Exploit for Missing Authentication for Critical Function in Coreweave Marimo

CVE-2026-39987 - marimo Terminal WebSocket Authentication Bypa...

CVE-2026-68579

FreeRDP before 3.30.0 = 3.29.0 contains a heap-based buffer overflow in the Windows clipboard client's CliprdrStreamRead function client/Windows/wfcliprdr.c. When an OLE paste consumer e.g. explorer.exe calls IStream::Read with a fixed-size buffer of cb bytes, CliprdrStreamRead requests file...

CVE-2026-67339

guzzlehttp/guzzle versions before 7.14.2 fail to properly isolate Proxy-Authorization headers from origin servers in cURL handlers. Attackers can capture proxy credentials through origin server access logs when requests are redirected, bypassed, or sent through SOCKS proxies that Guzzle...

CVE-2026-56850 affecting package nodejs for versions less than 24.18.1-1

CVE-2026-56850 affecting package nodejs for versions less than 24.18.1-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-45377

Decidim is a participatory democracy framework. Prior to 0.30.9, from 0.31.0 before 0.31.5, and in 0.32.0.rc1 before 0.32.0.rc2, the normal downloadyourdata flow requires the requester to be logged in as the export owner, but the resulting Active Storage blob redirect URL can be replayed without...

EUVD-2026-41139

Jodit has prototype pollution via Jodit.configure / ConfigMerge...

WordPress Backup and Staging by WP Time Capsule plugin < 1.21.16 - Authentication Bypass vulnerability

Authentication Bypass vulnerability discovered by WebARX Security in WordPress Plugin Backup and Staging by WP Time Capsule versions 1.21.16...

CVE-2026-17715

Inappropriate implementation in Passwords in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who convinced a user to engage in specific UI gestures to leak cross-origin data via a crafted HTML page. Chromium security severity: High...

EUVD-2026-50800

Inappropriate implementation in HTML in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to bypass content security policy via a crafted HTML page. Chromium security severity: High...

CVE-2026-11331 affecting package bind for versions less than 9.20.26-1

CVE-2026-11331 affecting package bind for versions less than 9.20.26-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-56852 affecting package moby-engine for versions less than 25.0.3-19

CVE-2026-56852 affecting package moby-engine for versions less than 25.0.3-19. A patched version of the package is available...

CVE-2026-56852 affecting package cf-cli for versions less than 8.7.11-8

CVE-2026-56852 affecting package cf-cli for versions less than 8.7.11-8. A patched version of the package is available...

CVE-2026-59919

Netty is an asynchronous, event-driven network application framework. In versions prior to 4.1.136.Final and 4.2.16.Final, Netty's HAProxy encoder HAProxyMessageEncoder writes AFUNIX source and destination socket addresses into the HAProxy V1 text protocol without validating them for CRLF...

EUVD-2026-50331

A Server-Side Template Injection SSTI vulnerability was identified in the mail template functionality of the Axway SecureTransport product in version 5.5-20260326. This flaw allows an attacker with admin privileges to inject arbitrary Java code expressions, which are executed server-side when the...

PT-2026-65877

Name of the Vulnerable Software and Affected Versions GitLab EE versions 19.1 through 19.1.2 GitLab EE versions 19.2 through 19.2.0 Description An issue exists where an authenticated user could access information from unauthorized projects. This occurs due to improper neutralization of untrusted...

CVE-2026-17528

Versions of the package nice-select2 before 2.4.1 are vulnerable to Cross-site Scripting XSS via the element. An attacker can supply a malicious payload that is rendered directly into the DOM without proper sanitization, causing arbitrary script execution in a victim’s browser when they view or...

CVE-2026-42016 Incorrect authorization validation of user token in JFrog Artifactory allows Privilege Escalation

JFrog Artifactory Self Hosted versions before 7.133.11 are vulnerable to a privilege escalation attack due to a validation check of the token signature/issuer and not the token’s scope...

CVE-2026-42016

JFrog Artifactory Self Hosted versions before 7.133.11 are vulnerable to a privilege escalation attack due to a validation check of the token signature/issuer and not the token’s scope...

CVE-2026-54890 BEAM VM crash via integer underflow in binary_to_term BIT_BINARY_EXT decoding

Integer Underflow Wrap or Wraparound vulnerability in erlang otp erlang/otp erts modules, erlang otp erts erts modules allows Forced Integer Overflow, Excessive Allocation. This vulnerability is associated with program files erts/emulator/beam/external.c, emulator/beam/external.c. The BITBINARYEX...

K000162429: PostgreSQL vulnerability CVE-2026-6479

Security Advisory Description Uncontrolled recursion in PostgreSQL SSL and GSS negotiation allows an attacker able to connect to a PostgreSQL AFUNIX socket to achieve sustained denial of service. If SSL and GSS are both disabled, an attacker can do the same via access to a PostgreSQL TCP socket...