CVE-2026-24213: Out-of-bounds Read

NVIDIA Triton Inference Server contains a vulnerability in the DALI backend where an attacker could cause an out-of-bounds read. A successful exploit of this vulnerability might lead to code execution, data tampering, denial of service, or information disclosure...

Trilium Notes Cross-Site Scripting Vulnerabilities

Trilium Notes is a hierarchical note application developed by Zadam, a personal developer. It focuses on building large-scale personal knowledge bases. Versions of Trilium Notes prior to 0.102.1 contained a cross-site scripting vulnerability. This vulnerability stemmed from deficiencies such as...

CVE-2026-24215: Uncontrolled Resource Consumption

NVIDIA Triton Inference Server contains a vulnerability in the DALI backend, where an attacker could cause uncontrolled resource consumption. A successful exploit of this vulnerability might lead to denial of service...

Siemens RUGGEDCOM operating system command injection vulnerability (CNVD-2026-23336)

Siemens RUGGEDCOM is a communication device developed by the German company Siemens. It provides fast and reliable communication for industries such as power, transportation, oil, and gas. Siemens RUGGEDCOM has a vulnerability related to operating system command injection. This vulnerability aris...

CVE-2026-34390 MantisBT: Privilege Escalation from Manager to Administrator

Mantis Bug Tracker MantisBT is an open source issue tracker. Versions 2.28.1 and prior have a Privilege Escalation vulnerability where insufficient access control checks in ProjectUsersAddCommand manageprojuseradd.php allow users having manageprojectthreshold access level manager by default to...

CVE-2026-39250

An authorization vulnerability exists in Innoshop 0.6.0. After logging into the frontend, an attacker can directly access backend application interfaces, leading to further dangerous operations...

MCP Gateway: Authority-injection and JWT/session bypass via the unauthenticated router hair-pin "router-key" / "mcp-init-host" path

Summary The MCP router extproc exposes an initialize-method code path that, when a request carries an mcp-init-host header, bypasses the gateway JWT session validator and rewrites the upstream :authority header to whatever the caller chooses, gated only by a single shared header value router-key...

com.alexnederlof:jasperreports-plugin (1.6), org.appverse.web.framework.modules.backend.reporting:appverse-web-modules-backend-reporting (>=1.0.3, <=1.5.4-release) potentially affected by CVE-2026-6009 via net.sf.jasperreports:jasperreports (5.0.1)

net.sf.jasperreports:jasperreports MAVEN version 5.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on net.sf.jasperreports:jasperreports and may be impacted: - com.alexnederlof:jasperreports-plugin 1.6 -...

@budibase/cli (>=3.0.0, <=3.2.26), @budibase/pro (>=3.0.0, <=3.2.26) +2 more potentially affected by CVE-2026-46424 via @budibase/backend-core (>=3.0.0, <=3.2.26)

@budibase/backend-core NPM version =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.2.26 Source cves: CVE-2026-46424 Source advisory: GHSA-6VP2-6R7M-2JVX...

@budibase/cli (>=3.0.0, <=3.2.26), @budibase/pro (>=3.0.0, <=3.2.26) +2 more potentially affected by CVE-2026-46424 via @budibase/backend-core (>=3.0.0, <=3.2.26)

@budibase/backend-core NPM version =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.2.26 Source cves: CVE-2026-46424 Source advisory: OSV:GHSA-6VP2-6R7M-2JVX...

@budibase/cli (>=3.0.0, <=3.2.26), @budibase/pro (>=3.0.0, <=3.2.26) +2 more potentially affected by CVE-2026-46424 via @budibase/backend-core (>=3.0.0, <=3.2.26)

@budibase/backend-core NPM version =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.2.26 Source cves: CVE-2026-46424 Source advisory: SNYK:JS-BUDIBASEBACKENDCORE-16874300...

backend-ai-manager (>=26.4.0rc1, <=26.8.3), bootgraph (>=1.20.0.dev34111, <=1.21.0) +10 more potentially affected by CVE-2026-45739 via strawberry-graphql (>=0.288.4, <=0.315.2)

strawberry-graphql PYPI version =0.288.4, =26.4.0rc1, =1.20.0.dev34111, =1.1.20, =1.13.1, =1.0.0, =4.5.4, =1.0.0, =0.1.0, =0.2.1, =0.6.7 Source cves: CVE-2026-45739 Source advisory: SNYK:PYTHON-STRAWBERRYGRAPHQL-16771095...

backend-ai-manager (>=26.4.0rc1, <=26.8.3), bootgraph (>=1.20.0.dev34111, <=1.21.0) +10 more potentially affected by CVE-2026-45739 via strawberry-graphql (>=0.288.4, <=0.315.2)

strawberry-graphql PYPI version =0.288.4, =26.4.0rc1, =1.20.0.dev34111, =1.1.20, =1.13.1, =1.0.0, =4.5.4, =1.0.0, =0.1.0, =0.2.1, =0.6.7 Source cves: CVE-2026-45739 Source advisory: OSV:GHSA-X97M-QP5C-W9XJ...

glibc: glibc: Incorrect DNS response parsing via crafted DNS server response

A flaw was found in glibc the GNU C Library. When an application uses the gethostbyaddr or gethostbyaddrr functions with a nsswitch.conf configuration that specifies glibc's DNS backend, a remote attacker can send a specially crafted DNS Domain Name System response. This crafted response can caus...

CVE-2025-14575

An Uncontrolled Search Path Element vulnerability in the OpenSSL TLS backend of Qt Network qtbase in Qt Qt Framework Unix allows a local attacker to load a rogue CA certificate as a trusted system authority via a crafted certificate file placed in the application's working directory...

UBUNTU-CVE-2025-14575

An Uncontrolled Search Path Element vulnerability in the OpenSSL TLS backend of Qt Network qtbase in Qt Qt Framework Unix allows a local attacker to load a rogue CA certificate as a trusted system authority via a crafted certificate file placed in the application's working directory...

CVE-2026-43493 crypto: pcrypt - Fix handling of MAY_BACKLOG requests

In the Linux kernel, the following vulnerability has been resolved: crypto: pcrypt - Fix handling of MAYBACKLOG requests MAYBACKLOG requests can return EBUSY. Handle them by checking for that value and filtering out EINPROGRESS notifications...

CVE-2026-46724 Path Traversal in extension "Faceted Search" (ke_search)

The file indexer does not normalize the configured directory path. A backend user with permission to edit indexer configurations can index documents from arbitrary locations on the server file system through path traversal sequences...

CVE-2026-46724

CVE-2026-46724 affects the Typo3 extension Faceted Search (ke_search). The file indexer does not normalize the configured directory path, allowing a backend user with permission to edit indexer configurations to index documents from arbitrary server file-system locations via path traversal. CVSS ...

CVE-2026-46724 Path Traversal in extension "Faceted Search" (ke_search)

The file indexer does not normalize the configured directory path. A backend user with permission to edit indexer configurations can index documents from arbitrary locations on the server file system through path traversal sequences...