Vulnerability

The MISP project has patched multiple security vulnerabilities in the cti-transmute tool, including arbitrary file/network access and improper authorization controls for user management.

An unauthenticated access control flaw in Atlas-Livre allows attackers to bypass authentication and execute privileged database operations due to a failure to terminate script execution following HTTP redirects.

A hard-coded cryptographic key vulnerability (CVE-2026-18411) in Acrisure KARR BT and DR-100 automotive anti-theft systems allows nearby attackers to issue unauthorized commands to vehicles.

Perspective version 5.0.0 is vulnerable to unauthenticated remote code execution via unsafe Python eval() calls within the PolarsVirtualServer backend triggered by crafted protobuf messages.

A missing authorization vulnerability (CVE-2026-18650) in HAVELSAN Liman MYS versions 2.2.3 through 2.3.0 allows authenticated users to escalate privileges.

A stack-based buffer overflow vulnerability (CVE-2026-10709) in the Autodesk FBX SDK allows arbitrary code execution via maliciously crafted FBX files.

A vulnerability in Zyxel firewall firmware allows a remote, authenticated attacker to achieve arbitrary code execution on the device.

Multiple vulnerabilities in Red Hat Enterprise Linux within DBI and perl-GD components allow local or remote attackers to execute arbitrary code, manipulate data, or trigger denial-of-service conditions.

Multiple Denial of Service vulnerabilities in IBM Tivoli Netcool/OMNIbus, potentially involving vulnerable Immutable.js libraries, allow unauthenticated remote attackers to disrupt service availability.

LibreNMS versions prior to 26.5.0 are affected by multiple vulnerabilities including RCE, SSRF, and XSS, posing a significant risk for unauthorized system access and network reconnaissance.

Multiple critical vulnerabilities in Bilin Software and Informatics Consultancy Inc. HUMANIST Digital Human Resources version 26.0 allow unauthorized access, web shell upload, session hijacking, and remote code execution. Upgrade to version 26.1 immediately.

Guzzle versions before 7.15.2 and 8.0.1 are vulnerable to a host-based security check bypass where transport handlers interpret non-canonical URI hostnames differently than application-level validation, potentially enabling SSRF.

FirmaCheck for Windows versions prior to 1.3.16 are susceptible to local privilege escalation and arbitrary code execution due to an unvalidated OpenSSL configuration file path.

ClearOS 7.9 contains an OS command injection vulnerability in the Log Viewer component that allows authenticated attackers to execute arbitrary commands as the webconfig user, with subsequent escalation to root.

Emlog Pro versions up to 2.6.23 contain a vulnerability in the AI service component that disables TLS certificate verification, allowing attackers to perform man-in-the-middle interception of LLM API keys and manipulate AI responses.

A memory exhaustion vulnerability in socket.io-parser (CVE-2026-69185) allows remote attackers to trigger denial-of-service by sending specially crafted packets containing a large number of binary attachments.

The undici library is susceptible to cache poisoning leading to information disclosure and application crashes due to improper handling of malformed Cache-Control directives in the cache interceptor.

Krayin CRM versions prior to 2.2.4 contain a blind SQL injection vulnerability in the leads DataGrid, allowing authenticated attackers to exfiltrate database contents via the rotten_lead[in] query parameter.

Multiple Wavlink networking devices are vulnerable to a remote stack-based buffer overflow in the lighttpd component due to insecure use of strcpy in the upload.cgi script via the HTTP_COOKIE header.

A local privilege escalation vulnerability in Razer RzUpdateService version 1.10.14.0 allows local attackers to manipulate the Named Pipe Handler to gain unauthorized privileges.

Krayin CRM 2.2.4 contains a missing authentication vulnerability in the installer middleware, allowing unauthenticated remote attackers to overwrite the administrator account via crafted HTTP POST requests.

OpenEMR versions 8.2.0 and earlier are vulnerable to authenticated remote code execution via SQL injection and unsafe eval() calls in the document category tree component.

CVE-2026-60004 is a critical pre-authentication RCE vulnerability in Gitea and Forgejo platforms caused by an unsafe bare clone design in the diffpatch API endpoint, enabling arbitrary command execution via injected Git hooks.

A use-after-free vulnerability in the Linux kernel posix-cpu-timers subsystem, identified as CVE-2026-64560, allows attackers to trigger kernel memory corruption via a race condition during non-leader thread exec() calls.

A vulnerability in Red Hat Multicluster Engine for Kubernetes allows an unauthenticated remote attacker to trigger a denial of service condition by exploiting a software flaw.

Multiple vulnerabilities in Red Hat Ansible Automation Platform allow a remote, unauthenticated attacker to achieve remote code execution or manipulate information displayed by the platform.

Multiple vulnerabilities in cPanel/WHM allow remote attackers to manipulate files and escalate privileges, potentially leading to arbitrary code execution with administrative rights.

Gitea contains a critical vulnerability allowing remote, unauthenticated attackers to execute arbitrary code and gain unauthorized access to sensitive information.

A critical unauthenticated remote code execution vulnerability, CVE-2026-13714, in Realtyna WPL Real Estate and Organic IDX plugins allows attackers to upload arbitrary PHP shells via the I/O API.

A heap-based buffer overflow in FreeRDP versions 3.29.0 and earlier allows a malicious RDP server to execute an out-of-bounds write in the memory of a paste consumer process when handling clipboard file transfers.

An unauthenticated directory traversal vulnerability in the CubeWP Framework plugin allows attackers to read arbitrary files by leveraging exposed AJAX nonces.

GitPython versions prior to 3.1.51 are vulnerable to command injection because the library's security blocklist fails to account for Git command-line option abbreviation, allowing attackers to execute arbitrary commands.

FreeRDP versions 3.28.0 and earlier are vulnerable to a heap out-of-bounds read during the processing of malicious RDP server glyph fragments, allowing for potential client-side crashes or information disclosure.

A null pointer dereference vulnerability in FreeRDP prior to 3.29.0 allows remote attackers to trigger a crash in the client process via crafted smartcard cache requests.

The Savon Ruby library is vulnerable to remote code execution (CVE-2026-53510) due to insecure use of module_eval when processing untrusted WSDL operation names.

An unauthenticated remote attacker can trigger a panic and crash the Pterodactyl Wings service by sending a maliciously crafted packet during the SFTP handshake.

A DNS rebinding vulnerability in the NLTK pathsec module allows attackers to bypass SSRF filters and access restricted internal resources by manipulating hostname resolution during the validation and connection phases.

Adversaries can exploit the creation of JavaScript-based user-defined functions in Apache Cassandra to escape the Nashorn sandbox and achieve remote code execution, particularly when vulnerable to CVE-2021-44521.

A vulnerability in Redis allows a remote, authenticated attacker to achieve arbitrary code execution on the target server.

Multiple vulnerabilities, including remote XSS and security policy bypass, have been identified in Progress MOVEit Transfer versions prior to 2026.0.3, enabling potential unauthorized access and session-based script execution.

Logsign SIEM versions prior to 6.4.108 are vulnerable to a critical code injection flaw (CVE-2026-17561) that enables unauthenticated remote attackers to achieve arbitrary code execution.

An unauthenticated remote code execution vulnerability in Juggle Through 1.6.0 allows attackers to leverage default credentials on the H2 database console to execute system-level commands.

A critical unauthenticated command injection vulnerability (CVE-2026-12943) in IBM HMC and Novalink allows remote attackers to execute arbitrary commands with elevated privileges.

A buffer overflow vulnerability in IBM PowerVM Hypervisor allows a local attacker with low privileges to trigger system crashes or compromise OS memory integrity via crafted hypervisor calls.

IBM Langflow OSS versions 1.0.0 through 1.10.1 are susceptible to unauthenticated remote code execution due to improper sanitization of environment variables in the MCP stdio launcher.

SolarWinds Web Help Desk versions 2026.1 and prior are vulnerable to a critical authentication bypass via the SAML 2.0 implementation, allowing unauthenticated remote access.

A remote unauthenticated denial-of-service vulnerability in IBM WebSphere Application Server - Liberty allows attackers to cause excessive memory consumption via crafted requests.

Multiple vulnerabilities in Spring Tools for Eclipse and VSCode/Cursor/Theia allow for remote code execution, unauthorized service access, credential exposure, and cross-site scripting.

A blind SQL injection vulnerability, tracked as CVE-2026-58046, affects the Plesk XML-RPC API, potentially allowing unauthenticated attackers to execute arbitrary database queries.

Flyto-core versions prior to 2.26.7 allow unauthenticated callers to exfiltrate API provider keys by supplying a malicious 'base_url' parameter, which forces the library to append operator-configured secrets to requests sent to attacker-controlled infrastructure.

An unauthenticated SSRF vulnerability in the Flyto Core /run endpoint allows attackers to exfiltrate the internal FLYTO_RUNNER_SECRET and perform unauthorized requests against internal infrastructure.

Multiple security vulnerabilities identified in GitLab CE and EE versions 19.x can result in remote denial of service, data confidentiality breaches, and reflected cross-site scripting.

CentreStack versions prior to 17.4 are vulnerable to an unauthenticated XXE injection via the SharePoint storage configuration handler, allowing attackers to exfiltrate sensitive server-side files.

An unauthenticated deserialization vulnerability in CentreStack allows remote attackers to create unauthorized local user accounts by sending crafted XML payloads to specific API endpoints.

IBM WebSphere Application Server and Liberty are vulnerable to a security bypass flaw that permits remote, unauthenticated attackers to circumvent established security controls.

Multiple vulnerabilities in Red Hat Enterprise Linux packages perl-Archive-Tar and httplib2 can be exploited by a remote, anonymous attacker to cause a Denial of Service condition.

A critical vulnerability (CVE-2026-44090) in Phoenix Contact CHARX SEC controllers allows unauthenticated remote attackers to gain full device control by bypassing authentication on the MQTT broker.

A file descriptor leak in the Performance Co-Pilot (PCP) linux_sockets module allows an attacker with initial code execution to escalate privileges to root.

A command injection vulnerability (CVE-2026-16524) in the PCP linux_sockets PMDA allows local attackers to execute arbitrary commands by injecting shell metacharacters into the network.persocket.filter metric.

The V library (versions 0.5.2 and below) contains a server-side request forgery (SSRF) bypass vulnerability allowing attackers to circumvent host-based allowlists via URL parsing differentials.

IBM WebSphere Application Server and Liberty are vulnerable to unauthenticated Server-Side Request Forgery (SSRF) when the SIP container feature is enabled, allowing attackers to perform unauthorized requests to internal services.

A critical insecure deserialization vulnerability (CVE-2026-63077) in JetBrains TeamCity allows unauthenticated remote attackers to execute arbitrary system commands via the agent polling protocol.

The proot-distro utility contains a symlink traversal vulnerability (CVE-2026-54574) that allows malicious tar archives to overwrite arbitrary files on the host filesystem during the installation or reset process.

The Elixir library 'Req' (versions >= 0.1.0, < 0.6.1) is susceptible to a denial-of-service vulnerability (CVE-2026-49755) caused by unbounded archive and compression extraction, which an attacker can leverage by providing a malicious HTTP response with a crafted 'content-type' or 'content-encoding' header, leading to memory exhaustion and application crashes.

A critical XML External Entity Injection (XXE) vulnerability, CVE-2026-54079, in veraPDF's validation-model module allows a remote attacker to read arbitrary files on the server file system or perform Server-Side Request Forgery (SSRF) by submitting a crafted PDF containing a malicious XFA stream, due to insecure XML parsing defaults.

CVE-2026-67215 describes a denial-of-service vulnerability in cJSON through version 1.7.19, where an attacker can trigger uncontrolled recursion and stack exhaustion by supplying a crafted RFC 6902 JSON Patch to cJSONUtils_ApplyPatches() or cJSONUtils_ApplyPatchesCaseSensitive(), leading to process crash.

A critical vulnerability, CVE-2026-66299, has been discovered in Apache Tomcat versions 9.0.x prior to 9.0.121, 10.1.x prior to 10.1.58, and 11.0.x prior to 11.0.25, allowing a remote attacker to cause a denial of service (DoS).

Multiple vulnerabilities have been discovered in Xen, allowing an attacker to achieve privilege escalation, remote denial of service, and compromise data confidentiality across all unpatched Xen versions, necessitating immediate patching.

A vulnerability in Apache Tomcat allows a remote, anonymous attacker to perform a Denial of Service attack, potentially disrupting service availability for applications hosted on the affected server.

An attacker can exploit multiple vulnerabilities in BlackBerry UEM Management Console to perform cross-site scripting attacks, cause a denial of service, and disclose information.

Multiple vulnerabilities exist in IBM WebSphere Application Server and IBM WebSphere Application Server Liberty that an attacker can exploit to execute arbitrary code, escalate privileges, perform denial of service attacks, disclose sensitive information, manipulate files, conduct cross-site scripting attacks, and bypass security measures.

Multiple vulnerabilities in Broadcom Brocade SANnav can be exploited by an attacker from an adjacent network to achieve information disclosure, execute SQL injection attacks, and manipulate data within the system.

An out-of-bounds write vulnerability, CVE-2026-18220, exists in the BFD library's DLX ELF backend (bfd/elf32-dlx.c) in GNU binutils, allowing attackers to achieve arbitrary code execution via a specially crafted ELF/DLX object file processed by BFD-consuming tools.

An unauthenticated attacker can exploit a Stored Cross-Site Scripting vulnerability (CVE-2026-16655) in the Fluent Forms WordPress plugin, versions up to and including 6.2.7, via insufficient input sanitization of the Name Field Nested `password` Member, allowing injection of arbitrary web scripts that execute in a user's browser upon page access.

An attacker can exploit multiple vulnerabilities found in Red Hat Enterprise Linux, specifically within the librest and pipewire components, to bypass security measures and achieve arbitrary code execution on affected systems, posing a significant risk to the integrity and confidentiality of the system.

A remote, authenticated attacker can exploit a vulnerability in PackageKit to bypass security mechanisms.

A vulnerability in Gitea allows a remote, unauthenticated attacker to execute arbitrary code, which could lead to full compromise of the affected Gitea instance and potentially the underlying server.

A remote, authenticated attacker can exploit a SQL injection vulnerability in Tanium Endpoint Management, enabling the execution of arbitrary SQL commands and potentially leading to data manipulation or unauthorized access.

Multiple vulnerabilities exist in IBM WebSphere Application Server Liberty that an attacker can exploit to perform a Denial of Service attack.

CVE-2026-18191 describes a critical Hidden Functionality vulnerability in Vacron VIN-DS783E-E6 devices that allows unauthenticated remote attackers to exploit a specific hidden function to obtain administrator credentials, leading to full device compromise.

An unauthenticated path traversal vulnerability (CVE-2026-54650) in openhole-server and openhole CLI versions 0.1.1 and earlier allows remote attackers to read arbitrary files outside the web root on tunneled local services by exploiting URL-decoded percent-encoded dot-segments and slashes, enabling arbitrary file disclosure and potential bypass of access controls.

A SQL injection vulnerability exists in the `escapeValue()` function of the `@hypequery/clickhouse` library, affecting versions prior to 2.0.2, allowing attackers to leverage a trailing backslash in user-controlled query parameters to bypass escaping mechanisms, leading to arbitrary SQL execution against ClickHouse databases.

A denial-of-service vulnerability exists in the `go/github.com/gotd/td` library versions prior to 0.145.1. A remote, unauthenticated attacker can exploit this by sending a crafted unencrypted MTProto packet during the handshake. This packet declares a large `dataLen` value, forcing the application to allocate an excessive amount of memory, potentially leading to out-of-memory (OOM) termination and denial of service due to unbounded memory allocation before length validation.

A critical vulnerability (CVE-2026-64863) in the goshs WebDAV server, affecting versions up to 2.1.3, allows an attacker to bypass the `--no-delete` security flag using the `MOVE` HTTP method, leading to unauthorized deletion of source files or overwriting of existing destination files, impacting data integrity.

An unauthenticated attacker can exploit CVE-2026-54719 in goshs versions up to 1.1.4 and goshs/v2 up to 2.1.0 to bypass file-based Access Control Lists (ACLs) and read any file under the webroot using the `?bulk` zip-download route, leading to unauthorized information disclosure.

The `datamodel-code-generator` library (versions <= 0.61.0) is vulnerable to an unauthenticated path traversal and arbitrary local file read (CVE-2026-55389), allowing an attacker to supply a crafted JSON-Schema with `$ref` fields pointing to local files using `file://` URIs or `../` path traversal sequences, bypassing the `--no-allow-remote-refs` security control, which leads to information disclosure of sensitive data and enables filesystem mapping.

The `datamodel-code-generator` Python package is vulnerable to code injection (CVE-2026-54654) when a developer uses the `--extra-template-data` option with a file whose `comment` value contains an unescaped carriage return, leading to arbitrary Python code execution during the import process of the generated code.

The `datamodel-code-generator` tool is vulnerable to a Server-Side Request Forgery (SSRF) protection bypass, identified as CVE-2026-55391, due to a time-of-check/time-of-use (TOCTOU) race condition through DNS rebinding, allowing attackers to access internal services like cloud instance metadata endpoints when processing attacker-influenced URLs.

datamodel-code-generator versions 0.59.0 through 0.61.0 are vulnerable to an unauthenticated path traversal and information disclosure issue, allowing an attacker to read arbitrary local files on the system where the code generator is executed by crafting a malicious XML Schema (XSD) `schemaLocation` attribute, with the contents of the files then incorporated into the generated output.

The `datamodel-code-generator` tool, specifically versions from `0.9.1` up to `0.60.2`, is vulnerable to Server-Side Request Forgery (SSRF) when using the `--url` argument with the `[http]` extra installed, allowing attackers to access internal network resources and exfiltrate sensitive data into generated Python files.

A path-segment injection vulnerability (CVE-2026-15280) in the collective routing mechanism of IBM WebSphere Application Server - Liberty versions 17.0.0.3 through 26.0.0.8 ND Collective Controller allows an unauthenticated attacker to inject arbitrary path segments, potentially leading to information disclosure.

CVE-2026-14996 details a high-severity vulnerability (CVSS v3.1 8.2, CWE-613) in IBM Aspera Faspex 5 versions 5.0.0 through 5.0.15.4 that allows unauthenticated, remote attackers to exploit insufficient session management, leading to high confidentiality impact and low integrity impact.

A critical unsafe deserialization vulnerability, CVE-2026-14974, in IBM WebSphere Application Server versions 8.5 and 9.0 traditional, allows a remote attacker to execute arbitrary code by processing specially crafted untrusted data, potentially leading to full system compromise.

A high-severity prototype pollution vulnerability, CVE-2026-14893, exists in the IBM Instana Node.js tracer component (@instana/core version 6.2.1) affecting IBM Observability with Instana Agent builds 1.0.303 through 1.0.320, allowing an attacker to modify critical application behavior through the configuration normalization API.

The IBM Aspera Desktop App (versions 1.0.5 through 1.0.19) is affected by a path traversal vulnerability (CWE-22) which allows files to be written outside of the user's selected download destination, leading to high integrity and confidentiality impacts through arbitrary file write operations, and requires user interaction to exploit.

A critical vulnerability, CVE-2026-14959, in IBM Aspera Faspex 5 (versions 5.0.0 through 5.0.15.4) allows a remote authenticated attacker to execute arbitrary code due to a shell command injection flaw, potentially leading to full system compromise and significant data loss or service disruption.

A critical remote code execution vulnerability (CVE-2026-14958) in IBM Aspera Faspex 5, affecting versions 5.0.0 through 5.0.15.4, allows a remote authenticated attacker to execute arbitrary code due to unquoted shell interpolation, posing a significant risk of system compromise.

A denial of service vulnerability, CVE-2026-16192, affects IBM WebSphere Application Server - Liberty versions 17.0.0.3 through 26.0.0.8 when the `restConnector-2.0` feature is enabled, allowing an unauthenticated attacker to cause service unavailability.

A remote attacker can bypass authentication in IBM WebSphere Application Server versions 9.0 and 8.5 by sending a crafted unauthenticated request, potentially leading to unauthorized access and impact on confidentiality, integrity, and availability.

The Unarchive function in Fission's pkg/utils/zip.go was vulnerable to a Zip Slip path traversal. An attacker controlling a malicious zip archive's URL could leverage this to write files outside the intended destination directory, potentially leading to overwriting sensitive files, accessing secrets from mounted volumes, or tampering with the fetcher's own binaries, impacting other tenants in a multi-tenant containerized environment. This vulnerability affects Fission versions up to and including v1.24.0 and was fixed in v1.25.0.

A remote attacker can exploit CVE-2026-7769, an SQL injection vulnerability in IBM Sterling B2B Integrator and IBM Sterling File Gateway, to send specially crafted SQL statements, allowing them to view, add, modify, or delete information in the backend database.

A session fixation vulnerability, CVE-2026-66745, in Artica Proxy before version 4.50.000000 Service Pack 7 allows unauthenticated attackers to hijack administrative sessions by pre-setting a PHPSESSID on a victim's browser, leading to full administrative control upon victim authentication.

An Untrusted Search Path vulnerability (CVE-2026-48395) in Adobe Bridge, affecting versions up to 16.0.5 and 15.1.6, can be exploited by an attacker to achieve arbitrary code execution in the context of the current user when a victim opens a specially crafted malicious file.

Progress Software has issued a security advisory (AV26-755) addressing multiple vulnerabilities, identified by CVEs CVE-2026-59686 through CVE-2026-59690, across several of its products including ECS Connection Manager, LoadMaster, MOVEit WAF, Multi Tenant, and Object Scale Connection Manager, with specific versions prior to various patch levels being vulnerable, urging administrators to apply necessary updates to secure their systems.

A path traversal vulnerability, tracked as CVE-2026-67185, exists in TinyWeb through version 0.0.8, allowing unauthenticated attackers to read arbitrary files by submitting '..' sequences in the URL path, bypassing security checks and potentially exposing sensitive data like credential stores or private keys when the server runs with root privileges.

An HTTP request smuggling vulnerability, identified as CVE-2026-67182, in Rouille versions 0.3.3 through 3.6.2 allows remote attackers to bypass access controls by injecting bare line feed characters (0x0A) into client-supplied request header values, causing upstream backends to misinterpret subsequent data as a separate, attacker-controlled HTTP request.

A vulnerability, CVE-2026-16313, exists in the `sg_inq` command of `sg3_utils` on Red Hat Enterprise Linux systems, allowing an attacker who can present a specially crafted SCSI device to inject arbitrary properties into the `udev` device database by embedding a newline character in the device's name string, leading to arbitrary command execution as root when the device is disconnected.

A denial-of-service vulnerability (CVE-2026-54632) exists in the SIPSorcery NuGet package versions <= 10.0.8, allowing an unauthenticated attacker to remotely terminate an active RTP or WebRTC media session by sending a single malformed inbound UDP packet to the RTP/ICE socket, which exploits insufficient length checks and an exception handling flaw.

An unauthenticated attacker can exploit an unbounded RECONNECT_REQUEST forwarding vulnerability in QTINeon's NeonRelay component to amplify denial-of-service attacks against a connected host. By sending spoofed RECONNECT_REQUEST packets, the relay forwards each one to the host without proper deduplication or rate limiting, consuming host resources. Additionally, excessive spoofed IPs can reset legitimate rate limiting, further impacting service availability. This vulnerability affects Java, Python, and TypeScript implementations of NeonRelay.

The `OAuth2::Client` in the `oauth2` Ruby gem is vulnerable to credential disclosure and Server-Side Request Forgery (SSRF) due to improper handling of protocol-relative redirect URLs, allowing an attacker to steal bearer tokens and access internal network resources.

The 'oauth' Ruby gem versions 0.5.5 through 1.1.5 are vulnerable to a critical issue (CVE-2026-54605) where the 'OAuth::Consumer#token_request' method improperly handles HTTP 3xx redirects during OAuth 1.0 token exchanges, enabling an attacker to redirect the request to a malicious host, exposing sensitive OAuth 1.0 metadata, and facilitating Server-Side Request Forgery (SSRF) and confused-deputy behavior.

A reachable assertion vulnerability exists in the `Request::remove_prefix` function of the Rouille web server framework, affecting versions 0.1.6 through 3.6.2, allowing remote, unauthenticated attackers to crash the server and cause a denial of service by sending a crafted percent-encoded URL.

A critical HTTP request smuggling vulnerability (CVE-2026-66752) exists in tiny-http versions up to and including 0.12.0, allowing remote attackers to desynchronize request framing by sending a Transfer-Encoding header with arbitrary values, causing the library to incorrectly apply chunk-decoding and ignore Content-Length, which enables request smuggling attacks and can lead to denial of service by tying up connections and consuming worker threads.

Camaleon CMS versions 2.1.1 through 2.9.1 are vulnerable to authenticated remote code execution where an attacker with `custom_fields manage` permission can execute arbitrary Ruby code by injecting a malicious expression into the `select_eval` custom field type's options command parameter, which is then evaluated via `instance_eval` within an ERB view when a post edit page is rendered, leading to server-side code execution with web server process privileges.

A privilege escalation vulnerability, CVE-2026-54593, exists in Pterodactyl's Wings component that allows authenticated subusers to upload arbitrary files to a server without explicit file creation permissions, due to insufficient validation of panel-signed JSON Web Tokens (JWTs.

An Uncontrolled Search Path Element vulnerability, CVE-2026-8164, in ArkSigner Desktop Client versions from v2.2.16.10 through 17062026 allows a local attacker to perform Search Order Hijacking, potentially leading to arbitrary code execution or privilege escalation with the application's privileges.

An improper privilege escalation vulnerability (CVE-2026-63727) exists in Anchore Enterprise versions 5.11.0 to 5.27.1 and 6.0.0, specifically within the user management API, allowing an authenticated attacker to issue a crafted API call to modify user permissions and gain elevated access to resources and operations, such as granting write access to a read-only user, with fixes available in versions 5.27.2 and 6.0.1.

An unauthenticated attacker can exploit CVE-2026-61609, a global rate-limit vulnerability in Pterodactyl Panel versions up to and including 1.12.4, by sending approximately 10 requests per minute to authentication endpoints, leading to a panel-wide denial of service for all legitimate users and administrators attempting to log in or complete 2FA.

A nil pointer dereference vulnerability, tracked as CVE-2026-47427, in the GitHub MCP Server's `completion/complete` handler allows an unauthenticated attacker to cause a complete denial of service by sending a malformed JSON-RPC request with missing or empty parameters for the `ref` field, leading to an immediate server crash.

Multiple vulnerabilities, including decompression bombs (CVE-2026-48586, CVE-2026-49158), an integer overflow (CVE-2026-55969), and a heap out-of-bounds read (CVE-2026-58023), affect Apache Thrift prior to version 0.24.0, potentially leading to denial of service, memory corruption, or arbitrary code execution, and require immediate patching.

WordPress Coding Standards (WordPressCS) versions before 3.4.1 are vulnerable to arbitrary code execution due to a flaw in the `WordPress.WP.EnqueuedResourceParameters` sniff, allowing an attacker to execute arbitrary commands on the scanning host by crafting a malicious `$ver` argument, posing a risk for users running PHPCS with specific rulesets in CI pipelines or developer environments.

A vulnerability, CVE-2026-43910, in Appium's java-client allows a malicious Appium server to redirect all subsequent session traffic to an arbitrary internal endpoint by injecting unvalidated `directConnectHost` and `directConnectPort` parameters when `directConnect(true)` is enabled, potentially leading to session traffic interception, network pivoting, and cloud credential theft.

A critical vulnerability has been identified in VeloCloud Orchestrator (VCO) On-Prem that allows for remote code execution, enabling a remote attacker to gain privileged access, execute arbitrary commands on the VCO host, and potentially install programs, modify or delete data, or create new user accounts with administrative rights, with impact severity depending on the service account privileges.

Multiple vulnerabilities have been discovered in Samba, a network file sharing service, which could allow a remote attacker to trigger a denial of service, compromise data confidentiality, and bypass security policies.

A missing authentication for critical function vulnerability, tracked as CVE-2026-7187, in Universal Software Inc.'s UKBS product allows attackers to bypass authentication and access functionality not properly constrained by Access Control Lists (ACLs), leading to unauthorized operations.

A flaw in Red Hat OpenShift's oauth-proxy, tracked as CVE-2026-49332, allows an authenticated low-privilege user to smuggle a forged identity header by exploiting differences in how dash and underscore variants of 'X-Forwarded-User' are handled, potentially leading to privilege escalation in upstream applications.

An anonymous, remote attacker can exploit multiple vulnerabilities in Apache Wicket to perform Cross-Site Scripting (XSS) attacks and bypass existing security measures, potentially leading to unauthorized client-side script execution and further compromise of user sessions or data.

A local attacker can exploit a vulnerability in binutils to cause a Denial of Service condition and disclose sensitive data.

A local attacker can exploit multiple vulnerabilities found in GIMP plugins to perform a Denial of Service attack, execute arbitrary code, or disclose confidential information on affected systems.

CVE-2026-16462 describes a critical SQL Injection vulnerability in Weidmueller Interface's PROCON-WEB SCADA, where a remote unauthenticated attacker can execute arbitrary SQL commands via the 'GetGridData' endpoint due to improper input sanitization, potentially leading to full system compromise.

A denial of service vulnerability exists in Netty, which an unauthenticated, remote attacker can exploit, allowing the attacker to disrupt the availability of affected systems or services.

Multiple vulnerabilities in Erlang/OTP allow a remote, anonymous attacker to perform a Denial of Service attack, execute arbitrary code, bypass security measures, and manipulate or disclose data.

An unauthenticated SQL injection vulnerability, tracked as CVE-2026-10207, exists in the PickPlugins Question Answer plugin for WordPress versions up to and including 1.2.73, allowing attackers to extract sensitive database information due to insufficient input sanitization of the 'id' GET parameter and improper SQL query construction.

Unauthenticated attackers can exploit a time-based SQL Injection vulnerability (CVE-2026-14516) in the Bookly WordPress plugin, affecting versions up to and including 27.5, via the 'staff_ids' parameter, chaining requests to `bookly_get_form_id` and `bookly_render_time` to extract sensitive database information due to insufficient input escaping and lack of CSRF protection.

A low-privileged remote attacker can exploit an incorrect behavior order vulnerability (CVE-2026-14169, CWE-696) in multiple ads-tec Industrial IT DVG-IRF series devices (versions prior to 2.3.0) by sending crafted input, leading to inconsistent account states and password overwrites, resulting in complete administrative unavailability of the device.

A low-privileged remote attacker can exploit CVE-2026-14167, an incorrect authorization vulnerability in multiple ads-tec Industrial IT DVG-IRF series products, to perform privileged configuration changes, including permission management, leading to privilege escalation.

A critical out-of-bounds read vulnerability (CVE-2026-66759) has been identified in the GIMP file-icns plugin, where processing a crafted ICNS file with a truncated mask resource can lead to information disclosure of heap contents via leaked alpha channel pixel values or a denial of service due to an application crash.

A flaw in the Event-Driven Ansible (EDA) server's ExternalEventStreamViewSet allows an unauthenticated attacker to bypass mTLS authentication by spoofing the Subject HTTP header, enabling injection of arbitrary events into mTLS-protected streams and triggering downstream automation actions, while also leaking the expected certificate Distinguished Name in 403 error responses.

A remote unauthenticated attacker can exploit CVE-2025-68686 in Fortinet FortiOS to bypass a previously applied patch, allowing sensitive information exposure and enabling persistence post-exploitation, provided the product was already compromised at the filesystem level via another vulnerability.

A denial-of-service vulnerability exists in facil.io versions 0.6.0 through 0.7.6, specifically in its multipart body parser, allowing an unauthenticated remote attacker to permanently freeze worker processes at 100% CPU by sending a malformed multipart/form-data request with a partial closing boundary, effectively disabling the server until manual restart.

An integer underflow vulnerability in facil.io through version 0.7.6 allows unauthenticated remote attackers to crash the server process via a crafted Content-Disposition header with an empty field name, leading to a Denial of Service.

Authenticated attackers can exploit stored and reflected cross-site scripting (XSS) vulnerabilities, identified as CVE-2026-66394, in SiYuan versions prior to v3.7.3 by bypassing the application's SVG sanitization to execute arbitrary scripts within the application's origin, potentially leading to session hijacking and data exfiltration.

NitroShare Desktop versions up to and including 0.3.4 are vulnerable to a path traversal flaw in their LAN file transfer server, allowing unauthenticated attackers on the same network to craft malicious filenames containing directory traversal sequences within the JSON item header. Exploiting this, attackers can write arbitrary files outside the intended transfer root to any location the current user has write access, including the Windows Startup folder, leading to persistent code execution upon user login.

Multiple vulnerabilities have been discovered in GLPI, including SQL injection, cross-site scripting (XSS), and privilege escalation, which could allow an attacker to compromise data integrity, bypass security policies, and elevate their privileges within the system.

A critical cross-site scripting (XSS) vulnerability has been identified in Zabbix, which a remote, unauthenticated attacker can exploit to execute malicious scripts within a user's browser session, potentially leading to unauthorized actions or data theft.

Multiple vulnerabilities in ffmpeg allow a remote, anonymous attacker to cause memory corruption, execute arbitrary code, trigger a denial-of-service condition, or disclose confidential information. The attacker does not require authentication to exploit these flaws.

A remote, anonymous attacker can exploit a vulnerability in OpenCTI to bypass security measures and disclose sensitive information, potentially leading to unauthorized access to critical threat intelligence data and circumvention of protective controls within the platform.

Multiple vulnerabilities in the libssh2 library allow a remote, unauthenticated attacker to potentially disclose sensitive information, cause a denial-of-service condition, or execute arbitrary code.

A low-privileged local attacker can exploit CVE-2026-14837, an improper signature verification vulnerability, in multiple Lenze products including models c430, c520, c550, i950 GenA, and i950 GenB to bypass the verification of the SSH enable file signature, subsequently enabling SSH access on the affected device, resulting in unauthorized administrative access and complete system compromise.

CVE-2026-63720 details a code injection vulnerability in datamodel-code-generator versions prior to 0.70.0, allowing attackers to achieve remote code execution by providing a malicious `customBasePath` value within input schemas that is unsafely embedded into a Python import statement.

A critical missing authorization vulnerability, CVE-2026-66012, in SiYuan before version 3.7.2 allows a remote unauthenticated attacker to exploit the POST /mcp kernel endpoint when the Publish server is in anonymous mode, leading to arbitrary file writes, sensitive credential exposure, malicious plugin execution, and ultimately administrator takeover on affected systems.

An unauthenticated Slowloris denial of service vulnerability exists in the default `serve()` path of AWS's `aws-smithy-http-server` framework (versions <= 0.66.4), allowing remote attackers to exhaust server resources by initiating numerous incomplete connections.

An improper neutralization of argument delimiters vulnerability (CVE-2026-16796) in the AWS Bedrock AgentCore Python SDK's `install_packages()` method allows a remote authenticated user to execute arbitrary commands within the Code Interpreter sandbox by crafting malicious package name arguments.

The AWS API MCP Server has a high-severity vulnerability, CVE-2026-16584, where a failure to initialize security policy data at server startup leads to a silent bypass of all per-request policy checks, allowing AWS API operations to execute without the intended restrictions, though underlying IAM permissions remain enforced.

A denial-of-service vulnerability in py-libp2p versions up to 0.6.0 allows an authenticated attacker to send a specially crafted 12-byte DATA or SYN frame with an oversized length field, causing the victim's yamux read loop to block indefinitely and freezing all streams on the affected connection.

Five independent HTTP/1.1 conformance laxities in Blaze's Java parser cause request-boundary disagreement with a stricter intermediary proxy, enabling front-end ACL/authentication bypass, response-queue poisoning on pooled backend connections, and cache poisoning in affected `http4s-blaze-server` and `blaze-http` components.

An attacker can exploit CVE-2026-14257, a denial of service vulnerability in the `brace-expansion` Node.js library, by crafting an input with deeply chained brace groups that causes the expanded string length to grow without bound, leading to an uncatchable out-of-memory process crash in any application processing untrusted input via `expand()` directly or through dependencies like `minimatch` or `glob`.

A collation vulnerability in Poweradmin's OIDC integration allows an unauthenticated attacker to take over victim accounts by exploiting the case and accent-insensitive MySQL collation (`utf8mb4_unicode_ci`) used for OIDC subject (`sub`) identifiers, causing the attacker's colliding `sub` to resolve to the victim's `user_id` during authentication.

A low-privilege authenticated user in Poweradmin (a web front-end for PowerDNS) can exploit an Insecure Direct Object Reference (IDOR) vulnerability, allowing them to modify any DNS record on the server, even those they do not own, by manipulating POST request parameters to bypass access control checks and achieve DNS record repointing, disabling, or hijacking, leading to data integrity and availability issues, and potentially cross-tenant DNS takeover.

An unauthenticated remote denial-of-service vulnerability exists in the frp server's optional SSH Tunnel Gateway (frps) that allows an attacker to crash the entire frps process by sending a specially crafted five-byte message containing an integer overflow value in an SSH `exec` channel request, leading to a sustained service outage.

An algorithm developer in the vantage6 system can modify another developer's algorithm metadata or Docker image tag, even when that algorithm is pending review, allowing an attacker with low privileges to replace an approved algorithm with an unapproved or malicious image.

A vulnerability in GitPython allows environment variables to be exfiltrated when using `Repo.create_remote()` or `Remote.add()`, where attacker-supplied URLs are processed by `Git.polish_url()` expanding sensitive environment variables into the URL, which is then stored in `.git/config` and transmitted to an attacker-controlled host.

A vulnerability in Budibase's MongoDB datasource configuration allows authenticated attackers to specify arbitrary absolute server-side file paths for `tlsCertificateKeyFile` and `tlsCAFile`, enabling the `/api/datasources/verify` endpoint to act as an arbitrary-path existence/read oracle on the underlying multi-tenant server, distinguishing between existing and non-existing files and potentially exfiltrating certificate content.

A critical SQL injection vulnerability was discovered in Budibase's MySQL integration (versions <= 3.38.1) that allows remote attackers to execute arbitrary SQL commands through user input fields due to the `multipleStatements: true` configuration, leading to complete database compromise.

A critical vulnerability in Budibase versions up to 3.38.1 allows full account takeover of any existing user, including global administrators, by exploiting a flaw in its OIDC SSO implementation that links incoming identities by email address alone without validating the `email_verified` claim, enabling an attacker to log in as a victim if they can coerce a trusted Identity Provider to assert the victim's email as unverified.

A denial of service vulnerability (CVE-2026-44907) affects multiple versions of the react-server-dom-webpack, react-server-dom-parcel, and react-server-dom-turbopack packages, allowing threat actors to trigger out-of-memory exceptions or excessive CPU usage by sending specially crafted HTTP requests to server function endpoints.

An app-scoped builder in Budibase can exploit a missing authorization flaw in the public role assignment API (`POST /api/public/v1/roles/assign`) to escalate privileges, granting themselves builder access to any other application within the tenant, read/modify data, exfiltrate datasource credentials, and execute arbitrary code via automation steps, compromising the entire tenant's app and data plane in Budibase versions up to and including 3.39.19 and npm/@budibase/server up to 3.38.1.

A critical remote code execution (RCE) vulnerability, CVE-2026-62263, exists in OpenAM's WebAuthn authenticator deserialization, allowing an unauthenticated attacker to bypass an `ObjectInputFilter` and execute arbitrary code by crafting a malicious serialized stream before authentication.

An incomplete fix for a path traversal vulnerability in Open WebUI's terminal proxy allows authenticated attackers to bypass security checks by sending a 9x percent-encoded path, leading to requests being forwarded with terminal credentials and user identification headers to unintended arbitrary paths outside the intended proxy scope.

A high-severity command injection vulnerability, CVE-2026-55404, in yt-dlp versions prior to 2026.7.4 allows remote attackers to achieve arbitrary code execution by crafting malicious metadata that is improperly sanitized when generating Windows `.url` or Linux `.desktop` shortcut files, leading to remote executable execution or shell command injection upon user interaction.

A heap out-of-bounds write vulnerability exists in the vf_quirc filter of FFmpeg versions 7.0 through 8.1.2, allowing an attacker to corrupt heap memory and potentially achieve arbitrary code execution by supplying a crafted PGS/SUP subtitle file with mismatched frame dimensions.

A heap out-of-bounds write vulnerability, CVE-2026-66040, exists in the native PNG and APNG encoders of FFmpeg through version 8.1.2, allowing remote attackers to corrupt heap memory and achieve potential arbitrary code execution by supplying a crafted PNG image with a malicious eXIf chunk.

A heap out-of-bounds write vulnerability exists in FFmpeg through version 8.1.2, specifically within the vf_hqdn3d filter, allowing attackers to corrupt heap memory by providing a crafted video input where frame resolution increases between frames while filtergraph reinitialization is disabled, leading to undersized buffers and a write beyond allocation boundaries.

A flaw exists in the cluster-proxy service-proxy component of Red Hat Advanced Cluster Management for Kubernetes (RHACM) and multicluster-engine (MCE), allowing an authenticated hub principal to inject an Impersonate-Group header into proxied requests, bypassing validation, and leveraging the spoke ServiceAccount's unrestricted impersonation permissions to escalate privileges to cluster-admin on all managed clusters.

A double-free vulnerability, CVE-2026-66032, in libssh2 versions through 1.11.1 allows a malicious SSH server to corrupt the heap of an authenticated client opening an SFTP session, potentially leading to arbitrary code execution.

sysPass versions up to 3.2.11 are affected by a missing object-level authorization vulnerability in the JSON-RPC API. Attackers holding an API token can exploit this flaw by invoking AccountController methods (e.g., viewAction, editAction, deleteAction, editPassAction) without proper AccountFilterUser checks, allowing them to enumerate account metadata, overwrite passwords, and delete user accounts across the entire vault, bypassing per-account access control defined by their token permissions.

An authenticated user can overwrite messages in any channel, including private and DM channels, by exploiting the CVE-2026-59714 authorization bypass vulnerability in Open WebUI's chat completion API, leading to message integrity destruction and impersonation.

An authenticated low-privilege user can exploit CVE-2026-59216 in Open WebUI versions prior to 0.10.0 to execute arbitrary Python code or tools within another user's authenticated session by supplying an unvalidated `session_id`, which, if targeting an administrator, leads to remote code execution on the server as the root process.

Open WebUI versions from 0.9.0 to before 0.10.0, when configured with Redis, fail to correctly enforce JWT revocation for realtime authentication endpoints such as Socket.IO and terminal websockets, allowing attackers to maintain access to real-time features with stolen, revoked JWTs.

An unauthenticated remote attacker can cause a Denial of Service (DoS) in Netty servers utilizing XmlFrameDecoder by sending a specially crafted XML payload containing repeated '</' characters, leading to CPU exhaustion of the server's EventLoop thread and unresponsiveness.

A stored web worker XSS vulnerability, CVE-2026-59214, in Open WebUI versions prior to 0.10.0 allows a low-privileged user to inject malicious Python code into chat messages that, when executed by an administrator or privileged user via a 'Run' click, triggers authenticated same-origin requests to create server-side functions with arbitrary commands, leading to remote code execution on the Open WebUI server.

A high-severity Cross-Site Request Forgery (CSRF) bypass vulnerability in React Router's unstable React Server Components (RSC) APIs allows for action execution before a 400 response, impacting applications utilizing these specific APIs.

A denial of service vulnerability exists in the js-yaml library (versions 5.0.0 through 5.2.1) due to an exponential parsing time bug in flow collections, allowing attackers to craft a small YAML document which, when processed by `load()` or `loadAll()` functions, consumes significant CPU resources and blocks the Node.js event loop.

A critical vulnerability in GitPython versions up to 3.1.53 allows attackers to achieve arbitrary command execution by influencing `git clone` options to include a malicious `--template` directory, which causes Git hooks to be copied and executed during cloning, even in default configurations.

Velocity.js versions up to 2.1.6 are vulnerable to Remote Code Execution (RCE) through an incomplete fix for a previous prototype pollution vulnerability, enabling attackers to craft malicious Velocity templates to leverage unfiltered property-read expressions and execute arbitrary JavaScript code on the server, leading to full server compromise.

A critical server-side template injection vulnerability exists in the @prompty/core Nunjucks renderer, affecting versions <= 0.1.4 and >= 2.0.0-alpha.1 up to <= 2.0.0-beta.4. This flaw allows an attacker to execute arbitrary JavaScript code within the host Node.js process by crafting malicious `.prompty` template bodies. The renderer's unrestricted JavaScript member access permits traversal of constructor and prototype properties, leading to remote code execution when rendering untrusted, community-supplied, cloned, or LLM-generated `.prompty` files.

A broken access control vulnerability in Suna's message queue API allows authenticated attackers to gain unauthorized access to and manipulate queue resources belonging to other users by exploiting missing ownership and account isolation checks. This exploit enables attackers to read all users' pending prompt queues, read or delete individual sessions, and inject arbitrary prompts into another user's session, which causes the background drainer to forward malicious messages to the victim's AI agent using their credentials and permissions, leading to potential data manipulation, unauthorized actions, or further compromise.

An attacker can perform a pre-account hijacking attack against the `better-auth` library if it uses magic-link or email-OTP plugins alongside open email and password registration and allows unverified accounts. The attacker first registers an account using the victim's email with a password they control. When the legitimate victim later uses a passwordless flow to verify their account, the attacker's pre-set password remains active, granting them persistent, unauthorized access to the victim's account and data, potentially leading to account takeover and user lockout.

The `@better-auth/scim` package is affected by multiple vulnerabilities, including a critical provider-ID collision flaw that allows authenticated users to craft SCIM tokens impersonating existing account providers, leading to unauthorized account access, profile modification, and user deletion, while additional issues include failed user deactivation and email update vulnerabilities bypassing uniqueness checks in versions `1.4.0-beta.27` through `1.6.21` and `1.7.0-beta.0` through `1.7.0-beta.9`.

The Easy Appointments plugin for WordPress, in versions up to and including 3.12.27, is vulnerable to unauthorized data modification due to a missing capability check and nonce verification on the `ea_delete_multiple_connections` AJAX action, allowing authenticated attackers with Contributor-level access or higher to delete arbitrary connection records and disrupt core booking functionality.

A high-severity vulnerability in the `httplib2` Python client library allows a remote attacker to trigger a denial-of-service condition by sending a crafted HTTP response with a small, highly compressed payload that expands excessively upon decompression, causing memory exhaustion or OOM-kill in the client process.

A vulnerability (CVE-2026-55575) in the LiquidJS templating library's `pop` filter, affecting versions up to and including 10.27.0, allows an attacker to bypass the `memoryLimit` accounting, leading to uncontrolled memory allocation and potential denial of service when processing untrusted, large arrays in templates.

A vulnerability, CVE-2026-54673, in `electron-builder`'s `builder-util-runtime` package, specifically in its HTTP redirect handler, allows credential headers like `PRIVATE-TOKEN` (GitLab personal access tokens) and mixed-case `Authorization` tokens to be improperly forwarded to attacker-controlled cross-origin redirect destinations, resulting in credential disclosure and enabling unauthorized access to private GitLab resources.

Numerous vulnerabilities across MongoDB Core Server and Compass, identified as CVE-2026-13055 through CVE-2026-13078, CVE-2026-14881, and CVE-2026-9737, enable attackers to bypass security policies and induce denial-of-service conditions, necessitating immediate patching.

Multiple vulnerabilities discovered in ESET Cyber Security and Endpoint Security for macOS allow an attacker to achieve privilege escalation on affected systems, posing a significant risk to macOS users.

Multiple vulnerabilities in Progress Software MOVEit Transfer allow attackers to bypass security measures, achieve elevated privileges, and manipulate or disclose sensitive data, including the ability to perform Cross-Site-Scripting (XSS) attacks.

Multiple vulnerabilities in FFmpeg allow an attacker to achieve arbitrary code execution or cause a denial-of-service condition.

Multiple vulnerabilities in Netty can be exploited by an attacker to conduct Denial of Service (DoS) attacks, impacting the availability of services utilizing the Netty framework.

Multiple vulnerabilities in JetBrains WebStorm allow a local attacker to execute arbitrary program code, enabling attackers to compromise the integrity and confidentiality of the affected system.

Multiple vulnerabilities have been identified in JetBrains IntelliJ IDEA, which a remote, unauthenticated attacker can exploit to disclose sensitive information, execute arbitrary code on affected systems, and bypass existing security measures.

An authenticated remote attacker can exploit a vulnerability in Red Hat Quay to bypass security measures, circumventing established security controls within the container registry.

A remote, anonymous attacker can exploit a vulnerability in QT to manipulate files, potentially affecting data integrity or system functionality.

A vulnerability in the Apache Tomcat mod_jk Connector allows a remote, unauthenticated attacker to bypass security measures or disclose sensitive information, which could enable an adversary to gain unauthorized access or collect confidential data.

CVE-2026-57106 describes a server-side request forgery (SSRF) vulnerability in Microsoft Data Quality that allows an unauthorized attacker to elevate privileges over a network.

9Router versions prior to 0.4.72 contain a server-side request forgery (SSRF) vulnerability in the /v1/web/fetch endpoint, allowing an authenticated or locally-connected user to bypass URL validation to fetch arbitrary internal URLs, potentially exposing cloud metadata credentials, accessing internal services, and bypassing authentication on localhost endpoints.

A critical vulnerability chain, CVE-2026-63732, in 9router version 0.4.59 allows a remote, unauthenticated attacker to achieve arbitrary code execution on the host operating system by leveraging a hardcoded default password for initial access, bypassing a local-only network restriction via Host header spoofing, and exploiting unvalidated arguments during MCP plugin registration to execute malicious code when a plugin's SSE endpoint is triggered.

A critical repository takeover vulnerability (CVE-2024-58354) exists in the cal.com (calcom/cal.diy) GitHub Actions workflows, allowing an attacker to submit a malicious pull request that executes arbitrary commands with write permissions to the repository, leading to full compromise.

A critical out-of-bounds write vulnerability (CVE-2026-65706) exists in FFmpeg versions 3.0 through 8.1.2 within the vf_swaprect video filter, allowing attackers to corrupt heap memory and achieve potential remote code execution by providing a specially crafted NV12 video frame with odd width dimensions.

A critical out-of-bounds write vulnerability exists in FFmpeg versions 3.4 through 8.1.2 within the vf_floodfill video filter, which attackers can exploit by providing a specially crafted, dynamically sized video stream with filtergraph reinitialization disabled via -reinit_filter 0, leading to heap corruption, a process crash, and potentially remote code execution.

An out-of-bounds write vulnerability (CVE-2026-65703) exists in the TDSC video decoder within FFmpeg versions 2.7 through 8.1.2, allowing remote attackers to cause heap corruption and potential code execution by supplying a specially crafted AVI file with changing frame dimensions across TDSF frames.

A Cross-Site Request Forgery (CSRF) vulnerability in the WPO365 | Login plugin for WordPress, affecting versions up to and including 43.2, allows unauthenticated attackers to overwrite arbitrary plugin options. This is due to a misconfiguration where the nonce check is effectively disabled. By tricking a site administrator into clicking a malicious link, an attacker can manipulate settings such as enabling the SCIM REST endpoint, planting a SCIM secret token, and setting the default user role for new registrations to 'administrator', potentially leading to full site compromise and unauthorized administrative access.

A remotely triggerable Denial of Service (DoS) vulnerability exists in the 'find-my-way' router when used with Node.js HTTP/2 servers. Malicious HTTP/2 method values, such as 'constructor' or '__proto__', can be passed to the 'lookup()' function, which then indexes these values against internal data structures. This leads to a crash when the code attempts to access properties of these unexpected values, such as 'currentNode.prefix.length', causing the server to become unavailable. Users are advised to upgrade to version 9.7.0 or validate HTTP methods before processing.

Chatwoot before version 4.16.0 contains an authentication bypass vulnerability in its direct uploads controller that allows unauthenticated attackers to create arbitrary ActiveStorage blobs in any tenant account by exploiting missing authentication checks, leading to data manipulation.

Vanna versions up to and including 2.0.2 contain a path traversal vulnerability in its FileSystemConversationStore persistence integration, allowing unauthenticated remote attackers to write attacker-controlled JSON files to arbitrary server filesystem locations and read conversation metadata or other files from outside the intended base directory by supplying path traversal sequences within the 'conversation_id' parameter to unauthenticated chat API endpoints.

An attacker can exploit a vulnerability in the pypdf library by crafting a PDF containing a malformed, not terminated inline image. When this malicious PDF is processed by pypdf, such as during text extraction, it triggers an infinite loop, leading to a denial of service. The issue is resolved in pypdf version 6.14.1.

An Insecure Direct Object Reference (IDOR) vulnerability, tracked as CVE-2026-65917, exists in CyberPanel versions through 1.9.1, specifically within the IncBackups application's incremental-backup handlers, allowing authenticated panel users to exploit attacker-controlled IncJob integer IDs to access, read metadata from, delete, or trigger unauthorized restoration of other tenants' backup resources, potentially leading to operations with root privileges.

PhpSpreadsheet's OLE reader contains a denial-of-service vulnerability where it fails to detect cycles in attacker-controlled XLS/OLE sector chains, leading to infinite loops and memory exhaustion when parsing specially crafted, small malformed XLS/OLE files, which can cause PHP workers to crash and deny service to web applications processing untrusted spreadsheet uploads.

A high-severity vulnerability (CVE-2026-45623) in PostCSS's `PreviousMap` component allows attackers to perform arbitrary file reads and information disclosure from the local filesystem by injecting malicious `sourceMappingURL` comments into untrusted CSS input, leading to sensitive data leakage and denial of service.

The PhpOffice PhpSpreadsheet library is vulnerable to a denial of service (DoS) attack, identified as CVE-2026-59932, where its Gnumeric reader processes attacker-supplied `.gnumeric` files containing gzipped content without enforcing a decompressed-size limit, causing memory exhaustion and application crashes.

A vulnerability in the Auth.js `getToken()` helper function (next-auth and @auth/core) allows unauthenticated attackers to trigger an uncaught exception via a malformed `Authorization: Bearer` header, leading to a per-request denial of service in affected applications.

A missing filepath validation vulnerability (CVE-2026-65690) in Bold Reports Standalone Report Designer before version 14.1.12 allows authenticated attackers to perform path traversal via crafted filenames during file upload, leading to arbitrary command execution with high privileges.

A missing filepath validation vulnerability (CVE-2026-65689) in Bold Reports Standalone Report Designer before version 14.1.12 allows unauthenticated attackers to perform path traversal by sending a crafted request to the database download feature, enabling them to read arbitrary sensitive server files, including authentication credentials, and potentially gain full unauthorized access to the application.

An authenticated attacker can exploit CVE-2026-65897 in Grav API Plugin versions prior to 1.0.10 by manipulating the 'groups' field during invitation creation, allowing invited accounts to gain super-admin API access, leading to privilege escalation.

An authenticated API caller with 'api.pages.write' permission in Grav API Plugin (Composer package getgrav/grav-plugin-api) before version 1.0.10 can exploit a path traversal vulnerability (CVE-2026-65896). The 'POST /pages/{route}/move' endpoint's 'slug' field is not properly sanitized, allowing attackers to use path traversal sequences (e.g., '01.home/../../../pwned'). This enables them to move an entire page directory, including content and media, to an arbitrary writable location outside the intended 'user/pages/' directory, potentially leading to unauthorized file manipulation or system compromise.

Grav API Plugin versions prior to 1.0.10 contain a missing authorization vulnerability (CVE-2026-65895) allowing authenticated users with the 'api.config.write' privilege to modify critical security settings, including disabling site-wide rate limiting to enable credential brute-forcing attacks and reconfiguring CORS policies to include attacker-controlled origins with credentials enabled, potentially leading to unauthorized data access.

A critical cross-site scripting (XSS) vulnerability, CVE-2026-65606, exists in SiYuan desktop application versions prior to 3.7.2's `siyuan://` protocol handler, allowing an attacker to inject an unescaped `<img>` element into the tab header, leading to arbitrary JavaScript execution and ultimately operating system command execution due to `nodeIntegration:true`.

Multiple vulnerabilities in Exim allow a local attacker to execute arbitrary commands and escalate privileges on the affected system, enabling a local adversary to gain higher control over the mail transfer agent and potentially the underlying operating system.

Multiple vulnerabilities have been discovered in Mitel MiCollab and Openscape UC products, enabling a remote attacker to achieve arbitrary code execution and conduct indirect remote code injection (XSS), posing significant risks to affected organizations.

A high-severity denial of service vulnerability, CVE-2026-64611, exists in the `cfIEEE1284NormalizeMakeModel()` function of libcupsfilters, allowing a network-adjacent attacker to cause sustained CPU consumption and system unresponsiveness by broadcasting a specially crafted printer advertisement with an empty model field in the IEEE-1284 device ID.

An attacker can exploit multiple vulnerabilities in the n8n workflow automation platform to bypass security measures, perform a Denial of Service attack, disclose sensitive information, manipulate files, conduct SQL injection, and execute arbitrary code.

A critical vulnerability in Mitel MiCollab allows a remote, unauthenticated attacker to execute arbitrary code, which could lead to full system compromise or further network penetration.

Multiple vulnerabilities in MongoDB allow an attacker to execute arbitrary code, bypass security measures, disclose confidential information, manipulate data, cause memory corruption, or trigger a denial-of-service condition.

A remote, authenticated attacker can exploit a Cross-Site Scripting (XSS) vulnerability in Mitel OpenScape, allowing the execution of malicious scripts in the victim's browser, potentially leading to session hijacking, data theft, or redirection to malicious websites.

Multiple vulnerabilities in Budibase allow an attacker to gain elevated privileges, perform SQL injection, bypass security measures, take over user accounts, manipulate or disclose data, and trigger a denial-of-service condition, enabling various malicious activities impacting data integrity, confidentiality, and system availability.

Multiple vulnerabilities in Internet Systems Consortium BIND allow an anonymous, remote attacker to bypass security measures, manipulate data, disclose confidential information, or trigger a Denial-of-Service condition, potentially leading to compromise of data integrity, confidentiality, and availability of the DNS service.

Multiple vulnerabilities exist in various Intel Ethernet products, which an attacker can exploit to trigger a denial-of-service condition and expose confidential information.

A high-severity OS command injection vulnerability, tracked as CVE-2026-16287, has been identified in the TUBITAK BILGEM Software Technologies Research Institute's pardus-update software, affecting versions from 0.6.6 before 0.7.0, enabling attackers to execute arbitrary operating system commands due to improper neutralization of special elements.

An insufficient input sanitization and output escaping vulnerability (CVE-2026-12421) in the ARforms plugin for WordPress, affecting versions up to and including 7.2.1, allows unauthenticated attackers to inject arbitrary web scripts via the 'password' field, leading to Stored Cross-Site Scripting (XSS) when a user accesses an injected page.

A vulnerability, CVE-2026-54171, has been identified in the Excon library concerning the redaction of sensitive or risky headers when following redirects, which could potentially expose confidential information if not properly addressed.

A denial of service vulnerability (CVE-2026-26080) in HAProxy Community Edition versions 3.2.x through 3.3.x before 3.3.3, HAProxy Enterprise, and ALOHA can lead to a loop or crash due to mishandled varint, impacting service availability.

CVE-2026-44621 describes a vulnerability in Libunbound applications where, when configured with the 'unwanted-reply-threshold' option, they can be abruptly terminated, leading to a denial of service.

A high-severity improper input validation vulnerability, CVE-2026-16632, exists in the `websocket_on_protocol_error` function of the `boazsegev facil.io` WebSocket Frame Parser, allowing a remote unauthenticated attacker to manipulate the `on_message` argument with a publicly available exploit, potentially leading to denial of service or information disclosure.

A cross-site scripting (XSS) vulnerability exists in JupyterLab versions 3.3.0 through 4.5.9 and 4.6.0 through 4.6.1, allowing arbitrary code execution because notebook display settings in the `overrides.json` file are not properly validated, enabling an attacker to craft a malicious file which, when imported by a user or automatically applied on a multi-tenant file system, can execute hidden instructions and compromise user data.

A cross-site scripting (XSS) vulnerability exists in JupyterLab's image viewer, allowing an attacker to achieve remote code execution (RCE) on the JupyterLab server if a specially crafted image file is opened in the image viewer and then opened in a new browser tab; affected versions include JupyterLab prior to 4.5.10 and versions from 4.6.0 up to, but not including, 4.6.2, with patches available in versions 4.5.10 and 4.6.2.

A memory leak vulnerability, CVE-2024-7708, in Eclipse Jetty's server handling of HTTP 100-Continue requests can be exploited by an attacker to trigger an OutOfMemory error, leading to a Denial of Service state for affected servers.

An authenticated user can exploit a format injection vulnerability in the n8n Edit Image node to write arbitrary files outside the node's working directory within the n8n instance, potentially leading to remote code execution or other significant impact.

An authenticated n8n user can exploit a path restriction bypass vulnerability within the Git node's fetch, pull, or push-tags operations to access arbitrary local Git repositories and their contents, potentially leading to sensitive data exposure.

An authenticated n8n user with workflow creation and execution rights can achieve arbitrary code execution on the n8n host by staging a crafted local Git repository within the Git node, causing Git to run malicious hooks as the n8n process user.

A high-severity vulnerability in n8n's embed login feature (CVE-2026-XXXX) allows attackers to achieve full account takeover by leveraging unverified email claims in incoming tokens, enabling authentication as any existing user if the instance has embed login enabled and a trusted key source configured that emits unverified email addresses.

A critical vulnerability, CVE-2026-65595, in n8n's Token Exchange module allows low-privileged users to achieve privilege escalation and potential code execution by exploiting incorrect Public API key scope assignments to JWTs, enabling administrative operations.

The n8n AI Agents module in versions prior to 2.27.4 and between 2.28.0 and 2.28.1 failed to enforce configured 'Allowed HTTP Request Domains' restrictions, allowing an authenticated member-level user with 'use-only' access to a shared credential to bypass these domain restrictions and exfiltrate sensitive secrets to an attacker-controlled server.

An authenticated n8n user with 'use-only editor access' can exploit CVE-2026-59209 in shared workflows when `N8N_EXPRESSION_ENGINE=vm` is enabled, allowing them to read sensitive HTTP Header Auth credentials from the `$request.headers` object within a paginated HTTP Request node's expression and exfiltrate them, bypassing credential domain restrictions.

A denial-of-service vulnerability exists in the `Bzip2Decoder` handler within Netty's `netty-codec-compression` and `netty-codec` libraries, allowing a remote attacker to exploit CVE-2026-59901 by providing a specially crafted bzip2 stream, which causes an infinite loop in the run-length encoding state machine, leading to the permanent hang of an event-loop thread and application denial of service.

A misconfiguration vulnerability (CVE-2026-56817) in Netty's XmlDecoder component allows attackers to send XML with DOCTYPE declarations to an unconfigured XML factory, potentially leading to XML External Entity (XXE) injection if the underlying Aalto XML parser resolves external entities, impacting Netty applications using `netty-codec-xml` versions 4.1.0.Final through 4.1.135.Final and 4.2.0.Final through 4.2.15.Final.

A critical vulnerability (CVE-2026-56820) in Netty's `OcspClient` allows a bad actor to bypass certificate revocation checks by replaying a valid OCSP 'GOOD' status response from an unrelated certificate, enabling a certificate validation bypass for any certificate issued by the same Certificate Authority.

A vulnerability in Netty's HTTP/3 `Http3FrameCodec`, tracked as CVE-2026-56816, allows an unauthenticated remote attacker to cause a denial of service by sending crafted reserved HTTP/3 frames with an excessively large, unvalidated payload length, leading to server memory exhaustion.

A vulnerability, CVE-2026-55851, in Netty's `HAProxyMessageDecoder` can lead to unbounded memory exhaustion when an attacker sends a specific PROXY protocol v2 binary prefix followed by a version byte of `0xFF`, causing a signed-byte sentinel collision that traps the decoder in a version-detection loop and ultimately exhausts the JVM's direct memory allocation, resulting in a denial of service.

A high-severity vulnerability, CVE-2026-55831, in Netty's SPDY SETTINGS decoder allows a remote unauthenticated attacker to trigger a denial of service by sending a crafted SPDY/3.1 SETTINGS frame that leads to excessive heap growth and CPU consumption due to unbounded map entries in `DefaultSpdySettingsFrame`.

Attackers can exploit CVE-2026-64829, a session invalidation vulnerability in Question2Answer through version 1.8.8, where the forgot-password reset flow fails to clear the sessioncode field, allowing an attacker with a previously obtained remember-me cookie to retain authenticated access even after the account's password has been reset.

A critical access bypass vulnerability (SA-CONTRIB-2026-081) exists in the Internationalization Single Sign-On module for Drupal, affecting versions prior to 1.8.0, allowing an attacker to bypass authentication mechanisms and potentially gain unauthorized access or elevate privileges within the application.

FFmpeg versions 0.6.3 through 8.1.2 are vulnerable to a remote denial of service (DoS) via CVE-2026-64834, allowing an attacker to trigger an infinite loop in the `rtp_asf_fix_header` function by sending a crafted RTP/ASF stream, leading to CPU exhaustion and service unavailability.

Check Point released a critical security advisory to address CVE-2026-16232, an authentication bypass vulnerability in SmartConsole, which is actively being exploited in the wild and affects Security Management, Multi-Domain Management, Firewall, and Multi-Domain Log Server products.

A high-severity out-of-bounds memory access vulnerability, tracked as CVE-2026-64835, exists in FFmpeg versions 4.4 through 8.1.2 within the ADX audio decoder, allowing attackers to trigger both out-of-bounds reads and writes by supplying a crafted ADX or AAX audio file with a mid-stream channel layout change, potentially leading to denial of service, information disclosure, or arbitrary code execution.

FFmpeg versions 0.7.1 through 8.1.2 contain an out-of-bounds read vulnerability in the S/PDIF muxer, allowing attackers to exploit a missing bounds check in the `spdif_header_dts4` function by supplying a crafted DTS stream with an oversized `core_size` value during S/PDIF re-muxing, leading to unauthorized memory reads beyond the packet buffer and potential information disclosure or denial of service.

FFmpeg versions 4.4 through 8.1.2 are vulnerable to a double-free condition within the NVIDIA NVDEC hardware decoder component (libavcodec/nvdec.c), allowing attackers to trigger memory corruption by providing a specially crafted video file, which occurs when an error path frees memory via `nvdec_fdd_priv_free` due to no decoder surfaces remaining, and a subsequent layer attempts to free the same frame description data, resulting in a double-free of the underlying decoder context in any FFmpeg-based application using NVDEC hardware acceleration.

A security advisory from CCCS highlights an authenticated code execution vulnerability (GHSA-rcv6-pvrj-4xcg) within the n8n Git node, affecting multiple versions prior to 1.123.67, 2.32.1, and 2.31.5, which could allow an authenticated attacker to execute arbitrary code on the host system.

A privilege escalation vulnerability (CVE-2026-65015) exists in n8n's AI Agents feature, allowing users with the read-only Project Viewer role to execute arbitrary tool nodes and access unauthorized credential secrets, potentially leading to arbitrary command execution on the n8n host.

A DOM-Based Cross-Site Scripting (XSS) vulnerability in n8n allows an attacker to inject scripts into the HTML preview through an unsandboxed iframe srcdoc, enabling the injected script to run with the same origin as the editor; if a victim opens this compromised preview, the script can call authenticated APIs using their session, allowing an account with 'global:member' privileges to exploit this to gain unauthorized access or perform actions.

A stored DOM XSS vulnerability in n8n's Resource Locator feature allows attackers to inject malicious JavaScript into the cachedResultUrl parameter. When a victim opens a specially crafted workflow and interacts with external links, the JavaScript payload executes in their browser, due to a lack of scheme validation for `cachedResultUrl` passed to `window.open()`.

A stack buffer overflow vulnerability exists in the Vulkan HEVC hardware decoder within FFmpeg versions 8.0 through 8.1.2, allowing remote attackers to achieve arbitrary code execution by crafting a malicious HEVC/H.265 bitstream with an oversized vps_num_hrd_parameters value that overwrites return addresses and adjacent stack frames in the vk_hevc_end_frame function.

FFmpeg versions 2.1 through 8.1.2 contain a heap buffer overflow vulnerability (CVE-2026-64830) in the VobSub subtitle demuxer, allowing attackers to corrupt adjacent heap memory by supplying a malicious .sub/.idx subtitle file, potentially leading to arbitrary code execution in applications using FFmpeg's VobSub demuxer.

CVE-2026-13321 describes a vulnerability in the BIND resolver where it incorrectly accepts validly-signed NSEC records that contain a 'Next Domain Name' field pointing outside the signer's zone, impacting integrity with a CVSSv3.1 score of 8.6 and requiring immediate updates to affected BIND 9 installations.

A critical vulnerability (CVE-2026-13204) in Internet Systems Consortium (ISC) BIND 9 can lead to a denial-of-service condition where the server exits unexpectedly due to an assertion failure during DNSSEC validation of specific NSEC/NSEC3 record configurations. This allows an unauthenticated attacker to cause a BIND 9 DNS resolver to crash, disrupting DNS resolution services.

This vulnerability affects BIND 9 resolver (`named`) and can lead to unexpected program termination (denial of service). The issue occurs when the resolver receives specific, delayed, or out-of-order responses to queries for CNAME or DNAME and A records. Specifically, if an authoritative server delays a DNAME or self-referential CNAME response while providing an A record, the `named` process may crash.

A DNSSEC validating resolver, specifically BIND 9 versions within the ranges 9.11.0-9.18.50, 9.20.0-9.20.24, 9.21.0-9.21.23, and their S1 variants, is vulnerable to a denial-of-service attack where an attacker can launch a random subdomain attack against a DNSSEC-signed zone by sending queries faster than the resolver can perform validation, leading to runaway memory usage and potentially exceeding configured limits by orders of magnitude.

A resource exhaustion vulnerability, CVE-2026-11605, affects specific versions of ISC BIND 9, where DNSSEC validation disproportionately consumes CPU resources when processing superfluous RRSIG records, potentially leading to a denial of service.

An attacker can exploit CVE-2026-11331, a flaw in ISC BIND 9's RPZ (Response Policy Zone) processing, by crafting long query names to trigger a mishandled NAMETOOLONG error, leading to either a bypass of RPZ rules or a denial of service due to an unexpected exit of the BIND 9 software.

Xpoda Türkiye Informatics Technology Inc.'s No Code Platform, specifically versions 4.3.1.0 through 20260722, is critically vulnerable to an SQL injection (CVE-2026-2395) that allows unauthenticated remote attackers to achieve high impact on the confidentiality, integrity, and availability of the system.

CERT-FR has issued an advisory detailing multiple vulnerabilities in Elastic products, including CVE-2026-42397 and CVE-2026-49092, which could allow an attacker to cause remote denial of service, compromise data confidentiality and integrity, and perform Server-Side Request Forgery (SSRF).

Multiple vulnerabilities have been discovered in GLPI, specifically affecting versions 11.0.x prior to 11.0.8 and all versions prior to 10.0.26, which allow an attacker to compromise data confidentiality and integrity, and bypass security policies.

CVE-2026-4773 is an improper input validation vulnerability in Magarsus Consulting Ltd. Co. IDM-MFA, allowing authentication bypass in versions from 2025.11.27 before 2026.03.10.

A command injection vulnerability (CVE-2026-44190, CWE-78) in the Ansible Lightspeed Visual Studio Code extension allows remote attackers to execute arbitrary commands on a user's system due to improper validation of the `ansible.python.activationScript` setting, leading to complete system control when a malicious project is opened.

Multiple vulnerabilities in Aruba AOS-CX can be exploited by an attacker to bypass security measures, execute arbitrary code, and manipulate files, which could lead to compromise of the network device.

A high-severity vulnerability, CVE-2026-8933, in Ubuntu's snap-confine component of the snapd service allows an unprivileged local user to gain root access on affected Ubuntu Desktop systems by exploiting race conditions during temporary file creation, enabling full administrative control.

A remote, highly privileged attacker can exploit multiple vulnerabilities in SolarWinds Serv-U to execute arbitrary code as Root, gain administrator privileges, take over accounts, disclose confidential information, or perform Cross-Site Scripting attacks.

A vulnerability in Veeam Backup & Replication allows a local attacker to escalate privileges on the affected system.

A local attacker can exploit a vulnerability within Ansible software to execute arbitrary code on the affected system, potentially leading to further compromise or unauthorized actions on the host where Ansible is running.

Multiple vulnerabilities exist in Red Hat Ansible Automation Platform, stemming from issues in components such as node-tar, linkify-it, protobufjs, brace-expansion, fast-uri, and DOMPurify. A remote, unauthenticated attacker can exploit these flaws to bypass security measures, perform Cross-Site Scripting (XSS) attacks, manipulate data, trigger Denial-of-Service (DoS) conditions, or execute arbitrary code on the affected system.