EUVD-2026-72500

In JetBrains YouTrack before 2026.2.18634 angularJS template injection in assignee names led to stored XSS...

CVE-2026-86484

In JetBrains YouTrack before 2026.2.18634 angularJS template injection in assignee names led to stored XSS...

PT-2026-86652

Modules 5.6.2, 5.3.2 and 4.5.4 are out, fixing CVE-2026-85013: command injection in the Bash completion of module/ml via malicious module names. All versions 3.2.7 to 5.6.1 affected, please upgrade. Advisory: https://t.co/TQixdBKFPL Found by AISLE in partnership with Red Hat...

CVE-2026-19634 PostgreSQL Anonymizer: SQL injection in import_database_rules() and import_roles_rules() via crafted object names / JSON

PostgreSQL Anonymizer contains a SQL injection vulnerability in two import functions. A user can create a malicious JSON document containing specially crafted object names. If a superuser subsequently calls anon.importdatabaserules or anon.importrolesrules, the malicious code is executed with...

EUVD-2026-71791

ntop nDPI versions before 6.0 contain a heap buffer overflow vulnerability in the ndpijsonstringescape function that writes beyond caller-supplied buffer boundaries. Attackers can trigger the overflow by supplying crafted network packet data including TLS SNI, HTTP headers, or DNS names that reac...

Linux Distros Unpatched Vulnerability : CVE-2026-86098

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ntop nDPI versions before 6.0 contain a heap buffer overflow vulnerability in the ndpijsonstringescape function that writes beyond caller-supplied buffer...

Linux Distros Unpatched Vulnerability : CVE-2026-86095

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Unidata netcdf-c through 4.10.1 contains an out-of-bounds write vulnerability in NC4HDF5inqattname that copies HDF5 attribute names into a fixed 256-byte buffer...

AZL-99894 CVE-2026-86095 affecting package netcdf 4.9.0-4

Unidata netcdf-c through 4.10.1 contains an out-of-bounds write vulnerability in NC4HDF5inqattname that copies HDF5 attribute names into a fixed 256-byte buffer without length validation. Attackers can craft HDF5 files with oversized attribute names to overflow the destination buffer, causing...

CVE-2026-86098

ntop nDPI versions before 6.0 contain a heap buffer overflow vulnerability in the ndpijsonstringescape function that writes beyond caller-supplied buffer boundaries. Attackers can trigger the overflow by supplying crafted network packet data including TLS SNI, HTTP headers, or DNS names that reac...

CVE-2026-86095

Unidata netcdf-c through 4.10.1 contains an out-of-bounds write vulnerability in NC4HDF5inqattname that copies HDF5 attribute names into a fixed 256-byte buffer without length validation. Attackers can craft HDF5 files with oversized attribute names to overflow the destination buffer, causing...

CVE-2026-73848

Emlog is an open source website building system. In versions 2.6.29 and prior, tag names in emlog are not HTML-encoded when rendered in the article editor. An attacker can create a tag containing ';alertdocument.domain;//. The addslashes function does not escape HTML entities, so ' is stored as-i...

CVE-2026-85654

Amazon awslabs.dynamodb-mcp-server contains a code injection vulnerability in its CDK generator component. The root cause is improper neutralization of special elements used in a template engine , allowing a context-dependent actor to execute arbitrary code on the host that deploys the generated ...

EUVD-2026-70782

MOOS-IvP uFldShoreBroker through 24.8.1 fails to limit the number of claimed communities stored in parallel vectors within ShoreBroker::handleMailNodePing. A single publisher can supply unbounded distinct community names to grow retained state and per-pass work without limit, causing memory...

CVE-2026-85426

MOOS-IvP uMemWatch through 24.8.1 constructs shell commands from attacker-chosen MOOS client names without sanitization. Attackers can inject shell metacharacters into client names to execute arbitrary commands as the uMemWatch process user through unquoted redirection targets in system calls...

gitpython: GitPython: Arbitrary file creation via path traversal in .gitmodules submodule names

A flaw was found in GitPython where it fails to properly validate submodule names within .gitmodules files. A remote attacker could craft a malicious Git repository containing specially formed submodule names with directory traversal sequences. When GitPython processes these malicious submodule...

CVE-2026-85448 MOOS-IvP through 24.8.1 uFldShoreBroker Unbounded Community State Retention

MOOS-IvP uFldShoreBroker through 24.8.1 fails to limit the number of claimed communities stored in parallel vectors within ShoreBroker::handleMailNodePing. A single publisher can supply unbounded distinct community names to grow retained state and per-pass work without limit, causing memory...

CVE-2026-85426 MOOS-IvP through 24.8.1 uMemWatch Command Injection via MOOS Client Names

MOOS-IvP uMemWatch through 24.8.1 constructs shell commands from attacker-chosen MOOS client names without sanitization. Attackers can inject shell metacharacters into client names to execute arbitrary commands as the uMemWatch process user through unquoted redirection targets in system calls...

CVE-2026-85426

MOOS-IvP uMemWatch (through version 24.8.1) is vulnerable to command injection via MOOS client names. The component constructs shell commands from attacker-controlled client names without sanitization, specifically through unquoted redirection targets in system calls (see MemWatch.cpp). An attack...

CVE-2026-85426 MOOS-IvP through 24.8.1 uMemWatch Command Injection via MOOS Client Names

MOOS-IvP uMemWatch through 24.8.1 constructs shell commands from attacker-chosen MOOS client names without sanitization. Attackers can inject shell metacharacters into client names to execute arbitrary commands as the uMemWatch process user through unquoted redirection targets in system calls...

PT-2026-85298

Name of the Vulnerable Software and Affected Versions MOOS-IvP pMarineViewer versions prior to 24.8.2 Description An issue exists where the software fails to limit the number of tracked node identities received from NODE REPORT messages. An unauthenticated attacker can publish crafted NODE REPORT...