EUVD-2026-56295

Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network...

EUVD-2026-56294

Relative path traversal in Microsoft Office SharePoint allows an authorized attacker to disclose information over a network...

EUVD-2026-56293

Improper authentication in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network...

EUVD-2026-56292

Improper neutralization of input during web page generation 'cross-site scripting' in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network...

CVE-2026-57105

Improper neutralization of input during web page generation 'cross-site scripting' in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network...

CVE-2026-65768

CVE-2026-65768 is a Microsoft Teams for Android path traversal leading to remote code execution over a network. The root cause is an improper limitation of a pathname to a restricted directory, enabling an unauthenticated, network-based attacker to run code. Public CVSS data assigns a high/critic...

CVE-2026-68321

A flaw was found in the Linux kernel. A resource leak vulnerability exists in the txgbe network driver. This flaw occurs because Flow Director FDIR filters are not properly freed when the network interface is removed while it is in a down state. This can lead to a gradual consumption of system...

CVE-2026-68335

A flaw was found in the Linux kernel's Reliable Datagram Sockets RDS component. The RDS component incorrectly handles incoming messages that cross network namespace boundaries, allowing a sender in one network namespace to deliver a message to a socket in a different network namespace. This can...

CVE-2026-68290

A flaw was found in the Linux kernel's Reliable Datagram Sockets RDS TCP implementation. A race condition can occur during network namespace teardown, where a concurrent system control sysctl write operation attempts to access a socket that has already been freed. This use-after-free vulnerabilit...

MAL-2026-13747 Malicious code in base65-13x (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 59226f2c38efcc1dd5de6423edfc866125564cd726915307d7a05ca5b5f13529 [email protected] impersonates cryptocoinjs/base-x, reusing its README, homepage, and API surface, but the exported decodestring function in both...

MAL-2026-13746 Malicious code in base65-12x (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 79b553d84d7f4dc5347840ddb97f16738eed2e52ac9757b48d2cb31ba1af7122 The package name base65-12x typosquats the popular base-x base-encoding library and reuses base-x's repository as its homepage. Both the CJS entry...

Malicious code in base65-13x (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 59226f2c38efcc1dd5de6423edfc866125564cd726915307d7a05ca5b5f13529 [email protected] impersonates cryptocoinjs/base-x, reusing its README, homepage, and API surface, but the exported decodestring function in both...

CVE-2026-71387 ColdFusion | Incorrect Authorization (CWE-863)

ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. The vulnerable component is restricted to an administrative network zone by...

CVE-2026-71387

CVE-2026-71387 affects ColdFusion with an Incorrect Authorization vulnerability that can allow arbitrary code execution in the context of the current user. The issue is exploitable without user interaction and the vulnerable component is restricted to an administrative network zone by default. Th...

EUVD-2026-56550

ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. The vulnerable component is restricted to an administrative network zone by...

EUVD-2026-56538

is affected by a Cross-site Scripting XSS vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. The vulnerable component is restricted to an administrative network zone by default...

CVE-2026-73082

Activepieces (open source AI workflow automation) has an SSRF vulnerability in the POST /api/v1/projects/:projectId/mcp-server/validate-agent-mcp-tool endpoint. Before version 0.82.0, an authenticated user could cause the server to issue outbound HTTP or SSE requests to a user-supplied serverUrl ...

CVE-2026-73082 Activepieces: Server-side request forgery in MCP tool validation endpoint

Activepieces is an open source AI workflow automation platform. Prior to 0.82.0, the POST /api/v1/projects/:projectId/mcp-server/validate-agent-mcp-tool endpoint makes an outbound HTTP or SSE request to a user-supplied serverUrl without URL validation or SSRF protection. An authenticated user can...

EUVD-2026-56534

Activepieces is an open source AI workflow automation platform. Prior to 0.82.0, the POST /api/v1/projects/:projectId/mcp-server/validate-agent-mcp-tool endpoint makes an outbound HTTP or SSE request to a user-supplied serverUrl without URL validation or SSRF protection. An authenticated user can...

CVE-2026-73082 Activepieces: Server-side request forgery in MCP tool validation endpoint

Activepieces is an open source AI workflow automation platform. Prior to 0.82.0, the POST /api/v1/projects/:projectId/mcp-server/validate-agent-mcp-tool endpoint makes an outbound HTTP or SSE request to a user-supplied serverUrl without URL validation or SSRF protection. An authenticated user can...