CVE-2026-12150

IBM MQ Appliance is affected by an improper validation vulnerability in its TLS certificate processing (CWE-121: Stack-based Buffer Overflow). A remote attacker holding a trusted TLS client certificate can cause a denial of service and potentially affect memory contents by supplying deeply nested...

CVE-2026-11378

IBM MQ Appliance is affected by an integer overflow in distribution list processing (CWE-190). An authenticated attacker could exploit this to cause a denial of service or potentially execute arbitrary code . IBM rates the CVSS base score at 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Affected ver...

CVE-2026-11726

IBM MQ Appliance is affected by an improper validation vulnerability in message header offset processing (CWE-125: Out-of-bounds Read). An authenticated attacker could exploit this to obtain sensitive information or cause a denial of service. The vulnerability carries a CVSS 3.1 base score of 8.1...

CVE-2026-11375

IBM MQ Appliance is vulnerable to a stack buffer overflow in XA transaction identifier processing , which could allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code . The IBM-assigned CVSS 3.1 base score is 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). A...

CVE-2026-10027

IBM MQ Appliance is affected by a buffer overflow (CWE-787) in compressed data channel processing . A remote, unauthenticated attacker can send malformed compressed data on channels with compression enabled, potentially causing a denial of service or arbitrary code execution . The CVSS 3.1 base s...

CVE-2026-10747

IBM MQ Appliance is affected by a heap buffer overflow (CWE-122) in protocol message processing that can be exploited remotely and prior to authentication, potentially leading to denial of service or arbitrary code execution . The CVSS 3.1 base score is 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)....

CVE-2026-73699

FileRun before 2026.3.0 is affected by a PHP object injection vulnerability in the Perms::getPerms() method. The root cause is an incorrect option passed to unserialize() : a positional array is used instead of the required named-key array, failing to disable class instantiation. Authenticated at...

CVE-2026-73698

FileRun versions prior to 2026.3.0 contain an authenticated SQL injection vulnerability in the Groups Add action. A delegated or simple administrator can submit the description parameter as an array, causing the getValuesString() method in DB/DP.php to interpolate raw array values into an INSERT ...

CVE-2026-73694

FileRun versions before 2026.3.0 contain an OS command injection vulnerability rooted in a no-op redefinition of escapeshellcmd() in CLI.php , which strips shell-metacharacter escaping and allows attacker-controlled input to reach an exec() sink unsanitized. Two exploitation paths are identified:...

CVE-2026-73693

FileRun before 2026.3.0 is vulnerable to OS command injection in the PhotoProofSheet handler. The root cause is a missing escapeshellarg() call when constructing the ImageMagick montage command, allowing authenticated users with upload permission to execute arbitrary commands by uploading files w...

CVE-2026-68487

CVE-2026-68487 is a path traversal vulnerability in Plesk's Backup Manager caused by an unsigned backup header , allowing an authenticated customer to perform an arbitrary file write as root . The vulnerability is scored CVSS 9.9 (Critical) with a changed scope, reflecting high impact on confiden...

CVE-2026-65639

ConfigServer Security & Firewall (CSF) is vulnerable to OS command injection in its advanced-rule parser . An attacker who controls a configured allow/deny feed can inject commands that execute with root privileges , due to insufficient validation of feed-supplied rule data. The vulnerability aff...

CVE-2026-68488

CVE-2026-68488 is a TOCTOU race condition in Plesk's Backup Manager that leads to insecure symlink following during restore operations. An attacker with low privileges can exploit this to take over ownership of arbitrary files or directories, resulting in local privilege escalation to root . The ...

CVE-2026-65638

ConfigServer Security & Firewall (CSF) is vulnerable to shell command injection due to improper escaping of a request URL. An unauthenticated remote attacker can exploit this to execute arbitrary commands as the CSF service account. The CVSS 4.0 score is 9.2 (Critical) with a network attack vecto...

CVE-2026-88050

Tesseract (open-source OCR engine) versions 5.5.3 and earlier contain an out-of-bounds write in the UnicharCompress component. The root cause is that RecodedCharID::DeSerialize in src/ccutil/unicharcompress.h validates length_ but accepts negative code_ values from a crafted .traineddata recoder ...

CVE-2026-88049

Tesseract (open-source OCR engine) versions 5.5.3 and earlier are affected by a heap out-of-bounds write in LSTM::Forward (src/lstm/lstm.cpp). Prior hardening added bounds checks to NetworkIO::CopyTimeStepGeneral and NetworkIO::Randomize but left NetworkIO::WriteTimeStepPart and NetworkIO::AddTim...

CVE-2026-88048

Tesseract OCR (open source) is affected through version 5.5.3 and earlier. The flaw resides in FullyConnected::DeSerialize (src/lstm/fullyconnected.cpp), which fails to validate deserialized layer scalars ni_ and no_ against weight-matrix dimensions. During FullyConnected::Forward, MatrixDotVecto...

CVE-2026-88047

Tesseract (open-source OCR engine), versions 5.5.3 and earlier , is affected by a stack buffer overflow in Classify::ReadNormProtos (src/classify/normmatch.cpp). The function parses the NORMPROTO component of a .traineddata file using std::istream::operator>>(char*) into a fixed 61-byte sta...

CVE-2026-38058

CVE-2026-38058 is currently a reserved candidate with no public technical details in the provided documents. A single sighting links it to a CISA ICS advisory (ICSA-26-183-01), but the advisory's contents are not included here. Action: monitor for updates when details are published.

CVE-2026-88046

rclone prior to 1.75.1 does not reject parent-directory (..) segments in source Object.Remote() values before they are passed to destination backends via fs/list, fs/walk, fs/sync, or fs/operations. A flat-keyspace source store populated with non-rclone tooling can carry a raw .. key segment, and...

CVE-2026-88045

rclone (a CLI for syncing files across cloud storage) is affected by a memory exhaustion vulnerability in its S3 multipart streaming path (cmd/serve/s3/multipart.go). From v1.75.0 through v1.75.1 , an attacker-controlled Content-Length is passed to multipart.NewRW().Reserve before the request bod...

CVE-2026-88044

rclone versions 1.70.0 through 1.75.1 are affected by an authentication proxy bypass in the serve/start RC interface. The FTP and S3 constructors in cmd/serve/ftp/ftp.go and cmd/serve/s3/server.go incorrectly check the process-global proxy.Opt.AuthProxy value instead of the per-server request-loc...

CVE-2026-79987

CVE-2026-79987 is a low-privilege remote code execution vulnerability in Craft CMS , exploitable by a remote, authenticated, non-admin Control Panel user holding only the accessCp permission. The root cause involves element-search eager loading , allowing the attacker to execute operating system ...

CVE-2026-82583

This reserved CVE candidate lacks publicly available technical details in the provided documents. A CISA ICS Medical Advisory (ICSMA-26-253-01) sighting suggests an industrial/medical context, but no product, component, or impact is yet confirmed. Monitor for updates.

CVE-2026-78224

This candidate is currently reserved with no public technical details. It was sighted in connection with a CISA ICS Medical Advisory (ICSMA-26-253-01). Monitor for updates as details are published.

CVE-2026-82578

CVE-2026-82578 is currently in a reserved state with no technical details published. Sightings reference a CISA ICS Medical Advisory , but no product, root cause, or impact information is yet available. Monitor for updates as the disclosure is expected.

CVE-2026-88018

rclone (a command-line tool for syncing files to cloud storage) contains a SigV4 signature bypass in its serve s3 mode. When configured with --auth-proxy but without --auth-key, the authPairMiddleware registers any client-chosen accessKeyID with an empty secret. The embedded gofakes3 component th...

CVE-2026-88017

rclone versions 1.64.0 through 1.75.1 contain a cross-session authentication confusion in the FTP auth-proxy driver (cmd/serve/ftp/ftp.go). The server stores one obscured password per username in a global userPass map rather than binding it to the authenticated session. When a second login with t...

CVE-2026-88016

rclone prior to 1.75.1 is vulnerable to a symlink-escape issue in the backend/local --links mode. A source .rclonelink object can plant a symlink in the destination, and subsequent directory metadata operations (MkdirMetadata, writeMetadataToFile, setTimes) — which run when Directory.translatedLi...

CVE-2026-88015

rclone prior to 1.75.1 is affected when its local backend is configured with --links (or links=true), which exposes symlink targets as .rclonelink objects. A crafted HTTP Range request with a positive start value larger than the target string length triggers an unchecked slice in openTranslatedLi...

CVE-2026-88014

rclone versions 1.72.0 through 1.75.1 are affected by a Zip Slip vulnerability in the archive ZIP backend ((*Fs).readZip in backend/archive/zip/zip.go). The method accepts archive/zip.File.Name values from an untrusted central directory and exposes cleaned entry names without verifying they remai...

CVE-2026-81046

Dell ThinOS 10 versions prior to 2605_10.2616 are affected by a Protection Mechanism Failure vulnerability. An unauthenticated attacker with remote network access can potentially exploit this flaw to achieve Arbitrary Code Execution within the application context. The CNA-assigned CVSS 3.1 score ...

CVE-2026-88959

Anchor CMS through 0.12.7 contains a privilege escalation vulnerability caused by missing role-based access control (RBAC) on admin user-management endpoints. Any authenticated user with editor or user roles can send POST requests directly to the admin/users/add or admin/users/edit endpoints to c...

CVE-2026-87913

The AWS Security Agent MCP server prior to version 0.2.0 is vulnerable to a missing S3 bucket ownership verification , allowing remote attackers to obtain the private source archive of a scanned workspace — including credentials and infrastructure state — by registering a storage bucket whose nam...

CVE-2026-81468

Dell ThinOS 10 , versions prior to 2605_10.2616 , is affected by an OS Command Injection vulnerability (Improper Neutralization of Special Elements used in an OS Command). A high-privileged attacker with remote access could potentially exploit this flaw to achieve command execution on the device....

CVE-2026-87912

CVE-2026-87912 affects the AWS Security Agent plugin in Amazon aws-agents-for-devsecops prior to version 1.1.0. A missing S3 bucket ownership verification allows a remote attacker to obtain the private source archive of a scanned workspace—potentially exposing credentials and infrastructure state...

CVE-2026-81467

Dell ThinOS 10 (versions prior to 2605_10.2616 ) is affected by an OS Command Injection vulnerability. An unauthenticated attacker with remote network access can exploit this flaw to achieve arbitrary command execution on the device. Dell assigned a CVSS v3.1 score of 9.8 (Critical) , reflecting ...

CVE-2026-88013

rclone (a command-line tool for syncing files to/from cloud storage) is affected in versions 1.49.0 through 1.75.1 due to its HTTP backend attaching custom headers (set via --http-headers or headers=) to outgoing requests while following redirects without a backend-specific http.Client.CheckRedir...

CVE-2026-81049

Dell ThinOS 10 , in versions prior to 2605_10.2616 , is affected by a Missing Support for Integrity Check vulnerability. A high-privileged attacker with local access can potentially exploit this flaw to achieve arbitrary code execution . The CVSS 3.1 score is 4.4 (MEDIUM) , with the primary impac...

CVE-2026-4130

CVE-2026-4130 is a cleartext storage vulnerability in NI SystemLink and NI SystemLink Server , affecting 2026 Q3 and prior versions . An attacker with local access and low privileges can obtain sensitive information stored by the system in cleartext, resulting in high impacts to both confidential...

CVE-2026-4129

NI SystemLink and NI SystemLink Server (versions 2026 Q3 and prior) contain an improper access control vulnerability that allows an authenticated user with limited privileges to access host operating system files and directories that should be restricted. The CVSS 3.1 score is 8.1 (HIGH) with hig...

CVE-2026-81051

Dell ThinOS 10 , in versions prior to 2605_10.2616 , is affected by a Security Version Number Mutable to Older Versions vulnerability. A low-privileged attacker with physical access can potentially exploit this flaw to bypass the system's protection mechanism, resulting in high impact across conf...

CVE-2026-88012

Traefik , the open-source HTTP reverse proxy and load balancer, has a flaw in how HTTP/3 entrypoints handle respondingTimeouts.readTimeout . The timeout is enforced at the TCP layer, but HTTP/3 operates over QUIC , which has no corresponding stream deadline. This means an unauthenticated attacker...

CVE-2026-81048

Dell ThinOS 10 , versions prior to 2605_10.2616 , is affected by a Command Injection vulnerability (Improper Neutralization of Special Elements used in a Command). An unauthenticated attacker with adjacent network access could exploit this to achieve Remote Code Execution , with a CVSS 3.1 score ...

CVE-2026-81052

Dell ThinOS 10 , versions prior to 2605_10.2616 , is affected by a Download of Code Without Integrity Check vulnerability. An unauthenticated attacker with physical access could potentially exploit this flaw to achieve arbitrary code execution , resulting in high impact to confidentiality, integr...

CVE-2026-88011

Traefik , an open-source HTTP reverse proxy and load balancer, is vulnerable to ForwardAuth identity spoofing via a dot-form header alias (e.g., X.Authenticated.User). Because Go treats dot-form headers as distinct from their dash-form equivalents (e.g., X-Authenticated-User), a client-supplied d...

CVE-2026-88940

knowns through version 0.33.0 fails to validate the path query parameter in the workspace browse endpoint , allowing remote, unauthenticated attackers to enumerate arbitrary directories on the host filesystem. Attackers can traverse the directory structure to locate project directories and identi...

CVE-2026-88939

knowns through 0.33.0 unconditionally exempts the project.set action from permission guard checks, allowing read-only agent sessions to bypass restrictions. An attacker with a read-only session can invoke project.set to repoint the server at another project directory, thereby obtaining write acce...

CVE-2026-88938

knowns through version 0.33.0 is affected by a path traversal vulnerability in the code.find MCP tool . The tool fails to confine its path argument to the project root, allowing an AI agent session to supply absolute paths or relative traversal sequences and retrieve full file contents from outsi...

CVE-2026-88937

knowns through version 0.33.0 is affected by a path traversal vulnerability in its code generation template engine (internal/codegen/template_engine.go). The engine fails to properly validate template destination paths, allowing an attacker who supplies a malicious template to read and write arbi...