CVE-2026-18686

A vulnerability was detected in GL.iNet GL-MT3000 up to 4.4.5. The affected element is the function nas-web.adduser of the file /cgi-bin/glc of the component nas-web RPC Wrapper. Performing a manipulation results in command injection. The attack can be initiated remotely. The exploit is now publi...

CVE-2026-46714

Misskey web client (versions 8.63.0 and later prior to 2026.5.4) is vulnerable to a DoS caused by a malformed theme triggering uncontrolled recursion during theme compilation, which can slow or crash the client. The issue is fixed in version 2026.5.4. Remediation is to upgrade to 2026.5.4 or late...

CVE-2026-18682

OpenAkita up to version 1.27.12 is affected by a cross-site scripting (XSS) vulnerability in the File Upload API (/api/upload). The issue arises from manipulated input in the File argument, with remote exploitation possible. The vulnerability has a high attack complexity, with exploit maturity de...

EUVD-2026-52451

Misskey is an open source, federated social media platform. Versions 2025.3.2 and later, but prior to 2026.5.4, contain a vulnerability where a lack of proper permission checks allows access to certain data points from the Direct Messages formerly Chat feature, regardless of account permissions...

EUVD-2026-52449

Misskey is an open source, federated social media platform. All Misskey servers running versions 2024.5.0 and later, but prior to 2026.5.4, contain a vulnerability in the Server Announcements API where insufficient permission checks allow attackers to access limited portions of data that they...

CVE-2026-48115

CVE-2026-48115 affects Misskey servers running versions 2024.5.0 and later, up to but not including 2026.5.4, where the Server Announcements API lacks sufficient permission checks, allowing attackers to access data they normally shouldn’t view. The issue exists regardless of federation being enab...

EUVD-2026-52423

Apache NiFi 1.5.0 through 2.10.0 support gzip-encoded HTTP requests for the application REST API using a Jersey encoding filter. The framework enforced a configurable maximum request size on the compressed payload rather than the decompressed output, allowing a malicious client to send crafted...

CVE-2026-68981 Apache NiFi: Uncontrolled Resource Consumption through Decompression of HTTP Requests

Apache NiFi 1.5.0 through 2.10.0 support gzip-encoded HTTP requests for the application REST API using a Jersey encoding filter. The framework enforced a configurable maximum request size on the compressed payload rather than the decompressed output, allowing a malicious client to send crafted...

EUVD-2026-52420

Authorization handling for Parameter Context validation requests in Apache NiFi 1.10.0 through 2.10.0 allows clients with read access to submit proposed Parameter values. The proposed values override current configuration, enabling users with read access to invoke predefined component validation...

EUVD-2026-50567

undici vulnerable to cross-user information disclosure via whitespace around equals in Cache-Control directives...

EUVD-2026-50566

undici vulnerable to downstream response desynchronization via retry interceptor...

Socket.IO: Zero-attachment Memory Exhaustion

Impact A specially crafted Socket.IO packet can make the server wait for a large number of binary attachments and buffer them, which can be exploited to make the server run out of memory. Patches | Version range | Used by | Fixed version |...

CVE-2026-69185 Socket.IO: Zero-attachment Memory Exhaustion

Socket.IO enables bidirectional and low-latency communication for every platform. Prior to 4.2.7, 3.4.5, and 3.3.6, a specially crafted Socket.IO packet can make the server wait for a large number of binary attachments and buffer them, which can be exploited to make the server run out of memory...

CVE-2026-66296

The CVE-2026-66296 issue concerns oaskit: a reflected XSS vulnerability in the default HTML error handler. The root cause is that Oaskit.ErrorHandler.Default.format_reason/4 and Oaskit.ErrorHandler.Default.reason_to_html/1 render request-validation failures as HTML when the Accept header includes...

EUVD-2026-52398

Dell Display and Peripheral Manager DDPM Mac, versions prior to 2.3.0.1005, contain an Improper Access Control vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of privileges and arbitrary code execution...

CVE-2026-69152

The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.18, 2.1.4, 3.0.6, and 5.0.9, expand does not apply maxLength while constructing comma-alternative intermediate arrays or padded sequences, allowing attacker-controlled input to exhaust memo...

CVE-2026-69152

Brace-expansion library vulnerability CVE-2026-69152: expand() mishandles maxLength for intermediate arrays and padded sequences, enabling memory exhaustion or event-loop stalls via attacker-controlled input. Affected versions: <1.1.18, <2.1.4, <3.0.6,

CVE-2026-69151 Angular i18n: Cross-Site Scripting (XSS) via event-handler attributes

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.27, 21.2.19, and 22.0.1, the Angular compiler i18n pipeline permits i18n-onerror and other i18n-on event-handler attributes, allowing a lower-trust...

CVE-2026-69149

CVE-2026-69149 affects Angular SSR: a Cross-Site Scripting (XSS) vulnerability in the DOM emulation dependency (domino) used by @angular/platform-server when serializing fallback raw-content elements (, , , ). The issue exists prior to versions 20.3.27, 21.2.19, and 22.0.7 and is fixed in those r...

CVE-2026-68945

CVE-2026-68945 affects Angular’s HttpTransferCache in HttpClient. Before 20.3.27, 21.2.19, and 22.0.2, comma-joining repeated request parameters caused semantically distinct requests to share a transfer-cache key, leading to reuse of a wrong backend response and potential state poisoning. The iss...