CVE-2026-73502

kin-openapi is a Go project for handling OpenAPI files. From 0.2.0 until 0.144.0, openapi3filter.ValidateRequest can encounter a NULL-pointer-dereference denial of service when an operation declares a content parameter whose application/json media type has no schema. In...

Fixed in Apache Tomcat 11.0.25

Low: Authenticated WebSocket session survives end of HTTP session CVE-2026-73180 If the session ID for an authenticated HTTP session was changed after a WebSocket connection had been established under that authenticated HTTP session, the WebSokcet session would not be closed as required by the...

PT-2026-76914

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in AKIN Software Computer Import Export Industry and Trade Ltd. AKINSOFT Wolvox9 ERP / KontrolPanel.exe allows Path Traversal. This issue affects AKINSOFT Wolvox9 ERP / KontrolPanel.exe: from s26.02.17 befo...

CVE-2026-16471

Missing Authorization vulnerability in Dolusoft Software Technologies Sonlogger allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Sonlogger: from v6.6.6 before 6.7.4.8...

Security Bulletin:Vulnerabilities exists in IBM Netezza Appliance

Summary Vulnerabilities identified in IBM Netezza Software have been addressed in version 1.0.2.0. Vulnerability Details CVEID:CVE-2025-47273 DESCRIPTION: setuptools is a package that allows users to download, build, install, upgrade, and uninstall Python packages. A path traversal vulnerability ...

CVE-2026-13433 IBM i Access Client Solutions (ACS) is Affected By Multiple Vulnerabilities

IBM i Access Client Solutions 1.1.2.0 through 1.1.9.13 ACS is vulnerable to downloading unverified product code when configured to update from an IBM i. A bad actor could use this vulnerablity to run compromised code on the ACS user's workstation...

PT-2026-78864

Name of the Vulnerable Software and Affected Versions Wireshark versions 4.6.0 through 4.6.7 Wireshark versions 4.4.0 through 4.4.18 Description A NULL pointer dereference in the H.245 protocol dissector can lead to a crash, resulting in a denial of service. A protocol dissector is a software...

CVE-2026-64941 Open redirect in Phoenix.LiveView.validate_local_url!/2 via ASCII tab, LF and CR

URL Redirection to Untrusted Site 'Open Redirect' vulnerability in phoenixframework phoenixliveview allows an attacker to send a victim's browser to an origin of the attacker's choosing via a :to value containing ASCII tab, LF or CR. redirect/2 validates :to through the private validatelocalurl!/...

CVE-2026-28672

Apache Ranger versions 0.6 through 2.8 are vulnerable to an OS command injection (CWE-77) in the unixusersync module. The vulnerability exists because the UnixUserGroupBuilder class executes the id command through a shell, concatenating an attacker-influenced username directly into the command li...

CVE-2026-52880

Klever-Go is the Go implementation of the Klever blockchain protocol. Versions from 1.7.14 through 1.7.17 are vulnerable to a remotely triggerable denial of service. Both REST APIs are started with the Gin Engine.Run convenience method, which serves requests through Go's default HTTP server with ...

CVE-2026-48007 Element Call reports full URLs of visited pages to analytics server

Element Call is a native Matrix video conferencing application. Versions 0.5.17 through 0.19.3 report analytics data to a PostHog server, when configured to by a posthog key in config.json or by the posthogApiHost and posthogApiKey URL parameters. Several fields of this data $initialpersoninfo,...

EUVD-2026-54618

Element Call is a native Matrix video conferencing application. Versions 0.5.17 through 0.19.3 report analytics data to a PostHog server, when configured to by a posthog key in config.json or by the posthogApiHost and posthogApiKey URL parameters. Several fields of this data $initialpersoninfo,...

NPM: Hono: `memo()` retains SSR output across requests, leading to cross-user data disclosure

NPM: Hono: memo retains SSR output across requests, leading to cross-user data disclosure vulnerability discovered by ? in WordPress Npm hono versions = 3.8.0, 4.12.34...

@aaarc/recursivelearnmcp (>=0.1.0, <=0.1.3), @activepieces/piece-ai (>=0.3.1, <=0.3.4) +739 more potentially affected by CVE-2026-71849 via hono (>=4.7.0, <=4.12.33)

hono NPM version =4.7.0, =0.1.0, =0.3.1, =0.0.138, =0.0.138, =0.0.138, =0.0.138, =0.0.138, =0.0.0-pr-306-20260707164534, =0.9.0, =0.1.9, =0.2.0, =0.0.1-alpha.0, =0.0.1-alpha.37 and more Source cves: CVE-2026-71849 Source advisory: OSV:GHSA-79QM-7RJ5-M7R9...

@aaarc/recursivelearnmcp (>=0.1.0, <=0.1.3), @activepieces/piece-ai (>=0.3.1, <=0.3.4) +377 more potentially affected by CVE-2026-71848 via hono (>=4.12.0, <=4.12.33)

hono NPM version =4.12.0, =0.1.0, =0.3.1, =0.0.138, =0.0.138, =0.0.138, =0.0.138, =0.0.138, =0.0.0-pr-306-20260707164534, =0.5.5, =0.0.1-alpha.0, =0.0.1-alpha.0, =0.0.1-alpha.1, =0.0.1-alpha.0, =0.0.1-alpha.37 and more Source cves: CVE-2026-71848 Source advisory: SNYK:JS-HONO-18593786...

@aaarc/recursivelearnmcp (>=0.1.0, <=0.1.3), @activepieces/piece-ai (>=0.3.1, <=0.3.4) +377 more potentially affected by CVE-2026-71848 via hono (>=4.12.0, <=4.12.33)

hono NPM version =4.12.0, =0.1.0, =0.3.1, =0.0.138, =0.0.138, =0.0.138, =0.0.138, =0.0.138, =0.0.0-pr-306-20260707164534, =0.5.5, =0.0.1-alpha.0, =0.0.1-alpha.0, =0.0.1-alpha.1, =0.0.1-alpha.0, =0.0.1-alpha.37 and more Source cves: CVE-2026-71848 Source advisory: OSV:GHSA-54FX-42GC-7VW4...

@bloggrify/bento (3.1.0), @bloggrify/core (>=3.2.0, <=3.3.0) +14 more potentially affected by CVE-2026-72744 via @nuxt/nitro-server (>=4.4.7, <=4.5.0)

@nuxt/nitro-server NPM version =4.4.7, =3.2.0, =4.5.0-depup.0, =1.13.12, =1.2.5, =1.6.0-rc.3, =1.0.0-alpha.17, =0.15.0, =0.1.0, =1.0.0, =4.4.7, =0.6.0-rc.4, =0.2.3, =0.3.0-alpha.2 and more Source cves: CVE-2026-72744 Source advisory: SNYK:JS-NUXTNITROSERVER-18593816...

CVE-2026-66491

Joomla Extension - phoca.cz - Arbitrary File Read in Phoca Commander 1.0.0-6.1.3 - Improper limitation of paths in the getSource function lead to an arbitrary file read vulnerability...

CVE-2026-66493

CVE-2026-66493 affects the Joomla extension Phoca Commander (phoca.cz) versions 1.0.0 through 6.1.3. The issue is a path traversal vulnerability caused by improper limitation of paths for delete, copy, and move actions. The CVSS data indicates NETWORK access with low complexity and high privilege...

@0xwork/connect (0.1.8), @4onstudios/iris-agent (>=0.2.5, <=0.2.6) +1357 more potentially affected by CVE-2026-16633 via pdfjs-dist (>=5.6.205, <=6.1.200)

pdfjs-dist NPM version =5.6.205, =0.2.5, =1.0.0, =0.2.0, =0.0.0, =0.0.11-alpha-20260329202526-cfad3bcbd829b82471d2d4fed4e49b2ef849cafb, =4.11.1, =0.0.4, =0.0.0-beta-20260819155526, =0.0.0-beta-20260820202238, =0.0.0-beta-20260819155526, =0.1.0, =0.17.9, =0.5.12, =0.17.6 and more Source cves:...