ALPINE-CVE-2026-56406

libexpat before 2.8.2 has an integer overflow in XMLParseBuffer because it lacked a check that was present in XMLParse...

CVE-2026-56385

Craft CMS versions = 5.0.0-RC1, = 4.0.0-RC1, = 4.17.7 contain an authorization bypass in the assets/preview-file endpoint. The action does not enforce per-asset view authorization before returning preview content, allowing an authenticated low-privileged user to supply a controlled assetId for an...

CVE-2026-56384 Craft CMS - Missing Authorization in assets/preview-thumb Endpoint

Craft CMS contains a missing authorization vulnerability in the assets/preview-thumb endpoint. A Control Panel user without permission to view a target private asset can call the endpoint with an attacker-controlled assetId and receive preview HTML containing a signed fallback transform preview...

CVE-2026-56382 Craft CMS - Remote Code Execution via Missing Config Sanitization in FieldsController

Craft CMS composer package craftcms/cms versions = 5.5.0 and = 5.9.13 contain a remote code execution vulnerability in the FieldsController::actionRenderCardPreview method, which passes the fieldLayoutConfig POST parameter directly to Fields::createLayout without calling Component::cleanseConfig...

CVE-2026-56378 ImageMagick - Heap Out-of-Bounds Read in PCD Decoder

ImageMagick before 7.1.2-15 and 6.x before 6.9.13-40 contains a heap out-of-bounds read in the PCD coder's DecodeImage loop. A crafted PCD file can trigger a one-byte heap out-of-bounds read during image decoding, resulting in denial of service and potential disclosure of an adjacent heap byte...

EUVD-2026-38134

AVideo TopMenu plugin through version 26.0 contains a stored cross-site scripting vulnerability in menu item rendering due to missing output encoding of icon classes, URLs, and text labels. Attackers can inject malicious JavaScript through unescaped menu item fields that execute for all site...

CVE-2026-56340 vLLM - Denial of Service via Unvalidated Multimodal Embeddings

vLLM versions = 0.10.2 and 0.13.0 are missing sparse tensor validation in multimodal embeddings processing. Because PyTorch disables sparse tensor invariant checks by default, an attacker can submit crafted embedding requests with malformed negative or out-of-bounds tensor indices, when the...

a-gpt (>=0.1.0, <=0.4.0), abd-clam (>=0.21.6, <=0.21.7) +2844 more potentially affected by unknown CVE via memmap2 (>=0.1.0, <=0.9.10)

memmap2 CARGO version =0.1.0, =0.1.0, =0.21.6, =0.4.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.2.2, =0.23.0, =0.23.0, =1.0.5, =1.1.2 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2026-0186...

Linux Distros Unpatched Vulnerability : CVE-2026-48988

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - markdown-it is a Markdown parser. Versions 14.1.1 and below contain a denial-of-service vulnerability when typographer: true is enabled, due to quadratic On^2...

PT-2026-51132

Name of the Vulnerable Software and Affected Versions Simple File List versions prior to 6.3.8 Description The Simple File List plugin for WordPress contains insufficient authorization checks that allow unauthenticated attackers to delete and modify files on the server. This issue occurs within t...

Fedora 44 : singularity-ce (2026-63ae478575)

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-63ae478575 advisory. Upgrade to 4.4.2 upstream version. Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessu...

bolic-network (0.0.1), futures-quic (>=0.2.4, <=0.2.8) +10 more potentially affected by CVE-2026-11941 via quiche (>=0.20.1, <=0.24.9)

quiche CARGO version =0.20.1, =0.2.4, =0.1.1, =2.0.0, =0.1.0, =0.1.19, =0.1.19, =0.1.19, =0.1.19, =0.1.21 Source cves: CVE-2026-11941 Source advisory: OSV:GHSA-MH64-PH39-MRC9...

@openinc/parse-server-opendash (>=4.0.0, <=4.0.29) potentially affected by CVE-2026-57481 via parse-server (>=9.6.0-alpha.37, <=9.8.0)

parse-server NPM version =9.6.0-alpha.37, =4.0.0, =4.0.29 Source cves: CVE-2026-57481 Source advisory: OSV:GHSA-97PR-9HGG-3P8R...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS via unsanitized input in the class attribute of the HTML template. An attacker can execute arbitrary JavaScript in the context of the affected site by injecting malicious code through user-supplied input. Detail...

GHSA-FCW4-WWQM-M8CF Grafana Operator: Privilege escalation from namespace admin to cluster admin via GrafanaDashboard jsonnetLib fileName

We have released version 5.24.0 of the Grafana Operator. This patch includes a MODERATE severity security fix for a path traversal/privilege escalation vulnerability in the Grafana Operator. Summary The Grafana Operator supports loading dashboards & library panels using the jsonnet data templatin...

@chaibuilder/sdk (>=0.1.0, <=1.2.19), @coderrental/csp-categorytree (>=1.1.0, <=1.1.7) +2 more potentially affected by CVE-2026-55091 via flat-to-nested (>=1.1.0, <=1.1.1)

flat-to-nested NPM version =1.1.0, =0.1.0, =1.1.0, =1.0.17, =1.0.18 - flow-dg-category-module 0.0.0 Source cves: CVE-2026-55091 Source advisory: OSV:GHSA-HP36-V28F-W3R4...

@ajna-inc/npmvc (>=0.1.0, <=0.3.4), @cra-ready/cli (>=0.1.0, <=0.1.1) +3 more potentially affected by CVE-2026-55849 via @cyclonedx/cyclonedx-npm (>=3.1.0, <=4.2.1)

@cyclonedx/cyclonedx-npm NPM version =3.1.0, =0.1.0, =0.1.0, =1.0.8, =1.1.3 - @raj-dev/guardrail 1.0.0 - flatlock 1.2.0 Source cves: CVE-2026-55849 Source advisory: SNYK:JS-CYCLONEDXCYCLONEDXNPM-17817903...

kozou (>=1.0.0, <=1.8.0) potentially affected by unknown CVE via @kozou/mcp (>=1.0.0, <=1.8.0)

@kozou/mcp NPM version =1.0.0, =1.0.0, =1.8.0 Source cves: unknown CVE Source advisory: OSV:GHSA-V52W-28XH-V562...

Exploit for Deserialization of Untrusted Data in Facebook React

CVE-2025-55182 — React2Shell Unauthenticated RCE in React S...

@kontaa/subgraph (>=1.0.1, <=1.2.3), @kontaa/utils (>=1.2.1, <=1.2.3) +4 more potentially affected by CVE-2026-55778 via parse-server (>=6.5.11, <=7.5.4)

parse-server NPM version =6.5.11, =1.0.1, =1.2.1, =2.4.46, =1.0.1, =1.0.0, =1.0.0, =1.0.1 Source cves: CVE-2026-55778 Source advisory: SNYK:JS-PARSESERVER-17420047...