CVE-2026-94372

MISP versions below 2.5.47 contain a stored cross-site scripting (XSS) vulnerability in the default theme's Galaxies index page . When the instance detects unknown galaxy clusters during synchronization, it renders sample tag names in an informational notice to site administrators. In the default...

CVE-2026-94211

Hyve5 Leantime versions up to 3.9.8 are affected by a stored cross-site scripting (XSS) vulnerability in the Project Dashboard component, specifically the file /app/Domain/Dashboard/Templates/show.blade.php. An attacker with EDIT permission can plant a malicious payload in a label name , which is...

CVE-2026-94368

NooBaa-core , the core component of the NooBaa Multicloud Object Gateway , contains a flaw in its SigV4 signature verification logic. When processing S3 presigned URLs, the service drops unsigned x-amz- headers from the signature calculation instead of rejecting them. An attacker holding a valid ...

CVE-2026-89139

Temporal Server versions 1.31.0 through

CVE-2026-87858

Temporal Server is vulnerable in its Workflow completion callback delivery logic (both HSM and CHASM implementations). A caller with only write permission in a single namespace can attach a callback with a non-empty source header, causing the History service to re-target the request to the intern...

CVE-2026-65654

CVE-2026-65654 affects github.com/temporalio/ringpop-go , a Go library implementing the SWIM membership protocol used by Temporal. The vulnerability is a missing enforcement of configured LabelOptions limits on inbound gossip: while local label changes are validated, label maps received from peer...

CVE-2026-65653

github.com/temporalio/tchannel-go failed to reject TChannel call fragments that carry checksum metadata but no length-prefixed argument chunks. The fragment reader left its chunk slice empty and then unconditionally selected the first element, producing an unrecovered Go slice-bounds panic on a l...

CVE-2026-65652

github.com/temporalio/tchannel-go fails to validate the one-byte checksum-type field in inbound TChannel call frames. An unauthenticated remote peer that completes the standard initialization handshake can send a call request with an unsupported checksum type. The parser uses that value as an ind...

CVE-2026-65651

temporalio/sqlparser accepts SQL with deeply nested unary expressions and returns a correspondingly deep abstract syntax tree without enforcing a nesting limit . The library's String and Walk operations traverse that tree recursively, causing a runtime-fatal Go stack overflow that terminates the ...

CVE-2026-16651

The temporalio/sqlparser library, used by Temporal Server , can panic when parsing a MySQL version comment that is empty or contains only one to five decimal digits. The root cause is in ExtractMysqlComment , which does not handle the -1 return value from strings.IndexFunc before using it as a sl...

CVE-2026-94210

Hyve5 Leantime (up to version 3.9.8 ) contains a cross-site scripting (XSS) vulnerability in the Kanban Board component, specifically in the getAllGrouped function of app/Domain/Tickets/Services/Tickets.php. The attack is remotely exploitable and requires low privileges and user interaction . CVS...

CVE-2026-91867

Apache Neethi is vulnerable to a denial of service (DoS) condition because it lacks a total timeout when fetching remote policy references. While the system limits time per read, a malicious or slow server can trickle bytes slowly to keep the fetch alive indefinitely, tying up the calling thread....

CVE-2026-91866

Apache Neethi is vulnerable to a denial of service (DoS) condition due to a flaw in its policy-intersection functionality. A remote attacker can provide a specially crafted pair of WS-Policy documents that force the system to perform an exponential amount of work, resulting in excessive CPU consu...

CVE-2026-91865

A flaw in Apache Neethi allows a remote attacker to cause a denial of service (DoS) by providing a specially crafted WS-Policy document . The vulnerability is triggered when the document contains repeated policy references , forcing Neethi to re-expand these references exponentially during normal...

CVE-2026-91864

Apache Neethi is vulnerable to a denial of service (DoS) condition due to insufficient input validation during the processing of WS-Policy documents . A specially crafted document can pack unlimited content within a policy assertion , which the software copies into memory without enforcing size l...

CVE-2026-91863

A flaw exists in Apache Neethi where a remote attacker can send a specially crafted WS-Policy document containing deeply nested policy elements. This document can bypass the parser's nesting-depth limit, triggering uncontrolled recursion that exhausts the thread stack and crashes the parser, resu...

CVE-2026-16652

Temporal Server is vulnerable to excessive CPU consumption in its Schedule component. An authenticated caller with namespace write permission can create or update a Schedule that combines a fine-grained cadence with an exclusion calendar rejecting every candidate time, causing the server to evalu...

CVE-2026-94292

A flaw exists in Epiphany (GNOME Web) where the autofill visibility check fails to detect form fields hidden using CSS properties like display:none , visibility:hidden , or opacity:0 . This allows a malicious webpage to silently populate hidden fields with sensitive data, such as credit card numb...

CVE-2026-77021

Checkmk versions prior to 2.5.0p14 , 2.4.0p37 , and 2.3.0p51 , as well as the EOL 2.2.0 release, are affected by a data amplification vulnerability in the agent receiver. The root cause is a missing decompression size limit on zlib-compressed data sent by hosts registered in push mode. An attacke...

CVE-2026-92612

Eclipse iceoryx2 versions greater than v0.8.0 are affected by a vulnerability in the StaticString type. The type exposes its contents as mutable bytes through safe APIs, while String::as_str() converts those bytes into a Rust string slice without validating UTF-8. This allows an application to cr...

CVE-2026-94291

A flaw in Epiphany (GNOME Web) allows a remote attacker to frame the ephy-reader and view-source URI schemes via iframes because they are not registered as display-isolated . When a user visits a malicious website, this can be exploited to exfiltrate local files . The specific mechanism is that u...

CVE-2026-92574

A vulnerability in CRI-O checkpoint restore allows a user who can create a pod from a malicious checkpointed container to bypass the destination Kubernetes security context. The restored process may retain credentials, Linux capabilities, no_new_privs, and seccomp state from the checkpoint instea...

CVE-2026-91921

CVE-2026-91921 is a Cross-Site Scripting (XSS) vulnerability in the client-side rendering engine of the 1millionbot AI Chat Platform , caused by inadequate input sanitisation. An unauthenticated remote user can trigger the issue by sending messages containing Markdown syntax and certain unsanitis...

CVE-2026-94277

CVE-2026-94277 is a stored cross-site scripting (XSS) vulnerability in MISP versions below 2.5.47 . The affected component is the galaxy matrix statistics view (app/View/Users/statistics_galaxymatrix.ctp), where the galaxy name is interpolated into HTML output via sprintf() without HTML encoding....

CVE-2025-12999

Open VSX is vulnerable to cache poisoning via UrlUtil.getBaseUrl , which constructs absolute URLs (download links, signatures, public keys) from X-Forwarded-Host , X-Forwarded-Proto , and X-Forwarded-Prefix headers without verifying the sender is a trusted proxy. A single unauthenticated request ...

CVE-2026-92400

The Payment Gateway for PayPal on WooCommerce WordPress plugin (before version 9.2.1 ) fails to verify that an incoming payment notification was confirmed in the store's configured payment environment or paid to the store's own merchant account before marking an order as complete. This allows una...

CVE-2026-86802

To Do List Member is a WordPress plugin that allows unauthenticated users to create arbitrary published posts and taxonomy terms due to missing authorization and nonce checks in its import routine. The plugin also fails to validate the source location it fetches imported data from, enabling unaut...

CVE-2026-85113

GiveWP WordPress plugin versions before 4.16.9 fail to remove shortcode delimiters from donor-supplied values (such as donor names) before rendering them on public pages. The shortcode-stripping logic the plugin applies can be defeated by nesting , allowing unauthenticated users to execute arbitr...

CVE-2026-85010

CVE-2026-85010 affects the RestroPress WordPress plugin prior to version 3.4.6 . The plugin fails to validate client-supplied item add-on prices on the server side when items are added to or updated in the cart. This allows unauthenticated attackers to manipulate prices arbitrarily, placing order...

CVE-2026-94152

Omega Solution FBP Fulfillment by People 2025 contains an authorization bypass in the User Profile API (file /user/). The vulnerability is triggered by manipulating the ID argument , allowing a low-privileged remote user to access unauthorized user profiles. The impact is a low confidentiality lo...

CVE-2026-15801

CRI-O contains a vulnerability in its container checkpoint and restore feature where insufficient validation of restore metadata may allow a privileged user to perform unintended operations on the host filesystem . Exploitation requires that checkpoint/restore functionality is explicitly enabled ...

CVE-2026-94151

A missing authentication vulnerability in Omega Solution HRM OS (up to version 20260717 ) affects the Role Permission API at the endpoint /role-permission/permission. Manipulating the roleId argument allows an unauthenticated remote attacker to bypass authentication controls, resulting in a low c...

CVE-2026-94150

CVE-2026-94150 is a cross-site scripting (XSS) flaw in Omega Solution HRM OS versions up to 20260717 , located in an unknown function of the SVG File Upload component at /media/view/. The attack can be initiated remotely but requires high privileges and user interaction , resulting in a low integ...

CVE-2026-94149

Omega Solution HRM OS (versions up to 20260717) is affected by an improper control of resource identifiers flaw in the Role Permission Retrieval Endpoint at /role-permission/permission. Manipulating the roleId argument allows a remote, authenticated attacker (low privileges) to access permission ...

CVE-2026-47321

Apache MINA's CompressionFilter uses ZLib to inflate incoming data without bounding the resulting size. An attacker can send a small compressed payload with a compression ratio exceeding 1,000× , exhausting application memory and causing a denial of service (CVSS 3.1: 7.5 HIGH , impact: availabil...

CVE-2026-94148

ScadaBR versions up to 1.1 are affected by an information disclosure vulnerability in the Export Project Endpoint . The function EmportDwr.createExportJSON in /ScadaBR/export_project.htm was left unprotected, while the corresponding import path was already gated with Permissions.ensureAdmin(). Th...

CVE-2026-94146

BioStar BIOS Update Utility 1.9.7.3 contains a write-what-where flaw in the IOCTL Handler (function sub_110BC of BSMEM64_W10.sys), triggered by manipulating the PhysicalAddress/Size argument. A local attacker with low privileges can achieve high impact on confidentiality, integrity, and availabil...

CVE-2026-94218

A flaw in Keycloak's authentication session management allows a user to bypass mandatory 2FA setup enforcement configured via a client policy. During the login process, manually visiting a specific session restart web link clears internal markers that track required security steps, letting the us...

CVE-2026-94217

CVE-2026-94217 is a flaw in the User-Managed Access (UMA) implementation of Keycloak , specifically in the authorization token endpoint when processing permission tickets. When two different users own resources with the same name, the system incorrectly merges permissions from both resources when...

CVE-2026-94145

A cross-site scripting (XSS) vulnerability affects xuxueli xxl-job versions up to 3.4.2/3.5.0 , specifically in the Task Management Interface component. The flaw resides in JobInfoController.java and is triggered by manipulation of the name or author argument, allowing a remote attacker with low ...

CVE-2026-90860

Canva Mobile App for HarmonyOS prior to v1.15.1 failed to restrict HTTP headers returned to an external origin running in a privileged WebView . The underlying cause is an insufficient origin check on WebView responses, allowing a threat actor with control of the WebView to read a user's session ...

CVE-2026-94144

A SQL injection vulnerability exists in drogonframework drogon up to 1.9.13 , specifically in the makeCriteria function within orm_lib/src/Criteria.cc of the ORM component. Manipulating the filter argument allows a remote, unauthenticated attacker to inject SQL, potentially compromising confident...

CVE-2026-94215

Keycloak's Admin REST API contains a cross-realm privilege escalation flaw. The API uses a per-request in-memory cache to resolve clients by their unique identifier without verifying realm ownership , allowing a limited-privilege administrator to read or modify client configurations in the master...

CVE-2026-94213

CVE-2026-94213 affects the Authorization Services component of Keycloak , an open-source identity and access management solution. The flaw resides in the policy evaluation endpoint , used by administrators to test how access policies apply to specific users. Due to missing authorization checks , ...

CVE-2026-82187

The Web to Print Online Designer WordPress plugin (versions before 2.15.0 ) is vulnerable to an unauthenticated arbitrary file upload flaw. The software fails to validate the type or extension of uploaded files and provides the protection token to any visitor who requests it. This allows an unaut...

CVE-2026-94143

Drogon (C++ web framework) up to 1.9.13 is affected by a SQL injection in the ORM Mapper component, specifically in the Mapper::orderBy function within Mapper.h. Manipulating the sort argument allows a remote, unauthenticated attacker to inject SQL. A public proof-of-concept exploit is available....

CVE-2026-94142

BioStar Temperature Monitor Utility 1.2.1806.2200 contains a write-what-where vulnerability in the IOCTL Handler component, specifically in the function sub_1105C of the kernel driver BS_HWMIO64_W10.sys . Manipulation of the PhysicalAddress argument allows a local attacker with low privileges to ...

CVE-2026-94139

A command injection vulnerability exists in the Cookie Handler component of the Chengdu Feiyuxing Technology Feiyu Star Router (version B-MB5E202-210322-r11656 ). Manipulation of the session_id argument in the file /send_order.cgi?parameter=loginout allows remote attackers to execute arbitrary co...

CVE-2026-94138

A command injection vulnerability exists in Chengdu Feiyuxing Technology Feiyu Star Router (version B-MB5E202-210322-r11656). The flaw resides in the /send_order.cgi script (parameter=del_expmac), where manipulation of the mac argument allows command execution. The attack can be launched remotely...

CVE-2026-94137

Hangzhou Shunwang Technology shzh version 10.7.2.693 contains a denial-of-service vulnerability in the driver file shdrv_x64.sys , specifically in the function sub_180004AC0 within the IRP_MJ_DEVICE_CONTROL handler. The root cause is improper handling of the PID argument, which allows a local att...