CVE-2026-65010

The CVE-2026-65010 entry covers a symlink-following vulnerability in Datasets (versions up to 5.00) within Extractor.extract(), where pre-placed symlinks at predictable output paths allow a local attacker to write arbitrary files in shared-cache environments. This could enable overwriting sensiti...

Updated cifs-utils packages fix a security vulnerability

The updated packages fix a security vulnerability: Local privilege escalation via forged cifs.spnego key description in cifs.upcall. CVE-2026-12505...

CVE-2026-15616 Local MFA not enforced during SSO sign-in

Logto does not enforce locally configured MFA during SSO authentication, allowing users to bypass second-factor requirements and grants unauthorized access...

JLSEC-2026-779

A malicious SCP server can send unexpected paths that could make the client application override local files outside of working directory. This could be misused to create malicious executable or configuration files and make the user execute them under specific consequences. This is the same issue...

CVE-2026-16735

The CVE concerns release-it conventional-changelog up to 11.0.1, where the writeChangelog function in index.js of the Changelog File Handler is vulnerable. Manipulation of the infile argument enables local OS command injection, with the exploit publicly disclosed. The attack is local and requires...

CVE-2026-16733

The CVE refers to bahmutov find-cypress-specs (up to version 1.54.12) where the function shell.exec in src/index.js of the Branch Handler is vulnerable. Manipulating the --branch argument leads to OS command injection. The attack is described as locally executable, with the exploit publicly avail...

kernel: xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete

A flaw was found in the Linux kernel's xfrm IPSec framework subsystem. This vulnerability, a use-after-free, occurs when the system incorrectly manages memory related to security policies, specifically during the deletion of xfrmstate lists. An attacker with local access could exploit this flaw b...

CVE-2026-64805

In JetBrains WebStorm before 2026.2 arbitrary code execution was possible before granting project trust via project-local package-manager tooling...

PYSEC-2026-3459 Anki's local HTTP server does not sufficiently validate requests

Summary Anki launches a local HTTP server to serve media files and web pages for parts of its interface. While the server has a CORS setup, requests from other origins were not blocked, allowing malicious websites to potentially trigger side-effecting requests. Browser impact The severity varies ...

PYSEC-2026-3517 PraisonAI: Missing Authentication for Critical Function and Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in praisonai

Unauthenticated PraisonAI UI MCP connect endpoint executes attacker-chosen local commands Summary PraisonAI v4.6.48 exposes the PraisonAIUI MCP client management API through the default UI host apps without authentication. A remote unauthenticated client can send POST /api/mcp/connect with a...

PYSEC-2026-3522 PraisonAI: Compute-bridged file tools allow shell command injection

Compute-bridged file tools allow shell command injection Summary LocalManagedAgent / SandboxedAgent compute bridging wraps readfile, listfiles, and writefile when a compute provider is attached. The bridge converts those file operations into shell command strings using raw path arguments, then...

PYSEC-2026-3488 ms-swift: Image Cache Hash Collision via Missing Dimension Metadata

A security vulnerability has been detected in modelscope ms-swift up to 4.2.0. This affects the function Template.savepilimage of the file swift/template/base.py of the component PIL Image Cache Key Handler. The manipulation leads to use of weak hash. An attack has to be approached locally. A hig...

EUVD-2026-48230

In JetBrains WebStorm before 2026.2 arbitrary code execution was possible before granting project trust via project-local package-manager tooling...

CVE-2026-64805

In JetBrains WebStorm before 2026.2 arbitrary code execution was possible before granting project trust via project-local package-manager tooling...

CVE-2026-64804

JetBrains WebStorm is affected by CVE-2026-64804: before version 2026.2, arbitrary code execution could occur before granting project trust when using project-local linter tooling. The NVD entry lists a CVSS v3.1 base score of 8.4 (HIGH), with LOCAL attack vector, no user interaction required, an...

CVE-2026-65481

CVE-2026-65481 affects WordPress Vino theme

EUVD-2026-48092

Contributor Local File Inclusion in Vino = 1.9 versions...

EUVD-2026-48088

Contributor Local File Inclusion in Tonda Core = 2.1.2 versions...

CVE-2026-65477

CVE-2026-65477 affects the WordPress Tonda Core plugin, version ≤ 2.1.2, with a Local File Inclusion vulnerability. Root cause: LFI in Tonda Core ≤ 2.1.2. Impact includes high confidentiality, integrity, and availability risk (CVSS 3.1: 7.5, AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H). Exploitation stat...

EUVD-2026-47912

Joomla Extension - regularlabs.com - Insecure path handling in CDN for Joomla Pro extension - CDN versioning could check file paths outside the site directory, exposing local file existence and modification metadata...