CVE-2026-73082

Activepieces (open source AI workflow automation) has an SSRF vulnerability in the POST /api/v1/projects/:projectId/mcp-server/validate-agent-mcp-tool endpoint. Before version 0.82.0, an authenticated user could cause the server to issue outbound HTTP or SSE requests to a user-supplied serverUrl ...

EUVD-2026-56527

Activepieces is an open source AI workflow automation platform. Prior to 0.80.0, the worker's code-compilation pipeline builds the on-disk path for a Code step from the step's name and passes that path to a shell-invoked build command. A step name containing shell metacharacters can break out of...

CVE-2026-32677

Path traversal for some gaudi-container-runtime before version 1.24.0 within Ring 3: User Applications may allow an escalation of privilege. Unprivileged software adversary with an authenticated user combined with a low complexity attack may enable escalation of privilege. This result may...

CVE-2026-27765

Improper input validation for some vLLM Hardware Plugin for IntelR GaudiR software before version 0.16.0 within Ring 3: User Applications may allow a denial of service. Authorized adversary with an authenticated user combined with a low complexity attack may enable denial of service. This result...

EUVD-2026-56522

Improper input validation for some vLLM Hardware Plugin for IntelR GaudiR software before version 0.16.0 within Ring 3: User Applications may allow a denial of service. Authorized adversary with an authenticated user combined with a low complexity attack may enable denial of service. This result...

EUVD-2026-56515

Heap-based buffer overflow for the IntelR Open Volume Kernel Library IntelR Open VKL library maintained by intelR before version 2.0.2 within Ring 3: User Applications may allow a denial of service. System software adversary with an authenticated user combined with a low complexity attack may...

CVE-2026-21399

The CVE affects Intel Open Volume Kernel Library (Intel Open VKL) prior to version 2.0.2, with a heap-based buffer overflow in the library component. The issue occurs in Ring 3 (user applications) and can allow a Denial of Service when an authenticated local user with low attack complexity can tr...

CVE-2026-21399

Heap-based buffer overflow for the IntelR Open Volume Kernel Library IntelR Open VKL library maintained by intelR before version 2.0.2 within Ring 3: User Applications may allow a denial of service. System software adversary with an authenticated user combined with a low complexity attack may...

CVE-2026-21399

Heap-based buffer overflow for the IntelR Open Volume Kernel Library IntelR Open VKL library maintained by intelR before version 2.0.2 within Ring 3: User Applications may allow a denial of service. System software adversary with an authenticated user combined with a low complexity attack may...

CVE-2026-21399

Heap-based buffer overflow for the IntelR Open Volume Kernel Library IntelR Open VKL library maintained by intelR before version 2.0.2 within Ring 3: User Applications may allow a denial of service. System software adversary with an authenticated user combined with a low complexity attack may...

CVE-2026-20786

CVE-2026-20786 describes an out-of-bounds read in the Intel(R) NPU Driver affecting all Ring 3 (user) versions. An unprivileged authenticated user with local access and low attack complexity may cause denial of service, with potential impact on integrity (low) and availability (high); confidentia...

CVE-2026-53416

Path traversal in Zoom VDI Client and Plugins may allow an authenticated user to conduct information disclosure via local access...

CVE-2026-53416

CVE-2026-53416 affects the Zoom VDI Client and Plugins. The issue is a path traversal vulnerability that may allow an authenticated user to disclose information via local access. Root cause is path traversal in the affected components. Exploitation details are not provided in the documents. The C...

CVE-2026-53416 Zoom VDI - Path Traversal

Path traversal in Zoom VDI Client and Plugins may allow an authenticated user to conduct information disclosure via local access...

EUVD-2026-56246

Path traversal in Zoom VDI Client and Plugins may allow an authenticated user to conduct information disclosure via local access...

CVE-2026-73068 ToolJet: Cross-tenant Broken Access Control in ToolJet Database (tooljet-db): any authenticated user can read and write another organization's tables

ToolJet is the open-source foundation am AI-native platform for building and deploying internal tools, workflows and AI agents. Prior to 3.20.207, the ToolJet Database HTTP API in server/src/modules/tooljet-db/controller.ts authorizes operations against the :organizationId URL path value without...

CVE-2026-73068

ToolJet CVE-2026-73068 describes cross-tenant broken access control in the ToolJet Database (tooljet-db). Before 3.20.207, the API拒authorization allowed any authenticated user to read/write other organizations’ tables via endpoints such as GET /api/tooljet-db/organizations/:organizationId/tables,...

CVE-2026-18638 Velociraptor server crash via the SetPassword API

Any authenticated Velociraptor user — including one holding only the readerrole — can terminate the entire server process with a single request, by calling SetPassword with a username that does not exist...

CVE-2026-18638 Velociraptor server crash via the SetPassword API

Any authenticated Velociraptor user — including one holding only the readerrole — can terminate the entire server process with a single request, by calling SetPassword with a username that does not exist...

CVE-2026-19434 Stored Cross-site Scripting in Pentestify finding severity field

Cross-site Scripting in the finding renderer in maalfer Pentestify before 2.3.1 allows authenticated users to execute arbitrary JavaScript in the application origin via HTML markup stored in a finding's severity field, which the frontend interpolates unescaped into class and style attributes when...