CVE-2026-55398

CVE-2026-55398 is a memory management vulnerability in Secure Access clients and servers prior to 14.55. Attackers with intimate knowledge of and total control over the tunnel protocol can cause a non-persistent DoS on the server. CVSS v4 base score 6.9 (Medium) with network attack, low complexit...

CVE-2026-52887

NocoBase before version 2.0.61 is affected by CVE-2026-52887 due to a SQL injection in the in-app notification plugin. The flaw occurs in GET /api/myInAppChannels:list where filter[latestMsgReceiveTimestamp][$lt] is interpolated into a Sequelize.literal() without escaping or parameter binding, en...

CVE-2026-33445

CVE-2026-33445 is a memory management vulnerability in Secure Access servers prior to version 14.55. The issue can be exploited by an attacker with detailed control over the tunnel protocol to induce a persistent denial of service against the server. The published CVSS data indicates high impact ...

CVE-2026-52888

NocoBase before 2.1.0-alpha.46 exposes sensitive data via the SQL Collection feature. The plugin-collection-sql checkSQL() used an incomplete keyword blacklist that did not block PostgreSQL system catalogs (e.g., pg_shadow, pg_roles, pg_stat_activity), allowing an admin-role user to read password...

CVE-2026-33444

The CVE-2026-33444 entry describes a memory management vulnerability in Secure Access servers prior to version 14.55. The issue allows attackers who have intimate knowledge and total control over the tunnel protocol to cause a non-persistent DoS against the server. The CVSS score is 6.9 (Medium) ...

CVE-2026-59950

The MCP Python SDK (package name mcp on PyPI) contains a vulnerability in the deprecated mcp.server.websocket.websocket_server transport prior to version 1.28.1, which accepted WebSocket handshakes without Host or Origin header validation. This prevents restrictions on originating connections to ...

CVE-2026-52870

The MCP Python SDK (package mcp on PyPI) has a vulnerability in versions 1.23.0–1.27.1 where default handlers installed by server.experimental.enable_tasks() for tasks/list, tasks/get, tasks/result, and tasks/cancel only operate on task identifiers and do not record the session that created each ...

CVE-2026-33443

CVE-2026-33443 describes a memory management error in Secure Access servers prior to 14.55. The issue allows attackers who have intimate knowledge of and total control over the tunnel protocol to trigger a persistent DoS against the server. The provided documents do not specify affected product f...

CVE-2026-52869

The MCP Python SDK (mcp on PyPI) has a vulnerability affecting versions prior to 1.27.2 in its SSE and stateful Streamable HTTP transports. These transports (mcp.server.sse.SseServerTransport and mcp.server.streamable_http_manager.StreamableHTTPSessionManager) route requests to an existing sessio...

CVE-2026-50144

ncnn (mobile-optimized neural network framework) contains an out-of-bounds heap write in ParamDict::load_param() when loading a malicious .param model, caused by a negative parameter id indexing before params[NCNN_MAX_PARAM_COUNT]. This is exploitable via Net::load_param() and is fixed by commit ...

CVE-2026-40958

CVE-2026-40958 involves an input validation error in Secure Access clients prior to 14.55. The root cause is improper input validation in the tunnel protocol handling, allowing attackers with intimate knowledge and total control of the tunnel protocol to trigger a non-persistent DoS against the c...

CVE-2026-45737

Argo CD ServerSideDiff in versions 3.2.0–3.2.12, 3.3.10, and 3.4.2 can exposed Kubernetes Secret values embedded in the kubectl.kubernetes.io/last-applied-configuration annotation because HideSecretData(target, live, ...) does not fully sanitize ResourceDiff.TargetState and LiveState predicted li...

CVE-2026-40957

CVE-2026-40957 describes a frameable content vulnerability in the Secure Access server login page prior to version 14.55. By controlling a malicious web site, an attacker could potentially steal credentials from an administrator visiting the login page. The connected sources confirm the existence...

CVE-2026-40956

CVE-2026-40956 is a memory-disclosure vulnerability in Secure Access client versions prior to 14.55. According to connected records, attackers who have intimate knowledge and total control over the tunnel protocol can cause a small amount of random memory to leak. The CVSS v4.0 score is 2.1 (LOW)...

CVE-2026-45738

CVE-2026-45738 : Argo CD contains a Stored XSS in link.argocd.argoproj.io/* annotations that can be rendered as anchor href values in the Summary tab, enabling javascript: execution for a higher-privileged user in the origin session when there is application write access. This is fixed in Argo CD...

CVE-2026-40955

CVE-2026-40955 describes an integer underflow in the traffic parsing function of Secure Access clients prior to 14.55. The vulnerability allows attackers with intimate knowledge of and total control over the tunnel protocol to cause a non-persistent Denial of Service against their client. Affecte...

CVE-2026-40954

The CVE-2026-40954 entry describes an integer underflow in the traffic parsing function of Secure Access clients prior to 14.55. The vulnerability can be exploited by attackers with intimate knowledge of and total control over the tunnel protocol to cause a non-persistent DoS against their client...

CVE-2026-49867

DataEase (open source data visualization tool) contains an authenticated stored XSS in template static resources prior to version 2.10.23. The flaw occurs when authenticated users submit TemplateManageRequest.staticResource via POST /de2api/templateManage/save or via DataVisualizationServer.decom...

CVE-2026-46684

CVE-2026-46684 (DataEase) : Open-source data visualization tool DataEase prior to 2.10.23 is affected by an unauthorized command execution vulnerability. The issue stems from enterprise token handling where TokenFilter#doFilter() may pass X-DE-TOKEN values to TokenUtils.validate(), which only che...

CVE-2026-40953

CVE-2026-40953: heap overflow in the certificate parsing function of Secure Access clients prior to 14.55. Local access with administrator permissions can cause a denial of service on the client. Affected software is Secure Access clients (versions before 14.55); root cause is a heap overflow in ...

CVE-2026-45320

DataEase (open source data visualization/analysis tool) is affected by an SQL injection in dashboard variables. Prior to version 2.10.23, dashboard SQL variables (e.g., ${deptId}) are processed by SqlparserUtils.transFilter(), whose final branch returns raw user input for non-in and non-between o...

CVE-2026-45535

DataEase (open source data visualization/analysis tool) contains a stored SQL injection in SQL-type datasets prior to version 2.10.23. The vulnerability arises because attacker-controlled SQL variable defaultValue entries (e.g., ${var}) are stored and SqlparserUtils.handleVariableDefaultValue() i...

CVE-2026-45533

DataEase prior to 2.10.23 contains a path traversal vulnerability in the export-center bulk delete API. Maliciously crafted identifiers can be passed to ExportCenterManage.delete using sequences like ../, enabling recursive deletion of arbitrary server directories during export task cleanup. Impa...

CVE-2026-50124

DataEase prior to version 2.10.23 contains a remote code execution vulnerability triggered by uploading payload.zip via the Excel upload API (/datasource/upload). This creates an H2 datasource using the zip: protocol, and when the SQL dataset path is executed, CalciteProvider.jdbcFetchResultField...

CVE-2026-40952

The CVE-2026-40952 entry describes a privilege misconfiguration in the Windows Secure Access installer for the client and server prior to version 14.55. Local attackers with access to the affected system can elevate privileges to Administrator when Secure Access is installed in a non-default loca...

CVE-2026-50030

DataEase prior to 2.10.23 exposes the SQL preview path (DatasetDataApi.previewSql/previewSqlCheck) via /de2api/datasetData/previewSql, accepting PreviewSqlDTO.sql, PreviewSqlDTO.datasourceId, and PreviewSqlDTO.isCross. The system stores decoded SQL in datasourceRequest.query and CalciteProvider.f...

CVE-2026-45419

DataEase contains an arbitrary file write vulnerability present before version 2.10.23. The flaw resides in template handling: the TemplateManageService#save, StaticResourceServer#saveFilesToServe methods and the /de2api/templateManage/save endpoint accept attacker-controlled staticResource names...

CVE-2026-45417

DataEase (open source data visualization/analysis tool) is affected by a SQL injection in the CalciteProvider#checkStatus path. Before version 2.10.23, datasource connection status checks concatenate configuration.getSchema() into getTablesSql and then executeQuery runs the resulting SQL, enablin...

CVE-2026-45534

DataEase prior to 2.10.23 is affected by an RCE in Redshift datasource connections. The issue arises when attacker-controlled rsjdbc.ini is loaded from System.getProperty("java.io.tmpdir"), with socketFactory set to org.springframework.context.support.FileSystemXmlApplicationContext, allowing com...

CVE-2026-56743

Cilium (versions 1.19.0–1.19.4) is affected where standard Kubernetes NetworkPolicy ipBlock rules without pod/namespace selectors, when configured with a non-default clusterName, can generate a wildcard namespace allow rule. The parser incorrectly creates a pod selector for selectorless peers, en...

CVE-2026-56742

Cilium Gateway API vulnerability (CVE-2026-56742): Prior to versions 1.17.17, 1.18.11, and 1.19.5, clusters using Gateway API allowed users with write permissions on namespaced HTTPRoutes to mirror traffic to any Service in any namespace, bypassing ReferenceGrant checks. Impacted when Gateway API...

CVE-2026-49445

Cilium CVE-2026-49445 : When L7 is enabled, embedded or standalone Envoy creates a world-accessible admin.sock on cluster nodes, enabling a local attacker to access Envoy admin endpoints, potentially expose TLS secrets, disrupt traffic, or terminate Envoy. Affected are Cilium releases prior to 1....

CVE-2026-62353

TDengine before version 3.4.1.14 contains an out-of-bounds read in the SQL lexer (parTokenizer.c tGetToken) where a trailing backslash in a string literal can cause the parser to read beyond the null terminator, potentially crashing the server and leaking adjacent memory. The issue requires an au...

CVE-2026-62351

TDengine before 3.4.1.15 is affected. In transDecompressMsg() within source/libs/transport/src/transComm.c, the code reads STransCompMsg.contLen when pHead->comp == 1 without first validating that the RPC packet contains the 8-byte STransCompMsg structure. This can cause an unauthenticated out...

CVE-2026-62348

TDengine TDengine Enterprise prior to 3.4.1.15 is affected. An authenticated low-privilege SQL user could issue KILL SSMIGRATE against an active shared-storage migration because mndProcessKillSsMigrateReq called mndKillSsMigrate while the MND_OPER_SSMIGRATE_DB privilege check was commented out. ...

CVE-2026-15895

CVE-2026-15895 : OS command injection vulnerability in the npm package loading component of AWS jsii-diff prior to v1.131.0. An attacker could exploit crafted package specifiers passed to the npm: source argument to execute arbitrary commands. Affected software is AWS jsii-diff (npm packaging) wi...

CVE-2026-62944

Technical details for CVE-2026-62944 are not publicly available in the supplied documents. The entry is reserved with details to be provided upon public disclosure; monitor for updates.

CVE-2026-62349

TDengine 3.4.1.6 and earlier contains an off-by-one/write vulnerability in source/libs/parser/src/parUtil.c: trimString() only checks a single-byte space before handling SQL string escape sequences (%, _, or \x), enabling a one-byte out-of-bounds write to the stack buffer tmpTokenBuf. This can le...

CVE-2026-62350

TDengine (open-source time-series DB) -- vulnerability CVE-2026-62350 allows a user with create_udf privilege to upload a crafted shared library, install it as a UDF (e.g., eval), and execute arbitrary C code on the server via queries. Root cause: improper validation of UDF loading/execution lead...

CVE-2026-52883

Technical details for CVE-2026-52883 are not publicly available in the provided documents; no affected products, vectors, or remediation are disclosed. Monitor for updates.

CVE-2026-46421

The CVE concerns a supply-chain compromise in the SAP Cloud Application Programming Model’s cap-js/cds-dbs monorepo. On 2026-04-29, compromised versions of @cap-js/[email protected], @cap-js/[email protected], and @cap-js/[email protected] were published; these malicious packages harvested credentials (n...

CVE-2026-62355

TDengine (TDengine Cloud DB) prior to 3.4.1.15 had a permission issue where a Data Reader admin_user could run create udf and access non-database objects, despite read-only intent for standard users. The vulnerability impact is limited to unauthorized creation of user-defined functions and relate...

CVE-2026-26032

Summary of CVE-2026-26032 (Apache Ivy): The PackagerResolver can repack downloaded artifacts via an Ant script in a subdirectory of buildRoot. If any Ivy coordinates contain "../" sequences, an attacker who can access a packager repository can escape the buildRoot and overwrite other files. The i...

CVE-2026-52882

Technical details for CVE-2026-52882 are not publicly available in the provided documents. No affected products, root cause, impact, or remediation can be confirmed. Monitor for updates as information is published.

CVE-2026-15746

CVE-2026-15746 affects strands-agents-tools’ elasticsearch_memory tool (used with Strands Agents SDK). The tool’s schema exposed connection parameters (es_url, cloud_id, api_key); if api_key is omitted, it falls back to the operator’s ELASTICSEARCH_API_KEY and may be sent to a host chosen by an L...

CVE-2026-52881

Technical details are not publicly available in the provided documents. Monitor for updates.

CVE-2026-12997

Summary of CVE-2026-12997 : The Gravity Forms plugin for WordPress is vulnerable to a Directory Traversal flaw in all versions up to and including 2.10.4, exploitable via the gform_uploaded_files parameter. An unauthenticated attacker can read arbitrary server files containing sensitive informati...

CVE-2026-52847

Technical details for CVE-2026-52847 are not publicly available in the provided documents. Monitor for updates; information on affected products, root cause, and remediation is not present here.

CVE-2026-54494

Technical details for CVE-2026-54494 are not publicly available in the provided documents. No affected products, impact, or remediation are described. Monitor for updates and future disclosures.

CVE-2026-54443

The CVE affects Dashy’s RSS Widget (src/components/Widgets/RssFeed.vue). From versions 1.9.4 through 3.2.0, RSS item link values are not sanitized before rendering titles and Read More links as anchor href attributes, allowing an attacker-controlled feed to provide a javascript: URI that executes...