UBUNTU-CVE-2026-53534

JabRef is a desktop application for managing BibTeX and BibLaTeX libraries. Prior to 6.0-alpha.6, when jabsrv or JabRef's built-in HTTP server is enabled, the GET /better-bibtex/cayw endpoint accepts an external command query parameter and CAYWQueryParams.getCommand passes it through...

CVE-2026-53534

JabRef is a desktop application for managing BibTeX and BibLaTeX libraries. Prior to 6.0-alpha.6, when jabsrv or JabRef's built-in HTTP server is enabled, the GET /better-bibtex/cayw endpoint accepts an external command query parameter and CAYWQueryParams.getCommand passes it through...

CVE-2026-14311

Amelia (Premium) is a WordPress booking plugin vulnerable through version 2.4.4 . The root cause is a missing ownership verification on the /users/customers/ endpoint, allowing any authenticated user with the wpamelia-provider role to view and modify arbitrary customer records, including password...

CVE-2026-93393

A heap-based buffer overflow exists in the TLS transport layer of the MongoDB C Driver when built with the Windows platform TLS backend. A remote endpoint that the client connects to can cause the driver to write uncontrolled data outside the bounds of a heap allocation while processing incoming...

grafana: Grafana: Denial of Service due to excessive memory allocation via large JSON payloads

A flaw was found in Grafana. An unauthenticated attacker can exploit the public dashboard query endpoint by sending arbitrarily large JSON payloads. This vulnerability, caused by a lack of request body size limits, triggers excessive memory allocation, leading to a denial of service through memor...

grafana: Grafana Live: Denial of Service due to unbounded memory allocation via push endpoint

A flaw was found in Grafana Live. An authenticated user with access to the Grafana Live API can exploit the push endpoint by sending a large or streaming request body. This can lead to unbounded memory allocation, potentially causing out-of-memory conditions and resulting in a Denial of Service D...

grafana: Grafana: Denial of Service via unbounded memory allocation in plugin resources endpoint

A flaw was found in Grafana. An authenticated user can exploit a vulnerability in the plugin resources endpoint by sending a request that causes unbounded memory allocation. This occurs when the system attempts to read the entire request body into memory. Successful exploitation can lead to an...

grafana: Grafana Live: Denial of Service due to unbounded memory allocation via push endpoint

A flaw was found in Grafana Live. An authenticated user with access to the Grafana Live API can exploit the push endpoint by sending a large or streaming request body. This can lead to unbounded memory allocation, potentially causing out-of-memory conditions and resulting in a Denial of Service D...

GHSA-8WMF-6V46-5GFG OpenTelemetry-Go: Exporter config logging may leak endpoint URLs in info logs

Summary OpenTelemetry Go versions 1.5.0 through 1.44.0 can include trace exporter endpoint configuration in an internal diagnostic log emitted when an SDK TracerProvider is created. The default OpenTelemetry logger does not emit this event. Exposure requires an application to install a logger tha...

EUVD-2026-81098

OpenTelemetry-Go: Exporter config logging may leak endpoint URLs in info logs...

CVE-2026-45723

Omni manages Kubernetes on bare metal, virtual machines, or in a cloud. Prior to 1.6.6 and 1.7.3, managementServer.CreateSchematic in internal/backend/grpc/schematics.go passes the caller-controlled TalosVersion field to imageFactoryClient.OverlaysVersions without validating it as a version. An...

CVE-2026-54460

OpenReception appointment booking software (prior to 1.1.1 ) is vulnerable to unauthenticated account takeover via the POST /api/auth/passkeys endpoint. The endpoint accepts an attacker-supplied userId and passkey without an authenticated session, fails to call WebAuthnService.verifyRegistration,...

CVE-2026-45723 Omni: Operator can traverse image-factory API paths via unsanitized `talos_version` in CreateSchematic

Omni manages Kubernetes on bare metal, virtual machines, or in a cloud. Prior to 1.6.6 and 1.7.3, managementServer.CreateSchematic in internal/backend/grpc/schematics.go passes the caller-controlled TalosVersion field to imageFactoryClient.OverlaysVersions without validating it as a version. An...

CVE-2026-45723

Omni (SideroLabs), a Kubernetes management platform, is vulnerable to same-host path traversal via the managementServer.CreateSchematic gRPC endpoint. The caller-controlled TalosVersion field is passed unsanitized to imageFactoryClient.OverlaysVersions, where url.URL.JoinPath resolves ../ sequenc...

CVE-2026-45723 Omni: Operator can traverse image-factory API paths via unsanitized `talos_version` in CreateSchematic

Omni manages Kubernetes on bare metal, virtual machines, or in a cloud. Prior to 1.6.6 and 1.7.3, managementServer.CreateSchematic in internal/backend/grpc/schematics.go passes the caller-controlled TalosVersion field to imageFactoryClient.OverlaysVersions without validating it as a version. An...

EUVD-2026-82402

Omni manages Kubernetes on bare metal, virtual machines, or in a cloud. Prior to 1.6.6 and 1.7.3, managementServer.CreateSchematic in internal/backend/grpc/schematics.go passes the caller-controlled TalosVersion field to imageFactoryClient.OverlaysVersions without validating it as a version. An...

CVE-2026-45723 Omni: Operator can traverse image-factory API paths via unsanitized `talos_version` in CreateSchematic

Omni manages Kubernetes on bare metal, virtual machines, or in a cloud. Prior to 1.6.6 and 1.7.3, managementServer.CreateSchematic in internal/backend/grpc/schematics.go passes the caller-controlled TalosVersion field to imageFactoryClient.OverlaysVersions without validating it as a version. An...

CVE-2026-49292

Kiwi TCMS is an open source test management system. Prior to 16.0, the unauthenticated /init-db/ page handled by InitDBView in tcms/core/views.py remains reachable after initial setup and proxies repeated requests to Kiwi/manage.py migrate. The migration command is reentrant, so repeated access...

CVE-2026-90997 Keycloak-services: keycloak: replay protection bypass leads to unauthorized access via database driver semantics mismatch

A flaw was found in Keycloak. When deployed in stateless mode with MySQL or MariaDB, a mismatch in row-count semantics between the database driver and Keycloak's application logic allows an attacker to bypass replay protection. This vulnerability enables an attacker who intercepts single-use...

CVE-2026-49292 Kiwi TCMS: The /init-db/ page renders and responds to requests after first use

Kiwi TCMS is an open source test management system. Prior to 16.0, the unauthenticated /init-db/ page handled by InitDBView in tcms/core/views.py remains reachable after initial setup and proxies repeated requests to Kiwi/manage.py migrate. The migration command is reentrant, so repeated access...