XML External Entity (XXE) Injection

Overview org.mapfish.print:print-lib is a component of MapFish for printing templated cartographic maps. Affected versions of this package are vulnerable to XML External Entity XXE Injection in the GML layer processing of the print report endpoint buildreport.pdf, which parses GML XML without...

CVE-2026-55891: Improper Encoding or Escaping of Output

PrivateBin is an online pastebin where the server has zero knowledge of pasted data. Prior to 2.0.5, Request::getRequestUri in lib/Request.php passes $SERVER'REQUESTURI' through FILTERSANITIZEURL, which does not remove quotation marks, angle brackets, or apostrophes, and Controller::init stores t...

CVE-2026-37751: Improper Neutralization of Special Elements used in an OS Command

An OS command injection vulnerability in the killSessionSync function lib/agent-runtime.ts of 23blocks-OS ai-maestro v0.24.17 allows attackers to execute arbitrary commands via a crafted input...

CVE-2026-66353: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in woylie doggo allows Reflected XSS. Doggo.normalizevalue/2 in lib/doggo.ex returned date field values wrapped in :safe, ..., the Phoenix.HTML marker meaning "already escaped, emit verbatim", without...

CVE-2026-81334: Out-of-bounds Read

darknet subscripts its layer array with an index taken from a configuration file without checking it against the array's length. The array is allocated in src-lib/darknetnetwork.cpp as xcallocnet.n, sizeofDarknet::Layer, sized to exactly the number of layer sections the file declares. The shortcu...

Linux Distros Unpatched Vulnerability : CVE-2026-74751

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: riscv: lib: Fix ZBB strnlen reading past count boundary The ZBB-optimized strnlen loop loads...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: bison (UTSA-2026-093642)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-093642 advisory. GNU Bison before 3.7.1 has a use-after-free in obstackfree in lib/obstack.c called from gramlex when a '\0' byte is encountered. NOTE: there is a risk only if Bison ...

shadcn-ui-lib (>=0.0.9, <=0.1.1) potentially affected by CVE-2026-55596 via @platejs/media (53.0.0)

@platejs/media NPM version 53.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on @platejs/media and may be impacted: - shadcn-ui-lib =0.0.9, =0.1.1 Source cves: CVE-2026-55596 Source advisory: OSV:GHSA-QJ6X-XX2H-8HVV...

The vulnerability of the audit_classes_init() function in the lib/audit.c module of the Linux kernel allows a hacker to trigger a service failure.

The vulnerability of the auditclassesinit function in the lib/audit.c module of the Linux kernel is related to a breach of data protection mechanisms. Exploiting this vulnerability could allow an attacker to cause a service failure...

PT-2026-94329

Name of the Vulnerable Software and Affected Versions vm2 versions 2.0.0 through 3.11.6 Description NodeVM contains a builtin-module denylist bypass. When the embedder uses the builtin wildcard with negative entries in the require configuration, negative entries are matched by exact module name i...

PT-2026-94323

Name of the Vulnerable Software and Affected Versions vm2 versions 3.11.4 through 3.11.6 Description Internal Node.js registered symbols are incompletely filtered across the sandbox boundary. The extraction filters in lib/setup-sandbox.js and the cross-realm symbol checks and write traps in...

CVE-2026-13217: NULL Pointer Dereference

The OCPP 1.6 client in subsys/net/lib/ocpp/ocpp.c reconstructs a session handle and PDU id from the uid field of a CALLRESULT message. In ocppprocessservermsg the code calls atoistrtokruid, "-", &tmp without checking the strtokr return value. When the server-supplied uid is empty or contains no -...

Malicious code in hyper-sharp-lib (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

MAL-2026-15710 Malicious code in hyper-sharp-lib (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

CVE-2026-65053: Improper Neutralization of Input During Web Page Generation

Horde IMP's AppleDouble MIME viewer writes an attacker-controlled attachment name into an HTML status block without escaping it. In lib/Mime/Viewer/Appledouble.php, IMPrender obtains the name of the data part with IMPContents::getPartName, which returns the MIME part's own name parameter as...

CVE-2026-78062: Use of Hard-coded Credentials

A vulnerability was identified in vas3k TaxHacker up to 0.8.2. The affected element is the function envSchema.parse of the file lib/config.ts of the component JWT Secret Handler. The manipulation of the argument BETTERAUTHSECRET leads to hard-coded credentials. The attack can be initiated remotel...

CVE-2026-62381

luci-lib-px5g LuCI contains a heap-based buffer overflow in the native ASN.1 encoding routine asn1addobj x509write.c when signing a certificate with a 2040-bit RSA key. For a 255-byte signature, the BIT STRING allocation is computed from the DER length encoding of 255 bytes, but the payload writt...

CVE-2026-62381 luci-lib-px5g 2040-bit Certificate Signing Heap Buffer Overflow

luci-lib-px5g LuCI contains a heap-based buffer overflow in the native ASN.1 encoding routine asn1addobj x509write.c when signing a certificate with a 2040-bit RSA key. For a 255-byte signature, the BIT STRING allocation is computed from the DER length encoding of 255 bytes, but the payload writt...

CVE-2026-62381 luci-lib-px5g 2040-bit Certificate Signing Heap Buffer Overflow

luci-lib-px5g LuCI contains a heap-based buffer overflow in the native ASN.1 encoding routine asn1addobj x509write.c when signing a certificate with a 2040-bit RSA key. For a 255-byte signature, the BIT STRING allocation is computed from the DER length encoding of 255 bytes, but the payload writt...

EUVD-2026-64273

luci-lib-px5g LuCI contains a heap-based buffer overflow in the native ASN.1 encoding routine asn1addobj x509write.c when signing a certificate with a 2040-bit RSA key. For a 255-byte signature, the BIT STRING allocation is computed from the DER length encoding of 255 bytes, but the payload writt...