GHSA-PQ6C-VH67-XPM3 n8n: Log Streaming Event Destinations Decrypt Generic-Auth Credentials Without Ownership Check

Impact A log streaming event destination may reference a generic HTTP credential, and the destination resolved and decrypted whichever credential it named without checking that the caller had access to it. A user holding a custom global role scoped to Log Streaming operations could therefore name...

CVE-2026-68527

Concrete CMS versions 8.3.0 through 9.5.2 are vulnerable to an authorization bypass in the Calendar event edit dialog concrete/controllers/dialog/event/edit.php. The dialog checked permissions against the calendar identifier supplied in the request rather than the calendar owning the targeted eve...

UBUNTU-CVE-2026-88035

A size check in the client-side authentication path of the MongoDB C Driver can wrap around, so an unusually large user-name value is accepted and copied past the end of a small buffer. A party able to set the driver's connection settings may cause the application that embeds the driver to...

CVE-2026-88035

A size check in the client-side authentication path of the MongoDB C Driver can wrap around, so an unusually large user-name value is accepted and copied past the end of a small buffer. A party able to set the driver's connection settings may cause the application that embeds the driver to...

CVE-2026-88056 Angular: SSRF and Cross-Origin Credential Disclosure via URL Resolution Discrepancy in SSR

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.30, 21.2.22, and 22.1.4, Angular Server-Side Rendering in @angular/platform-server processes user-controlled resource or request URLs through HttpClien...

EUVD-2026-75673

Concrete CMS versions 8.3.0 through 9.5.2 are vulnerable to an authorization bypass in the Calendar event edit dialog concrete/controllers/dialog/event/edit.php. The dialog checked permissions against the calendar identifier supplied in the request rather than the calendar owning the targeted eve...

CVE-2026-88035 Heap buffer overflow via wrapped size check during SASL username canonicalization in MongoDB C Driver

A size check in the client-side authentication path of the MongoDB C Driver can wrap around, so an unusually large user-name value is accepted and copied past the end of a small buffer. A party able to set the driver's connection settings may cause the application that embeds the driver to...

CVE-2026-88035 Heap buffer overflow via wrapped size check during SASL username canonicalization in MongoDB C Driver

A size check in the client-side authentication path of the MongoDB C Driver can wrap around, so an unusually large user-name value is accepted and copied past the end of a small buffer. A party able to set the driver's connection settings may cause the application that embeds the driver to...

CVE-2026-88035

CVE-2026-88035 is a heap buffer overflow in the MongoDB C Driver 's client-side authentication path, triggered during SASL username canonicalization . A size-check integer wrap-around allows an unusually large username to be copied past the end of a small buffer, causing the embedding application...

Heap buffer overflow via wrapped size check during SASL username canonicalization in MongoDB C Driver

A size check in the client-side authentication path of the MongoDB C Driver can wrap around, so an unusually large user-name value is accepted and copied past the end of a small buffer. A party able to set the driver's connection settings may cause the application that embeds the driver to...

CVE-2026-88044

rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.70.0 until 1.75.1, the serve/start RC interface accepts per-server proxyOpt.AuthProxy settings, and the FTP and S3 constructors in cmd/serve/ftp/ftp.go and cmd/serve/s3/server.go...

Directory Traversal

Overview icecoder/icecoder is a Browser based code editor allowing you to code from anywhere. Affected versions of this package are vulnerable to Directory Traversal via the File::check function. An attacker can access, modify, or delete files outside the intended directory by submitting traversa...

CVE-2026-81049

Dell ThinOS 10, versions prior to 260510.2616, contain a Missing Support for Integrity Check vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to arbitrary code execution...

CVE-2026-81052

Dell ThinOS 10, versions prior to 260510.2616, contain a Download of Code Without Integrity Check vulnerability. An unauthenticated attacker with physical access could potentially exploit this vulnerability, leading to arbitrary code execution...

CVE-2026-87912 Missing S3 bucket ownership verification in the AWS Security Agent plugin for aws-agents-for-devsecops

A missing S3 bucket ownership verification in the AWS Security Agent plugin in Amazon aws-agents-for-devsecops before 1.1.0 might allow remote attackers to obtain the private source archive of a scanned workspace, including credentials and infrastructure state contained in that archive, via a...

EUVD-2026-75566

Dell ThinOS 10, versions prior to 260510.2616, contain a Missing Support for Integrity Check vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to arbitrary code execution...

CVE-2026-81049

Dell ThinOS 10 , in versions prior to 2605_10.2616 , is affected by a Missing Support for Integrity Check vulnerability. A high-privileged attacker with local access can potentially exploit this flaw to achieve arbitrary code execution . The CVSS 3.1 score is 4.4 (MEDIUM) , with the primary impac...

CVE-2026-81049

Dell ThinOS 10, versions prior to 260510.2616, contain a Missing Support for Integrity Check vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to arbitrary code execution...

CVE-2026-81049

Dell ThinOS 10, versions prior to 260510.2616, contain a Missing Support for Integrity Check vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to arbitrary code execution...

CVE-2026-81052

Dell ThinOS 10, versions prior to 260510.2616, contain a Download of Code Without Integrity Check vulnerability. An unauthenticated attacker with physical access could potentially exploit this vulnerability, leading to arbitrary code execution...