CVE-2026-73307 Budibase: SSRF via bare fetch() in uploadUrl during AI table generation

Budibase is an open-source low-code platform. Prior to 3.39.4, uploadUrl in packages/server/src/utilities/fileUtils.ts used a bare server-side fetch for string attachment values passed by processAttachments in packages/server/src/sdk/workspace/ai/helpers/rows.ts. A builder with the AI...

CVE-2026-73307

Budibase CVE-2026-73307 affects the open-source platform prior to version 3.39.4. The issue arises from a bare server-side fetch used by uploadUrl in fileUtils.ts for string attachment values passed by processAttachments in AI table generation (rows.ts). A builder could cause an attachment to ref...

CVE-2026-18676 Kong Mesh: default control plane config leaks the admin token cross-origin via a CORS wildcard and localhost admin

The default kuma-cp configuration in Kong Mesh reveals the admin bootstrap token and signing keys to any webpage the operator visits while the control plane is reachable from their browser. Due to a CORS misconfiguration a cross-origin fetch from a malicious page returns the admin JWT and signing...

CVE-2026-18676 Kong Mesh: default control plane config leaks the admin token cross-origin via a CORS wildcard and localhost admin

The default kuma-cp configuration in Kong Mesh reveals the admin bootstrap token and signing keys to any webpage the operator visits while the control plane is reachable from their browser. Due to a CORS misconfiguration a cross-origin fetch from a malicious page returns the admin JWT and signing...

EUVD-2026-57423

The default kuma-cp configuration in Kong Mesh reveals the admin bootstrap token and signing keys to any webpage the operator visits while the control plane is reachable from their browser. Due to a CORS misconfiguration a cross-origin fetch from a malicious page returns the admin JWT and signing...

CVE-2026-12234

The userspace syscall verifiers zvrfyzsocksendmsg and zvrfyzsockrecvmsg in subsys/net/lib/sockets/sockets.c snapshot the caller-supplied struct netmsghdr into a kernel-side copy with kusermodefromcopy, but then re-read the still-live user struct for subsequent decisions. The kernel iovec shadow...

CVE-2026-12234 TOCTOU double-fetch in `zsock_sendmsg`/`recvmsg` userspace verifiers allows kernel-heap out-of-bounds write

The userspace syscall verifiers zvrfyzsocksendmsg and zvrfyzsockrecvmsg in subsys/net/lib/sockets/sockets.c snapshot the caller-supplied struct netmsghdr into a kernel-side copy with kusermodefromcopy, but then re-read the still-live user struct for subsequent decisions. The kernel iovec shadow...

CVE-2026-12234 TOCTOU double-fetch in `zsock_sendmsg`/`recvmsg` userspace verifiers allows kernel-heap out-of-bounds write

The userspace syscall verifiers zvrfyzsocksendmsg and zvrfyzsockrecvmsg in subsys/net/lib/sockets/sockets.c snapshot the caller-supplied struct netmsghdr into a kernel-side copy with kusermodefromcopy, but then re-read the still-live user struct for subsequent decisions. The kernel iovec shadow...

CVE-2026-12234

The CVE affects Zephyr’s userspace networking verification on zsock_sendmsg/zsock_recvmsg. The issue is a TOCTOU double-fetch: the verifier snapshots struct net_msghdr, yet later re-reads the live user memory to bound the loop, allowing a race where msg_iovlen can be inflated after the shadow buf...

CVE-2026-12234

The userspace syscall verifiers zvrfyzsocksendmsg and zvrfyzsockrecvmsg in subsys/net/lib/sockets/sockets.c snapshot the caller-supplied struct netmsghdr into a kernel-side copy with kusermodefromcopy, but then re-read the still-live user struct for subsequent decisions. The kernel iovec shadow...

EUVD-2026-57069

The userspace syscall verifiers zvrfyzsocksendmsg and zvrfyzsockrecvmsg in subsys/net/lib/sockets/sockets.c snapshot the caller-supplied struct netmsghdr into a kernel-side copy with kusermodefromcopy, but then re-read the still-live user struct for subsequent decisions. The kernel iovec shadow...

CVE-2026-12234 TOCTOU double-fetch in `zsock_sendmsg`/`recvmsg` userspace verifiers allows kernel-heap out-of-bounds write

The userspace syscall verifiers zvrfyzsocksendmsg and zvrfyzsockrecvmsg in subsys/net/lib/sockets/sockets.c snapshot the caller-supplied struct netmsghdr into a kernel-side copy with kusermodefromcopy, but then re-read the still-live user struct for subsequent decisions. The kernel iovec shadow...

Malicious code in cc-skills-helper (npm)

The npm package cc-skills-helper is a Windows-only supply-chain dropper published as seven versions 1.0.0 through 1.0.6 in a single 8-hour burst on 2026-04-25 by npm user betatester44676 [email protected], then abandoned. dist-tags.latest points at 1.0.6. All seven versions share the same...

MAL-2026-13933 Malicious code in cc-skills-helper (npm)

The npm package cc-skills-helper is a Windows-only supply-chain dropper published as seven versions 1.0.0 through 1.0.6 in a single 8-hour burst on 2026-04-25 by npm user betatester44676 [email protected], then abandoned. dist-tags.latest points at 1.0.6. All seven versions share the same...

PT-2026-70993

The userspace syscall verifiers z vrfy zsock sendmsg and z vrfy zsock recvmsg in subsys/net/lib/sockets/sockets.c snapshot the caller-supplied struct net msghdr into a kernel-side copy with k usermode from copy, but then re-read the still-live user struct for subsequent decisions. The kernel iove...

CVE-2026-12234: Time-of-check Time-of-use (TOCTOU) Race Condition

The userspace syscall verifiers zvrfyzsocksendmsg and zvrfyzsockrecvmsg in subsys/net/lib/sockets/sockets.c snapshot the caller-supplied struct netmsghdr into a kernel-side copy with kusermodefromcopy, but then re-read the still-live user struct for subsequent decisions. The kernel iovec shadow...

DEBIAN-CVE-2026-19550

A flaw was found in FreeIPA. The trust-fetch-domains command is gated by a read-only permission on the trust object rather than a trust-administration permission, allowing an authenticated, non-privileged IPA user to trigger a privileged Active Directory trust refresh using an attacker-supplied...

CVE-2026-19550

A flaw was found in FreeIPA. The trust-fetch-domains command is gated by a read-only permission on the trust object rather than a trust-administration permission, allowing an authenticated, non-privileged IPA user to trigger a privileged Active Directory trust refresh using an attacker-supplied...

CVE-2026-19550

A flaw was found in FreeIPA. The trust-fetch-domains command is gated by a read-only permission on the trust object rather than a trust-administration permission, allowing an authenticated, non-privileged IPA user to trigger a privileged Active Directory trust refresh using an attacker-supplied...

EUVD-2026-56977

A flaw was found in FreeIPA. The trust-fetch-domains command is gated by a read-only permission on the trust object rather than a trust-administration permission, allowing an authenticated, non-privileged IPA user to trigger a privileged Active Directory trust refresh using an attacker-supplied...