CVE-2026-5667

Technical details (affected models, root cause specifics, versions, and fixes) are not publicly available in the provided documents. Monitor for updates as more information may be released.

SUSE-SU-2026:22151-1 Security update for python-starlette

This update for python-starlette fixes the following issues - CVE-2025-54121: denial-of-service when parsing a multi-part form with large files bsc1246855. - CVE-2025-62727: DoS via Range header merging bsc1252805. - CVE-2026-48710: Missing Host header validation poisons request.url.path, bypassi...

OPENSUSE-SU-2026:20975-1 Security update for python-starlette

This update for python-starlette fixes the following issues - CVE-2025-54121: denial-of-service when parsing a multi-part form with large files bsc1246855. - CVE-2025-62727: DoS via Range header merging bsc1252805. - CVE-2026-48710: Missing Host header validation poisons request.url.path, bypassi...

PT-2026-50372

Missing Authorization vulnerability in ali2woo AliNext allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects AliNext: from n/a through 3.3.5...

PT-2026-50362

Name of the Vulnerable Software and Affected Versions Mitsubishi Electric Room Air Conditioners affected versions not specified Mitsubishi Electric Wireless LAN Adapters for Room Air Conditioners affected versions not specified Mitsubishi Electric Wireless LAN Adapters for Packaged Air Conditione...

CVE-2026-5667: Use of Hard-coded Credentials

Use of Hard-coded Credentials vulnerability in Mitsubishi Electric Room Air Conditioners for Japan and outside Japan; Wireless LAN Adapters for Room Air Conditioners for Japan and outside Japan; Wireless LAN Adapters for Packaged Air Conditioners for Japan and outside Japan; Refrigerators for...

CVE-2026-47277 Runtipi: Unauthenticated arbitrary file read through app-store logo symlinks

Runtipi is a personal homeserver orchestrator. In versions 4.9.1 through 4.9.3, Runtipi serves marketplace app logos from files inside cloned app-store repositories through an unauthenticated endpoint, which leads to arbitrary file read through app-store logo symlinks. The path guard checks only...

CVE-2026-46888

Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM component: Database Upgrade. Supported versions that are affected are 17.0-26.5. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Siebel CRM Deployment executes to...

CVE-2024-22451

Dell Peripheral Manager, versions from 1.5.1 to 1.7.2, contain an uncontrolled search path element vulnerability. An attacker could potentially exploit this vulnerability through preloading malicious executable, leading to arbitrary code execution...

CVE-2026-42089

The CVE concerns yeoman-environment. Vulnerable versions 2.9.0 through 6.0.0 install missing local generator packages from attacker-controlled names without user confirmation, via installLocalGenerators() calling repository.install(). This can cause arbitrary package installation and code executi...

CVE-2024-22451

Dell Peripheral Manager, versions from 1.5.1 to 1.7.2, contain an uncontrolled search path element vulnerability. An attacker could potentially exploit this vulnerability through preloading malicious executable, leading to arbitrary code execution...

CVE-2024-22451

Dell Peripheral Manager, versions from 1.5.1 to 1.7.2, contain an uncontrolled search path element vulnerability. An attacker could potentially exploit this vulnerability through preloading malicious executable, leading to arbitrary code execution...

@a1st/aix (>=0.0.3, <=0.8.0), @a1st/aix-core (>=0.2.0, <=0.8.0) +18 more potentially affected by CVE-2026-54298 via astro (>=6.0.0-beta.1, <=6.4.4)

astro NPM version =6.0.0-beta.1, =0.0.3, =0.2.0, =1.11.1, =2.7.0, =0.3.0, =1.4.1, =0.19.0, =0.19.0, =1.10.0, =1.0.0, =1.1.0 and more Source cves: CVE-2026-54298 Source advisory: SNYK:JS-ASTRO-17356187...

@3onedata/alsatian (>=0.1.8-fix.3, <=0.1.8-fix.5), @activepieces/piece-ai (>=0.3.1, <=0.3.4) +805 more potentially affected by CVE-2026-54289 via hono (>=4.0.0, <=4.12.24)

hono NPM version =4.0.0, =0.1.8-fix.3, =0.3.1, =0.0.138, =0.0.138, =0.0.138, =0.0.138, =0.0.138, =0.9.0, =0.1.0, =0.1.9, =0.2.0, =0.0.1-alpha.0, =0.0.1-alpha.37 and more Source cves: CVE-2026-54289 Source advisory: OSV:GHSA-WGPF-JWQJ-8H8P...

@3onedata/alsatian (>=0.1.8-fix.3, <=0.1.8-fix.5), @activepieces/piece-ai (>=0.3.1, <=0.3.4) +805 more potentially affected by CVE-2026-54289 via hono (>=4.0.0, <=4.12.24)

hono NPM version =4.0.0, =0.1.8-fix.3, =0.3.1, =0.0.138, =0.0.138, =0.0.138, =0.0.138, =0.0.138, =0.9.0, =0.1.0, =0.1.9, =0.2.0, =0.0.1-alpha.0, =0.0.1-alpha.37 and more Source cves: CVE-2026-54289 Source advisory: SNYK:JS-HONO-17356391...

@a1st/aix (>=0.0.3, <=0.8.0), @a1st/aix-core (>=0.2.0, <=0.8.0) +17 more potentially affected by CVE-2026-50146 via astro (>=6.0.0-beta.1, <=6.3.1)

astro NPM version =6.0.0-beta.1, =0.0.3, =0.2.0, =1.11.1, =2.7.0, =0.3.0, =1.4.1, =0.19.0, =0.19.0, =1.10.0, =1.0.0, =1.4.2, =1.4.8 and more Source cves: CVE-2026-50146 Source advisory: SNYK:JS-ASTRO-17356186...

NPM: Nuxt dev server vite-node IPC socket is world-connectable on Linux

NPM: Nuxt dev server vite-node IPC socket is world-connectable on Linux vulnerability discovered by ? in WordPress Npm nuxt versions = 3.18.0, 3.21.7...

@cwa/nuxt-edge (>=1.0.0-29304822.f444f03, <=1.0.0-29317775.3ebbdc9), @geode/opengeodeweb-front (>=9.13.1-rc.9, <=10.0.2-rc.4) +1 more potentially affected by CVE-2026-56301 via nuxt (>=3.18.1, <=3.20.1)

nuxt NPM version =3.18.1, =1.0.0-29304822.f444f03, =9.13.1-rc.9, =1.0.1-alpha.0, =1.0.1-alpha.33 Source cves: CVE-2026-56301 Source advisory: SNYK:JS-NUXT-17353897...

NPM: Nuxt: Route-rule middleware bypass via case-sensitivity mismatch between vue-router and the routeRules matcher

NPM: Nuxt: Route-rule middleware bypass via case-sensitivity mismatch between vue-router and the routeRules matcher vulnerability discovered by ? in WordPress Npm nuxt versions = 3.11.0, 3.21.7...

CVE-2026-49772

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Liquid Web / StellarWP The Events Calendar allows Blind SQL Injection. This issue affects The Events Calendar: from 6.15.12 through 6.16.2...