CVE-2026-80758

CVE-2026-80758 is a use-after-free vulnerability in the Linux kernel's futex subsystem. The flaw is in futex_private_hash_put(), which drops its reference to the private hash (fph) before evaluating fph->mm for wake_up_var(). Because futex_ref_put() re-enables preemption before returning, a ta...

CVE-2026-78543

IBM App Connect Enterprise (13.0.1.0–13.0.8.1, 12.0.1.0–12.0.12.28) and IBM Integration Bus for z/OS (10.1.0.0–10.1.0.7) are vulnerable to a denial of service caused by an infinite loop (CWE-835 ). A remote, unauthenticated attacker can trigger the condition with no user interaction. IBM assigns ...

CVE-2026-78658

IBM UrbanCode Deploy (UCD) and IBM DevOps Deploy contain an information disclosure vulnerability (CWE-212) in the redaction engine. When a deployment's secure property begins with certain non-ASCII characters , subsequent ASCII secure values embedded inside unsecure properties may fail to be mask...

CVE-2026-81832

IBM App Connect Enterprise (versions 13.0.1.0–13.0.8.1 and 12.0.1.0–12.0.12.28) and IBM Integration Bus for z/OS (10.1.0.0–10.1.0.7) are affected through the SAP Adapter , which is vulnerable to an XML External Entity (XXE) attack. The CVSS 3.1 score is 7.7 (HIGH) with a scope-changing, network-a...

CVE-2026-6958

Acunetix 25.11.251107123 for Windows contains a local privilege escalation vulnerability in the Web Vulnerability Scanning Engine (wvsc.exe) . The root cause is a missing hardcoded directory path for OpenSSL-related files; a low-privileged local attacker can create that directory, place a malicio...

CVE-2026-81859

IBM Enterprise Records (part of Cloud Pak for Business Automation ) is vulnerable to information disclosure due to the use of a broken or risky cryptographic algorithm . A local attacker with no privileges required can obtain sensitive information, resulting in high confidentiality impact (CVSS 3...

CVE-2026-85700

Onyx 4.6.6 fails to properly restrict access to custom tool credentials stored in custom_headers , allowing any authenticated user with basic permissions to call GET /tool/{tool_id} or GET /tool endpoints and retrieve plaintext authorization headers and third-party API keys defined by administrat...

CVE-2026-85698

Turso through 0.8.0-pre.8 contains an out-of-bounds read vulnerability in the table-leaf page reader . The root cause is an attacker-controlled cell-count field that is read without bounds validation. A crafted malicious database file with a modified cell count value can trigger an index-out-of-b...

CVE-2026-85699

jina-ai reader is affected by a server-side request forgery (SSRF) vulnerability. URL validation is applied only to the initial request but is not re-applied to subsequent redirect hops . An attacker can craft a public URL that redirects to internal network addresses or cloud metadata endpoints, ...

CVE-2026-85697

Documenso 2.17.0 contains an access control flaw in its PDF-serving endpoint . The route fails to validate document visibility settings, specifically missing ownership validation on document data identifiers , allowing attackers with low privileges to read restricted documents within their team o...

CVE-2026-85696

SadTalker (OpenTalker), a talking-head video generation tool, contains an OS command injection vulnerability in its video muxing process . In version v0.0.2 , uploaded audio filenames are interpolated into ffmpeg commands without proper escaping (see src/utils/videoio.py). An attacker can upload ...

CVE-2026-85695

FastChat (lm-sys/FastChat) has an authentication bypass in the /register_worker endpoint that allows unauthenticated attackers to register arbitrary worker addresses. This enables server-side request forgery (SSRF) and model spoofing : attackers can register malicious workers under victim model n...

CVE-2026-85694

LaVague 0.2.35 is vulnerable to remote code execution via its PythonFromMarkdownExtractor.extract_as_object function, which uses eval on untrusted language model output derived from web page content. An attacker can perform indirect prompt injection through a web page to inject malicious Python c...

CVE-2026-85692

Nightingale (n9e) contains an SSRF guard bypass in the isPublicIP function within aiagent/tools/http.go, the SSRF protection for the http_fetch AI-agent tool. The function only unwraps standard IPv4-mapped (::ffff:a.b.c.d) IPv6 addresses before checking them against a forbidden-range list, failin...

CVE-2026-85693

Chatbot UI (open-source chat application) contains an authorization bypass in its retrieval endpoint (/api/retrieval/retrieve). The root cause is a service-role Supabase client that bypasses row-level security and fails to validate file ownership, allowing any authenticated user to retrieve index...

CVE-2026-85691

MegaParse 0.0.55 contains an unauthenticated server-side request forgery (SSRF) in the POST /v1/url endpoint, which fetches caller-supplied URLs server-side without requiring authentication. Attackers can supply internal service URLs or cloud metadata endpoints and read their responses directly f...

CVE-2026-85690

Plandex 2.2.1 is vulnerable to a path traversal in the ApplyFiles function, which allows files to be written outside the project directory. Attackers can influence model output through poisoned repository files or attacker-controlled context to write to sensitive locations such as shell rc or cro...

CVE-2026-85689

llmware 0.4.6 contains an SQL injection vulnerability in its collection-database layer (llmware/resources.py). Filter and lookup values are directly string-interpolated into SQL WHERE clauses without parameterization or escaping, affecting both the SQLite and PostgreSQL backends. The filter valid...

CVE-2026-85688

TEN Framework 0.11.71 is vulnerable to unauthenticated arbitrary file read and write via the TMAN Designer file-content API endpoints (/api/designer/v1/file-content). Attackers can send POST and PUT requests to read arbitrary files or write malicious content to system paths, enabling code executi...

CVE-2026-85687

CVE-2026-85687 affects the surya 0.22.1 screenshot server, where the /info, /page, and /process routes accept raw file_path parameters without validation. The unsanitized paths are passed directly to Image.open or pypdfium2.PdfDocument , allowing an unauthenticated attacker to read any image or P...

CVE-2026-85685

AgentScope through 2.0.7.post1 is affected by a path traversal vulnerability in LocalWorkspace.add_skill . The skill_path request parameter is not confined, allowing an unauthenticated attacker over the network to supply an arbitrary directory path and copy files from any server location into the...

CVE-2026-85686

ms-swift 4.5.2 (ModelScope) contains an unauthenticated SSRF in the swift deploy OpenAI-compatible API. The vulnerable component is vision_utils.py, which fetches multimodal media URLs (image_url , audio_url , video_url ) without URL validation or redirect filtering. An attacker can supply arbitr...

CVE-2026-85684

marker through version 2.0.0 contains a path traversal vulnerability in its FastAPI /marker/upload handler. The root cause is a failure to sanitize the file.filename parameter, allowing unauthenticated attackers to supply filenames containing directory traversal sequences. This permits writing ar...

CVE-2026-85676

Dub , a link-shortening service, contains an open redirect vulnerability in its redir_url query parameter. The parameter is accepted on every short link without validation or domain-allowlist enforcement, allowing attackers to append an arbitrary external URL and redirect visitors through the tru...

CVE-2026-85675

OWL 's DocumentProcessingToolkit contains a server-side request forgery (SSRF) vulnerability in the extract_document_content tool. The tool fetches caller-supplied URLs without scheme, host, or IP filtering , allowing attackers to inject malicious URLs via prompt injection and cause the server to...

CVE-2026-85674

aider (aider-chat) is a CLI-based AI coding assistant that automatically loads a .aider.conf.yml configuration file from the root of the git repository it is launched in. A crafted repository can set test-cmd (executed at startup) or lint-cmd (executed on the first file edit), both of which are e...

CVE-2026-85673

LLaMA-Factory contains a server-side request forgery (SSRF) vulnerability in its OpenAI-compatible API multimodal media URL handler . The root cause is that the check_ssrf_url guard validates a URL only once, while requests.get subsequently follows HTTP redirects and re-resolves DNS without re-va...

CVE-2026-85671

QAnything 2.0.0 contains an authentication bypass in the /api/local_doc_qa/get_file_base64 and /api/local_doc_qa/get_doc endpoints. Unauthenticated attackers can enumerate file identifiers and retrieve base64-encoded files or parsed document chunks without ownership verification, enabling cross-t...

CVE-2026-85672

zerox 1.1.20 (getomni-ai) is affected by an OS command injection in its file download mechanism. The temporary file extension derived from document URLs is interpolated unsanitized into shell commands executed by poppler utilities. An attacker can craft a document URL with a malicious file extens...

CVE-2026-85670

CVE-2026-85670 affects Hugging Face tokenizers (observed in version 0.23.1 ). The vulnerability is an out-of-bounds buffer access in BpeBuilder::build (tokenizers/src/models/bpe/model.rs). When loading a tokenizer.json via Tokenizer::from_file/from_str, the builder sizes a scratch buffer to the l...

CVE-2026-85669

potpie through 2.0.0 fails to verify user ownership on the POST /conversations/{conversation_id}/code-changes/sync endpoint. Authenticated attackers can write arbitrary file changes into other users' conversations by supplying conversation IDs, resulting in unauthorized modification of pending co...

CVE-2026-85667

xiaobei through 5.5.2 fails to implement authentication or signature validation on its webhook endpoints, specifically the /webhook_worktool handler. This allows unauthenticated network attackers to inject arbitrary messages into the agent pipeline and exploit unvalidated media URL fetching to pe...

CVE-2026-85668

Xinference (v3.x, affected commit 4a94832, specifically v3.3.0) contains an unauthenticated arbitrary-path file read vulnerability in the POST /v1/models/llm/auto-register endpoint. The endpoint accepts a caller-supplied model_path parameter without authentication or path confinement, reads and p...

CVE-2026-85666

OGX (formerly Llama Stack), affected at commit fbe8e0f and released as v1.3.1 , contains an unauthenticated server-side request forgery (SSRF) in the OpenAI-compatible POST /v1/responses endpoint. MCP tool definitions accept a server_url parameter along with headers and authorization values that ...

CVE-2026-85665

Bruno versions through 3.4.2 are affected by an arbitrary file read vulnerability caused by insufficient validation of file paths in request body declarations. An attacker who can influence a collection's body:file path can embed parent-directory traversal (../) sequences that resolve outside the...

CVE-2026-85663

Aim 3.29.1 remote tracking server contains an unauthenticated method dispatch vulnerability: incoming requests are not authenticated, and methods are resolved via getattr without an allowlist check. Unauthenticated attackers can register clients, instantiate Repo resources, and invoke arbitrary m...

CVE-2026-85664

Chroma 1.5.9 , a vector database, fails to enforce maximum bounds on the HNSW index parameters max_neighbors , ef_construction , and ef_search when processing collection-create requests. Because no upper limit is validated, unauthenticated attackers over the network can supply arbitrarily large v...

CVE-2026-85662

Marqo 2.26.0 contains a Server-Side Request Forgery (SSRF) vulnerability in the add_documents endpoint. The root cause is that the download_image_from_url and fetch_content_sample functions lack destination filtering and host validation , allowing unauthenticated network-based attackers to supply...

CVE-2026-85661

excel-mcp-server 0.1.8 (by haris-musa) contains a path confinement bypass in stdio mode : when the EXCEL_FILES_PATH environment variable is unset, unchecked file paths supplied to the read and write tools allow an attacker to read and write arbitrary files accessible to the process. The vulnerabi...

CVE-2026-85660

cli-mcp-server 0.2.5 contains a command allowlist bypass in the _validate_command_with_operators function. When ALLOW_SHELL_OPERATORS is enabled, an attacker can inject shell command substitution syntax such as $(...) or backticks to execute commands that are not on the ALLOWED_COMMANDS allowlist...

CVE-2026-85651

Trigger.dev versions before 4.5.2 fail to validate environment membership during run replay operations , allowing authenticated attackers to inject their own task runs into other organizations' or projects' environments. The result is resource consumption on the victim's environment and pollution...

CVE-2026-85650

Trigger.dev versions before 4.5.2 contain a server-side request forgery (SSRF) vulnerability in webhook alert channel delivery URLs that are fetched without validation or SSRF protection. Authenticated users with organization membership can create alert channels with URLs targeting internal servi...

CVE-2026-85626

git-mcp-server 2.15.1 is affected by an argument injection vulnerability in the ref and object parameters of the git_log, git_diff, and git_show tools. The root cause is a lack of leading-dash validation , allowing attackers to inject git command-line options such as --output= and write files out...

CVE-2026-85625

sift (sift.js) 17.1.3 is vulnerable to remote code execution due to its use of for...in to enumerate query keys, which walks the object prototype chain and dispatches any matched operator key including $where . The $where operator compiles a string value into a function via new Function unless CS...

CVE-2026-85624

Blinko 1.8.7 is vulnerable to a cross-user private note disclosure in the noteReferenceList procedure, which performs no ownership verification on supplied note identifiers. An authenticated attacker can enumerate sequential note IDs to retrieve the complete content of other users' private notes ...

CVE-2026-85622

AppFlowy-Cloud through 0.9.64 fails to validate workspace membership in the establish_ws_connection_v2 WebSocket handler. This allows any authenticated user to bind a session to a workspace they do not belong to, then send sync Manifest messages with victim object identifiers to read full documen...

CVE-2026-85623

goose v1.37.0 (by aaif-goose) contains an arbitrary command execution flaw in its recipe subsystem. The vulnerable components are stdio extensions and retry.checks within recipes, which are executed without passing through the recipe security scan—creating a bypass for attackers who distribute ma...

CVE-2026-85621

LobeChat (LobeHub) 2.2.1 has an improper webhook signature verification flaw in its QQ and Feishu adapters . The webhook route (/api/agent/webhooks/:platform) is unauthenticated by design and delegates verification to each adapter. The QQ adapter performs no Ed25519 signature verification on disp...

CVE-2026-85620

Postgres MCP Pro 0.3.0 contains a restricted-mode bypass in its SQL validation layer. The root cause is that function-name validation is not applied to RangeFunction nodes in FROM clauses , allowing attackers to invoke file-reading functions such as pg_read_file via FROM-clause syntax and read ar...

CVE-2026-85619

AppFlowy-Cloud 0.9.64 contains an authorization bypass in its collaboration object access control (libs/access-control/src/casbin/collab.rs). The service fails to verify that requested collab objects belong to the caller's workspace, allowing an authenticated attacker to supply a victim's object ...