CVE-2026-102293

A vulnerability exists in realjerrytang tacomall 1.0.0 within the api-admin Backend component. Specifically, the OrgStaffServiceImpl.add function in the ApiMaApplication.java file is susceptible to improper authorization when the isAdmin/jobId arguments are manipulated. This flaw allows for remot...

Amazon Linux 2023 : libssh, libssh-config, libssh-devel (ALAS2023-2026-3096)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3096 advisory. A flaw was found in libssh. A remote authenticated client can issue SSHFXPREAD requests with an arbitrarily large length, causing a libssh SFTP server to allocate excessive memory and...

Amazon Linux 2 : gvfs (ALAS-2026-3943)

The version of gvfs installed on the remote host is prior to 1.36.2-3. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2026-3943 advisory. A flaw was found in the SFTP backend in gvfs. When mounting a share and reading a file, a malicious SFTP server can cause readreply t...

PT-2026-102682

Name of the Vulnerable Software and Affected Versions SGLang versions prior to 0.5.21 Description When operating in prefill/decode disaggregation mode with the Mooncake KV transfer backend, the software fails to validate duplicate bootstrap room fields in the '/generate' endpoint. Unauthenticated...

CVE-2026-102634: Use of Multiple Resources with Duplicate Identifier

SGLang through 0.5.20 in prefill/decode disaggregation mode fails to validate duplicate bootstraproom fields in /generate requests with Mooncake KV transfer backend. Unauthenticated attackers can send concurrent requests with identical bootstraproom values to crash scheduler processes or hang oth...

PT-2026-102578

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 157 Thunderbird versions prior to 157 Description A use-after-free issue exists in the Preferences: Backend component, which can lead to a sandbox escape. A use-after-free occurs when a program continues to use a...

Important: gvfs

Issue Overview: A flaw was found in the SFTP backend in gvfs. When mounting a share and reading a file, a malicious SFTP server can cause readreply to process a length that exceeds the size requested by the client. The function does not verify the server-provided length against the allocated buff...

PT-2026-102639

Name of the Vulnerable Software and Affected Versions Weblate versions 4.11.1 through 2026.7.1 Description An argument-injection flaw exists in the Mercurial backend of this web-based continuous localization platform. Repository filenames starting with a hyphen - may be interpreted as Mercurial...

PT-2026-102453

Name of the Vulnerable Software and Affected Versions realjerrytang tacomall version 1.0.0 Description An improper authorization issue exists in the api-admin Backend component within the file ApiMaApplication.java. The flaw occurs in the OrgStaffServiceImpl.add function, where manipulating the...

CVE-2026-102293: Improper Authorization

A vulnerability was identified in realjerrytang tacomall 1.0.0. Impacted is the function OrgStaffServiceImpl.add of the file ApiMaApplication.java of the component api-admin Backend. The manipulation of the argument isAdmin/jobId leads to improper authorization. Remote exploitation of the attack ...

CVE-2026-86035: Improper Neutralization of Special Elements used in an OS Command

Weblate is a web-based continuous localization platform used to manage software translations. Weblate 4.11.1 through 2026.7.1 contains an argument-injection vulnerability in its Mercurial backend. Repository filenames beginning with - could be interpreted as Mercurial options instead of literal...

CVE-2026-86158: Missing Authentication for Critical Function

Missing authentication in the local .NET backend Fiddler.WebUi of Progress Software Fiddler Everywhere 8.0.2 allows a local unauthenticated attacker to mint OAuth tokens and read the machine-in-the-middle root certificate through an unauthenticated localhost HTTP and SignalR RPC channel...

CVE-2026-100804: Use After Free

Sandbox escape due to use-after-free in the Preferences: Backend component. This vulnerability was fixed in Thunderbird 157 and Firefox 157...

CVE-2025-57819

CVE-2025-57819 - FreePBX 未认证远程代码执行 RCE CVE-2025-57819 是一个影响 Sangoma FreePBX 版本 15、16 和 17 的 严重远程代码执行 RCE 漏洞。该漏洞源于易受攻击端点中对用户控制输入的清理不足 ，使得未认证攻击者能够绕过认证、操纵应用程序的后端数据库，并最终在底层服务器上执行任意操作系统命令。 凭借 CVSS v3 评分 9.8（严重） ，该漏洞代表一个完整的入侵场景，不需要认证 ，不需要用户交互 。 技术摘要 属性| 值 ---|--- CVE| CVE-2025-57819 严重性| 严重 CVSS v3| 9....

CVE-2026-101078

A vulnerability has been found in deepseek-ai deepseek-harness up to 0.1.7-rc.2. Affected is an unknown function of the file packages/sandbox/sandbox-local/src/profiles.ts of the component Landlock Backend. Such manipulation leads to improper isolation or compartmentalization. The attack must be...

CVE-2026-101078

A vulnerability exists in deepseek-ai deepseek-harness versions up to 0.1.7-rc.2 within the Landlock Backend component. The issue stems from an unknown function in the file packages/sandbox/sandbox-local/src/profiles.ts, which can lead to improper isolation or compartmentalization . Exploitation ...

EUVD-2026-88334

A vulnerability has been found in deepseek-ai deepseek-harness up to 0.1.7-rc.2. Affected is an unknown function of the file packages/sandbox/sandbox-local/src/profiles.ts of the component Landlock Backend. Such manipulation leads to improper isolation or compartmentalization. The attack must be...

CVE-2026-101078 deepseek-ai deepseek-harness Landlock Backend profiles.ts isolation

A vulnerability has been found in deepseek-ai deepseek-harness up to 0.1.7-rc.2. Affected is an unknown function of the file packages/sandbox/sandbox-local/src/profiles.ts of the component Landlock Backend. Such manipulation leads to improper isolation or compartmentalization. The attack must be...

CVE-2026-101078 deepseek-ai deepseek-harness Landlock Backend profiles.ts isolation

A vulnerability has been found in deepseek-ai deepseek-harness up to 0.1.7-rc.2. Affected is an unknown function of the file packages/sandbox/sandbox-local/src/profiles.ts of the component Landlock Backend. Such manipulation leads to improper isolation or compartmentalization. The attack must be...

CVE-2026-101078: Improper Isolation or Compartmentalization

A vulnerability has been found in deepseek-ai deepseek-harness up to 0.1.7-rc.2. Affected is an unknown function of the file packages/sandbox/sandbox-local/src/profiles.ts of the component Landlock Backend. Such manipulation leads to improper isolation or compartmentalization. The attack must be...