CVE-2026-56567

HCL iControl v4.3.0 was affected by Security Misconfiguration vulnerabilities. It involves the public exposure of internal configuration files due to improper web server or application hardening...

CVE-2026-56569

HCL iControl was affected by Sensitive Data Exposure vulnerabilities. It involves the public exposure of internal configuration files due to improper web server or application hardening...

GHSA-Q6HH-GP44-4HCM Wings: Maliciously or erroneously created parsed config files can cause wings process to OOM

Summary Config file parsers, json, yaml, xml etc in parser.go have no file size limit/checks, allowing for a giant config file to potentially OOM the wings process. Impact All wings users who have an egg with a non-file parser configuration file setting...

CVE-2026-52857 Wings: Maliciously or erroneously created parsed config files can cause wings process to OOM

Wings is the server control plane for Pterodactyl, a free, open-source game server management panel. Prior to 1.13.0, unbounded json, yaml, and xml configuration-file parsers in parser.go can process an oversized non-file parser configuration file and exhaust Wings process memory. This issue is...

CVE-2026-52857

CVE-2026-52857 affects Wings (Pterodactyl server control plane). Prior to 1.13.0, unbounded json, yaml, and xml configuration-file parsers in parser.go can process an oversized non-file parser configuration file and exhaust Wings’ memory. This is fixed in version 1.13.0. Impact is Availability (O...

python-pillow: Pillow: Denial of Service via excessive memory allocation when processing font files

A flaw was found in Pillow, a Python imaging library. When processing a specially crafted font file, the library's font compilation function does not adequately check for excessive memory allocation. This oversight allows a remote attacker to trigger an unreasonable consumption of system memory,...

python-pillow: Pillow: Denial of Service via excessive memory allocation when processing font files

A flaw was found in Pillow, a Python imaging library. When processing a specially crafted font file, the library's font compilation function does not adequately check for excessive memory allocation. This oversight allows a remote attacker to trigger an unreasonable consumption of system memory,...

CVE-2026-56569

HCL iControl was affected by Sensitive Data Exposure vulnerabilities. It involves the public exposure of internal configuration files due to improper web server or application hardening...

CVE-2026-56569

Technical details of CVE-2026-56569 are not publicly available in the provided documents. Affected components, root cause, impact, and fixes are not disclosed here. Monitor the referenced sources for updates.

CVE-2026-56569 HCL iControl is affected by multiple security vulnerabilities.

HCL iControl was affected by Sensitive Data Exposure vulnerabilities. It involves the public exposure of internal configuration files due to improper web server or application hardening...

EUVD-2026-51543

HCL iControl was affected by Sensitive Data Exposure vulnerabilities. It involves the public exposure of internal configuration files due to improper web server or application hardening...

CVE-2026-56567

HCL iControl v4.3.0 was affected by Security Misconfiguration vulnerabilities. It involves the public exposure of internal configuration files due to improper web server or application hardening...

CVE-2026-56567

Technical details about CVE-2026-56567 are not publicly available in the provided documents. Monitor for updates from the product/vendor and security advisories.

BIT-HELM-2026-63308 Helm Files.Lines Denial of Service via Empty Chart Files

Helm through 4.2.3, fixed in commit ba6c9a2, contains a denial of service vulnerability in the Files.Lines template helper in pkg/engine/files.go that allows attackers to trigger an index out of range panic by including zero-length byte slices in chart files. Attackers can include empty files in...

CVE-2026-56671

ComfyUI is a modular diffusion model GUI, api and backend with a graph/nodes interface. Prior to 0.28.0, getmodelpreview in app/modelmanager.py joins an unrestricted filename route capture to a selected model directory without a containment check, allowing an unauthenticated remote attacker to us...

CVE-2026-14862

The Support Genix WordPress plugin before 1.4.48 does not properly authorize access to support-ticket attachment downloads, allowing unauthenticated users who obtain the stored attachment file name to download other users' private ticket attachments...

CVE-2026-14849

The CVE-2026-14849 entry concerns the Paid Membership Subscriptions WordPress plugin (before 3.0.7). Affected component: member and payment export files written to a predictable location in the uploads directory. Root cause: lack of protection allows unauthenticated users to download these export...

CVE-2026-14849

The Paid Membership Subscriptions WordPress plugin before 3.0.7 does not protect the member and payment export files it writes to a predictable location in the uploads directory, allowing unauthenticated users to download the exported member and payment data including PII while an export artifact...

CVE-2026-14849 Paid Member Subscriptions < 3.0.7 - Unauthenticated Sensitive Information Exposure via Residual Export Files

The Paid Membership Subscriptions WordPress plugin before 3.0.7 does not protect the member and payment export files it writes to a predictable location in the uploads directory, allowing unauthenticated users to download the exported member and payment data including PII while an export artifact...

CVE-2026-56673 ComfyUI: Path traversal in LoadImage via the /prompt API allows arbitrary file existence probing and image exfiltration

ComfyUI is a modular diffusion model GUI, API, and backend with a graph-and-node interface. Prior to 0.28.0, folderpaths.getannotatedfilepath and existsannotatedfilepath join workflow-controlled annotated filenames to a base directory without a containment check, allowing an unauthenticated craft...