CVE-2026-42400

CVE-2026-42400 affects Kibana with Uncontrolled Resource Consumption (CWE-400). An authenticated user can send a specially crafted compressed request payload that is processed before authorization checks, causing excessive memory and CPU usage and potentially making the Kibana instance unresponsi...

CVE-2026-42401

CVE-2026-42401 affects Kibana, where improper neutralization of input during web page generation (CWE-79) allows stored HTML injection. A user with write access to an Elasticsearch index can persist crafted markup that, when rendered in a Kibana view by another user, may not be sufficiently sanit...

CVE-2026-33463

The CVE-2026-33463 issue affects Kibana and is caused by a logic error in validating expiration timestamps, allowing time-bounded public file share tokens to remain usable after expiration and enabling an unauthenticated actor with the token to access content. Affected versions include Kibana 8.x...

CVE-2026-33464

Summary: CVE-2026-33464 affects Kibana and causes denial of service through uncontrolled resource consumption when an authenticated, low-privilege user submits an oversized payload to an internal Kibana API, exhausting resources and making the service unresponsive. Affected product and versions (...

CVE-2026-33462

CVE-2026-33462 : Path traversal in Kibana dashboard management allows an authenticated, low-privileged user to craft a dashboard ID that, when deleted by an admin, can be redirected to an unintended endpoint, potentially enabling unauthorized deletion of user accounts or other resources. Affected...

CVE-2026-32847

DeepCode (commit c991dc2) exposes a path traversal vulnerability in the SPA catch-all route of new_ui/backend/main.py. An unauthenticated attacker can read arbitrary files by sending percent-encoded path segments to GET /{full_path:path}, bypassing Starlette path normalization via %2F and %2E%2E....

CVE-2026-33590

CVE-2026-33590 affects Portainer CE. Insecure default permissions grant regular (non-admin) users with endpoint access privileges to read host files and potentially obtain root-equivalent access on the host through privileged operations exposed by Portainer. The NVD entry and CVE records describe...

CVE-2026-49130

MPD (Music Player Daemon) prior to version 0.24.11 is affected by a CRLF injection vulnerability in the XSPF playlist plugin’s xspf_char_data function. By supplying a malicious XSPF playlist that exploits XML numeric character references, an attacker can cause Expat decoding to insert literal CR/...

CVE-2026-49129

Music Player Daemon (MPD) <= 0.24.10 contains a server-side request forgery (SSRF) in CurlInputPlugin by setting CURLOPT_FOLLOWLOCATION without CURLOPT_REDIR_PROTOCOLS_STR. This allows unauthenticated attackers to bypass the http/https scheme restriction and redirect to non-HTTP protocols (e.g...

CVE-2026-9039

CVE-2026-9039 affects the XCharge C6 via a configuration weakness in the device’s remote management service. An authenticated session can be established over a channel intended only for vehicle-charger signaling. The service is exposed on interfaces at the charging connector and accepts a default...

CVE-2026-9038

CVE-2026-9038 describes a stack-based buffer overflow in the charging controller’s signal-processing logic (XCharge C6). The vulnerability allows a physically proximate attacker to send oversized message fields, leading to memory corruption and potential execution of unauthorized code with elevat...

CVE-2026-9037

The CVE-2026-9037 issue affects the XCharge C6 charging controller’s firmware update mechanism. The firmware update process does not validate the authenticity of firmware packages delivered via the device management interface, because cryptographic signatures are not verified. An attacker with ac...

CVE-2026-49128

Music Player Daemon (MPD) up to version 0.24.11 contains a path traversal vulnerability in the local storage plugin, specifically LocalStorage::MapFSOrThrow and LocalStorage::MapUTF8, where on-disk paths are constructed by simple string joins of the storage root and a user-supplied URI without ca...

CVE-2026-46439

Summary: A high-severity Server-Side Template Injection (SSTI) vulnerability affects the trestle author jinja command in the Compliance-Trestle project, as reported in the GitHub advisory GHSA-GG2G-P7XC-QQMM. The issue arises from recursive rendering of Jinja templates without sandboxing, allowin...

CVE-2026-49127

MPD

CVE-2026-46685

RustFS 1.0.0-beta.2 fixes a CORS bug in the S3 listener. Before the fix, if RUSTFS_CORS_ALLOWED_ORIGINS is unset, ConditionalCorsLayer would echo any Origin back as Access-Control-Allow-Origin and set Access-Control-Allow-Credentials: true and Access-Control-Allow-Headers: *, including preflight ...

CVE-2026-45039

RustFS prior to 1.0.0-beta.2 uses an HMAC-SHA256 signature for internode RPC authentication that falls back to DEFAULT_SECRET_KEY = "rustfsadmin" if neither RUSTFS_RPC_SECRET nor the global S3 secret key is configured. The vulnerability arises from get_shared_secret() in crates/ecstore/src/rpc/ht...

CVE-2026-45040

RustFS (Rust-based distributed object storage) prior to version 1.0.0-beta.2 leaks sensitive credentials in logs when RUST_LOG=debug, including SessionToken (JWT), SecretAccessKey, and full JWT claims. The issue’s impact is information disclosure in server logs. Mitigation is upgrading to 1.0.0-b...

CVE-2026-45041

CVE-2026-45041 affects RustFS prior to 1.0.0-beta.2, where crates/appauth/src/token.rs embeds a 2048-bit RSA private key (TEST_PRIVATE_KEY) as a string constant and uses it in production to verify licenses. This allows anyone who can read the source or extract the key from binaries to mint arbitr...

CVE-2026-45042

RustFS is a distributed object storage system in Rust. Prior to 1.0.0-beta.2, the UploadPartCopy operation could copy objects across buckets without enforcing destination bucket policy on the source, because the implementation separately validates GetObject on the source and PutObject on the dest...

CVE-2026-45044

RustFS prior to 1.0.0-beta.2 is vulnerable. The admin router’s whitelist of /profile/cpu and /profile/memory from authentication allows any unauthenticated client to invoke profiling handlers. On supported builds (e.g., glibc), the handler runs a fixed 60-second CPU profiling operation, potential...

CVE-2026-47136

CVE-2026-47136 affects RustFS, a distributed object storage system written in Rust. The issue is an unauthenticated exposure of license metadata via the console endpoint GET /rustfs/console/license, which is accessible to any client that can reach the console listener and returns JSON containing ...

CVE-2026-47337

The CVE-2026-47337 issue affects Ubuntu Linux platforms (6.8, 6.17, 7.0) that include SAUCE patches. A NULL pointer dereference can occur in the handling of AF_INET/AF_INET6 socket mediation, potentially allowing an unprivileged local user to trigger a kernel oops. Affected component is the kerne...

CVE-2026-47336

Ubuntu Linux 6.8 is affected by a SAUCE patch issue in AppArmor AF_INET/AF_INET6 socket mediation code due to an uninitialized variable, exploitable by an unprivileged local user and potentially causing incorrect fine-grained mediation of network sockets. The CVE description and related documents...

CVE-2026-47335

CVE-2026-47335 : Ubuntu Linux 6.8 reportedly contains SAUCE patches and a possible NULL pointer dereference in AppArmor notification handling, exploitable by an unprivileged local user and capable of triggering a kernel panic. The connected sources provide minimal details beyond this description;...

CVE-2026-47334

The CVE-2026-47334 entry affects Ubuntu Linux versions 6.8, 6.17 and 7.0 where AppArmor SAUCE patches sleep while holding a spinlock in notification handling code. The underlying issue is a spinlock misuse in the notification path triggered by an unprivileged local user, which can lead to kernel ...

CVE-2026-47333

Summary (MODE C) : Ubuntu Linux 6.8, 6.17 and 7.0 include AppArmor SAUCE patches which may miscompute an internal buffer size, causing a heap memory out-of-bounds read in the AppArmor DFA policy engine’s notification handling code. The issue can be triggered by an unprivileged local user and can ...

CVE-2026-47332

CVE-2026-47332 affects Ubuntu Linux releases 6.8, 6.17 and 7.0 where AppArmor SAUCE patches incorrectly validate the size of an internal structure in notification handling. Root cause: size validation flaw leading to an out-of-bounds read in the notification path. Impact: information disclosure f...

CVE-2026-47331

CVE-2026-47331 affects Ubuntu Linux 6.8 and involves AppArmor SAUCE patches. The issue is a race condition caused by a failure to acquire a lock when modifying a linked list, which can lead to a use-after-free (UAF). An unprivileged local user could trigger this condition, with theoretical arbitr...

CVE-2026-47330

Ubuntu Linux 6.8, 7.17 and 7.0 contain AppArmor SAUCE patches that can use an uninitialized variable in notification handling code. The bug can be triggered by an unprivileged local user and can result in the incorrect caching of AppArmor notification responses. Affected component: AppArmor/notif...

CVE-2026-47329

CVEs-2026-47329 affects Ubuntu Linux releases 6.8, 6.17 and 7.0 due to SAUCE patches failing to validate invalid sizes of the name field in AppArmor notification responses. The issue can be triggered by an unprivileged local user and may cause incorrect handling of crafted responses. Root cause: ...

CVE-2026-47328

The CVE affects Ubuntu Linux versions 6.8, 6.17 and 7.0, where AppArmor SAUCE patches incorrectly free a pointer that was not kmalloc’d and leak memory. The vulnerability can be triggered by an unprivileged local user and may lead to slab metadata corruption and resource exhaustion. Root cause: d...

CVE-2026-47327

CVE-2026-47327 affects Ubuntu Linux 6.8, 6.17 and 7.0 where SAUCE patches introduce a NULL pointer dereference in AppArmor notification handling. The flaw can be triggered by an unprivileged local user and may lead to a kernel oops. The available documents do not provide exploit code, specific vu...

CVE-2026-46380

The GHSA advisory describes SSRF in the compliance-trestle project (trestle/core/remote/cache.py). The HTTPSFetcher._do_fetch() passes a user-supplied URL directly to requests.get() without validation, enabling Server-Side Request Forgery to internal services or cloud metadata endpoints (e.g., 16...

CVE-2026-47326

The CVE-2026-47326 issue concerns Ubuntu Linux versions 6.8, 6.17 and 7.0 affected by SAUCE patches introducing a memory leak in the handling of large AppArmor notification responses. The vulnerability can be triggered by an unprivileged local user, with the resulting leak potentially causing res...

CVE-2026-45332

Affected software: Automad (flat-file CMS/template engine). Vulnerability: Broken Access Control allowing an unauthenticated attacker to retrieve bcrypt password hashes of all administrator accounts (and, in 2.0.0-beta.27, TOTP secrets) via the publicly accessible /_api/user-collection/create-fir...

CVE-2026-4944

The provided documents describe a vulnerability in vllm-project/vllm version 0.14.1 where trust_remote_code is hardcoded to True in nemotron_vl.py and kimi_k25.py, bypassing user-specified --trust-remote-code=False and enabling remote code execution via malicious HuggingFace model repositories. T...

CVE-2026-43979

CVE-2026-43979 affects Local Deep Research. Before 1.6.0, PDFService._markdown_to_html() embeds user-supplied title and metadata into HTML without escaping, allowing HTML injection in the PDF export flow. This can chain into SSRF via WeasyPrint when rendering the PDF, bypassing existing SSRF defe...

CVE-2026-46526

CVE-2026-46526 concerns Local Deep Research. Before version 1.6.10, the URL validation flow had a logical flaw that could bypass SSRF protections because parsing differed between urlparse and the HTTP request library. The code first runs SSRF checks via validate_url and then uses requests.get to ...

CVE-2026-46509

CVE-2026-46509 affects the deepobj library. The vulnerability is prototype pollution arising when property paths contain proto /constructor/prototype, enabling modification of object prototypes. A fixed version is 1.0.3. Affected information is supported by multiple sources (NVD/NVD entry and CVE...

CVE-2026-43898

CVE-2026-43898 affects SandboxJS. Before version 0.9.6, sandboxed functions could access the host runtime via Function.caller, leaking the internal LispType.Call callback and enabling sandbox escapes that allow execution of arbitrary host JavaScript. The root cause is leakage through sandboxed fu...

CVE-2026-45307

Speakr prior to 0.8.20-alpha is vulnerable to an open redirect via the is_safe_url() helper. The validation used urljoin(request.host_url, target) before parsing, so a scheme-relative input like ////evil.com is resolved to a same-host URL during validation but is emitted verbatim in the Location ...

CVE-2026-45021

Kuma CVE-2026-45021 describes a cross-origin exposure in the default kuma-cp config where CorsAllowedDomains: "." and LocalhostIsAdmin: true enable a browser-based attacker to fetch admin credentials from the control plane. Before versions 2.7.25, 2.9.15, 2.11.13, 2.12.10, and 2.13.5, a malicious...

CVE-2026-46345

CVE-2026-46345 maps to a GitHub Advisory for compliance-trestle (trestle/core/commands/author/jinja.py) describing an Arbitrary File Write via Path Traversal. The root cause is insufficient validation of the -o/--output path, allowing traversal sequences (../, ..) and absolute paths. This enables...

CVE-2026-45774

CVE-2026-45774: The connected advisory details a path-traversal in IBM/compliance-trestle v4.0.2 where trestle:// URIs and relative paths bypass workspace boundaries, enabling reading arbitrary server files (e.g., /etc/passwd, /root/.aws/credentials) during OSCAL profile imports. Root cause is la...

CVE-2026-45311

The CVE concerns the DeepSeek-TUI run_tests tool, where versions 0.3.0–0.8.23 auto-run cargo test without user approval, enabling execution of arbitrary code via test code and build scripts. The root cause is that tests are auto-approved, allowing attacker-controlled test code in a malicious repo...

CVE-2026-45310

CVE-2026-45310 describes an SSRF via HTTP redirect bypass in CodeWhale’s fetch_url tool (DeepSeek TUI). Before version 0.8.22, fetch_url validates the initial URL against a restricted-IP blocklist, but the HTTP client follows up to 5 redirects without re-validating the redirect targets, potential...

CVE-2026-45373

CodeWhale: SSRF bypass in DeepSeek-TUI (CodeWhale via DeepSeek + MiMo) allows http://[::1] to bypass hostname validation prior to 0.8.26. The vulnerability stems from SSRF defenses not handling IPv6 literals correctly, enabling access to internal resources. Affected version is before 0.8.26; reme...

CVE-2026-45374

CVE-2026-45374 affects CodeWhale’s DeepSeek+MiMo task_create flow. Before version 0.8.26, sub-agents inherit two insecure defaults: allow_shell = true and auto_approve = true, enabling unrestricted, unapproved shell access after user approval of a task_create prompt. This can lead to remote comma...

CVE-2026-45058

The CVE-2026-45058 issue affects electerm (versions 3.8.8 and earlier). The root cause is persistent local-pty code execution via imported bookmarks or compromised sync targets, allowing an attacker to inject exec* fields or global config. This can cause remote code to run when a bookmark is open...