CVE-2026-53551

The vulnerability CVE-2026-53551 affects free5GC AUSF prior to version 1.4.5, where the supiOrSuci field in UE authentication requests is not validated. Null bytes (\x00) and other control characters pass through JSON parsing and are forwarded to the UDM in an unescaped URL path, causing Go’s net...

CVE-2026-62959

CVE-2026-62959 affects Coturn versions 4.5.2–4.14.0 where, when started with --acme-redirect and exposing a plaintext-TCP listener, an unauthenticated remote client can trigger a pre-auth heap-memory disclosure by sending a single HTTP GET, receiving a 301 with a Location header that leaks up to...

CVE-2026-53599

CVE-2026-53599 affects REDAXO CMS versions 5.18.2–5.21.1 where rex_mediapool::isAllowedExtension lets an authenticated backend user with media[upload] permission upload a JPEG/PHP polyglot named shell.php.any.jpg. On servers with multi-extension PHP handlers, this can be executed as the web serve...

CVE-2026-62999

Copier (library and CLI for rendering project templates) is affected from version 9.5.0 through 9.16.0. Percent-encoded parent-directory segments or encoded path separators in a template URL could match a configured trusted repository prefix before HTTP server or Git transport decoding, enabling ...

CVE-2026-53510

Savon (Ruby SOAP client) contains a vulnerability in Savon::Model.all_operations, which interpolates attacker-controlled WSDL operation names into Ruby source passed to module_eval, allowing arbitrary code execution in the application process. Affected versions are 0.9.8 through 2.17.1; the issue...

CVE-2026-18394

CVE-2026-18394 affects Strands Agents Tools’ http_request tool prior to v0.8.2, where incorrect authorization could allow an attacker to exfiltrate credentials configured via HTTP_REQUEST_TOKEN_CONFIG by routing requests through proxy infrastructure under attacker control. Root cause: insufficien...

CVE-2026-65841

CVE-2026-65841 affects Jodit Editor prior to version 4.13.6, where the clean-html denyTags filter fails to normalize foreign SVG/MathML script node names, allowing a [removed] element nested inside SVG (or MathML) to survive and execute when content is loaded. The issue stems from insufficient no...

CVE-2026-62324

Technical details about CVE-2026-62324 are not publicly available in the provided documents. Monitor for updates.

CVE-2026-55825

CVE-2026-55825 (Contao) : Affected are Contao core-bundle versions 5.7.0–5.7.6. An authenticated backend user who can access one job can craft an attachment identifier containing ../ segments to have the job attachment download endpoint read a file from another job directory inside var/job-attach...

CVE-2026-55824

Contao CVE-2026-55824 affects the crawler in versions 4.13.40–5.3.46 and 5.7.0-RC1–5.7.6. The issue arises because the crawler’s cleanup logic preserves root-origin options but strips out non-Symfony option names basic_auth and bearer_auth instead of Symfony’s auth_basic and auth_bearer, leaving ...

CVE-2026-53502

Thumbor (open-source image thumbnail service by globo.com) is affected by a path traversal in file_loader prior to version 7.8.0. The issue occurs because file_loader decodes percent-encoded path segments after root-boundary validation, allowing traversal outside FILE_LOADER_ROOT_PATH via waterma...

CVE-2026-53505

Thumbor (open-source photo thumbnail service by globo.com) is affected prior to version 7.8.0. The filters:proportion() function does not enforce an upper bound on and executes during the post-transform phase, enabling extremely large resizes that can exhaust CPU/memory and cause a denial of ser...

CVE-2026-53504

Thumbor contains a Regex Denial of Service (ReDoS) vulnerability in the convolution filter that triggers exponential backtracking on crafted repeated numeric input. This affects versions prior to 7.8.0 and can cause a URL request to exhaust processing time. The issue is fixed in 7.8.0. Per the co...

CVE-2026-53503

Thumbor CVE-2026-53503 documents a vulnerability in the filters:convolution filter prior to 7.8.0 where the user-supplied columns value is passed to a C extension (thumbor/ext/filters/_convolution.c) as a divisor without validating that columns > 0. If columns is 0, the C code triggers undefin...

CVE-2026-53501

Thumbor (open-source image thumbnail service by globo.com) is affected prior to version 7.8.0. The vulnerability stems from using Python’s .replace() to strip the signature from the URL before HMAC validation, which removes all occurrences of the substring. An attacker can insert the same signatu...

CVE-2026-53500

Thumbor (open-source image service by globo.com) is affected prior to version 7.8.0 where ALLOWED_SOURCES is applied by re.match() to unescaped strings, enabling a hostname with dot-position differences to bypass the allowlist. Root cause: unescaped patterns treated as normal strings in a regex m...

CVE-2026-57232

CVE-2026-57232 affects Contao core-bundle's Feed Reader module. From versions 5.3.35–5.3.47 and 5.7.0-RC1–5.7.8, FeedReaderController::getResponse() passes feed URLs directly to the HTTP client via feedIo->read() without validating schemes or private addresses, enabling a backend user with mod...

CVE-2026-63725

Technical details for CVE-2026-63725 are not publicly available in the provided documents. Monitor for updates; no affected product, vulnerability type, or remediation can be determined from the current data.

CVE-2026-25552

The CVE-2026-25552 entry concerns Ghost CLI before 1.30.1, where an IP spoofing vulnerability allows unauthenticated remote attackers to bypass rate-limiting on self-hosted Ghost instances. The underlying issue is misusing the X-Forwarded-For header in combination with a misconfigured Nginx setup...

CVE-2026-18481

CVE-2026-18481 describes a stored cross-site scripting flaw in the AWS Ops Wheel project, affecting the participant_url handling. The issue, triggered by a crafted participant_url value with a dangerous URI scheme, could allow an authenticated remote user to steal session tokens and escalate to f...

CVE-2026-18321

CVE-2026-18321 describes a buffer overflow in NTPsec’s Zyfer refclock that can crash ntpd via a local attack. The CVE is listed as a classic buffer overflow (Buffer Copy without Checking Size of Input) affecting ntpsec, but the provided documents do not specify affected versions, exact vulnerable...

CVE-2026-54737

The CVE refers to @phun-ky/defaults-deep, a lodash-like defaultsDeep library. Before 2.0.5, defaultsDeep() recursively merges user-supplied objects without filtering proto, constructor, and prototype, allowing properties to be written to Object.prototype (prototype pollution). Affected version ra...

CVE-2026-54725

The vault-secrets-webhook Kubernetes mutating webhook is vulnerable prior to version 1.23.1, allowing direct secret injection into Pods via parseVaultConfig() accepting vault-addr annotation and related webhook behavior. The vault-serviceaccount setting can cause a ServiceAccount JWT to be sent t...

CVE-2026-34497

CVE-2026-34497 affects Johnson Controls FM Systems Employee prior to 2025.3.1, with an improper neutralization of Script-Related HTML tags in a web page that enables basic XSS. The CVSS 4.0 vector: AV:N/AC:L/PR:H/UI:P/VI:N/VO:N/SA:N/SI:N/VM:N, base score 4.8 (MEDIUM). No exploitation details are ...

CVE-2026-34495

Johnson Controls FM Systems Employee web application is affected by CVE-2026-34495, a Stored XSS due to improper neutralization of input during web page generation. Affects FM Systems Employee before 2025.3.1. CVSS v4.0 base score 4.8 (Medium) with network access, low attack complexity, no privil...

CVE-2026-21662

CVE-2026-21662 describes an "Unrestricted upload of file with dangerous type" vulnerability in Johnson Controls FM Systems Employee, affecting versions before 2025.3.1. The issue involves uploading potentially dangerous files, enabling use of malicious files. The official metrics list a CVSS v4.0...

CVE-2026-34490

CVE-2026-34490 affects the XAAP Android application (pre-1.53). The issue is cleartext storage of sensitive data in an unencrypted local database on the device, allowing a local attacker on a jailbroken or otherwise compromised device to retrieve sensitive information. CVSS v4.0 base score 4.8 (M...

CVE-2026-8446

CVE-2026-8446 refers to an authentication bypass in Langflow OSS via the Model Context Protocol (MCP) composer endpoint when mcp_composer_enabled=true (default) and projects use auth_type=oauth. Affected: Langflow OSS 1.0.0–1.10.3. Root cause: missing authentication for a critical function in MCP...

CVE-2026-17630

Langflow OSS CVE-2026-17630 is identified in IBM’s security bulletin as a remote-code execution vulnerability caused by improper validation of configuration parameters. Affected versions are Langflow OSS 1.0.0-1.10.3. The issue could allow a remote attacker to execute arbitrary code on the server...

CVE-2026-9077

Langflow OSS 1.0.0–1.10.3 is affected by CVE-2026-9077, where remote authenticated attackers can bypass localhost restrictions and write arbitrary MCP server configurations to IDE configuration files on the host. The IBM advisory details exploitation via improper handling of Model Context Protoco...

CVE-2026-7646

Langflow OSS has CVE-2026-7646: via a crafted MCP resources/read request with a URL-encoded path traversal, an attacker could read arbitrary files on the server (e.g., other users’ uploads, the JWT signing secret, the SQLite DB, and env vars). Affected versions are Langflow OSS 1.0.0–1.10.3. Root...

CVE-2026-17625

Langflow OSS is affected by CVE-2026-17625, where an authenticated remote attacker could execute arbitrary commands due to improper neutralization of special elements used in an OS command. This is part of a cluster of MCP-related vulnerabilities in Langflow, with high-severity CVSS scores for re...

CVE-2026-17626

Langflow OSS contains a vulnerability in the Model Context Protocol (MCP) features where incomplete filtering of dangerous Docker volume-mount and device-mapping arguments could allow an authenticated attacker to read, modify, or expose sensitive host files via Docker-based MCP servers. Root caus...

CVE-2026-17623

CVE-2026-17623 is a vulnerability in Langflow OSS affecting version 1.0.0–1.10.3 where the command field in MCP server configurations is not properly validated, allowing a remote authenticated attacker to execute arbitrary commands (OS command injection). Root cause: improper validation of MCP co...

CVE-2026-55100

CVE-2026-55100 affects the Node.js module hashi-vault-js . The vulnerable component is the internal path construction in src/Vault.js, which concatenates unencoded identifier values (e.g., name, username, group, role, version) into request paths and query strings instead of using proper encoding,...

CVE-2026-54729

The CVE affects the DSSRF Node.js library. Prior to version 1.0.5, is_url_safe could treat localhost as safe when DNS resolver 1.1.1.1 returns NXDOMAIN (dns.resolve4 yields no address and no dns.lookup fallback), enabling SSRF. The issue is fixed in version 1.0.5. Impact is SSRF with network atta...

CVE-2026-12075

CVE-2026-12075 / GHSA-QVV7-CG9C-W4X3 documents a DNS-rebinding SSRF bypass in the Python NLTK package, specifically via nltk.pathsec.urlopen. The advisory explains that the pathsec filter blocks loopback, private, link-local, and multicast ranges, including obfuscated forms, and recommends ENFORC...

CVE-2026-12061

CVE-2026-12061 is linked to a real vulnerability in Natural Language Toolkit (NLTK) related to the ReviewsCorpusReader FEATURES regex. The issue is a ReDoS: the vulnerable pattern ((?:(?:\w+\s)+)?\w+)[((?:+|-)\d)] can backtrack quadratically on long, bracket-less input lines, leading to high CPU ...

CVE-2026-12072

The CVE-2026-12072 entry is connected to a concrete vulnerability in the Natural Language Toolkit (NLTK) NKJPCorpusReader path traversal. The advisory details that attacker-controlled fileids can cause NKJPCorpusReader to construct a path via plain string concatenation (no normalization or contai...

CVE-2026-12074

CVE-2026-12074 / GHSA-XH95-F55M-82FW : The connected advisories reveal a path-traversal in NLTK’s FrameNetCorpusReader.frame(). By constructing a caller-supplied frame name, an attacker can escape the corpus root (e.g., using ../) and read arbitrary XML files via the built-in open(), bypassing th...

CVE-2026-44945

Technical details for CVE-2026-44945 are not publicly available in the provided documents. Monitor for updates.

CVE-2026-55996

Technical details for CVE-2026-55996 are not publicly available in the provided documents. Monitor for updates from vendors and security advisories.

CVE-2026-55997

Technical details for CVE-2026-55997 are not publicly available in the provided documents. Monitor for updates from SUSE and other vendors for affected products, impacts, and fixes.

CVE-2026-55998

Technical details for CVE-2026-55998 are not publicly available in the provided documents; no affected products, impact, or remediation are stated. Monitor for official disclosure updates from vendors.

CVE-2026-59675

Technical details for CVE-2026-59675 are not publicly available in the provided documents. Monitor for updates.

CVE-2026-62289

Technical details for CVE-2026-62289 are not publicly available in the provided documents. Monitor for updates.

CVE-2026-62292

Technical details for CVE-2026-62292 are not publicly provided in the supplied documents; no affected products, impact, or remediation are disclosed. Monitor for updates.

CVE-2026-62377

Technical details for CVE-2026-62377 are not publicly available in the provided documents. Monitor SUSE page and related sources for updates.

CVE-2026-58047

Technical details (affected product/version, root cause, exploitability) are not publicly provided in the supplied documents. Monitor for updates from CVE sources to obtain concrete impact, remediation, and affected configurations.

CVE-2026-58048

CVE-2026-58048 affects cPanel: during database rename operations the SQL mode is not properly preserved, allowing execution of SQL in the root context. The underlying issue is described as improper preservation of SQL mode when renaming databases, which can enable privilege escalation on privileg...