CVE-2026-106177 HP Sure Click Kernel Buffer Overflow

A kernel buffer overflow vulnerability in HP Sure Click versions prior to 4.4.33 may allow local privilege escalation or arbitrary code execution. HP has released version 4.4.33 to address this vulnerability...

CVE-2026-107678 FFmpeg through 9.0.2 Stack Exhaustion via Recursive Free of pssh Boxes

FFmpeg through 9.0.2 contains a stack exhaustion vulnerability in avencryptioninitinfofree in libavutil/encryptioninfo.c, which recursively frees AVEncryptionInitInfo linked lists built by the MOV demuxer's movreadpssh. Attackers can supply a crafted MP4 file with tens of thousands of small pssh...

CVE-2026-107677 FFmpeg through 9.0.2 DASH Demuxer Infinite Loop via Empty SegmentTemplate Media

FFmpeg through 9.0.2 contains a denial of service vulnerability in the DASH demuxer that allows attackers to trigger an infinite loop by supplying an empty SegmentTemplate media URL. Attackers can craft an .mpd manifest declaring SegmentTemplate media="" so getcurrentfragment calls avstrireplace...

CVE-2026-107675 FFmpeg through 9.0.2 Missing SSH Host Key Verification in sftp Protocol

FFmpeg through 9.0.2 contains a missing host key verification vulnerability in the libssh-based sftp protocol handler that allows network attackers to impersonate SFTP servers. Attackers performing man-in-the-middle, DNS, or ARP spoofing can capture passwords supplied in sftp URLs, serve forged...

CVE-2026-107676 FFmpeg through 9.0.2 Uninitialized Memory Disclosure via HDR10+ Metadata Serializer

FFmpeg through 9.0.2 contains an uninitialized memory disclosure vulnerability in avdynamichdrplustot35 that leaves up to three payload bytes uninitialized when tonemappingflag is 0. Attackers can supply crafted Matroska T.35 BlockAdditional or HEVC/AV1 SEI metadata so that remuxing or transcodin...

CVE-2026-107660 FFmpeg before 8.1.3 and 9.x before 9.0.2 mbedTLS Hostname Verification Bypass for IP Hosts

FFmpeg before 8.1.3 and 9.x before 9.0.2 contains an improper certificate validation vulnerability in tlsopen of libavformat/tlsmbedtls.c, which skips hostname checks for IP-address hosts. Network attackers can intercept https, rtmps, or tls connections to IP-literal URLs with any trusted CA-issu...

CVE-2026-19585 Go-getter vulnerable to a path traversal in S3/GCS directory download handling

HashiCorp go-getter versions before 1.8.10 and go-getter/v2 versions before 2.2.5 are vulnerable to path traversal during S3 and GCS directory downloads, which may allow files to be written outside the requested destination. This vulnerability CVE-2026-19585 is fixed in go-getter 1.8.10 and...

CVE-2026-107289 Pydantic AI: SSRF cloud-metadata blocklist bypass via IPv6 zone identifier (incomplete fix for CVE-2026-46678 and CVE-2026-48782)

Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 1.56.0 until 1.107.6 and 2.44.0, applications that opt attacker-influenced URLs into local network access through FileUrl with forcedownload='allow-local' or webfetchtool with...

CVE-2026-107288 Pydantic AI: web_fetch_tool blocked_domains bypass via a hostname the resolver normalizes differently

Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 1.77.0 until 1.107.6 and 2.44.0, the local webfetchtool and the WebFetch local fallback compare blockeddomains entries with a URL hostname before both values are normalized to the form used by...

CVE-2026-107287 Pydantic AI: Excessive resource use when local web fetching converts nested HTML

Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 1.77.0 until 1.107.7 and 2.52.0, the local webfetchtool and the WebFetch local fallback can consume excessive CPU and memory during HTML-to-Markdown conversion of attacker-controlled HTML...

CVE-2026-107286

Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 2.10.0 until 2.53.0, streamed requests made through ConcurrencyLimitedModel or limitmodelconcurrency can retain shared concurrency slots because anyio.CapacityLimiter associates an acquired sl...

CVE-2026-107586

Uncontrolled eviction in the browser session table of the REST API in Progressive Robot hMailServer 6.2.28 through 6.3.5 allows a remote authenticated user to end other users' sessions. The table of browser sessions, shared by every account, the server administrator and support sessions, dropped...

CVE-2026-107585

Uncontrolled eviction in the pending sign-in tables of the REST API in Progressive Robot hMailServer 6.3.4 and 6.3.5 allows a remote unauthenticated attacker to make other users' OpenID Connect, SAML and passkey sign-ins fail. The routes that start a single sign-on and hand out a passkey sign-in...

CVE-2026-107589

Insufficient job validation for service accounts in Jacamar CI prior to v0.30.0 allows authenticated CI users to generate arbitrary account names...

CVE-2026-9209

mJobTime through build 15.7.3.32 contains an unauthenticated SQL execution vulnerability in the Login.aspx admin panel handlers, where the runQueryButton postback and exportSqlQueryServer PageMethod execute caller-supplied SQL against the backing Sybase SQL Anywhere database using DBA/sysadmin...

CVE-2026-107623

A flaw exists in the OIDC Dynamic Client Registration (DCR) component of Keycloak . A bug in the response serialization causes the backchannel logout offline token revocation setting to be omitted from responses. When a client performs a standard update, this missing information causes the settin...

CVE-2026-107604

A flaw in the Keycloak identity management service allows a realm administrator with the read-only view-clients role to retrieve the active primary secret of any confidential client. This occurs via the installation provider and client registration endpoints. The exposed secret can be used to imp...

CVE-2026-107565

A flaw in luksmeta allows a local attacker with administrative privileges to cause data corruption when saving metadata to a Linux Unified Key Setup (LUKS) device. The root cause is identified as incorrect boundary calculations and flawed overlap detection within the luks1 metadata allocator. Con...

CVE-2026-12859

A Missing Authorization (CWE-862) vulnerability exists in Caz Informatics Services Trade Inc. Advancity ALMS Cloud . The flaw allows an attacker to access functionality that is not properly constrained by Access Control Lists (ACLs). This issue affects the product through 2026-10-08 . The CVSS v3...

CVE-2026-93017

The insights-operator contains a security misconfiguration where the insights-operator-gather ClusterRole grants the gather service account excessive permissions. Specifically, it allows read access (get, list) to secrets in the core API group without any namespace or resource names restrictions....

CVE-2026-14269

IBM DataPower Gateway versions 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 are vulnerable to a heap-based buffer overflow . This issue is caused by improper bounds checking , which could allow an unauthenticated remote attacker to o...

CVE-2026-105331

Checkmk versions 2.5.0 before 2.5.0p10 are vulnerable to local privilege escalation via the mk-oracle agent plugin. An attacker with permissions to edit the Oracle Instant Client referenced by the plugin can escalate their privileges if the agent has this plugin enabled. This issue is associated ...

CVE-2026-107640

Integrics Enswitch versions 3.13 through 4.4 are vulnerable to an authentication bypass within the /api/json/user/password/update/ endpoint. The root cause is a weak password recovery mechanism where an unauthenticated attacker can change account passwords by omitting the reset parameter. By targ...

CVE-2026-107639

The ILIAS learning management system versions before 9.24 , 10.x before 10.12 , and 11.x before 11.5 are vulnerable to an argument injection vulnerability in the assImagemapQuestionGUI component. The root cause is that escapeshellcmd() fails to neutralize tab-separated options embedded within upl...

CVE-2026-107638

The pH7Builder (pH7 Social Dating CMS) software versions before 18.5.0 is vulnerable to an improper restriction of authentication attempts (CWE-307). The flaw resides in VerificationCodeFormProcess.php , where the system fails to limit attempts when verifying TOTP codes. An attacker who already p...

CVE-2026-107636

The pH7Builder (pH7 Social Dating CMS) application before version 18.5.1 is vulnerable to a payment validation bypass within the Payment Module MainController . This flaw allows registered low-privileged members to gain access to any membership tier by manipulating client-controlled fields such a...

CVE-2026-107637

pH7Builder (pH7 Social Dating CMS) versions prior to 18.5.0 are vulnerable to an improper authorization flaw within the note module delete() action . The root cause is a lack of profile ID checks in the database queries, which allows authenticated members to delete note comments and categories be...

CVE-2026-107635

Dislocker versions through 0.7.3 are vulnerable to an integer underflow within the get_vmk() and get_fvek() functions. An attacker can provide a malicious BitLocker volume image with a datum_size smaller than the required 36-byte AES-CCM header, triggering an out-of-bounds heap read via the hexdu...

CVE-2026-107634

Dislocker versions through 0.7.3 are vulnerable to a heap out-of-bounds read in the get_dataset() and get_next_datum() functions. The root cause is a failure to validate dataset and datum sizes against the metadata allocation. An attacker can craft a BitLocker volume image with inflated sizes to ...

CVE-2026-105832

EspoCRM versions before 10.0.6 are vulnerable to an authentication bypass flaw where the system accepts a login that is stopped at the second factor on routes not requiring authentication. An attacker possessing a 2FA-enabled user's credentials can bypass the second factor to access config parame...

CVE-2026-105833

EspoCRM versions before 10.0.5 are vulnerable to an Insecure Direct Object Reference (IDOR) in the PersonalAccount\Service component. This flaw allows users with Email Account scope access to retrieve the IMAP passwords of other users. If an attacker knows a victim's Email Account record ID, they...

CVE-2026-105830

The league/commonmark library (versions 2.0.0 before 2.10.2 ) is vulnerable to a quadratic-time denial of service (DoS) attack within the GitHub Flavored Markdown Table extension. The issue resides in the TableStartParser::tryStart() block-start scan, where unauthenticated attackers can submit a ...

CVE-2026-105831

EspoCRM versions before 10.0.6 are vulnerable to an unauthenticated stored HTML injection vulnerability. An attacker can submit crafted data via a Lead Capture public form , which is stored in LeadCaptureLogRecord.data . When an administrator views the log record, the request body is rendered une...

CVE-2026-105829

The League CommonMark library (versions 1.3.0 before 2.10.2 ) is vulnerable to a Stored Cross-Site Scripting (XSS) flaw. The root cause is a bypass in the DisallowedRawHtml extension, where an attacker can evade restrictions by ending a raw HTML tag with a bare disallowed tag name. By placing a l...

CVE-2026-105827

Versions of ImageMagick prior to 7.1.2-30 and 6.9.13-55 are vulnerable to a stack overflow within the CALS decoder . The root cause is a missing depth check , which allows an attacker to provide a crafted CALS image that triggers unbounded recursion . This vulnerability results in the exhaustion ...

CVE-2026-105828

Parse Server versions 8.2.2 before 8.6.92 and 9.0.0 before 9.10.1-alpha.12 are vulnerable to an information disclosure vulnerability via GraphQL errors. Even when public introspection is disabled, unauthenticated attackers possessing a public Application Id can send crafted operations to trigger ...

CVE-2026-105826

ImageMagick versions before 6.9.13-55 and 7.x before 7.1.2-30 are vulnerable to a security policy bypass within the MAT decoder . The root cause is the decoder's failure to enforce configured temporary file size limits when processing highly compressed data. An attacker can provide a crafted MAT ...

CVE-2026-105825

Versions of ImageMagick before 6.9.13-55 and 7.x before 7.1.2-30 are vulnerable to a Denial of Service (DoS) vulnerability. The root cause is improper handling of XMP profiles , where a crafted profile causes the process to terminate instead of raising an exception. An attacker can crash applicat...

CVE-2026-105823

The ImageMagick image processing library is vulnerable to a security policy bypass in the CUT encoder due to a lack of adequate security policy checks. This affects versions before 6.9.13-56 and 7.x before 7.1.2-31 . An attacker can provide crafted input to the CUT encoder to cause an application...

CVE-2026-105824

The ImageMagick image processing library is vulnerable to a Use-After-Free (CWE-416) flaw in the RSVG decoder when the software is built without Cairo support . This issue affects versions before 6.9.13-55 and 7.x before 7.1.2-30 . The vulnerability is triggered when a decoding limit is reached, ...

CVE-2026-105404

Versions of ImageMagick before 6.9.13-56 and 7.x before 7.1.2-31 are susceptible to a code injection vulnerability within the PostScript coders . The root cause is that certain values are not adequately escaped or trimmed during the output process. Consequently, an attacker can provide crafted va...

CVE-2026-105405

The ImageMagick library is vulnerable to an invalid memory free vulnerability within the MVG decoder in versions prior to 6.9.13-56 and 7.x before 7.1.2-31 . An attacker can trigger this flaw by providing a crafted MVG image for processing, which leads to an application crash and a subsequent den...

CVE-2026-105403

The ImageMagick software versions before 6.9.13-56 and 7.x before 7.1.2-31 are vulnerable to a security policy bypass . The root cause is the use of coder instead of module as a domain within a policy, which allows an attacker to provide a crafted image to evade restrictions. This bypass enables ...

CVE-2026-105402

The software ImageMagick versions prior to 7.1.2-31 is vulnerable to a Denial of Service (DoS) condition during XMP profile parsing . An attacker can provide a crafted XMP profile that causes the application to fail while attempting to determine the numerator and denominator, resulting in a crash...

CVE-2026-105400

ImageMagick versions prior to 7.1.2-31 are susceptible to a resource leak vulnerability. By supplying a crafted magick script , an attacker can cause the software to leave file pointers open. This leak of file descriptors can lead to resource exhaustion, potentially resulting in a denial of servi...

CVE-2026-105401

Versions of ImageMagick before 7.1.2-31 are vulnerable to a heap buffer overflow within the distributed pixel cache server . An attacker can connect to this server and transmit crafted data to overwrite heap memory, which can result in a server crash and a denial of service (DoS). No specific exp...

CVE-2026-105399

The ImageMagick software versions before 6.9.13-56 and 7.x before 7.1.2-31 are vulnerable to a Denial of Service attack via the MVG decoder . The root cause is a missing limit check that allows an attacker to provide a specially crafted MVG image. This triggers a long-running decoding operation, ...

CVE-2026-105398

The ImageMagick software (versions before 7.1.2-31 ) is vulnerable to a heap buffer overflow within the GetVirtualPixels API . An attacker can trigger an out-of-bounds heap write by providing crafted input, which can lead to a server crash and a denial of service (DoS) . No specific exploit detai...

CVE-2026-13257

The IBM DataPower Gateway is vulnerable to insufficient verification of data authenticity (CWE-345 ) in versions 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2. This flaw could allow an authenticated user to forge signature requests . ...

CVE-2026-13258

IBM DataPower Gateway is vulnerable to a cross-site scripting (XSS) flaw (CWE-79) in its Web UI. This vulnerability allows an authenticated user to embed arbitrary JavaScript code, which can alter functionality and potentially lead to credentials disclosure within a trusted session. Affected vers...