CVE-2026-73653

A flaw was found in Vitest. A remote attacker, by sending specially crafted commands to the Browser Mode API, could bypass file access restrictions. This allows the attacker to read, create, overwrite, or delete arbitrary files on the system where Vitest is running, even when file write permissio...

CVE-2026-16206

A flaw was found in django-oauth-toolkit. A remote attacker can exploit a vulnerability in the loadidtoken function to manipulate session handling, leading to session expiration. This can result in a denial of service for affected users by prematurely ending their active sessions...

CVE-2026-77358

A flaw was found in cpp-httplib. The TLS Transport Layer Security-enabled WebSocket client improperly frees a TLS session while the WebSocket connection is still active. This timing issue, which occurs during the normal shutdown of a secure WebSocket connection, leads to a use-after-free...

php: ext-pgsql: PHP: SQL injection via improper backslash escaping

A flaw was found in PHP. Improper escaping of backslashes in attacker-provided parameters can lead to a SQL injection vulnerability. A remote attacker could exploit this flaw by crafting malicious input, potentially gaining unauthorized access to sensitive information, manipulating data, or causi...

mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME header

A flaw was found in the Golang MIME Multipurpose Internet Mail Extensions package. A remote attacker could exploit this vulnerability by sending a maliciously-crafted MIME header containing many invalid encoded-words. This could lead to excessive CPU consumption, resulting in a Denial of Service...

CVE-2026-52111

An issue in fast-note-sync-service =2.13.7 allows a remote attacker to escalate privileges via the admin configuration endpoint exposes authTokenKey...

CVE-2026-52022

An issue in kamailio v.6.1.1 and before allows a remote attacker to cause a denial of service via the IMS P-CSCF registration handling components...

PT-2026-84567

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 152.0.7977.75 Description Improper input validation in the Omnibox allows a remote attacker to bypass the web origin policy through crafted network traffic, typically leveraging social engineering. Recommendatio...

CVE-2026-73720: Improper Neutralization of Special Elements used in an OS Command

Insecure file operations in the API of HPE Networking Fabric Composer could allow an authenticated remote attacker to achieve remote code execution. Successful exploitation could allow an attacker to execute arbitrary commands as a privileged user on the underlying operating system...

CVE-2026-52022

The Kamailio SIP server (versions v.6.1.1 and before ) is vulnerable to a denial of service (DoS) attack. The flaw exists within the IMS P-CSCF registration handling components , which serve as the initial point of contact for user equipment in an IMS network. To remediate this vulnerability, it ...

CVE-2026-51788

An issue in cleverangeauth v.0.1.10 allows a remote attacker to cause a denial of service via the accountverification function and the accounts/models.py component...

CVE-2026-73524: Improper Neutralization of Input During Web Page Generation

Cypht before 2.12.2 contains a cross-site scripting vulnerability in the contacts module that allows remote attackers to execute arbitrary script content by embedding malicious payloads within angle brackets in the FROM email header. The sanitization logic removes only the first occurrence of eac...

CVE-2026-52111: Improper Access Control

An issue in fast-note-sync-service =2.13.7 allows a remote attacker to escalate privileges via the admin configuration endpoint exposes authTokenKey...

CVE-2026-82732: Improper Input Validation

Improper Input Validation vulnerability in ash-project ashtypescript allows a remote attacker to submit argument values outside a declared allowlist or bound on typed-controller routes. AshTypescript.TypedController.RequestHandler in lib/ashtypescript/typedcontroller/requesthandler.ex calls...

PT-2026-84421

Name of the Vulnerable Software and Affected Versions HPE Networking Fabric Composer affected versions not specified Description A command injection flaw in the web-based management interface allows an unauthenticated remote attacker to execute arbitrary commands on the underlying host operating...

CVE-2026-73722: Improper Neutralization of Special Elements used in an OS Command

Command injection vulnerabilities in the web-based management interface of HPE Networking Fabric Composer could allow an authenticated remote attacker to perform command injection against the affected system. Successful exploitation could allow an attacker to execute arbitrary commands as a...

ROS-20260901-73-0048

The vulnerability in Netty is related to an uncontrolled resource consumption. Exploiting this vulnerability can allow a remote attacker to cause service interruptions...

ROS-20260901-73-0038

The vulnerability in Netty is related to an uncontrolled resource consumption. Exploiting this vulnerability can allow a remote attacker to cause service interruptions...

CVE-2026-52022

An issue in kamailio v.6.1.1 and before allows a remote attacker to cause a denial of service via the IMS P-CSCF registration handling components...

CVE-2026-52023

An issue in kamailio v.6.1.1 and before allows a remote attacker to cause a denial of service via the imsregistrarpcscf module, specifically the pcscfsavepending/savepending path and security-agreement parsing in secagree.c:parsesecagree...