CVE-2026-110757

A flaw was found in Text::CSVXS. An attacker can cause record splitting and data tampering by supplying input containing embedded newline characters that evaluates as numeric. Because the library fails to quote fields flagged as numeric when formatting Comma-Separated Values CSV records, the...

CVE-2026-110756

A flaw was found in Text::CSVXS. When printing records where a UTF-8 flagged field precedes invalid UTF-8 bytes, the module drops held-back bytes, closing quotes, and line endings without signaling an error. An attacker capable of providing crafted input can exploit this flaw to cause data...

CLSA-2026-1792190438 flatpak: Fix of CVE-2026-96275

CVE-2026-96275: prevent extra-data path traversal by validating names and using fd-relative extraction and apply operations...

CVE-2026-110756 Text::CSV_XS versions before 1.65 for Perl drop the end of a record and its line ending when a UTF-8 flagged field precedes invalid UTF-8 bytes in print

Text::CSVXS versions before 1.65 for Perl drop the end of a record and its line ending when a UTF-8 flagged field precedes invalid UTF-8 bytes in print. When a record contains a UTF-8 flagged field, print holds back trailing bytes that are not valid UTF-8 at each buffer flush, so that a character...

CVE-2026-110756 Text::CSV_XS versions before 1.65 for Perl drop the end of a record and its line ending when a UTF-8 flagged field precedes invalid UTF-8 bytes in print

Text::CSVXS versions before 1.65 for Perl drop the end of a record and its line ending when a UTF-8 flagged field precedes invalid UTF-8 bytes in print. When a record contains a UTF-8 flagged field, print holds back trailing bytes that are not valid UTF-8 at each buffer flush, so that a character...

CVE-2026-110756

Text::CSVXS versions before 1.65 for Perl drop the end of a record and its line ending when a UTF-8 flagged field precedes invalid UTF-8 bytes in print. When a record contains a UTF-8 flagged field, print holds back trailing bytes that are not valid UTF-8 at each buffer flush, so that a character...

CVE-2026-110756

The Text::CSV_XS module for Perl (versions before 1.65 ) contains a flaw where it drops the end of a record and its line ending during printing. This occurs when a UTF-8 flagged field precedes invalid UTF-8 bytes; the module holds back trailing bytes during buffer flushes but fails to write them ...

CVE-2026-110756

Text::CSVXS versions before 1.65 for Perl drop the end of a record and its line ending when a UTF-8 flagged field precedes invalid UTF-8 bytes in print. When a record contains a UTF-8 flagged field, print holds back trailing bytes that are not valid UTF-8 at each buffer flush, so that a character...

CVE-2026-111162

A flaw was found in WildMIDI. When parsing HMP audio files, an integer underflow in chunk length calculations causes the application to read beyond allocated memory boundaries. By tricking a user into opening a specially crafted file, an attacker can trigger an application crash, resulting in a...

CVE-2026-100353

A flaw was found in kin-openapi. An unauthenticated remote attacker can cause a Denial of Service DoS by sending specially crafted HTTP requests containing specific array query parameters or form-encoded data. Because the request decoder fails to properly validate certain array schemas before...

CVE-2026-108374

ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.121.0 and 16.34.0, certain endpoints for status modification fail to enforce proper authorization checks. A low-privileged authenticated user can invoke state-changing whitelisted methods without required write,...

CVE-2026-108373

ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.118.0 and 16.27.0, certain endpoints in the Sales Person-wise Transaction Summary report fail to enforce proper authorization checks. When a role-limited authenticated user requests the affected financial report, the...

CVE-2026-76894

The MCP Apps UI resource an interactive DataStore table rendered in the host's webview/iframe communicates with its parent via "postMessage". Its inbound "message" listener performs no "event.origin" validation, and its outbound messages are sent with target origin "''". Any window/frame able to...

CVE-2026-64862 Frappe HR: Missing Authorization on PWA API Endpoints enables Cross-Employee Data access in HRMS

Frappe HR is an open-source human resources management solution HRMS. Prior to 15.58.3 and 16.4.3, HRMS PWA API endpoints for employee data do not consistently authorize employee-specific PWA API requests. An authenticated user requests records associated with another employee. The user can reque...

CVE-2026-64862 Frappe HR: Missing Authorization on PWA API Endpoints enables Cross-Employee Data access in HRMS

Frappe HR is an open-source human resources management solution HRMS. Prior to 15.58.3 and 16.4.3, HRMS PWA API endpoints for employee data do not consistently authorize employee-specific PWA API requests. An authenticated user requests records associated with another employee. The user can reque...

CVE-2026-64862

The open-source human resources management solution Frappe HR is vulnerable to a missing authorization flaw (CWE-862) in its PWA API endpoints . Versions prior to 15.58.3 and 16.4.3 do not consistently authorize employee-specific PWA API requests, allowing an authenticated user to request and acc...

CVE-2026-64862 Frappe HR: Missing Authorization on PWA API Endpoints enables Cross-Employee Data access in HRMS

Frappe HR is an open-source human resources management solution HRMS. Prior to 15.58.3 and 16.4.3, HRMS PWA API endpoints for employee data do not consistently authorize employee-specific PWA API requests. An authenticated user requests records associated with another employee. The user can reque...

CVE-2026-108373

The ERPNext Enterprise Resource Planning tool is vulnerable to unauthorized access to financial data in versions prior to 15.118.0 and 16.27.0 . The root cause is a missing authorization check within certain endpoints of the Sales Person-wise Transaction Summary report. Specifically, the system f...

CVE-2026-108373 ERPNext: Unauthorised access to financial data due to missing validation

ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.118.0 and 16.27.0, certain endpoints in the Sales Person-wise Transaction Summary report fail to enforce proper authorization checks. When a role-limited authenticated user requests the affected financial report, the...

CVE-2026-108373 ERPNext: Unauthorised access to financial data due to missing validation

ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.118.0 and 16.27.0, certain endpoints in the Sales Person-wise Transaction Summary report fail to enforce proper authorization checks. When a role-limited authenticated user requests the affected financial report, the...