CVE-2026-85976

Progress MarkLogic Server versions 12.x before 12.1.0 and 11.x before 11.3.7 are vulnerable to HTTP response splitting . The root cause is insufficient input sanitization within the Query Console file-exploration endpoint , which can lead to unintended client-side response handling . No specific ...

RHLW-2026-99869C1CAD4574FC Lightwell Security Advisory: netty-codec-http 4.1.100.Final-rhlw-00001

Red Hat Lightwell has released io.netty:netty-codec-http 4.1.100.Final-rhlw-00001 with backported fixes for CVE-2024-29025, CVE-2025-58056, CVE-2025-67735, CVE-2026-33870, CVE-2026-41417, CVE-2026-42580, CVE-2026-42581, CVE-2026-42584, CVE-2026-42585, CVE-2026-42587, CVE-2026-50020, CVE-2026-5583...

CVE-2026-109360 MONAI 0.4.0 before 1.6.1 RCE via SENet Pretrained Weights Over Plaintext HTTP

MONAI 0.4.0 before 1.6.1 contains a remote code execution vulnerability that allows on-path attackers to execute code by tampering with SENet pretrained weights fetched over plaintext HTTP. Attackers can substitute a crafted .pth file that loadstatedictfromurl unpickles without weightsonly=True,...

CVE-2026-109360 MONAI 0.4.0 before 1.6.1 RCE via SENet Pretrained Weights Over Plaintext HTTP

MONAI 0.4.0 before 1.6.1 contains a remote code execution vulnerability that allows on-path attackers to execute code by tampering with SENet pretrained weights fetched over plaintext HTTP. Attackers can substitute a crafted .pth file that loadstatedictfromurl unpickles without weightsonly=True,...

CVE-2026-109360

MONAI 0.4.0 before 1.6.1 contains a remote code execution vulnerability that allows on-path attackers to execute code by tampering with SENet pretrained weights fetched over plaintext HTTP. Attackers can substitute a crafted .pth file that loadstatedictfromurl unpickles without weightsonly=True,...

EUVD-2026-97662

MONAI 0.4.0 before 1.6.1 contains a remote code execution vulnerability that allows on-path attackers to execute code by tampering with SENet pretrained weights fetched over plaintext HTTP. Attackers can substitute a crafted .pth file that loadstatedictfromurl unpickles without weightsonly=True,...

CVE-2026-109360

The MONAI library (versions 0.4.0 before 1.6.1) is vulnerable to Remote Code Execution (RCE) when constructing SEResNet50 or other SENet models with pretrained=True. The root cause is the insecure unpickling of pretrained weights fetched over plaintext HTTP via the load_state_dict_from_url functi...

CVE-2026-109360 MONAI 0.4.0 before 1.6.1 RCE via SENet Pretrained Weights Over Plaintext HTTP

MONAI 0.4.0 before 1.6.1 contains a remote code execution vulnerability that allows on-path attackers to execute code by tampering with SENet pretrained weights fetched over plaintext HTTP. Attackers can substitute a crafted .pth file that loadstatedictfromurl unpickles without weightsonly=True,...

CVE-2026-109357 LibreNMS before 26.9.0 LDAP Filter Injection Authentication Bypass via Authorization Header

LibreNMS before 26.9.0 contains an LDAP filter injection in ldap-authorization and ad-authorization modes because usernames are inserted unescaped into LDAP search filters and authentication only checks user existence. When REMOTEUSER is not forwarded, unauthenticated attackers can send a wildcar...

CVE-2026-109357 LibreNMS before 26.9.0 LDAP Filter Injection Authentication Bypass via Authorization Header

LibreNMS before 26.9.0 contains an LDAP filter injection in ldap-authorization and ad-authorization modes because usernames are inserted unescaped into LDAP search filters and authentication only checks user existence. When REMOTEUSER is not forwarded, unauthenticated attackers can send a wildcar...

CVE-2026-109357 LibreNMS before 26.9.0 LDAP Filter Injection Authentication Bypass via Authorization Header

LibreNMS before 26.9.0 contains an LDAP filter injection in ldap-authorization and ad-authorization modes because usernames are inserted unescaped into LDAP search filters and authentication only checks user existence. When REMOTEUSER is not forwarded, unauthenticated attackers can send a wildcar...

EUVD-2026-97627

Grav from 2.0.22 before 2.1.7 contains an authentication bypass vulnerability in the Clockwork profiler that trusts loopback REMOTEADDR values. Unauthenticated attackers behind a same-host HTTP proxy can read profiler records exposing system and plugin configuration, secrets, request metadata, an...

CVE-2026-109325

Grav from 2.0.22 before 2.1.7 contains an authentication bypass vulnerability in the Clockwork profiler that trusts loopback REMOTEADDR values. Unauthenticated attackers behind a same-host HTTP proxy can read profiler records exposing system and plugin configuration, secrets, request metadata, an...

CVE-2026-109325 Grav from 2.0.22 before 2.1.7 Clockwork Profiler Authentication Bypass via Proxy

Grav from 2.0.22 before 2.1.7 contains an authentication bypass vulnerability in the Clockwork profiler that trusts loopback REMOTEADDR values. Unauthenticated attackers behind a same-host HTTP proxy can read profiler records exposing system and plugin configuration, secrets, request metadata, an...

CVE-2026-109325 Grav from 2.0.22 before 2.1.7 Clockwork Profiler Authentication Bypass via Proxy

Grav from 2.0.22 before 2.1.7 contains an authentication bypass vulnerability in the Clockwork profiler that trusts loopback REMOTEADDR values. Unauthenticated attackers behind a same-host HTTP proxy can read profiler records exposing system and plugin configuration, secrets, request metadata, an...

CVE-2026-109309 SiYuan v3.7.0 before v3.8.6 Arbitrary File Read via Plugin ResponseFile.Path

SiYuan v3.7.0 before v3.8.6 contains an absolute path traversal vulnerability in the kernel's private plugin HTTP server, which passes a kernel plugin handler's ResponseFile.Path to gin's Context.File without validation. Attackers supplying a malicious kernel plugin can return an absolute path to...

EUVD-2026-97611

SiYuan v3.7.0 before v3.8.6 contains an absolute path traversal vulnerability in the kernel's private plugin HTTP server, which passes a kernel plugin handler's ResponseFile.Path to gin's Context.File without validation. Attackers supplying a malicious kernel plugin can return an absolute path to...

CVE-2026-109309

SiYuan versions v3.7.0 before v3.8.6 are vulnerable to an absolute path traversal vulnerability within the kernel's private plugin HTTP server. The flaw occurs because a kernel plugin handler's ResponseFile.Path is passed to gin's Context.File without proper validation. An attacker capable of sup...

CVE-2026-109309 SiYuan v3.7.0 before v3.8.6 Arbitrary File Read via Plugin ResponseFile.Path

SiYuan v3.7.0 before v3.8.6 contains an absolute path traversal vulnerability in the kernel's private plugin HTTP server, which passes a kernel plugin handler's ResponseFile.Path to gin's Context.File without validation. Attackers supplying a malicious kernel plugin can return an absolute path to...

Siemens .NET Client Library for SIMATIC S7 Webserver API information leakage vulnerability

The Siemens .NET Client Library for SIMATIC S7 Webserver API versions prior to V3.3.62 has a vulnerability related to information leakage. This vulnerability arises from the improper masking of the PLC recovery password from HTTP error messages. As a result, attackers with access to logs or other...