CVE-2026-70374: Improper Neutralization of Special Elements used in an OS Command

HashBrown CMS through 1.4.6 contains an OS Command Injection vulnerability CWE-78 in the media upload thumbnail generation routine. Media.generateThumbnail in src/Server/Entity/Resource/Media.js builds a temporary file path as 'thumbnail' + Path.extnamefilename and passes it, unescaped, into a...

CVE-2026-71291: Improper Neutralization of Special Elements Used in a Template Engine

Bolt CMS renders content field values through Twig's full application-level Environment with no SandboxExtension registered anywhere in the codebase. In src/Entity/Field.php, getTwigValue calls shouldBeRenderedAsTwig, which gates rendering only on the field definition's allowtwig flag and a regex...

CVE-2026-51400

An issue in Vim Project v9.2.0389 and earlier allows a local attacker to execute arbitrary code via the vmsfixfilename function within file vim/src/osvms.c...

CVE-2026-67857: Out-of-bounds Read

open62541 1.5.5 contains an out-of-bounds read in the client-side function responseReadNamespacesArray in src/client/uaclientconnect.c...

CVE-2026-51401

An issue in Vim Project v9.2.0389 and earlier allows a local attacker to execute arbitrary code via the vmsfixfilename function within file vim/src/osvms.c...

PT-2026-67883

Name of the Vulnerable Software and Affected Versions open62541 version 1.5.5 Description A buffer overflow exists in the high-level attribute reading logic within the src/client/ua client highlevel.c file. This flaw allows a remote attacker to trigger a denial of service. Recommendations At the...

PT-2026-67749

Name of the Vulnerable Software and Affected Versions Flowise versions prior to 3.1.3 Description A sandbox escape exists in the executeJavaScriptCode function that allows an authenticated attacker to execute arbitrary system commands as root on the server. The issue occurs because the function...

CVE-2026-47764: Improper Limitation of a Pathname to a Restricted Directory

pdm is a Python package and dependency manager supporting the latest PEP standards. Versions prior to 2.27.0 are vulnerable to path traversal through writetofs. InstallDestination.writetofs in src/pdm/installers/installers.py overrides the base class to add symlink/hardlink support but replaces t...

CVE-2026-70471: Incorrect Authorization

Flowise is a drag-and-drop user interface for building customized large language model LLM flows. Prior to 3.1.3, Flowise injects $vars into the code execution sandbox without requiring variables:view, bypassing the permission-protected Variables API. Variables for the active workspace are fetche...

CVE-2026-18816: Improper Authentication

A vulnerability was identified in Baserow up to 2.3.2. Affected by this vulnerability is the function verify of the file backend/src/baserow/api/twofactorauth/views.py of the component 2FA Verify Endpoint. Such manipulation leads to improper authentication. The attack may be launched remotely. Th...

PT-2026-67877

Name of the Vulnerable Software and Affected Versions Baserow versions prior to 2.3.3 Description An issue in the 2FA Verify Endpoint allows for improper authentication via remote manipulation. The flaw exists within the verify function located in the backend/src/baserow/api/two factor...

CVE-2026-18817: Improper Authorization

A security flaw has been discovered in Baserow up to 2.3.2. Affected by this issue is the function BaserowImpersonateAuthTokenSerializer of the file backend/src/baserow/api/admin/users/serializers.py of the component Inactive Non-Staff User Handler. Performing a manipulation results in improper...

CVE-2026-51401: Improper Control of Generation of Code

An issue in Vim Project v9.2.0389 and earlier allows a local attacker to execute arbitrary code via the vmsfixfilename function within file vim/src/osvms.c...

PT-2026-69029

Name of the Vulnerable Software and Affected Versions OpenImageIO versions prior to 3.0.21.0 OpenImageIO versions prior to 3.1.16.0 OpenImageIO versions prior to 3.2.0.3-beta1 Description A heap out-of-bounds write and memory corruption occur when processing a zbuffer-only tiled iff file. This...

PT-2026-76156

A flaw has been found in LibRaw up to 0.22.0. This affects the function LibRaw::nikon load padded packed raw of the file src/decoders/decoders libraw.cpp of the component TIFF/NEF. Executing a manipulation of the argument load flags/raw width can lead to out-of-bounds read. It is possible to laun...

PT-2026-67853

Name of the Vulnerable Software and Affected Versions Vim Project versions prior to 9.2.0390 Description A local attacker can execute arbitrary code through the vms fixfilename function located in the vim/src/os vms.c file. Recommendations Update to a version newer than 9.2.0389. As a temporary...

PT-2026-76195

GNU Wget through 1.25.0, fixed in commit 37a40fc, contains a heap buffer underread vulnerability in the clean metalink string function within src/metalink.c that allows a malicious server to trigger memory corruption by serving a Metalink document containing a whitespace-only URL. Attackers can...

PT-2026-76196

GNU Wget through 1.25.0, fixed in commit 43d3ba9, contains an integer overflow vulnerability in the parse content range function within src/http.c that allows server-controlled values to cause signed integer arithmetic to overflow. Attackers can supply malicious Content-Range header values to...

PT-2026-76197

GNU Wget through 1.25.0, fixed in commit c2640fe, contains a heap buffer overflow vulnerability in the convert fname function within src/url.c that allows remote attackers to trigger memory corruption through a server-supplied filename requiring character set conversion. When the output buffer is...

PT-2026-76198

GNU Wget through 1.25.0, fixed in commit dd692d9, contains a heap buffer overflow vulnerability in the html quote string function in src/convert.c that allows a remote attacker to trigger memory corruption by supplying a crafted HTML attribute with a large number of characters requiring entity...