EUVD-2026-63677

BigBlueButton is an open-source virtual classroom. Prior to 3.0.23, BigBlueButton allowed authenticated moderators to inject SQL through the meetingId and userId values used by refreshBreakoutRoomsVisibleForUsers in akka-bbb-apps/src/main/scala/org/bigbluebutton/core/db/BreakoutRoomUserDAO.scala...

CVE-2026-67448 Mailpit: WebSocket origin check bypass via percent-encoded path (regression of CVE-2026-22689)

Mailpit is an email testing tool and API for developers. From 1.29.0 until 1.30.6, Mailpit's server/server.go origin middleware checks the raw RequestURI for the /api/ prefix while Go's ServeMux routes using the percent-decoded URL path, and server/websockets/client.go configures...

CVE-2026-67448 Mailpit: WebSocket origin check bypass via percent-encoded path (regression of CVE-2026-22689)

Mailpit is an email testing tool and API for developers. From 1.29.0 until 1.30.6, Mailpit's server/server.go origin middleware checks the raw RequestURI for the /api/ prefix while Go's ServeMux routes using the percent-decoded URL path, and server/websockets/client.go configures...

CVE-2026-28134

Report di Sfruttamento della CVE-2026-28134 JetEngine = 3.7.2 — Esecuzione Remota di Codice autenticata Contributor+ tramite Twig SSTI Data: 11 marzo 2026 Punteggio CVSS: 8.8 Alto Vettore CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Plugin Interessato: JetEngine = 3.7.2 Plugin Slug:...

CVE-2026-69242

libvips is a fast image processing library with low memory needs. Prior to version 8.18.3, a crafted many-band TIFF processed through VipsForeignLoadTiff can evade scanline validation in libvips/iofuncs/image.c and cause an integer overflow in vipsimagesanity. The resulting buffer-region...

Open Redirect

Overview unstructured is an A library that prepares raw documents for downstream ML tasks. Affected versions of this package are vulnerable to Open Redirect via the url argument in the partition, partitionhtml, and partitionmd functions. An attacker can access internal network resources or...

CVE-2026-67447 Mailpit: SMTP DATA line reader buffers over-limit input before size enforcement

Mailpit is an email testing tool and API for developers. From 1.30.0 until 1.30.5, Mailpit's internal/smtpd/smtpd.go readData function calls bufio.Reader.ReadBytes before applying the lendata+lenline size check to the completed SMTP DATA line against Server.MaxSize. An unauthenticated SMTP client...

CVE-2026-39987

CVE-2026-39987 — RCE pre-autenticazione in Marimo CVE-2026-39987 è una vulnerabilità critica di Remote Code Execution RCE pre-autenticazione che colpisce Marimo, un ambiente notebook Python reattivo. La vulnerabilità risiede nell'endpoint WebSocket del terminale di Marimo: root@kitploit:...

EUVD-2026-63663

Mailpit is an email testing tool and API for developers. Prior to 1.30.4, Mailpit reads SMTP commands through internal/smtpd/smtpd.go session.readLine using bufio.Reader.ReadString before session.parseLine parses the verb or the RFC 5321 512-octet command-line limit is enforced. An unauthenticate...

CVE-2026-53804 OTRS Community Edition OS Command Injection via PGP Configuration

OTRS Community Edition contains an authenticated OS command injection vulnerability in the PGP encryption module that allows administrators to execute arbitrary operating-system commands by supplying crafted values for the PGP binary path and command options. Administrator-supplied configuration...

EUVD-2026-63661

Improper Neutralization of CRLF Sequences 'CRLF Injection' vulnerability in mtrudel bandit allows an unauthenticated remote attacker to smuggle CR, LF, or NUL characters into application-visible request headers via HTTP/2. Bandit.HTTP2.Stream.readheaders/1 validates pseudo-header placement and...

CVE-2026-67446 Mailpit: Thumbnail generation decodes unbounded image dimensions before scaling

Mailpit is an email testing tool and API for developers. Prior to 1.30.4, Mailpit decodes attacker-supplied image attachments into a full raster before checking decoded dimensions, pixel count, or memory use in the GET /api/v1/message/id/part/partID/thumb endpoint. The Thumbnail handler in...

CVE-2026-43798

A single crafted SSH message gives an unauthenticated network attacker an out-of-bounds stack write of attacker-controlled length and content against any application built on swift-nio-ssh. This vulnerability is addressed in swift-nio-ssh version 0.14.1...

CVE-2026-43798

CVE-2026-43798 is an out-of-bounds stack write vulnerability in swift-nio-ssh , Apple's SSH library for Swift. A single crafted SSH message allows an unauthenticated network attacker to write attacker-controlled data of attacker-controlled length to an out-of-bounds stack location in any applicat...

EUVD-2026-63651

libvips is a fast image processing library with low memory needs. Prior to version 8.18.3, a crafted many-band TIFF processed through VipsForeignLoadTiff can evade scanline validation in libvips/iofuncs/image.c and cause an integer overflow in vipsimagesanity. The resulting buffer-region...

CVE-2026-69242

libvips versions prior to 8.18.3 are affected by an integer overflow in vips_image_sanity within libvips/iofuncs/image.c. A crafted many-band TIFF processed through VipsForeignLoadTiff evades scanline validation, causing the overflow. The resulting buffer-region calculation can access attacker-co...

sadcloud

Sadcloud sadcloud is a tool for spinning up insecure AWS infrastructure with Terraform. It supports approx. 84 misconfigurations across 22 AWS Services. The inital set of misconfigurations were drawn from ScoutSuite, NCCGroup's Multi-cloud auditing tool. sadcloud was created to easily allow...

CVE-2026-61712 vulnerabilities

Vulnerabilities for packages: podman, kubescape, guac, conftest, scorecard, kaniko...

CVE-2026-64719

A flaw was found in WebKitGTK. Processing malicious web content can cause an out-of-bounds access issue due to improper bounds checking and result in an unexpected process crash. Mitigation Do not process or load untrusted web content with WebKitGTK. In Red Hat Enterprise Linux 7, the following...

CVE-2026-73040 Dockge Path Traversal via Unvalidated Stack Name Allows Arbitrary Compose and .env Disclosure and Arbitrary Directory Deletion

Dockge validates a stack name only on the write path. In backend/stack.ts the allow-list check in validate, which requires the name to match ^a-z0-9-+$, is reached from save alone, while the path getter returns path.jointhis.server.stacksDir, this.name and Stack.getStack builds...