CVE-2026-18953

Improper limitation of a pathname to a restricted directory in the getresource tool in Amazon awslabs.aws-transform-mcp-server 0.1.0 through 0.1.4 might allow a context-dependent actor to write arbitrary files outside the intended working directory via the savePath parameter. To remediate this...

CVE-2026-70616

CVE-2026-70616 affects boringproxy 0.10.0. The vulnerability allows an authenticated user to cause resource exhaustion on the server by sending requests to GET /loading with attacker-supplied id values. The handler performs no map-lookup validation and blocks on a nil channel, with no timeout, ca...

EUVD-2026-53584

boringproxy through 0.10.0 contains a newline injection vulnerability that allows authenticated low-privileged users with tunnel-creation permission to inject arbitrary lines into the server account's SSH authorizedkeys file by supplying a percent-encoded newline character in the domain parameter...

CVE-2026-70615

boringproxy through 0.10.0 contains a newline injection vulnerability that allows authenticated low-privileged users with tunnel-creation permission to inject arbitrary lines into the server account's SSH authorizedkeys file by supplying a percent-encoded newline character in the domain parameter...

CVE-2026-70615

Boringproxy 0.10.0 is affected by a newline injection in the tunnel-creation endpoint’s domain parameter, enabling authenticated, low-privilege users with tunnel-creation permission to inject lines into the SSH authorized_keys file. This may allow insertion of an unrestricted public key, granting...

CVE-2026-70428

Jenkins 2.575 and earlier, LTS 2.568.1 and earlier improperly identifies file paths attempting path traversal in file parameter names, allowing attackers with Item/Configure and Item/Build permission to write files to arbitrary locations on the controller file system...

CVE-2026-70428

Jenkins 2.575 and earlier, LTS 2.568.1 and earlier improperly identifies file paths attempting path traversal in file parameter names, allowing attackers with Item/Configure and Item/Build permission to write files to arbitrary locations on the controller file system...

CVE-2026-70428

Jenkins 2.575 and earlier, LTS 2.568.1 and earlier improperly identifies file paths attempting path traversal in file parameter names, allowing attackers with Item/Configure and Item/Build permission to write files to arbitrary locations on the controller file system...

NPM: Electron: DevTools JavaScript Injection via Unsanitized Dock State Parameter

NPM: Electron: DevTools JavaScript Injection via Unsanitized Dock State Parameter vulnerability discovered by ? in WordPress Npm electron versions 39.8.7...

CVE-2026-70609

Electron contains a vulnerability where the mode option for webContents.openDevTools() was not sanitized by the DevTools frontend prior to versions 39.8.7, 40.9.0, 41.2.0, and 42.0.0-beta.1. If an attacker can influence this value, script execution could occur within the DevTools context, which i...

EUVD-2026-53477

IBM Langflow OSS 1.0.0 through 1.10.3 could allow a remote attacker to execute arbitrary code due to improper validation of configuration parameters...

keycloak: org.keycloak.protocol.oidc: HTTP Parameter Pollution in OIDC redirect URI allows response parameter duplication - #GHI-604

A flaw was found in Keycloak, an open-source identity and access management solution. When a client application is configured to accept broad redirect Uniform Resource Identifiers URIs, a remote attacker can manipulate the authentication process by crafting a special web address. If a user clicks...

keycloak: org.keycloak.protocol.oidc: HTTP Parameter Pollution in OIDC redirect URI allows response parameter duplication - #GHI-604

A flaw was found in Keycloak, an open-source identity and access management solution. When a client application is configured to accept broad redirect Uniform Resource Identifiers URIs, a remote attacker can manipulate the authentication process by crafting a special web address. If a user clicks...

EUVD-2026-53396

Improper Handling of Length Parameter Inconsistency vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.1. Unauthenticated attackers can cause a denial of service via a specially crafted Accept-Language header that triggers excessive CPU consumption during parsing. Users...

CVE-2026-48834 Apache Answer: Denial of service via crafted Accept-Language header parsing

Improper Handling of Length Parameter Inconsistency vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.1. Unauthenticated attackers can cause a denial of service via a specially crafted Accept-Language header that triggers excessive CPU consumption during parsing. Users...

postcss: PostCSS: Information disclosure via crafted sourceMappingURL

A flaw was found in PostCSS. A remote attacker can exploit this vulnerability by providing a specially crafted sourceMappingURL when a specific configuration the 'from' parameter is not set. This can cause the application to read and expose unintended source-map files, potentially revealing...

CVE-2026-17506

The Independent Analytics plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 404 notfoundurl tracking parameter in versions up to, and including, 2.15.0. This is due to the getcellcontent function applying urldecode after escurl when rendering the URL column for 404 entries...

CVE-2026-71287

Cacti's sanitizesqlcolumn lib/functions.php sanitizes user-supplied ORDER BY column names using the regex pregreplace'/^a-zA-Z0-9./', '', $column. Because this allowlist retains letters, digits, underscore, parentheses, and dot intended to support expressions like COUNTid and table.column, a...

CVE-2026-71276

Magistrala formerly Mainflux's message-readers API reads a format value from the HTTP query string readers/api/http/transport.go with no validation and interpolates it directly into raw SQL queries via fmt.Sprintf in both the PostgreSQL reader readers/postgres/messages.go: fmt.Sprintf"SELECT FROM...

CVE-2026-71275

OpenBK7231T's httpfnotaexec src/httpserver/httpfns.c reflects the host query parameter directly into an HTML response via hprintf255request, "OTA requested for %s!", tmpA with no HTML encoding, allowing a crafted URL such as /otaexec?host=alert1 to execute JavaScript in an authenticated admin's...