CVE-2026-9500: Heap-based Buffer Overflow

A vulnerability was found in GNU LibreDWG up to 0.14. The affected element is the function read2004compressedsection of the file src/decode.c of the component Dwgread Utility. Performing a manipulation results in heap-based buffer overflow. The attack is only possible with local access. The explo...

CVE-2026-9473: Improper Limitation of a Pathname to a Restricted Directory

A vulnerability has been found in c-rick jimeng-mcp 1.10.0. Affected by this vulnerability is the function getFileContent/uploadCoverFile/generateImage/generateVideo of the file src/api.ts. The manipulation of the argument filePath leads to path traversal. The attack may be initiated remotely. Th...

CVE-2026-47069: Improper Neutralization of CRLF Sequences

Improper Neutralization of CRLF Sequences 'CRLF Injection' vulnerability in benoitc hackney allows HTTP Response Splitting. The hackneycookie:setcookie/3 function in src/hackneycookie.erl validates the Name and Value arguments against CRLF and control characters, but concatenates the domain and...

CVE-2026-47070: URL Redirection to Untrusted Site

Sensitive Data Exposure vulnerability in benoitc hackney allows Retrieve Embedded Sensitive Data. The HTTP/3 redirect handler in src/hackneyh3.erl passes the original request headers unchanged to the redirect target without performing any cross-origin check. When a client issues an HTTP/3 request...

CVE-2026-47073: Uncontrolled Resource Consumption

Allocation of Resources Without Limits or Throttling vulnerability in benoitc hackney allows Flooding. The WebSocket client in src/hackneyws.erl imposes no upper bound on memory consumption in three code paths. First, readhandshakeresponse/3 accumulates received bytes into a growing buffer with n...

CVE-2026-47067: Allocation of Resources Without Limits or Throttling

Allocation of Resources Without Limits or Throttling vulnerability in benoitc hackney allows Flooding. The URL parser in src/hackneyurl.erl converts every unrecognized URL scheme to a permanent BEAM atom via binarytoatom/2. BEAM atoms are never garbage-collected and the atom table defaults to a...

CVE-2026-9468: Improper Limitation of a Pathname to a Restricted Directory

A security flaw has been discovered in dazeb cline-mcp-memory-bank up to 55c81b9cf6c16700983c84dc4cdea3cafa19a75f. The affected element is the function handleInitializeMemoryBank of the file src/index.ts. The manipulation of the argument projectPath results in path traversal. The attack may be...

CVE-2026-9472: Improper Limitation of a Pathname to a Restricted Directory

A flaw has been found in dazeb markdown-downloader up to 3d4394b34b6c99d81af817623af55e3384df5a6a. Affected is the function downloadmarkdown/listdownloadedfiles/createsubdirectory of the file src/index.ts. Executing a manipulation can lead to path traversal. The attack can be launched remotely. T...

CVE-2026-47072: Improper Neutralization of CRLF Sequences

Improper Neutralization of CRLF Sequences 'CRLF Injection' vulnerability in benoitc hackney allows HTTP Request/Response Splitting. The WebSocket upgrade code in src/hackneyws.erl copies the host, path, headers ExtraHeaders, and protocols options from the caller-supplied opts map into the interna...

CVE-2026-9358: Uncontrolled Recursion

A vulnerability was determined in postcss-selector-parser up to 6.1.2/7.1.2. Affected is the function toString of the file src/selectors/container.js of the component AST Serialization. Executing a manipulation can lead to uncontrolled recursion. It is possible to launch the attack remotely. The...

CVE-2026-9365: Heap-based Buffer Overflow

A vulnerability has been found in Ettercap up to 0.8.3. The affected element is the function FUNCDECODER of the file src/dissectors/ecgg.c of the component GG Dissector. The manipulation of the argument gg leads to heap-based buffer overflow. The attack is possible to be carried out remotely. The...

CVE-2026-9372: Server-Side Request Forgery (SSRF)

A flaw has been found in ItzCrazyKns Vane up to 1.12.1. This vulnerability affects unknown code of the file src/app/api/providers/route.ts of the component Model Provider API. This manipulation of the argument baseURL causes server-side request forgery. Remote exploitation of the attack is...

Laravel-Lang PHP Packages Compromised to Deliver Cross-Platform Credential Stealer

Cybersecurity researchers have flagged a fresh software supply chain attack campaign that has targeted multiple PHP packages belonging to Laravel-Lang to deliver a comprehensive credential-stealing framework. The affected packages include - laravel-lang/lang laravel-lang/http-statuses...

Mantis Bug Tracker 安全特征问题漏洞

Mantis Bug Tracker MantisBT is an open-source bug tracker developed by Mantis Bug Tracker. Versions of Mantis Bug Tracker prior to 2.28.1 contained a security vulnerability related to the script-src directive, which allowed bypassing content security policies by uploading specially crafted...

CVE-2026-32253: Improper Authentication

Sunshine is a self-hosted game stream host for Moonlight. In versions prior to 2026.516.143833, the client-certificate authentication can be bypassed because of how OpenSSL verification results are handled. In src/crypto.cpp, the custom verify callback treats X509VERRUNABLETOGETISSUERCERTLOCALLY,...

GHSA-CRHJ-59GH-8X96 vulnerabilities

Vulnerabilities for packages: kaniko, kargo, kots, snyk-cli, bom, argo-cd, gomplate, melange, syft, gitaly, crossplane, terragrunt, k9s, zot, external-secrets-operator, argo-workflows, osv-scanner, dagger, goreleaser, grype, gitlab-runner, xeol, nfpm, pulumi-language-dotnet, tfsec, scorecard,...

GHSA-M7CR-M3PV-HGRP vulnerabilities

Vulnerabilities for packages: kaniko, kargo, kots, snyk-cli, bom, argo-cd, gomplate, melange, syft, gitaly, crossplane, terragrunt, k9s, zot, external-secrets-operator, argo-workflows, osv-scanner, dagger, goreleaser, grype, gitlab-runner, xeol, nfpm, pulumi-language-dotnet, tfsec, scorecard,...

CVE-2026-45571 vulnerabilities

Vulnerabilities for packages: kaniko, kargo, kots, snyk-cli, bom, argo-cd, gomplate, melange, syft, gitaly, crossplane, terragrunt, k9s, zot, external-secrets-operator, argo-workflows, osv-scanner, dagger, goreleaser, grype, gitlab-runner, xeol, nfpm, pulumi-language-dotnet, tfsec, scorecard,...

CVE-2026-45570 vulnerabilities

Vulnerabilities for packages: kaniko, kargo, kots, snyk-cli, bom, argo-cd, gomplate, melange, syft, gitaly, crossplane, terragrunt, k9s, zot, external-secrets-operator, argo-workflows, osv-scanner, dagger, goreleaser, grype, gitlab-runner, xeol, nfpm, pulumi-language-dotnet, tfsec, scorecard,...

GHSA-M7CR-M3PV-HGRP vulnerabilities

Vulnerabilities for packages: tfsec, crossplane-fips, rancher-fleet, skaffold, trufflehog, gitaly, nuclei, argo-events, pulumi-language-java, gitlab-runner-fips, grype-fips, kargo, kaniko, pulumi-language-dotnet, trivy-operator, gptscript, gomplate, grype, gitaly-fips, osv-scanner, guac, steampip...