Redis: undisclosed vulnerability (ZAI-2026-LNZGNG)

Not disclosed. Details are not yet publicly disclosed...

Chasquid: undisclosed vulnerability (ZAI-2026-7Y6YOD)

Not disclosed. Details are not yet publicly disclosed...

Redis: undisclosed vulnerability (ZAI-2026-1Q6UU5)

Not disclosed. Details are not yet publicly disclosed...

Redis: undisclosed vulnerability (ZAI-2026-VLANCP)

Not disclosed. Details are not yet publicly disclosed...

Nacos: undisclosed vulnerability (ZAI-2026-3076EK)

Not disclosed. Details are not yet publicly disclosed...

Pixiv: undisclosed vulnerability (ZAI-2026-G2X87A)

Not disclosed. Details are not yet publicly disclosed...

GStreamer: undisclosed vulnerability (ZAI-2026-138GI8)

Not disclosed. Details are not yet publicly disclosed...

JeecgBoot: undisclosed vulnerability (ZAI-2026-P75QQS)

Not disclosed. Details are not yet publicly disclosed...

wolfSSL: undisclosed vulnerability (ZAI-2026-T3I9LK)

Not disclosed. Details are not yet publicly disclosed...

Apple Safari: undisclosed vulnerability (ZAI-2026-BVBFCK)

Not disclosed. Details are not yet publicly disclosed...

bank-dispute: undisclosed vulnerability (ZAI-2026-41WNIX)

Not disclosed. Details are not yet publicly disclosed...

GStreamer: undisclosed vulnerability (ZAI-2026-URWEH2)

Not disclosed. Details are not yet publicly disclosed...

Dingtalk: undisclosed vulnerability (ZAI-2026-2PJVT2)

Not disclosed. Details are not yet publicly disclosed...

FineReport: undisclosed vulnerability (ZAI-2026-PEQ0L2)

Not disclosed. Details are not yet publicly disclosed...

126 Mail: undisclosed vulnerability (ZAI-2026-6NPKQY)

Not disclosed. Details are not yet publicly disclosed...

Frappe comment template context values unescaped, leading to XSS

Frappe Comment Template Context Values Unescaped, Leading to XSS Vulnerability Overview When rendering the Jinja template of the website-side comment component in Frappe Framework, context values such as the page path, referenced doctype, and document name are concatenated directly into HTML...

FFmpeg: undisclosed vulnerability (ZAI-2026-D9L696)

Not disclosed. Details are not yet publicly disclosed...

SmartDNS: undisclosed vulnerability (ZAI-2026-81HOU3)

Not disclosed. Details are not yet publicly disclosed...

FreeBSD: undisclosed vulnerability (ZAI-2026-1RHT80)

Not disclosed. Details are not yet publicly disclosed...

Vaultwarden /events/collect cross-organization event injection

Vaultwarden /events/collect Cross-Organization Event Injection Vulnerability Overview The Bitwarden protocol's event-reporting endpoint POST /events/collect receives user operation events submitted by clients entry viewing, password-field copying, editing, etc., and the server writes them into...

Exim: undisclosed vulnerability (ZAI-2026-1O9YNW)

Not disclosed. Details are not yet publicly disclosed...

inDrive: undisclosed vulnerability (ZAI-2026-4TYTBA)

Not disclosed. Details are not yet publicly disclosed...

Microsoft DNS: undisclosed vulnerability (ZAI-2026-Z2AF14)

Not disclosed. Details are not yet publicly disclosed...

Redis: undisclosed vulnerability (ZAI-2026-UHBN8E)

Not disclosed. Details are not yet publicly disclosed...

Typora: undisclosed vulnerability (ZAI-2026-50LRC9)

Not disclosed. Details are not yet publicly disclosed...

wolfSSL: undisclosed vulnerability (ZAI-2026-R0NL2I)

Not disclosed. Details are not yet publicly disclosed...

Suricata: undisclosed vulnerability (ZAI-2026-SSNI71)

Not disclosed. Details are not yet publicly disclosed...

TikTok: undisclosed vulnerability (ZAI-2026-3XMTX2)

Not disclosed. Details are not yet publicly disclosed...

glibc resolver: undisclosed vulnerability (ZAI-2026-TJS14X)

Not disclosed. Details are not yet publicly disclosed...

GStreamer: undisclosed vulnerability (ZAI-2026-OT5LA4)

Not disclosed. Details are not yet publicly disclosed...

OpenBSD: undisclosed vulnerability (ZAI-2026-3DFRID)

Not disclosed. Details are not yet publicly disclosed...

GStreamer: undisclosed vulnerability (ZAI-2026-458UTH)

Not disclosed. Details are not yet publicly disclosed...

Airbnb: undisclosed vulnerability (ZAI-2026-PX2F0W)

Not disclosed. Details are not yet publicly disclosed...

Frappe Discussion Reply Markdown rendering allows unsafe tags, leading to stored XSS

Frappe Discussion Reply Markdown Rendering Allows Unsafe Tags, Leading to Stored XSS Vulnerability Overview The Discussion feature on the website side of Frappe Framework supports Markdown replies; after a reply is saved, the system pushes the rendered Markdown result in real time to all online...

Linux kernel 6lowpan: NHC entry use-after-free on error path

In the Linux kernel, the following vulnerability has been resolved: 6lowpan: fix NHC entry use-after-free on error path lowpannhcdouncompression looks up an NHC descriptor while holding lowpannhclock. If the descriptor has no uncompress callback, the error path drops the lock before printing...

QQ Mail: undisclosed vulnerability (ZAI-2026-2FWFM1)

Not disclosed. Details are not yet publicly disclosed...

Dnsmasq: undisclosed vulnerability (ZAI-2026-ORY50V)

Not disclosed. Details are not yet publicly disclosed...

ALSCO: undisclosed vulnerability (ZAI-2026-3XCY8S)

Not disclosed. Details are not yet publicly disclosed...

VMware Workstation/Fusion NAT vulnerability: a guest VM admin can disrupt or intercept other guest VMs' network connections

VMware Workstation/Fusion NAT Network Packet Management Flaw Allows a Guest VM to Disrupt or Intercept Other Guest VMs' Network Connections CVE-2026-22715 Vulnerability Overview VMware Workstation and Fusion contain a logic flaw CWE-923, communication channel not correctly restricted to intended...

FineReport: undisclosed vulnerability (ZAI-2026-88NSND)

Not disclosed. Details are not yet publicly disclosed...

Redis: undisclosed vulnerability (ZAI-2026-ZW22XM)

Not disclosed. Details are not yet publicly disclosed...

BIND9: undisclosed vulnerability (ZAI-2026-O7DVD0)

Not disclosed. Details are not yet publicly disclosed...

Redis: undisclosed vulnerability (ZAI-2026-XCSSCM)

Not disclosed. Details are not yet publicly disclosed...

FreeType: undisclosed vulnerability (ZAI-2026-S5HCAG)

Not disclosed. Details are not yet publicly disclosed...

Frappe Auto Repeat update_reference lacks reference-document permission check, allowing unauthorized document references

Frappe Auto Repeat updatereference Lacks Reference-Document Permission Check, Allowing Unauthorized Document References Vulnerability Overview Auto Repeat in Frappe Framework automatic repetition / subscription documents provides a whitelisted method used to bind a reference document to an...

Vaultwarden icon endpoint SSRF via IP-literal hrefs

Vaultwarden icon Endpoint Server-Side Request Forgery SSRF Vulnerability Overview Vaultwarden's built-in icon service ICONSERVICE=internal automatically fetches, on the server side, the web pages and icon resources pointed to by vault entry URIs in order to display favicons for entries. The...

SMTP MIME message/rfc822: encapsulation parser state not reset, bypassing attachment filename and decoded-content inspection

SMTP MIME message/rfc822: encapsulation parser state not reset, bypassing attachment filename and decoded-content inspection Vulnerability Overview Suricata's SMTP MIME parser incompletely resets state when processing message/rfc822 encapsulated messages: after entering the inner message, the...

Redis: undisclosed vulnerability (ZAI-2026-5YPF8J)

Not disclosed. Details are not yet publicly disclosed...

Databricks: undisclosed vulnerability (ZAI-2026-BVF26F)

Not disclosed. Details are not yet publicly disclosed...

Frappe Google OAuth state is client-controllable, enabling redirects and authorization-flow abuse

Frappe Google OAuth State Is Client-Controllable, Enabling Redirects and Authorization-Flow Abuse Vulnerability Overview The Google integrations in Frappe Framework Gmail/Calendar/Drive, etc. share a unified OAuth authorization entry point and callback handler. Before the fix, the authorization...