86002
Dokku is a docker-powered platform as a service. In Dokku versions before 0.38.25, a user with app-level Dokku access and remote SSH access to execute docker-options commands can store arbitrary strings through the docker-options plugin, and those strings are later concatenated into DOCKER_ARGS and …
CWE: CWE-95
NVD
CRITICAL
CVE-2026-55562
CVE-2026-55562
Cronicle is a multi-server task scheduler and runner, with a web based front-end UI. Prior to 0.9.119, the administrator Activity Log in htdocs/js/pages/admin/Activity.js concatenates the attacker-controlled item.user.full_name value into HTML without applying encode_entities and inserts the result …
CWE: CWE-79
GitHub-GHSA
CRITICAL
Claude Agent SDK: Argument Injection via resume Option Allows Arbitrary Command Execution
Claude Agent SDK: Argument Injection via resume Option Allows Arbitrary Command Execution
The Claude Agent SDK for Python passed the `resume` option to the Claude CLI without validation, allowing a value beginning with `-` to be interpreted as a separate CLI flag. An attacker who controlled the `resume` value could inject an `–mcp-config` flag defining a stdio MCP server, resulting in a…
CVE-2026-96620
GitHub-GHSA
CRITICAL
Dgraph: Zero Unauthenticated HTTP Admin removeNode Denial of Service
Dgraph: Zero Unauthenticated HTTP Admin removeNode Denial of Service
### Summary
Dgraph `v25.3.8` exposes a Zero HTTP administrative surface that is unauthenticated when port `6080` is reachable.
The exposed routes include:
– `/state`
– `/assign`
– `/removeNode`
– `/moveTablet`
An unauthenticated request to `/removeNode?id=1&group=0` on a single-node standalone d…
CVE-2026-102748
NVD
HIGH
CVE-2026-96627
CVE-2026-96627
Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to 2.6.0, UpdateUser in backend/api/handlers/users.go sets PasswordHash for any target without comparing caller and target privilege. A holder of delegated users:update permission can submit a password change…
CWE: CWE-266, CWE-269
GitHub-GHSA
HIGH
Arcane: Delegated users:update permission allows admin account takeover via password reset (no privilege-hierarchy check)
Arcane: Delegated users:update permission allows admin account takeover via password reset (no privilege-hierarchy check)
## Summary
A user holding the delegated `users:update` permission can reset the global administrator's password and take over the admin account. `UpdateUser` sets the target user's `PasswordHash` from the request body for ANY target with no comparison of caller-vs-target privilege. Because role assi…
A user holding the delegated `users:update` permission can reset the global administrator's password and take over the admin account. `UpdateUser` sets the target user's `PasswordHash` from the request body for ANY target with no comparison of caller-vs-target privilege. Because role assi…
CVE-2026-96627
NVD
HIGH
CVE-2026-111642
CVE-2026-111642
FastapiAdmin through 3.0 contains a hard-coded JWT signing secret in backend/app/config/setting.py that allows low-privileged users to forge tokens impersonating the superuser. Attackers can register via the unauthenticated /api/v1/system/user/register endpoint, log in, and forge an HS256 token keep…
CWE: CWE-321
NVD
HIGH
CVE-2026-92553
CVE-2026-92553
The YaySMTP – WP Mail SMTP with Email Logs, Tracking & Reports plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.7.7 via the putFile function. This is due to insufficient file type validation in the putFile function, as sanitize_file_name() does no…
CWE: CWE-434
GitHub-GHSA
HIGH
Nginx UI: nginx config directive denylist (ValidateConfigFile) is bypassable via same-line ";" separation → authenticated directive injection (RCE on the official image)
Nginx UI: nginx config directive denylist (ValidateConfigFile) is bypassable via same-line ";" separation → authenticated directive injection (RCE on the official image)
## Summary
`config.ValidateConfigFile` is the security control that blocks dangerous nginx directives
(`js_*`, `perl_*`, `load_module` of njs/perl modules, `user root`). Its directive scanner is
bypassable: it splits the config by newlines and inspects only the FIRST token of each line, but
nginx se…
`config.ValidateConfigFile` is the security control that blocks dangerous nginx directives
(`js_*`, `perl_*`, `load_module` of njs/perl modules, `user root`). Its directive scanner is
bypassable: it splits the config by newlines and inspects only the FIRST token of each line, but
nginx se…
CVE-2026-84316
GitHub-GHSA
HIGH
Nginx UI: TOTP / passkey enrolment requires no re-authentication, enabling persistent account takeover
Nginx UI: TOTP / passkey enrolment requires no re-authentication, enabling persistent account takeover
## Summary
Endpoints that bind a TOTP secret (`POST /api/otp_enroll`) or register a WebAuthn passkey (`POST /api/finish_passkey_register`) for the *current* user require only a valid JWT. There is no current-password re-prompt and the routes are explicitly registered **outside** the `RequireSecureS…
CVE-2026-84313
GitHub-GHSA
HIGH
Nginx UI: MCP `nginx_config_add` Bypasses Directive Validation — Authenticated RCE
Nginx UI: MCP `nginx_config_add` Bypasses Directive Validation — Authenticated RCE
### Summary
The MCP tool `nginx_config_add` writes nginx configuration files to disk and triggers an nginx reload without calling `config.ValidateConfigFile`. The identical flow in the REST API (`POST /api/configs`) does call that function and correctly rejects dangerous directives. An authenticate…
CVE-2026-84318
GitHub-GHSA
HIGH
Nginx UI: MCP nginx_config_add skips config directive validation → authenticated nginx directive injection (RCE on the official image)
Nginx UI: MCP nginx_config_add skips config directive validation → authenticated nginx directive injection (RCE on the official image)
## Summary
`internal/config/validation.go` (`ValidateConfigFile`) is a security control that blocks dangerous
nginx directives — `js_*`, `perl_*`, `load_module` of the njs/perl modules, and `user root`. It is
enforced on three of the four config-write paths: `api/config/add.go`, `api/config/modify…
`internal/config/validation.go` (`ValidateConfigFile`) is a security control that blocks dangerous
nginx directives — `js_*`, `perl_*`, `load_module` of the njs/perl modules, and `user root`. It is
enforced on three of the four config-write paths: `api/config/add.go`, `api/config/modify…
CVE-2026-84317
NVD
HIGH
CVE-2026-110908
CVE-2026-110908
Netgate pfSense FRR package (pfSense-pkg-frr) 2.0.2_1 and source revision 2.1.2_1 contain an OS command injection vulnerability in the FRR status filter. An authenticated WebGUI user with only the page-status-frr privilege can supply a filter value that breaks out of a single-quoted sed expression i…
CWE: CWE-78
NVD
HIGH
CVE-2026-91184
CVE-2026-91184
Description
NGINX Gateway Fabric has a vulnerability when it renders the spec.basic.realm (and spec.jwt.realm) field of a namespaced AuthenticationFilter verbatim, unescaped and unvalidated, into the shared data-plane nginx.conf as auth_basic "<realm>";. A namespaced authenticated attacker that co…
CWE: CWE-76
NVD
HIGH
CVE-2026-73802
CVE-2026-73802
Gitea Runner passes workflow-controlled container options into Docker job container configuration while privileged mode is disabled. Host namespace settings, expanded capabilities, and security profile overrides can remain effective despite Privileged being forced false. A workflow author able to ru…
CWE: CWE-269
NVD
HIGH
CVE-2026-104795
CVE-2026-104795
The insights-runtime-extractor runs as a privileged DaemonSet (`hostPID: true`)
that scans container processes for runtime fingerprinting. When scanning a
container, the coordinator:
that scans container processes for runtime fingerprinting. When scanning a
container, the coordinator:
1. **fork()s** a child process
2. **setns()** into the target container's PID and mount namespaces
3. **fchdir()** b…
CWE: CWE-250
NVD
HIGH
CVE-2026-110167
CVE-2026-110167
Use after free in Media in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
CWE: CWE-416
NVD
HIGH
CVE-2026-110166
CVE-2026-110166
Buffer overflow in Animation in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
CWE: CWE-122
NVD
HIGH
CVE-2026-110164
CVE-2026-110164
Use after free in DOM in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
CWE: CWE-416
NVD
HIGH
CVE-2026-110163
CVE-2026-110163
Use after free in DOM in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
CWE: CWE-416
NVD
HIGH
CVE-2026-110162
CVE-2026-110162
Use after free in Desktop in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
CWE: CWE-416
NVD
HIGH
CVE-2026-110157
CVE-2026-110157
Use after free in SVG in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
CWE: CWE-416
NVD
HIGH
CVE-2026-110155
CVE-2026-110155
Buffer overflow in PDFium in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
CWE: CWE-122
NVD
HIGH
CVE-2026-110154
CVE-2026-110154
Use after free in Canvas in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
CWE: CWE-416
NVD
HIGH
CVE-2026-110153
CVE-2026-110153
Use after free in Media in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
CWE: CWE-416
NVD
HIGH
CVE-2026-110151
CVE-2026-110151
Use after free in Media in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Critical)
CWE: CWE-416
NVD
HIGH
CVE-2026-110148
CVE-2026-110148
Use after free in SVG in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Critical)
CWE: CWE-416
NVD
HIGH
CVE-2026-110147
CVE-2026-110147
Use after free in PDF in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
CWE: CWE-416
NVD
HIGH
CVE-2026-110140
CVE-2026-110140
Type confusion in V8 in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
CWE: CWE-843
NVD
HIGH
CVE-2026-110139
CVE-2026-110139
Use after free in Media in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
CWE: CWE-416
NVD
HIGH
CVE-2026-110137
CVE-2026-110137
Use after free in WebRTC in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
CWE: CWE-416
GitHub-GHSA
HIGH
Microsoft Security Advisory CVE-2026-70035 – .NET and Visual Studio Remote Code Execution Vulnerability
Microsoft Security Advisory CVE-2026-70035 – .NET and Visual Studio Remote Code Execution Vulnerability
## Executive summary
Microsoft is releasing this security advisory to provide information about a vulnerability in Microsoft.WindowsDesktop.App.Runtime (WPF). This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability.
Restrictive XAML …
CVE-2026-70035
GitHub-GHSA
HIGH
Microsoft Security Advisory CVE-2026-70007 – .NET and Visual Studio Remote Code Execution Vulnerability
Microsoft Security Advisory CVE-2026-70007 – .NET and Visual Studio Remote Code Execution Vulnerability
## Executive summary
Microsoft is releasing this security advisory to provide information about a vulnerability in Microsoft.WindowsDesktop.App.Runtime (WPF). This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability.
Crafted WPF pixel…
CVE-2026-70007
GitHub-GHSA
HIGH
Microsoft Security Advisory CVE-2026-87697 – .NET and Visual Studio Remote Code Execution Vulnerability
Microsoft Security Advisory CVE-2026-87697 – .NET and Visual Studio Remote Code Execution Vulnerability
## Executive summary
Microsoft is releasing this security advisory to provide information about a vulnerability in Microsoft.WindowsDesktop.App.Runtime (WPF). This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability.
WPF XPS synthetic…
CVE-2026-87697
GitHub-GHSA
HIGH
Microsoft Security Advisory CVE-2026-96230 – ASP.NET Core Remote Code Execution Vulnerability
Microsoft Security Advisory CVE-2026-96230 – ASP.NET Core Remote Code Execution Vulnerability
## Executive summary
Microsoft is releasing this security advisory to provide information about a vulnerability in Microsoft.AspNetCore.Components.WebAssembly.Server. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability.
The Blazo…
CVE-2026-96230
GitHub-GHSA
HIGH
Microsoft Security Advisory CVE-2026-96224 – .NET and Visual Studio Remote Code Execution Vulnerability
Microsoft Security Advisory CVE-2026-96224 – .NET and Visual Studio Remote Code Execution Vulnerability
## Executive summary
Microsoft is releasing this security advisory to provide information about a vulnerability in Microsoft.WindowsDesktop.App.Runtime (WPF). This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability.
Crafted WPF pixel…
CVE-2026-96224
GitHub-GHSA
HIGH
Microsoft Security Advisory CVE-2026-85363 – .NET and Visual Studio Remote Code Execution Vulnerability
Microsoft Security Advisory CVE-2026-85363 – .NET and Visual Studio Remote Code Execution Vulnerability
## Executive summary
Microsoft is releasing this security advisory to provide information about a vulnerability in Microsoft.WindowsDesktop.App.Runtime (WPF). This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability.
Attacker-controll…
CVE-2026-85363
GitHub-GHSA
HIGH
Microsoft Security Advisory CVE-2026-83520 – .NET and Visual Studio Remote Code Execution Vulnerability
Microsoft Security Advisory CVE-2026-83520 – .NET and Visual Studio Remote Code Execution Vulnerability
## Executive summary
Microsoft is releasing this security advisory to provide information about a vulnerability in Microsoft.WindowsDesktop.App.Runtime (WPF). This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability.
Restrictive XAML …
CVE-2026-83520
GitHub-GHSA
HIGH
Microsoft Security Advisory CVE-2026-70174 – .NET and Visual Studio Remote Code Execution Vulnerability
Microsoft Security Advisory CVE-2026-70174 – .NET and Visual Studio Remote Code Execution Vulnerability
## Executive summary
Microsoft is releasing this security advisory to provide information about a vulnerability in Microsoft.WindowsDesktop.App.Runtime (WPF). This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability.
WPF XPS hyperlink…
CVE-2026-70174
GitHub-GHSA
HIGH
Microsoft Security Advisory CVE-2026-96235 – .NET and Visual Studio Remote Code Execution Vulnerability
Microsoft Security Advisory CVE-2026-96235 – .NET and Visual Studio Remote Code Execution Vulnerability
## Executive summary
Microsoft is releasing this security advisory to provide information about a vulnerability in Microsoft.WindowsDesktop.App.Runtime (WPF). This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability.
Crafted WPF pixel…
CVE-2026-96235
GitHub-GHSA
HIGH
Microsoft Security Advisory CVE-2026-102870 – ASP.NET Core Remote Code Execution Vulnerability
Microsoft Security Advisory CVE-2026-102870 – ASP.NET Core Remote Code Execution Vulnerability
## Executive summary
Microsoft is releasing this security advisory to provide information about a vulnerability in the Blazor WebAssembly debugger included in `Microsoft.AspNetCore.Components.WebAssembly.Server`. This advisory also provides guidance on what developers can do to update their applica…
CVE-2026-102870
NVD
HIGH
CVE-2026-88157
CVE-2026-88157
Heap-based buffer overflow in OpenSSH for Windows allows an unauthorized attacker to execute code over a network.
CWE: CWE-122
NVD
HIGH
CVE-2026-83923
CVE-2026-83923
Relative path traversal in OpenSSH for Windows allows an unauthorized attacker to execute code over a network.
CWE: CWE-23
NVD
HIGH
CVE-2026-109428
CVE-2026-109428
Mistral Vibe before 2.25.5 contains a permission validation bypass vulnerability that allows attackers to execute unauthorized commands by exploiting a parsing discrepancy between tree-sitter-bash and bash in handling backslash-newline line continuations in the _extract_commands() function of bash.p…
CWE: CWE-436
NVD
HIGH
CVE-2026-102214
CVE-2026-102214
Use after free in Windows Hyper-V allows an authorized attacker to execute code locally.
CWE: CWE-416
NVD
HIGH
CVE-2026-100220
CVE-2026-100220
Heap-based buffer overflow in Windows Media Video Decoder allows an unauthorized attacker to execute code over a network.
CWE: CWE-122
NVD
HIGH
CVE-2026-108385
CVE-2026-108385
dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.38.0 through 0.70.5, BaseGenerator.parse_enum and EnumRepresentation.render_symbols use each schema-controlled enum symbol as a genera…
CWE: CWE-94
NVD
HIGH
CVE-2026-108384
CVE-2026-108384
dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.38.0 through 0.70.5, BaseGenerator.parse_fixed interpolates a fixed type's aliases value directly into a generated types.confixed anno…
CWE: CWE-94
NVD
HIGH
CVE-2026-108383
CVE-2026-108383
dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.38.0 through 0.70.5, FieldRepresentation.get_field_default renders a schema-controlled enum field default as an enum member reference …
CWE: CWE-94
NVD
HIGH
CVE-2026-108382
CVE-2026-108382
dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.38.0 through 0.70.5, EnumRepresentation.render_symbols concatenates each schema-controlled enum symbol between double quotes in a gene…
CWE: CWE-94
NVD
HIGH
CVE-2026-108381
CVE-2026-108381
dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.44.0 through 0.70.5, the Pydantic and AvroDantic model generators insert a schema field's pydantic-class value after pydantic. in a ge…
CWE: CWE-94
NVD
HIGH
CVE-2026-108380
CVE-2026-108380
dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.65.9 through 0.70.5, PydanticFieldRepresentation.add_field_properties inserts a schema field's doc value between the quotes of a gener…
CWE: CWE-94
NVD
HIGH
CVE-2026-108379
CVE-2026-108379
dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.38.0 through 0.70.5, BaseGenerator.parse_fixed inserts a fixed type's namespace value between quotes inside a generated types.confixed…
CWE: CWE-94
NVD
HIGH
CVE-2026-108378
CVE-2026-108378
dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.40.0 through 0.70.5, ClassRepresentation.render_docstring copies a schema record's doc value into a generated triple-double-quoted cla…
CWE: CWE-94
NVD
HIGH
CVE-2026-108377
CVE-2026-108377
dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.62.3 through 0.70.5, ClassRepresentation.render_metaclass inserts a schema-controlled Avro record name into the quoted Meta.schema_nam…
CWE: CWE-94
NVD
HIGH
CVE-2026-108376
CVE-2026-108376
dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.47.3 through 0.70.5, FieldRepresentation.get_field_default inserts a schema-controlled referenced record name into the callable positi…
CWE: CWE-94
NVD
HIGH
CVE-2026-108375
CVE-2026-108375
dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.38.0 through 0.70.5, FieldRepresentation.get_field_default inserts schema-controlled string, UUID, bytes, and fixed field defaults int…
CWE: CWE-94
NVD
HIGH
CVE-2026-55376
CVE-2026-55376
Heym builds and runs agentic systems and business-process automations on self-hosted infrastructure. Prior to 0.0.40, an authenticated user who can create or edit a workflow with an Agent custom Python tool can bypass the blacklist-based sandbox in backend/app/services/python_tool_executor.py becaus…
CWE: CWE-78, CWE-94, CWE-693
NVD
HIGH
CVE-2026-109652
CVE-2026-109652
Frappe ERPNext before 15.119.1 and 16.x before 16.32.0 contains a server-side template injection vulnerability because user-controlled message fields are not validated before template rendering, allowing expressions to run in an unrestricted context. Authenticated attackers holding a common operatio…
CWE: CWE-1336
NVD
HIGH
CVE-2026-84318
CVE-2026-84318
Nginx UI is a web user interface for the Nginx web server. From 2.0.0-rc.6 until 2.4.1, the MCP tool nginx_config_add writes nginx configuration files to disk and triggers an nginx reload without calling config.ValidateConfigFile. The identical flow in the REST API (POST /api/configs) does call that…
CWE: CWE-693
NVD
HIGH
CVE-2026-84317
CVE-2026-84317
Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, internal/config/validation.go (ValidateConfigFile) is a security control that blocks dangerous nginx directives — js_*, perl_*, load_module of the njs/perl modules, and user root. It is enforced on three of the four config-…
CWE: CWE-20, CWE-693
NVD
HIGH
CVE-2026-84316
CVE-2026-84316
Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, config.ValidateConfigDirectives splits configuration by newline and checks only the first directive token on each line even though Nginx permits multiple semicolon-separated directives on one line. An authenticated caller can…
CWE: CWE-20, CWE-184
NVD
HIGH
CVE-2026-84313
CVE-2026-84313
Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, POST /api/otp_enroll and POST /api/finish_passkey_register are registered outside RequireSecureSession and accept a normal authenticated session without verifying the current password. An attacker with a stolen JWT can bind a…
CWE: CWE-287, CWE-306
NVD
HIGH
CVE-2026-105464
CVE-2026-105464
IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 for Linux, UNIX and Windows (includes DB2 Connect Server) could allow a local attacker to gain elevated privileges due to improper privilege management.
CWE: CWE-269
NVD
HIGH
CVE-2026-77363
CVE-2026-77363
obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. Prior to 1.3.1, the Streamable HTTP transport does not validate the Host or Origin header or enable DNS-rebinding protection. When the documented loopback configuration uses auth.mode set to none, a malicious w…
CWE: CWE-346, CWE-1385
NVD
HIGH
CVE-2026-12613
CVE-2026-12613
Deserialization of untrusted data vulnerability in Ministry of Justice General Directorate of Information Technology UYAP Document Editor on Windows and Linux and Ministry of Justice General Directorate of Information Technology UYAP Document Editor on MacOS allows Object Injection.
This issue affe…
CWE: CWE-502
NVD
HIGH
CVE-2026-18537
CVE-2026-18537
IBM Maximo Application Suite – Location Service for Esri Component 9.2, 9.1, and 9.0 is vulnerable to improper input validation due to an unsanitised container image reference in a Kubernetes operator template.
CWE: CWE-94
NVD
HIGH
CVE-2026-18529
CVE-2026-18529
IBM Maximo Application Suite – Location Service for Esri Component 9.2, 9.1, and 9.0 is vulnerable to command injection due to improper sanitisation of a user-controlled value passed to a shell command in a Kubernetes operator task.
CWE: CWE-78
NVD
HIGH
CVE-2026-111633
CVE-2026-111633
ZKEACMS through 4.4 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge REST API JWT bearer tokens using a hard-coded HMAC-SHA256 signing key in JwtBearerDefaults.cs. Attackers can sign a token with the Name claim set to 'admin' to call ApiAuthorize endpoin…
CWE: CWE-321
NVD
HIGH
CVE-2026-110144
CVE-2026-110144
Incorrect authorization in Mojo in Google Chrome on on Windows prior to 155.0.8059.79 allowed a local attacker to potentially execute arbitrary code outside the sandbox via a local program. (Chromium security severity: High)
CWE: CWE-863
NVD
HIGH
CVE-2026-65172
CVE-2026-65172
NVIDIA AIStore for Linux and Kubernetes contains a missing authorization vulnerability in the ETL management API where an unauthenticated remote attacker may access ETL information or control existing ETL jobs by sending crafted GET or POST requests to an AIStore proxy.
A successful exploit may lea…
CWE: CWE-862
NVD
HIGH
CVE-2026-65170
CVE-2026-65170
NVIDIA AIStore for Linux contains a vulnerability in the experimental HT backend where an unauthenticated remote attacker may cause server-side request forgery by supplying a crafted original URL. A successful exploit of this vulnerability may lead to information disclosure.
CWE: CWE-918
NVD
HIGH
CVE-2026-65101
CVE-2026-65101
NVIDIA AIStore for Linux contains a vulnerability in the distributed sort component where an attacker could cause server-side request forgery by supplying a crafted external key map URL. A successful exploit of this vulnerability might lead to information disclosure.
CWE: CWE-918
NVD
HIGH
CVE-2026-65954
CVE-2026-65954
PHPCSUtils is a suite of utility functions for use with PHP_CodeSniffer. From 1.0.0-alpha1 until 1.2.3, PHPCSUtils\AbstractSniffs\AbstractArrayDeclarationSniff::getActualArrayKey() evaluates attacker-controlled array-key expressions with eval(), allowing callback-form keys in untrusted PHP code scan…
CWE: CWE-95
NVD
HIGH
CVE-2026-96626
CVE-2026-96626
Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to 2.5.0, UpdateRegistry and TestRegistry in backend/api/services/container_registry_service.go allow the registry URL to change while preserving the stored encrypted token. When a holder of registries:update…
CWE: CWE-200, CWE-522
NVD
HIGH
CVE-2026-92982
CVE-2026-92982
A flaw was found in Ansible Operator Plugins. A low-privileged Kubernetes user can exploit a Jinja2 template injection vulnerability by crafting malicious custom resource (CR) specification values. These values are processed by Ansible without proper sanitization, allowing embedded Jinja2 expression…
CWE: CWE-1336
NVD
HIGH
CVE-2026-50218
CVE-2026-50218
Akamai GPA (Guardicore Platform Agent) client on all platforms before 7.4 improperly validates JWT tokens used for seeding. By convincing a user to interact with a malicious link, an attacker can use a spoofed JWT token to inject arbitrary parameters into the client software, resulting in unauthoriz…
CWE: CWE-99
NVD
HIGH
CVE-2026-85952
CVE-2026-85952
Affected Linux-based Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain a server-side request forgery vulnerability that could allow an authenticated attacker to access internal cloud services, potentially resulting in unauthorized access to cloud credentia…
CWE: CWE-918
GitHub-GHSA
HIGH
Nginx UI OTP secure-session step-up is missing on sensitive mutation routes
Nginx UI OTP secure-session step-up is missing on sensitive mutation routes
Reporter: Jagadesh Achanta
Target: `0xJacky/nginx-ui`
Affected version / commit tested:
– App version: `2.3.10`
– Commit: `4948fba8744e82c3d7003f68ee164e9f49421066`
– Disclosure channel: GitHub Private Vulnerability Reporting
– Credential reference: `cred:github-jagstack-gh-cli`
## AI assistance …
CVE-2026-84315
GitHub-GHSA
HIGH
Nginx UI: MCP configuration tools bypass restricted directive validation and allow secondary authenticated users to execute NJS in Nginx worker context
Nginx UI: MCP configuration tools bypass restricted directive validation and allow secondary authenticated users to execute NJS in Nginx worker context
## Summary
The regular HTTP configuration API rejects restricted Nginx directives such as `load_module`, `js_import`, and `js_content`.
However, the MCP configuration interface allows a secondary authenticated user to write and apply equivalent restricted configuration content. In the lab, this al…
CVE-2026-84319
NVD
HIGH
CVE-2026-110158
CVE-2026-110158
Use after free in Passwords in Google Chrome prior to 155.0.8059.79 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
CWE: CWE-416
NVD
HIGH
CVE-2026-110156
CVE-2026-110156
Incorrect reference resolution in Extensions in Google Chrome on on Mac prior to 155.0.8059.79 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted Chrome extension. (Chromium security severity: High)
CWE: CWE-706
NVD
HIGH
CVE-2026-110145
CVE-2026-110145
Use after free in Passwords in Google Chrome prior to 155.0.8059.79 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
CWE: CWE-416
NVD
HIGH
CVE-2026-110138
CVE-2026-110138
Use after free in ShapeDetection in Google Chrome prior to 155.0.8059.79 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
CWE: CWE-416
NVD
HIGH
CVE-2026-78557
CVE-2026-78557
A vulnerability has been identified in Industrial Edge App Publisher (All versions < V1.27.9). The application fails to properly sanitize or escape data received from the backend before rendering it in the user interface. Because the front end is integrated with Node.js, this vulnerability allows fo…
CWE: CWE-79
NVD
HIGH
CVE-2026-84319
CVE-2026-84319
Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, the regular HTTP configuration API rejects restricted Nginx directives such as load_module, js_import, and js_content. However, the MCP configuration interface allows a secondary authenticated user to write and apply equivale…
CWE: CWE-693
NVD
HIGH
CVE-2026-84315
CVE-2026-84315
Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, Nginx UI does not apply RequireSecureSession to multiple authenticated mutation routes even though OTP-enabled users are expected to present a fresh X-Secure-Session-ID for sensitive actions. A stolen authenticated session ca…
CWE: CWE-862
NVD
HIGH
CVE-2026-49410
CVE-2026-49410
OpenHuman is an open-source agent harness available as a desktop application and Rust library. Versions before 0.56.0 allow cross-site request forgery against the unauthenticated GET /auth/telegram loopback callback because telegram_auth_handler consumes an attacker-supplied one-time Telegram login …
CWE: CWE-352, CWE-384
NVD
HIGH
CVE-2026-111639
CVE-2026-111639
bbs-go through 4.4.6 contains an authentication bypass vulnerability in the /api/login/google_one_tap endpoint that allows remote attackers to log in as other users by submitting Google ID tokens issued to any OAuth client. Attackers operating their own Google OAuth client can capture a victim's Goo…
CWE: CWE-287
NVD
HIGH
CVE-2026-111391
CVE-2026-111391
SGLang 0.5.10 through 0.5.22 contains a code injection vulnerability in _evaluate_filter() that allows remote attackers to execute Python code by escaping the eval() sandbox through re.search __globals__. Attackers can send a crafted filter expression to the unauthenticated /dumper/configure endpoin…
CWE: CWE-95
NVD
HIGH
CVE-2026-75903
CVE-2026-75903
The Vulnity Security plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 1.4.3 This is due to insufficient protection of the delegated-login pairing credential file on Nginx-based installations, where the plugin's generated server configuration snippet g…
CWE: CWE-287
GitHub-GHSA
HIGH
Nginx UI: OTP secure-session step-up can be bypassed via MCP configuration tools
Nginx UI: OTP secure-session step-up can be bypassed via MCP configuration tools
### Summary
An OTP-enabled authenticated user who cannot use the HTTP configuration mutation endpoints without a valid secure session can still mutate Nginx configuration through `/mcp` and `/mcp_message` using only ordinary authentication.
An OTP-enabled authenticated user who cannot use the HTTP configuration mutation endpoints without a valid secure session can still mutate Nginx configuration through `/mcp` and `/mcp_message` using only ordinary authentication.
### Details
The HTTP configuration mutation surface is exp…
CVE-2026-84360
NVD
HIGH
CVE-2026-104103
CVE-2026-104103
Ludwig is a low-code framework for building custom LLMs, neural networks, and other AI models. Prior to 0.17.8, ludwig.datasets.archives.extract_archive() validated tar member names before calling TarFile.extractall() but did not validate symlink members or hard-link members. A crafted archive could…
CWE: CWE-22, CWE-59
NVD
HIGH
CVE-2026-97205
CVE-2026-97205
NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_core_module module. When asynchronous file I/O (AIO) is enabled in certain configurations, processing a Server Side Includes (SSI) page containing “include virtual” commands may trigger a Use-After-Free (UAF) in the NGINX work…
CWE: CWE-416
NVD
HIGH
CVE-2026-93479
CVE-2026-93479
A vulnerability exists in NGINX Plus and NGINX Open Source when a map directive uses regex matching and the root directive or access log format references the map's regex capture variables before referencing the map output variable. Alternatively, the same result could be achieved by using a non-cac…
CWE: CWE-122
NVD
HIGH
CVE-2026-15176
CVE-2026-15176
A vulnerability exists in NGINX Plus and NGINX Open Source when a location is configured that uses the alias directive together with rewrite and a set or return directive referencing the $request_filename variable. Alternatively, the same result could be achieved when the $request_filename variable …
CWE: CWE-122
NVD
HIGH
CVE-2020-37281
CVE-2020-37281
Gravitee API Management through 4.12.22 contains an authentication bypass vulnerability that allows unauthenticated remote attackers to impersonate any user by forging JWTs signed with the shipped default jwt.secret. Attackers knowing an existing user ID can sign an HS256 token with that subject and…
CWE: CWE-1394
NVD
HIGH
CVE-2026-92392
CVE-2026-92392
During an upload, curl mishandles HTTP/2 `RST_STREAM` received from the server
(with reason `HTTP_1_1_REQUIRED` or `REFUSED_STREAM`) leading to a use after
free of a `struct Curl_easy` object.
(with reason `HTTP_1_1_REQUIRED` or `REFUSED_STREAM`) leading to a use after
free of a `struct Curl_easy` object.
CWE: CWE-416
GitHub-GHSA
HIGH
Microsoft Security Advisory CVE-2026-70197 – .NET and Visual Studio Remote Code Execution Vulnerability
Microsoft Security Advisory CVE-2026-70197 – .NET and Visual Studio Remote Code Execution Vulnerability
## Executive summary
Microsoft is releasing this security advisory to provide information about a vulnerability in System.Net.Sockets. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability.
On Windows, reusing a `SocketAsyncEventAr…
CVE-2026-70197
GitHub-GHSA
HIGH
Microsoft Security Advisory CVE-2026-70175 – ASP.NET Core Elevation of Privilege Vulnerability
Microsoft Security Advisory CVE-2026-70175 – ASP.NET Core Elevation of Privilege Vulnerability
## Executive summary
Microsoft is releasing this security advisory to provide information about a vulnerability in Microsoft.AspNetCore.Identity and Microsoft.AspNetCore.Identity.UI. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerabi…
CVE-2026-70175
NVD
HIGH
CVE-2026-110097
CVE-2026-110097
Ikaros 1.2.0 through 1.2.5 contains an authentication bypass vulnerability that allows attackers with a valid password to skip TOTP verification by reusing the login temp token. Attackers can present the temp token from the jwt/apply endpoint as a bearer JWT, refresh it, or use HTTP Basic login to g…
CWE: CWE-287
NVD
HIGH
CVE-2026-65164
CVE-2026-65164
NVIDIA AIStore for Linux contains a path traversal vulnerability in the dSort archive extraction component where a remote attacker may cause an improper limitation of a pathname to a restricted directory by supplying crafted archive member names to a dSort job. A successful exploit may lead to arbit…
CWE: CWE-22
NVD
HIGH
CVE-2026-65103
CVE-2026-65103
NVIDIA AIStore for Linux contains a path traversal vulnerability in the target-side object rename handler, where an unauthenticated remote attacker could cause an improper limitation of a pathname to a restricted directory by submitting a crafted rename destination directly to an AIStore target, res…
CWE: CWE-22
NVD
HIGH
CVE-2026-84360
CVE-2026-84360
Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, the HTTP configuration mutation routes require RequireSecureSession, but /mcp and /mcp_message require only ordinary authentication before exposing nginx_config_add and nginx_config_modify. An OTP-enabled user with a normal J…
CWE: CWE-288
NVD
HIGH
CVE-2020-37279
CVE-2020-37279
easy-pdf-merge 0.1.0 through 0.2.6 contains an OS command injection vulnerability that allows attackers to execute commands by injecting shell metacharacters into source paths, destination path, or maxHeap option. Attackers can supply file names or options containing double quotes, semicolons, $() o…
CWE: CWE-78
NVD
HIGH
CVE-2026-109422
CVE-2026-109422
NetEase Cloud Music client for Windows (cloudmusic.exe) versions 3.1.38 and 3.1.39.205426 contains a remote code execution vulnerability in the renderer-process IPC bridge os.navigateExternal, which passes caller-supplied URLs to ShellExecuteW without validating the URL scheme. An attacker able to i…
CWE: CWE-749
NVD
HIGH
CVE-2026-109286
CVE-2026-109286
Open WebUI from 0.7.0 before 0.11.4 contains a cross-origin message handling vulnerability in SyncStatsModal that allows any website to steal a signed-in user's session token by posting unvalidated verify:chat messages. Attackers can supply a path-traversal chat id redirecting the authenticated stat…
CWE: CWE-346
NVD
HIGH
CVE-2026-109237
CVE-2026-109237
Crawl4AI from 0.9.0 before 0.9.4 contains an untrusted-config gate bypass that allows non-admin API clients to construct forbidden config objects by wrapping them in dict-type wrappers. Attackers can send a laundered LLMConfig with api_token set to an env reference via /config/dump to read SECRET_KE…
CWE: CWE-502
NVD
HIGH
CVE-2026-79824
CVE-2026-79824
A directory traversal vulnerability in HPE NonStop Python 3.x could allow attackers to overwrite arbitrary files via a .. (dot dot) sequence in filenames in a TAR archive.
CWE: CWE-30
NVD
HIGH
CVE-2023-32198
CVE-2023-32198
A vulnerability has been identified in Steve where by default it was using an insecure option that did not validate the certificate presented by the remote server while performing a TLS connection. This could allow the execution of a man-in-the-middle (MitM) attack against services using Steve.
CWE: CWE-295
NVD
HIGH
CVE-2026-105429
CVE-2026-105429
Improper neutralization of special elements in the NetBird client SSH configuration manager (client/ssh/config/manager.go) in NetBird versions 0.60.0 through 0.74.6 allows a malicious or compromised peer to execute arbitrary commands on other NetBird client hosts. The client writes a system-wide Ope…
CWE: CWE-78, CWE-116
GitHub-GHSA
HIGH
containerd CRI plugin: Checkpoint restore bypasses destination security context
containerd CRI plugin: Checkpoint restore bypasses destination security context
### Impact
A vulnerability in containerd's CRI implementation allows a container restored from an untrusted checkpoint via the `CreateContainer` API to bypass the destination security context and execute with elevated privileges. When restoring a container from a checkpoint archive or annotated OCI…
CVE-2026-95837
GitHub-GHSA
HIGH
mise permits untrusted local configuration to override default shell arguments
mise permits untrusted local configuration to override default shell arguments
## Summary
Untrusted local .mise.toml [settings] can set the shell interpreter args (unix/windows default_inline / default_file shell_args), yielding arbitrary command execution, because those command-interpreter settings were not added to the global_only denylist the CVE-2026-55448 fix relies on. …
CVE-2026-103929
NVD
HIGH
CVE-2026-103929
CVE-2026-103929
mise manages dev tools like node, python, cmake, and terraform. Prior to 2026.7.14, in the default non-safe mode, mise loads .mise.toml [settings] from an untrusted local project before trust approval and strip_local_only_settings removes only fields marked global_only. The unix_default_file_shell_a…
CWE: CWE-78, CWE-284
NVD
HIGH
CVE-2026-110648
CVE-2026-110648
@offactory/compress-fonts before 1.1.1 contains an OS command injection vulnerability that allows attackers to execute shell commands by supplying font files with crafted names. Font paths are interpolated unquoted into a FontForge command run through child_process.execSync, so shell metacharacters …
CWE: CWE-78
GitHub-GHSA
HIGH
Microsoft Security Advisory CVE-2026-96225 – .NET and Visual Studio Elevation of Privilege Vulnerability
Microsoft Security Advisory CVE-2026-96225 – .NET and Visual Studio Elevation of Privilege Vulnerability
## Executive summary
Microsoft is releasing this security advisory to provide information about a vulnerability in Microsoft.NETCore.App.Runtime; System.Private.CoreLib. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability.
Unix n…
CVE-2026-96225
GitHub-GHSA
HIGH
Microsoft Security Advisory CVE-2026-96231 – .NET and Visual Studio Elevation of Privilege Vulnerability
Microsoft Security Advisory CVE-2026-96231 – .NET and Visual Studio Elevation of Privilege Vulnerability
## Executive summary
Microsoft is releasing this security advisory to provide information about a vulnerability in Microsoft.NETCore.App.Runtime; System.Private.CoreLib. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability.
Unix n…
CVE-2026-96231
NVD
HIGH
CVE-2026-97811
CVE-2026-97811
Double free in OpenSSH for Windows allows an authorized attacker to elevate privileges locally.
CWE: CWE-400, CWE-415
NVD
HIGH
CVE-2026-96309
CVE-2026-96309
Use after free in Windows Subsystem for Linux allows an authorized attacker to elevate privileges locally.
CWE: CWE-416
NVD
HIGH
CVE-2026-85864
CVE-2026-85864
Improper privilege management in Python allows an authorized attacker to elevate privileges locally.
CWE: CWE-641
NVD
HIGH
CVE-2026-83769
CVE-2026-83769
Use after free in OpenSSH for Windows allows an authorized attacker to elevate privileges locally.
CWE: CWE-416
NVD
HIGH
CVE-2026-70027
CVE-2026-70027
Heap-based buffer overflow in Windows Subsystem for Linux allows an authorized attacker to elevate privileges locally.
CWE: CWE-122
NVD
HIGH
CVE-2026-102220
CVE-2026-102220
Use after free in Windows VHD miniport driver allows an authorized attacker to elevate privileges locally.
CWE: CWE-416
NVD
HIGH
CVE-2026-102218
CVE-2026-102218
Heap-based buffer overflow in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to elevate privileges locally.
CWE: CWE-122
NVD
HIGH
CVE-2026-102216
CVE-2026-102216
Access of resource using incompatible type ('type confusion') in Windows StateRepository API allows an authorized attacker to elevate privileges locally.
CWE: CWE-843
NVD
HIGH
CVE-2026-102215
CVE-2026-102215
Heap-based buffer overflow in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to elevate privileges locally.
CWE: CWE-122
NVD
HIGH
CVE-2026-102205
CVE-2026-102205
Heap-based buffer overflow in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to elevate privileges locally.
CWE: CWE-122
NVD
HIGH
CVE-2026-102202
CVE-2026-102202
Improper access control in Windows Container Isolation FS Filter Driver (unionfs.sys) allows an authorized attacker to elevate privileges locally.
CWE: CWE-59
NVD
HIGH
CVE-2026-102201
CVE-2026-102201
Use after free in Microsoft Windows Media Foundation allows an authorized attacker to elevate privileges locally.
CWE: CWE-416
NVD
HIGH
CVE-2026-102196
CVE-2026-102196
Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally.
CWE: CWE-416
NVD
HIGH
CVE-2026-100217
CVE-2026-100217
Improper privilege management in Windows Group Policy allows an authorized attacker to elevate privileges locally.
CWE: CWE-862
NVD
HIGH
CVE-2026-101020
CVE-2026-101020
An incorrect permission assignment for critical resource issue exists in AssetView, AssetView CLOUD, and AssetView Cloud +. If this vulnerability is exploited, a local authenticated attacker who can log in to the Windows system where Management Console or Client Terminal for the product is running m…
CWE: CWE-732
NVD
HIGH
CVE-2026-109358
CVE-2026-109358
Edgeless Systems Contrast 1.8.0 before 1.24.1 contains an incorrect permissions vulnerability where the node installer writes the containerd config world-writable (0666). Local unprivileged users on the node can modify the containerd config, for example overwriting the runc location, to escalate pri…
CWE: CWE-732
NVD
HIGH
CVE-2026-18390
CVE-2026-18390
Improper neutralization of special elements used in an OS command ('OS command injection') vulnerability in Ministry of Justice General Directorate of Information Technology UYAP Document Editor on Windows and Linux and Ministry of Justice General Directorate of Information Technology UYAP Document …
CWE: CWE-78
GitHub-GHSA
HIGH
FrankenPHP: Cross-request PHP session ID leak in worker mode when the session extension is a shared module
FrankenPHP: Cross-request PHP session ID leak in worker mode when the session extension is a shared module
## Summary
In worker mode under concurrency, FrankenPHP can hand a PHP session id from one request to another when PHP's `session` extension is loaded as a shared module instead of being statically linked into the FrankenPHP binary. A request presenting `Cookie: session=A` can have `session_id()` re…
In worker mode under concurrency, FrankenPHP can hand a PHP session id from one request to another when PHP's `session` extension is loaded as a shared module instead of being statically linked into the FrankenPHP binary. A request presenting `Cookie: session=A` can have `session_id()` re…
CVE-2026-82416
NVD
HIGH
CVE-2026-53999
CVE-2026-53999
Radius is a cloud-native, portable application platform that makes app development easier for teams building cloud-native apps. Prior to 0.58.0, the Kubernetes controller deserializes the user-controlled radapp.io/status annotation on a Deployment and uses its container resource identifier for delet…
CWE: CWE-20, CWE-441
NVD
HIGH
CVE-2026-14765
CVE-2026-14765
Epic Games Unreal Engine versions up to and including 5.8.0 ship with an insecure default configuration for the LaunchURL Blueprint node (UKismetSystemLibrary::LaunchURL). The URL scheme filter (FURLRequestFilter) is empty by default, which permits all URL schemes. On Windows, this results in a call…
CWE: CWE-1188
NVD
HIGH
CVE-2026-82416
CVE-2026-82416
FrankenPHP is a modern application server for PHP. Prior to 1.12.5, FrankenPHP worker mode can retain PHP session state between requests when the session extension is loaded as a shared module and is unavailable through HAVE_PHP_SESSION at compile time. In this build configuration, frankenphp_reset_…
CWE: CWE-362, CWE-488
NVD
HIGH
CVE-2026-18517
CVE-2026-18517
IBM Maximo Application Suite – Location Service for Esri Component 9.2, 9.1, and 9.0 IBM Maximo Application Suite — Location Service for Esri Component is vulnerable to unintended network egress due to a misconfigured Kubernetes NetworkPolicy.
CWE: CWE-284
NVD
HIGH
CVE-2026-18166
CVE-2026-18166
IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 for Linux, UNIX and Windows (includes DB2 Connect Server) could allow a remote authenticated attacker to obtain sensitive information due to improper authorization when using the CREATE WRAPPER command.
CWE: CWE-284
NVD
HIGH
CVE-2026-53574
CVE-2026-53574
EspoCRM is an open source customer relationship management application. From 8.1.0 until 9.3.8, an authenticated non-administrator can submit a crafted where parameter to the GET entity streamAttachments endpoint because that query path permits complex expressions. Boolean-based blind SQL injection …
CWE: CWE-89
NVD
HIGH
CVE-2026-112082
CVE-2026-112082
A vulnerability was identified in sgl-project SGLang up to 0.5.19. This impacts the function Scheduler.expert_distribution_handle of the file python/sglang/srt/eplb/expert_distribution.py of the component Expert-Distribution Recording Endpoint. Such manipulation leads to denial of service. It is pos…
CWE: CWE-404
GitHub-GHSA
HIGH
lopdf has a stack overflow via deeply nested PDF objects
lopdf has a stack overflow via deeply nested PDF objects
`lopdf::Document::load_mem` (and the other `load*` entry points) parses nested PDF arrays and dictionaries with unbounded recursion. A small crafted PDF whose Catalog contains a deeply nested array (`/X [[[ … ]]]`, on the order of 10,000 levels) exhausts the call stack and aborts the process with …
GitHub-GHSA
HIGH
JavaCV: Integer Overflow in IPCameraFrameGrabber Causes Infinite-Loop DoS
JavaCV: Integer Overflow in IPCameraFrameGrabber Causes Infinite-Loop DoS
### Summary
`IPCameraFrameGrabber` parses the `Content-Length` value from the multipart MJPEG HTTP stream returned by the configured IP camera without any bounds checking. A malicious or compromised camera endpoint – or any network attacker able to tamper with the plaintext HTTP response (these stre…
`IPCameraFrameGrabber` parses the `Content-Length` value from the multipart MJPEG HTTP stream returned by the configured IP camera without any bounds checking. A malicious or compromised camera endpoint – or any network attacker able to tamper with the plaintext HTTP response (these stre…
CVE-2026-102834
GitHub-GHSA
HIGH
gomarkdown/markdown IsSafeURL panics on short URLs
gomarkdown/markdown IsSafeURL panics on short URLs
## Summary
IsSafeURL slices url[:nPath] before checking that len(url) >= nPath, so a URL shorter than a path prefix (0, 1 or 2 bytes) triggers a slice-bounds panic, and this is reached end to end when the html.Safelink hardening flag is enabled and the input contains an empty or very short link des…
CVE-2026-102941
NVD
HIGH
CVE-2026-92766
CVE-2026-92766
The Vitepos – Point of Sale (POS) for WooCommerce plugin for WordPress is vulnerable to generic SQL Injection via the 'src_by' parameter in all versions up to, and including, 3.5.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL qu…
CWE: CWE-89
NVD
HIGH
CVE-2026-111378
CVE-2026-111378
FreeRDP from 3.0.0 before 3.32.0 contains an uncontrolled resource consumption vulnerability in parse_nla_mode_pdu that allows unauthenticated attackers to exhaust server memory. Attackers can complete TLS and stream bytes not beginning with the DER SEQUENCE tag 0x30, causing unbounded receive buffe…
CWE: CWE-400
GitHub-GHSA
HIGH
kin-openapi: Incomplete Fix for GHSA-p6wj-qrr4-pgh5: Three Unpatched nil-Items Panic Paths in openapi3filter
kin-openapi: Incomplete Fix for GHSA-p6wj-qrr4-pgh5: Three Unpatched nil-Items Panic Paths in openapi3filter
## Summary
The fix for GHSA-p6wj-qrr4-pgh5 addressed a nil-pointer dereference that occurs when an OpenAPI 3.1 array schema omits the `items` keyword (which is legal under JSON Schema 2020-12). That fix patched three decoder paths: the standalone `parseArray` function, the top-level array check in …
CVE-2026-100353
GitHub-GHSA
HIGH
kin-openapi: Uncontrolled Recursion on Circular allOf/anyOf/oneOf Schemas Causes Fatal Process Crash
kin-openapi: Uncontrolled Recursion on Circular allOf/anyOf/oneOf Schemas Causes Fatal Process Crash
## Summary
kin-openapi's spec loader and spec-time validator both handle circular schema references safely: the loader resolves circular `$ref`s on purpose (to support recursive data structures), and `Schema.validate()` uses stack-based cycle detection. `Validate()` therefore accepts a schema whose…
CVE-2026-100354
GitHub-GHSA
HIGH
kin-openapi: YAML NaN/Inf Values Bypass Built-in Guards and Panic via OAS 3.1 Validation Path
kin-openapi: YAML NaN/Inf Values Bypass Built-in Guards and Panic via OAS 3.1 Validation Path
## Summary
kin-openapi guards against `NaN` and `Inf` values in its built-in schema visitor (`visitJSON`) by returning `ErrSchemaInputNaN` / `ErrSchemaInputInf` when a `float64` input violates those constraints. For OAS 3.1 specs, however, `Schema.VisitJSON` routes through `useJSONSchema2020`, whic…
CVE-2026-100352
GitHub-GHSA
HIGH
OpenNext Cloudflare: Cache interception can bypass middleware protection for encoded paths
OpenNext Cloudflare: Cache interception can bypass middleware protection for encoded paths
## Summary
When cache interception is enabled, `@opennextjs/cloudflare` can interpret percent-encoded paths differently during middleware matching and cache lookup.
An encoded request may fail to match authorization middleware, then be decoded into the cache key of a protected route. The cached re…
CVE-2026-100409
GitHub-GHSA
HIGH
kin-openapi: Nil-pointer dereference panic in openapi3filter for OpenAPI 3.1 array schemas missing items
kin-openapi: Nil-pointer dereference panic in openapi3filter for OpenAPI 3.1 array schemas missing items
### Summary
A nil-pointer dereference in `openapi3filter` lets any unauthenticated client crash a request handler with a single HTTP request against an OpenAPI **3.1** operation that declares `type: array` **without** `items`. OpenAPI 3.1 (JSON Schema 2020-12) permits omitting `items`, and `doc.Val…
CVE-2026-97394
GitHub-GHSA
HIGH
Junrar: RarVM VM_JMP maxOpCount bypass causes infinite CPU loop during RAR4 extraction
Junrar: RarVM VM_JMP maxOpCount bypass causes infinite CPU loop during RAR4 extraction
### Summary
Junrar's RAR virtual machine can be forced into a deterministic infinite loop while extracting a crafted RAR4 archive. The `RarVM.ExecuteCode` loop is intended to be bounded by `maxOpCount`, but jump instructions can bypass this limit when `setIP()` is called with a target instruction p…
CVE-2026-97370
NVD
HIGH
CVE-2026-87018
CVE-2026-87018
undici is an HTTP client library for Node.js. In versions 4.2.1 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1, the client process crashes when a TLS 1.2 server renegotiates after the connection is established and presents a different, CA-trusted certificate whose hostname does not m…
CWE: CWE-248, CWE-617
NVD
HIGH
CVE-2026-104827
CVE-2026-104827
react/http is an event-driven, streaming HTTP client and server implementation for ReactPHP. From 1.0.0 until 1.11.1, React\Http\Browser uses ClientRequestStream::handleData() to append response-header bytes to an internal buffer without enforcing a size limit. A remote server can send a valid statu…
CWE: CWE-770
NVD
HIGH
CVE-2026-110869
CVE-2026-110869
Nodemailer 3.0.0 before 10.0.13 has a regular expression denial of service in SMTPConnection._actionEHLO, whose four AUTH mechanism detection regexes contain overlapping whitespace sub-patterns that backtrack quadratically. A malicious or man-in-the-middle SMTP server can reply to EHLO with 250-AUTH…
CWE: CWE-1333
NVD
HIGH
CVE-2026-110856
CVE-2026-110856
GitPython before 3.2.0 contains a regular expression denial of service vulnerability in the _re_actor_epoch pattern used by parse_actor_and_date on author, committer, and tagger lines. Attackers can serve repositories with commit or tag objects containing long space-filled lines lacking a valid epoc…
CWE: CWE-1333
NVD
HIGH
CVE-2026-110838
CVE-2026-110838
FreeRDP shadow server from 3.0.0 before 3.32.0 dispatches input PDUs during the Confirm Active state before authentication, allowing unauthenticated attackers to inject keyboard input. Attackers can negotiate TLS-only RDP and send an input PDU without Confirm Active to inject synthetic keystrokes in…
CWE: CWE-306
GitHub-GHSA
HIGH
Microsoft.OpenApi.YamlReader vulnerable to denial of service via YAML alias expansion
Microsoft.OpenApi.YamlReader vulnerable to denial of service via YAML alias expansion
### Impact
A small YAML OpenAPI document containing nested anchors and aliases can cause uncontrolled resource consumption in Microsoft.OpenApi.YamlReader and Microsoft.OpenApi.Readers. The issue affects OpenAPI document parsing through the public YAML reader APIs and can cause the parsing process …
CVE-2026-72923
NVD
HIGH
CVE-2026-73260
CVE-2026-73260
Mongoose is an embedded web server and network library. Prior to 7.23, the built-in TLS certificate parser selected by MG_TLS_BUILTIN fails to verify that a long-form DER element length fits within the remaining certificate buffer. In mg_der_to_tlv() and mg_der_next(), a peer-controlled length can a…
CWE: CWE-125
NVD
HIGH
CVE-2026-73252
CVE-2026-73252
Mongoose is an embedded web server and network library. Prior to 7.23, the built-in TLS stack selected by MG_TLS_BUILTIN in src/tls_builtin.c accepts a TLS 1.3 record whose decrypted size is exactly the 16-byte authentication tag with no plaintext or ContentType byte. In mg_tls_recv_record(), the ms…
CWE: CWE-125, CWE-191
NVD
HIGH
CVE-2026-54554
CVE-2026-54554
FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to 1.5.10.1870, the management adInfo() endpoint in packages/web/lib/fog/fogpage.class.php was reported to return the FOG_AD_DEFAULT_PASSWORD value in its domainpass JSON field and to be dispatchable through no…
CWE: CWE-200
NVD
HIGH
CVE-2026-109527
CVE-2026-109527
The Model Context Protocol Python SDK is the official Python SDK for Model Context Protocol servers and clients. In mcp versions before 1.29.1 and from 2.0.0a1 through 2.0.1, the Streamable HTTP session manager, SSE message endpoint, and OAuth authorization-server routes buffer complete HTTP request…
CWE: CWE-770
NVD
HIGH
CVE-2026-94197
CVE-2026-94197
An authentication and authorization bypass vulnerability exists in F5 NGINX Kubernetes Ingress Controller (NIC) when configured with the `ExternalAuth` policy or Ingress external authentication. Client-supplied X-Forwarded-Prefix, X-Forwarded-URI, X-Original-URI, and X-Forwarded-Method routing and m…
CWE: CWE-290
NVD
HIGH
CVE-2026-110623
CVE-2026-110623
Papermerge Core through 3.5.3 contains a missing authorization vulnerability in the shared nodes API that allows authenticated users to share other users' documents by supplying arbitrary node UUIDs. Attackers can call POST /shared-nodes or PATCH /shared-nodes/access/{node_id} to grant themselves an…
CWE: CWE-862
NVD
HIGH
CVE-2026-104939
CVE-2026-104939
Description
NGINX Ingress Controller has a vulnerability when implementing an externalAuth policy for ingress. NGINX Ingress Controller may mishandle the HTTP response from an OAuth IdP and allow an attacker to acquire unauthenticated access to protected paths before the proper external authenticati…
NGINX Ingress Controller has a vulnerability when implementing an externalAuth policy for ingress. NGINX Ingress Controller may mishandle the HTTP response from an OAuth IdP and allow an attacker to acquire unauthenticated access to protected paths before the proper external authenticati…
CWE: CWE-303
NVD
HIGH
CVE-2026-110449
CVE-2026-110449
Nix before 2.35.3 and Lix before 2.95.4 have an integer overflow and resultant out-of-bounds write when evaluating untrusted expressions because list allocation is mishandled.
CWE: CWE-190
GitHub-GHSA
HIGH
Microsoft Security Advisory CVE-2026-70186 – ASP.NET Core Denial of Service Vulnerability
Microsoft Security Advisory CVE-2026-70186 – ASP.NET Core Denial of Service Vulnerability
## Executive summary
Microsoft is releasing this security advisory to provide information about a vulnerability in Microsoft.AspNetCore.Server.Kestrel.Core. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability.
An unauthenticated …
CVE-2026-70186
GitHub-GHSA
HIGH
Microsoft Security Advisory CVE-2026-70179 – ASP.NET Core Elevation of Privilege Vulnerability
Microsoft Security Advisory CVE-2026-70179 – ASP.NET Core Elevation of Privilege Vulnerability
## Executive summary
Microsoft is releasing this security advisory to provide information about a vulnerability in Microsoft.AspNetCore.Authentication.Negotiate. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability.
ASP.NET Core N…
CVE-2026-70179
GitHub-GHSA
HIGH
Microsoft Security Advisory CVE-2026-96959 – .NET and Visual Studio Denial of Service Vulnerability
Microsoft Security Advisory CVE-2026-96959 – .NET and Visual Studio Denial of Service Vulnerability
## Executive summary
Microsoft is releasing this security advisory to provide information about a vulnerability in System.Security.Cryptography.Xml; System.Private.Xml. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability.
Signed …
CVE-2026-96959
GitHub-GHSA
HIGH
Microsoft Security Advisory CVE-2026-96232 – .NET and Visual Studio Information Disclosure Vulnerability
Microsoft Security Advisory CVE-2026-96232 – .NET and Visual Studio Information Disclosure Vulnerability
## Executive summary
Microsoft is releasing this security advisory to provide information about a vulnerability in Microsoft.WindowsDesktop.App.Runtime (WPF). This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability.
Restrictive XAML …
CVE-2026-96232
GitHub-GHSA
HIGH
Microsoft Security Advisory CVE-2026-96236 – ASP.NET Core Denial of Service Vulnerability
Microsoft Security Advisory CVE-2026-96236 – ASP.NET Core Denial of Service Vulnerability
## Executive summary
Microsoft is releasing this security advisory to provide information about a vulnerability in Microsoft.AspNetCore.Localization. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability.
ASP.NET Core request-local…
CVE-2026-96236
GitHub-GHSA
HIGH
Microsoft Security Advisory CVE-2026-69651 – .NET and Visual Studio Denial of Service Vulnerability
Microsoft Security Advisory CVE-2026-69651 – .NET and Visual Studio Denial of Service Vulnerability
## Executive summary
Microsoft is releasing this security advisory to provide information about a vulnerability in System.Security.Cryptography.Xml; System.Private.Xml. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability.
Signed …
CVE-2026-69651
GitHub-GHSA
HIGH
Microsoft Security Advisory CVE-2026-96960 – .NET and Visual Studio Denial of Service Vulnerability
Microsoft Security Advisory CVE-2026-96960 – .NET and Visual Studio Denial of Service Vulnerability
## Executive summary
Microsoft is releasing this security advisory to provide information about a vulnerability in System.Security.Cryptography.Xml; System.Private.Xml. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability.
Signed …
CVE-2026-96960
GitHub-GHSA
HIGH
Microsoft Security Advisory CVE-2026-96233 – .NET and Visual Studio Denial of Service Vulnerability
Microsoft Security Advisory CVE-2026-96233 – .NET and Visual Studio Denial of Service Vulnerability
## Executive summary
Microsoft is releasing this security advisory to provide information about a vulnerability in System.Runtime. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability.
DateTime Hebrew-number parsing can read outsi…
CVE-2026-96233
GitHub-GHSA
HIGH
Microsoft Security Advisory CVE-2026-96958 – .NET and Visual Studio Denial of Service Vulnerability
Microsoft Security Advisory CVE-2026-96958 – .NET and Visual Studio Denial of Service Vulnerability
## Executive summary
Microsoft is releasing this security advisory to provide information about a vulnerability in System.Security.Cryptography.Xml; System.Private.Xml. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability.
Signed …
CVE-2026-96958
GitHub-GHSA
HIGH
Microsoft Security Advisory CVE-2026-84008 – .NET Denial of Service Vulnerability
Microsoft Security Advisory CVE-2026-84008 – .NET Denial of Service Vulnerability
## Executive summary
Microsoft is releasing this security advisory to provide information about a vulnerability in System.Security.Cryptography.Pkcs. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability.
`SignedCms.CheckSignature`…
CVE-2026-84008
GitHub-GHSA
HIGH
Microsoft Security Advisory CVE-2026-58280 – .NET and Visual Studio Denial of Service Vulnerability
Microsoft Security Advisory CVE-2026-58280 – .NET and Visual Studio Denial of Service Vulnerability
## Executive summary
Microsoft is releasing this security advisory to provide information about a vulnerability in System.Security.Cryptography.Xml and System.Private.Xml. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability.
Sign…
CVE-2026-58280
GitHub-GHSA
HIGH
Microsoft Security Advisory CVE-2026-70183 – ASP.NET Core Security Feature Bypass Vulnerability
Microsoft Security Advisory CVE-2026-70183 – ASP.NET Core Security Feature Bypass Vulnerability
## Executive summary
Microsoft is releasing this security advisory to provide information about a vulnerability in Microsoft.AspNetCore.Components.Authorization. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability.
A stale asynch…
CVE-2026-70183
GitHub-GHSA
HIGH
Microsoft Security Advisory CVE-2026-70181 – ASP.NET Core Denial of Service Vulnerability
Microsoft Security Advisory CVE-2026-70181 – ASP.NET Core Denial of Service Vulnerability
## Executive summary
Microsoft is releasing this security advisory to provide information about a vulnerability in Microsoft.AspNetCore.WebUtilities. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability.
FileBufferingReadStream ea…
CVE-2026-70181
GitHub-GHSA
HIGH
Microsoft Security Advisory CVE-2026-70159 – ASP.NET Core Denial of Service Vulnerability
Microsoft Security Advisory CVE-2026-70159 – ASP.NET Core Denial of Service Vulnerability
## Executive summary
Microsoft is releasing this security advisory to provide information about a vulnerability in Microsoft.AspNetCore.SignalR.Common and Microsoft.AspNetCore.SignalR.Core. This advisory also provides guidance on what developers can do to update their applications to remove this vu…
CVE-2026-70159
NVD
HIGH
CVE-2026-83754
CVE-2026-83754
Heap-based buffer overflow in OpenSSH for Windows allows an unauthorized attacker to execute code over a network.
CWE: CWE-122
NVD
HIGH
CVE-2026-70163
CVE-2026-70163
Allocation of resources without limits or throttling in OpenSSH for Windows allows an unauthorized attacker to deny service over a network.
CWE: CWE-770
NVD
HIGH
CVE-2026-102599
CVE-2026-102599
Socket.IO enables bidirectional and low-latency communication for every platform. From Engine.IO 6.6.0 until 6.6.10, a transport upgrade can independently derive an Engine.IO protocol revision from the upgrade request instead of enforcing the revision stored on the existing session. A malicious clie…
CWE: CWE-248
NVD
HIGH
CVE-2026-102192
CVE-2026-102192
Integer underflow (wrap or wraparound) in Windows Failover Cluster allows an unauthorized attacker to deny service over a network.
CWE: CWE-191
NVD
HIGH
CVE-2026-110102
CVE-2026-110102
Powerlevel10k through 1.20.0 contains an insecure download vulnerability in the gitstatus/install script that disables TLS certificate verification with curl -k and skips integrity checks when no SHA-256 utility exists. Network-positioned attackers can intercept the github.com mirror request and sub…
CWE: CWE-494
NVD
HIGH
CVE-2026-65161
CVE-2026-65161
NVIDIA AIStore for Linux contains a vulnerability in the Promote API where an unauthenticated remote attacker may read files accessible to the target process by supplying a crafted absolute source path. A successful exploit may lead to information disclosure.
CWE: CWE-22
NVD
HIGH
CVE-2026-109832
CVE-2026-109832
A flaw was found in gnome-remote-desktop as shipped in Red Hat Enterprise Linux. In the VNC TLS I/O handlers, retryable GnuTLS results (GNUTLS_E_AGAIN and GNUTLS_E_INTERRUPTED) are handled with an unbounded busy loop instead of yielding to the event loop. A remote attacker who can reach an enabled V…
CWE: CWE-835
NVD
HIGH
CVE-2026-109563
CVE-2026-109563
N3.js before 2.11.1 contains a regular expression denial of service vulnerability in the N3Lexer number pattern that backtracks quadratically on long digit runs. Attackers can supply untrusted Turtle or N3 input containing long runs of digits that do not end a number, blocking the Node.js event loop…
CWE: CWE-1333
NVD
HIGH
CVE-2026-109363
CVE-2026-109363
ZcashFoundation Zebra 6.4.0 before 6.4.2 parses version 6 transactions carrying a pre-NU6.3 consensus branch ID, but the size computation during UnminedTx construction treats re-serialization of the Orchard bundle as infallible, so the resulting error trips an expect that aborts zebrad. Unauthentica…
CWE: CWE-617
NVD
HIGH
CVE-2026-109326
CVE-2026-109326
Grav before 2.1.7 contains an information disclosure vulnerability because bundled nginx, lighttpd, IIS, and Caddy 2 configurations block .git only at document root. Unauthenticated attackers can request nested repositories such as user/.git to retrieve Git config, refs, and objects, reconstructing …
CWE: CWE-527
GitHub-GHSA
HIGH
kin-openapi: ValidationHandler security-requirement bypass via encoded-path operation confusion
kin-openapi: ValidationHandler security-requirement bypass via encoded-path operation confusion
## Summary
`openapi3filter.ValidationHandler.Middleware` validates requests with kin-openapi's
legacy router, which selects an OpenAPI operation from the decoded `URL.Path`. The
method is documented as implementing `gorilla/mux.MiddlewareFunc`, but a downstream
gorilla/mux router configured with `U…
CVE-2026-100351
NVD
HIGH
CVE-2026-109383
CVE-2026-109383
undici is an HTTP client library for Node.js. In versions 4.0.0 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1, its Agent dispatcher passes its constructor options through a JSON-based deep clone before forwarding them to each per-origin pool, and because JSON cannot represent functi…
CWE: CWE-295
NVD
HIGH
CVE-2026-110864
CVE-2026-110864
Better Auth from 1.5.0-beta.12 before 1.7.7 contains an authentication bypass vulnerability in the OAuth Proxy plugin that allows unauthenticated attackers to sign in as other users by forging encrypted profiles. When the proxy shares the global secret and cookie-stored state is used, attackers can …
CWE: CWE-287
GitHub-GHSA
HIGH
Microsoft Security Advisory CVE-2026-96222 – .NET Spoofing Vulnerability
Microsoft Security Advisory CVE-2026-96222 – .NET Spoofing Vulnerability
## Executive summary
Microsoft is releasing this security advisory to provide information about a vulnerability in System.Security.Cryptography.Xml. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability.
`KeyInfoX509Data` can accep…
CVE-2026-96222
NVD
HIGH
CVE-2026-108184
CVE-2026-108184
Improper certificate validation in certain Zoom Clients for Windows may allow an unauthenticated user to conduct an information disclosure via network access.
CWE: CWE-295
NVD
HIGH
CVE-2026-78556
CVE-2026-78556
A vulnerability has been identified in Industrial Edge App Publisher (All versions < V1.27.9). The affected software does not properly validate the server certificate when initiating a TLS connection. This allows an attacker to intercept and relay communication (Man-in-the-Middle attack) and to spoo…
CWE: CWE-295
NVD
HIGH
CVE-2026-84418
CVE-2026-84418
IBM DataStage on Cloud Pak for Data 5.4.0.0 can allow a man-in-the-middle attacker to present a forged TLS certificate, intercept the connection, and capture the IAM bearer Authorization header automatically attached by the session adapter. The captured token grants full platform-scope tenant API ac…
CWE: CWE-295
NVD
HIGH
CVE-2026-109423
CVE-2026-109423
NetEase Cloud Music client for Windows (cloudmusic.exe) versions 3.1.38 and 3.1.39.205426 contains a TLS certificate validation vulnerability that allows a network-adjacent attacker to intercept and decrypt HTTPS traffic by failing to validate the server certificate chain, verify the hostname, or co…
CWE: CWE-295
NVD
HIGH
CVE-2026-85974
CVE-2026-85974
Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 do not consistently validate TLS certificate hostnames for certain outbound connections. A network-positioned attacker could exploit this weakness to intercept or modify communications with an affected service.
CWE: CWE-297
NVD
HIGH
CVE-2026-86008
CVE-2026-86008
Mailu is a mail server distributed as a set of Docker images. Prior to 8577c929b4ade04d3cd4210cf036601abd793556, a domain manager targeting an administrative account or another domain manager with greater privileges can reset passwords or obtain tokens for that account. This authorization failure al…
CWE: CWE-269, CWE-285
NVD
HIGH
CVE-2026-110719
CVE-2026-110719
Portkey AI Gateway 1.14.0 through 1.15.2 contains a server-side request forgery vulnerability that allows unauthenticated attackers to reach loopback and Docker host services because isValidCustomHost trusts localhost-style hosts when TRUSTED_CUSTOM_HOSTS is unset. Attackers can send /v1 requests wi…
CWE: CWE-918
NVD
HIGH
CVE-2026-41510
CVE-2026-41510
OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.1, Coraza silently drops arguments after SecArgumentsLimit in internal/corazawaf/transaction.go, while internal/bodyprocessors/urlencoded.go writes ARGS_POST without enforcing the cap. The flaw…
CWE: CWE-693, CWE-770
GitHub-GHSA
HIGH
Nginx UI: Casdoor SSO callback uses a constant `state` parameter (login CSRF)
Nginx UI: Casdoor SSO callback uses a constant `state` parameter (login CSRF)
## Summary
In the Casdoor SSO flow, the OAuth `state` parameter is hard-coded to `settings.CasdoorSettings.Application` — a value identical for every user and every login. The callback handler accepts whatever `state` the client sends without comparing it to anything stored in the user agent, ena…
CVE-2026-84312
NVD
HIGH
CVE-2026-53582
CVE-2026-53582
OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.10, the Trust module stores attacker-controlled certificate authority and certificate refid values and interpolates them into XPath expressions in src/opnsense/mvc/app/models/OPNsense/Trust/FieldTypes/CAsField.php and s…
CWE: CWE-91, CWE-643
NVD
HIGH
CVE-2026-19673
CVE-2026-19673
ethernet_recv() in subsys/net/l2/ethernet/ethernet.c validates only that the first net_buf of a received frame holds a plain 14-byte struct net_eth_hdr. When the ethertype is 0x8100 and VLAN is enabled on the interface, the same buffer is reinterpreted as the 18-byte struct net_eth_vlan_hdr without …
CWE: CWE-125
NVD
HIGH
CVE-2026-84312
CVE-2026-84312
Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, GetCasdoorUri uses the configured Casdoor application name as a constant OAuth state value and CasdoorCallback does not compare the submitted state with a value bound to the initiating browser session. An unauthenticated atta…
CWE: CWE-287, CWE-352
NVD
HIGH
CVE-2026-111701
CVE-2026-111701
OtterMind Nubase through 0.1.4 contains a missing authentication vulnerability that allows unauthenticated attackers to access private bucket objects because /storage/v1/object/{bucketId}/{path} is treated as public for every HTTP method. Attackers knowing a tenant subdomain, bucket id and object pa…
CWE: CWE-306
NVD
HIGH
CVE-2026-62840
CVE-2026-62840
Time-of-check time-of-use (toctou) race condition in Linux Kernel allows an authorized attacker to elevate privileges locally.
CWE: CWE-367
NVD
HIGH
CVE-2026-86022
CVE-2026-86022
VNote is a note-taking platform. Prior to 4.3.0, SessionConfig::ExternalProgram::fetchCommand wraps a note path in double quotes and substitutes it into a command string that QProcess::start(const QString&) reparses into arguments through ProcessUtils::startDetached. The automatic path in src/contro…
CWE: CWE-78, CWE-88
NVD
HIGH
CVE-2026-85879
CVE-2026-85879
Time-of-check time-of-use (toctou) race condition in Windows Subsystem for Linux allows an authorized attacker to elevate privileges locally.
CWE: CWE-367
NVD
HIGH
CVE-2026-83871
CVE-2026-83871
Heap-based buffer overflow in OpenSSH for Windows allows an authorized attacker to elevate privileges locally.
CWE: CWE-122, CWE-367
NVD
HIGH
CVE-2026-102211
CVE-2026-102211
Use after free in Windows Virtualization-Based Security (VBS) Enclave allows an authorized attacker to elevate privileges locally.
CWE: CWE-362, CWE-416
NVD
HIGH
CVE-2026-102208
CVE-2026-102208
Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally.
CWE: CWE-416
NVD
HIGH
CVE-2026-102207
CVE-2026-102207
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Kernel allows an authorized attacker to elevate privileges locally.
CWE: CWE-362
NVD
HIGH
CVE-2026-102197
CVE-2026-102197
Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally.
CWE: CWE-416
NVD
HIGH
CVE-2026-102195
CVE-2026-102195
Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally.
CWE: CWE-416
NVD
HIGH
CVE-2026-102194
CVE-2026-102194
Use after free in Windows Graphics Kernel allows an authorized attacker to elevate privileges locally.
CWE: CWE-416
NVD
HIGH
CVE-2026-102193
CVE-2026-102193
Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally.
CWE: CWE-416
NVD
HIGH
CVE-2026-102191
CVE-2026-102191
Heap-based buffer overflow in Windows Storage allows an authorized attacker to elevate privileges locally.
CWE: CWE-122
NVD
HIGH
CVE-2026-102189
CVE-2026-102189
Heap-based buffer overflow in Windows Storage allows an authorized attacker to elevate privileges locally.
CWE: CWE-122
NVD
HIGH
CVE-2026-100225
CVE-2026-100225
Heap-based buffer overflow in Windows Storage allows an authorized attacker to elevate privileges locally.
CWE: CWE-122
NVD
HIGH
CVE-2026-100216
CVE-2026-100216
Stack-based buffer overflow in Windows Storage allows an authorized attacker to elevate privileges locally.
CWE: CWE-121
NVD
HIGH
CVE-2026-100203
CVE-2026-100203
Heap-based buffer overflow in Windows Update Service allows an authorized attacker to elevate privileges locally.
CWE: CWE-122
NVD
HIGH
CVE-2026-100201
CVE-2026-100201
Heap-based buffer overflow in Windows Client License Service allows an authorized attacker to elevate privileges locally.
CWE: CWE-122, CWE-197
NVD
HIGH
CVE-2026-100200
CVE-2026-100200
Use after free in Windows Update Service allows an authorized attacker to elevate privileges locally.
CWE: CWE-416
GitHub-GHSA
HIGH
kin-openapi openapi3filter: nil-pointer panic in ValidateResponse on a response header declared with content
kin-openapi openapi3filter: nil-pointer panic in ValidateResponse on a response header declared with content
## Summary
`ValidateResponse` panics on a nil pointer when a spec declares a response header with `content` instead of `schema`. `doc.Validate()` accepts that document, so the crash comes from a spec the library just called valid.
Same class as GHSA-jpcw-4wr7-c3vq, which covered the request-parame…
CVE-2026-100349
GitHub-GHSA
HIGH
Claude Code: Plugin Hash Pin Bypass Allows Bypass of Hash Pinning
Claude Code: Plugin Hash Pin Bypass Allows Bypass of Hash Pinning
The plugin install flow in Claude Code and Claude Desktop checked out a marketplace's pinned commit SHA using `git checkout` without verifying that the resulting HEAD matched the pinned SHA. An attacker controlling a plugin's upstream repository could create a branch named identically to the pinned …
CVE-2026-86063
GitHub-GHSA
HIGH
Qwik: Crashing any Qwik Server via Resource thenable
Qwik: Crashing any Qwik Server via Resource thenable
### Summary
A Qwik server in the default configuration can be crashed with one unauthenticated HTTP request. During qwik-json body parsing, `ResourceSerializer.$fill$` does `Promise.resolve(resource._resolved)`. If `_resolved` is a plain object whose `.then` is a QRL for an unregistered symbol, the…
CVE-2026-84994
GitHub-GHSA
HIGH
Nginx UI: Account Takeover via Missing `RequireSecureSession` on User Management Endpoint
Nginx UI: Account Takeover via Missing `RequireSecureSession` on User Management Endpoint
### Summary
`POST /api/users/:id` allows any authenticated user to change any other user's password without `RequireSecureSession` (2FA verification). In contrast, the self password change endpoint `POST /api/user/password` correctly requires `RequireSecureSession`. This inconsistency enables any au…
`POST /api/users/:id` allows any authenticated user to change any other user's password without `RequireSecureSession` (2FA verification). In contrast, the self password change endpoint `POST /api/user/password` correctly requires `RequireSecureSession`. This inconsistency enables any au…
CVE-2026-84314
GitHub-GHSA
HIGH
Sliver: Unauthenticated Memory Exhaustion Denial of Service in Sliver HTTP(S) Listener PNG Decoder
Sliver: Unauthenticated Memory Exhaustion Denial of Service in Sliver HTTP(S) Listener PNG Decoder
### Summary
Sliver is vulnerable to a Denial of Service (DOS) attack because there is no cap in the size of a PNG file that can be sent to an open http listener and there is a small amount of possible nonces. This vulnerability lets the attacker completely max out the RAM of the machine running serv…
Sliver is vulnerable to a Denial of Service (DOS) attack because there is no cap in the size of a PNG file that can be sent to an open http listener and there is a small amount of possible nonces. This vulnerability lets the attacker completely max out the RAM of the machine running serv…
CVE-2026-77622
GitHub-GHSA
MEDIUM
Metalama allows local code execution through DLL planting in shared temporary directories
Metalama allows local code execution through DLL planting in shared temporary directories
## Summary
Metalama loaded and executed compile-time assemblies, auxiliary executable tools, and embedded helper assemblies from predictable temporary directories. On Linux and macOS the default cache location was the world-writable system temporary directory (`Path.GetTempPath()`, i.e. `/tmp`), an…
CVE-2026-62847
GitHub-GHSA
MEDIUM
MCP Python SDK: Unbounded Session Accumulation in StreamableHTTP Transport Enables Resource Exhaustion
MCP Python SDK: Unbounded Session Accumulation in StreamableHTTP Transport Enables Resource Exhaustion
### Summary
In affected versions, a Streamable HTTP server in stateful mode (the default) never reclaimed session state:
In affected versions, a Streamable HTTP server in stateful mode (the default) never reclaimed session state:
– sessions did not expire;
– a client `DELETE` ended the session but left its entry registered;
– a session whose first request was refused stayed registered with a running task.…
CVE-2026-59951
NVD
MEDIUM
CVE-2026-110024
CVE-2026-110024
@fastify/jwt is a JWT utility plugin for Fastify. In versions prior to 10.2.5, the top-level sign and verify methods replace the globally configured defaults with the per-call options instead of merging them, so passing any per-call option silently drops every global default that the call does not r…
CWE: CWE-613
NVD
MEDIUM
CVE-2026-111622
CVE-2026-111622
smart-sso through 2.1.1 contains an open redirect vulnerability in the /login handler that allows unauthenticated attackers to steal OAuth2 authorization codes by supplying an unvalidated redirectUri parameter. Attackers can send crafted /login links to users with active SSO sessions, then redeem st…
CWE: CWE-601
GitHub-GHSA
MEDIUM
Distribution: Client `manifests.Get()` does not verify returned content against requested digest
Distribution: Client `manifests.Get()` does not verify returned content against requested digest
### Summary
`registry/client.(*manifests).Get(ctx, dgst, …)` fetches a manifest by digest but never hashes the returned body and compares it against the requested digest. A malicious or compromised registry, or any MITM on the registry connection, can serve arbitrary manifest bytes in response to…
CVE-2026-85747
NVD
MEDIUM
CVE-2026-85747
CVE-2026-85747
Distribution is a toolkit to pack, ship, store, and deliver container content. Prior to 3.1.2, registry/client.(*manifests).Get() reads a manifest returned for a digest-pinned request and passes it to distribution.UnmarshalManifest without hashing the body against the requested digest, allowing a ma…
CWE: CWE-354
NVD
MEDIUM
CVE-2026-102206
CVE-2026-102206
Heap-based buffer overflow in Windows Portable Device MTP Driver allows an unauthorized attacker to elevate privileges with a physical attack.
CWE: CWE-122
NVD
MEDIUM
CVE-2026-102188
CVE-2026-102188
Untrusted pointer dereference in Windows Storage Port Driver allows an unauthorized attacker to elevate privileges with a physical attack.
CWE: CWE-822
NVD
MEDIUM
CVE-2026-49265
CVE-2026-49265
OAuthLib is an implementation of the OAuth request-signing logic for Python 3.6+. From 3.0.0 until 4.0.0, OAuthLib's PKCE checks in oauthlib/oauth2/rfc6749/grant_types/authorization_code.py compare attacker-supplied code_verifier values with stored challenges using ordinary string equality in code_c…
CWE: CWE-208
NVD
MEDIUM
CVE-2026-109292
CVE-2026-109292
Open WebUI from 0.6.27 before 0.11.4 contains an information disclosure vulnerability that allows destination servers to obtain user session cookies by receiving the full browser cookie jar on OAuth-mode connections. Operators of OpenAI-compatible connections, OpenAPI tool servers or terminal server…
CWE: CWE-200
NVD
MEDIUM
CVE-2026-109245
CVE-2026-109245
FreeRDP 3.0.0 before 3.32.0 contains an improper certificate validation vulnerability in freerdp_http_request() in libfreerdp/utils/http.c that completes TLS handshakes without verifying the server certificate chain. On-path attackers can impersonate login.microsoftonline.com in the Azure AD authent…
CWE: CWE-295
NVD
MEDIUM
CVE-2026-112006
CVE-2026-112006
OpenTelemetry opentelemetry-exporter-otlp-proto-http 1.5.0 before 1.45.0 contains an improper certificate validation vulnerability that disables TLS verification when OTEL_EXPORTER_OTLP_CERTIFICATE variables are empty strings. Man-in-the-middle attackers can impersonate the collector to read or alte…
CWE: CWE-295
NVD
MEDIUM
CVE-2026-111917
CVE-2026-111917
Vikunja 2.3.0 before 2.7.0 contains an improper session validation vulnerability that allows attackers to keep WebSocket access after revocation because handleAuth never checks the JWT sid claim against the sessions table. Attackers holding a stolen access token can open or maintain connections to /…
CWE: CWE-613
GitHub-GHSA
MEDIUM
Wasmtime: WASI hard links bypass wasmtime-wasi's FilePerms for destination
Wasmtime: WASI hard links bypass wasmtime-wasi's FilePerms for destination
## Summary
Wasmtime's WASI filesystem implementation lets a guest with a read-only source file capability overwrite that file by hard-linking it into another preopen that allows file writes. An attacker who can run a WASI guest can bypass `WasiCtxBuilder` per-preopen `FilePerms` and modify host fil…
CVE-2026-58494
NVD
MEDIUM
CVE-2026-111669
CVE-2026-111669
ZR.Admin.NET through 3.8.2 contains an sql injection vulnerability that allows authenticated attackers to manipulate the ORDER BY clause by supplying a crafted PagerInfo.Sort query parameter to the shared ToPage paging helper. Attackers holding the system:user:list permission can inject subquery or …
CWE: CWE-89
NVD
MEDIUM
CVE-2026-19541
CVE-2026-19541
Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 fail to require re-entry of the stored client secret when validating an outgoing OAuth connection, which allows an authenticated user with permission to manage outgoing OAuth connections to obtain the secre…
CWE: CWE-201
NVD
MEDIUM
CVE-2026-109414
CVE-2026-109414
The Vitepos – Point of Sale (POS) for WooCommerce plugin for WordPress is vulnerable to blind SQL Injection via the 'src_by[].val.start / src_by[].val.end (operator 'bt')' parameter in all versions up to, and including, 3.6.1 due to insufficient escaping on the user supplied parameter and lack of …
CWE: CWE-89
NVD
MEDIUM
CVE-2026-111367
CVE-2026-111367
BillionMail through 4.9 contains a hard-coded cryptographic key vulnerability that allows unauthenticated attackers to forge unsubscribe and subscribe-confirm JWTs by computing the key from shipped configuration constants. Attackers can submit forged tokens to /api/unsubscribe, /api/unsubscribe_new,…
CWE: CWE-1394
GitHub-GHSA
MEDIUM
Appium: Symlink based Zip Slip in @appium/support ZIP extraction
Appium: Symlink based Zip Slip in @appium/support ZIP extraction
### Summary
CVE-2026-30973 [(GHSA-rfx7-4xw3-gh4m)](https://github.com/appium/appium/security/advisories/GHSA-rfx7-4xw3-gh4m) was a plain path traversal in the entry name. The containment check built an Error object without throwing it, so an entry literally named something like `../evil.txt` was wr…
CVE-2026-103975
GitHub-GHSA
MEDIUM
tinytag: Infinite loop when parsing certain M4A files containing invalid atoms
tinytag: Infinite loop when parsing certain M4A files containing invalid atoms
### Impact
An M4A file containing a sub-atom with a size of zero in the `—-` atom makes the parser enter an infinite loop, resulting in a denial-of-service for programs reading such files with tinytag.
An M4A file containing a sub-atom with a size of zero in the `—-` atom makes the parser enter an infinite loop, resulting in a denial-of-service for programs reading such files with tinytag.
### Patches
The issue has been fixed in tinytag 2.3.0, by reusing the primary atom parsing code…
CVE-2026-104266
GitHub-GHSA
MEDIUM
Nezha Monitoring: Whole-instance DoS in Nezha dashboard: a member can crash the process for every tenant
Nezha Monitoring: Whole-instance DoS in Nezha dashboard: a member can crash the process for every tenant
## Summary
A single low-privilege `RoleMember` can take the entire Nezha dashboard offline, and with it every tenant's web UI, REST API, and agent connections, by racing two ordinary operations on their own service. The crash is a nil pointer dereference in the service-monitor worker at `service/si…
CVE-2026-100394
GitHub-GHSA
MEDIUM
SFTPGo: Denial of service via malformed SSH channel request
SFTPGo: Denial of service via malformed SSH channel request
### Summary
A flaw in the SSH service allows an authenticated client to crash the server by sending a malformed protocol message while opening a channel.
### Impact
Any user able to authenticate over SSH can trigger an unhandled error condition that aborts the server process. This results in a de…
CVE-2026-77375
GitHub-GHSA
MEDIUM
Python Social Auth: Login CSRF in LINE backend (LineOAuth2) — missing OAuth state validation (incomplete fix of 5.0.0 campaign)
Python Social Auth: Login CSRF in LINE backend (LineOAuth2) — missing OAuth state validation (incomplete fix of 5.0.0 campaign)
### Impact
Applications using the LINE Login backend are vulnerable to login CSRF / forced authentication. An attacker can start a LINE authorization flow for an account they control and trick a victim into visiting the callback URL with the attacker’s authorization code. Because the LINE backend…
CVE-2026-62322
NVD
MEDIUM
CVE-2026-62322
CVE-2026-62322
Python Social Auth is a social authentication/registration mechanism. Prior to 5.0.2, the LINE backend exchanges an authorization code without validating the returned OAuth state. An attacker can begin authorization for an attacker-controlled LINE account and induce a victim to visit the resulting c…
CWE: CWE-352
NVD
MEDIUM
CVE-2026-104266
CVE-2026-104266
tinytag is a Python library for reading audio file metadata. From 2.0.0 until 2.3.0, an M4A file containing a sub-atom with a size of zero inside a —- atom can cause the metadata parser to stop advancing through the input. The custom-field atom traversal repeatedly processes the malformed location…
CWE: CWE-835
NVD
MEDIUM
CVE-2026-101302
CVE-2026-101302
TLS 1.3 embeds the actual record type as the last non-zero byte of the decrypted payload, optionally followed by zero padding. The code which searches for the inner record type had an off-by-one bug which could be triggered by an invalid frame, leading to an underflow followed by an unconditional N…
CWE: CWE-193, CWE-476
NVD
MEDIUM
CVE-2026-110923
CVE-2026-110923
A flaw was found in OpenSSH. During an sftp copy, a malicious server can supply an empty name, a slash-only path, or a ".." basename that sftp uses as the local destination, writing outside the directory the user selected.
CWE: CWE-22
NVD
MEDIUM
CVE-2026-97629
CVE-2026-97629
Description
When NGINX Plus or NGINX Open Source is configured with ssl_session_cache
When NGINX Plus or NGINX Open Source is configured with ssl_session_cache
shared:name:size
without an explicit ssl_session_ticket_key file directives to automatically rotate SSL session ticket keys, a remote unauthenticated attacker is able to forge client SSL sessions
in a non-de…
CWE: CWE-908
NVD
MEDIUM
CVE-2026-96615
CVE-2026-96615
Description
NGINX Gateway Fabric has a vulnerability when it is configured with Gateway
NGINX Gateway Fabric has a vulnerability when it is configured with Gateway
Custom Resource Definition (CRD) and have an authenticated gRPC connection with NGINX Agent. A namespaced
authenticated attacker with access to a service account may impersonate the authenticated NGINX Age…
CWE: CWE-290
NVD
MEDIUM
CVE-2026-101019
CVE-2026-101019
Description
NGINX JavaScript (njs) has a vulnerability where the njs XML module exposes entity-backed XML attributes inconsistently with libxml2 canonicalization. In both the built-in njs and QuickJS backends during the canonicalization process, the $attr$Name getter may return undefined for an expl…
NGINX JavaScript (njs) has a vulnerability where the njs XML module exposes entity-backed XML attributes inconsistently with libxml2 canonicalization. In both the built-in njs and QuickJS backends during the canonicalization process, the $attr$Name getter may return undefined for an expl…
CWE: CWE-436
NVD
MEDIUM
CVE-2026-107433
CVE-2026-107433
Missing Authorization vulnerability in miniOrange WP OAuth Server miniorange-oauth-20-server allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP OAuth Server: from n/a through 6.4.0.
CWE: CWE-862
NVD
MEDIUM
CVE-2026-108064
CVE-2026-108064
The WP Encryption WordPress plugin before 7.8.8.2 does not perform a capability or nonce check on one of the handlers that drives its SSL certificate-provisioning routine, allowing unauthenticated users to make the WP Encryption WordPress plugin before 7.8.8.2 overwrite the site's certificate priv…
CWE: CWE-862
NVD
MEDIUM
CVE-2026-110146
CVE-2026-110146
Information leak in Passwords in Google Chrome prior to 155.0.8059.79 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted HTML page. (Chromium security severity: High)
CWE: CWE-200
GitHub-GHSA
MEDIUM
Microsoft Security Advisory CVE-2026-96229 – .NET and Visual Studio Information Disclosure Vulnerability
Microsoft Security Advisory CVE-2026-96229 – .NET and Visual Studio Information Disclosure Vulnerability
## Executive summary
Microsoft is releasing this security advisory to provide information about a vulnerability in Microsoft.WindowsDesktop.App.Runtime (WPF). This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability.
Restrictive XAML …
CVE-2026-96229
GitHub-GHSA
MEDIUM
Microsoft Security Advisory CVE-2026-70194 – .NET and Visual Studio Security Feature Bypass Vulnerability
Microsoft Security Advisory CVE-2026-70194 – .NET and Visual Studio Security Feature Bypass Vulnerability
## Executive summary
Microsoft is releasing this security advisory to provide information about a vulnerability in System.Net.Security. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability.
.NET 11 post-handshake TLS client authen…
CVE-2026-70194
NVD
MEDIUM
CVE-2026-96206
CVE-2026-96206
Use of uninitialized resource in Windows Subsystem for Linux allows an authorized attacker to disclose information locally.
CWE: CWE-908
NVD
MEDIUM
CVE-2026-102199
CVE-2026-102199
Stack-based buffer overflow in Microsoft Windows Codecs Library allows an unauthorized attacker to deny service over a network.
CWE: CWE-121
NVD
MEDIUM
CVE-2026-19940
CVE-2026-19940
The Bluetooth Classic Hands-Free Profile Audio Gateway implementation in subsys/bluetooth/host/classic/hfp_ag.c keeps its struct bt_hfp_ag objects in a static pool indexed by ACL connection index. On link teardown, hfp_ag_disconnected() cancels ag->tx_work and the per-call work items and then clears…
CWE: CWE-416
NVD
MEDIUM
CVE-2026-110121
CVE-2026-110121
PickMall lilishop through 4.4 contains an insecure direct object reference vulnerability that allows authenticated sellers to overwrite any store's product by supplying another store's goodsId to the goods update endpoint. Attackers can send PUT requests to /store/goods/goods/update/{goodsId} to rep…
CWE: CWE-639
NVD
MEDIUM
CVE-2026-110114
CVE-2026-110114
FJ-OMS oms-erp through PRE contains a missing authentication vulnerability that allows unauthenticated attackers to delete and rebuild product search indexes by calling public es-test maintenance endpoints in skyer-goods. Attackers can repeatedly request /v1/goods/sku/es-test to empty the shared goo…
CWE: CWE-306
NVD
MEDIUM
CVE-2026-104004
CVE-2026-104004
MongoDB Server's collection validation feature may not properly handle certain expressions stored in a validator. In some cases, this can cause the server process to stop running when a document is later inserted. The behavior can occur for authenticated users with write access.
CWE: CWE-476
NVD
MEDIUM
CVE-2026-109941
CVE-2026-109941
FreeRDP from 2.3.0 before 3.32.0 contains an infinite loop vulnerability in http_chuncked_read that allows malicious RD Gateways to hang clients by sending incomplete chunked responses. Attackers can send a partial chunk-size line or footer followed by a clean TLS shutdown, causing zero-byte reads t…
CWE: CWE-835
NVD
MEDIUM
CVE-2026-41210
CVE-2026-41210
Moonlight Qt is a GameStream client for Windows, macOS, Linux, and Steam Link. In version 6.1.0 and earlier, after a victim initiates a streaming session to a malicious host, the host can send a crafted H.264 SPS NAL when Moonlight selects a decoder path that does not advertise CAPABILITY_REFERENCE_…
CWE: CWE-787
NVD
MEDIUM
CVE-2026-18533
CVE-2026-18533
IBM Maximo Application Suite – Location Service for Esri Component 9.2, 9.1, and 9.0 is vulnerable to improper input validation due to an unsanitised container image configuration in a Kubernetes operator template.
CWE: CWE-94
NVD
MEDIUM
CVE-2026-77364
CVE-2026-77364
obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. Prior to 1.3.1, undefined readPaths and writePaths settings allow all paths, strictReadDefault does not protect direct requests, and the .obsidian, .git, and .trash control directories are excluded only during …
CWE: CWE-200, CWE-276
NVD
MEDIUM
CVE-2026-107862
CVE-2026-107862
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ExpressTech Quiz And Survey Master quiz-master-next allows DOM-Based XSS.This issue affects Quiz And Survey Master: from n/a through 11.2.7.
CWE: CWE-79
NVD
MEDIUM
CVE-2026-109295
CVE-2026-109295
Open WebUI from 0.11.0 before 0.11.4 contains a regular expression denial of service vulnerability that allows authenticated users to stall server workers via file search patterns. Attackers can instruct the model to call grep_knowledge_files or grep_chat_files with a catastrophically backtracking r…
CWE: CWE-1333
NVD
MEDIUM
CVE-2026-109293
CVE-2026-109293
Open WebUI from 0.11.0 before 0.11.4 contains an information disclosure vulnerability that allows authenticated non-admin users with tool export permission to obtain tool source code shared with them read-only. Attackers can request GET /api/v1/tools/export to retrieve the full Python source of read…
CWE: CWE-200
NVD
MEDIUM
CVE-2026-109170
CVE-2026-109170
LogicalDOC Community Edition through 9.3 contains an HQL injection vulnerability in DocumentsDataServlet that allows authenticated users to manipulate queries via the unvalidated indexed parameter. Attackers with read access to any folder can inject boolean HQL expressions to bypass folder scope and…
CWE: CWE-89
NVD
MEDIUM
CVE-2026-109288
CVE-2026-109288
Open WebUI before 0.11.4 contains a stored cross-site scripting vulnerability in MarkdownInlineTokens.svelte, which renders markdown link URLs into anchor hrefs without validating their scheme. Authenticated users can embed javascript: links in shared chats that, when clicked by a victim, steal the …
CWE: CWE-79
NVD
MEDIUM
CVE-2026-111922
CVE-2026-111922
Vikunja from 2.2.0 before 2.7.0 contains a permissive CORS configuration that trusts every localhost and 127.0.0.1 port with credentials, even when service.publicurl is set. Attackers controlling a page on any localhost port can send a credentialed request to the token refresh endpoint and read the …
CWE: CWE-942
GitHub-GHSA
MEDIUM
Nginx UI: Auto backup name allows path traversal outside validated storage path
Nginx UI: Auto backup name allows path traversal outside validated storage path
## Summary
Nginx UI validates `backup_path` and `storage_path` against the administrator-defined `backup.GrantedAccessPath` boundary, but the final auto-backup output filename is built from the user-controlled auto-backup `name` without stripping path separators or `..` components.
An authenticate…
CVE-2026-84320
NVD
MEDIUM
CVE-2026-19939
CVE-2026-19939
The AVDTP signalling layer arms a 6-second command timeout (AVDTP_TIMEOUT) in avdtp_send_cmd() whenever the local device issues an AVDTP request. Every response handler in subsys/bluetooth/host/classic/avdtp.c cancels session->timeout_work before clearing the pending request, but bt_avdtp_l2cap_disc…
CWE: CWE-825
NVD
MEDIUM
CVE-2026-84320
CVE-2026-84320
Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.3, Nginx UI validates an automatic backup's storage_path, but AutoBackup.GetName returns a user-controlled name without rejecting path separators or parent-directory components, and downstream filename formatting embeds that res…
CWE: CWE-22
GitHub-GHSA
MEDIUM
unstructured: Stored XSS via unescaped HTML generation
unstructured: Stored XSS via unescaped HTML generation
### Summary
When `unstructured` parses an untrusted document and outputs the result as HTML, malicious markup contained in the document (e.g. `<img src=x onerror=…>`) is left in the output HTML without escaping. When that output is displayed in a browser, the script embedded in the document execu…
CVE-2026-104250
NVD
MEDIUM
CVE-2026-57183
CVE-2026-57183
Scoold is a Q&A and a knowledge sharing platform for teams. Prior to 1.69.1, checkApiAuth() in src/main/java/com/erudika/scoold/utils/ScooldUtils.java accepts a JWT signed with app_secret_key or para_secret_key for /api/config and /api/stats without requiring a registered API-key jti, and maps the r…
CWE: CWE-287
NVD
MEDIUM
CVE-2026-49264
CVE-2026-49264
OAuthLib is an implementation of the OAuth request-signing logic for Python 3.6+. From 0.6.1 until 4.0.0, OAuthLib's RevocationEndpoint in oauthlib/oauth2/rfc6749/endpoints/revocation.py reflects an unvalidated callback request parameter into success and error response bodies when enable_jsonp=True.…
CWE: CWE-79
NVD
MEDIUM
CVE-2025-27902
CVE-2025-27902
IBM DB2 Recovery Expert for Linux, UNIX and Windows 5.5 IF 2 uses a web link with untrusted references to an external site. A remote attacker could exploit this vulnerability to expose sensitive information or perform unauthorized actions on the victims’ web browser
CWE: CWE-1022
NVD
MEDIUM
CVE-2025-27897
CVE-2025-27897
IBM Db2 Recovery Expert for Linux, UNIX and Windows 5.5 IF 2 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated attacker to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a t…
CWE: CWE-79
NVD
MEDIUM
CVE-2025-27896
CVE-2025-27896
IBM Db2 Recovery Expert for Linux, UNIX and Windows 5.5 IF 2 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated attacker to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a t…
CWE: CWE-79
NVD
MEDIUM
CVE-2025-27895
CVE-2025-27895
IBM DB2 Recovery Expert for Linux, UNIX and Windows 5.5 IF 2 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated attacker to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within …
CWE: CWE-79
NVD
MEDIUM
CVE-2026-109345
CVE-2026-109345
DOMPurify before 3.4.16 contains a cross-site scripting vulnerability that allows attackers to bypass sanitization because IN_PLACE mode returns a force-removed style element whose text content still carries markup. Attackers can supply a style element containing a closing style tag and an img onerr…
CWE: CWE-79
NVD
MEDIUM
CVE-2026-104126
CVE-2026-104126
JumpServer is an open source bastion host and an operation and maintenance security audit system. Prior to 4.10.17-lts, JumpServer's Ansible-based automation rendering can evaluate attacker-controlled template expressions from users who have permission to create or execute affected automation tasks.…
CWE: CWE-94
NVD
MEDIUM
CVE-2026-65131
CVE-2026-65131
NVIDIA NVSentinel for Linux contains a vulnerability in the platform-connectors component, where the gRPC health-event interface, exposed over a world-writable Unix domain socket, lacks authentication. A successful exploit of this vulnerability might lead to denial of service.
CWE: CWE-306
NVD
MEDIUM
CVE-2026-77427
CVE-2026-77427
FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. From 3.9.0 until 3.22.0, pristine manual FileRise installations without PERSISTENT_TOKENS_KEY or metadata/persistent_tokens.key can activate a published legacy compatibility key. If an attacker se…
CWE: CWE-798, CWE-1188
NVD
MEDIUM
CVE-2026-102082
CVE-2026-102082
An Improper Handling of Missing Special Element vulnerability in the SSL plugin of Juniper Networks Junos OS on SRX Series allows a network-based, unauthenticated attacker to cause a Denial-of-Service (DoS).
This issue is will occur when 'ssl-proxy' is configured on SRX platforms and during a TLS…
CWE: CWE-166
GitHub-GHSA
MEDIUM
Microsoft Security Advisory CVE-2026-85790 – .NET Information Disclosure Vulnerability
Microsoft Security Advisory CVE-2026-85790 – .NET Information Disclosure Vulnerability
## Executive summary
Microsoft is releasing this security advisory to provide information about a vulnerability in Microsoft.Native.Quic.MsQuic.Schannel. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability.
Various vulnerabilitie…
CVE-2026-85790
GitHub-GHSA
MEDIUM
Microsoft Security Advisory CVE-2026-66822 – .NET and Visual Studio Information Disclosure Vulnerability
Microsoft Security Advisory CVE-2026-66822 – .NET and Visual Studio Information Disclosure Vulnerability
## Executive summary
Microsoft is releasing this security advisory to provide information about a vulnerability in System.Net.Http. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability.
SocketsHttpHandler can retain a `Proxy-Autho…
CVE-2026-66822
GitHub-GHSA
MEDIUM
Microsoft Security Advisory CVE-2026-70162 – .NET Denial of Service Vulnerability
Microsoft Security Advisory CVE-2026-70162 – .NET Denial of Service Vulnerability
## Executive summary
Microsoft is releasing this security advisory to provide information about a vulnerability in System.Security.Cryptography.Pkcs. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability.
On Windows, `EnvelopedCms.…
CVE-2026-70162
GitHub-GHSA
MEDIUM
Microsoft Security Advisory CVE-2026-70196 – ASP.NET Core Denial of Service Vulnerability
Microsoft Security Advisory CVE-2026-70196 – ASP.NET Core Denial of Service Vulnerability
## Executive summary
Microsoft is releasing this security advisory to provide information about a vulnerability in Microsoft.AspNetCore.WebUtilities. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability.
Incrementally arriving for…
CVE-2026-70196
NVD
MEDIUM
CVE-2026-109833
CVE-2026-109833
A flaw was found in gnome-remote-desktop as shipped in Red Hat Enterprise Linux. In the VNC TLS read path, partial consumption of the internal peek buffer incorrectly moves remaining peeked bytes into the caller-supplied buffer instead of compacting the peek buffer. A remote attacker who can reach a…
CWE: CWE-121
NVD
MEDIUM
CVE-2026-19938
CVE-2026-19938
The Bluetooth host's ATT transmit path releases a buffer it does not own when signing fails. chan_send() in subsys/bluetooth/host/att.c documents (and every other error exit implements) the contract that on failure the caller retains ownership of the net_buf; the BT_ATT_OP_SIGNED_WRITE_CMD branch in…
CWE: CWE-416
NVD
MEDIUM
CVE-2022-51020
CVE-2022-51020
Flower before 2.2.0 contains a cross-site request forgery vulnerability because Tornado xsrf_cookies is disabled and the OAuth session cookie lacks SameSite. Attackers can lure authenticated users to malicious pages that POST to /api/worker/shutdown, /api/worker/pool/restart, or /api/task/revoke to …
CWE: CWE-352
NVD
MEDIUM
CVE-2026-109424
CVE-2026-109424
NetEase Cloud Music client for Windows (cloudmusic.exe) versions 3.1.38 and 3.1.39.205426 contains a weak encryption vulnerability where /eapi/ and /xeapi/ API response bodies are decrypted using a fixed, publicly documented AES-128-ECB key with no integrity credential. Attackers who can intercept o…
CWE: CWE-321
NVD
MEDIUM
CVE-2026-111662
CVE-2026-111662
Chaskiq through 2.0.3 contains a server-side request forgery vulnerability that allows unauthenticated attackers to make the server fetch arbitrary URLs via the url parameter of the /oembed endpoint. Attackers can target loopback, private, or cloud-metadata addresses through FetchLinkCardService, wh…
CWE: CWE-918
NVD
MEDIUM
CVE-2026-7767
CVE-2026-7767
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.11 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user controlling a Kubernetes agent to cause sensitive authentication tokens to be sent to an…
CWE: CWE-601
NVD
MEDIUM
CVE-2026-41508
CVE-2026-41508
OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.4.0 until 3.8.0, the multipart processor in internal/bodyprocessors/multipart.go treats io.ErrUnexpectedEOF as nonfatal without setting MULTIPART_STRICT_ERROR. A remote attacker can submit a truncated multip…
CWE: CWE-693, CWE-755
NVD
MEDIUM
CVE-2026-41504
CVE-2026-41504
OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.0, the Native audit-log formatter in internal/auditlog/formats.go writes attacker-influenced request and response fields without neutralizing carriage returns or line feeds. When SecAuditLogFor…
CWE: CWE-93, CWE-117
NVD
MEDIUM
CVE-2026-104774
CVE-2026-104774
OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.0, the t:jsDecode transformation in internal/transformations/js_decode.go:64-70 includes the backslash in the octal buffer, causing ParseInt to fail and return a null byte. The flaw is triggere…
CWE: CWE-172, CWE-193, CWE-693
NVD
MEDIUM
CVE-2026-59966
CVE-2026-59966
Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.10, executes user-controlled Automation regular-expression patterns with Python re.sub() without complexity validation or an execution timeout when an authenticated user stores a catastr…
CWE: CWE-1333
NVD
MEDIUM
CVE-2026-19937
CVE-2026-19937
The Bluetooth Mesh Access layer delayable-message machinery in subsys/bluetooth/mesh/delayable_msg.c manages a static pool of CONFIG_BT_MESH_ACCESS_DELAYABLE_MSG_COUNT message contexts (default 4) threaded onto a free_ctx or busy_ctx list. release_delayable_msg_ctx() returned a context to free_ctx o…
CWE: CWE-772
GitHub-GHSA
MEDIUM
Pipecat: Public exposure of Pipecat’s development runner can allow unauthenticated bot session creation
Pipecat: Public exposure of Pipecat’s development runner can allow unauthenticated bot session creation
Pipecat’s built-in development runner exposes endpoints that create bot sessions and, for the Daily transport, paid Daily rooms. These development endpoints intentionally do not authenticate callers.
The runner binds to localhost by default and is designed exclusively for local development. It is…
CVE-2026-102682
NVD
MEDIUM
CVE-2026-102682
CVE-2026-102682
Pipecat is an open-source Python framework for building real-time voice and multimodal conversational agents. From 0.0.98 until 1.6.0, the pipecat-ai package's built-in development runner exposes unauthenticated endpoints including /start, /daily, and /daily-dialin-webhook that can create bot sessio…
CWE: CWE-345, CWE-770, CWE-862
NVD
MEDIUM
CVE-2026-110150
CVE-2026-110150
Privilege elevation in Installer in Google Chrome on on Windows prior to 155.0.8059.79 allowed a local attacker to obtain sensitive information via a local program. (Chromium security severity: High)
CWE: CWE-250
NVD
MEDIUM
CVE-2026-102187
CVE-2026-102187
Use of uninitialized resource in Windows Kernel allows an authorized attacker to disclose information locally.
CWE: CWE-908
NVD
MEDIUM
CVE-2026-88838
CVE-2026-88838
A flaw was found in BusyBox's mount utility. A non-root user can bypass mount security restrictions set in /etc/fstab by specifying clearing-mask options on the command line. These options pass the non-root flag filter and are merged with fstab options as strings; when the combined options are re-pa…
CWE: CWE-693
NVD
MEDIUM
CVE-2026-102734
CVE-2026-102734
asteval is a Python expression evaluator designed for restricted execution. Prior to 1.0.9, in asteval/astutils.py, the default Interpreter with numpy enabled exposes a ctypes type and permits from_address memory access. safe_getattr blocks the ctypes module but not reachable ctypes type objects, wh…
CWE: CWE-693, CWE-749, CWE-913
NVD
MEDIUM
CVE-2026-111388
CVE-2026-111388
Frappe Framework before 15.120.0 and 16.x before 16.33.0 does not enforce the per-user restrict_ip allowlist for non-session authentication methods, including API key, OAuth, and header-based authentication. Attackers holding valid credentials of these types can authenticate from IP addresses outsid…
CWE: CWE-284
NVD
MEDIUM
CVE-2026-111348
CVE-2026-111348
Likeshop through 3.5.1 contains an insecure direct object reference vulnerability in AfterSale.php and AfterSaleLogic.php that lets authenticated users access other customers' after-sale records by supplying their ids. Attackers with self-registered accounts can call the detail, goodsInfo, cancel, e…
CWE: CWE-639
GitHub-GHSA
MEDIUM
Nginx UI: Standalone short tokens survive administrative revocation in cache and authenticate again after account re-enable
Nginx UI: Standalone short tokens survive administrative revocation in cache and authenticate again after account re-enable
### Summary
Standalone short tokens issued for WebSocket and explicit-token authentication can survive administrative revocation in cache. If the same account is later re-enabled before the cache entry expires, the deleted short token becomes valid again.
Standalone short tokens issued for WebSocket and explicit-token authentication can survive administrative revocation in cache. If the same account is later re-enabled before the cache entry expires, the deleted short token becomes valid again.
### Details
`GenerateShortToken()` creates …
CVE-2026-84321
NVD
MEDIUM
CVE-2026-110925
CVE-2026-110925
A flaw was found in OpenSSH. A username entered on the ssh command line can still contain '$' or a non-trailing backslash. When a configuration expands %u inside ProxyCommand or Match exec, those characters are passed into the shell.
CWE: CWE-78
NVD
MEDIUM
CVE-2026-103974
CVE-2026-103974
lichess.org is the forever free, adless and open source chess server. Prior to commit c54596c9e1569d378fe20f80d4c790c6fdee54c4, a user who can add a chapter to a study can place attacker-controlled text in the PGN Annotator tag, which becomes Comment.Author.External and is returned verbatim by autho…
CWE: CWE-79
NVD
MEDIUM
CVE-2026-70396
CVE-2026-70396
Gitea's organization repository-creation API requires write:organization but omits the write:repository token scope enforced by other repository-creation routes. A personal access token or OAuth application token without repository-write scope can therefore create organization-owned repositories if …
CWE: CWE-863
NVD
MEDIUM
CVE-2026-110593
CVE-2026-110593
BottleCRM through 1.14.5 contains a server-side template injection vulnerability in the send_email Celery task, which compiles the user-supplied AccountEmail message_body with django.template.Template(). Authenticated organization members can submit template tags through POST /api/accounts/<id>/crea…
CWE: CWE-1336
NVD
MEDIUM
CVE-2026-104587
CVE-2026-104587
blob42 gosuki through commit 6e2bf34 contains a Stored Cross-Site Scripting (XSS) vulnerability. The application uses text/template instead of html/template, failing to perform context-aware auto-escaping on the URL and DisplayURL fields of bookmarks in internal/webui/templates/bookmarks.html. An at…
CWE: CWE-79
NVD
MEDIUM
CVE-2026-84321
CVE-2026-84321
Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, GenerateShortToken creates standalone short-token records without a long Token value, but DeleteUserTokens invalidates cached entries only when the long Token field is nonempty. A revoked short token can therefore remain in t…
CWE: CWE-613
NVD
MEDIUM
CVE-2026-109362
CVE-2026-109362
Heym v0.0.5 before v0.0.113 contains a broken access control vulnerability that allows former collaborators to keep executing JWT-auth workflows by reusing scoped workflow:execute tokens after share removal. Attackers can mint a token with a TTL up to 10 years, which the owner cannot list or revoke,…
CWE: CWE-613
NVD
MEDIUM
CVE-2026-109283
CVE-2026-109283
Open WebUI from 0.11.1 before 0.11.4 contains an authorization bypass in the OAuth token exchange endpoint, which reads role claims only from the provider's userinfo response and keeps the user's existing role when no roles claim is found, ignoring roles sent only in the ID token. Users with a linke…
CWE: CWE-863
NVD
MEDIUM
CVE-2026-103528
CVE-2026-103528
Thelia 2.6.0 uses Smarty for email templates without properly restricting access to dangerous PHP functions. An authenticated administrator can inject malicious Smarty expressions into email templates via the messages configuration interface, and when the template is previewed or rendered, functions…
CWE: CWE-1336
NVD
MEDIUM
CVE-2026-112083
CVE-2026-112083
A security flaw has been discovered in sgl-project SGLang up to 0.5.19. Affected is the function WeightExporter.send_weights_to_remote_instance of the file python/sglang/srt/model_executor/model_runner_components/weight_exporter.py of the component Weight Exporter. Performing a manipulation of the a…
CWE: CWE-404
NVD
MEDIUM
CVE-2026-103376
CVE-2026-103376
The PeachPay — Payments & Express Checkout for WooCommerce (supports Stripe, PayPal, Square, Authorize.net, NMI) WordPress plugin before 1.120.70 does not perform any capability or ownership check before returning an order's secret key in response to an unauthenticated request, allowing anyone to …
CWE: CWE-200
NVD
MEDIUM
CVE-2026-111707
CVE-2026-111707
99AI through 4.3.0 contains an insecure direct object reference vulnerability that allows unauthenticated attackers to read other users' chat messages because querySingleChat lacks an owner check. Attackers can send a fingerprint header to obtain a visitor JWT and iterate sequential chatId values to…
CWE: CWE-639
NVD
MEDIUM
CVE-2026-111409
CVE-2026-111409
Missing Authorization vulnerability in YITH YITH PayPal Express Checkout for WooCommerce yith-paypal-express-checkout-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects YITH PayPal Express Checkout for WooCommerce: from n/a through 1.61.0.
CWE: CWE-862
GitHub-GHSA
MEDIUM
kin-openapi deepObject query decoding repeatedly compiles an invariant regular expression
kin-openapi deepObject query decoding repeatedly compiles an invariant regular expression
### Summary
`openapi3filter` decodes `deepObject`-style query parameters by looping over **every** key in the request's query string. Inside that loop it recompiles a **loop-invariant** regular expression on every iteration. The pattern depends only on the spec-defined parameter name, not on the lo…
CVE-2026-100350
GitHub-GHSA
MEDIUM
kin-openapi spec loader panics on a self-referential additionalProperties $ref (nil-pointer DoS)
kin-openapi spec loader panics on a self-referential additionalProperties $ref (nil-pointer DoS)
The defect
———-
Confirmed at HEAD (f0407d5, v0.144.0). openapi3/loader.go, inside resolveComponent's drill closure (around line 455), the case *SchemaRef branch for pathPart == "additionalProperties" dereferences c.Value.AdditionalProperties with no nil-check on c.Value:
———-
Confirmed at HEAD (f0407d5, v0.144.0). openapi3/loader.go, inside resolveComponent's drill closure (around line 455), the case *SchemaRef branch for pathPart == "additionalProperties" dereferences c.Value.AdditionalProperties with no nil-check on c.Value:
case *SchemaRef:
…
CVE-2026-100348
GitHub-GHSA
MEDIUM
kin-openapi: Unauthenticated panic (DoS) in openapi3filter legacy router via non-canonical/unsupported HTTP method on a static path
kin-openapi: Unauthenticated panic (DoS) in openapi3filter legacy router via non-canonical/unsupported HTTP method on a static path
## Summary
The `openapi3filter.ValidationHandler` (the exported, documented request-validation middleware) hard-wires the legacy router (`routers/legacy`). That router matches the incoming request method verbatim against a trie built exclusively from upper-cased canonical HTTP methods. A request car…
The `openapi3filter.ValidationHandler` (the exported, documented request-validation middleware) hard-wires the legacy router (`routers/legacy`). That router matches the incoming request method verbatim against a trie built exclusively from upper-cased canonical HTTP methods. A request car…
CVE-2026-100347
GitHub-GHSA
MEDIUM
MessagePack: Nested arrays can blow past buffer length limits
MessagePack: Nested arrays can blow past buffer length limits
### Impact
MessagePack-CSharp is vulnerable to denial of service through excessive memory allocation when deserializing attacker-controlled data into `System.Object`.
When `PrimitiveObjectFormatter` encounters an array, it allocates an `object[]` using the declared array length **before** enforcin…
CVE-2026-92707
NVD
MEDIUM
CVE-2026-100350
CVE-2026-100350
kin-openapi is a Go project for handling OpenAPI files. From 0.145.0 until 0.146.0, openapi3filter repeatedly calls regexp.MustCompile for the same parameter-name regular expression inside the per-query-key loop in urlValuesDecoder.DecodeObject used to decode a deepObject query parameter. An unauthe…
CWE: CWE-400, CWE-770, CWE-1050
NVD
MEDIUM
CVE-2026-110926
CVE-2026-110926
A flaw was found in OpenSSH. When compression is negotiated, channels on the same connection share one LZ77 dictionary. A peer who can write on one channel can recover plaintext from another channel by chosen-plaintext lengths.
CWE: CWE-203
NVD
MEDIUM
CVE-2026-110816
CVE-2026-110816
### Summary
`qs.stringify` with `arrayFormat: 'comma'` throws `TypeError: Cannot convert object to primitive value` when an array element cannot be coerced to a string, such as an object with an own non-callable `toString` (`{ "toString": "x" }`) or a null-prototype object. The comma format joins…
CWE: CWE-248, CWE-704
NVD
MEDIUM
CVE-2026-110248
CVE-2026-110248
Insertion of sensitive information into log files in the git_utils[.]py component in Amazon SageMaker Python SDK V3 before 3.10.0 and V2 before 2.257.3 might allow an authenticated remote user to obtain plaintext repository credentials from CloudWatch Logs when a git clone operation fails, because t…
CWE: CWE-532
NVD
MEDIUM
CVE-2026-102080
CVE-2026-102080
An Improper Resource Locking vulnerability in the clock synchronization daemon (clksyncd) of Juniper Networks Junos OS on MX Series allows a unauthenticated, logically adjacent attacker to cause a Denial-of-Service (DoS).
If a SyncE or PTP upstream node sends a malformed message to an MX device e…
CWE: CWE-413
NVD
MEDIUM
CVE-2026-95101
CVE-2026-95101
Description
NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_v3_module module. When using HTTP/3 with
NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_v3_module module. When using HTTP/3 with
proxy_request_buffering on directive, an unauthenticated attacker may be able to inject data in the proxied request.
Impact
This vulnerability may allow remote attackers …
CWE: CWE-172
NVD
MEDIUM
CVE-2026-101025
CVE-2026-101025
Description
NGINX JavaScript (njs) has a vulnerability where the built-in njs engine leaks a libxml2 parser context when xml.parse() fails. The failure path did not register cleanup and the context was not released for the lifetime of the process. An unauthenticated attacker may send requests with…
CWE: CWE-401
NVD
MEDIUM
CVE-2026-85473
CVE-2026-85473
The auth0/java-jwt library may terminate a thread if it receives a JWT with a timestamp claim (exp, nbf, iat) containing an out-of-range value. The condition occurs during token parsing, prior to signature verification. Repeated requests of this nature may lead to degraded availability of the affect…
CWE: CWE-20, CWE-755
GitHub-GHSA
MEDIUM
Microsoft Security Advisory CVE-2026-96234 – .NET and Visual Studio Information Disclosure Vulnerability
Microsoft Security Advisory CVE-2026-96234 – .NET and Visual Studio Information Disclosure Vulnerability
## Executive summary
Microsoft is releasing this security advisory to provide information about a vulnerability in Microsoft.WindowsDesktop.App.Runtime (WPF). This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability.
Restrictive XAML …
CVE-2026-96234
GitHub-GHSA
MEDIUM
Microsoft Security Advisory CVE-2026-92707 – ASP.NET Core Denial of Service Vulnerability
Microsoft Security Advisory CVE-2026-92707 – ASP.NET Core Denial of Service Vulnerability
## Executive summary
Microsoft is releasing this security advisory to provide information about a vulnerability in Microsoft.AspNetCore.SignalR.Protocols.MessagePack; MessagePack; MessagePack.Annotations; MessagePackAnalyzer. This advisory also provides guidance on what developers can do to update …
NVD
MEDIUM
CVE-2026-102198
CVE-2026-102198
Out-of-bounds read in Windows Remote Desktop Protocol allows an authorized attacker to disclose information over a network.
CWE: CWE-125
NVD
MEDIUM
CVE-2026-85733
CVE-2026-85733
FrankenPHP is a modern application server for PHP. Prior to 1.12.5, the official FrankenPHP Debian and Alpine Docker images include a default /app/public/index.php that executes phpinfo(). A derived image that does not overwrite this placeholder serves the diagnostics page in production and can disc…
CWE: CWE-200
NVD
MEDIUM
CVE-2026-109786
CVE-2026-109786
In fail2ban 0.10.5 through 1.1.1 before ddd879d, the sshd filter (config/filter.d/sshd.conf) accepts an "on <token>" suffix after the host address. Because OpenSSH logs the offered username verbatim, a remote unauthenticated attacker can use a username such as "x VICTIM-SOURCE-IP-ADDRESS on" to make…
CWE: CWE-117
NVD
MEDIUM
CVE-2026-109425
CVE-2026-109425
Tink-go (tink-crypto/tink-go) through 2.8.0 contains an input-validation vulnerability where keyset.NewHandleWithNoSecrets() and ReadWithNoSecrets() skip the structural Validate() step before constructing a keyset.Handle, allowing malformed public or no-secret keysets that violate Tink's keyset inva…
CWE: CWE-1286
NVD
MEDIUM
CVE-2026-109239
CVE-2026-109239
Crawl4AI before 0.9.4 contains a blind server-side request forgery vulnerability in RobotsParser.can_fetch that lets unauthenticated attackers bypass Docker server egress controls. Attackers can enable check_robots_txt and use redirects or DNS rebinding to reach internal, loopback, or cloud-metadata…
CWE: CWE-918
NVD
MEDIUM
CVE-2026-58394
CVE-2026-58394
OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, src/www/system_advanced_admin.php reads certificate records into $a_cert but omits that array from legacy_html_escape_form_data() before rendering each certificate descr value in the SSL Certificate selector. The ce…
CWE: CWE-79
NVD
MEDIUM
CVE-2026-107674
CVE-2026-107674
IBM i 7.3, 7.4, 7.5, and 7.6 is vulnerable to a denial of service to Digital Certificate Manager (DCM) for System TLS using applications attempting to create secure network connections. A bad actor could use this to prevent a service from starting or cause it to fallback to non-secure connections.
CWE: CWE-667
NVD
MEDIUM
CVE-2026-110594
CVE-2026-110594
BottleCRM 0.43 through 1.14.5 contains a regular expression denial of service vulnerability that allows authenticated organization administrators to block web workers via unbounded routing rule regex patterns. Attackers can create a routing rule with a catastrophically backtracking pattern evaluated…
CWE: CWE-1333
NVD
MEDIUM
CVE-2026-110924
CVE-2026-110924
A flaw was found in OpenSSH. With GSSAPI authentication enabled, a failed GSSAPI attempt can leave delegated credentials stored for the connection even though user authorization did not succeed. A later successful login on that connection is not authorized by the leftover state.
CWE: CWE-459
NVD
MEDIUM
CVE-2026-19936
CVE-2026-19936
The Bluetooth Mesh Access-layer delayable message queue in subsys/bluetooth/mesh/delayable_msg.c shares three intrusive lists (busy_ctx, free_ctx, free_chunks) and one k_work_delayable between two cooperative threads with no synchronization: bt_mesh_delayable_msg_manage() runs on the Bluetooth host …
CWE: CWE-362
NVD
MEDIUM
CVE-2026-102186
CVE-2026-102186
Untrusted pointer dereference in Windows Network File System allows an authorized attacker to disclose information locally.
CWE: CWE-822
NVD
MEDIUM
CVE-2026-77361
CVE-2026-77361
obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. Prior to 1.3.1, read access-control list (ACL) checks use a lexical vault-relative path while containment checks use the resolved path. An in-vault symlink under an allowed glob that resolves into a denied fold…
CWE: CWE-59, CWE-863
NVD
MEDIUM
CVE-2026-19600
CVE-2026-19600
Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 fail to sanitize authentication tokens before writing them to server log entries, which allows an attacker with access to server logs to obtain valid session tokens or OAuth access tokens and impersonate au…
CWE: CWE-532
NVD
MEDIUM
CVE-2026-19076
CVE-2026-19076
Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to reject OAuth application sessions in the account type switch endpoint, which allows an attacker with a valid OAuth bearer token for a target user to permanently take over that user's SSO-backed accou…
CWE: CWE-863
NVD
MEDIUM
CVE-2026-102221
CVE-2026-102221
No cwe for this issue in Windows Secure Boot allows an authorized attacker to bypass a security feature locally.
CWE: CWE-299
NVD
MEDIUM
CVE-2026-109281
CVE-2026-109281
ImageMagick 7.1.0-21 before 7.1.2-32 contains a heap buffer over-read in its handling of the -fx option, where a certain -fx operation reads beyond the bounds of an allocated heap buffer in specific situations. Attackers who can get a crafted -fx expression processed can read out-of-bounds heap memo…
CWE: CWE-125
NVD
MEDIUM
CVE-2026-111988
CVE-2026-111988
A security flaw has been discovered in dyad-sh dyad up to 1.16.0. Affected by this issue is some unknown functionality of the component OAuth Callback Handler. Performing a manipulation results in cross-site request forgery. The attack may be initiated remotely. Upgrading to version 1.17.0-beta.1 ca…
CWE: CWE-352, CWE-862
NVD
MEDIUM
CVE-2026-96628
CVE-2026-96628
Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to 2.11.0, AuthMiddleware.managerAuth accepts X-Arcane-Agent-Token credentials and the environment-token branch calls next before the AdminRequired option is evaluated. An attacker with a valid X-Arcane-Agent…
CWE: CWE-863
GitHub-GHSA
MEDIUM
Arcane: Environment access token bypasses the admin-required authorization gate on `/api/debug/pprof`
Arcane: Environment access token bypasses the admin-required authorization gate on `/api/debug/pprof`
## Summary
Arcane v2.10.2 contains an authorization inconsistency in `AuthMiddleware.managerAuth`.
When a request supplies a valid environment access token through the `X-Arcane-Agent-Token` header, `managerAuth` resolves the associated environment, installs an environment-scoped permission set, a…
CVE-2026-96628
GitHub-GHSA
MEDIUM
SFTPGo source-side file-pattern filter bypass during copy operations
SFTPGo source-side file-pattern filter bypass during copy operations
### Summary
File pattern filters (`denied_patterns` / `allowed_patterns`) were evaluated on the destination of a copy only. A user holding the copy permission could copy a file denied by the filters to a permitted name and then read it. A recursive directory copy reproduced the contents of a restri…
CVE-2026-103028
GitHub-GHSA
MEDIUM
Backstage: Improper access control in backend action invocation
Backstage: Improper access control in backend action invocation
### Impact
An authenticated user could invoke actions that an operator had excluded through action configuration. Existing action permissions and downstream authorization remain enforced.
### Patches
Patched in `@backstage/backend-defaults` version `0.17.8`
### Workarounds
Limit access to actio…
CVE-2026-106495
NVD
MEDIUM
CVE-2026-58395
CVE-2026-58395
OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, the safe-delete path reached through ApiMutableModelControllerBase::delBase() interpolates an unvalidated safe-delete token from the request URL into an XPath expression over config.xml before confirming that the to…
CWE: CWE-643
NVD
MEDIUM
CVE-2026-110927
CVE-2026-110927
A flaw was found in OpenSSH. After compression is negotiated, a compressed payload can expand past the maximum supported packet size because the inflate loop does not stop at that limit. Memory use grows in the process handling that connection.
CWE: CWE-770
NVD
MEDIUM
CVE-2026-110809
CVE-2026-110809
A security vulnerability has been detected in sgl-project SGLang up to 0.5.19. Affected by this issue is the function Session.create_req of the file python/sglang/srt/session/session_controller.py of the component Session Cleanup. Such manipulation leads to denial of service. The attack may be perfo…
CWE: CWE-404
NVD
MEDIUM
CVE-2026-110807
CVE-2026-110807
A weakness has been identified in sgl-project SGLang up to 0.5.19. Affected by this vulnerability is an unknown functionality of the file python/sglang/srt/managers/io_struct.py of the component generate Endpoint. This manipulation of the argument session_params causes denial of service. The attack …
CWE: CWE-404
NVD
MEDIUM
CVE-2026-110763
CVE-2026-110763
lamp-boot 4.16.0-java17 through 4.21.2-java17 contains an insecure direct object reference vulnerability in the oauth module's /anyone/findDeptByCompany endpoint that skips URI permission checks. Authenticated low-privilege users can iterate sequential employeeId values to read every employee's depa…
CWE: CWE-639
NVD
MEDIUM
CVE-2026-110143
CVE-2026-110143
Use of uninitialized variable in ThirdParty lmza_sdk in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to potentially read memory inside the sandbox via a crafted file. (Chromium security severity: High)
CWE: CWE-457
NVD
MEDIUM
CVE-2026-110122
CVE-2026-110122
PickMall lilishop through 4.4 contains an insecure direct object reference vulnerability that allows authenticated sellers to change other stores' product freight templates via PUT /store/goods/goods/freight. GoodsServiceImpl.freight and GoodsSkuServiceImpl.freight update goods and SKUs by id withou…
CWE: CWE-639
NVD
MEDIUM
CVE-2026-77362
CVE-2026-77362
obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. Prior to 1.3.1, bridge tools do not consistently apply the read access-control list (ACL) to every returned field. The tasks_filter tool exposes group counts derived from denied notes, makemd_query passes unfil…
CWE: CWE-200, CWE-863
NVD
MEDIUM
CVE-2026-109962
CVE-2026-109962
Froxlor 0.10.0 before 2.3.14 contains a missing authorization vulnerability that allows reseller accounts to read full-admin-only MySQL server and cronjob configuration via API read commands. Resellers can call MysqlServer.listing, MysqlServer.get, or Cronjobs.listing through api.php to obtain manag…
CWE: CWE-285
NVD
MEDIUM
CVE-2026-105458
CVE-2026-105458
GitLab has remediated an issue in GitLab EE affecting all versions from 19.1 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user holding a specific granular permission to obtain a GitLab Duo Agent Platform token that bypa…
CWE: CWE-807
NVD
MEDIUM
CVE-2026-97691
CVE-2026-97691
Convex is an open-source reactive database for application developers. Prior to the self-hosted image published on August 10, 2026 and local deployment binary precompiled-2026-08-10-c0cb7ae, a malicious user can, in rare cases, perform unauthorized reading of deployment information from a Convex dep…
CWE: CWE-284
GitHub-GHSA
MEDIUM
JupyterLab: Command link trust prompt in JupyterLab can trust a document other than the one clicked
JupyterLab: Command link trust prompt in JupyterLab can trust a document other than the one clicked
## Description
A Markdown file or a notebook output can carry a button that runs a JupyterLab command. Since 4.5.7 the first click on such a button opens a prompt naming the command, with Cancel, Run Once and Trust. Choosing Trust runs the command and marks the document trusted, so its later button…
CVE-2026-102832
NVD
MEDIUM
CVE-2026-110160
CVE-2026-110160
Missing authorization in ReadingMode in Google Chrome prior to 155.0.8059.79 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to potentially bypass site isolation via a crafted HTML page. (Chromium security severity: High)
CWE: CWE-862
NVD
MEDIUM
CVE-2026-110107
CVE-2026-110107
RuoYi-Cloud-Plus through 6.0.0 contains an insecure direct object reference vulnerability that allows authenticated users to delete other users' social login bindings by supplying their socialId. Attackers can send DELETE /auth/unlock/{socialId}, which deletes sys_social rows by primary key without …
CWE: CWE-639
NVD
MEDIUM
CVE-2026-110106
CVE-2026-110106
RuoYi-Vue-Plus through 6.0.0 contains an insecure direct object reference vulnerability that allows authenticated users to delete other users' social login bindings by supplying their socialId. Attackers can send DELETE /auth/unlock/{socialId} requests with a victim's binding id to remove their GitH…
CWE: CWE-639
NVD
MEDIUM
CVE-2026-109561
CVE-2026-109561
goose from 1.28.0 before 1.44.0 contains an authorization bypass vulnerability that allows tools to run without user approval in Manual Approval mode because persisted read-only annotations are never cleared by update_goose_mode. After a session uses Smart Approval mode, prompt-injected calls to too…
CWE: CWE-863
NVD
MEDIUM
CVE-2026-110652
CVE-2026-110652
ONLYOFFICE DocumentServer before 10.0.0 contains an unauthenticated server-side request forgery vulnerability in the /downloadfile/:docid endpoint that allows remote attackers to bypass the private-IP request-filtering-agent by exploiting the isInJwtToken flag when JWT verification is disabled in th…
CWE: CWE-918
GitHub-GHSA
MEDIUM
containerd: Unpack DoS via repeated opaque whiteouts
containerd: Unpack DoS via repeated opaque whiteouts
### Impact
A vulnerability exists in containerd's layer unpack handler where the processing of certain image layers causes superlinear time complexity. During the unpack operation, specific file configurations within the layer can trigger repeated directory traversals.
Consequently, pulling or imp…
CVE-2026-95838
GitHub-GHSA
MEDIUM
copyparty FTP: upload outside defined volumes (limited path traversal)
copyparty FTP: upload outside defined volumes (limited path traversal)
The FTP and FTPS server — if enabled — would allow uploading to any folder that the copyparty process had permission to write to.
The FTP-server is default-disabled, and must be explicitly enabled in the config with global-option `ftp` or `ftps` to be affected. Additionally, SFTP was not affected…
CVE-2026-104102
GitHub-GHSA
MEDIUM
Gotify: Insufficiently Protected Password Change endpoint
Gotify: Insufficiently Protected Password Change endpoint
The password change endpoint (`POST /current/user/password`) in Gotify versions <= 2.9.1 does not require knowledge of the current password. An attacker in possession of a valid client token can set a new password for the affected user. Recovering the account requires administrator intervention or d…
CVE-2026-102603
GitHub-GHSA
MEDIUM
Nuxt OG Image cache poisoning through derivable cache keys on unsigned dynamic image routes
Nuxt OG Image cache poisoning through derivable cache keys on unsigned dynamic image routes
**Vendor:** Nuxt
**Product:** Nuxt OG Image
**Version:** 6.2.5
**Description:** Due to the specifics of caching and key generation in the Open Graph image cache created by the module, an unauthenticated attacker can modify the content of the image (for example, the `title` parameter) that is deliver…
**Product:** Nuxt OG Image
**Version:** 6.2.5
**Description:** Due to the specifics of caching and key generation in the Open Graph image cache created by the module, an unauthenticated attacker can modify the content of the image (for example, the `title` parameter) that is deliver…
CVE-2026-102527
GitHub-GHSA
MEDIUM
AdonisJS HTTP Server: Uncontrolled Resource Consumption and Inefficient Regular Expression Complexity
AdonisJS HTTP Server: Uncontrolled Resource Consumption and Inefficient Regular Expression Complexity
### Description
A Regular Expression Denial of Service vulnerability in the built-in AdonisJS slug route matcher may allow a remote attacker to block the Node.js event loop using a specially crafted URL.
This affects applications using `router.matchers.slug()` on a route parameter reachable by an …
CVE-2026-104150
GitHub-GHSA
MEDIUM
borg extract might modify out-of-tree files when extracting maliciously crafted archives
borg extract might modify out-of-tree files when extracting maliciously crafted archives
### Impact
A maliciously crafted archive could contain a symlink (e.g. "evil" -> "/etc") followed by an item below it ("evil/passwd"), or an item whose path embeds ".." (e.g. "a/../../etc/passwd").
When extracting such items, borg followed the symlink / resolved the "..", so it could delete or ove…
CVE-2026-62268
GitHub-GHSA
MEDIUM
Terragrunt catalog predictable temp symlink clobber
Terragrunt catalog predictable temp symlink clobber
### Summary
Terragrunt's `terragrunt catalog` command clones each repository referenced in your catalog configuration into a temporary working directory. In affected versions, the clone path it derived was deterministic and sat under the shared system temporary directory, in the form `<tmp>/catalog…
CVE-2026-64672