CVE-2026-14380

A flaw was found in the DBI component for Perl. This vulnerability allows an attacker to inject and execute arbitrary code by manipulating the Profile attribute of a DBI handle. When a string is assigned to this attribute, the component processes it without proper validation, enabling the executi...

PT-2026-60684

Name of the Vulnerable Software and Affected Versions Nuclio versions prior to 1.16.5 Description Nuclio's Java runtime is susceptible to code injection during the function build process. The issue occurs because the createGradleBuildScript function uses the Go text/template package to generate a...

PT-2026-60482

Name of the Vulnerable Software and Affected Versions Kiota versions prior to 1.32.5 Description Kiota, an OpenAPI based HTTP Client code generator, fails to validate outputPath values for clients and plugins within the .kiota/workspace.json configuration file. This allows a malicious repository ...

net-imap: Net::IMAP: Arbitrary IMAP command injection via CRLF sequences in unvalidated input

A flaw was found in Net::IMAP before 0.4.24, 0.5.14, and 0.6.4. Several commands accept raw string arguments sent to the server without validation or escaping; if derived from user-controlled input, CRLF sequences allow injection of arbitrary IMAP commands...

CVE-2026-45313

Summary: Sandboxie-Plus on Windows contains a local privilege escalation in GuiServer.cpp prior to v1.17.6. The GuiServer::WndHookRegisterSlave handler stores attacker-supplied hthread and hproc from GUI_WND_HOOK_REGISTER without validating thread belonging to the sandbox or the function pointer’...

CVE-2026-62312

9Router is an AI router & token saver. Prior to 0.5.2, 9Router allows a remote authenticated attacker to achieve arbitrary code execution on the host operating system by combining a Host header bypass of localhost-only routes with unvalidated MCP plugin args passed to childprocess.spawn, allowing...

CVE-2026-62312 9Router: Authenticated RCE via Unvalidated MCP Plugin Arguments

9Router is an AI router & token saver. Prior to 0.5.2, 9Router allows a remote authenticated attacker to achieve arbitrary code execution on the host operating system by combining a Host header bypass of localhost-only routes with unvalidated MCP plugin args passed to childprocess.spawn, allowing...

CVE-2026-62312

CVE-2026-62312 affects 9Router, an AI router & token saver. Before v0.5.2, an authenticated remote attacker can achieve arbitrary code execution on the host by abusing a Host header bypass of localhost-only routes in combination with unvalidated MCP plugin arguments passed to child_process.spawn(...

CVE-2026-53513 Better Auth: Server-side request forgery via unvalidated OIDC endpoints on @better-auth/sso provider registration

Better Auth is an authentication and authorization library for TypeScript. Prior to 1.6.11, the @better-auth/sso plugin's POST /sso/register and POST /sso/update-provider endpoints accept attacker-controlled oidcConfig.userInfoEndpoint, tokenEndpoint, and jwksEndpoint URLs when skipDiscovery: tru...

CVE-2026-53513 Better Auth: Server-side request forgery via unvalidated OIDC endpoints on @better-auth/sso provider registration

Better Auth is an authentication and authorization library for TypeScript. Prior to 1.6.11, the @better-auth/sso plugin's POST /sso/register and POST /sso/update-provider endpoints accept attacker-controlled oidcConfig.userInfoEndpoint, tokenEndpoint, and jwksEndpoint URLs when skipDiscovery: tru...

CVE-2026-61451 Grav before 1.0.4 Password Reset Token Poisoning via admin_base_url

The Grav API plugin grav-plugin-api before 1.0.4 does not validate the origin of the client-supplied adminbaseurl field in the POST /api/v1/auth/forgot-password endpoint. The sanitizeHttpUrl function only checks that the URL scheme is http/https and never verifies the host against the server's ow...

PT-2026-60267

Name of the Vulnerable Software and Affected Versions TDengine versions prior to 3.4.1.15 Description An unauthenticated out-of-bounds read, uncontrolled allocation, and integer underflow can occur when the server processes malformed RPC packets. This happens because the transDecompressMsg functi...

PT-2026-60385

Name of the Vulnerable Software and Affected Versions Koel versions prior to 9.7.0 Description An authenticated user can perform a Server-Side Request Forgery SSRF via Subsonic-compatible endpoints. The createInternetRadioStation.view and updateInternetRadioStation.view routes fail to implement t...

The vulnerability of the RAR5 file archiver WinRAR’s recovery processing system and the UnRAR decompression tool allows a perpetrator to execute arbitrary code.

The vulnerability of the RAR5 file archiver WinRAR’s volume recovery processing system, as well as the UnRAR decompression tool, is related to unvalidated array indexing. Exploiting this vulnerability can allow an attacker to execute arbitrary code...

JLSEC-2026-733 When restoring a session from cache, a pointer from the serialized session data is used in a free...

When restoring a session from cache, a pointer from the serialized session data is used in a free operation without validation. An attacker who can poison the session cache could trigger an arbitrary free. Exploitation requires the ability to inject a crafted session into the cache and for the...

CVE-2026-54572

Rogue symlink handling in rclone before 1.74.4: when using -l/--links, rclone serializes symlinks as .rclonelink and recreates them locally without validating the target, allowing an attacker-controlled remote to plant an escaping symlink and cause subsequent writes to land outside the destinatio...

CVE-2026-54572 rclone: Unvalidated symlink target in local `--links` — arbitrary file write from an untrusted remote

Rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.74.4, with -l/--links, rclone serializes symlinks as .rclonelink text objects and recreates them on a local destination without validating the target, allowing an...

CVE-2026-54572 rclone: Unvalidated symlink target in local `--links` — arbitrary file write from an untrusted remote

Rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.74.4, with -l/--links, rclone serializes symlinks as .rclonelink text objects and recreates them on a local destination without validating the target, allowing an...

CVE-2026-54572 rclone: Unvalidated symlink target in local `--links` — arbitrary file write from an untrusted remote

Rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.74.4, with -l/--links, rclone serializes symlinks as .rclonelink text objects and recreates them on a local destination without validating the target, allowing an...

GHSA-2C7F-FXWW-6W6C yutu: Arbitrary File Write via MCP `caption-download` Tool

Arbitrary File Write via MCP caption-download Tool Summary The caption-download MCP tool in yutu passes the caller-supplied file parameter directly to os.Create at pkg/caption/caption.go:272 without any path validation, canonicalization, or confinement to the pkg.Root boundary YUTUROOT. A local...