PT-2026-133684

Frappe Learning Management System LMS is a learning system that helps users structure their content. Prior to version 2.52.0, an authenticated user with a course editing role can inject malicious JavaScript through meta tag fields in the Course Management module. The values are stored without...

PT-2026-133674

croc is a tool that allows any two computers to simply and securely transfer files and folders. Prior to 11.5.2, the receive-side file-readiness loop in src/croc/croc.go treats any sender-controlled basename beginning with croc-stdin- as a trusted text-transfer artifact even when SendingText is...

PT-2026-133718

Frappe Learning Management System LMS is a learning system that helps users structure their content. Prior to version 2.54.0, quiz submission records are not adequately authorized on the server. Through a REST bypass, an authenticated student can record a passing or perfect quiz result without...

PT-2026-133695

The FV Flowplayer Video Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 7.5.55.7212 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...

CVE-2026-119053

lwIP 2.0.0 through 2.2.1 built with the SNMP agent contains an out-of-bounds read vulnerability in snmppbufstreamwriteto that bounds copies by pbuf-len instead of remaining bytes. Remote unauthenticated attackers knowing the read community can send fragmented SNMP requests to receive adjacent...

UBUNTU-CVE-2026-118782

Forge also called node-forge is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, node-forge accepted a PKCS12 MAC or PKCS12 password-based encryption iteration count of zero or less. pki.pbe.generatePkcs12Key then returned a constant key independent of the passwo...

CVE-2026-118475

A flaw was found in Eye of GNOME. When parsing a specially crafted PNG image containing malformed color profile metadata, the application fails to validate chunk boundaries while searching for a null terminator. An attacker could trick a user into opening a malicious image, causing the applicatio...

CVE-2026-119196

pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.5, constructed BIT STRING decoding repeatedly shifts and copies the complete bit value accumulated from earlier fragments. Attacker-controlled BER or CER input contains many constructed BIT STRING fragments; schema-driven DER also accepts...

PT-2026-134196

Tesseract is an open source OCR engine. Prior to 5.5.4, ReadAdaptedClass in src/classify/adaptive.cpp raw-reads an ADAPT CLASS STRUCT from a pre-adapted-template .a file without neutralizing TempProtos and Config pointer fields before any destructor path. When the legacy engine is selected,...

SUSE SLES15 Security Update : perl-Cpanel-JSON-XS (SUSE-SU-2026:4926-1)

The remote SUSE Linux SLES15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4926-1 advisory. - CVE-2025-40929: integer overflow bsc1249331. - CVE-2026-9334: type confusion via duplicate object keys when dupkeysasarrayref is enabled...

PT-2026-133308

Improper Validation of Specified Quantity in Input vulnerability in the Elixir standard library's URI module allows an attacker who supplies a URL to cause a denial of service through CPU exhaustion. URI.parse/1 converts the port component with String.to integer/1 in split authority/1...

CVE-2026-118781

Forge also called node-forge is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used BigInteger.prototype.modInverse, bnModInverse, lib/jsbn.js, RSA public exponent e to process the relevant input or security decision. node-forge's...

CVE-2026-118782

Forge also called node-forge is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, node-forge accepted a PKCS12 MAC or PKCS12 password-based encryption iteration count of zero or less. pki.pbe.generatePkcs12Key then returned a constant key independent of the passwo...

UBUNTU-CVE-2026-118779

Forge also called node-forge is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used pem.decode, lib/pem.js, missing END line to process the relevant input or security decision. node-forge used polynomial-time regular expressions in...

UBUNTU-CVE-2026-118774

Forge also called node-forge is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used certificate.verifychild, verifySignature, lib/x509.js to process the relevant input or security decision. node-forge selected RSA padding and...

PT-2026-134183

RAGFlow is an open-source RAG Retrieval-Augmented Generation engine. From 0.25.2 until 0.27.3, POST /api/v1/agents/chat/completions invokes completion openai and returns through the openai-compatible branch before UserCanvasService.accessible checks whether the caller may access the requested...

PT-2026-134171

Name of the Vulnerable Software and Affected Versions PinePods versions prior to 0.9.0 Description An authenticated user can trigger server-side requests to internal loopback, private-network, and cloud metadata services. This occurs when the system processes an attacker-controlled RSS feed via t...

AdminNeo has Cookie Attribute Injection via Unsanitized X-Forwarded-Prefix in Set-Cookie Headers

AdminNeo versions 4.6.0 through at least 5.5.0 are vulnerable to cookie attribute injection via the X-Forwarded-Prefix HTTP header. An attacker who can influence this header e.g., through a reverse proxy that forwards it from clients, an attacker-controlled upstream proxy, or a man-in-the-middle...

AdminNeo Vulnerable to XSS via Rogue MySQL Server Version String (CSP Nonce Bypass)

AdminNeo inserts the database server's version string into a tag that carries a valid CSP nonce, without any sanitization. A rogue database server can return a crafted version string that breaks out of the JavaScript context and executes arbitrary code. Because the script tag already has a valid...

AdminNeo: RCE via SQLite VACUUM INTO (ATTACH Blocklist Bypass)

Adminer blocks ATTACH queries for SQLite to prevent arbitrary file creation. However, VACUUM INTO is not blocked and achieves the same result: writing a database file containing attacker-controlled PHP code to any path with any extension. An authenticated SQLite user can write a web shell to the...