EUVD-2026-8684

OneUptime: OS Command Injection in Probe NetworkPathMonitor via unsanitized destination in traceroute exec...

@enclave-vm/core is vulnerable to Sandbox Escape

Summary It is possible to escape the security boundraries set by @enclave-vm/core, which can be used to achieve remote code execution RCE. The issue has been fixed in version 2.11.1. --- Details It is possible to obtain the native Object constructor instead of the SafeObject wrapper. This can be...

EUVD-2025-208104

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 7.0.4, OpenEMR's HTTP client wrapper oeHttp/oeHttpRequest disables SSL/TLS certificate verification by default verify: false, making all external HTTPS connections vulnerable ...

SUSE CVE-2026-25987

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a heap buffer over-read vulnerability exists in the MAP image decoder when processing crafted MAP files, potentially leading to crashes or unintended memory...

CVE-2026-27593 Statamic is vulnerable to account takeover via password reset link injection

Statmatic is a Laravel and Git powered content management system CMS. Prior to versions 6.3.3 and 5.73.10, an attacker may leverage a vulnerability in the password reset feature to capture a user's token and reset the password on their behalf. The attacker must know the email address of a valid...

EUVD-2026-8467

Payload is a free and open source headless content management system. Prior to 3.75.0, a Server-Side Request Forgery SSRF vulnerability exists in Payload's external file upload functionality. When processing external URLs for file uploads, insufficient validation of HTTP redirects could allow an...

CVE-2026-2793

CVE-2026-2793 is a memory-safety issue in Mozilla products (Firefox/Thunderbird) affecting Firefox ESR 115.32, ESR 140.7, Thunderbird ESR 140.7, Firefox 147 and Thunderbird 147. The advisory notes evidence of memory corruption and that, with enough effort, arbitrary code could potentially be exec...

CVE-2026-25989 ImageMagick has integer overflow or wraparound and incorrect conversion between numeric types in the internal SVG decoder

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a crafted SVG file can cause a denial of service. An off-by-one boundary check instead of = that allows bypass the guard and reach an undefined sizet cast...

CVE-2026-24481

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a heap information disclosure vulnerability exists in ImageMagick's PSD Adobe Photoshop format handler. When processing a maliciously crafted PSD file containin...

SUSE CVE-2026-27190

Deno is a JavaScript, TypeScript, and WebAssembly runtime. Prior to 2.6.8, a command injection vulnerability exists in Deno's node:childprocess implementation. This vulnerability is fixed in 2.6.8...

PT-2026-21675

Name of the Vulnerable Software and Affected Versions Docker Desktop versions prior to 4.62.0 Description An out of bounds read issue exists in the grpcfuse kernel module within the Linux VM used by Docker Desktop for Windows, Linux, and macOS. This could allow a local attacker to potentially cau...

CVE-2026-27022

@langchain/langgraph-checkpoint-redis is the Redis checkpoint and store implementation for LangGraph. A query injection vulnerability exists in the @langchain/langgraph-checkpoint-redis package's filter handling. The RedisSaver and ShallowRedisSaver classes construct RediSearch queries by directl...

CVE-2026-27485

Summary (concrete details): CVE-2026-27485 affects OpenClaw’s npm package, specifically the packaging helper script under skills/skill-creator/scripts/package_skill.py. The vulnerability arises when the script, run on a crafted local skill directory, follows symlinks to files outside the skill ro...

CVE-2026-27458 LinkAce: Stored XSS in Atom Feed via CDATA Escape in List Description

LinkAce is a self-hosted archive to collect website links. Versions 2.4.2 and below have a Stored Cross-site Scripting vulnerability through the Atom feed endpoint for lists /lists/feed. An authenticated user can inject a CDATA-breaking payload into a list description that escapes the XML CDATA...

CVE-2026-26992

Summary: CVE-2026-26992 affects LibreNMS up to version 26.1.1, where the port group name is not sanitized during creation via POST to /port-groups, enabling stored XSS when an admin creates a port group. The issue stems from unsanitized input in the name parameter, which is later rendered in the ...

CVE-2026-26987

LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring tool. Versions 25.12.0 and below are vulnerable to Reflected XSS attacks via email field. This issue has been fixed in version 26.2.0...

CVE-2026-26959 ADB Explorer Vulnerable to RCE via Insufficient Input Validation

ADB Explorer is a fluent UI for ADB on Windows. Versions 0.9.26020 and below fail to validate the integrity or authenticity of the ADB binary path specified in the ManualAdbPath setting before executing it, allowing arbitrary code execution with the privileges of the current user. An attacker can...

CVE-2026-2408 Use-after-free in Cloud Workloads

Tanium addressed a use-after-free vulnerability in the Cloud Workloads Enforce client extension...

CVE-2026-26314

CVE-2026-26314 (go-ethereum / geth): Prior to version 1.16.9, a vulnerable node can be forced to shutdown or crash by processing a specially crafted p2p message. The issue is resolved in v1.16.9 and v1.17.0 releases. Affected software: go-ethereum (Geth) execution layer of the Ethereum protocol. ...

PT-2026-20552

Name of the Vulnerable Software and Affected Versions InvoicePlane version 1.7.0 InvoicePlane versions prior to 1.7.1 Description A Stored Cross-Site Scripting XSS issue exists in InvoicePlane. An authenticated administrator can inject malicious JavaScript through the Product Unit Name fields. Th...