CVE-2026-104077 Obsidian Desktop < 1.14.0 RCE via Slides Plugin Markdown

Obsidian Desktop before 1.14.0 contains a remote code execution vulnerability that allows attackers to craft malicious Markdown notes exploiting insufficient sanitization of the data-background-iframe attribute, which bypasses DOMPurify and is processed by the bundled Reveal.js 4.3.1 within the...

CVE-2026-107292 Pydantic AI Web chat UI (`Agent.to_web()`, `clai web`): the local chat endpoint does not validate the `Host` header

Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 1.34.0 until 2.30.0, the Agent.toweb and clai web development chat server does not validate the Host header, allowing a website visited by a developer to use DNS rebinding to reach a...

CVE-2026-50055 Zimbra Collaboration Suite Sieve Notify Filter Action Bypasses Mail Forwarding Restriction via Variable Expansion

A policy-enforcement flaw in Zimbra Collaboration Suite allows an authenticated user to bypass disabled mail forwarding by using a Sieve notify action to send copies of email content and headers to an arbitrary address...

CVE-2026-50054 Zimbra Collaboration Suite GrantRightsRequest SOAP Handler Allows Self-Granting of Undocumented loginAs Mailbox Delegation Right

An authorization flaw in Zimbra Collaboration Suite’s GrantRightsRequest allows an attacker with access to an authenticated account to grant another local account the loginAs right, creating persistent mailbox access and mail-sending authority that survives password changes and session expiry...

CVE-2026-10631 Zimbra Collaboration Suite EWS Extension Authorization Bypass via Crafted Composite Folder/Item Identifier

An authorization bypass in the EWS FindItem handler of Zimbra Collaboration Suite 10.1.0 through 10.1.19 allows an authenticated user with EWS enabled to read complete mailbox items, including raw MIME and attachments, from arbitrary local accounts without a share or delegation grant...

CVE-2026-107291 Pydantic AI OpenTelemetry instrumentation: exception events on tool and agent run spans include content when `include_content=False`

Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 0.3.4 until 1.107.6 and 2.44.0, OpenTelemetry instrumentation configured with InstrumentationSettingsincludecontent=False can still export sensitive agent content through exception.message and...

CVE-2026-61801 github.com/moby/sys/user has a possible DoS via unbounded parsing of user and group database files

The github.com/moby/sys/user package provides Go utilities for parsing and looking up entries in Unix-style user and group database files. Versions before 0.4.1 do not sufficiently limit entries when parsing /etc/passwd- or /etc/group-style files, allowing an attacker who can supply a specially...

CVE-2026-107290 Pydantic AI: Event loop blocked by quadratic title extraction in `web_fetch`

Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 1.77.0 until 1.107.6 and 2.44.0, the local webfetchtool and the WebFetch local fallback process server-controlled responses with quadratic title extraction, whitespace normalization, and...

CVE-2026-106177

A kernel buffer overflow vulnerability in HP Sure Click versions prior to 4.4.33 may allow local privilege escalation or arbitrary code execution. HP has released version 4.4.33 to address this vulnerability...

CVE-2026-107678

FFmpeg through 9.0.2 contains a stack exhaustion vulnerability in avencryptioninitinfofree in libavutil/encryptioninfo.c, which recursively frees AVEncryptionInitInfo linked lists built by the MOV demuxer's movreadpssh. Attackers can supply a crafted MP4 file with tens of thousands of small pssh...

CVE-2026-107677

FFmpeg through 9.0.2 contains a denial of service vulnerability in the DASH demuxer that allows attackers to trigger an infinite loop by supplying an empty SegmentTemplate media URL. Attackers can craft an .mpd manifest declaring SegmentTemplate media="" so getcurrentfragment calls avstrireplace...

CVE-2026-107675

FFmpeg through 9.0.2 contains a missing host key verification vulnerability in the libssh-based sftp protocol handler that allows network attackers to impersonate SFTP servers. Attackers performing man-in-the-middle, DNS, or ARP spoofing can capture passwords supplied in sftp URLs, serve forged...

CVE-2026-107676

FFmpeg through 9.0.2 contains an uninitialized memory disclosure vulnerability in avdynamichdrplustot35 that leaves up to three payload bytes uninitialized when tonemappingflag is 0. Attackers can supply crafted Matroska T.35 BlockAdditional or HEVC/AV1 SEI metadata so that remuxing or transcodin...

CVE-2026-107660

FFmpeg before 8.1.3 and 9.x before 9.0.2 contains an improper certificate validation vulnerability in tlsopen of libavformat/tlsmbedtls.c, which skips hostname checks for IP-address hosts. Network attackers can intercept https, rtmps, or tls connections to IP-literal URLs with any trusted CA-issu...

CVE-2026-19585

HashiCorp go-getter versions before 1.8.10 and go-getter/v2 versions before 2.2.5 are vulnerable to path traversal during S3 and GCS directory downloads, which may allow files to be written outside the requested destination. This vulnerability CVE-2026-19585 is fixed in go-getter 1.8.10 and...

CVE-2026-107289

Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 1.56.0 until 1.107.6 and 2.44.0, applications that opt attacker-influenced URLs into local network access through FileUrl with forcedownload='allow-local' or webfetchtool with...

CVE-2026-107288

Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 1.77.0 until 1.107.6 and 2.44.0, the local webfetchtool and the WebFetch local fallback compare blockeddomains entries with a URL hostname before both values are normalized to the form used by...

CVE-2026-107287

Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 1.77.0 until 1.107.7 and 2.52.0, the local webfetchtool and the WebFetch local fallback can consume excessive CPU and memory during HTML-to-Markdown conversion of attacker-controlled HTML...

CVE-2026-107286

Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 2.10.0 until 2.53.0, streamed requests made through ConcurrencyLimitedModel or limitmodelconcurrency can retain shared concurrency slots because anyio.CapacityLimiter associates an acquired sl...

CVE-2026-107586

Uncontrolled eviction in the browser session table of the REST API in Progressive Robot hMailServer 6.2.28 through 6.3.5 allows a remote authenticated user to end other users' sessions. The table of browser sessions, shared by every account, the server administrator and support sessions, dropped...

CVE-2026-107585

Uncontrolled eviction in the pending sign-in tables of the REST API in Progressive Robot hMailServer 6.3.4 and 6.3.5 allows a remote unauthenticated attacker to make other users' OpenID Connect, SAML and passkey sign-ins fail. The routes that start a single sign-on and hand out a passkey sign-in...

CVE-2026-107589

Insufficient job validation for service accounts in Jacamar CI prior to v0.30.0 allows authenticated CI users to generate arbitrary account names...

CVE-2026-9209

mJobTime through build 15.7.3.32 contains an unauthenticated SQL execution vulnerability in the Login.aspx admin panel handlers, where the runQueryButton postback and exportSqlQueryServer PageMethod execute caller-supplied SQL against the backing Sybase SQL Anywhere database using DBA/sysadmin...

CVE-2026-107623

A flaw exists in the OIDC Dynamic Client Registration (DCR) component of Keycloak . A bug in the response serialization causes the backchannel logout offline token revocation setting to be omitted from responses. When a client performs a standard update, this missing information causes the settin...

CVE-2026-107604

A flaw in the Keycloak identity management service allows a realm administrator with the read-only view-clients role to retrieve the active primary secret of any confidential client. This occurs via the installation provider and client registration endpoints. The exposed secret can be used to imp...

CVE-2026-107565

A flaw in luksmeta allows a local attacker with administrative privileges to cause data corruption when saving metadata to a Linux Unified Key Setup (LUKS) device. The root cause is identified as incorrect boundary calculations and flawed overlap detection within the luks1 metadata allocator. Con...

CVE-2026-12859

A Missing Authorization (CWE-862) vulnerability exists in Caz Informatics Services Trade Inc. Advancity ALMS Cloud . The flaw allows an attacker to access functionality that is not properly constrained by Access Control Lists (ACLs). This issue affects the product through 2026-10-08 . The CVSS v3...

CVE-2026-93017

The insights-operator contains a security misconfiguration where the insights-operator-gather ClusterRole grants the gather service account excessive permissions. Specifically, it allows read access (get, list) to secrets in the core API group without any namespace or resource names restrictions....

CVE-2026-14269

IBM DataPower Gateway versions 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 are vulnerable to a heap-based buffer overflow . This issue is caused by improper bounds checking , which could allow an unauthenticated remote attacker to o...

CVE-2026-105331

Checkmk versions 2.5.0 before 2.5.0p10 are vulnerable to local privilege escalation via the mk-oracle agent plugin. An attacker with permissions to edit the Oracle Instant Client referenced by the plugin can escalate their privileges if the agent has this plugin enabled. This issue is associated ...

CVE-2026-107640

Integrics Enswitch versions 3.13 through 4.4 are vulnerable to an authentication bypass within the /api/json/user/password/update/ endpoint. The root cause is a weak password recovery mechanism where an unauthenticated attacker can change account passwords by omitting the reset parameter. By targ...

CVE-2026-107639

The ILIAS learning management system versions before 9.24 , 10.x before 10.12 , and 11.x before 11.5 are vulnerable to an argument injection vulnerability in the assImagemapQuestionGUI component. The root cause is that escapeshellcmd() fails to neutralize tab-separated options embedded within upl...

CVE-2026-107638

The pH7Builder (pH7 Social Dating CMS) software versions before 18.5.0 is vulnerable to an improper restriction of authentication attempts (CWE-307). The flaw resides in VerificationCodeFormProcess.php , where the system fails to limit attempts when verifying TOTP codes. An attacker who already p...

CVE-2026-107636

The pH7Builder (pH7 Social Dating CMS) application before version 18.5.1 is vulnerable to a payment validation bypass within the Payment Module MainController . This flaw allows registered low-privileged members to gain access to any membership tier by manipulating client-controlled fields such a...

CVE-2026-107637

pH7Builder (pH7 Social Dating CMS) versions prior to 18.5.0 are vulnerable to an improper authorization flaw within the note module delete() action . The root cause is a lack of profile ID checks in the database queries, which allows authenticated members to delete note comments and categories be...

CVE-2026-107634

Dislocker versions through 0.7.3 are vulnerable to a heap out-of-bounds read in the get_dataset() and get_next_datum() functions. The root cause is a failure to validate dataset and datum sizes against the metadata allocation. An attacker can craft a BitLocker volume image with inflated sizes to ...

CVE-2026-107635

Dislocker versions through 0.7.3 are vulnerable to an integer underflow within the get_vmk() and get_fvek() functions. An attacker can provide a malicious BitLocker volume image with a datum_size smaller than the required 36-byte AES-CCM header, triggering an out-of-bounds heap read via the hexdu...

CVE-2026-105832

EspoCRM versions before 10.0.6 are vulnerable to an authentication bypass flaw where the system accepts a login that is stopped at the second factor on routes not requiring authentication. An attacker possessing a 2FA-enabled user's credentials can bypass the second factor to access config parame...

CVE-2026-105833

EspoCRM versions before 10.0.5 are vulnerable to an Insecure Direct Object Reference (IDOR) in the PersonalAccount\Service component. This flaw allows users with Email Account scope access to retrieve the IMAP passwords of other users. If an attacker knows a victim's Email Account record ID, they...

CVE-2026-105831

EspoCRM versions before 10.0.6 are vulnerable to an unauthenticated stored HTML injection vulnerability. An attacker can submit crafted data via a Lead Capture public form , which is stored in LeadCaptureLogRecord.data . When an administrator views the log record, the request body is rendered une...

CVE-2026-105830

The league/commonmark library (versions 2.0.0 before 2.10.2 ) is vulnerable to a quadratic-time denial of service (DoS) attack within the GitHub Flavored Markdown Table extension. The issue resides in the TableStartParser::tryStart() block-start scan, where unauthenticated attackers can submit a ...

CVE-2026-105829

The League CommonMark library (versions 1.3.0 before 2.10.2 ) is vulnerable to a Stored Cross-Site Scripting (XSS) flaw. The root cause is a bypass in the DisallowedRawHtml extension, where an attacker can evade restrictions by ending a raw HTML tag with a bare disallowed tag name. By placing a l...

CVE-2026-105827

Versions of ImageMagick prior to 7.1.2-30 and 6.9.13-55 are vulnerable to a stack overflow within the CALS decoder . The root cause is a missing depth check , which allows an attacker to provide a crafted CALS image that triggers unbounded recursion . This vulnerability results in the exhaustion ...

CVE-2026-105828

Parse Server versions 8.2.2 before 8.6.92 and 9.0.0 before 9.10.1-alpha.12 are vulnerable to an information disclosure vulnerability via GraphQL errors. Even when public introspection is disabled, unauthenticated attackers possessing a public Application Id can send crafted operations to trigger ...

CVE-2026-105826

ImageMagick versions before 6.9.13-55 and 7.x before 7.1.2-30 are vulnerable to a security policy bypass within the MAT decoder . The root cause is the decoder's failure to enforce configured temporary file size limits when processing highly compressed data. An attacker can provide a crafted MAT ...

CVE-2026-105825

Versions of ImageMagick before 6.9.13-55 and 7.x before 7.1.2-30 are vulnerable to a Denial of Service (DoS) vulnerability. The root cause is improper handling of XMP profiles , where a crafted profile causes the process to terminate instead of raising an exception. An attacker can crash applicat...

CVE-2026-105823

The ImageMagick image processing library is vulnerable to a security policy bypass in the CUT encoder due to a lack of adequate security policy checks. This affects versions before 6.9.13-56 and 7.x before 7.1.2-31 . An attacker can provide crafted input to the CUT encoder to cause an application...

CVE-2026-105824

The ImageMagick image processing library is vulnerable to a Use-After-Free (CWE-416) flaw in the RSVG decoder when the software is built without Cairo support . This issue affects versions before 6.9.13-55 and 7.x before 7.1.2-30 . The vulnerability is triggered when a decoding limit is reached, ...

CVE-2026-105405

The ImageMagick library is vulnerable to an invalid memory free vulnerability within the MVG decoder in versions prior to 6.9.13-56 and 7.x before 7.1.2-31 . An attacker can trigger this flaw by providing a crafted MVG image for processing, which leads to an application crash and a subsequent den...

CVE-2026-105404

Versions of ImageMagick before 6.9.13-56 and 7.x before 7.1.2-31 are susceptible to a code injection vulnerability within the PostScript coders . The root cause is that certain values are not adequately escaped or trimmed during the output process. Consequently, an attacker can provide crafted va...