CVE-2026-62959

A flaw was found in Coturn. When configured with ACME redirect and a plaintext-TCP listener, an unauthenticated remote client can send an HTTP GET request. This action can lead to the disclosure of up to approximately 870 bytes of adjacent process heap memory. On a busy server, this leaked memory...

CVE-2026-48120

A flaw was found in Kakoune, a code editor. A local attacker could exploit a vulnerability in the bundled autorestore.kak script by crafting malicious backup files. When a user simply opens a file, these malicious backup files can lead to the execution of arbitrary Kakoune and shell commands. Thi...

CVE-2026-11425

A flaw was found in Domoticz. An authenticated attacker can exploit a stored cross-site scripting XSS vulnerability in the mobile dashboard. This allows the attacker to inject malicious code by updating specific device values through the application's programming interface API. When an...

CVE-2026-48765

TypeBot is a chatbot builder tool. Versions prior to 3.17.0 allow a low-privilege read collaborator to extract a workspace OAuth credentialsId from a readable bot configuration and then overwrite that credential through handleUpdateOAuthCredentials by supplying an attacker-controlled writable...

EUVD-2026-56974

TypeBot is a chatbot builder tool. Versions prior to 3.17.0 allow a low-privilege read collaborator to extract a workspace OAuth credentialsId from a readable bot configuration and then overwrite that credential through handleUpdateOAuthCredentials by supplying an attacker-controlled writable...

CVE-2026-48765 TypeBot vulnerable to cross-workspace OAuth credential takeover in updateOAuthCredentials via missing object binding

TypeBot is a chatbot builder tool. Versions prior to 3.17.0 allow a low-privilege read collaborator to extract a workspace OAuth credentialsId from a readable bot configuration and then overwrite that credential through handleUpdateOAuthCredentials by supplying an attacker-controlled writable...

CVE-2026-48765

CVE-2026-48765 affects TypeBot (a chatbot builder tool). Versions prior to 3.17.0 allow a low-privilege read collaborator to extract a workspace OAuth credentialsId from a readable bot configuration and then overwrite that credential via handleUpdateOAuthCredentials using an attacker-controlled w...

CVE-2026-48765 TypeBot vulnerable to cross-workspace OAuth credential takeover in updateOAuthCredentials via missing object binding

TypeBot is a chatbot builder tool. Versions prior to 3.17.0 allow a low-privilege read collaborator to extract a workspace OAuth credentialsId from a readable bot configuration and then overwrite that credential through handleUpdateOAuthCredentials by supplying an attacker-controlled writable...

CVE-2026-48765 TypeBot vulnerable to cross-workspace OAuth credential takeover in updateOAuthCredentials via missing object binding

TypeBot is a chatbot builder tool. Versions prior to 3.17.0 allow a low-privilege read collaborator to extract a workspace OAuth credentialsId from a readable bot configuration and then overwrite that credential through handleUpdateOAuthCredentials by supplying an attacker-controlled writable...

CVE-2026-68093

A flaw was found in the Linux kernel's KVM Kernel-based Virtual Machine. When a virtual CPU vCPU is scheduled out and its physical CPU pCPU undergoes a hotplug cycle offline and then online, the vCPU might resume with an Address Space Identifier ASID that has been reassigned to another vCPU from ...

open-isns: open-iscsi: Denial of Service via double-free in iSNS attribute decoder

A flaw was found in open-iscsi. An unauthenticated man-in-the-middle MITM attacker can exploit a double-free vulnerability in the iSNS attribute decoder. This can lead to a denial of service DoS condition, making the affected system unavailable...

CVE-2026-65981

A flaw was found in Coturn, an open-source implementation of TURN and STUN servers. An authenticated attacker who obtains a victim's MOBILITY-TICKET can exploit this vulnerability during a session resume. This allows the attacker to take over the victim's TURN Traversal Using Relays around NAT...

GO-2026-5119 Nezha's authenticated agents can forge service-monitor results for other users' services in github.com/nezhahq/nezha

Nezha accepts service-monitor TaskResult messages from an authenticated agent based only on whether the reported service ID exists. The dashboard authenticates the agent and derives the reporter server ID from the gRPC stream, but the service-monitor result worker does not verify that the reporte...

GO-2026-5529 Unauthenticated restoreTenant mutation allows database overwrite and SSRF in github.com/dgraph-io/dgraph

The restoreTenant GraphQL mutation in Dgraph was missing from the admin mutation middleware configuration. This omission bypassed all authentication, IP whitelisting, and audit logging for this mutation. An unauthenticated remote attacker could use this mutation to trigger a database restore from...

GO-2026-5532 Authorization and Cookie headers forwarded to error page service in github.com/traefik/traefik

Traefik's errors middleware by default forwards all original request headers to the error page service. If the error page service is in a separate trust domain, this can lead to the disclosure of sensitive information such as Authorization or Cookie headers. The fix adds an errorRequestHeaders...

GO-2026-5466 Unauthenticated backend instantiation in github.com/rclone/rclone

The operations/fsinfo remote control RC endpoint in rclone was registered without requiring authentication. This allowed unauthenticated callers to instantiate arbitrary backends via inline backend definitions, which could lead to local command execution if the backend configuration allows it e.g...

CVE-2026-73243

kkFileView is a universal file online preview project based on Spring Boot. Prior to 5.0.1, the unauthenticated GET /addTask endpoint in kkFileView is omitted from TrustHostFilter and TrustDirFilter in server/src/main/java/cn/keking/config/WebConfig.java, allowing FileConvertQueueTask to fetch an...

CVE-2026-73244

kkFileView is a universal file online preview project based on Spring Boot. Prior to 5.0.1, the unauthenticated POST /listFiles endpoint in server/src/main/java/cn/keking/web/controller/FileController.java passes the user-controlled path parameter from FileControllergetFiles to...

CVE-2026-73241

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.30.0, FreeRDP server-side RDSTLS in libfreerdp/core/rdstls.c accepts an attacker-supplied RDSTLSTYPECAPABILITIES PDU while rdstlsserverauthenticate is waiting for RDSTLSTYPEAUTHREQ, leaving resultCode at RDSTLSRESULTSUCCE...

CVE-2026-73242

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.30.0, FreeRDP's winpr/libwinpr/sspi/Kerberos/kerberos.c kerberosDecryptMessage function fails to bound the peer-controlled GSS Wrap-token EC field before using it with RRC in IOV pointer offsets, allowing a malicious RDP...