CVE-2026-67969: Improper Input Validation

An issue in the HSMonitorApplications component of NASA cFS v7.0.1 allows attackers to force the processor to reset via supplying a crafted HS.AppMonTbl entry...

CVE-2026-67969

An issue in the HSMonitorApplications component of NASA cFS v7.0.1 allows attackers to force the processor to reset via supplying a crafted HS.AppMonTbl entry...

CVE-2026-9856 Path Traversal in huggingface/transformers

A vulnerability in huggingface/transformers versions =5.8.0.dev0 allows an attacker to perform arbitrary file writes via path traversal. The issue resides in the savepretrained methods of PreTrainedTokenizerBase and ProcessorMixin, where keys from the chattemplate dictionary are used directly as...

EUVD-2026-52005

A vulnerability in huggingface/transformers versions =5.8.0.dev0 allows an attacker to perform arbitrary file writes via path traversal. The issue resides in the savepretrained methods of PreTrainedTokenizerBase and ProcessorMixin, where keys from the chattemplate dictionary are used directly as...

CVE-2026-9856

The CVE-2026-9856 entry describes a path traversal flaw in huggingface/transformers

CVE-2026-9856 Path Traversal in huggingface/transformers

A vulnerability in huggingface/transformers versions =5.8.0.dev0 allows an attacker to perform arbitrary file writes via path traversal. The issue resides in the savepretrained methods of PreTrainedTokenizerBase and ProcessorMixin, where keys from the chattemplate dictionary are used directly as...

CVE-2026-9856 Path Traversal in huggingface/transformers

A vulnerability in huggingface/transformers versions =5.8.0.dev0 allows an attacker to perform arbitrary file writes via path traversal. The issue resides in the savepretrained methods of PreTrainedTokenizerBase and ProcessorMixin, where keys from the chattemplate dictionary are used directly as...

PT-2026-67349

Name of the Vulnerable Software and Affected Versions huggingface/transformers versions prior to 5.8.0.dev0 Description An issue allows arbitrary file writes through path traversal, a technique used to access files and directories outside the intended folder. The flaw exists in the save pretraine...

CVE-2026-14830 FlxWoo < 3.1.1 - Unauthenticated Payment Bypass

The FlxWoo WordPress plugin before 3.1.1 does not verify with the payment processor that a checkout session was actually paid before marking the associated order as paid, allowing unauthenticated attackers to complete WooCommerce orders without paying...

CVE-2026-14830: Improper Authentication

The FlxWoo WordPress plugin before 3.1.1 does not verify with the payment processor that a checkout session was actually paid before marking the associated order as paid, allowing unauthenticated attackers to complete WooCommerce orders without paying...

The vulnerability of the configuration processor for protected branches of the Git-based software platform, which allows a hacker to modify the configuration of protected branches.

The vulnerability of the configuration processor for protected branches in the git-based software platform, which is used for collaborative code development in GitLab CE/EE, is related to deficiencies in the authentication process. Exploiting this vulnerability could allow a malicious actor to...

CVE-2026-18064

An incomplete fix for CVE-2026-15352 in the NASA core Flight System cFS Health and Safety HS application leaves a separate NULL pointer dereference reachable in versions through 7.0.1. An attacker who can trigger the affected command under specific conditions could cause the HS application to...

CVE-2026-18064 NASA Core Flight System (cFS) Health & Safety (HS) Application NULL Pointer Dereference

An incomplete fix for CVE-2026-15352 in the NASA core Flight System cFS Health and Safety HS application leaves a separate NULL pointer dereference reachable in versions through 7.0.1. An attacker who can trigger the affected command under specific conditions could cause the HS application to...

CVE-2026-18064 NASA Core Flight System (cFS) Health & Safety (HS) Application NULL Pointer Dereference

An incomplete fix for CVE-2026-15352 in the NASA core Flight System cFS Health and Safety HS application leaves a separate NULL pointer dereference reachable in versions through 7.0.1. An attacker who can trigger the affected command under specific conditions could cause the HS application to...

CVE-2026-18064 NASA Core Flight System (cFS) Health & Safety (HS) Application NULL Pointer Dereference

An incomplete fix for CVE-2026-15352 in the NASA core Flight System cFS Health and Safety HS application leaves a separate NULL pointer dereference reachable in versions through 7.0.1. An attacker who can trigger the affected command under specific conditions could cause the HS application to...

SUSE CVE-2026-35599

Vikunja is an open-source self-hosted task management platform. Prior to 2.3.0, the addRepeatIntervalToTime function uses an On loop that advances a date by the task's RepeatAfter duration until it exceeds the current time. By creating a repeating task with a 1-second interval and a due date far ...

SUSE CVE-2026-46378

Dasel is a command-line tool and library for querying, modifying, and transforming data structures. From 3.0.0 until 3.10.1, the selector lexer matchRegexPattern closure in Tokenizer.parseCurRune in selector/lexer/tokenize.go loops while tokenizing an unterminated regex literal such as r/ because...

CVE-2026-15657

A vulnerability in the foreUP customer REST API allows any authenticated user to read cleartext payment-processor merchant credentials in the response body...

CVE-2026-15657

A vulnerability in the foreUP (Golf Compete) customer REST API allows any authenticated user to read cleartext payment-processor merchant credentials in the response body. Specifically, each customer record response exposes the facility's finix_username , finix_password , and finix_merchant_id . ...

CVE-2026-15657 foreUP customer REST API allows authenticated users to read cleartext payment-processor merchant credentials

A vulnerability in the foreUP customer REST API allows any authenticated user to read cleartext payment-processor merchant credentials in the response body...