CVE-2026-65423

An integer overflow in the UAVariant arrayDimensions product computation in open62541 may allow a remote attacker to trigger an out-of-bounds write...

DEBIAN-CVE-2026-65423

An integer overflow in the UAVariant arrayDimensions product computation in open62541 may allow a remote attacker to trigger an out-of-bounds write...

CVE-2026-17721

An out of bounds write flaw was found in the ANGLE component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=523495723...

CVE-2026-10031

SFTPGo before 2.7.4 contains a permission bypass vulnerability where an authenticated user can circumvent per-directory access controls by creating symbolic links in a permitted directory that point to files in directories where download, upload, or overwrite are denied. Exploitation relies on th...

CVE-2026-68562

A flaw was found in ansible-collection-redhat-leapp. An attacker with privileged write access to a managed node's Leapp report content can manipulate it. When an operator runs a specific remediation task, this manipulated report can cause the Ansible controller to read its own local files and cop...

CVE-2026-65423 o6 Automation open62541 Integer Overflow or Wraparound

An integer overflow in the UAVariant arrayDimensions product computation in open62541 may allow a remote attacker to trigger an out-of-bounds write...

CVE-2026-65423

An integer overflow in the UAVariant arrayDimensions product computation in open62541 may allow a remote attacker to trigger an out-of-bounds write...

CVE-2026-65423 o6 Automation open62541 Integer Overflow or Wraparound

An integer overflow in the UAVariant arrayDimensions product computation in open62541 may allow a remote attacker to trigger an out-of-bounds write...

CVE-2026-65423

The CVE concerns the open62541 library. Vulnerable: UA_Variant arrayDimensions product computation. Root cause: integer overflow that may cause an out-of-bounds write. Impact (per documents): network-accessible by remote attacker with low privileges, high impact to confidentiality, integrity, and...

CVE-2026-68562

CVE-2026-68562 affects the ansible-collection-redhat-leapp. A privileged attacker who can write to a managed node’s Leapp report can tamper the report; when an operator runs a remediation task, the Ansible controller may read its own local files and copy them to the managed node, causing informat...

CVE-2026-67206 Wolf CMS 0.8.3.1 Authenticated RCE via FileManagerController File Upload

Wolf CMS through 0.8.3.1 contains a remote code execution vulnerability in FileManagerController that allows authenticated attackers to create arbitrary PHP files by exploiting missing file extension validation in the createfile and save functions. Attackers with the filemanagermkfile capability...

CVE-2026-67594

Summary (CVE-2026-67594): Spikster (commit e1cdf8c) contains a missing authentication flaw in the API route group due to the CipiAuth middleware being registered but never applied. This allows unauthenticated remote attackers to access approximately 50 API endpoints, enabling enumeration and prov...

CVE-2026-67594 Spikster Missing Authentication via API Route Group

Spikster through commit e1cdf8c contains a missing authentication vulnerability that allows unauthenticated remote attackers to access all API routes by exploiting the unattached CipiAuth middleware, which is registered but never applied to any route in the API routing configuration. Attackers ca...

ALPINE-CVE-2026-11771

OpenVPN version 2.1.0 through 2.6.20 and 2.7alpha1 through 2.7.4 allows attackers via an off-by-one buffer write in the NTLM proxy authentication to potentially cause a crash via a crafted NTLM response from a malicious proxy server...

CVE-2026-11771

OpenVPN version 2.1.0 through 2.6.20 and 2.7alpha1 through 2.7.4 allows attackers via an off-by-one buffer write in the NTLM proxy authentication to potentially cause a crash via a crafted NTLM response from a malicious proxy server...

CVE-2026-48499

Activepieces is an open source AI workflow automation platform. Prior to 0.84.0, an unsanitized path segment in the Code piece sandbox can let an authenticated flow author reach read-write cached flow and code files belonging to other tenants on the same worker, exposing embedded data and allowin...

SUSE CVE-2026-40090

Zarf is an Airgap Native Packager Manager for Kubernetes. Versions 0.23.0 through 0.74.1 contain an arbitrary file write vulnerability in the zarf package inspect sbom and zarf package inspect documentation subcommands. These subcommands output file paths are constructed by joining a...

SUSE CVE-2026-46695

Boxlite is a sandbox service that allows users to create lightweight virtual machines Boxes and launch OCI containers within them to run untrusted code. Prior to version 0.9.0, Boxlite does not restrict the kernel capabilities available inside the container, malicious code can remount the directo...

SUSE CVE-2026-47671

Nhost is an open source Firebase alternative with GraphQL. In versions of Nhost CLI prior to 1.46.0, the hidden nhost configserver used by nhost dev exposes the Mimir GraphQL API with dummy authorization directives and permissive CORS. When a developer is running the local development environment...

SUSE CVE-2026-48089

DevGuard provides vulnerability management for the full software supply chain. Prior to 1.4.2, on a DevGuard API instance with one or more public assets, any authenticated user - including users from a different organization with no membership or role in the affected org/project - can create,...