CVE-2026-54503

The connected advisories reveal a concrete vulnerability in plone.app.textfield: Stored XSS when RichText mimeType and outputMimeType are the same, bypassing safe_html on render and emitting unsanitized content. Root cause: RichTextValue.output returns the raw value when stored mimeType equals ou...

CVE-2026-50185

CVE-2026-50185 affects RustCrypto CMOV (cmov crate) aarch64 backends where Cmov and CmovEq incorrectly assume high bits are zero-extended when loading small values, causing left.cmovz and cmoveq operations to produce incorrect results under certain casts or inline-asm paths. Affected range is 0.1...

CVE-2026-52746

CVE-2026-52746 concerns the JSONata language. Affected: jsonata prior to version 2.2.0. Issue: malicious non-matching inputs to the $toMillis function can cause superlinear backtracking in the ISO-8601 validation regex, leading to denial of service in applications evaluating JSONata expressions. ...

CVE-2026-48487

CVE-2026-48487 (python-zeroconf) : Prior to 0.149.16, _read_character_string and _read_string in zeroconf’s incoming protocol could advance the parser past the end of the payload by using attacker-declared RDLENGTH without checking against data length, enabling unauthenticated LAN-local hosts on ...

CVE-2026-48045

The CVE-2026-48045 issue affects python-zeroconf (Zeroconf Pure Python) where AsyncListener.handle_query_or_defer retains every truncated TC-bit mDNS query per source in self._deferred[addr] and arms per-address timers in self._timers[addr]. This unbounded queue growth on LAN-local hosts (UDP/535...

CVE-2026-9171

CVE-2026-9171 is an IBM WebSphere Application Server/Liberty denial-of-service vulnerability caused by sending a specially crafted request that can lead to memory resource exhaustion. It affects PowerVM Novalink versions 2.2.0, 2.2.1, 2.2.1.1, 2.3.0, 2.3.0.1, 2.3.1, 2.3.2. IBM IBM-provided bullet...

CVE-2026-47184

CVE-2026-47184 affects the python-zeroconf project. DNSCache._async_add can insert every response record into cache, expirations, expire_heap, and service_cache without a cap, enabling unauthenticated LAN hosts on UDP/5353 (224.0.0.251 / ff02::fb) to multicast valid mDNS responses with unique nam...

CVE-2026-47183

CVE-2026-47183 - zeroconf (python-zeroconf) : Affected versions prior to 0.149.6 store an unbounded in-memory log of exceptions in DNSIncoming._log_exception_debug and QuietLogger dedup, retaining frame locals with raw packet data. This enables any unauthenticated LAN host on UDP/5353 (224.0.0.25...

CVE-2026-47180

CVE-2026-47180 affects the Zeroconf Python library. The vulnerability stems from DNSIncoming._decode_labels_at_offset recursing for each DNS-name compression pointer; a crafted mDNS packet with ~1500 chained pointers can cause unbounded recursion, escaping DNSIncoming.init and triggering sustaine...

CVE-2026-53712

The CVE describes a vulnerability in the OnGres SCRAM library (com.ongres.scram:scram-client and scram-common) where, prior to version 3.3, a TLS MITM can silently downgrade SCRAM-SHA-256-PLUS with channel binding to SCRAM-SHA-256 without channel binding when an X.509 certificate uses modern sign...

CVE-2026-49835

Technical details regarding CVE-2026-49835 are not publicly available in the provided documents. Monitor for updates from official advisories and OSV entries for any surfaced specifics (affected product/version, impact, fix).

CVE-2026-16073

Technical details are not publicly available in the provided documents. Monitor for updates.

CVE-2026-54247

CVE-2026-54247 is linked to a Kubernetes-related exposure in Skipper’s admission webhook. The advisory notes an unbounded memory allocation: the admission webhook reads the full request body with io.ReadAll(r.Body) without a size limit, allowing a nefarious client with cluster access to send mult...

CVE-2026-50273

Datadog .NET Tracer (dd-trace-dotnet) is affected prior to version 3.43.0 by CVE-2026-50273 due to improper parsing of W3C baggage headers. The extraction path does not enforce DD_TRACE_BAGGAGE_MAX_ITEMS or DD_TRACE_BAGGAGE_MAX_BYTES, allowing a remote unauthenticated attacker to send a header wi...

CVE-2026-48009

Shopware vulnerability CVE-2026-48009: A low-privilege admin with user_recovery:read can takeover any admin by triggering password recovery, reading the recovery hash via Admin API, and resetting the password. Root cause: the hash field in UserRecoveryDefinition was exposed in the Admin API (no A...

CVE-2026-48014

Summary: CVE-2026-48014 affects Shopware open commerce platforms prior to 6.6.10.18 and 6.7.10.1, where Admin API order state transition routes (/api/_action/order/{orderId}/state/{transition} and related endpoints) could bypass ACL checks. The routes did not declare PlatformRequest::ATTRIBUTE_AC...

CVE-2026-48010

Summary: CVE-2026-48010 affects Shopware core prior to versions 6.6.10.18 and 6.7.10.1. The vulnerability arises when UserController::upsertUser() writes raw request data in SYSTEM_SCOPE without filtering the admin field, allowing a non-admin API user with user:create or user:update ACL to set ad...

CVE-2026-48016

Summary of findings (CVE-2026-48016) : The vulnerability in Shopware Store API allows an external Store API user, including guests, to trigger payments for another user’s order by supplying a foreign orderId to the endpoint /store-api/handle-payment. The root cause is that payment initiation/proc...

CVE-2026-48015

Shopware core is affected by CVE-2026-48015 due to SVG files being allowed in the media upload whitelist and not sanitized in the upload pipeline (MediaUploadController → FileSaver → TypeDetector). Prior to versions 6.6.10.18 and 6.7.10.1, uploading SVGs could allow embedded JavaScript (onload, [...

CVE-2026-48008

Shopware vulnerability CVE-2026-48008 describes privilege escalation via the Sync API. A non-admin API user with integration:create can set admin: true when creating an integration through POST /api/_action/sync, bypassing the normal admin-check that blocks admin flag on POST /api/integration. Th...

CVE-2026-9198

IBM Langflow OSS versions 1.0.0–1.10.0 are affected by CVE-2026-9198: unauthenticated attackers chain /api/v1/auto_login (issues superuser tokens) with /api/v1/validate/code (exec() of user code) to achieve full RCE on default deployments. The root cause is the combination of an open auto-login e...

CVE-2026-9202

CVE-2026-9202 affects IBM Langflow OSS versions 1.0.0–1.10.0. Unauthenticated attackers can create unlimited user accounts; if NEW_USER_IS_ACTIVE is true, new accounts are immediately active and can authenticate to reach RCE endpoints, bypassing AUTO_LOGIN. IBM CVSS v3.1 base score 9.8 (CRITICAL)...

CVE-2026-9762

CVE-2026-9762 affects IBM Db2 Client components: the IBM Data Server Driver for JDBC and SQLJ. A remote code execution (RCE) exists when the JDBC URL is under user control. Affected products/versions: Db2 client 11.5.0–11.5.9 and 12.1.0–12.1.4. Root cause identified as CWE-94 (Improper Code Gener...

CVE-2025-59866

The CVE concerns HCL DFMPro, DFXAnalytics, and DFXServer installers suffering from Insecure file permissions that allow a logged-in non-administrative user to overwrite or replace the executable with a malicious binary. The underlying cause is unrestricted or insecure permissions on the installer...

CVE-2026-21764

Technical details about CVE-2026-21764 are not publicly available in the provided documents. Monitor for updates from official sources; current entries only state insufficient input validation without specifics.

CVE-2026-21762

Technical details are not publicly available in the provided documents. Monitor for updates.

CVE-2026-21761

Technical details about CVE-2026-21761 are not publicly available in the provided documents. Monitor for updates from the referenced sources.

CVE-2026-21760

CVE-2026-21760 affects HCL DevOps Loop with an unauthorized access via forced browsing. The root cause is improper authorization checks that permit direct access to protected admin endpoints. CVSSv3.1 metrics indicate Network attack vector, Low privileges required, User interaction required, with...

CVE-2026-12694

CVE-2026-12694 concerns Vimesoft Inc.’s Enterprise Video Platform. Affected versions are 3.11.0.0 through 3.24.x (before 3.25.0). The issue is a Missing Authorization vulnerability that allows accessing functionality not properly constrained by ACLs. Practical impact described is high due to pote...

CVE-2026-54496

CVE-2026-54496 affects Zebrad and related crates (halo2_gadgets, orchard, zcash_primitives, zcashd) prior to fixed versions. Root cause: the variable-base scalar multiplication gadget uses assign_advice() to feed the base point in halo2_gadgets—without a copy constraint tying it to the real base—...

CVE-2026-12693

The CVE-2026-12693 entry concerns an Identity/Authorization weakness in Vimesoft Inc.'s Enterprise Video Platform. Affected software: Enterprise Video Platform versions 3.11.0.0 up to, but not including, 3.25.0. The issue is an Authorization bypass via a User-Controlled key, leading to a lack of ...

CVE-2026-16104

CVE-2026-16104 affects the authentication configuration endpoint in the Keycloak services used by Red Hat Build of Keycloak. The underlying issue is that the system does not mask sensitive configuration values (e.g., reCAPTCHA secrets) when requested by administrators with view-only permissions, ...

CVE-2026-16103

Keycloak CVE-2026-16103 affects the keycloak-services component. It describes an incomplete fix for CVE-2026-9798: brute-force protection checks were added to the CIBA initiation path but omitted from the token redemption path. As a result, an attacker with valid client credentials can obtain acc...

CVE-2026-14957

Technical details for CVE-2026-14957 are not publicly available in the provided documents. Monitor for updates.

CVE-2026-16106

CVE-2026-16106 refers to Keycloak, specifically the admin REST API. The issue arises when a delegated administrator attempts to remove a child role from a composite role, bypassing authorization checks. This can allow a user with limited admin permissions to remove privileged roles they are not a...

CVE-2026-16108

The CVE-2026-16108 issue affects Keycloak’s default-groups REST endpoint and realm representation. It allows a delegated administrator with realm-viewing permissions to disclose the names and identifiers of hidden default groups that they should not be able to view, potentially exposing internal ...

CVE-2026-16093

CVE-2026-16093 affects Keycloak’s Client Policies by allowing bypass of the requirement to use signed JWTs. A flaw lets an attacker with valid client credentials submit a fake, unsigned assertion header, making the system think policy requirements are met and enabling authentication with simpler ...

CVE-2026-44722

Summary: CVE-2026-44722 affects pyzipper before 0.4.0, where a Python operator precedence bug in pyzipper/zipfile_aes.py prevented automatic selection of AE-2 during encryption. As a result, entries were written using AE-1 format, which stores the plaintext CRC32 checksum in the ZIP header and, f...

CVE-2026-12692

CVE-2026-12692 affects Vimesoft Inc. Enterprise Video Platform (EVP) versions prior to 3.25.0, with EVP 3.11.0.0 and above being affected. The issue is described as an unverified password change vulnerability that enables authentication bypass. The available documents do not provide details on th...

CVE-2026-12691

CVE-2026-12691 affects Vimesoft Inc. Enterprise Video Platform, vulnerable in versions before 3.25.0 (3.11.0.0 onwards up to but not including 3.25.0). The issue is a missing authentication for a critical function that enables an authentication bypass. Public references list this vulnerability wi...

CVE-2026-49215

Symphony UX LiveComponent is affected: from version 2.22.0 through 2.36.0 and in 3.1.0, the isLiveComponentRequest() gate relied on Accept: application/vnd.live-component+html, which is CORS-safelisted. Cross-origin fetch() can set this header without a preflight, allowing forged cross-origin #[L...

CVE-2026-57860

Technical details about CVE-2026-57860 are not publicly available in the provided documents. Monitor for updates.

CVE-2026-49216

CVE-2026-49216 (Symfony UX Autocomplete) : The Stimulus controller in symfony/ux-autocomplete renders AJAX response items by interpolating item[labelField] directly into HTML, causing stored XSS when values come from user-supplied content. Affected: 2.2.0 through 2.36.0 and 3.1.0. Impact is that ...

CVE-2026-63309

CVE-2026-63309 affects SurrealDB prior to 3.1.5. The issue occurs because field-level SELECT permissions are not applied to ORDER BY clauses, allowing authenticated users to infer the relative ordering of restricted-field values. Attackers can issue ORDER BY queries on indexed restricted fields t...

CVE-2026-49211

Symfony UX Autocomplete vulnerable in versions 2.2.0–2.35.0 and 3.1.0 where addSearchClause() builds LIKE literals with client input wrapped in %...%, without escaping %, _, or , allowing unauthenticated users to turn BaseEntityAutocompleteType into a broad matcher across default searchable_field...

CVE-2026-63308

Helm

CVE-2026-63307

CVE-2026-63307 affects Chat2DB prior to 5.3.0. The vulnerability is an insecure direct object reference in GET /api/connection/datasource/{id}. The handler calls dataSourceService.queryExistent(id, …) without an ownership check and returns the decrypted password field, enabling any authenticated ...

CVE-2026-49208

CVE-2026-49208 (Symfony UX LiveComponent) : Vulnerability occurs when a writable #[LiveProp] is typed as DateTimeInterface with no explicit format, allowing client-supplied strings like now/tomorrow/+10 years to bypass checks via LiveComponentHydrator::hydrateObjectValue(), effectively moving tim...

CVE-2026-49210

Symfony UX: XSS in LiveComponent due to ChildComponentPartialRenderer::createHtml() injecting client-controlled children[id].tag into HTML without escaping. Affected: 2.8.0–2.36.0 and 3.1.0. Exploitation potential includes arbitrary HTML, e.g., [removed] tags, on re-renders containing at least on...

CVE-2026-49212

The vulnerability CVE-2026-49212 affects Symfony UX LiveComponentHydrator: the HMAC checksum previously covered only sorted prop key/value pairs and did not bind the component name, slot (props vs propsFromParent), or request context. This allowed a signed blob created for one component/slot to b...