GHSA-Q4VM-PQ3Q-8WGQ nebula-mesh: Operator session tokens stored in plaintext in the database

Impact Operator session tokens are stored in plaintext in the operatorsessions table the token column is the PRIMARY KEY. The session token is a 32-byte random hex value sent directly in a cookie and valid for 24 hours. - internal/models/operator.go:61 — OperatorSession.Token holds the plaintext...

CVE-2026-48760

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. From 6.1.0 until 6.4.41, 7.4.13, and 8.0.13, UrlSanitizer::parse rejected raw BiDi formatting characters but not percent-encoded forms and used an ASCII-only whitespace check, allowing sanitized URLs...

CVE-2026-24259

NVIDIA TensorRT-LLM for Linux contains a vulnerability where an attacker could cause missing authentication for a critical function. A successful exploit of this vulnerability might lead to code execution, data tampering, and information disclosure...

EUVD-2026-44463

NVIDIA TensorRT-LLM for Linux contains a vulnerability where an attacker could cause missing authentication for a critical function. A successful exploit of this vulnerability might lead to code execution, data tampering, and information disclosure...

CVE-2026-24259

NVIDIA TensorRT-LLM for Linux contains a vulnerability where an attacker could cause missing authentication for a critical function. A successful exploit of this vulnerability might lead to code execution, data tampering, and information disclosure...

CVE-2026-24259

NVIDIA TensorRT-LLM for Linux contains a vulnerability where an attacker could cause missing authentication for a critical function. A successful exploit of this vulnerability might lead to code execution, data tampering, and information disclosure...

GHSA-28XV-PH75-77WH Prototype pollution in @feathersjs/commons _.merge via JSON-parsed __proto__

Impact The .mergetarget, source utility exported by @feathersjs/commons recursively merges source into target by iterating Object.keyssource. When source was produced by JSON.parse and contains a proto or constructor / prototype key, that key is returned as an own-enumerable property. The recursi...

CVE-2026-48252

Adobe Experience Manager is affected by CVE-2026-48252 (Missing Authentication for Critical Function, CWE-306). An attacker could bypass security measures and gain unauthorized write access without user interaction. The vulnerability has a CVSS v3.1 score of 8.6 (Network, Low attack complexity, N...

CVE-2026-48252 Adobe Experience Manager | Missing Authentication for Critical Function (CWE-306)

Adobe Experience Manager is affected by a Missing Authentication for Critical Function vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue does not...

CVE-2026-48760 Symfony: HtmlSanitizer URL Parser Deny Gates Underinclusive: Percent-Encoded BiDi Marks and Unicode Whitespace Bypass Visual-Spoofing Defense

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. From 6.1.0 until 6.4.41, 7.4.13, and 8.0.13, UrlSanitizer::parse rejected raw BiDi formatting characters but not percent-encoded forms and used an ASCII-only whitespace check, allowing sanitized URLs...

Out-of-bounds Write

Overview Affected versions of this package are vulnerable to Out-of-bounds Write via the apply function. An attacker can cause memory corruption and potentially crash the application by providing an output image with a mode that does not match the transform's declared output mode. Remediation...

EUVD-2026-44055

External control of file name or path in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally...

EUVD-2026-43954

Missing authentication for critical function in Windows Routing and Remote Access Service RRAS allows an authorized attacker to elevate privileges locally...

EUVD-2026-43888

Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally...

EUVD-2026-44043

Missing authentication for critical function in Microsoft Office SharePoint allows an unauthorized attacker to elevate privileges over a network...

EUVD-2026-43821

Missing authentication for critical function in Windows Spaceport.sys allows an authorized attacker to elevate privileges locally...

EUVD-2026-43988

Missing authentication for critical function in Microsoft Windows DNS allows an authorized attacker to perform tampering locally...

EUVD-2026-43731

A security flaw has been discovered in DedeCMS 5.7.118. Affected by this vulnerability is the function ExtractFile of the file include/zip.class.php of the component Album Publishing Feature. The manipulation of the argument filename results in path traversal. The attack can be executed remotely...

CVE-2026-57093

Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally...

Missing Synchronization

Overview Affected versions of this package are vulnerable to Missing Synchronization in the AddDiff function when running in Diff mode, which writes to the shared responsesDiff map without synchronization. An attacker can cause the process to crash and become unavailable by sending multiple...