Lowcoder Query Library API contains cross-tenant authorization bypass allowing for data exfiltration

Overview Lowcoder, version 2.4.10, contains an authorization bypass vulnerability in its Query Library feature’s API. Authenticated users with an admin or dev role can access private library-query data from other organizations within a multi-tenant Lowcoder instance. Description CVE-2026-16753...

Retraction of mpc-lib hardened derivation fails to protect ancestor isolation

Overview Fireblocks' mpc-lib library contains a cryptographic fail-open vulnerability in its BIP32 hardened derivation implementation in the case of a missing private parent key. This breaks the ancestor isolation property of hardened derivation, allowing an attacker with a compromised lower-leve...

Komodo Periphery agent contains an OS command injection vulnerability

Overview Versions = 2.2.0 of Periphery, an agent within the Komodo server management platform, is vulnerable to OS command injection due to missing validation of container names, through two vectors: container destruction and container log searches. This allows an authenticated attacker to execut...

COVESA vsomeip excessive memory allocation in reliable (TCP) endpoint buffer handling

Overview vsomeip, COVESA's open source implementation of the SOME/IP automotive communication middleware, contained a memory allocation vulnerability present in versions 3.7.3 and below. A vsomeip reliable TCP SOME/IP endpoint grows its receive buffer to an attacker-declared message size before...