bind: bind9: DNSSEC Validation Bypass via Out-of-Zone NSEC Next Field

The BIND resolver accepts validly-signed NSEC records where the "Next Domain Name" field points outside the signer's zone...

CVE-2026-73624 GitPython before 3.1.54 Arbitrary File Overwrite via diff

GitPython versions before 3.1.54 contain an arbitrary file overwrite vulnerability in the Diffable.diff method that fails to validate git options passed through kwargs. Attackers can supply the --output argument via the other parameter or output kwarg to write patch content to attacker-chosen fil...

EUVD-2026-57816

File Browser before v2.63.22 fails to validate access rules for descendants during recursive copy, rename, and delete operations, allowing authenticated users to bypass path-based access controls. Attackers can copy, rename, or delete denied files by operating on their allowed parent directory,...

CVE-2026-73602 Flowise before 3.1.3 Sandbox Escape to RCE

Flowise before 3.1.3 contains a sandbox escape vulnerability in the vm2 JavaScript sandbox that allows authenticated users to execute arbitrary code by exploiting moment locale validation bypass. Attackers can craft a fake String object with a match function that bypasses path traversal checks to...

Insufficient Session Expiration

Apache Camel Keycloak Component is vulnerable to Insufficient Session Expiration. The vulnerability is due to KeycloakSecurityHelper.parseAndVerifyAccessToken omitting the TokenVerifier.ISACTIVE check, allowing expired or not-yet-valid access tokens to pass signature, subject, and issuer validati...

Improper Input Validation

Apache Camel is vulnerable to Improper Input Validation. The vulnerability is due to unfiltered CometD client-supplied headers being copied directly into the Camel Exchange, which allows an attacker to inject Camel control headers and manipulate downstream producers such as HTTP, file, or JMS...

bind: bind9: DNSSEC Validation Bypass via Out-of-Zone NSEC Next Field

The BIND resolver accepts validly-signed NSEC records where the "Next Domain Name" field points outside the signer's zone...

Kibana 8.19.20, 9.3.8, and 9.4.5 Security Update (ESA-2026-101)

Uncaught Exception in Kibana Leading to Denial of Service Description: Uncaught Exception CWE-248, resulting from Improper Input Validation CWE-20, in Kibana can lead to denial of service via Input Data Manipulation CAPEC-153. An authenticated user holding only low-privileged access can cause an...

CVE-2026-12263

Zohocorp ManageEngine Password Manager Pro versions before 13232 and PAM360 versions before 8551 are vulnerable to an authentication bypass vulnerability due to improper SAML validation...

CVE-2026-12263

CVE-2026-12263 affects Zohocorp ManageEngine Password Manager Pro <13232 and PAM360

EUVD-2026-57776

Zohocorp ManageEngine Password Manager Pro versions before 13232 and PAM360 versions before 8551 are vulnerable to an authentication bypass vulnerability due to improper SAML validation...

dompurify: DOMPurify: URI validation bypass leads to cross-site scripting

A flaw was found in DOMPurify. An attacker can bypass URI validation by providing a specially crafted predicate function via EXTRAELEMENTHANDLING.attributeCheck. This allows unsafe protocols, such as javascript:, to persist after sanitization, potentially leading to DOM-based cross-site scripting...

Input Validation Vulnerability

Apache Camel Mail Component is vulnerable to Improper Input Validation and Exposure of Sensitive Information to an Unauthorized Actor. The vulnerability is due to the MailProducer accepting attacker-controlled mail.smtp. and mail.smtps. headers, allowing untrusted input to override mail session...

Memory Allocation With Excessive Size Value

Apache ActiveMQ is vulnerable to Memory Allocation with Excessive Size Value. The vulnerability is due to improper validation of the encoded size of OpenWire message property maps during unmarshaling, which allows an authenticated attacker to send a crafted message with an excessively large size...

Improper Input Validation

Apache Camel is vulnerable to Improper Input Validation. The vulnerability is due to unfiltered operationName and operationNamespace headers from inbound HTTP requests, which allows an attacker to control the SOAP operation invoked by the CXF producer and potentially trigger unintended or...

CVE-2026-18622

Foxit PDF Editor/Reader inconsistently alerts users when signature fields are abnormally modified, including alterations to appearance, coordinates, or field duplication. This may mislead users into trusting tampered documents, since the UI cannot accurately reflect the actual integrity status of...

CVE-2026-18622 Foxit PDF Editor/Reader's signature-validation pop-up reports modified certified documents as valid

Foxit PDF Editor/Reader inconsistently alerts users when signature fields are abnormally modified, including alterations to appearance, coordinates, or field duplication. This may mislead users into trusting tampered documents, since the UI cannot accurately reflect the actual integrity status of...

CVE-2026-18622

Technical details are not publicly available in the provided documents. Monitor for updates.

JLSEC-2026-1274 code-server's session cookie can be extracted by having user visit specially crafted proxy URL

Summary A maliciously crafted URL using the proxy subpath can result in the attacker gaining access to the session token. Details Failure to properly validate the port for a proxy request can result in proxying to an arbitrary domain. The malicious URL https:///proxy/[email protected]/path would be...

CVE-2026-3835

The Prevent Direct Access – Protect WordPress Files plugin for WordPress is vulnerable to unauthorized access of protected files due to insufficient token validation in the getadvancefilebyurl method in all versions up to, and including, 2.8.8.8 The method uses a SQL LIKE operator for token looku...