CVE-2026-114582

An issue was discovered in Django 6.1 before 6.1.3, 6.0 before 6.0.10, and 5.2 before 5.2.19. django.contrib.gis.gdal.SpatialReference and related transform methods and srs/srid setters do not restrict GDAL’s file and network access when parsing string input, which allows attackers to trigger...

CVE-2026-113593

An issue was discovered in Django 6.1 before 6.1.3, 6.0 before 6.0.10, and 5.2 before 5.2.19. The django.middleware.cache.UpdateCacheMiddleware and the django.views.decorators.cache.cachepage decorator generate identical cache keys for requests that omit a header listed in the response’s Vary...

CVE-2026-111362

An issue was discovered in Django 6.1 before 6.1.3, 6.0 before 6.0.10, and 5.2 before 5.2.19. django.contrib.gis.gdal.OGRGeometry does not restrict external coordinate reference system definitions in GeoJSON input, which allows remote attackers to cause server-side requests to attacker-selected...

CVE-2026-111211

An issue was discovered in Django 6.1 before 6.1.3, 6.0 before 6.0.10, and 5.2 before 5.2.19. django.contrib.gis.forms.widgets.BaseGeometryWidget.deserialize, used by django.contrib.gis.forms.GeometryField, does not escape invalid submitted values before logging them, which allows remote attacker...

CVE-2026-108147

An issue was discovered in Django 6.1 before 6.1.3, 6.0.4 before 6.0.10, and 5.2.13 before 5.2.19. django.http.multipartparser.MultiPartParser is subject to excessive memory consumption when processing multipart file uploads with base64 Content-Transfer-Encoding, which could be buffered entirely ...

CVE-2026-119722

Blender before 4.5.15 and 5.x before 5.2.3 contains a heap out-of-bounds access vulnerability in readstruct that skips size validation when a .blend file's SDNA struct layout compares equal. Attackers can supply a crafted .blend file with short blocks so field reads, writes, and pointer...

CVE-2026-119721

Blender before 4.5.15 and 5.x before 5.2.3 contains an out-of-bounds read vulnerability in blobheadid accessors in readfile.cc that read ID fields without block length checks. Attackers can supply a crafted .blend file with short ID blocks that, when browsed or appended from, causes heap over-rea...

CVE-2026-119720

Blender before 4.5.15 and 5.x before 5.2.3 contains a heap out-of-bounds read vulnerability in readfiledna that reads a GLOB block field without validating its declared length. Attackers can supply a crafted .blend file with a truncated GLOB block that, when opened, triggers the out-of-bounds rea...

CVE-2026-119719

Blender before 4.5.15 and 5.x before 5.2.3 contains a heap buffer overflow vulnerability in the blend file thumbnail extractor caused by 32-bit integer overflow in thumbdataverticalflip. Attackers can craft a .blend file with malicious TEST block dimensions that trigger an out-of-bounds write whe...

CVE-2026-119718

Blender before 4.5.15 and 5.x before 5.2.3 contains a heap buffer overflow vulnerability caused by integer overflow in ptcachedataalloc when reading point cache files. Attackers can supply a crafted point cache file with a large totpoint value alongside a .blend file to crash Blender or execute...

CVE-2026-119574

Traefik from 3.2.0 before 3.7.15 contains a data race in the experimental FastProxy that allows unauthenticated attackers to crash the process by abusing HTTP/1 protocol upgrades. Attackers can repeatedly open and abort upgraded connections such as WebSocket, corrupting the unsynchronized shared...

CVE-2026-119591

SQLite before 3.54.0 contains a stack exhaustion vulnerability in countOfViewOptimization that allows attackers to crash the host process via count over a large multi-row VALUES clause. Attackers supplying SQL or a database file with a crafted view can trigger deeply nested TKPLUS expressions who...

CVE-2026-119586

SQLite command-line shell through 3.54.1 contains a command injection vulnerability in the .recover command that emits attacker-planted dot-commands stored in sqliteschema.sql values verbatim. Attackers can craft a database whose schema holds a valid CREATE statement followed by a .shell or .syst...

CVE-2026-119563

phpMyAdmin through 5.2.3 contains a stored cross-site scripting vulnerability that allows database users with CREATE privilege to inject script via unescaped table names in DesignerHistory.display. Attackers can create a table whose name contains HTML markup that executes in another user's sessio...

CVE-2026-119562

phpMyAdmin through 5.2.3 contains an sql injection vulnerability that allows authenticated users to inject SQL by supplying unescaped colextra and colattribute values to /database/central-columns. Attackers can inject SQL into pmacentralcolumns INSERT and UPDATE queries run with controluser...

CVE-2026-119561

phpMyAdmin through 5.2.3 contains an authentication bypass vulnerability in CustomServer::parseAndValidateAssertionResponse that never verifies WebAuthn assertion signatures against stored public keys. Attackers holding a victim's MySQL credentials can POST a crafted webauthnrequestresponse with...

CVE-2026-119428

phpMyAdmin through 5.2.3 contains a server-side request forgery vulnerability that allows unauthenticated attackers to trigger outbound connections via setup/validate.php, which lacks the setup-disabled guard. Attackers can POST attacker-chosen host and port values reaching...

CVE-2026-119429

phpMyAdmin through 5.2.3 contains a missing re-authentication vulnerability that allows authenticated attackers to remove two-factor authentication by posting the 2fa key to /config/set. Attackers holding a hijacked session can submit key=2fa with a null JSON value to SetConfigController, strippi...

CVE-2026-119427

phpMyAdmin through 5.2.3 contains an sql injection vulnerability in Designer saveSetting that allows authenticated users to inject SQL via unescaped jsonencode output. Attackers can send crafted index or value parameters with operation=savesettingvalue to /database/designer to overwrite other...

CVE-2026-119426

phpMyAdmin through 5.2.3 contains a cross-site request forgery vulnerability that allows remote attackers to execute arbitrary SQL by bypassing CSRF token checks on non-AJAX POST requests. Attackers can lure authenticated victims into submitting cross-site POSTs carrying sqlquery to /sql or...

CVE-2026-119379

SQLite before 3.54.0 built with the session extension contains a heap buffer overflow vulnerability in sqlite3changesetapply that allows attackers to corrupt heap memory by supplying crafted changesets. Attackers can repeat a table name in a second changeset block with a larger column count,...

CVE-2026-119378

SQLite before 3.54.0 contains a use-after-free vulnerability in the R-Tree extension that allows attackers to make applications use freed heap memory by manipulating the %node shadow table. Attackers can supply a database declaring %node WITHOUT ROWID or with a RAISEIGNORE trigger so nodeWrite...

CVE-2026-119376

SQLite before 3.54.0 contains a stack exhaustion vulnerability that allows attackers to bypass the SQLITELIMITEXPRDEPTH limit by chaining COLLATE postfix operators. Attackers can supply roughly 175,000 chained COLLATE operators in SQL or an untrusted database view to trigger unbounded recursion i...

CVE-2026-119377

SQLite before 3.54.0 contains an authorization bypass vulnerability in lookupName that invokes the authorizer only for the first joined table's USING column. Attackers able to submit SQL can query a shared USING column in a RIGHT or FULL JOIN to read columns denied via sqlite3setauthorizer...

CVE-2026-119375

SQLite before 3.54.0 contains an information disclosure vulnerability that allows attackers to read uninitialized page-cache memory by supplying a WAL file with an undersized page size. Attackers can craft a database and WAL file whose oversized record payload makes queries like substr return sta...

CVE-2026-119374

SQLite before 3.54.0 built with FTS5 contains a heap buffer overflow in fts5DoSecureDelete that allows attackers to write past the leaf page buffer via crafted footer key offsets. Attackers can supply a database file with a corrupted FTS5 index that, when deleted from with secure-delete enabled,...

CVE-2026-119373

SQLite before 3.54.0 built with FTS5 contains a heap buffer overflow in fts5MergeRowidLists that undersizes the output buffer when merging detail=none prefix doclists. Attackers who can populate a detail=none FTS5 table with negative rowids and run a prefix MATCH query can write past the...

CVE-2026-119372

SQLite before 3.54.0 built with FTS3/FTS4 and SQLITEENABLEFTS3PARENTHESIS contains a use-after-free vulnerability in fts3BestSnippet caused by dangling cached position-list pointers. Attackers can run a full-text MATCH query combining OR and NEAR operators with snippet to read freed heap memory a...

CVE-2026-119364

ProFTPD through 1.3.9e and 1.3.10rc1 through 1.3.10rc4 contains a link-following vulnerability in modcopy that allows authenticated FTP users to bypass Limit WRITE restrictions via symlinks. Attackers can place a symlink in a writable directory and use SITE COPY or SITE CPTO to overwrite files in...

CVE-2026-119371

SQLite before 3.54.0 contains a stack exhaustion vulnerability that allows attackers to bypass the SQLITELIMITEXPRDEPTH nesting limit because common table expressions are not counted against it. Attackers can supply a WITH clause chaining tens of thousands of CTEs, via plain SQL or a view in an...

CVE-2026-119147

ProFTPD before 1.3.9e and 1.3.10rc5 contains an authorization bypass in the modsftp copy-file extension handler that skips Limit WRITE checks for new destination files. Authenticated SFTP users can copy any readable file to a new path in write-denied directories, creating files where uploads are...

CVE-2026-119146

ProFTPD before 1.3.9e and 1.3.10rc5 contains a buffer overflow vulnerability in the modrewrite int:utf8trans RewriteMap that allows remote attackers to overwrite static buffers. Attackers can send FTP command arguments longer than 1024 bytes, without authentication if pre-login commands are...

CVE-2026-119124

ImageMagick before 7.1.2-34 contains a heap-based buffer overflow in its -morph processing, where crafted images cause writes beyond the bounds of a heap buffer. An attacker can supply a crafted image that, when processed by a user with the -morph option, corrupts heap memory and crashes the...

CVE-2026-119123

ImageMagick before 7.1.2-34 contains a stack overflow vulnerability in the TIFF decoder that occurs when the DNG decoder is disabled. Attackers can supply a crafted image file for processing to trigger the stack overflow and crash the application, causing denial of service...

CVE-2026-114148

Incorrect default permissions in ASP.NET Core allows an authorized attacker to elevate privileges locally...

CVE-2026-85498

A flaw was found in polkit. When processing input that begins with a null byte, an arithmetic error in the authentication agent helper causes an integer underflow during buffer length calculation, resulting in an out-of-bounds memory read. An attacker capable of supplying crafted input can trigge...

CVE-2026-79656

A user with read access to Grafana's server logs, or to a log store they are shipped to, can recover the OAuth and OIDC access, refresh and ID tokens of users who sign in through the Generic OAuth, Google or GitLab providers. Grafana writes these tokens to its logs unredacted when an access or ID...

CVE-2026-116531

HTTP::Body versions before 1.2301 for Perl lose track of chunk boundaries in chunked request bodies when a read ends inside a chunk. In chunked mode, used when no content length is given, add treats a chunk as complete once the buffer is as long as the chunk's declared size, but the buffer still...

CVE-2026-116285

HTTP::Body versions before 1.2301 for Perl allow CPU exhaustion via quadratic regex backtracking when parsing chunked request bodies. In chunked mode, used when no content length is given, add matches each chunk-size line with /^\da-fA-F+.\x0D\x0A/. On a line of hex digits whose first LF has no C...

CVE-2026-116135

HTTP::Body versions before 1.2301 for Perl drop mixed-case percent escapes from urlencoded form fields instead of decoding them. The decode table holds only the all-lowercase and all-uppercase spelling of each hex pair, while the escape pattern matches either case. An escape such as %aB finds no...

CVE-2026-116134

HTTP::Body versions before 1.2301 for Perl allow memory exhaustion via an unbounded multipart part header block. The multipart parser takes everything up to the first blank line after a boundary as the part's header block, with no limit on its size or number of lines. Every line is stored in the...

CVE-2026-116133

HTTP::Body versions before 1.2301 for Perl allow CPU exhaustion via quadratic rescanning of a multipart body with a missing or malformed boundary. Before the first part, and between parts, the multipart parser searches the whole buffered body for the next boundary. On a miss it keeps everything a...

CVE-2026-116132

HTTP::Body versions before 1.2301 for Perl leave the temporary file of an incomplete multipart upload on disk. The multipart parser creates a temporary file as soon as a file part starts, but adds it to the upload list only when the part completes. Uploads are only ever deleted from that list, by...

CVE-2026-116131

HTTP::Body versions before 1.2301 for Perl allow memory and temporary file exhaustion via an unlimited number of form fields and multipart parts. The urlencoded parser splits the whole body on its separators at once, creating one scalar per separator before any field is stored. This costs about 9...

CVE-2026-88858

A user with the Viewer role in Grafana can crash the server by submitting a crafted server-side math expression uncontrolled recursion. A user with permission to provision alert rules can make the outage persist across restarts...

CVE-2026-88967

A user with query access to an Azure Monitor data source in Grafana can cause server-side requests to an attacker-controlled endpoint that disclose the data source's Azure access token server-side request forgery...

CVE-2026-100105

A user with permission to edit contact points but not their protected fields can change protected settings, such as a contact point's destination URL, by switching an integration to a legacy schema version, which can expose stored credentials and redirect alert notifications incorrect authorizati...

CVE-2026-117624

Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not consistently enforce the restriction on deserializing objects of types marked as storing their configuration in independent top-level configuration files as nested values, allowing attackers to bypass the root element check and potential...

CVE-2026-117623

Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not escape the text shown in the tooltips of breadcrumb bar overflow menu entries, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers with Overall/Read permission...

CVE-2026-117621

Jenkins 2.587 and earlier, LTS 2.580.1 and earlier computes on the agent the URL of the link shown in the workspace browser for each file and directory, resulting in a cross-site scripting XSS vulnerability exploitable by attackers in control of agent processes...