CVE-2026-71807

RuoYi-Cloud-Plus versions up to 2.6.2 are affected in the ruoyi-workflow module. The root cause is that multiple core task APIs in FlwTaskController lack permission annotations, and the Service layer does not verify whether the current user is the task handler or related user. Authenticated low-p...

CVE-2026-79516

CVE-2026-79516 is an out-of-bounds read in the stbsp_vsnprintf function (stb_sprintf.h) of the nothings/stb library, as of commit 31c1ad3 . A crafted input can trigger the OOB read, leading to a Denial of Service . The CVSS 3.1 score is 4.0 (MEDIUM) with a local attack vector and high complexity ...

CVE-2026-71809

Siam Ordering (siam-server) 1.0.0 contains an Authentication Bypass via Hardcoded Master Verification Code vulnerability. This allows a remote unauthenticated attacker to log in as any user, merchant, or administrator , effectively granting full access to the application without valid credentials...

CVE-2026-87942

CVE-2026-87942 affects the SafeDelete Drupal contrib module, which manages content deletion and provides reports for identifying orphaned content. The root cause is insufficient sanitization of node titles when displaying the orphaned nodes report, resulting in a persistent cross-site scripting (...

CVE-2026-79322

CVE-2026-79322 is a SQL injection vulnerability in the RelatedProduct block of Mageplaza Blog for Magento 2 (mageplaza/magento-2-blog-extension) through version 4.3.2 . Remote unauthenticated attackers can execute arbitrary SQL commands and read arbitrary database contents by manipulating the id ...

CVE-2026-71613

CVE-2026-71613 is a buffer overflow in GPAC (a multimedia framework), specifically in the j2kdec_process() function (JPEG 2000 decoder). The vulnerability is present in commit c2dee3aff638cd96f9617ac5b17dc2868cd90ef3 and allows an attacker to execute arbitrary code via a local attack vector requi...

CVE-2026-79324

A missing authorization flaw in the Address Delete controller of the Mageplaza GDPR extension for Magento 2 (mageplaza/module-gdpr) through version 4.2.9 allows a remote, unauthenticated attacker to delete any customer's saved address via a simple GET request to /customer/address/delete/id/{id}. ...

CVE-2026-71612

A buffer overflow in the nhntdmx_process() function of GPAC (introduced in commit c2dee3aff638cd96f9617ac5b17dc2868cd90ef3) allows an attacker to execute arbitrary code . The vulnerability is fixed in commit fac50e6a12ac27ffabdd5d3080b51afcc44ad8d6, available at the GPAC repository . No specific ...

CVE-2026-71808

CVE-2026-71808 is a SQL Injection vulnerability in Siam Ordering (siam-server) 1.0.0 . The root cause is the use of ${} string concatenation in MyBatis Mapper files—specifically AdminMapper.java , MerchantWithdrawRecordMapper.java , and MemberWithdrawRecordMapper.java —which allows remote authent...

CVE-2026-87952

CVE-2026-87952 affects the SAML SSO – Service Provider Drupal contrib module, which allows a Drupal site to act as a SAML 2.0 Service Provider. The module does not sufficiently prevent reuse of previously accepted SAML assertions : under certain circumstances, a valid assertion can be replayed wi...

CVE-2026-87955

CVE-2026-87955 affects the Ultimate Table Field Drupal contrib module, which stores table data in a field and allows editing cells through a dialog. The module does not sufficiently protect the route that opens the cell editor dialog, making it accessible to anonymous users who can open the dialo...

CVE-2026-87950

CVE-2026-87950 affects the SAML SSO – Service Provider Drupal contrib module, which allows a Drupal site to act as a SAML 2.0 Service Provider for external identity provider authentication. The vulnerability stems from embedded credentials within the module that, under certain circumstances, coul...

CVE-2026-87940

CVE-2026-87940 affects a Drupal contrib module that enables key-based authentication on a per-user basis. The module does not cache authentication keys per user, which can allow an attacker with the same permissions as another user to view that user's authentication keys, resulting in an access b...

CVE-2026-87951

CVE-2026-87951 affects the SAML SSO – Service Provider Drupal contrib module, which configures a Drupal site as a SAML 2.0 Service Provider for authentication via an external identity provider. The module stores sensitive authentication information in a manner that could allow disclosure to users...

CVE-2026-87941

CVE-2026-87941 is a reserved CVE that, per the connected Drupal advisory SA-CONTRIB-2026-139 , is associated with the Patreon Drupal module. The advisory classifies the issue as Critical and marks the module as unsupported , indicating the maintainer has not fixed the known security issue. No spe...

CVE-2026-79515

CVE-2026-79515 is an out-of-bounds read in the stbtt_GetGlyphShape component of the nothings/stb library (commit 31c1ad3). A crafted TTF file can trigger the read, leading to a Denial of Service . The CVSS 3.1 score is 4.3 (MEDIUM) with a network attack vector, low complexity, no required privile...

CVE-2026-79387

CVE-2026-79387 is an SQL injection (CWE-89) in PbootCMS versions 3.2.0 through 3.2.5, located in the mod() method of UserController.php and modUser() in UserModel.php. The field and value GET parameters are concatenated directly into a SQL UPDATE statement without sanitization or parameterized qu...

CVE-2026-19201

Google go-attestation versions up to and including 0.6.1 contain an uncontrolled recursion vulnerability in its Windows SIPA event log parser . The (*WinEvents).readELAMAggregation function recurses for every nested elamAggregation sub-event without enforcing a maximum depth limit, while the size...

CVE-2026-53939

OpenIDC/cjose is a C library implementing JOSE. In versions 0.6.1 through 0.6.2.5 , when encrypting a JWE using an AES-CBC-HMAC content-encryption algorithm (A128CBC-HS256, A192CBC-HS384, or A256CBC-HS512) with any key-management algorithm that generates a fresh CEK, the CEK is all zero bytes ins...

CVE-2026-53938

OpenIDC/cjose , a C library implementing JOSE, is affected by a heap buffer overflow in its JWE decryption path for the AES Key Wrap algorithms (A128KW, A192KW, A256KW) prior to version 0.6.2.5 . The root cause is a missing length validation of the attacker-supplied encrypted_key before unwrappin...

CVE-2026-53937

CVE-2026-53937 affects the MCP Kotlin SDK (versions 0.7.0–0.12.0 ). The root cause is an unbounded kotlinx.io.Buffer in ReadBuffer.append, which grows indefinitely when the stdio transport receives a byte stream without a terminating newline. The issue is amplified by StdioServerTransport and Std...

CVE-2026-87065

CVE-2026-87065 affects konflux-operator-tasks , where Tekton task steps execute with root privileges without sufficient defense-in-depth hardening. The lack of restricted capabilities, disabled privilege escalation, and other security controls could allow an attacker to escalate privileges or per...

CVE-2026-87064

konflux-operator-tasks contains a flaw where GitHub workflows do not explicitly define their required permissions. This oversight allows workflows to inherit default access tokens that grant broader privileges than intended. Excessive permissions could potentially allow an attacker to gain unauth...

CVE-2026-87063

A flaw in konflux-operator-tasks allows a compromised distribution channel to substitute a malicious tkn CLI binary during the Continuous Integration process. The root cause is that the CI pipeline downloads the tkn CLI over the network without verifying its integrity via checksums or digital sig...

CVE-2026-87061

A flaw in olm-operator-konflux-sample 's bundle-hack/update_bundle.sh script allows it to continue execution after errors in critical data processing steps (e.g., skopeo or jq commands), potentially leading to data integrity issues within the system. Red Hat notes that mitigation is either unavai...

CVE-2026-87059

A flaw in olm-operator-konflux-sample affects the bundle builder stage, which installs and upgrades Python packages using pip without verifying versions or using hash verification. This allows a malicious or compromised package to be introduced into the build process undetected, potentially leadi...

CVE-2026-87060

A flaw in olm-operator-konflux-sample stems from Renovate's automerge being configured too broadly, permitting a wide range of updates without sufficient scrutiny, while the critical base image ose-operator-registry is entirely excluded from update tracking. This combination creates an inconsiste...

CVE-2026-87056

CVE-2026-87056 affects operator-sdk-builder , where the repository lacks automated dependency-update configurations for its git submodules , Containerfile base image , and Tekton bundle references . This gap prevents the automatic flagging of stale or vulnerable dependencies, which could result i...

CVE-2026-87058

A flaw in olm-operator-konflux-sample (Konflux) leaves hermetic build mode disabled by default , allowing bundle builds to perform live network fetches. This permits external, unverified resources to be pulled during the build process, introducing a supply chain risk where resulting software arti...

CVE-2026-87055

A supply chain integrity flaw in operator-sdk-builder arises from the use of a mutable tag to identify its base container image in the Containerfile, rather than an immutable SHA256 digest. Because the tag can resolve to different image layers over time, the underlying base image may change unexp...

CVE-2026-87052

A flaw was identified in operator-foundry where the absence of automated dependency-update and vulnerability-scanning configurations in the repository increases the risk of undetected security vulnerabilities . This gap in automated security checks could lead to the inclusion of known vulnerable ...

CVE-2026-87051

A path-containment flaw in operator-foundry allows unauthorized file access beyond the intended build context confinement. The check that restricts file access relies on string-based validation only and fails to resolve symbolic links (symlinks) , enabling an attacker to create a symlink within t...

CVE-2026-86564

A flaw in DPDK lib/vhost results from missing length validation before reading command_data in the virtio-net control-queue handler , which can cause an out-of-bounds read and a host process crash . The CVSS v3.1 score is 3.3 (LOW) , with a local attack vector, low privileges required, no user in...

CVE-2026-47680

CVE-2026-47680 is a path traversal vulnerability in FluxCD source-controller (versions 0.0.17 through 1.8.4), a Kubernetes operator for artifact acquisition from Git, OCI, Helm, and S3 sources. Two attack surfaces exist: (1) an actor who can influence the contents of a Bucket-referenced bucket ca...

CVE-2026-18090

A heap out-of-bounds read vulnerability was identified in gdk-pixbuf , specifically in the uncompress() function that handles RLE-encoded Apple Icon Image (.icns) data. The function fails to validate the source buffer's boundaries during decompression, allowing a local attacker who supplies a cra...

CVE-2026-53581

OPNsense is a FreeBSD-based firewall and routing platform. A path traversal vulnerability in the NTP configuration module allows an attacker with access to NTP settings to manipulate the GPS or PPS serial port parameter , escaping the intended directory and forcing the system to write user-contro...

CVE-2026-87062

A flaw was found in konflux-operator-tasks , where GitHub Actions are configured to reference mutable tags or branches instead of specific, immutable commit SHAs. A remote attacker who compromises the referenced mutable tag or branch could introduce malicious code into the build process , potenti...

CVE-2026-87057

CVE-2026-87057 affects olm-operator-konflux-sample , where build pipelines reference runtime base images using mutable floating tags instead of immutable SHA256 digests. This allows the content of base images to be altered without detection, potentially introducing malicious code or unexpected ch...

CVE-2026-87054

CVE-2026-87054 affects operator-sdk-builder , where the containers-policy.json configuration file defaults to insecureAcceptAnything for container image registries not explicitly listed. This causes signature verification to be skipped for images pulled from unlisted registries, potentially allow...

CVE-2026-87053

operator-sdk-builder is affected by a flaw in its Containerfile configuration that causes the final built container image to run with root privileges by default . This increases the attack surface, as any process executed within the container has elevated permissions, and a compromised container ...

CVE-2026-87050

CVE-2026-87050 affects operator-foundry , where GitHub Actions and reusable workflows are referenced using mutable tags (e.g., @v0, @v4) instead of pinned commit SHAs. This allows an attacker to potentially alter the code executed in the CI pipeline through an upstream compromise or by re-pointin...

CVE-2026-53637

CVE-2026-53637 is an improper workflow enforcement vulnerability in Sylius (an open-source eCommerce framework on Symfony). The affected component is the cart FormComponent , a Symfony UX LiveComponent. When an order is completed while the cart page remains open, the stale component fails to dete...

CVE-2026-53638

Sylius (open-source eCommerce framework built on Symfony) is affected by an authorization bypass in the shop account API. The endpoint PATCH /api/v2/shop/account/orders/{tokenValue}/payments/{paymentId}—used by an authenticated customer to change the payment method of an unpaid order—fails to val...

CVE-2026-53639

Sylius (Open Source eCommerce Framework on Symfony) versions 2.0.0 through before 2.0.18, 2.1.15, and 2.2.6 are affected by an IDOR on Shop Payment Request API endpoints. The GET/PUT /api/v2/shop/payment-requests/{hash} and POST /api/v2/shop/orders/{tokenValue}/payment-requests endpoints perform ...

CVE-2026-55250

Maravel Framework (a PHP dependency-injection framework), prior to version 10.74.0 , is affected by a Token Replay Vulnerability (CVSS 8.7 HIGH). The root cause is a lifecycle mismatch: tymon/jwt-auth writes 14-day JWT blacklist entries into tagged cache, but Maravel's O(1) Atomic Lazy Eviction m...

CVE-2026-83950

This CVE entry is reserved , indicating technical details have not yet been publicized. The only reference is a ZDI blog post on the September 2026 security update review. Monitor for updates as the disclosing organization publishes specifics.

CVE-2026-53933

Maravel , a PHP dependency-injection framework, is vulnerable to side-channel information disclosure via dynamic route fuzzing in versions prior to 10.73.1 . When routes are compiled with dynamic placeholders (e.g., /api/v1/users/{id}), the raw placeholder key is mistakenly registered into the fl...

CVE-2026-81904

Concrete CMS below 9.5.3 is affected by a missing authorization flaw in the asset registration for sub-blocks within a Stack , Container , or layout area. The system registered view assets for every sub-block without verifying whether the requesting user had permission to view that sub-block, all...

CVE-2026-86075

n8n , an open-source workflow automation platform, contains an unauthenticated storage exhaustion vulnerability in its OAuth Dynamic Client Registration endpoint. Prior to versions 2.37.7 and 2.38.2 , the endpoint properly bounded redirect_uris but accepted arbitrarily large client_name and grant...

CVE-2026-86076

n8n , an open-source workflow automation platform, is affected by an expression sandbox escape in the Editor-UI. Prior to versions 1.123.76 , 2.37.7 , and 2.38.2 , the expression compiler sanitizer (the PrototypeSanitizer hook in packages/workflow/src/expression-sandboxing.ts) resolved through dy...