CVE-2026-73070

Vim is an open source, command line text editor. Prior to 9.2.0842, the socket server backend in src/socketserver.c accepts unbounded client connections in socketserveraccept, causing descriptors to overflow fdset structures in src/channel.c and fixed-size struct pollfd arrays in src/osunix.c,...

CVE-2026-73079 Sub2API: Path traversal in the Responses subpath routes lets an authenticated tenant relay requests to arbitrary upstream endpoints using pooled account credentials

Sub2API is an AI API gateway platform designed to distribute and manage API quotas from AI product subscriptions. From 0.1.135, to 0.1.168, platform API keys issued to tenants are exchanged for upstream requests made with shared provider accounts ChatGPT/Codex OAuth, OpenAI platform keys, or an...

CVE-2026-73077 Vim: Arbitrary Code Execution via Shell Keyword Lookup

Vim is an open source, command line text editor. Prior to 9.2.0839, the runtime/ftplugin/sh.vim, runtime/ftplugin/zsh.vim, and runtime/ftplugin/ps1.vim filetype plugins pass attacker-controlled Visual-mode selections from K through keywordprg commands without safely separating shell arguments...

Linux Distros Unpatched Vulnerability : CVE-2026-54338

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - JupyterHub is software that allows users to create a multi-user server for Jupyter notebooks. Prior to 5.5.0, invalid input to form-based login authenticators c...

CVE-2026-52879 Klever-Go: Unbounded goroutine spawn on direct-message ingress enables peer-driven DoS

Klever-Go is the Go implementation of the Klever blockchain protocol. In versions 1.7.14 through 1.7.17, the direct-message ingress handler spawns a new goroutine for every incoming direct message before the processor-level antiflood layer makes any admission decision, with no semaphore, throttle...

CVE-2026-52878 Klever-Go: Unauthenticated nil-pointer DoS in P2P transaction validation can halt the chain

Klever-Go is the Go implementation of the Klever blockchain protocol. Versions 1.7.14 through 1.7.17 are vulnerable to a nil-pointer panic triggered by a protobuf Transaction whose embedded RawData sub-message is omitted. This omission causes RawData to decode to nil. Every transaction gossiped o...

CVE-2026-52878

CVE-2026-52878 affects Klever-Go (versions 1.7.14–1.7.17). A nil RawData sub-message in protobuf Transaction triggers a nil-pointer panic when txVersionChecker.CheckTxVersion dereferences tx.RawData.Version without a nil check, causing a crash in the libp2p pubsub/the node process. The crash prop...

Security Bulletin: Consul vulnerable to partial arbitrary file read via Vault Connect CA provider

Summary Consul Community Edition and Consul Enterprise 1.18.21 through 2.0.2 are vulnerable to a partial arbitrary file read when configured to use the Vault Connect CA provider with JWT or AppRole authentication. A privileged attacker with operator:write permission may direct Consul to read and...

CVE-2026-15972 Unauthenticated denial of service via unbounded external gRPC connection acceptance

Consul Community Edition and Consul Enterprise 1.13.0 through 2.0.2 are vulnerable to an unauthenticated denial of service through unbounded connection acceptance on the external gRPC listeners. A remote attacker may exhaust agent file descriptors, goroutines, and memory by opening many incomplet...

CVE-2026-15970 L7 intention authorization bypass via custom public listener

Consul Community Edition and Consul Enterprise 1.20.1 through 2.0.2 are vulnerable to an L7 intention authorization bypass when a service proxy is configured with a custom public listener. An authenticated mesh workload may reach HTTP paths that are blocked by a path-based deny intention. This...

CVE-2026-19017

Consul vulnerable: Community Edition and Enterprise versions 1.18.21–2.0.2 are affected by a partial arbitrary file read when configured with Vault Connect CA provider using JWT or AppRole authentication. A user with operator:write can instruct Consul to read and forward credential files outside ...

CVE-2026-71851 crypto-js: Insufficient Entropy in Cryptographic Secret Generation via Vulnerable CryptoJS Dependency Chain

crypto-js is a JavaScript library of crypto standards. Versions of crypto-js prior to 4.0.0 generate randomness in CryptoJS.lib.WordArray.random using a custom variation of the Multiply-With-Carry pseudorandom number generator, seeded from Math.random, instead of a cryptographically secure source...

CVE-2026-71848

Summary: CVE-2026-71848 affects the Hono web framework (4.12.0–4.12.33) via the languageDetector middleware. The root cause is an implementation in normalizeLanguage() that builds language tag prefixes with parts.slice(0, i).join('-') for every possible prefix, causing the total string processing...

CVE-2026-69127

Kirby (open-source CMS) has a REST API flaw where, prior to 4.9.5 and from 5.0.0 through 5.5.1, the API error handler can return unsanitized PHP error messages that reveal the full filesystem path of the Kirby installation to unauthenticated API users. The issue affects all sites that have not di...

CVE-2026-71847

Ruby JSON: ResumableParser in the native C extension (Ruby JSON) from versions 2.20.0–2.21.2 allocates correctly but after consuming input, state.start/state.cursor/state.end point into freed storage. When partial_value processes a truncated object with duplicate keys, cursor_position dereference...

CVE-2026-62992

Smarty is a template engine for PHP, facilitating the separation of presentation HTML/CSS from application logic. Prior to 5.8.2 and 4.5.7 on the 4.x line, Security::checkDir does not fully resolve symbolic links before validating that a requested path lies within a configured secure directory. A...

CVE-2026-17594

CVE-2026-17594 affects Nexus Repository 3 CE/Pro versions 3.0.0–3.94.x. The root cause is an authorization mismatch in the repository-creation UI: a delegated repository-admin (scoped to a specific format) could cause a repository of a different, unauthorized format to be created because authoriz...

EUVD-2026-54512

Nexus Repository 3 contains a Server-Side Request Forgery SSRF vulnerability in the email configuration verification feature. A user holding the nexus:settings:update permission could submit arbitrary host and port values to the email test/verification endpoint, causing the server to attempt...

CVE-2026-66059

CVE-2026-66059 concerns the Frappe full‑stack web framework where, prior to versions 16.20.0 and 15.112.0 , a field‑level permissions bypass could expose restricted DocType fields. The underlying issue is a bypass of field permissions, enabling access to normally restricted data. The vulnerabilit...

Linux Distros Unpatched Vulnerability : CVE-2026-71478

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - league/commonmark is a PHP library for parsing and rendering CommonMark Markdown. From 1.5.0 until 2.9.0, the AttributesExtension's href and src unsafe-link...