CVE-2026-40345

deepmerge-ts

CVE-2026-40345 deepmerge-ts: Stack exhaustion when merging recursive object graphs

deepmerge-ts is a typescript library providing functionality to deep merging of javascript objects. Prior to 8.0.0, the deepmerge, deepmergeCustom, deepmergeInto, and deepmergeIntoCustom APIs do not track visited objects or object pairs when recursively merging records. When two input values...

Microsoft Partner Center Information Disclosure Vulnerability

Authorization bypass through user-controlled key in Microsoft Partner Center allows an unauthorized attacker to disclose information over a network...

CVE-2026-64971

ATutor's restore functionality allows reflected XSS: a crafted URL triggers arbitrary JavaScript execution in the victim's browser. Only version 2.2.4 is confirmed vulnerable, but the product is no longer actively supported and has no fix, so other versions may also be affected. CVSS 4.0 base sco...

WordPress TrueBooker plugin <= 1.2.6 - Unauthenticated Authorization Bypass Through User-Controlled Key to Account Takeover to 'truebooker_wp_user_id' Parameter vulnerability

Unauthenticated Authorization Bypass Through User-Controlled Key to Account Takeover to 'truebookerwpuserid' Parameter vulnerability discovered by Décio Brandão in WordPress Plugin TrueBooker versions = 1.2.6...

EUVD-2026-62958

In Splunk AI Toolkit versions below 6.0.0, a user who can upload models could overwrite a model being uploaded by another user by sending a concurrent upload request for the same model name, causing the resulting model lookup entry to reference attacker-controlled content. The race condition is...

PT-2026-79213

Name of the Vulnerable Software and Affected Versions Microsoft Partner Center affected versions not specified Description An authorization bypass exists due to a user-controlled key, which allows an unauthorized attacker to disclose information over a network. Recommendations At the moment, ther...

cve-2026-47851 - HIGH - Unbounded recursion over attacker-controlled PDF outline tree in Spring AI PDF Document Reader

cve-2026-47851 - HIGH - Unbounded recursion over attacker-controlled PDF outline tree in Spring AI PDF Document Reader...

CVE-2025-36398 DS8900F and DS8A00 Information Disclosure

IBM System Storage DS8A00 10.1.3.0 through 10.11.35.0 and IBM DS8900F 89.40.83.0 through 89.44.25.0 could allow an authenticated user to read or modify another user's command history due to an externally controlled filename...

Contentful MCP Server: export_space/import_space tools pass LLM-controlled `host`/`proxy` args to CMA client, redirecting server PAT to attacker-controlled endpoint

Summary exportspace and importspace tools in @contentful/mcp-tools accept LLM-controlled host and proxy parameters that are spread directly into the options object passed to contentful-export / contentful-import. These libraries pass the merged options — including the attacker-controlled host — t...

CVE-2026-49441 Wazuh : peer-controlled metadata key in process_files_from_worker non-merged branch allows arbitrary file write under WAZUH_PATH on Wazuh manager

Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4.3.0 until 4.14.6 and 5.0.0-beta3, the non-merged branch of processfilesfromworker in framework/wazuh/core/cluster/master.py trusts a peer-controlled filepath key from filesmetadata.json. The...

CVE-2026-76240

stigmem-node 0.9.0a1 interpolates Postgres backend schema identifiers into SQL strings without defensive quoting. In the affected code path the schema value is operator-controlled, but the unsafe pattern could allow SQL injection if a schema name were derived from tenant, request, or user input...

DEBIAN-CVE-2026-65609

nnn is vulnerable to Out-of-Bound write vulnerability. Due to lack of validation of attacker-controlled length fields deserialized from a session file, a crafted session file can cause nnn to write data beyond the bounds of fixed-size global buffers when loaded with the -s option. An attacker who...

EUVD-2026-62404

stigmem-node 0.9.0a1 interpolates Postgres backend schema identifiers into SQL strings without defensive quoting. In the affected code path the schema value is operator-controlled, but the unsafe pattern could allow SQL injection if a schema name were derived from tenant, request, or user input...

EUVD-2026-62398

nnn is vulnerable to Out-of-Bound write vulnerability. Due to lack of validation of attacker-controlled length fields deserialized from a session file, a crafted session file can cause nnn to write data beyond the bounds of fixed-size global buffers when loaded with the -s option. An attacker who...

BIT-KIBANA-2026-72680 Authorization Bypass Through User-Controlled Key in Kibana Agent Builder Leading to Unauthorized Data Modification

Kibana Agent Builder A2A JSON-RPC API endpoint derives the identifier of a stored conversation from a user-supplied input, and the ownership check on that identifier does not distinguish between a conversation that does not exist and one that exists but belongs to another user. As a result, an...

BIT-ELK-2026-72680 Authorization Bypass Through User-Controlled Key in Kibana Agent Builder Leading to Unauthorized Data Modification

Kibana Agent Builder A2A JSON-RPC API endpoint derives the identifier of a stored conversation from a user-supplied input, and the ownership check on that identifier does not distinguish between a conversation that does not exist and one that exists but belongs to another user. As a result, an...

PT-2026-78361

Name of the Vulnerable Software and Affected Versions nnn version 5.2 Description An Out-of-Bound write issue exists due to insufficient validation of attacker-controlled length fields during the deserialization of session files. When a crafted session file is loaded using the -s option, the...

PT-2026-78421

Name of the Vulnerable Software and Affected Versions stigmem-node version 0.9.0a1 Description The software interpolates Postgres backend schema identifiers into SQL strings without defensive quoting. While the schema value in the affected code path is operator-controlled, this pattern could allo...

DEBIAN-CVE-2026-63335

The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.31.0, inbound AMQP command assembly in src/main/java/com/rabbitmq/client/impl/CommandAssembler.java processes a content-bearing method and header whose...