PT-2026-66848

Jodit Editor is a WYSIWYG editor with a built-in file browser & image editor. Prior to 4.12.31, Jodit's sanitizeHTMLElement method fails to use isDangerousUrl to normalize javascript: href values before checking the scheme, allowing case variants, control-byte prefixes, and embedded tabs or...

PT-2026-66853

Name of the Vulnerable Software and Affected Versions Coturn versions 4.5.2 through 4.14.0 Description When started with the --acme-redirect parameter and exposing a plaintext-TCP listener, an unauthenticated remote client can send an HTTP GET request to trigger a memory leak. The server responds...

Qnap QuTS hero NULL Pointer Dereference (CVE-2025-62850)

A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to launch a denial-of-service DoS attack. We have already fixed the vulnerability in the...

Qnap QTS and QuTS hero Stack-based Buffer Overflow (CVE-2025-62858)

A buffer overflow vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to modify memory or crash processes. We have already fixed the vulnerability in the following versions:...

CVE-2026-65421 MZ Automation libiec61850 Out-of-bounds Read

The MMS BER decoder contains a flaw in decoding fixed-width BER fields boolean/integer: an attacker-supplied length value is not validated, causing a read past the end of a heap buffer. This leads to termination of the MMS service process and a denial-of-service condition...

CVE-2026-65421

The MMS BER decoder contains a flaw in decoding fixed-width BER fields boolean/integer: an attacker-supplied length value is not validated, causing a read past the end of a heap buffer. This leads to termination of the MMS service process and a denial-of-service condition...

CVE-2026-65421

CVE-2026-65421 affects the MMS BER decoder in the MMS/IEC 61850 stack (as noted in NVD and CVE lists). The flaw is an attacker-supplied length for fixed-width BER fields (boolean/integer) that is not validated, causing a read past the end of a heap buffer. This results in termination of the MMS s...

CVE-2026-61526

AdonisJS HTTP Server is a package for handling HTTP requests in the AdonisJS framework. In versions 8.0.0-next.0 through 8.2.0 and 9.0.0 through 9.0.2, the error.message is interpolated into the default HTML exception response without escaping, allowing a crafted missing-route URL to execute...

CVE-2026-55777

GoAccess is a real-time web log analyzer and interactive viewer that runs in a terminal in nix systems or through the browser. Prior to 1.11, the parseios function uses an attacker-controlled keyword-to-OS offset as both the source offset and copy length for memmove, allowing a crafted User-Agent...

DEBIAN-CVE-2026-54715

GoAccess is a real-time web log analyzer and interactive viewer that runs in a terminal in nix systems or through the browser. In version 1.10.2, parsebrowser assumes the matched browser token begins with Opera and moves a trailing version substring to match plus five, allowing a crafted User-Age...

CVE-2026-62845

Kamaji is the Hosted Control Plane Manager for Kubernetes. Prior to 26.7.4-edge, the PostgreSQL and MySQL datastore drivers build DDL statements by interpolating the user-supplied DataStoreUsername/DataStoreSchema directly into SQL via fmt.Sprintf, without escaping identifiers. These fields have ...

CVE-2026-62845

Kamaji (Hosted Control Plane Manager for Kubernetes) is affected by a SQL injection in the PostgreSQL and MySQL datastore drivers. The root cause is that DataStoreUsername and DataStoreSchema are interpolated into SQL statements via fmt.Sprintf without escaping identifiers, and these fields have ...

CVE-2026-62845 Kamaji: SQL injection via unescaped datastore identifiers in PostgreSQL/MySQL drivers

Kamaji is the Hosted Control Plane Manager for Kubernetes. Prior to 26.7.4-edge, the PostgreSQL and MySQL datastore drivers build DDL statements by interpolating the user-supplied DataStoreUsername/DataStoreSchema directly into SQL via fmt.Sprintf, without escaping identifiers. These fields have ...

CVE-2026-61526 AdonisJS HTTP Server is vulnerable to reflected XSS through its exception handler

AdonisJS HTTP Server is a package for handling HTTP requests in the AdonisJS framework. In versions 8.0.0-next.0 through 8.2.0 and 9.0.0 through 9.0.2, the error.message is interpolated into the default HTML exception response without escaping, allowing a crafted missing-route URL to execute...

CVE-2026-68501

Sylius Mollie Plugin provides Mollie payment integration for Sylius applications. Prior to 2.2.8, 3.2.4, and 3.3.1, Sylius Mollie Plugin's GET /locale/thank-you PageRedirectController::thankYouAction and GET /locale/get-code QrCodeAction::fetchQrCodeFromOrder endpoints look up sequential orderId...

CVE-2026-68501 Sylius Mollie Plugin: Unauthenticated IDOR leaks order token and customer PII

Sylius Mollie Plugin provides Mollie payment integration for Sylius applications. Prior to 2.2.8, 3.2.4, and 3.3.1, Sylius Mollie Plugin's GET /locale/thank-you PageRedirectController::thankYouAction and GET /locale/get-code QrCodeAction::fetchQrCodeFromOrder endpoints look up sequential orderId...

CVE-2026-68501

Sylius Mollie Plugin for Sylius is affected by an IDOR vulnerability prior to versions 2.2.8, 3.2.4, and 3.3.1. The GET endpoints /{_locale}/thank-you (PageRedirectController::thankYouAction) and /{_locale}/get-code (QrCodeAction::fetchQrCodeFromOrder) can look up sequential orderId values withou...

CVE-2026-54715

GoAccess is a real-time web log analyzer and interactive viewer that runs in a terminal in nix systems or through the browser. In version 1.10.2, parsebrowser assumes the matched browser token begins with Opera and moves a trailing version substring to match plus five, allowing a crafted User-Age...

CVE-2026-54715 GoAccess: Heap Out-of-Bounds Write in parse_browser()

GoAccess is a real-time web log analyzer and interactive viewer that runs in a terminal in nix systems or through the browser. In version 1.10.2, parsebrowser assumes the matched browser token begins with Opera and moves a trailing version substring to match plus five, allowing a crafted User-Age...

DEBIAN-CVE-2026-67550

re2 provides Node.js bindings for Google's RE2 regular expression engine. Prior to 1.25.2, re2 validates lastIndex against the UTF-8 byte length of a subject but uses it as a UTF-16 code-unit offset in exec, test, match, replace, and split, allowing an attacker-influenced lastIndex on a non-ASCII...