PT-2026-71595

amazing-print/amazing print at commit dc890dfafdf07088ea901df53c19c2710e5c5234 contains a Ruby code injection condition in AwesomeMethodArraygrep. A specially named method containing Ruby interpolation syntax can be interpolated into a dynamically constructed eval string when grep is called with ...

EUVD-2026-58030

amazing-print/amazingprint at commit dc890dfafdf07088ea901df53c19c2710e5c5234 contains a Ruby code injection condition in AwesomeMethodArraygrep. A specially named method containing Ruby interpolation syntax can be interpolated into a dynamically constructed eval string when grep is called with a...

CVE-2026-67986

amazing-print/amazingprint at commit dc890dfafdf07088ea901df53c19c2710e5c5234 contains a Ruby code injection condition in AwesomeMethodArraygrep. A specially named method containing Ruby interpolation syntax can be interpolated into a dynamically constructed eval string when grep is called with a...

Cisco Identity Services Engine zipFiles Directory Traversal Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Cisco Identity Services Engine. Authentication is required to exploit this vulnerability. The specific flaw exists within the zipFiles method. The issue results from the lack of proper validation of ...

CVE-2026-19566

Net::CIDR::Set versions before 0.23 for Perl allow memory exhaustion and malformed set ranges via unbounded IPv6 prefix lengths. The encode method accepts any prefix length matching 0|1-90-9 and passes it to width2bits, which builds the mask as '1' x $width + 8, one character per bit. The inc...

CVE-2026-9318

tablib prior to 3.10.0 contains a stored cross-site scripting vulnerability in the HTML export functionality that allows attackers to execute arbitrary JavaScript by embedding malicious payloads in dataset titles, which are interpolated unsanitized into HTML output via the exportbook method in th...

PT-2026-76556

Name of the Vulnerable Software and Affected Versions Winter CMS versions prior to 1.2.13 Description An issue exists where the backend fails to validate the handler name submitted via the handler POST field during form postbacks. While AJAX requests are validated against the onA-Zw+ pattern, the...

PT-2026-75979

Impact Affected versions of Winter CMS did not validate the handler name submitted through the form postback mechanism handler POST field in the same way as AJAX requests X WINTER REQUEST HANDLER header. The AJAX path validates that handler names match the onA-Zw+ pattern, but the postback path...

PT-2026-71030

The ProSolution WP Client WordPress plugin before 2.0.9 does not validate a user-supplied URL, and does not check the capability or nonce of the requester, before performing a server-side HTTP request with it, allowing any authenticated user, such as a subscriber, to make the site issue arbitrary...

CVE-2026-18703

An issue in MongoDB Server could allow a party with a valid client certificate and a corresponding user account to authenticate using a certificate-based authentication method, even when an administrator has configured the server to restrict authentication to other mechanisms. This could allow...

CVE-2026-18703 Improper Enforcement of Authentication Mechanism Restrictions in MongoDB Server Allows Use of Disabled Authentication Method

An issue in MongoDB Server could allow a party with a valid client certificate and a corresponding user account to authenticate using a certificate-based authentication method, even when an administrator has configured the server to restrict authentication to other mechanisms. This could allow...

udisks2: udisks2: Local Privilege Escalation via as-user option spoofing

A flaw was found in udisks2. A local attacker with an active console session can exploit insufficient authorization checking on the 'as-user' option in the org.freedesktop.UDisks2.Filesystem.Mount D-Bus method. This allows the attacker to spoof the 'as-user' parameter, mounting filesystems on...

CVE-2026-19516 CVE-2026-19516 CVE Record

A caller-supplied X-Grafana-URL request header controls the destination of mcp-grafana's outbound requests, and the grafanaapirequest tool lets the caller also choose the HTTP method, path, and body. Because the destination is not restricted to the configured Grafana instance, a caller can direct...

EUVD-2026-55938

A caller-supplied X-Grafana-URL request header controls the destination of mcp-grafana's outbound requests, and the grafanaapirequest tool lets the caller also choose the HTTP method, path, and body. Because the destination is not restricted to the configured Grafana instance, a caller can direct...

PT-2026-70131

Name of the Vulnerable Software and Affected Versions ZoneMinder version 1.39.17 Description An authenticated user can execute OS commands due to a broken permission check within the Filter class. The canEdit and canDelete functions call nonexistent methods on the ZMUser class, which triggers the...

PT-2026-70062

Name of the Vulnerable Software and Affected Versions mcp-grafana versions prior to 1.1.0 Description An authentication bypass allows unauthenticated attackers to use self-generated session IDs to gain access to the server's Grafana service account. This can be chained with a server-side request...

Eclipse Foundation OpenJ9: Eclipse OpenJ9: Incorrect method delegation can lead to integrity issues

A flaw was found in Eclipse OpenJ9. When executing specially crafted class files, the Java Virtual Machine JVM incorrectly delegates method calls from a recompiled abstract superclass method to an interface default method. This can lead to unexpected program behavior and potential data integrity...

Eclipse Foundation OpenJ9: Eclipse OpenJ9: Incorrect method delegation can lead to integrity issues

A flaw was found in Eclipse OpenJ9. When executing specially crafted class files, the Java Virtual Machine JVM incorrectly delegates method calls from a recompiled abstract superclass method to an interface default method. This can lead to unexpected program behavior and potential data integrity...

Eclipse Foundation OpenJ9: Eclipse OpenJ9: Buffer underflow via tracing method arguments

A flaw was found in Eclipse OpenJ9. When using the -Xtrace option to trace method arguments, a buffer underflow vulnerability can occur. This could potentially lead to memory corruption, impacting the integrity and availability of the application...

CVE-2026-68346

CVE-2026-68346 concerns the Linux kernel ALSA hda cs35l41 ACPI mute handling. The issue arises when cs35l41_get_acpi_mute_state() calls a _DSM method to obtain the ACPI mute state and reads the first byte of the returned object, but the returned ACPI object is not freed, causing a leak per query....