CVE-2026-109354 LibreNMS before 26.9.0 Path Traversal via NFSen channel Parameter

LibreNMS before 26.9.0 contains a path traversal vulnerability in nfsenchannelcommon.inc.php that allows authenticated users to read unauthorized RRD data by injecting ../ sequences into the channel parameter. Attackers with access to one NFSen-enabled device can request graph.php with a traverse...

EUVD-2026-97635

SurrealDB from 3.0.0 before 3.3.0 contains an authorization bypass vulnerability that allows authenticated record users to read records in other namespaces or databases by resolving record ids through FETCH. Attackers can switch to a foreign namespace/database and name a known record id in a RETU...

CVE-2026-109328 Admidio 5.0.0 before 5.0.15 Unauthenticated Stored XSS via Registration Name

Admidio 5.0.0 before 5.0.15 contains an unauthenticated stored cross-site scripting vulnerability in RegistrationPresenter.php, which inserts the raw FIRSTNAME registration value into an unencoded data-message attribute. Attackers can register with a double-quoted event handler that executes...

CVE-2026-109328 Admidio 5.0.0 before 5.0.15 Unauthenticated Stored XSS via Registration Name

Admidio 5.0.0 before 5.0.15 contains an unauthenticated stored cross-site scripting vulnerability in RegistrationPresenter.php, which inserts the raw FIRSTNAME registration value into an unencoded data-message attribute. Attackers can register with a double-quoted event handler that executes...

CVE-2026-109316

The Grav Data Manager plugin (versions 1.4.0 through 1.4.5) contains a missing authorization vulnerability. This flaw allows unauthenticated attackers to delete stored data files, such as form submissions, located under user/data/ via the classic Admin integration . Exploitation is possible by se...

EUVD-2026-97618

Grav Data Manager plugin 1.4.0 through 1.4.5 contains a missing authorization vulnerability that allows unauthenticated attackers to delete stored data files via the classic Admin integration. Attackers can send a request with the delete parameter and known data type and filename to remove files...

CVE-2026-109316 Grav Data Manager 1.4.0 through 1.4.5 Unauthenticated File Deletion via Admin

Grav Data Manager plugin 1.4.0 through 1.4.5 contains a missing authorization vulnerability that allows unauthenticated attackers to delete stored data files via the classic Admin integration. Attackers can send a request with the delete parameter and known data type and filename to remove files...

CVE-2026-109316 Grav Data Manager 1.4.0 through 1.4.5 Unauthenticated File Deletion via Admin

Grav Data Manager plugin 1.4.0 through 1.4.5 contains a missing authorization vulnerability that allows unauthenticated attackers to delete stored data files via the classic Admin integration. Attackers can send a request with the delete parameter and known data type and filename to remove files...

CVE-2026-85956

Progress MarkLogic Server versions 12.x before 12.1.0 and 11.x before 11.3.7 are vulnerable to improper privilege management during backup and restore operations. A remote attacker with delegated database-administrator privileges can perform these operations on forests outside the authorized data...

CVE-2026-85956 Improper privilege management in Progress MarkLogic Server backup and restore operations

Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 allow a remote attacker with delegated database-administrator privileges to perform backup or restore operations on forests outside the authorized database scope, which could result in unauthorized access to or...

EUVD-2026-97519

Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 allow a remote attacker with delegated database-administrator privileges to perform backup or restore operations on forests outside the authorized database scope, which could result in unauthorized access to or...

EEF-CVE-2026-96618 Hex exhausts memory and disk on oversized or compressed responses from an untrusted mirror

Summary Improper Handling of Highly Compressed Data Data Amplification vulnerability in hexpm hex allows an untrusted package mirror to exhaust the memory or disk space of the machine running mix deps.get, mix deps.update, mix hex.package fetch or mix hex.docs fetch. Hex treats a mirror configure...

CVE-2026-96618

Improper Handling of Highly Compressed Data Data Amplification vulnerability in hexpm hex allows an untrusted package mirror to exhaust the memory or disk space of the machine running mix deps.get, mix deps.update, mix hex.package fetch or mix hex.docs fetch. Hex treats a mirror configured with...

CVE-2026-96618 Hex exhausts memory and disk on oversized or compressed responses from an untrusted mirror

Improper Handling of Highly Compressed Data Data Amplification vulnerability in hexpm hex allows an untrusted package mirror to exhaust the memory or disk space of the machine running mix deps.get, mix deps.update, mix hex.package fetch or mix hex.docs fetch. Hex treats a mirror configured with...

EUVD-2026-97500

Improper Handling of Highly Compressed Data Data Amplification vulnerability in hexpm hex allows an untrusted package mirror to exhaust the memory or disk space of the machine running mix deps.get, mix deps.update, mix hex.package fetch or mix hex.docs fetch. Hex treats a mirror configured with...

CVE-2026-96618

The hexpm hex package (versions 0.11.2 before 2.5.2) is vulnerable to a Data Amplification attack where an untrusted mirror can exhaust a machine's memory or disk space. The root cause is that Hex.HTTP.request/5 decompresses gzip responses without enforcing size limits, and package tarballs/docs ...

CVE-2026-96618 Hex exhausts memory and disk on oversized or compressed responses from an untrusted mirror

Improper Handling of Highly Compressed Data Data Amplification vulnerability in hexpm hex allows an untrusted package mirror to exhaust the memory or disk space of the machine running mix deps.get, mix deps.update, mix hex.package fetch or mix hex.docs fetch. Hex treats a mirror configured with...

Security update for libsoup

This update for libsoup fixes the following issues: CVE-2026-15713: SoupCache: libsoup: HTTP/2 frame window exhaustion remote denial of service via memory leak bsc1271448. CVE-2026-102555: Heap buffer overflow via uninitialized length in data-URI base64 decoding bsc1283299. CVE-2026-102556: Heap...

CVE-2026-92681 @neo4j/graphql: schema-level and type-level @authentication not enforced on top-level @cypher fields

In @neo4j/graphql versions up to and including 7.6.3, @authentication directives applied at the schema level or on the Query or Mutation types are silently ignored for top-level fields annotated with @cypher. Only @authentication directives placed directly on the individual fields are enforced. A...

CVE-2026-92681 @neo4j/graphql: schema-level and type-level @authentication not enforced on top-level @cypher fields

In @neo4j/graphql versions up to and including 7.6.3, @authentication directives applied at the schema level or on the Query or Mutation types are silently ignored for top-level fields annotated with @cypher. Only @authentication directives placed directly on the individual fields are enforced. A...