CVE-2026-71640: Improper Check or Handling of Exceptional Conditions

An issue in ZJU-FAST-Lab EGO-Planner-v2 All versions up to commit 5c99a95880401e2599638d567abc0e240396cb42 allows unsafe vehicle motion via improper handling of expired trajectory data in the replanning pipeline...

CVE-2026-71640

The ZJU-FAST-Lab EGO-Planner-v2 software is affected by a vulnerability in all versions up to commit 5c99a95880401e2599638d567abc0e240396cb42 . The root cause is the improper handling of expired trajectory data within the replanning pipeline, which can lead to unsafe vehicle motion . Exploitation...

BIT-ELK-2026-78593 Improper Control of Generation of Code in Kibana Leading to Privilege Escalation

An insufficiently validated configuration field in Kibana's Cribl integration allows an authenticated user holding Kibana Fleet management privileges to inject attacker-controlled expressions into a server-side script template, resulting in an Elasticsearch ingest pipeline being written beyond th...

Linux Distros Unpatched Vulnerability : CVE-2026-82052

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The $regexFindAll expression can be used by an authenticated user who can run aggregation pipeline stages to crash a MongoDB server mongod. Under certain specif...

CVE-2026-87057

A flaw was found in olm-operator-konflux-sample. The build pipelines use mutable floating tags to reference runtime base images instead of immutable SHA256 digests. This configuration allows for the content of the base images to be altered without detection, potentially leading to the introductio...

CVE-2026-87050

A flaw was found in operator-foundry. GitHub Actions and reusable workflows within the component are referenced using mutable tags e.g., @v0, @v4 instead of fixed commit SHAs. This allows an attacker to potentially alter the code executed in the Continuous Integration CI pipeline through an...

EUVD-2026-69701

Predis: Redis command injection and denial of service via CRLF smuggling in pipelined commands on aggregate connections...

Predis: Redis command injection and denial of service via CRLF smuggling in pipelined commands on aggregate connections

Summary An improper CRLF neutralization flaw in Predis' pipeline handling on aggregate connections lets an unauthenticated attacker who can influence any pipelined argument — a value or a key, e.g. a URL slug used as a cache key — smuggle arbitrary Redis commands into the connection. - On cluster...

CRLF Injection

Overview Affected versions of this package are vulnerable to CRLF Injection in AbstractAggregateConnection::write in src/Connection/AbstractAggregateConnection.php, which re-parses the already serialized pipeline buffer by splitting on \r\n and rebuilding chunks through Command::deserializeComman...

CVE-2026-81821 AVEVA Pipeline Integrity Monitor Use of hard-coded cryptographic key

The vulnerability, if exploited, could allow a miscreant with read access to PIMBoards project files to decrypt and view sensitive information...

CVE-2026-81821

CVE-2026-81821 affects AVEVA Pipeline Integrity Monitor (PIMBoards) due to the use of a hard-coded cryptographic key . An attacker with local read access to PIMBoards project files can decrypt and view sensitive information stored within them. The CVSS 3.1 score is 8.4 (HIGH) with changed scope, ...

CVE-2026-81821 AVEVA Pipeline Integrity Monitor Use of hard-coded cryptographic key

The vulnerability, if exploited, could allow a miscreant with read access to PIMBoards project files to decrypt and view sensitive information...

CVE-2026-81822 AVEVA Pipeline Integrity Monitor Use of a Broken or Risky Cryptographic Algorithm

The vulnerability, if exploited, could allow a miscreant with read access to PIMBoards project files to reverse engineer PIMBoards users’ app-native passwords through computational brute-forcing of weak hashes, potentially allowing elevation to a PIMBoards administrator user...

CVE-2026-81823 AVEVA Pipeline Integrity Monitor Missing Authorization

The vulnerability, if exploited, could allow an unauthenticated miscreant to perform read operations intended only for PIMBoards users, resulting in information disclosure. Write operations are not impacted...

CVE-2026-81823 AVEVA Pipeline Integrity Monitor Missing Authorization

The vulnerability, if exploited, could allow an unauthenticated miscreant to perform read operations intended only for PIMBoards users, resulting in information disclosure. Write operations are not impacted...

CVE-2026-81824 AVEVA Pipeline Integrity Monitor cross-site scripting

The vulnerability, if exploited, could allow a miscreant to run arbitrary JavaScript code in a browser session of a PIMBoards user who was socially engineered to click on a malicious link...

CVE-2026-81824

CVE-2026-81824 affects AVEVA Pipeline Integrity Monitor (PIMBoards) and is a cross-site scripting (XSS) vulnerability. If exploited, it allows an attacker to execute arbitrary JavaScript code in the browser session of a PIMBoards user who was socially engineered into clicking a malicious link. Th...

CVE-2026-82052

The $regexFindAll expression can be used by an authenticated user who can run aggregation pipeline stages to crash a MongoDB server mongod. Under certain specific conditions the regex match can start in the middle of a multi-code-unit character, triggering an assertion during query execution...

EUVD-2026-72939

The $regexFindAll expression can be used by an authenticated user who can run aggregation pipeline stages to crash a MongoDB server mongod. Under certain specific conditions the regex match can start in the middle of a multi-code-unit character, triggering an assertion during query execution...

CVE-2026-82052 $regexFindAll may crash mongod server when byte-matching multi-byte UTF-8 chars

The $regexFindAll expression can be used by an authenticated user who can run aggregation pipeline stages to crash a MongoDB server mongod. Under certain specific conditions the regex match can start in the middle of a multi-code-unit character, triggering an assertion during query execution...