CVE-2026-74041

Wazuh versions 4.14.3 before 4.14.8 are vulnerable to a remote command validation bypass due to a case-sensitivity mismatch between the ossec.conf validator and the wazuh-logcollector. Authenticated users possessing the manager:update_config privilege can exploit this flaw by injecting an upperca...

CVE-2026-74041 Wazuh 4.14.3 before 4.14.8 Remote Command Validation Bypass via Case Mismatch

Wazuh 4.14.3 before 4.14.8 contains a case-sensitivity mismatch between the ossec.conf validator and wazuh-logcollector that bypasses remote-command validation. Authenticated users with manager:updateconfig can inject an uppercase LOGFORMAT command localfile that the collector runs as root on...

CVE-2026-74041 Wazuh 4.14.3 before 4.14.8 Remote Command Validation Bypass via Case Mismatch

Wazuh 4.14.3 before 4.14.8 contains a case-sensitivity mismatch between the ossec.conf validator and wazuh-logcollector that bypasses remote-command validation. Authenticated users with manager:updateconfig can inject an uppercase LOGFORMAT command localfile that the collector runs as root on...

CVE-2026-107832

The fastify web framework for Node.js (versions 5.12.2 through 5.12.5 ) is vulnerable to a header validation bypass due to improper case sensitivity handling. Specifically, the routine that lowercases header names in a route schema fails to lowercase enum or const header names nested within a pro...

CVE-2026-107832 fastify vulnerable to header validation bypass via case-sensitive propertyNames

fastify is a fast and low overhead web framework for Node.js. In versions 5.12.2 through 5.12.5, the routine that lowercases header names declared in a route schema does not lowercase the enum or const header names nested inside a propertyNames subschema. As a result, a header allow-list or...

CVE-2026-107832 fastify vulnerable to header validation bypass via case-sensitive propertyNames

fastify is a fast and low overhead web framework for Node.js. In versions 5.12.2 through 5.12.5, the routine that lowercases header names declared in a route schema does not lowercase the enum or const header names nested inside a propertyNames subschema. As a result, a header allow-list or...

CVE-2026-103902

A flaw was found in libdigidocpp. A remote attacker can create forged digital signatures that are improperly verified and incorrectly displayed as valid. This flaw allows an attacker to bypass signature validation checks and present fraudulent or altered documents as authentic...

PT-2026-111524

Name of the Vulnerable Software and Affected Versions fastify versions 5.12.2 through 5.12.5 Description A routine used to lowercase header names declared in a route schema fails to lowercase enum or const header names nested within a propertyNames subschema. This causes header allow-lists or...

CVE-2026-109428: Interpretation Conflict

Mistral Vibe before 2.25.5 contains a permission validation bypass vulnerability that allows attackers to execute unauthorized commands by exploiting a parsing discrepancy between tree-sitter-bash and bash in handling backslash-newline line continuations in the extractcommands function of bash.py...

CVE-2026-84316

Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, config.ValidateConfigDirectives splits configuration by newline and checks only the first directive token on each line even though Nginx permits multiple semicolon-separated directives on one line. An authenticated caller...

CVE-2026-84319

The Nginx UI web interface for the Nginx web server is vulnerable to a protection mechanism failure in versions prior to 2.4.1 . While the regular HTTP configuration API correctly rejects restricted directives like load_module, js_import, and js_content, the MCP configuration interface fails to d...

CVE-2026-84319 Nginx UI: MCP configuration tools bypass restricted directive validation and allow secondary authenticated users to execute NJS in Nginx worker context

Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, the regular HTTP configuration API rejects restricted Nginx directives such as loadmodule, jsimport, and jscontent. However, the MCP configuration interface allows a secondary authenticated user to write and apply equivale...

CVE-2026-84319 Nginx UI: MCP configuration tools bypass restricted directive validation and allow secondary authenticated users to execute NJS in Nginx worker context

Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, the regular HTTP configuration API rejects restricted Nginx directives such as loadmodule, jsimport, and jscontent. However, the MCP configuration interface allows a secondary authenticated user to write and apply equivale...

CVE-2026-84318

Nginx UI versions from 2.0.0-rc.6 until 2.4.1 are vulnerable to an authenticated security bypass. The MCP tool nginx_config_add writes configuration files to disk and triggers a reload without invoking config.ValidateConfigFile. This differs from the REST API, which correctly rejects dangerous di...

CVE-2026-84318 Nginx UI: MCP `nginx_config_add` Bypasses Directive Validation — Authenticated RCE

Nginx UI is a web user interface for the Nginx web server. From 2.0.0-rc.6 until 2.4.1, the MCP tool nginxconfigadd writes nginx configuration files to disk and triggers an nginx reload without calling config.ValidateConfigFile. The identical flow in the REST API POST /api/configs does call that...

CVE-2026-96012

IBM Db2 Mirror for i 7.4, 7.5, and 7.6 is vulnerable to privilege escalation. An authenticated attacker could craft a malicious request that bypasses additional authorization and input validation checks to execute malicious code. An attacker could exploit this vulnerability to obtain elevated...

CVE-2026-109423 NetEase Cloud Music TLS Certificate Validation Bypass

NetEase Cloud Music client for Windows cloudmusic.exe versions 3.1.38 and 3.1.39.205426 contains a TLS certificate validation vulnerability that allows a network-adjacent attacker to intercept and decrypt HTTPS traffic by failing to validate the server certificate chain, verify the hostname, or...

EUVD-2026-97815

IBM Db2 Mirror for i 7.4, 7.5, and 7.6 is vulnerable to privilege escalation. An authenticated attacker could craft a malicious request that bypasses additional authorization and input validation checks to execute malicious code. An attacker could exploit this vulnerability to obtain elevated...

CVE-2026-109320 Grav API Plugin before 1.0.36 Disabled Account Session Access Bypass

The Grav API plugin grav-plugin-api before 1.0.36 contains an improper session validation vulnerability that allows disabled accounts to keep API access, because SessionAuthenticator does not enforce account state. Disabled users can reuse an already authorized browser or remember-me session to...

Important: Red Hat Security Advisory: bind9.16 security, bug fix, and enhancement update

An update for bind9.16 is now available for Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support and Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On. Red Hat Product Security has rated this update as having a security impact of Important. A Common...