CVE-2026-48535

GFI Archiver before 15.13 contains a stored cross-site scripting vulnerability in the Call Home proxy server configuration that allows authenticated attackers to inject arbitrary web script or HTML via the proxy server address parameter to /Archiver/CallHomeSettingsWizard.aspx. The injected paylo...

CVE-2026-48535

GFI Archiver Additional Settings page. Exploitation requires authenticated access; CVSS 4.0/3.1 base scores are 5.1 (medium) and 5.4 (medium) respectively. Remediation: upgrade to version 15.13 or later. If upgrading is not possible, apply the documented workaround as per vendor guidance.

EUVD-2026-48294

GFI Archiver before 15.13 contains a stored cross-site scripting vulnerability in the Call Home proxy server configuration that allows authenticated attackers to inject arbitrary web script or HTML via the proxy server address parameter to /Archiver/CallHomeSettingsWizard.aspx. The injected paylo...

CVE-2026-16624

CVE-2026-16624 affects Cal.com OSS, where there is an authorization bypass on webhook creation via unvalidated teamId injection. Any authenticated user can create a webhook on any team and potentially exfiltrate booking data (e.g., organizer/attendee emails and custom responses) and, in some case...

EUVD-2026-47769

Cal.com OSS ships lacks authorization on webhook teamId creation, allowing any authenticated user to create a webhook on any team via unvalidated teamId injection, then steal booking data, including fields like organizer/attendee emails and custom responses, and conditionally video-call passwords...

CVE-2026-16624 CVE-2026-16624

Cal.com OSS ships lacks authorization on webhook teamId creation, allowing any authenticated user to create a webhook on any team via unvalidated teamId injection, then steal booking data, including fields like organizer/attendee emails and custom responses, and conditionally video-call passwords...

CVE-2026-16624 CVE-2026-16624

Cal.com OSS ships lacks authorization on webhook teamId creation, allowing any authenticated user to create a webhook on any team via unvalidated teamId injection, then steal booking data, including fields like organizer/attendee emails and custom responses, and conditionally video-call passwords...

CVE-2026-65013 Onlook tRPC Insecure Direct Object Reference via multiple procedures

Onlook through 0.2.32, fixed in commit 423e2e9, contains a broken object level authorization vulnerability that allows authenticated attackers to access and manipulate other users' resources by supplying arbitrary UUID values to tRPC API procedures including project.get, member.remove, and...

EUVD-2026-47636

n8n before 1.123.64, 2.29.8, and 2.30.1 contains a stored DOM cross-site scripting vulnerability in the Resource Locator component, which passes the workflow-persisted cachedResultUrl parameter to window.open without scheme validation. An attacker with workflow creation/editing privileges can cra...

EUVD-2026-47451

Vulnerability in the Oracle Call Center Technology product of Oracle E-Business Suite component: RDBMS and UI. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Call Center...

CVE-2026-61264

Vulnerability in the Oracle Call Center Technology product of Oracle E-Business Suite component: RDBMS and UI. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Call Center...

EUVD-2026-46444

The NXP LPUART serial driver drivers/serial/uartmcuxlpuart.c, when CONFIGUARTUSERUNTIMECONFIGURE is enabled, called LPUARTDeinit at the start of mcuxlpuartconfigure, which disables the LPUART peripheral clocks. The requested configuration is validated only afterwards in mcuxlpuartconfigurebasic,...

CVE-2026-64026

A flaw was found in the Linux kernel's rxrpc component. This vulnerability can lead to pagecache corruption when data packets are decrypted in-place after being transmitted locally via the splice system call. This issue stems from improper handling of packet sharing within the I/O thread,...

CVE-2026-47396 PraisonAI call server exposes unauthenticated agent listing, invocation, and deletion when CALL_SERVER_TOKEN is unset

PraisonAI is a multi-agent teams system. Prior to version 4.6.40, PraisonAI's call server exposes a network-facing agent control API without authentication when CALLSERVERTOKEN is not configured. The affected component is the praisonai.api.agentinvoke router as mounted by praisonai.api.call. The...

CVE-2026-47396 PraisonAI call server exposes unauthenticated agent listing, invocation, and deletion when CALL_SERVER_TOKEN is unset

PraisonAI is a multi-agent teams system. Prior to version 4.6.40, PraisonAI's call server exposes a network-facing agent control API without authentication when CALLSERVERTOKEN is not configured. The affected component is the praisonai.api.agentinvoke router as mounted by praisonai.api.call. The...

CVE-2026-47396

Plausible vulnerability CVE-2026-47396 affects PraisonAI’s call server. Before version 4.6.40, the network-facing API under praisonai.api.agent_invoke (mounted by praisonai.api.call) authenticates fail-open when CALL_SERVER_TOKEN is not configured, exposing unauthenticated access on 0.0.0.0. Endp...

CVE-2026-64101

A flaw was found in the Linux kernel's fwctl component. Insufficient validation of the Remote Procedure Call RPC input buffer size in the pdsfcfwrpc function can lead to an out-of-bounds read. A local attacker could exploit this vulnerability by providing a specially crafted RPC input, potentiall...

Axios form serializer maxDepth bypass via {} metatoken

Summary Axios versions in the fixed lines for GHSA-62hf-57xw-28j9 still contain an incomplete depth-limit bypass in lib/helpers/toFormData.js. When serializing an object with a top-level key ending in , axios calls JSON.stringify on that value before the formSerializer.maxDepth guard can inspect...

GHSA-PMV8-RQ9R-6J72 Axios: Deep formToJSON Key Recursion Can Cause Denial of Service

Summary Axios versions starting with 0.28.0 contain uncontrolled recursion in formDataToJSON, which is exposed as axios.formToJSON and used internally when axios serialises FormData with Content-Type: application/json. If an application passes attacker-controlled FormData field names to this...

CVE-2026-35590 Possible out-of-bounds read leading to crash when decoding well-crafted EXIF metadata

libvips is a fast image processing library with low memory needs. The EXIF decoder within libvips versions before and including 8.18.1 was not verifying the range of EXIF tag groups before passing data to libexif, leading to a possible null pointer dereference and crash. This has been patched in...