November 06, 2026—KB5135582 (Monthly Rollup) Out-of-band

November 06, 2026—KB5135582 Monthly Rollup Out-of-band Applies To Windows Server 2012 R2 ESU Important This update is being released as an exception for devices that are past Year 3 of the Extended Security Updates ESU program. It is provided to deliver a quality improvement. Windows Server 2012 ...

GHSA-9HQ4-HM3J-JMPH DDEV incomplete tar symlink traversal fix allows host file overwrite - Incomplete fix of CVE-2026-32885

Summary The CVE-2026-32885 ZipSlip fix added a symlink-target escape check to Untar, but the check rebases an ABSOLUTE symlink target into dest before validating filepath.Joindest, "/etc" stays lexically inside dest and passes, while the symlink is then created with the RAW absolute target via...

CVE-2026-90586

The Zephyr RTOS Xtensa MMU userspace port fails to initialize the thread->arch.ptables pointer during thread setup. Because arch_mem_domain_thread_add() treats a non-NULL value in this field as a migration predicate, recycled kernel memory containing stale data triggers a migration branch. Thi...

CVE-2026-90586

The Xtensa MMU userspace port never initialized the per-thread page-table pointer thread-arch.ptables during thread setup, while archmemdomainthreadadd in arch/xtensa/core/ptables.c uses a non-NULL value of that field as its "this thread is migrating from another memory domain" predicate. For a...

CVE-2026-77473

AsyncSSH is a Python package which provides an asynchronous client and server implementation of the SSHv2 protocol on top of the Python asyncio framework. Prior to 2.24.1, recursive remote-to-local SFTP copies in SFTPClient.copy in asyncssh/sftp.py, reached through get, mget, and copy, trust...

CVE-2026-77473

The AsyncSSH Python package (prior to version 2.24.1 ) is vulnerable to a path traversal issue during recursive remote-to-local SFTP copies. The vulnerability exists in the SFTPClient._copy() function within asyncssh/sftp.py, which can be reached via get(), mget(), and copy(). Because the package...

CVE-2026-125106

The Wagtail content management system (built on Django) is vulnerable to a privilege escalation issue where a CMS user with the submit translations permission can bypass edit restrictions. By calling the Admin API copy for translation action, an attacker can copy a source page they lack permissio...

CVE-2026-125106

Wagtail is an open source content management system built on Django. Prior to 7.0.9, 7.3.4, 7.4.3, and 8.0rc2, a Wagtail CMS user with the submit translations permission can call the Admin API copy for translation action for a source page that the user cannot edit. The action copies the...

CVE-2026-123819

The Wagtail content management system contains a vulnerability where a CMS user with add permissions for a snippet model, but lacking change and view permissions, can bypass authorization to access and copy an existing snippet. The copy operation reveals the private contents of the unauthorized s...

CVE-2026-123819

Wagtail is an open source content management system built on Django. Prior to 7.0.9, 7.3.4, 7.4.3, and 8.0rc2, a CMS user who has add permission for a snippet model but lacks change and view permission for an existing snippet can access the snippet copy view and copy that source object. The copy...

CVE-2026-123808

The Nuxt UI Vue UI library is vulnerable in versions prior to 4.8.1 due to how the UForm component in src/runtime/components/Form.vue handles form submissions. The server-rendered form omits method and action attributes, relying entirely on a hydrated @submit.prevent handler. If a user submits th...

CVE-2026-123808

Nuxt UI is an intuitive Vue UI library powered by Reka UI and Tailwind CSS. Prior to 4.8.1, the server-rendered form element produced by UForm in src/runtime/components/Form.vue omits the method and action attributes and relies solely on the hydrated @submit.prevent handler to stop native...

CVE-2026-104259

The ModSecurity web application firewall engine is vulnerable to security rule bypasses in versions prior to 2.9.15 and 3.0.17 . The root cause lies in the t:removeComments transformation, where functions msre_fn_removeComments_execute (in apache2/re_tfns.c) and inplace() (in src/actions/transfor...

CVE-2026-104259

ModSecurity is an open source, cross platform web application firewall WAF engine for Apache, IIS and Nginx. Prior to 2.9.15 and 3.0.17, msrefnremoveCommentsexecute in apache2/retfns.c and inplace in src/actions/transformations/removecomments.cc implement t:removeComments by copying the character...

EUVD-2026-120487

The Xtensa MMU userspace port never initialized the per-thread page-table pointer thread-arch.ptables during thread setup, while archmemdomainthreadadd in arch/xtensa/core/ptables.c uses a non-NULL value of that field as its "this thread is migrating from another memory domain" predicate. For a...

EUVD-2026-120480

AsyncSSH is a Python package which provides an asynchronous client and server implementation of the SSHv2 protocol on top of the Python asyncio framework. Prior to 2.24.1, recursive remote-to-local SFTP copies in SFTPClient.copy in asyncssh/sftp.py, reached through get, mget, and copy, trust...

EUVD-2026-120509

ModSecurity is an open source, cross platform web application firewall WAF engine for Apache, IIS and Nginx. Prior to 2.9.15 and 3.0.17, msrefnremoveCommentsexecute in apache2/retfns.c and inplace in src/actions/transformations/removecomments.cc implement t:removeComments by copying the character...

EUVD-2026-120460

Wagtail is an open source content management system built on Django. Prior to 7.0.9, 7.3.4, 7.4.3, and 8.0rc2, a Wagtail CMS user with the submit translations permission can call the Admin API copy for translation action for a source page that the user cannot edit. The action copies the...

EUVD-2026-120456

Wagtail is an open source content management system built on Django. Prior to 7.0.9, 7.3.4, 7.4.3, and 8.0rc2, a CMS user who has add permission for a snippet model but lacks change and view permission for an existing snippet can access the snippet copy view and copy that source object. The copy...

GHSA-VVR2-H2JP-838M Code Graph RAG: MCP paginated read_file path traversal / arbitrary file read

Summary The readfile MCP tool in codebaserag/mcp/tools.py contains a path traversal vulnerability in its paginated branch when offset or limit is supplied. The handler constructs a file path using Pathself.projectroot / filepath without subsequently validating that the resolved path remains withi...