CVE-2026-62985: Uncaught Exception

request-filtering-agent is an https.Agent implementation that blocks requests to Private/Reserved IP addresses. Prior to 3.2.1, RequestFilteringHttpAgent and RequestFilteringHttpsAgent synchronously threw from createConnection when rejecting a literal private-IP host such as 169.254.169.254 or...

CVE-2026-75432

An issue in yaml-cpp 0.9.0 allows a remote attacker to obtain sensitive information via the src/scanner.cpp, Scanner::PopIndent, and Scanner::PushIndentTo components...

CVE-2026-25254: Improper Authorization

Improper authorization leads to Remote Code Execution via SocketIO interface...

CVE-2026-25264: Uncontrolled Search Path Element

Privilege escalation due to weak configuration during package extraction process...

CVE-2026-93556: Authorization Bypass Through User-Controlled Key

The ‘/password/guardarClau/recover’ endpoint accepts the ‘usuariId’ parameter, which specifies the account whose password is to be changed. The JWT token for the recovery process is not validated against the user specified in that parameter. An unauthenticated attacker could manipulate the...

CVE-2026-94455: Missing Authentication for Critical Function

An HTTP endpoint intended for provisioning enterprise and reseller organisations is reachable without any session. The authentication middleware is bound only to an explicit list of controllers, and the enterprise controller is not on that list, so no authentication runs for these routes. The...

CVE-2026-25255: Exposed Dangerous Method or Function

Exposed dangerous function lead to privilege escalation via gRPC server...

CVE-2026-28325: Deserialization of Untrusted Data

SolarWinds Observability Self-Hosted was found to be affected by an unauthenticated remote code execution vulnerability stemming from deserialization of untrusted data when the application is configured to use a specific communication mode...

CVE-2026-76716: Allocation of Resources Without Limits or Throttling

Multiple vulnerabilities exist in the Analytics and Location Engine ALE that may allow for unauthorized access or denial of service. An unauthenticated remote attacker could exploit these vulnerabilities by sending specially crafted input or leveraging improper security configurations. Successful...

CVE-2026-75728: Incorrect Authorization

Adobe Campaign Classic ACC is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction...

CVE-2026-88415: Improper Neutralization of Input During Web Page Generation

MCMS 6.1.1 through 6.2.1 is vulnerable to stored Cross-Site Scripting XSS. The article content field contentDetails is excluded from the global XSS filter...

CVE-2026-84395: Server-Side Request Forgery (SSRF)

Premiere Pro is affected by a Server-Side Request Forgery SSRF vulnerability that could result in privilege escalation potentially resulting in unauthorized write access. Exploitation of this issue does not require user interaction. Scope is changed...

CVE-2026-16468: Improper Neutralization of Special Elements used in an OS Command

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary commands due to OS command injection...

CVE-2026-16426: Server-Side Request Forgery (SSRF)

IBM Concert 1.0.0 through 3.0.0 is vulnerable to server-side request forgery SSRF. This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks...

CVE-2026-75676: Stack-based Buffer Overflow

Bridge is affected by a Stack-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file...

CVE-2026-88350: Undefined Security Weakness

An integer overflow vulnerability exists in MPack 1.1.1 in mpacknodecstralloc and mpacknodeutf8cstralloc...

CVE-2026-83660: Server-Side Request Forgery (SSRF)

Adobe Campaign Classic ACC is affected by a Server-Side Request Forgery SSRF vulnerability that could result in privilege escalation. Exploitation of this issue does not require user interaction. Scope is changed...

CVE-2026-75432: Undefined Security Weakness

An issue in yaml-cpp 0.9.0 allows a remote attacker to obtain sensitive information via the src/scanner.cpp, Scanner::PopIndent, and Scanner::PushIndentTo components...

CVE-2026-75699: Improper Control of Generation of Code

Adobe Campaign Classic ACC is affected by an Improper Control of Generation of Code 'Code Injection' vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue...

CVE-2026-75632: Uncontrolled Resource Consumption

CAI Content Credentials is affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service. An attacker could exploit this vulnerability to exhaust system resources, resulting in an application denial-of-service condition. Exploitation of this issue...