Redis: undisclosed vulnerability (ZAI-2026-LNZGNG)

Not disclosed. Details are not yet publicly disclosed...

Redis: undisclosed vulnerability (ZAI-2026-1Q6UU5)

Not disclosed. Details are not yet publicly disclosed...

Chasquid: undisclosed vulnerability (ZAI-2026-7Y6YOD)

Not disclosed. Details are not yet publicly disclosed...

Nacos: undisclosed vulnerability (ZAI-2026-3076EK)

Not disclosed. Details are not yet publicly disclosed...

GStreamer: undisclosed vulnerability (ZAI-2026-138GI8)

Not disclosed. Details are not yet publicly disclosed...

JeecgBoot: undisclosed vulnerability (ZAI-2026-P75QQS)

Not disclosed. Details are not yet publicly disclosed...

wolfSSL: undisclosed vulnerability (ZAI-2026-T3I9LK)

Not disclosed. Details are not yet publicly disclosed...

Apple Safari: undisclosed vulnerability (ZAI-2026-BVBFCK)

Not disclosed. Details are not yet publicly disclosed...

bank-dispute: undisclosed vulnerability (ZAI-2026-41WNIX)

Not disclosed. Details are not yet publicly disclosed...

126 Mail: undisclosed vulnerability (ZAI-2026-6NPKQY)

Not disclosed. Details are not yet publicly disclosed...

GStreamer: undisclosed vulnerability (ZAI-2026-URWEH2)

Not disclosed. Details are not yet publicly disclosed...

Frappe comment template context values unescaped, leading to XSS

Frappe Comment Template Context Values Unescaped, Leading to XSS Vulnerability Overview When rendering the Jinja template of the website-side comment component in Frappe Framework, context values such as the page path, referenced doctype, and document name are concatenated directly into HTML...

FFmpeg: undisclosed vulnerability (ZAI-2026-D9L696)

Not disclosed. Details are not yet publicly disclosed...

FineReport: undisclosed vulnerability (ZAI-2026-PEQ0L2)

Not disclosed. Details are not yet publicly disclosed...

SmartDNS: undisclosed vulnerability (ZAI-2026-81HOU3)

Not disclosed. Details are not yet publicly disclosed...

Exim: undisclosed vulnerability (ZAI-2026-1O9YNW)

Not disclosed. Details are not yet publicly disclosed...

FreeBSD: undisclosed vulnerability (ZAI-2026-1RHT80)

Not disclosed. Details are not yet publicly disclosed...

inDrive: undisclosed vulnerability (ZAI-2026-4TYTBA)

Not disclosed. Details are not yet publicly disclosed...

Redis: undisclosed vulnerability (ZAI-2026-UHBN8E)

Not disclosed. Details are not yet publicly disclosed...

Typora: undisclosed vulnerability (ZAI-2026-50LRC9)

Not disclosed. Details are not yet publicly disclosed...

OpenBSD: undisclosed vulnerability (ZAI-2026-3DFRID)

Not disclosed. Details are not yet publicly disclosed...

Suricata: undisclosed vulnerability (ZAI-2026-SSNI71)

Not disclosed. Details are not yet publicly disclosed...

Microsoft DNS: undisclosed vulnerability (ZAI-2026-Z2AF14)

Not disclosed. Details are not yet publicly disclosed...

GStreamer: undisclosed vulnerability (ZAI-2026-458UTH)

Not disclosed. Details are not yet publicly disclosed...

glibc resolver: undisclosed vulnerability (ZAI-2026-TJS14X)

Not disclosed. Details are not yet publicly disclosed...

Airbnb: undisclosed vulnerability (ZAI-2026-PX2F0W)

Not disclosed. Details are not yet publicly disclosed...

wolfSSL: undisclosed vulnerability (ZAI-2026-R0NL2I)

Not disclosed. Details are not yet publicly disclosed...

ALSCO: undisclosed vulnerability (ZAI-2026-3XCY8S)

Not disclosed. Details are not yet publicly disclosed...

Linux kernel 6lowpan: NHC entry use-after-free on error path

In the Linux kernel, the following vulnerability has been resolved: 6lowpan: fix NHC entry use-after-free on error path lowpannhcdouncompression looks up an NHC descriptor while holding lowpannhclock. If the descriptor has no uncompress callback, the error path drops the lock before printing...

GStreamer: undisclosed vulnerability (ZAI-2026-OT5LA4)

Not disclosed. Details are not yet publicly disclosed...

VMware Workstation/Fusion NAT vulnerability: a guest VM admin can disrupt or intercept other guest VMs' network connections

VMware Workstation/Fusion NAT Network Packet Management Flaw Allows a Guest VM to Disrupt or Intercept Other Guest VMs' Network Connections CVE-2026-22715 Vulnerability Overview VMware Workstation and Fusion contain a logic flaw CWE-923, communication channel not correctly restricted to intended...

TikTok: undisclosed vulnerability (ZAI-2026-3XMTX2)

Not disclosed. Details are not yet publicly disclosed...

FineReport: undisclosed vulnerability (ZAI-2026-88NSND)

Not disclosed. Details are not yet publicly disclosed...

Redis: undisclosed vulnerability (ZAI-2026-XCSSCM)

Not disclosed. Details are not yet publicly disclosed...

MongoDB: undisclosed vulnerability (ZAI-2026-M5JLW3)

Not disclosed. Details are not yet publicly disclosed...

FreeType: undisclosed vulnerability (ZAI-2026-S5HCAG)

Not disclosed. Details are not yet publicly disclosed...

Pixiv: undisclosed vulnerability (ZAI-2026-G2X87A)

Not disclosed. Details are not yet publicly disclosed...

Frappe Auto Repeat update_reference lacks reference-document permission check, allowing unauthorized document references

Frappe Auto Repeat updatereference Lacks Reference-Document Permission Check, Allowing Unauthorized Document References Vulnerability Overview Auto Repeat in Frappe Framework automatic repetition / subscription documents provides a whitelisted method used to bind a reference document to an...

Vaultwarden /events/collect cross-organization event injection

Vaultwarden /events/collect Cross-Organization Event Injection Vulnerability Overview The Bitwarden protocol's event-reporting endpoint POST /events/collect receives user operation events submitted by clients entry viewing, password-field copying, editing, etc., and the server writes them into...

Redis: undisclosed vulnerability (ZAI-2026-ZW22XM)

Not disclosed. Details are not yet publicly disclosed...

Dnsmasq: undisclosed vulnerability (ZAI-2026-ORY50V)

Not disclosed. Details are not yet publicly disclosed...

BIND9: undisclosed vulnerability (ZAI-2026-O7DVD0)

Not disclosed. Details are not yet publicly disclosed...

FineReport: undisclosed vulnerability (ZAI-2026-WP2SMY)

Not disclosed. Details are not yet publicly disclosed...

Suricata: undisclosed vulnerability (ZAI-2026-ZGY90J)

Not disclosed. Details are not yet publicly disclosed...

FFmpeg: undisclosed vulnerability (ZAI-2026-42S9BI)

Not disclosed. Details are not yet publicly disclosed...

GStreamer: undisclosed vulnerability (ZAI-2026-C3517B)

Not disclosed. Details are not yet publicly disclosed...

Frappe Google OAuth state is client-controllable, enabling redirects and authorization-flow abuse

Frappe Google OAuth State Is Client-Controllable, Enabling Redirects and Authorization-Flow Abuse Vulnerability Overview The Google integrations in Frappe Framework Gmail/Calendar/Drive, etc. share a unified OAuth authorization entry point and callback handler. Before the fix, the authorization...

Seafile server-controlled sync path can escape the client worktree (macOS/Linux)

Seafile server-controlled sync path can escape the client worktree macOS/Linux Vulnerability Overview The Seafile client's sync module applies file diffs delivered by the server during the checkout phase, and the target path of rename operations is fully controlled by the server. The validity che...

WeKan expired impersonation records bypass private board export authorization (ImpersonateBleed)

WeKan Expired Impersonation Records Bypass Private Board Export Authorization ImpersonateBleed Vulnerability Overview WeKan administrators can use the impersonation feature to operate as other users, and the system records every impersonation action. The flaw is this: in addition to the normal...

WeKan /metrics unconditionally trusts X-Forwarded-For, allowing whitelist IP spoofing (MetricsBleed)

WeKan /metrics Unconditionally Trusts X-Forwarded-For, Allowing Whitelist IP Spoofing MetricsBleed Vulnerability Overview WeKan's Prometheus /metrics endpoint restricts access via an IP whitelist only configured monitoring IPs are allowed. When determining the client's source IP, the code...