EUVD-2026-54608

Consul Community Edition and Consul Enterprise 1.2.0 through 2.0.2 are vulnerable to an uncontrolled resource consumption issue in the Connect CA roots endpoint that may allow a remote caller to grow the agent's Connect CA roots cache without bound, defeating the operator's cache-disable...

CVE-2026-19014 Uncontrolled resource consumption in the Consul Connect authorization endpoint

Consul Community Edition and Consul Enterprise 1.17.0 through 2.0.2 are vulnerable to an uncontrolled resource consumption issue in the Connect authorization endpoint that may allow a caller to grow the agent's intention-match cache without bound, defeating the operator's cache-disable...

CVE-2026-19012 Authenticated denial of service in Consul Enterprise-to-Community Edition downgrade path

Consul Community Edition and Consul Enterprise 1.18.0 through 2.0.2 are vulnerable to an authenticated denial of service in the Enterprise-to-Community Edition downgrade path that may allow an authorized caller to crash the Consul server. A caller with config-entry write permission can submit a...

CVE-2026-19012 Authenticated denial of service in Consul Enterprise-to-Community Edition downgrade path

Consul Community Edition and Consul Enterprise 1.18.0 through 2.0.2 are vulnerable to an authenticated denial of service in the Enterprise-to-Community Edition downgrade path that may allow an authorized caller to crash the Consul server. A caller with config-entry write permission can submit a...

EUVD-2026-54605

Consul Community Edition and Consul Enterprise 1.19.1 through 2.0.2 did not enforce the session:write ACL permission for session deletion operations submitted through the transaction API. An authenticated caller with network access to the Consul server RPC port could delete arbitrary sessions...

CVE-2026-19016

Consul Community Edition and Consul Enterprise 1.19.1 through 2.0.2 did not enforce the session:write ACL permission for session deletion operations submitted through the transaction API. An authenticated caller with network access to the Consul server RPC port could delete arbitrary sessions...

CVE-2026-20124

A vulnerability in the Simple Network Management Protocol SNMP subsystem of Cisco IOS XE Software could allow an authenticated, remote attacker to cause an affected device to reload, resulting in a denial of service DoS condition. This vulnerability is due to improper error handling when parsing...

CVE-2026-71234

Documize Community's attachment download route domain/attachment/endpoint.go, Download function, registered via AddPublic with no auth middleware accepts a query parameter and grants access whenever the parameter is simply non-empty lensecureToken 0, without comparing it to any server-stored valu...

CVE-2026-71234

Documize Community's attachment download route domain/attachment/endpoint.go, Download function, registered via AddPublic with no auth middleware accepts a secure query parameter and grants access whenever the parameter is simply non-empty lensecureToken 0, without comparing it to any server-stor...

CVE-2026-71234 Documize Community - Attachment Download Authorization Bypass via Non-Validated secure Token

Documize Community's attachment download route domain/attachment/endpoint.go, Download function, registered via AddPublic with no auth middleware accepts a query parameter and grants access whenever the parameter is simply non-empty lensecureToken 0, without comparing it to any server-stored valu...

CVE-2026-71234

Documize Community exposes an authentication bypass in the attachment download endpoint: the Download function accepts a non-empty secure query parameter and grants access without validating against a server-stored value. This is inconsistent with sibling handlers (togglePublish, delete) which en...

ROOT-APP-NPM-CVE-2026-27795 CVE-2026-27795 in @langchain/community - Patched by Root

Root has patched CVE-2026-27795 in the @langchain/community package for Root:npm. Multiple fixed versions available...

CLSA-2026-1777941835 TuxCare security update for @react-native-community (1 CVE)

TuxCare rebuilt 11 @react-native-community packages to address 1 CVE. Fixed in 11.4.1-tuxcare.1...

CLSA-2026-1778114659 TuxCare security update for @react-native-community (1 CVE)

TuxCare rebuilt 11 @react-native-community packages to address 1 CVE. Fixed in 12.3.7-tuxcare.1...

CLSA-2026-1778114660 TuxCare security update for @react-native-community (1 CVE)

TuxCare rebuilt 11 @react-native-community packages to address 1 CVE. Fixed in 13.6.9-tuxcare.1...

CLSA-2026-1778114661 TuxCare security update for @react-native-community (1 CVE)

TuxCare rebuilt 13 @react-native-community packages to address 1 CVE. Fixed in 15.1.3-tuxcare.1...

CVE-2026-3093 vulnerabilities

Vulnerabilities for packages: gitlab-cng-fips, gitlab-workhorse-ce-fips, gitlab-cng, gitlab-rails-ce-fips, gitlab-rails-ce, gitlab-workhorse-ce, gitlab-runner-fips, gitlab-runner...

CVE-2026-14351 vulnerabilities

Vulnerabilities for packages: gitlab-cng-fips, gitlab-workhorse-ce-fips, gitlab-cng, gitlab-rails-ce-fips, gitlab-rails-ce, gitlab-workhorse-ce, gitlab-runner-fips, gitlab-runner...

CVE-2026-65875

BaserCMS provided by baserCMS Users Community contains a CSV file injection vulnerability. If a user downloads and opens a CSV file containing malicious code injected by an attacker, the malicious code may be executed...

CVE-2026-65875

BaserCMS provided by baserCMS Users Community contains a CSV file injection vulnerability. If a user downloads and opens a CSV file containing malicious code injected by an attacker, the malicious code may be executed...