CVE-2026-47167 Vim: Vimscript Code Injection in cucumber filetype plugin via crafted step-definition regex

Vim is an open source, command line text editor. Prior to version 9.2.0496, a code injection vulnerability exists in s:stepmatch in the cucumber filetype plugin runtime/ftplugin/cucumber.vim on Vim builds with +ruby support. Step-definition patterns read from .rb files under the repository's...

CVE-2026-47167 Vim: Vimscript Code Injection in cucumber filetype plugin via crafted step-definition regex

Vim is an open source, command line text editor. Prior to version 9.2.0496, a code injection vulnerability exists in s:stepmatch in the cucumber filetype plugin runtime/ftplugin/cucumber.vim on Vim builds with +ruby support. Step-definition patterns read from .rb files under the repository's...

Missing Cryptographic Step

Overview Affected versions of this package are vulnerable to Missing Cryptographic Step in EVPPKEYderivesetpeer when called with a DHX X9.42 peer key. A malicious peer can recover the victim's private key. A peer presenting an X9.42 key that carries the victim's p and g, and a forged q passes all...

CVE-2026-10731 SQL injection in Nemon products

SQL injection in the ‘twostepsauthcode’ parameter processed by the ‘twoStepsAuthVerification’ function within the ‘/user-login’ endpoint. The two-factor authentication 2FA functionality can be accessed without prior authentication, allowing unauthenticated attackers to execute arbitrary SQL queri...

CVE-2026-49755

Improper Handling of Highly Compressed Data Data Amplification vulnerability in wojtekmach Req allows attacker-controlled HTTP servers to exhaust memory in a Req client via decompression-bomb response bodies. Req's default response pipeline includes Req.Steps.decodebody/1 and...

CVE-2025-27852

The locally served web site on the Garmin WDU v1 1.4.6 and v2 5.0 allows a reflected cross site scripting XSS attack. This allows an attacker on the local network segment to execute arbitrary JavaScript code within the context of the WDU webpage. Full administrator level access to the device is...

CVE-2026-42481

Open CASCADE Technology OCCT V800rc5 contains multiple vulnerabilities in its IGES and STEP file parsers that can be triggered by crafted IGES or STEP files. These issues include an out-of-bounds read in Geom2dBSplineCurve::EvalD0 during IGES B-spline curve evaluation, an out-of-bounds read in...

CVE-2026-23756

GFI HelpDesk before 4.99.9 contains a stored cross-site scripting vulnerability in the Troubleshooter module where the subject POST parameter is not sanitized in ControllerStep.InsertSubmit and EditSubmit before being rendered by ViewStep.RenderViewSteps. An authenticated staff member can inject...

CVE-2026-41679

Paperclip is a Node.js server and React UI that orchestrates a team of AI agents to run a business. Prior to version 2026.416.0, an unauthenticated attacker can achieve full remote code execution on any network-accessible Paperclip instance running in authenticated mode with default configuration...

CVE-2026-44648

SillyTavern is a locally installed user interface that allows users to interact with text generation large language models, image generation engines, and text-to-speech voice models. Prior to 1.18.0, SillyTavern relies on cookie-session for authentication, storing all session data user handle,...

Atlassian Jira Service Management Data Center and Server 5.15.2 < 10.3.20 / 10.4.x < 11.3.5 (JSDSERVER-16574)

The version of Atlassian Jira Service Management Data Center and Server Jira Service Desk running on the remote host is affected by a vulnerability as referenced in the JSDSERVER-16574 advisory. - The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior...

Missing Cryptographic Step

Overview Affected versions of this package are vulnerable to Missing Cryptographic Step due to the lack of enforcement for receiving a cryptographically-signed final chunk before the termination of the outer HTTP body. An attacker can cause undetected truncation of chunked messages by forwarding...

PT-2026-49153

Publisher note Fixed in v1.7.17. Operators running v1.7.17 should upgrade. The decompression-error path in MultiDataInterceptor.ProcessReceivedMessage now releases the global throttler slot before returning guarded defer after StartProcessing, disabled when the asynchronous goroutine takes...

GHSA-49RJ-9FVP-4H2H React Router's vendored turbo-stream v2 allows arbitrary constructor invocation via TYPE_ERROR deserialization leading to Unauth RCE

When using React Router v7 in Framework Mode, there exists a combination of steps that could potentially allow unauthorized RCE through external requests. This first requires the application code to have an existing prototype pollution vulnerability. This can be leveraged into a 2-step attack in...

CVE-2026-25681 vulnerabilities

Vulnerabilities for packages: helm, terraform-provider-acme, kine, cilium, step, karpenter, step-issuer, kubernetes-dashboard, nerdctl, opentelemetry-collector, hydra, minio, kubernetes, kyverno, k3s, grafana-pyroscope, crossplane-provider-aws-elasticache, telegraf, prometheus-operator, vale,...

CVE-2026-25680 vulnerabilities

Vulnerabilities for packages: helm, terraform-provider-acme, kine, cilium, step, karpenter, step-issuer, kubernetes-dashboard, nerdctl, opentelemetry-collector, hydra, minio, kubernetes, kyverno, k3s, grafana-pyroscope, crossplane-provider-aws-elasticache, telegraf, prometheus-operator, vale,...

CVE-2026-42506 vulnerabilities

Vulnerabilities for packages: helm, terraform-provider-acme, kine, cilium, step, karpenter, step-issuer, kubernetes-dashboard, nerdctl, opentelemetry-collector, hydra, minio, kubernetes, kyverno, k3s, grafana-pyroscope, crossplane-provider-aws-elasticache, telegraf, prometheus-operator, vale,...

GHSA-M9X8-M34X-FJ9Q vulnerabilities

Vulnerabilities for packages: helm, terraform-provider-acme, kine, cilium, step, karpenter, step-issuer, kubernetes-dashboard, nerdctl, opentelemetry-collector, hydra, minio, kubernetes, kyverno, k3s, grafana-pyroscope, crossplane-provider-aws-elasticache, telegraf, prometheus-operator, vale,...

CVE-2026-27136 vulnerabilities

Vulnerabilities for packages: helm, terraform-provider-acme, kine, cilium, step, karpenter, step-issuer, kubernetes-dashboard, nerdctl, opentelemetry-collector, hydra, minio, kubernetes, kyverno, k3s, grafana-pyroscope, crossplane-provider-aws-elasticache, telegraf, prometheus-operator, vale,...

GHSA-WRH2-89VG-4J9G vulnerabilities

Vulnerabilities for packages: helm, terraform-provider-acme, kine, cilium, step, karpenter, step-issuer, kubernetes-dashboard, nerdctl, opentelemetry-collector, hydra, minio, kubernetes, kyverno, k3s, grafana-pyroscope, crossplane-provider-aws-elasticache, telegraf, prometheus-operator, vale,...