CVE-2026-59168 Dasel: Unbounded recursion in JSON and XML readers causes unrecoverable stack-overflow DoS

Dasel is a command-line tool and library for querying, modifying, and transforming data structures. From 3.0.0 until 3.11.1, parsing/json/jsonreader.go decodeValue, decodeObject, and decodeArray, and parsing/xml/reader.go parseElement, recurse once per input nesting level without a depth guard...

CVE-2026-59168 Dasel: Unbounded recursion in JSON and XML readers causes unrecoverable stack-overflow DoS

Dasel is a command-line tool and library for querying, modifying, and transforming data structures. From 3.0.0 until 3.11.1, parsing/json/jsonreader.go decodeValue, decodeObject, and decodeArray, and parsing/xml/reader.go parseElement, recurse once per input nesting level without a depth guard...

CVE-2026-62866 Dasel: Selector lexer panics on trailing whitespace in `parseCurRune`

Dasel is a command-line tool and library for querying, modifying, and transforming data structures. From 3.0.0 until 3.11.2, selector/lexer/tokenize.go parseCurRune advances the input index across trailing whitespace and then reads the source at the exhausted index without an end-of-input check. ...

CVE-2026-62866 Dasel: Selector lexer panics on trailing whitespace in `parseCurRune`

Dasel is a command-line tool and library for querying, modifying, and transforming data structures. From 3.0.0 until 3.11.2, selector/lexer/tokenize.go parseCurRune advances the input index across trailing whitespace and then reads the source at the exhausted index without an end-of-input check. ...

CVE-2026-77561 Tinyauth: Unauthenticated login attempts can trigger global login lockdown denial of service

Tinyauth is an authentication and authorization server. Prior to 5.1.0, an unauthenticated remote attacker can send POST /api/user/login requests with 257 distinct nonexistent usernames to fill MaxLoginAttemptRecords and activate a global login lockdown. internal/controller/usercontroller.go...

CVE-2026-77561 Tinyauth: Unauthenticated login attempts can trigger global login lockdown denial of service

Tinyauth is an authentication and authorization server. Prior to 5.1.0, an unauthenticated remote attacker can send POST /api/user/login requests with 257 distinct nonexistent usernames to fill MaxLoginAttemptRecords and activate a global login lockdown. internal/controller/usercontroller.go...

CVE-2026-77582 Tinyauth: User enumeration attack by timing oracle

Tinyauth is an authentication and authorization server. Prior to 5.1.0, Tinyauth exposes a remotely observable timing difference between authentication attempts for existing and nonexistent local usernames. internal/controller/usercontroller.go loginHandler and...

CVE-2026-77582 Tinyauth: User enumeration attack by timing oracle

Tinyauth is an authentication and authorization server. Prior to 5.1.0, Tinyauth exposes a remotely observable timing difference between authentication attempts for existing and nonexistent local usernames. internal/controller/usercontroller.go loginHandler and...

WordPress Meta Box AIO plugin <= 3.11.0 And Standalone Plugin Extensions - Unauthenticated Privilege Escalation to Administrator to 'rwmb_frontend_field_object_id' Parameter vulnerability

Unauthenticated Privilege Escalation to Administrator to 'rwmbfrontendfieldobjectid' Parameter vulnerability discovered by h0xilo in WordPress Plugin Meta Box Frontend Submission versions = 4.5.6...

WordPress Meta Box AIO plugin <= 3.11.0 And Standalone Plugin Extensions - Unauthenticated Privilege Escalation to Administrator to 'rwmb_frontend_field_object_id' Parameter vulnerability

Unauthenticated Privilege Escalation to Administrator to 'rwmbfrontendfieldobjectid' Parameter vulnerability discovered by h0xilo in WordPress Plugin Meta Box AIO versions = 3.11.0...

CVE-2026-13355

This candidate has been reserved by an organization or individual " "that will use it when announcing a new security problem. When the candidate has been " "publicized, the details for this candidate will be provided...

WordPress Meta Box AIO plugin <= 3.11.0 And Standalone Plugin Extensions - Unauthenticated Privilege Escalation to Administrator to 'rwmb_frontend_field_object_id' Parameter vulnerability

Unauthenticated Privilege Escalation to Administrator to 'rwmbfrontendfieldobjectid' Parameter vulnerability discovered by h0xilo in WordPress Plugin Meta Box User Profile versions = 3.11.0...

CVE-2026-17051 Out-of-bounds write in the Intel SEDI IPM driver from an unvalidated inbound doorbell length

The Intel SEDI IPM inter-processor mailbox driver in drivers/ipm/ipmsedi.c handles an inbound message interrupt in ipmeventdispose. It read the peer-written doorbell register, extracted the payload length with IPCHEADERGETLENGTH, and passed that length straight to sediipcreadmsg to copy the messa...

CVE-2026-17051 Out-of-bounds write in the Intel SEDI IPM driver from an unvalidated inbound doorbell length

The Intel SEDI IPM inter-processor mailbox driver in drivers/ipm/ipmsedi.c handles an inbound message interrupt in ipmeventdispose. It read the peer-written doorbell register, extracted the payload length with IPCHEADERGETLENGTH, and passed that length straight to sediipcreadmsg to copy the messa...

CVE-2026-17050 Double free of the USB host configuration descriptor when device enumeration fails

The experimental USB host stack allocates a per-device configuration-descriptor buffer, udev-cfgdesc, from the dedicated usbdeviceheap in usbhdevicesetconfiguration subsys/usb/host/usbhdevice.c. On three failure paths — a failed full-length GETDESCRIPTORCONFIGURATION read, a mismatch between the...

CVE-2026-17050 Double free of the USB host configuration descriptor when device enumeration fails

The experimental USB host stack allocates a per-device configuration-descriptor buffer, udev-cfgdesc, from the dedicated usbdeviceheap in usbhdevicesetconfiguration subsys/usb/host/usbhdevice.c. On three failure paths — a failed full-length GETDESCRIPTORCONFIGURATION read, a mismatch between the...

CVE-2026-77560 Tinyauth: forward-auth per-app ACL is matched case-sensitively against the (case-insensitive) hostname, letting an authenticated user reach apps they are not on the allowlist for

Tinyauth is an authentication and authorization server. Prior to 5.1.2, Tinyauth compares forwarded hostnames case-sensitively while reverse proxies route equivalent hostnames case-insensitively, allowing an authenticated low-privilege user to bypass per-app access controls with a differently cas...

CVE-2026-77560 Tinyauth: forward-auth per-app ACL is matched case-sensitively against the (case-insensitive) hostname, letting an authenticated user reach apps they are not on the allowlist for

Tinyauth is an authentication and authorization server. Prior to 5.1.2, Tinyauth compares forwarded hostnames case-sensitively while reverse proxies route equivalent hostnames case-insensitively, allowing an authenticated low-privilege user to bypass per-app access controls with a differently cas...

CVE-2026-79920 Ajenti: Privilege escalation to root via unauthenticated/unauthorized plugin install task

Ajenti is a Linux & BSD modular server admin panel. Prior to version 2.2.16, any authenticated user can call /api/core/tasks/start to enqueue InstallPlugin, UnInstallPlugin, or UpgradeAll from plugins/plugins/tasks.py without plugin-management authorization. InstallPlugin and UnInstallPlugin...

CVE-2026-79920 Ajenti: Privilege escalation to root via unauthenticated/unauthorized plugin install task

Ajenti is a Linux & BSD modular server admin panel. Prior to version 2.2.16, any authenticated user can call /api/core/tasks/start to enqueue InstallPlugin, UnInstallPlugin, or UpgradeAll from plugins/plugins/tasks.py without plugin-management authorization. InstallPlugin and UnInstallPlugin...