CVE-2026-67305

FreeRDP Windows client before 3.29.0 contains a heap buffer overflow vulnerability in the clipboard virtual channel when processing CLIPRDRFILECONTENTSRESPONSE PDUs without validating the server-provided size against the destination buffer. A malicious RDP server can send a response with a data...

Langflow < 1.9.0 - Remote Code Execution

Langflow versions prior to 1.9.0 are vulnerable to unauthenticated remote code execution RCE via the buildpublictmp endpoint. Attackers can submit a manipulated flow JSON containing Python code that is executed during the build process without proper sandboxing. id: CVE-2026-33017 info: name:...

CVE-2026-65882

CVE-2026-65882 affects the Joomla Extension joomdle.com, specifically Joomdle versions prior to 3.1.1. The vulnerability is a reflected XSS in the moodle wrapper endpoint, exploitable via the goto url parameter. The CVSS-based assessment in the documents shows Network attack vector, required user...

CVE-2026-48145

The CVE concerns Apache Thrift’s C++ bindings, specifically the TSSLSocket matchName() path, where improper validation of certificates with host mismatches is reported. Affected versions are Thrift before 0.24.0. The vulnerability arises from RFC 6125 wildcard handling in the certificate host mis...

CVE-2026-61425 Joomla Extension - balbooa.com - Authentication bypass in Gridbox < 1.6.0

Joomla Extension - balbooa.com - Authentication bypass in Gridbox 1.6.0 - The Joomla extension Gridbox is vulnerable an authenticated bypass, potentially leading to full admin access...

CVE-2026-60029

The CVE concerns Joomla extension Quix Page Builder Pro (thethemexpert) with an authenticated stored XSS flaw. The issue allows an authenticated builder user to break out of id/class fields that render to public pages. Affected version(s) are Quix Page Builder Pro before 6.2.1; remediation is upg...

CVE-2026-63757

SurrealDB versions before 3.1.0 contain a session hijacking vulnerability where the HTTP /rpc sessions method returns attached session UUIDs without authentication and accepts arbitrary session fields with no ownership verification. Unauthenticated attackers can enumerate session UUIDs and...

CVE-2026-9537

Mojo::JWT versions before 1.02 for Perl verify HMAC signatures with a non-constant-time string comparison. The decode method compares the supplied signature to the recomputed HMAC with Perl's eq operator, which stops at the first differing byte, so the comparison time varies with the number of...

PT-2026-60976

Name of the Vulnerable Software and Affected Versions joe versions prior to 4.6-4.1 Description An issue allows arbitrary command execution through the use of a malicious tags file. Recommendations Update to version 4.6-4.1...

CVE-2026-58319

Certain Apache Doris FE HTTP REST administrative APIs were accessible without proper authentication. An unauthenticated attacker with network access to the FE HTTP service could perform unauthorized administrative operations, potentially affecting cluster integrity and availability and leading to...

CVE-2026-50721 affecting package libreswan for versions less than 4.15-2

CVE-2026-50721 affecting package libreswan for versions less than 4.15-2. A patched version of the package is available...

CVE-2026-59796

CVE-2026-59796 affects JetBrains TeamCity prior to 2026.1.2. The issue arises from improper permission checks that could allow pipeline modification. Documented impact is pipeline modification with high impact on confidentiality and integrity (per CVSS 3.1: AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N). N...

CVE-2026-42506 affecting package dasel for versions less than 2.8.1-4

CVE-2026-42506 affecting package dasel for versions less than 2.8.1-4. A patched version of the package is available...

CVE-2026-42502 affecting package keda for versions less than 2.14.1-14

CVE-2026-42502 affecting package keda for versions less than 2.14.1-14. A patched version of the package is available...

CVE-2026-48934 affecting package nodejs for versions less than 24.17.0-1

CVE-2026-48934 affecting package nodejs for versions less than 24.17.0-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-42502 affecting package containerd2 for versions less than 2.2.4-4

CVE-2026-42502 affecting package containerd2 for versions less than 2.2.4-4. A patched version of the package is available...

CVE-2026-60001

sshd in OpenSSH before 10.4 does not always honor the minimum authentication delay...

Foxit PDF Editor for Mac < 14.0.5 / 2026.1.2 Multiple Vulnerabilities

According to its version, the Foxit PDF Editor for Mac application previously named Foxit PhantomPDF for Mac installed on the remote macOS host is prior to 2026.1.2/14.0.5. It is, therefore affected by multiple vulnerabilities: Note that Nessus has not tested for this issue but has instead relied...

CVE-2026-26307

Gitea versions before 1.25.5 do not enforce a timeout on git grep searches, allowing expensive searches to consume server resources...

Mozilla Thunderbird < 140.12.1

The version of Thunderbird installed on the remote macOS or Mac OS X host is prior to 140.12.1. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2026-64 advisory. - An attacker who can send HTML chat messages via Matrix or XMPP can inject arbitrary styled content,...