CVE-2026-89089

A SQL injection vulnerability in OpenNMS Meridian and Horizon allows a low-privileged authenticated user (ROLE_USER ) to exploit the DATE_FORMAT parameter in two shipped JasperReports ("Maintenance contracts expired" and "Maintenance contracts strategy") via the reporting REST API (POST /rest/rep...

CVE-2026-45751

Suricata (OISF) IDS/IPS engine is affected by a heap-use-after-free in the dotprefix transform (rust/src/detect/transforms/dotprefix.rs). Prior to 7.0.16 and 8.0.5 , the inspection-buffer helper could retain a stale inspect pointer after SCInspectionBufferCheckAndExpand reallocated the backing bu...

CVE-2026-76652

TP-Link Archer MR600 (v2, v3, v5) and TL-MR6400 v8 are affected by an authenticated directory traversal vulnerability in their file upload functionality . Due to insufficient validation of user-supplied file information , an authenticated remote attacker can upload a specially crafted file that i...

CVE-2026-76653

A missing authentication flaw in the VPN configuration management interface of TP-Link Archer MR600 (firmware v2, v3, and v5) and TL-MR6400 (firmware v8) stems from improper access control , allowing a remote unauthenticated attacker on an adjacent network to disclose and modify VPN configuration...

CVE-2026-19596

An XML External Entity (XXE) vulnerability in the XML collector of OpenNMS Meridian and Horizon allows an attacker who can control the XML response collected by OpenNMS (e.g., via a compromised monitored host or HTTP man-in-the-middle) to read files accessible to the OpenNMS service account, incl...

CVE-2026-89011

isomorphic-git before 1.42.0 is affected by a prototype pollution vulnerability in the getRemoteInfo function. A malicious Git server can advertise crafted ref names containing __proto__ path segments during ref negotiation (e.g., __proto__/corsProxy), polluting Object.prototype to reroute all su...

CVE-2026-89087

CVE-2026-89087 affects the cstruct package for OCaml in versions before 6.3.0 . The root cause is an index mishandling issue. The assigned CVSS 3.1 score is 7.3 (HIGH) with a vector of AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L, indicating a network-reachable flaw requiring no privileges or user interac...

CVE-2026-89086

CVE-2026-89086 affects the jose package for OCaml, versions before 0.11.0. The vulnerability lies in RSA signature validation: library calls only confirm that PKCS #1 decoding succeeds and then declare the signature valid, skipping the required steps that involve the public key . This means a mal...

CVE-2026-89054

CVE-2026-89054 is a missing authorization vulnerability in OpenNMS Horizon . The Spring Security policy for the /api/v2 REST API defines authorization rules for every HTTP method except PATCH , leaving the shipped @PATCH endpoints for event configuration and SNMP data collection accessible withou...

CVE-2026-55416

A SQL injection vulnerability exists in Pimcore's Custom Reports bundle (bundles/CustomReportsBundle/src/Tool/Adapter/Sql.php). Authenticated users with the reports_config permission can inject arbitrary SQL through report configuration fields (sql, from, where, groupby), which are concatenated d...

CVE-2026-84432

Concrete CMS versions 9 through 9.5.2 are affected by a CSRF vulnerability in the Boards custom slot dialog controller (custom_slot.php), specifically the saveTemplate() action. The action did not validate an anti-CSRF token, gating only on the canEditBoardContents() permission. A crafted cross-s...

CVE-2026-88062

OmniRoute (open-source AI gateway) versions 3.8.49 and earlier are affected by a remote code execution flaw in the POST /api/acp/agents custom ACP agent endpoint. Attacker-controlled binary and versionCommand values pass a self-consistency check and a limited metacharacter filter (tokenizeVersion...

CVE-2026-88061

career-ops (an open-source AI-assisted job search tool) prior to 0.8.0 exposed its local web dashboard (web/) /api routes for command-spawning and user-file-writing without validating request origin or restricting clients to loopback addresses. A malicious page in another browser tab could issue ...

CVE-2026-88060

Angular server-side rendering in @angular/platform-server (prior to 20.3.30, 21.2.22, and 22.1.4) serializes untrusted input inside content nested in fallback raw-content elements such as noscript , iframe , noembed , and noframes . The Domino serializer's fallbackRawContentTags traversal stoppe...

CVE-2026-88059

Angular's @angular/common HttpTransferCache can leak authenticated responses when Server-Side Rendering uses a hierarchical HttpClient with withRequestsMadeViaParent. The child TransferCache evaluates a request as anonymous before a parent interceptor injects credentials (Authorization header, co...

CVE-2026-87993

The consul-template library is vulnerable to an information disclosure issue in its error handling path , which may allow Vault secret values to appear in template error messages, log output, and downstream surfaces such as Nomad task events . The vulnerability is rated CVSS 7.7 (High) with a net...

CVE-2026-88021

Consul and Consul Enterprise contain an authorization bypass in the Connect service mesh . When generating Envoy RBAC rules to enforce Connect intentions, Consul failed to correctly escape certain characters in service names , namespaces , and partitions , causing the resulting authorization rule...

CVE-2026-87107

Consul and Consul Enterprise are affected by an authorization bypass in the catalog deregistration path. A caller holding only service:write or node:write ACL permissions can deregister peer-imported catalog objects (services, checks, or nodes) without possessing authority over the originating pe...

CVE-2026-88058

Angular SSR in @angular/platform-server (prior to 20.3.30, 21.2.22, and 22.1.4 ) serializes ProcessingInstruction DOM nodes inside fallback raw-content elements (noscript, iframe, noembed, noframes) without escaping character was escaped but

CVE-2026-87106

Consul and Consul Enterprise are vulnerable to a denial of service in the native RPC listener . An authenticated client that can complete the internal RPC mTLS handshake may exhaust server memory before ACL authorization is evaluated , meaning a valid ACL token is not strictly required to trigger...

CVE-2026-87090

Consul and Consul Enterprise (HashiCorp) are affected by an authorization bypass in the catalog node-write path . An authenticated attacker holding a token with node-write permission on any single node name can, if they obtain the node ID of a node they do not control, delete that node's catalog ...

CVE-2026-88057

Angular (versions prior to 20.3.28 , 21.2.20 , and 22.1.0 ) contains a sanitization bypass in @angular/core and @angular/compiler . The root cause is that the SecurityContext for directive host bindings was derived from the declaring directive or component selector rather than the concrete host e...

CVE-2026-9336

IBM WebSphere Application Server versions 9.0 and 8.5 (prior to 9.0.5.29 and 8.5.5.31 ) are vulnerable to a denial of service caused by a specially-crafted HTTP request sent to an administrative endpoint. A remote attacker with adjacent network access and no privileges can exhaust filesystem spac...

CVE-2026-9338

IBM WebSphere Application Server versions 9.0 (prior to 9.0.5.29) and 8.5 (prior to 8.5.5.31) are vulnerable to a denial of service triggered by a specially-crafted request that causes excessive resource consumption, potentially reducing service availability. The attack requires no authentication...

CVE-2026-88056

Angular's @angular/platform-server is vulnerable to SSRF and cross-origin credential disclosure prior to versions 20.3.30, 21.2.22, and 22.1.4 . The root cause is that the resolveUrl and parseUrl utilities invoked String.prototype.trim(), which strips leading Unicode whitespace (e.g. U+00A0, U+FE...

CVE-2026-89049

AWS Systems Manager Agent (SSM Agent) before 3.3.4851.0 on all platforms is affected by a server-side request forgery (SSRF) flaw in the Session Manager port forwarding to remote hosts functionality. The root cause is improper validation of equivalent address representations , allowing an authent...

CVE-2026-68527

Concrete CMS 8.3.0 through 9.5.2 contains an authorization bypass (cross-calendar IDOR) in the Calendar event edit dialog (concrete/controllers/dialog/event/edit.php). The dialog validated permissions against the calendar identifier supplied in the request rather than the calendar actually owning...

CVE-2026-88036

The GridFS component of the MongoDB C Driver is vulnerable to query-operator injection in file identifiers. A caller-supplied structured file ID can be interpreted as a query condition rather than a literal identifier, allowing an authenticated user who can influence the identifier to either read...

CVE-2026-88035

CVE-2026-88035 is a heap buffer overflow in the MongoDB C Driver 's client-side authentication path, triggered during SASL username canonicalization . A size-check integer wrap-around allows an unusually large username to be copied past the end of a small buffer, causing the embedding application...

CVE-2026-88034

CVE-2026-88034 affects the GridFS component of the MongoDB C++ Driver . The root cause is improper neutralization of special elements in data query logic: a caller-supplied structured file identifier can be interpreted as a query condition rather than a literal identifier. An authenticated user w...

CVE-2026-88033

MongoDB Java Driver 's GridFS component is vulnerable to query-operator injection through improperly neutralized file identifiers. A caller-supplied structured file ID may be interpreted as a query condition rather than a literal value, allowing an authenticated user who can influence the identif...

CVE-2026-88032

A use-after-free vulnerability in the reactive client-side encryption component of the MongoDB Java Driver allows an attacker who can cause an affected encrypted operation to be cancelled to free native resources while they are still in use, leading to hosting application process termination (den...

CVE-2026-88031

CVE-2026-88031 affects the GridFS component of the MongoDB Go Driver . The root cause is a query-operator injection vulnerability: a caller-supplied structured file identifier is interpreted as a query condition rather than a literal identifier due to improper neutralization of special elements i...

CVE-2026-88030

CVE-2026-88030 affects the GridFS component of the MongoDB Ruby Driver . The root cause is improper neutralization of special elements in data query logic: a caller-supplied structured file identifier can be interpreted as a query condition rather than a literal identifier. An authenticated user ...

CVE-2026-88029

CVE-2026-88029 is a query-operator injection vulnerability in the GridFS component of the MongoDB Python Driver . An improper neutralization of special elements in data query logic allows a caller-supplied structured file identifier to be interpreted as a query condition rather than a literal ide...

CVE-2026-88028

CVE-2026-88028 affects the polymorphic relation handling in the MongoDB integration for Laravel . The root cause is improper neutralization of special elements in data query logic , which allows a caller-supplied relation identifier to be interpreted as a query condition rather than a literal ide...

CVE-2026-88055

AnythingLLM (by Mintplex-Labs), in versions 1.16.1 and earlier , is affected by a stored XSS caused by unescaped server-side HTML concatenation. The manager role can store meta_page_title or meta_page_favicon via /api/admin/system-preferences; these values pass unchanged through server/models/sys...

CVE-2026-88027

CVE-2026-88027 affects the MongoDB integration for Laravel in its embedded-document relation handling . The root cause is a query-operator injection flaw: a caller-supplied embedded record identifier can be interpreted as a query condition rather than a literal identifier, due to improper neutral...

CVE-2026-88026

MongoDB C# Driver is affected by a regular expression injection in its LINQ query translation component . The root cause is improper neutralization of regular-expression metacharacters: a caller-supplied string can alter a regex predicate generated by the application. An authenticated user who ca...

CVE-2026-88025

CVE-2026-88025 affects the GridFS component of the MongoDB C# Driver . A caller-supplied structured file identifier is improperly neutralized, allowing it to be interpreted as a query condition rather than a literal identifier (query-operator injection). An authenticated user who can influence th...

CVE-2026-88024

CVE-2026-88024 affects the GridFS component of the MongoDB Rust Driver . A caller-supplied structured file identifier is not properly neutralized in query logic, allowing it to be interpreted as a query condition rather than a literal identifier. An authenticated user who can influence the identi...

CVE-2026-88023

CVE-2026-88023 affects the GridFS component of the MongoDB PHP Library . The root cause is query-operator injection : a caller-supplied structured file identifier is interpreted as a query condition rather than a literal identifier due to improper neutralization of special elements in data query ...

CVE-2026-88054

Tesseract is an open-source OCR engine affected in version 5.5.3 and earlier by a denial-of-service flaw. The root cause is in Plumbing::DeSerialize (src/lstm/plumbing.cpp), which rejects excessively large network stacks but accepts a zero-length stack for NT_SERIES, NT_PARALLEL, or NT_REVERSED l...

CVE-2026-89046

zstd-jni versions 1.5.5-6 through 1.5.7-13 contain an out-of-bounds read vulnerability in Zstd.getFrameContentSize . The root cause is a missing validation of negative srcPosition arguments, which bypass bounds checks and propagate into the native frame-header parser, causing out-of-bounds memory...

CVE-2026-89045

zstd-jni versions 1.4.8-4 through 1.5.7-13 contain a denial-of-service vulnerability in ZstdInputStreamNoFinalizer.read(). The method fails to validate negative length parameters, causing an infinite loop while holding the stream monitor and blocking all other threads from accessing the stream. T...

CVE-2026-89044

Netty versions 4.1.133.Final through 4.1.137.Final and 4.2.13.Final through 4.2.17.Final contain an HTTP request smuggling vulnerability in the Transfer-Encoding header handling within the HTTP codec. The root cause is a failure to properly validate the final transfer coding: attackers can split ...

CVE-2026-89043

passport-saml-encrypted through version 0.1.13 is affected by an XML signature wrapping vulnerability. The root cause is that signature verification and assertion extraction use independent XPath lookups with no cross-validation (see saml.js lines 256 and 328). An attacker holding any validly sig...

CVE-2026-89042

passport-saml-encrypted through version 0.1.13 contains an authentication bypass vulnerability in its SAML signature verification logic. The signature check is conditional on an optional cert option; when this option is not configured, SAML responses are accepted without signature verification . ...

CVE-2026-88053

Tesseract OCR engine (version 5.5.3 and earlier) is vulnerable to a heap out-of-bounds write in Classify::ReadIntTemplates (src/classify/intproto.cpp). The function reads NumClassPruners, NumClasses, and NumProtoSets from the TESSDATA_INTTEMP component of a crafted .traineddata file and uses them...

CVE-2026-88052

Tesseract is an open-source OCR engine. In versions 5.5.3 and earlier , the function UNICHARSET::load_via_fgets (in src/ccutil/unicharset.cpp) uses a declared unichar count as a loop bound and indexes into the unichars vector with an unchecked id. Because unichar_insert_backwards_compatible can l...