CVE-2026-9500: Heap-based Buffer Overflow

A vulnerability was found in GNU LibreDWG up to 0.14. The affected element is the function read2004compressedsection of the file src/decode.c of the component Dwgread Utility. Performing a manipulation results in heap-based buffer overflow. The attack is only possible with local access. The explo...

CVE-2026-47070: URL Redirection to Untrusted Site

Sensitive Data Exposure vulnerability in benoitc hackney allows Retrieve Embedded Sensitive Data. The HTTP/3 redirect handler in src/hackneyh3.erl passes the original request headers unchanged to the redirect target without performing any cross-origin check. When a client issues an HTTP/3 request...

CVE-2026-47067: Allocation of Resources Without Limits or Throttling

Allocation of Resources Without Limits or Throttling vulnerability in benoitc hackney allows Flooding. The URL parser in src/hackneyurl.erl converts every unrecognized URL scheme to a permanent BEAM atom via binarytoatom/2. BEAM atoms are never garbage-collected and the atom table defaults to a...

CVE-2026-9468: Improper Limitation of a Pathname to a Restricted Directory

A security flaw has been discovered in dazeb cline-mcp-memory-bank up to 55c81b9cf6c16700983c84dc4cdea3cafa19a75f. The affected element is the function handleInitializeMemoryBank of the file src/index.ts. The manipulation of the argument projectPath results in path traversal. The attack may be...

CVE-2026-9473: Improper Limitation of a Pathname to a Restricted Directory

A vulnerability has been found in c-rick jimeng-mcp 1.10.0. Affected by this vulnerability is the function getFileContent/uploadCoverFile/generateImage/generateVideo of the file src/api.ts. The manipulation of the argument filePath leads to path traversal. The attack may be initiated remotely. Th...

CVE-2026-9365: Heap-based Buffer Overflow

A vulnerability has been found in Ettercap up to 0.8.3. The affected element is the function FUNCDECODER of the file src/dissectors/ecgg.c of the component GG Dissector. The manipulation of the argument gg leads to heap-based buffer overflow. The attack is possible to be carried out remotely. The...

CVE-2026-9358: Uncontrolled Recursion

A vulnerability was determined in postcss-selector-parser up to 6.1.2/7.1.2. Affected is the function toString of the file src/selectors/container.js of the component AST Serialization. Executing a manipulation can lead to uncontrolled recursion. It is possible to launch the attack remotely. The...

CVE-2026-9372: Server-Side Request Forgery (SSRF)

A flaw has been found in ItzCrazyKns Vane up to 1.12.1. This vulnerability affects unknown code of the file src/app/api/providers/route.ts of the component Model Provider API. This manipulation of the argument baseURL causes server-side request forgery. Remote exploitation of the attack is...

Laravel-Lang PHP Packages Compromised to Deliver Cross-Platform Credential Stealer

Cybersecurity researchers have flagged a fresh software supply chain attack campaign that has targeted multiple PHP packages belonging to Laravel-Lang to deliver a comprehensive credential-stealing framework. The affected packages include - laravel-lang/lang laravel-lang/http-statuses...

CVE-2026-32253: Improper Authentication

Sunshine is a self-hosted game stream host for Moonlight. In versions prior to 2026.516.143833, the client-certificate authentication can be bypassed because of how OpenSSL verification results are handled. In src/crypto.cpp, the custom verify callback treats X509VERRUNABLETOGETISSUERCERTLOCALLY,...

Mantis Bug Tracker 安全特征问题漏洞

Mantis Bug Tracker MantisBT is an open-source bug tracker developed by Mantis Bug Tracker. Versions of Mantis Bug Tracker prior to 2.28.1 contained a security vulnerability related to the script-src directive, which allowed bypassing content security policies by uploading specially crafted...

GHSA-CRHJ-59GH-8X96 vulnerabilities

Vulnerabilities for packages: external-secrets-operator, grype, rancher-fleet, xeol, nuclei, trivy-operator, argo-cd, bom, melange, kubescape, gitaly, cerbos, gitsign, flux-image-automation-controller, pulumi-language-yaml, argo-workflows, tfsec, gitea, src-fingerprint, witness,...

GHSA-M7CR-M3PV-HGRP vulnerabilities

Vulnerabilities for packages: external-secrets-operator, grype, rancher-fleet, xeol, nuclei, trivy-operator, argo-cd, bom, melange, kubescape, gitaly, cerbos, gitsign, flux-image-automation-controller, pulumi-language-yaml, argo-workflows, tfsec, gitea, src-fingerprint, witness,...

CVE-2026-45570 vulnerabilities

Vulnerabilities for packages: external-secrets-operator, grype, rancher-fleet, xeol, nuclei, trivy-operator, argo-cd, bom, melange, kubescape, gitaly, cerbos, gitsign, flux-image-automation-controller, pulumi-language-yaml, argo-workflows, tfsec, gitea, src-fingerprint, witness,...

CVE-2026-45571 vulnerabilities

Vulnerabilities for packages: external-secrets-operator, grype, rancher-fleet, xeol, nuclei, trivy-operator, argo-cd, bom, melange, kubescape, gitaly, cerbos, gitsign, flux-image-automation-controller, pulumi-language-yaml, argo-workflows, tfsec, gitea, src-fingerprint, witness,...

GHSA-CRHJ-59GH-8X96 vulnerabilities

Vulnerabilities for packages: crossplane, gomplate-fips, argo-workflows-fips, gomplate, pulumi-language-java, gitea-fips, kargo, xeol, dagger, pulumi-language-yaml, cloudbeat, trivy-operator, coder-fips, zarf-fips, kubevela-fips, pulumi, jfrog-cli, goreleaser, rancher-fleet, cerbos-fips, bom,...

GHSA-M7CR-M3PV-HGRP vulnerabilities

Vulnerabilities for packages: crossplane, gomplate-fips, argo-workflows-fips, gomplate, pulumi-language-java, gitea-fips, kargo, xeol, dagger, pulumi-language-yaml, cloudbeat, trivy-operator, coder-fips, zarf-fips, kubevela-fips, pulumi, jfrog-cli, goreleaser, rancher-fleet, cerbos-fips, bom,...

PT-2026-45087

An uncontrolled resource consumption memory leak flaw was found in ZeroMQ's src/xpub.cpp in versions before 4.3.3. This flaw allows a remote unauthenticated attacker to send crafted PUB messages that consume excessive memory if the CURVE/ZAP authentication is disabled on the server, causing a...

PT-2026-45085

There's a flaw in the zeromq server in versions before 4.3.3 in src/decoder allocators.hpp. The decoder static allocator could have its sized changed, but the buffer would remain the same as it is a static buffer. A remote, unauthenticated attacker who sends a crafted request to the zeromq server...

PT-2026-45084

An uncontrolled resource consumption memory leak flaw was found in the ZeroMQ client in versions before 4.3.3 in src/pipe.cpp. This issue causes a client that connects to multiple malicious or compromised servers to crash. The highest threat from this vulnerability is to system availability...