CVE-2026-97224 Excalidraw Imported File restore.ts cross site scripting

A vulnerability was detected in Excalidraw up to 0.18.1. The impacted element is an unknown function of the file packages/excalidraw/data/restore.ts of the component Imported File Handler. Performing a manipulation of the argument customData.generationData.html results in cross site scripting. Th...

CVE-2026-97224

A cross-site scripting (XSS) vulnerability exists in Excalidraw versions up to 0.18.1 . The flaw is located within an unknown function in the packages/excalidraw/data/restore.ts file, specifically affecting the Imported File Handler component. An attacker can achieve remote execution of XSS by ma...

CVE-2026-97404

In OpenStack Zaqar versions before 22.0.2 , the WSGI transport mishandles the URL-Signature header . An unauthenticated remote attacker who knows a target project's UUID can bypass Keystone authentication and pre-signed URL verification by sending a request with an empty URL-Signature header. Thi...

CVE-2026-97404

In OpenStack Zaqar before 22.0.2, WSGI transport mishandles the URL-Signature header. By sending a request with an empty URL-Signature header, an unauthenticated remote attacker who knows a target project's UUID may bypass both Keystone authentication and pre-signed URL verification, resulting in...

EUVD-2026-85915

In OpenStack Zaqar before 22.0.2, WSGI transport mishandles the URL-Signature header. By sending a request with an empty URL-Signature header, an unauthenticated remote attacker who knows a target project's UUID may bypass both Keystone authentication and pre-signed URL verification, resulting in...

CVE-2026-97404

In OpenStack Zaqar before 22.0.2, WSGI transport mishandles the URL-Signature header. By sending a request with an empty URL-Signature header, an unauthenticated remote attacker who knows a target project's UUID may bypass both Keystone authentication and pre-signed URL verification, resulting in...

EUVD-2026-85912

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of environment variables...

CVE-2026-91187

Improper Verification of Cryptographic Signature vulnerability in dashbit nimblezta allows an unauthenticated remote attacker to authenticate as an arbitrary Cloudflare service token. Applications using the Cloudflare Zero Trust authentication strategy are affected. verifytoken/2 in...

EUVD-2026-86006

IBM PowerVM Hypervisor FW1120.00 through FW1120.01, FW1110.00 through FW1110.31, FW1060.00 through FW1060.81, and FW950.00 through FW950.H3 could allow a remote attacker to obtain sensitive information due to an out-of-bounds read...

CVE-2026-66075

A flaw was found in RabbitMQ, a messaging and streaming broker. A remote attacker with monitoring user credentials can exploit an authorization flaw to restart federation links. This unauthorized action disrupts message flow, leading to a denial of service DoS for affected services. This...

CVE-2026-67231

A flaw was found in RabbitMQ. The trust-store plugin incorrectly validates client certificates by only matching the issuer name and serial number, rather than using the full certificate for path validation. This allows a remote attacker, who knows the issuer name and serial number of a whiteliste...

CVE-2026-91187 Improper Verification of Cryptographic Signature in dashbit nimble_zta Cloudflare strategy

Improper Verification of Cryptographic Signature vulnerability in dashbit nimblezta allows an unauthenticated remote attacker to authenticate as an arbitrary Cloudflare service token. Applications using the Cloudflare Zero Trust authentication strategy are affected. verifytoken/2 in...

CVE-2026-91187

The dashbit nimble_zta library (versions 0.1.2 before 0.1.3 ) contains an improper verification of cryptographic signature vulnerability. Specifically, the verify_token/2 function in lib/nimble_zta/cloudflare.ex calls JOSE.JWT.verify/2 but fails to check the boolean verification result, returning...

EUVD-2026-85871

Improper Verification of Cryptographic Signature vulnerability in dashbit nimblezta allows an unauthenticated remote attacker to authenticate as an arbitrary Cloudflare service token. Applications using the Cloudflare Zero Trust authentication strategy are affected. verifytoken/2 in...

EEF-CVE-2026-91187 Improper Verification of Cryptographic Signature in dashbit nimble_zta Cloudflare strategy

Summary Improper Verification of Cryptographic Signature vulnerability in dashbit nimblezta allows an unauthenticated remote attacker to authenticate as an arbitrary Cloudflare service token. Applications using the Cloudflare Zero Trust authentication strategy are affected. verifytoken/2 in...

CVE-2026-91187 Improper Verification of Cryptographic Signature in dashbit nimble_zta Cloudflare strategy

Improper Verification of Cryptographic Signature vulnerability in dashbit nimblezta allows an unauthenticated remote attacker to authenticate as an arbitrary Cloudflare service token. Applications using the Cloudflare Zero Trust authentication strategy are affected. verifytoken/2 in...

CVE-2026-97182

A security vulnerability has been detected in halo-dev Halo up to 2.25.4/2.26.1. Affected is an unknown function of the file application/src/main/java/run/halo/app/content/comment/ReplyNotificationSubscriptionHelper.java of the component SpEL Handler. Such manipulation leads to improper...

tesseract: Tesseract: Heap out-of-bounds write via crafted .traineddata

A flaw was found in Tesseract, an open-source Optical Character Recognition OCR engine. A remote attacker could exploit this by providing a specially crafted .traineddata LSTM model component. When Tesseract's deserializer processes this component during OCR recognition, an unchecked integer...

CVE-2026-97182

A security vulnerability exists in halo-dev Halo versions up to 2.25.4/2.26.1 . The flaw is located within an unknown function in the file application/src/main/java/run/halo/app/content/comment/ReplyNotificationSubscriptionHelper.java belonging to the SpEL Handler component. This issue leads to i...

EUVD-2026-85859

A security vulnerability has been detected in halo-dev Halo up to 2.25.4/2.26.1. Affected is an unknown function of the file application/src/main/java/run/halo/app/content/comment/ReplyNotificationSubscriptionHelper.java of the component SpEL Handler. Such manipulation leads to improper...