CVE-2026-79919 MaxKB function-library sandbox escape: dlopen stack-check bypass via importlib meta-path callbacks and unhooked dlsym(RTLD_NEXT)

MaxKB is an open-source AI assistant for enterprise. Prior to version 2.10.6-lts, function-library code running under the LDPRELOAD sandbox can invoke ctypes.CDLL from an importlib.abc.MetaPathFinder callback so the dlopen call-stack heuristic sees a Python import frame, then use unhooked dlsym...

CVE-2026-79919 MaxKB function-library sandbox escape: dlopen stack-check bypass via importlib meta-path callbacks and unhooked dlsym(RTLD_NEXT)

MaxKB is an open-source AI assistant for enterprise. Prior to version 2.10.6-lts, function-library code running under the LDPRELOAD sandbox can invoke ctypes.CDLL from an importlib.abc.MetaPathFinder callback so the dlopen call-stack heuristic sees a Python import frame, then use unhooked dlsym...

CVE-2026-79919 MaxKB function-library sandbox escape: dlopen stack-check bypass via importlib meta-path callbacks and unhooked dlsym(RTLD_NEXT)

MaxKB is an open-source AI assistant for enterprise. Prior to version 2.10.6-lts, function-library code running under the LDPRELOAD sandbox can invoke ctypes.CDLL from an importlib.abc.MetaPathFinder callback so the dlopen call-stack heuristic sees a Python import frame, then use unhooked dlsym...

CVE-2026-94501

jshERP through 3.6 contains an authorization bypass vulnerability in the userBusiness CRUD endpoints that allows authenticated users to create, modify, or delete authorization-relation rows without privilege checks. Attackers can manipulate user-role mappings and access controls to escalate...

perl-DBI: DBI for Perl: Heap out-of-bounds write via unvalidated numeric placeholder

A flaw was found in DBI for Perl. An unvalidated numeric placeholder in the preparse function can lead to a heap out-of-bounds write. When processing an untrusted statement, a specially crafted numeric placeholder can cause the binder counter to become negative. This results in subsequent...

Atlassian Confluence 8.9.0 < 9.2.24 / 9.3.1 < 10.2.17 (CONFSERVER-104362)

The version of Atlassian Confluence Server running on the remote host is affected by a vulnerability as referenced in the CONFSERVER-104362 advisory. - Impact: The fix for CVE-2021-23337 https://github.com/advisories/GHSA-35jh-r3h4-6jhm added validation for the variable option in .template but di...

Partition-Matched Evaluation of Community Features under Distribution Shift in Android Malware Function-Call Graphs

Graph-based Android malware classifiers can lose accuracy under malware-type or family shifts. We test whether mesoscopic organization in function-call graphs provides shift-stable information beyond local degree profiles LDP, global statistics, lightweight metadata, and size-matched random...

VulnCheck KEV: CVE-2026-79756

Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. Prior to version 1.17.4, the fix for unauthenticated OS command injection in the nuclio dashboard on the local/Docker platform is incomplete. The fix added validateFunctionName for function names and common.Quote for the...

ROS-20260921-73-0113

The vulnerability of the Close function in the Go programming language is related to the operation of writing data outside the buffer in memory. Exploiting this vulnerability can allow a malicious actor to cause service failures...

Atlassian Jira Service Management Data Center and Server 5.15.2 < 10.3.24 / 10.4.x < 11.3.7 (JSDSERVER-16596)

The version of Atlassian Jira Service Management Data Center and Server Jira Service Desk running on the remote host is affected by a vulnerability as referenced in the JSDSERVER-16596 advisory. - Impact: The fix for CVE-2021-23337 https://github.com/advisories/GHSA-35jh-r3h4-6jhm added validatio...

CVE-2026-88856

Joomla Extension - OrdaSoft.com - Authenticated, Privileged Remote Code Execution in OrdaSoft Joomla Gallery extension for Joomla 6.2.7 - The extensions updateOSGallery, reached via task=updateosgallery, read a JSON request body and called the value of a method field as a live PHP function, passi...

CVE-2026-88856

OrdaSoft Joomla Gallery extension for Joomla versions

PT-2026-95935

Name of the Vulnerable Software and Affected Versions aiyiyi121 SxDevOps versions 1.0 through 1.1 Description An issue exists in the UserSerializer component within the backend/rbac/serializers.py file. A remote attacker can manipulate the update function to cause improper privilege management...

PT-2026-95996

Name of the Vulnerable Software and Affected Versions OrdaSoft Joomla Gallery versions prior to 6.2.7 Description An authenticated and privileged remote code execution issue exists in the OrdaSoft Joomla Gallery extension. The updateOSGallery function, accessible via the task=update osgallery...

CVE-2026-93985

OpenPanel js-runtime through commit bad75bdd is affected by a sandbox escape in its JavaScript webhook template validator . The validator fails to block computed member access to constructor chains, allowing attackers with project write access to craft webhook templates using computed property no...

CVE-2026-92807

The Save as PDF Plugin by PDFCrowd plugin for WordPress is vulnerable to Arbitrary Function Invocation in all versions up to, and including, 4.6.1 via the pdfcreatedcallback shortcode attribute. The evalshortcode function copies any non-button/non-email shortcode attribute verbatim into a custom...

CVE-2026-92807 Save as PDF Plugin by PDFCrowd <= 4.6.1 - Authenticated (Contributor+) Arbitrary Function Invocation / Code Injection via 'pdf_created_callback' Shortcode Attribute

The Save as PDF Plugin by PDFCrowd plugin for WordPress is vulnerable to Arbitrary Function Invocation in all versions up to, and including, 4.6.1 via the pdfcreatedcallback shortcode attribute. The evalshortcode function copies any non-button/non-email shortcode attribute verbatim into a custom...

EUVD-2026-83481

The Save as PDF Plugin by PDFCrowd plugin for WordPress is vulnerable to Arbitrary Function Invocation in all versions up to, and including, 4.6.1 via the pdfcreatedcallback shortcode attribute. The evalshortcode function copies any non-button/non-email shortcode attribute verbatim into a custom...

SUSE CVE-2026-89798

In the Linux kernel, the following vulnerability has been resolved: rpcrdma: arm rndone before publishing the notification rpcrdmarnregister inserts @rn into rdxa with xaalloc before storing the caller's callback in rn-rndone. The xarray makes @rn reachable to rpcrdmaremoveone, which walks rdxa a...

PT-2026-95828

Name of the Vulnerable Software and Affected Versions Pod::Text versions prior to 6.1.1 Description Formatting a POD document with excessive =over nesting can lead to CPU and memory exhaustion. Each =over element increases the margin, which the wrap function subtracts from the output width to...