CVE-2026-102894: gpustack: GPUStack is an open-source GPU cluster manager for AI model serving and GPU instance provisioning

GPUStack is an open-source GPU cluster manager for AI model serving and GPU instance provisioning. From 0.7.1 until 2.2.2, the /auth/saml/callback endpoint decoded SAML XML, used its NameID and attributes to resolve or provision a user, and minted a gpustacksession JWT without calling...

CVE-2026-92200: Quest Foglight for Databases: Quest Foglight for Databases Incorrect Permission Assignment Local Privilege Escalation Vulnerability

Quest Foglight for Databases Incorrect Permission Assignment Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Quest Foglight for Databases. An attacker must first obtain the ability to execute low-privileged co...

CVE-2026-121802: better-auth Better Auth: @better-auth/expo before 1.7.16 allows certain account-takeover outcomes (e.g., unauthenticated changes of any…

@better-auth/expo before 1.7.16 allows certain account-takeover outcomes e.g., unauthenticated changes of any account's email address, because it signs a caller-supplied state value without checking whether that value had been issued by the server. NOTE: the application secret must be rotated aft...

CVE-2026-120639: HTTP Response Splitting

CGI versions before 5.00 for Perl allow HTTP header injection via entity decoding after the newline check in header and unchecked values in multipartstart and dopush. With autoEscape off, header decodes HTML entities in extra header values after its newline check, so an encoded CR or LF reaches t...

CVE-2026-120645: Inefficient Regular Expression Complexity (ReDoS)

CGI versions before 5.00 for Perl allow denial of service via submitted values used as a regex for optgroup selection in scrollinglist. When rendering option groups, scrollinglist marks the selected options by interpolating each selected value, by default taken from the request parameters,...

CVE-2026-120651: Loop with Unreachable Exit Condition ('Infinite Loop')

CGI versions before 5.00 for Perl allow an infinite loop on a short request body when $DISABLEUPLOADS is set. When $CGI::PUTDATAUPLOAD or an upload hook is set, readpostdataputdata takes a request body that is not a form submission. With $CGI::DISABLEUPLOADS set, it discards the body by reading...

CVE-2026-121750: nvm-sh nvm: Node Version Manager (nvm) is a POSIX-compliant shell function for managing multiple node.js versions

Node Version Manager nvm is a POSIX-compliant shell function for managing multiple node.js versions. In versions 0.40.5 through 0.40.8, nvmdownloadartifact downloads a release archive directly to its final path in $NVMDIR/.cache and verifies its checksum afterwards; on a checksum mismatch it...

CVE-2026-122299: jelmer dulwich: Dulwich before 1.2.20 contains a commit object parsing vulnerability where the read path in _parse_commit resolves a…

Dulwich before 1.2.20 contains a commit object parsing vulnerability where the read path in parsecommit resolves a duplicate tree header to the last occurrence instead of the first, diverging from core git's resolution behavior, while Poetry 2.5.1 ships this version and uses dulwich by default fo...

CVE-2026-121961: FreeRDP: FreeRDP before 3.32.2 contains a use-after-free vulnerability in the freerdp-proxy DRDYNVC tracker when intercepting…

FreeRDP before 3.32.2 contains a use-after-free vulnerability in the freerdp-proxy DRDYNVC tracker when intercepting the drdynvc channel. A malicious target server can repeatedly send CREATEREQUESTPDU for an active channel id, racing front DATA handling to free a borrowed context and crash the...

CVE-2026-19731: TÜBİTAK BİLGEM Software Technologies Research Institute İmzager: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in TÜBİTAK BİLGEM Software…

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in TÜBİTAK BİLGEM Software Technologies Research Institute İmzager allows Path Traversal. This issue affects İmzager: from 2.10.5 before 2.10.7...

CVE-2026-114426: SEPPmail AG SEPPmail Secure Email Gateway (SEG): SEPPmail Secure Email Gateway before 15.1.1 processes and writes v1 file-interface upload data before authenticating…

SEPPmail Secure Email Gateway before 15.1.1 processes and writes v1 file-interface upload data before authenticating the caller and without an absolute request-size limit. An unauthenticated remote attacker can occupy workers and consume temporary storage with concurrent or slow requests, causing...

CVE-2026-122131: hapijs joi: Joi 17.13.6 before 17.13.9 and 18.2.5 before 18.3.1 contains a prototype pollution vulnerability in lib/messages.js…

Joi 17.13.6 before 17.13.9 and 18.2.5 before 18.3.1 contains a prototype pollution vulnerability in lib/messages.js compile and merge that fails to reject a proto language key. Attackers supplying untrusted message configuration via any.messages, prefs, validate options or Joi.extend can replace...

CVE-2026-121943: irontec sngrep: Irontec sngrep through 1.9.0 contains an out-of-bounds stack read vulnerability in sip_check_packet and…

Irontec sngrep through 1.9.0 contains an out-of-bounds stack read vulnerability in sipcheckpacket and sipvalidatepacket caused by an off-by-one length check on 10240-byte SIP payloads. Remote attackers can send a crafted UDP or TCP SIP packet or supply a pcap file to crash sngrep or leak adjacent...

CVE-2026-115474: zulip: Zulip is an open-source team collaboration tool

Zulip is an open-source team collaboration tool. From 8.0 until 12.2, in organizations where the Who can view all other users in the organization setting restricted guests from viewing other users, saving or editing a direct message draft did not verify that the sender could access the draft...

CVE-2026-62126: miniOrange SAML SP Single Sign On: Allocation of Resources Without Limits or Throttling vulnerability in miniOrange SAML SP Single Sign On…

Allocation of Resources Without Limits or Throttling vulnerability in miniOrange SAML SP Single Sign On miniorange-saml-20-single-sign-on allows HTTP DoS.This issue affects SAML SP Single Sign On: from n/a through 6.1.0...

CVE-2026-102895: gpustack: GPUStack is an open-source GPU cluster manager for AI model serving and GPU instance provisioning

GPUStack is an open-source GPU cluster manager for AI model serving and GPU instance provisioning. Prior to 2.2.0, getcurrentuser in gpustack/api/auth.py treated a loopback request source as the built-in administrator when forceauthlocalhost was false, which was the default. A remote request coul...

CVE-2026-85036: zephyrproject zephyr: The Bluetooth Classic AVDTP layer defers releasing a session's stream endpoints: bt_avdtp_l2cap_disconnected() in…

The Bluetooth Classic AVDTP layer defers releasing a session's stream endpoints: btavdtpl2capdisconnected in subsys/bluetooth/host/classic/avdtp.c ends with kworksubmit&session-releasework, placing the embedded struct kwork on the system work queue's pending list. When the same struct btavdtp...

CVE-2026-121751: nvm-sh nvm: Node Version Manager (nvm) is a POSIX-compliant shell function for managing multiple node.js versions

Node Version Manager nvm is a POSIX-compliant shell function for managing multiple node.js versions. In versions 0.39.6 through 0.40.8, nvm ls-remote and other commands that refresh remote LTS aliases store the version column of the mirror's index.tab in $NVMDIR/alias/lts/ without validating it,...

CVE-2026-115242: Unknown: The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.137 does not sanitize the staging destination…

The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.137 does not sanitize the staging destination folder supplied to its staging-start handler, applying only a generic text filter while the sibling writability-check handler applies the correct filename sanitizer, so an...

CVE-2026-122137: romkatv: Powerlevel10k before 1.20.19 contains an insecure temporary directory vulnerability in the bundled gitstatus/install…

Powerlevel10k before 1.20.19 contains an insecure temporary directory vulnerability in the bundled gitstatus/install script that reuses attacker-creatable directories when mktemp fails. Local attackers can pre-create the predictable gitstatus-install.tmp directory to replace the extracted...