EUVD-2026-65699

Alluxio's S3 REST proxy fails to verify AWS Signature Version 4 signatures in its default configuration, allowing unauthenticated attackers to spoof user identity. Attackers can extract usernames from unsigned Authorization headers and impersonate any user, including service accounts, to read,...

CVE-2026-55580 mcp-shell — Security Disabled by Default in Bare-Binary Deploy Path + Shell Interpreter in Secure-Mode Allowlist

mcp-shell is an MCP server for running shell commands securely, auditably, and on demand. Prior to 0.6.0, config.go initializes Security.Enabled to false, and when MCPSHELLSECCONFIGFILE is unset, main.go starts the documented bare-binary deployment without a security policy...

CVE-2026-16723

A flaw was found in fastjson. This remote code execution RCE vulnerability allows a remote attacker to execute arbitrary code on the system. The vulnerability is exploitable under fastjson's default configuration, meaning no special setup or AutoType enablement is required for exploitation...

EUVD-2026-65343

The extension fails to restrict which frontend usergroups a logged-in user may assign to their own account when the profile edit plugin uses its default field configuration, allowing self-service privilege escalation into arbitrary frontend groups...

PT-2026-81482

Name of the Vulnerable Software and Affected Versions Alluxio affected versions not specified Description The S3 REST proxy fails to verify AWS Signature Version 4 signatures when using the default configuration. This allows unauthenticated attackers to spoof user identity by extracting usernames...

PT-2026-81352

Name of the Vulnerable Software and Affected Versions mcp-shell versions prior to 0.6.0 Description An OS Command Injection issue exists in the shell exec MCP tool. The software implements a secure mode that restricts command execution to an allowlist of executables defined in security.yaml, whic...

DEBIAN-CVE-2026-10618

Hugo's default fenced-code-block renderer writes attribute values taken from the code-fence info string into the rendered HTML without escaping them. New in markup/internal/attributes/attributes.go converts every attribute value from a byte slice to a string as it is stored, deliberately dropping...

CVE-2026-10618

Hugo's default fenced-code-block renderer writes attribute values taken from the code-fence info string into the rendered HTML without escaping them. New in markup/internal/attributes/attributes.go converts every attribute value from a byte slice to a string as it is stored, deliberately dropping...

Astra Linux – Vulnerability in Tomcat9

The Padding Oracle vulnerability exists in Apache Tomcat’s EncryptInterceptor with the default configuration. This issue affects Apache Tomcat versions as follows: 11.0.0-M1 through 11.0.18, 10.0.0-M1 through 10.1.52, 9.0.13 through 9.0.115, 8.5.38 through 8.5.100, and 7.0.100 through 7.0.109...

Astra Linux – Vulnerability in wkhtmltopdf

A directory traversal vulnerability exists in wkhtmltopdf version 0.12.5, allowing remote attackers to read local files and disclose sensitive information by using a crafted HTML file with default configurations...

CVE-2026-62388 NLTK before 3.10.0 Insecure Default Configuration in pathsec.py

NLTK versions before 3.10.0 default to ENFORCE=False in pathsec.py, causing all security validation functions to emit warnings instead of raising exceptions. Attackers can bypass path traversal and pickle deserialization protections by exploiting the disabled security controls that are only activ...

CVE-2026-62388

NLTK (Python Natural Language Processing toolkit) versions before 3.10.0 ship with an insecure default in pathsec.py : the ENFORCE flag is set to False, causing all security validation functions to emit warnings rather than raising exceptions. This means path traversal and pickle deserialization ...

dompurify: DOMPurify: Sanitization bypass via hook manipulation

A flaw was found in DOMPurify. An attacker can exploit a vulnerability in how DOMPurify handles its sanitization hooks when default configurations are used. By manipulating the uponSanitizeElement or uponSanitizeAttribute hooks, an attacker can permanently alter the allowed HTML tags and...

dompurify: DOMPurify: Sanitization bypass via hook manipulation

A flaw was found in DOMPurify. An attacker can exploit a vulnerability in how DOMPurify handles its sanitization hooks when default configurations are used. By manipulating the uponSanitizeElement or uponSanitizeAttribute hooks, an attacker can permanently alter the allowed HTML tags and...

CVE-2026-74882

openssl_encrypt versions before 1.4.0 ship with an insecure default in its IntegrityProxyConfig trusted_proxies that trusts the entire RFC 1918 private address space. This allows attackers on private networks to forge client certificate headers and bypass mTLS authentication when ProxyAuth valida...

CVE-2026-55400

CVE-2026-55400 describes an integer underflow in Secure Access servers prior to 14.57. With an authenticated session, an attacker can send specially crafted traffic to a server in a non-default configuration, causing a persistent denial of service. Affected product/version: Secure Access servers

CVE-2025-59321

CPSD CryptoPro Secure Disk for Bitlocker before v7.7.4 contains a default TPM PCR policy that fails to consider the system boot state. This allows the TPM to be unsealed via an unintended execution path or from another hardware platform...

CVE-2025-41769

The device's PROFINET service is affected by a buffer overflow vulnerability that exists in the default configuration. An unauthenticated remote attacker could exploit this vulnerability to reboot the device or execute arbitrary code...

PT-2026-71069

Name of the Vulnerable Software and Affected Versions CryptoPro Secure Disk for Bitlocker versions prior to 7.7.4 Description The software contains a default TPM PCR policy that fails to consider the system boot state. This flaw allows the Trusted Platform Module TPM, a specialized chip used to...

CVE-2026-72555

A broken access control vulnerability in Peppermint Lab Peppermint through commit ba6e217 exists because the Config.rolesactive flag defaults to false, causing all permission checks on ticket, client, and user handlers to behave as no-ops on default installations. All authenticated users bypass...