info.cqframework:elm-fhir (1.5.4), org.opencds.cqf.cql.ls:cql-ls (1.5.2) +1 more potentially affected by CVE-2026-81875 via ca.uhn.hapi.fhir:org.hl7.fhir.validation (5.4.8)

ca.uhn.hapi.fhir:org.hl7.fhir.validation MAVEN version 5.4.8 is affected by a known vulnerability. The following packages have a transitive dependency on ca.uhn.hapi.fhir:org.hl7.fhir.validation and may be impacted: - info.cqframework:elm-fhir 1.5.4 - org.opencds.cqf.cql.ls:cql-ls 1.5.2 -...

info.cqframework:cqf-fhir (>=1.5.10, <=1.5.12), info.cqframework:elm-fhir (>=1.5.8, <=1.5.12) +4 more potentially affected by CVE-2026-81875 via ca.uhn.hapi.fhir:org.hl7.fhir.validation (5.6.15)

ca.uhn.hapi.fhir:org.hl7.fhir.validation MAVEN version 5.6.15 is affected by a known vulnerability. The following packages have a transitive dependency on ca.uhn.hapi.fhir:org.hl7.fhir.validation and may be impacted: - info.cqframework:cqf-fhir =1.5.10, =1.5.8, =1.5.6, =1.5.7, =1.5.7, =1.5.9 Sour...

info.cqframework:elm-fhir (>=1.5.5, <=1.5.7), org.opencds.cqf.cql.ls:cql-ls (>=1.5.3, <=1.5.4) +1 more potentially affected by CVE-2026-81875 via ca.uhn.hapi.fhir:org.hl7.fhir.validation (5.5.16)

ca.uhn.hapi.fhir:org.hl7.fhir.validation MAVEN version 5.5.16 is affected by a known vulnerability. The following packages have a transitive dependency on ca.uhn.hapi.fhir:org.hl7.fhir.validation and may be impacted: - info.cqframework:elm-fhir =1.5.5, =1.5.3, =1.5.3, =1.5.4 Source cves:...

CVE-2026-93337

NetworkManager-l2tp through 1.52.4, fixed in 1.52.6, contains an improper input validation vulnerability that allows local users with VPN connection creation permissions to inject arbitrary pppd directives by supplying mru or mtu property values containing trailing non-numeric content after a val...

vim: Vim: Arbitrary code execution via crafted step-definition patterns

A flaw was found in Vim, a command-line text editor. This vulnerability, identified as a code injection, affects the cucumber filetype plugin when Vim is configured with Ruby support. An attacker could exploit this by creating a malicious repository containing specially crafted step-definition...

CVE-2026-93337 NetworkManager-l2tp Privilege Escalation via pppd Plugin Injection

NetworkManager-l2tp through 1.52.4, fixed in 1.52.6, contains an improper input validation vulnerability that allows local users with VPN connection creation permissions to inject arbitrary pppd directives by supplying mru or mtu property values containing trailing non-numeric content after a val...

CVE-2026-93337

NetworkManager-l2tp contains an improper input validation vulnerability in its handling of mru or mtu property values. A local user with VPN connection creation permissions can inject trailing non-numeric content after a valid integer, which is written verbatim into the pppd options file via writ...

CVE-2026-93337 NetworkManager-l2tp Privilege Escalation via pppd Plugin Injection

NetworkManager-l2tp through 1.52.4, fixed in 1.52.6, contains an improper input validation vulnerability that allows local users with VPN connection creation permissions to inject arbitrary pppd directives by supplying mru or mtu property values containing trailing non-numeric content after a val...

Skipper has OPA body-authz bypass: truncated_body mitigation fails open on chunked/HTTP-2 (incomplete fix GHSA-8qqm-fp2q-v734)

Affected component: filters/openpolicyagent/openpolicyagent.go → ExtractHttpBodyOptionally; combined with github.com/open-policy-agent/opa-envoy-plugin envoyauth/request.go → getParsedBody / checkIfHTTPBodyTruncated. Filter: opaAuthorizeRequestWithBody. - Affected versions: = 0.27.33 current HEAD...

autocleus (0.1.1), poetry (>=1.2.0a1, <=1.2.0a2) +2 more potentially affected by CVE-2026-102938 via virtualenv (20.4.4)

virtualenv PYPI version 20.4.4 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - autocleus 0.1.1 - poetry =1.2.0a1, =0.1.2, =0.0.1, =0.4.1 Source cves: CVE-2026-102938 Source advisory: OSV:PYSEC-2026-4012...

CVE-2026-75588

Mattermost Desktop App versions =6.2 6.2.2.0 fail to validate the URL scheme when checking whether a target URL is internal to the connected server, which allows a network-positioned attacker to load a plugin popout window over an insecure connection via a link using a downgraded URL scheme...

EUVD-2026-81678

Mattermost Desktop App versions =6.2 6.2.2.0 fail to validate the URL scheme when checking whether a target URL is internal to the connected server, which allows a network-positioned attacker to load a plugin popout window over an insecure connection via a link using a downgraded URL scheme...

CVE-2026-75588 Mattermost Desktop App plugin popout scheme validation bypass

Mattermost Desktop App versions =6.2 6.2.2.0 fail to validate the URL scheme when checking whether a target URL is internal to the connected server, which allows a network-positioned attacker to load a plugin popout window over an insecure connection via a link using a downgraded URL scheme...

CVE-2026-75588 Mattermost Desktop App plugin popout scheme validation bypass

Mattermost Desktop App versions =6.2 6.2.2.0 fail to validate the URL scheme when checking whether a target URL is internal to the connected server, which allows a network-positioned attacker to load a plugin popout window over an insecure connection via a link using a downgraded URL scheme...

app.cash.backfila:client (0.1.3-20210127.1838-76ab4fc), app.cash.backfila:client-misk (0.1.3-20210127.1838-76ab4fc) +16 more potentially affected by CVE-2026-63126 via com.squareup.wire:wire-runtime (3.5.0)

com.squareup.wire:wire-runtime MAVEN version 3.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.squareup.wire:wire-runtime and may be impacted: - app.cash.backfila:client 0.1.3-20210127.1838-76ab4fc - app.cash.backfila:client-misk...

com.squareup.retrofit:converter-wire (>=1.7.0, <=1.9.0), com.squareup.wire:wire-compiler (1.5.2) +3 more potentially affected by CVE-2026-63126 via com.squareup.wire:wire-runtime (1.5.2)

com.squareup.wire:wire-runtime MAVEN version 1.5.2 is affected by a known vulnerability. The following packages have a transitive dependency on com.squareup.wire:wire-runtime and may be impacted: - com.squareup.retrofit:converter-wire =1.7.0, =1.9.0 - com.squareup.wire:wire-compiler 1.5.2 -...

com.squareup.wire:wire-compiler (1.6.1), com.squareup.wire:wire-gson-support (1.6.1) +2 more potentially affected by CVE-2026-63126 via com.squareup.wire:wire-runtime (1.6.1)

com.squareup.wire:wire-runtime MAVEN version 1.6.1 is affected by a known vulnerability. The following packages have a transitive dependency on com.squareup.wire:wire-runtime and may be impacted: - com.squareup.wire:wire-compiler 1.6.1 - com.squareup.wire:wire-gson-support 1.6.1 -...

com.squareup.wire:wire-compiler (1.3.0), com.squareup.wire:wire-gson-support (1.3.0) +1 more potentially affected by CVE-2026-63126 via com.squareup.wire:wire-runtime (1.3.0)

com.squareup.wire:wire-runtime MAVEN version 1.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.squareup.wire:wire-runtime and may be impacted: - com.squareup.wire:wire-compiler 1.3.0 - com.squareup.wire:wire-gson-support 1.3.0 -...

com.squareup.retrofit:converter-wire (1.6.1), com.squareup.wire:wire-compiler (1.5.1) +2 more potentially affected by CVE-2026-63126 via com.squareup.wire:wire-runtime (1.5.1)

com.squareup.wire:wire-runtime MAVEN version 1.5.1 is affected by a known vulnerability. The following packages have a transitive dependency on com.squareup.wire:wire-runtime and may be impacted: - com.squareup.retrofit:converter-wire 1.6.1 - com.squareup.wire:wire-compiler 1.5.1 -...

com.squareup.wire:wire-compiler (2.0.0-beta1), com.squareup.wire:wire-gson-support (2.0.0-beta1) +2 more potentially affected by CVE-2026-63126 via com.squareup.wire:wire-runtime (2.0.0-beta1)

com.squareup.wire:wire-runtime MAVEN version 2.0.0-beta1 is affected by a known vulnerability. The following packages have a transitive dependency on com.squareup.wire:wire-runtime and may be impacted: - com.squareup.wire:wire-compiler 2.0.0-beta1 - com.squareup.wire:wire-gson-support 2.0.0-beta1...