CVE-2025-36290

IBM Integrated Analytics System (IIAS) versions 1.0.0.0 through 1.0.31.0 contain a vulnerability in the JWT service component (apjwtservice.py module), where SSL/TLS server certificate validation is not enabled on an SSL/TLS connection. This allows a remote attacker to perform man-in-the-middle a...

CVE-2025-36271

IBM Integrated Analytics System (IIAS) versions 1.0.0.0 through 1.0.31.0 are affected by a predictable salt vulnerability in the Magneto component (specifically the resmgr.py module). The use of a predictable salt in cryptographic operations (classified as CWE-759 ) weakens hashing and encryption...

CVE-2026-13735

Zephyr RTOS WireGuard implementation in subsys/net/lib/wireguard/wg_crypto.c accepted 16-byte keepalive data messages before verifying the Poly1305 authentication tag, allowing a network attacker with a valid receiver index to forge keepalive packets without possessing the session key. The impact...

CVE-2026-13734

Zephyr RTOS's WireGuard data-plane receive handler wg_process_data_message() in subsys/net/lib/wireguard/wg_crypto.c validated the anti-replay counter only after committing several peer-state mutations (endpoint roaming update, liveness timers, and keypair rotation). Because the AEAD tag authenti...

CVE-2026-55678

Arc is an open, SQL-native time-series database for telemetry. In Enterprise cluster deployments from v26.02.1 to v26.06.2 , the coordinator accepts cluster join requests without authentication when cluster.enabled=true but cluster.shared_secret is empty. The HMAC validation in coordinator.go is ...

CVE-2026-75118

CVE-2026-75118 is a pre-authentication stack-based buffer overflow in the http_gdpr_decrypt function of the TP-Link TL-MR100 V3.20 router, caused by insufficient bounds checking of encrypted requests to the /cgi/login endpoint. An unauthenticated attacker on an adjacent network can trigger memory...

CVE-2026-81533

CVE-2026-81533 is a memory-safety vulnerability in the MongoDB BI Connector ODBC Driver . The root cause is the driver copying an unusually long digit sequence following a LIMIT clause into a fixed-size internal buffer without a length check. The issue is only reachable on connections where the d...

CVE-2026-55763

CVE-2026-55763 affects Klever-Go (the Go implementation of the Klever blockchain), prior to version 1.7.19 . In processPercentageRoyaltiesTransfer (core/kapp/accounts/accounts.go), the sender's royalty debit via SubFromBalance is ordered after the split loop and after the royaltiesToPay

CVE-2026-81532

CVE-2026-81532 affects the MongoDB Connector for BI ODBC driver . The root cause is improper bounds checking on a positioned-cursor statement's cursor name : because the name length is not bounded before the driver builds its diagnostic message, an overly long name overwrites memory adjacent to a...

CVE-2026-55891

PrivateBin , a zero-knowledge PHP pastebin, is vulnerable to reflected JSON injection in its JSON-LD response paths (/?jsonld= and /?pasteid) in versions prior to 2.0.5 . The root cause is that FILTER_SANITIZE_URL does not strip quotation marks from $_SERVER['REQUEST_URI'], and the unsanitized va...

CVE-2026-81520

MongoDB Connector for BI is vulnerable to a denial-of-service condition caused by an unbounded SASL authentication negotiation loop . A network-reachable, unauthenticated client can initiate a SASL-based login exchange and then decline to complete it. Because the negotiation loop had no overall t...

CVE-2026-55696

PrivateBin versions prior to 2.0.5 contain a stored XSS vulnerability in the attachment download link. The root cause is that DOMPurify sanitization in AttachmentViewer.setAttachment only applies to image/*svg MIME types, and the resulting sanitized blob is assigned to a local variable used for t...

CVE-2026-76651

A buffer overflow in the embedded HTTP service of the TP-Link TL-WR841N v14 is triggered when processing multipart/form-data requests. Insufficient validation of an attacker-controlled boundary parameter allows a remote, unauthenticated attacker from the adjacent network to corrupt memory beyond ...

CVE-2026-76650

CVE-2026-76650 is a NULL pointer dereference in the UPnP service of TP-Link TL-WR841N v14 , triggered by a specially crafted SOAP state variable query request . Successful exploitation causes the UPnP process to terminate or become unstable, resulting in a denial-of-service affecting UPnP discove...

CVE-2026-76649

TP-Link TL-WR841N v14 is affected by a pre-authentication NULL pointer dereference in its UPnP service when processing SOAP action requests. A specially crafted SOAP request containing unexpected XML content causes the UPnP daemon to terminate, resulting in a denial-of-service condition that pers...

CVE-2026-81518

mongosqld in the MongoDB BI Connector contains a TLS misconfiguration: when a client certificate authority file is configured, the listener requests a client certificate during the TLS handshake but does not require it. In deployments where client certificates serve as the sole authentication mec...

CVE-2026-81517

CVE-2026-81517 affects MongoDB Connector for BI (mongosqld) . An unauthenticated network attacker can exhaust storage on the configured log path simply by generating routine connection log activity. When a subsequent log write or rotation fails, the error is not handled , causing the shared mongo...

CVE-2026-82333

multer , a Node.js middleware for handling multipart/form-data, is vulnerable to a remotely triggerable denial of service (CVSS 7.5 HIGH). An attacker can send a small multipart request containing two specially crafted text field names: a large numeric array index in the first field allocates a m...

CVE-2026-81490

MongoDB Connector for BI (mongosqld) contains an improper error handling flaw in its schema-sampling routine. A database user who can create a view in a sampled namespace can define a view whose evaluation reliably fails. The sampling logic misclassifies the resulting server message as transient ...

CVE-2026-77078

multer , a popular Node.js middleware for handling multipart/form-data, is vulnerable to a remote denial-of-service in all versions before 2.3.0 . A small multipart request containing two specially crafted text field names triggers an uncaught RangeError (Invalid array length) : the first field a...

CVE-2026-77063

multer , a Node.js middleware for handling multipart/form-data, contains a race condition in its file stream handling that is triggered when an application uses an asynchronous fileFilter together with the fileSize limit . An attacker can exploit this to cause a file that exceeds the configured s...

CVE-2026-77037

multer is a Node.js middleware for handling multipart/form-data uploads. In version 2.2.0 , when a disk-backed upload is aborted or truncated before the write stream finishes, the disk storage engine removes the visible file but fails to close the underlying write file descriptor , leaving a dele...

CVE-2026-77586

In MongoDB Connector for BI , object names (collections, fields, indexes) are embedded into the DDL output of SHOW CREATE statements without escaping the identifier delimiter. A user with write access to a sampled collection can craft a name that closes the quoted identifier early, injecting arbi...

CVE-2026-77184

MongoDB Connector for BI is affected by an incomplete escaping flaw: the description text of a collection's JSON schema validator is incorporated into the comment text of DDL returned by SHOW CREATE statements without fully escaping backslash characters. An attacker with permission to modify a co...

CVE-2026-76798

The MongoSQL Transition Readiness Tool (part of MongoDB's SQL/BI Connector stack) writes query text and user names from BI Connector log files into its generated HTML reports without encoding them for the HTML output context. An attacker with low privileges who can issue queries through the BI Co...

CVE-2026-76797

The MongoSQL Transition Readiness Tool (MongoDB) is vulnerable to CSV injection through its generated reports. Database and collection names are written into CSV output without neutralizing leading characters that spreadsheet applications interpret as formulas. An attacker with write privileges o...

CVE-2026-76794

MongoSQL Transition Readiness Tool (part of the MongoDB BI Connector) contains an improper HTML encoding flaw when processing database metadata. A MongoDB user with write access can inject crafted metadata that, when another user generates and opens the Transition Readiness Report, may cause scri...

CVE-2026-55484

ALOS HTTP , a Linux-first Go web framework with a custom networking stack, is vulnerable to an unauthenticated remote denial-of-service . The root cause is an unchecked p[0] access in core/utils.go::sanitizeRequestPath after splitPathQuery processes a path beginning with a question mark, leaving ...

CVE-2026-55634

Pimcore, an open-source Data & Experience Management Platform, is vulnerable to Remote Code Execution via its class-definition import endpoint. Prior to versions 11.5.19, 12.3.10, and 2026.1.6, a DataObject field name is emitted without an identifier allowlist into generated PHP properties (Field...

CVE-2026-55220

Pimcore (Open Source Data & Experience Management Platform) contains an unrestricted deserialization flaw in Hotspotimage::getDataFromResource() . After JSON decoding of the __hotspots object-store column fails, the raw value is passed to Serialize::unserialize() without an allowed-classes whitel...

CVE-2026-55215

MariaDB Connector/Node.js is vulnerable to cleartext password disclosure via a man-in-the-middle attack when ssl: true is set without a pinned CA or server certificate. The root cause lies in the TLS handshake logic: in handshake.js, a server selecting mysql_clear_password as the initial authenti...

CVE-2026-55247

plone.app.event , Plone's event content type, contains multiple issues in its iCalendar import (src/plone/app/event/ical/importer.py) prior to versions 5.2.4 and 6.0.1 . The importer accepts insufficiently restricted calendar and event URLs, does not adequately bound downloaded bytes or imported ...

CVE-2026-82021

Hermes Agent versions 0.18.2 prior to 0.19.0 contain a supply chain vulnerability in its bundled MCP catalog . A third-party upstream repository is referenced via a mutable branch rather than a pinned commit SHA, meaning an attacker who compromises that upstream repository can propagate malicious...

CVE-2026-82020

Hermes Agent versions 0.16.0 through prior to 0.17.0 contain an improper path restriction vulnerability. Sensitive-path guards that should protect the credential store failed to exclude the auth.json file , allowing an attacker who can influence ingested message content to craft a malicious messa...

CVE-2026-55520

Protego is a pure-Python robots.txt parser. Prior to 0.6.2 , the _URLPattern._prepare_pattern_for_regex method in src/protego/_urlpattern.py translates every asterisk in an Allow or Disallow directive into a lazy regex wildcard. A directive containing many asterisks triggers exponential backtrack...

CVE-2026-55248

plone.app.portlets (Plone CMS) is vulnerable to three issues in its RSS feed portlet, all fixed in versions 5.0.8, 6.0.4, and 7.0.2 . A low-privileged member can set the RSS feed URL to a very large response, causing excessive in-memory data retention and denial of service via the FEED_DATA cache...

CVE-2026-55673

PowSyBl (Power System Blocks), a framework for building power system software, is affected by a command injection vulnerability prior to version 7.2.2. The UnixLocalCommandExecutor and WindowsLocalCommandExecutor components concatenate attacker-controlled arguments and environment variables into ...

CVE-2026-55584

phpSysInfo versions ≤ 3.4.5 contain an IP allowlist bypass in the PSI_ALLOWED check within read_config.php. The vulnerable code resolves the client IP from attacker-controlled X-Forwarded-For and Client-IP headers before falling back to REMOTE_ADDR, with no trusted-proxy concept. A remote unauthe...

CVE-2026-82329

CVE-2026-82329 is a critical authentication bypass in JFrog Artifactory (self-managed), rooted in the JFrog Access service. On default installations, a blank join key is silently trusted, and its HMAC secret is a fully known 32-byte value of 0x20. An unauthenticated attacker forges a valid join J...

CVE-2026-55245

Bifrost is an enterprise AI gateway for routing requests to model providers. Prior to 1.5.17 , the isPublicIP function in core/providers/utils/fetch.go (reached via FetchAndEncodeURL for Bedrock and Vertex image/document URLs) incorrectly classifies CGNAT (100.64.0.0/10) , IPv6 6to4 (2002::/16) ,...

CVE-2026-55378

JS Recon is a JavaScript enumeration and SAST tool. In versions 1.2.1-beta.1 through 1.3.1-beta.2 , the PR Branch Checker workflow in .github/workflows/pr_checker.yml interpolates untrusted values (github.head_ref and github.event.pull_request.head.repo.full_name) directly into a shell gh pr comm...

CVE-2026-55485

Piccolo Admin is a Python admin interface and content management system built on the Piccolo ORM. Prior to 1.14.0 , the superuser_validators in piccolo_admin/endpoints.py block mutating requests (PUT, PATCH, DELETE, POST) by non-superusers but permit GET requests to configured user and session ta...

CVE-2026-55509

WsgiDAV , a Python-based WebDAV server, has a blind SQL injection vulnerability in its sample MySQLBrowserProvider (wsgidav/samples/mysql_dav_provider.py). The affected methods (_exists_record_by_primary_key, _get_field_by_primary_key, _get_record_by_primary_key) concatenate a record key parsed f...

CVE-2026-55425

Graylog (free and open log management platform) has an authorization flaw in the System Catalog entity titles endpoint (EntityTitleServiceImpl.java). An authenticated user can request composite display fields without the server verifying that every selected field is readable, allowing retrieval o...

CVE-2026-81849

amazon-ssm-agent prior to version 3.3.4515.0 contains a path traversal vulnerability in its aws:downloadContent plugin. The root cause is an improper limitation of a pathname to a restricted directory, allowing an authenticated remote user with restricted ssm:SendCommand permission (limited to th...

CVE-2026-56100

SpringBlade versions 2.7.3 through 3.5.0 are affected by a privilege escalation vulnerability in an internal Feign user-creation endpoint exposed via @RestController without authorization checks. The gateway's authentication filter only validates JWT parsing without verifying user roles or caller...

CVE-2026-70309

An origin validation error in Microsoft Edge (Chromium-based) allows an unauthorized attacker to bypass a security feature over a network. The CVSS 3.1 score is 5.4 (Medium) with a vector of AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N, indicating that exploitation requires user interaction and results in...

CVE-2026-72984

CVE-2026-72984 is a type confusion vulnerability in Microsoft Edge (Chromium-based) , described as an "access of resource using incompatible type." This flaw allows an unauthorized attacker to achieve remote code execution over a network, provided user interaction is required (e.g., the victim vi...

CVE-2026-66798

Microsoft Edge (Chromium-based) is affected by a Use After Free vulnerability that allows an unauthorized attacker to execute code over a network . The CVSS 3.1 base score is 4.3 (MEDIUM) , with an attack vector of network, low complexity, no privileges required, but user interaction required . N...

CVE-2026-66324

CVE-2026-66324 is a spoofing vulnerability in Microsoft Edge (Chromium-based) caused by external control of a file name or path . An unauthorized network-based attacker with low complexity and no prior privileges , but requiring user interaction , can exploit this to perform spoofing. The CVSS 3....