CVE-2026-102832 JupyterLab: Command link trust prompt in JupyterLab can trust a document other than the one clicked

JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. From 4.5.7 until 4.5.11 and 4.6.4, the markdownviewer:trust and notebook:trust command-link handlers use tracker.currentWidget to resolve the current Markdown viewer or...

CVE-2026-55675 Salty documentation workflow executes fork-controlled Python build hooks with deployment secrets

The Salty documentation repository builds and deploys the docs.saltbox.dev website. Prior to commit 649c9aea2daef1168eeb0415b44e65dbbde9f220, .github/workflows/trigger-pr-build.yml records an untrusted fork commit in the prinfo artifact, and the secret-bearing workflowrun job in...

CVE-2026-109525 girishsaraf Online-Appointment-Booking-System submit2 changebookingstatus.php authorization

A vulnerability was identified in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5. This affects an unknown part of the file changebookingstatus.php of the component submit2 Handler. Such manipulation of the argument username/timestamp/status leads to...

CVE-2026-55376 heym Python Tool Sandbox Escape

Heym builds and runs agentic systems and business-process automations on self-hosted infrastructure. Prior to 0.0.40, an authenticated user who can create or edit a workflow with an Agent custom Python tool can bypass the blacklist-based sandbox in backend/app/services/pythontoolexecutor.py becau...

CVE-2026-105460 Bluez: bluez: stack-based out-of-bounds read in btmon via unvalidated num_keys in return_link_keys_evt()

A flaw was found in BlueZ. An out-of-bounds read vulnerability exists in the btmon Bluetooth monitor tool when processing crafted HCI Return Link Keys events. A maliciously crafted btsnoop capture file can specify a large number of link keys that exceeds the actual packet data, causing btmon to...

CVE-2026-81507 ESF-IDF: Bluetooth Classic L2CAP Heap Memory Disclosure Allowing Unauthorized Access to Sensitive Data

ESF-IDF is the Espressif Internet of Things IOT Development Framework. Prior to 5.2.8, 5.3.6, 5.5.5, 6.0.3, and 6.1-rc1, ESP-IDF BlueDroid L2CAP configuration-option processing in l2cmain.c and l2cutils.c does not consistently validate option lengths against the remaining received packet bytes. A...

CVE-2026-109524 girishsaraf Online-Appointment-Booking-System Admin Display Pages showdoctor.php authorization

A vulnerability was determined in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5. Affected by this issue is some unknown functionality of the file Admin/showdoctor.php of the component Admin Display Pages. This manipulation causes missing authorizatio...

CVE-2026-106108 Quasar Framework: App Vite SSG page output paths can escape the configured distribution directory

Quasar Framework is a framework for building high-performance Vue.js user interfaces. From 3.1.0 until 3.3.0, @quasar/app-vite SSG page definitions returned by getSsgPages could supply dir and filename values that were joined to build.distDir without verifying the final destination. Parent...

CVE-2026-103028 SFTPGo source-side file-pattern filter bypass during copy operations

SFTPGo is an open source, event-driven file transfer solution. From 2.5.0 until 2.7.6, an authenticated user with copy permission can copy a source file denied by deniedpatterns or outside allowedpatterns to an allowed destination name because file-pattern filters are evaluated only on the...

CVE-2026-77375 SFTPGo: Denial of service via malformed SSH channel request

SFTPGo is an open source, event-driven file transfer solution. Prior to 2.7.5, an authenticated SSH user can send a malformed protocol message while opening a channel, causing an unhandled error that terminates the server process and affects all connected users until restart. No confidentiality o...

CVE-2026-102250

CWE-345: Insufficient Verification of Data Authenticity vulnerability exists that could allow modified firmware to be uploaded when an authorized admin user begins a firmware update procedure which could result in control over the device...

CVE-2026-107918 Insufficient input validation vulnerability in NETGEAR R7300

Insufficient input validation vulnerability in the LAN Setup feature of NETGEAR R7300 router allows authenticated administrators connected to the local network to perform unauthorized actions on the router.This issue was identified through testing in a controlled research environment using a...

CVE-2026-107917 Insufficient input validation vulnerability in NETGEAR R7300 router

Insufficient input validation vulnerability in the PPPoE Setup feature of NETGEAR R7300 router allows authenticated administrators connected to the local network to perform unauthorized actions on the router. This issue was identified through testing in a controlled research environment using a...

CVE-2026-109523 girishsaraf Online-Appointment-Booking-System AJAX Endpoint getclinic.php sql injection

A vulnerability was found in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5. Affected by this vulnerability is an unknown functionality of the file Admin/getclinic.php of the component AJAX Endpoint. The manipulation of the argument city/cid results i...

CVE-2026-104192 DragonflyDB stream RDB deserialization double-free

Dragonfly is an in-memory data store built for modern application workloads. Prior to 1.40, OpaqueObjLoader::CreateStream in src/server/rdbload.cc can associate one streamNACK with a consumer group's global PEL and a consumer-local PEL, then free the shared object when a duplicate consumer entry ...

CVE-2026-11732 Insufficient input validation vulnerability exists in website blocking feature of certain NETGEAR RAX/CAX series models

An insufficient input validation vulnerability in the website blocking feature Block Sites of the listed NETGEAR router models allows a network-adjacent attacker having network access such as WiFi credentials to run unauthorized commands on the router. This vulnerability could affect the...

CVE-2026-11731 Authentication Bypass Vulnerability in Certain NETGEAR RAX Series Models

An authentication bypass vulnerability in the listed NETGEAR RAX series models allows an unauthenticated attacker with adjacent access to the affected device’s management service to access certain device information or modify administrative settings. This vulnerability may impact the...

CVE-2026-11730 Insufficient session randomness vulnerability exists in certain NETGEAR EX Series Models

Insufficient session randomness vulnerability in the listed NETGEAR Extender models allows a network-adjacent attacker having network access such as WiFi credentials to predict valid session identifiers and hijack an authenticated administrator session on the web management portal...

CVE-2026-9218 Insufficient input validation vulnerability in Certain NETGEAR routers allows unauthorized access

Insufficient input validation vulnerability in time server NTP setting of the listed NETGEAR models allows an attacker who is connected to the router’s local network and has the router’s administrator credentials to run unauthorized commands on the router. This vulnerability could impact the...

CVE-2026-53711 MCP ContextForge: Global Prompts stored cross-site scripting compromises the Admin UI

MCP Context Forge provides an MCP Admin UI for managing gateway resources. From 0.2.0 until 0.3.1, the Global Prompts feature stores a prompt template without sufficient output encoding before the MCP Admin UI renders it. An authenticated attacker can save markup containing script-capable event...

CVE-2026-53709 MCP Context Forge: Hardcoded default JWT_SECRET_KEY shipped in source and .env.example enables pre-authentication platform admin token forgery

MCP Context Forge is an MCP gateway and administrative platform. Prior to 1.0.2, mcpgateway/config.py and .env.example ship a known JWTSECRETKEY, while verifyjwttoken accepts HS256 tokens signed with that key and getcurrentuser creates a platform administrator when the token subject matches...

CVE-2026-109522 girishsaraf Online-Appointment-Booking-System Admin CRUD Endpoint deleteclinic.php sql injection

A vulnerability has been found in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5. Affected is an unknown function of the file Admin/deleteclinic.php of the component Admin CRUD Endpoint. The manipulation of the argument cid/did leads to sql injection...

CVE-2026-108185

Improper certificate validation in the My Notes feature of certain Zoom Clients may allow an unauthenticated user to conduct an information disclosure via network access...

CVE-2026-102342 ammonia allows stored XSS through unsanitized SVG animate and set attributes

ammonia is a Rust library for repairing and securing untrusted HTML. Prior to 3.3.3, 4.0.3, and 4.1.4, applications that allow the SVG animate or set elements can retain an animation whose attributeName targets href and whose value uses the javascript scheme. The sanitized SVG can therefore creat...

CVE-2026-108184

Improper certificate validation in certain Zoom Clients for Windows may allow an unauthenticated user to conduct an information disclosure via network access...

CVE-2026-77100 MediaAgent Denial of Service

MediaAgent contained a heap-based buffer overflow issue affecting service availability. Software customers upgrade to resolved maintenance release. Update Commvault installation of MediaAgents and HyperScale...

CVE-2026-97334 Network messaging layer decompression resource exhaustion

The network messaging layer contained improper handling of highly compressed data affecting service availability. Software customers upgrade to resolved maintenance release. Update all Commvault installations, including CommServe server, Web Server, Command Center, MediaAgents, clients, and...

CVE-2026-97333 QAPI stack-based buffer overflow

QAPI contained a stack-based buffer overflow affecting service availability. Software customers upgrade to resolved maintenance release. Update CommServe, Web Server, Command Center and Index Server...

CVE-2026-77094 CvFWD Out-of-Bounds Write

CvFWD contained an out-of-bounds write affecting service availability. Software customers upgrade to resolved maintenance release. Software customers upgrade to resolved maintenance release. Update all Commvault installations, including CommServe, Webserver, Command Center, MediaAgents, Clients a...

CVE-2026-77096 CVFS Missing Authentication

CVFS contained a missing authentication condition affecting command execution. Software customers upgrade to resolved maintenance release. Update CVFS...

CVE-2026-77095 CvFWD Null Pointer Dereference

CvFWD contained a null pointer dereference affecting service availability. Software customers upgrade to resolved maintenance release. Update all Commvault installations, including CommServe, Webserver, Command Center, MediaAgents, Clients and HyperScale...

CVE-2026-77099 CVFS Command Execution

CVFS contained an input validation issue affecting command execution. Software customers upgrade to resolved maintenance release. Update CVFS...

CVE-2026-18228 Hyperscale Path Traversal

HyperScale contained a path traversal issue affecting information disclosure. Software customers upgrade to resolved maintenance release. Update Commvault installation of HyperScale MediaAgents...

CVE-2026-77093 CvFWD Denial of Service

CvFWD contained an integer overflow affecting service availability. Software customers upgrade to resolved maintenance release. Update all Commvault installations, including CommServe, Webserver, Command Center, MediaAgents, Clients and HyperScale...

CVE-2026-77090 CVFS Information Disclosure

CVFS contained an XML external entity XXE reference handling issue affecting information dislcosure. Software customers upgrade to resolved maintenance release. Update CVFS...

CVE-2026-53420

Buffer overflow in a Zoom Phone feature of Zoom Workplace Clients may allow an unauthenticated user to conduct a escalation of privilege via network access...

CVE-2026-102603 Gotify: Insufficiently Protected Password Change endpoint

Gotify server is a simple server for sending and receiving messages in real-time per WebSocket. Prior to 3.0.0, the password change endpoint POST /current/user/password accepts a valid client token without requiring the account's current password or another elevated authentication step. An attack...

CVE-2026-65200 Huawei malicious on-bus PLDM or NCSI device can drive out-of-bounds-heap reads via short MCTP responses

The openUBMC device-management process parses PLDM-over-MCTP and NCSI-over-MCTP responses from on-bus devices, and three response parsers in the shared transport libraries subtract a fixed header or reserved-field size from a device-supplied response length without a lower-bound check. An...

CVE-2026-65199 Huawei openUBMC low-privilege SNMP to administrator privilege escalation

openUBMC assigns the full privilege set to pseudo-identities representing SNMP callers. An authenticated, but low-privilege, SNMP user can therefore invoke mapped backend operations as an administrative identity. In routemapper/account.lua, getuserprivilege returns the complete nine-privilege set...

CVE-2026-65198 Huawei Default SNMPv3 USM key

Huawei's openUBMC ships a default SNMPv3 USM key that uses one value for both authentication and privacy. An attacker who holds the key recoverable from the open-source build can authenticate SNMPv3 to, and decrypt SNMPv3 traffic from, any unit that still carries the shipped key. The build...

CVE-2026-65197 H3C G3/G5 HDM Firmware Verification Key Replacement

H3C HDM Family-A verifies the RSA signature of a firmware image against a public key it reads from the mutable file /conf/public.pem. That file is writable by an authenticated Redfish client through the UpdateService.UploadSignKey action, which stores the uploaded body verbatim after validating...

CVE-2026-107460 Apache Fesod (Incubating): UrlImageConverter SSRF protection bypass via DNS rebinding

Server-Side Request Forgery SSRF protection in the UrlImageConverter component of Apache Fesod Incubating fesod-sheet 2.0.2-incubating can be bypassed through DNS rebinding. When an application accepts an attacker-controlled image URL for spreadsheet writing, the converter checks the hostname's...

CVE-2026-53418

Improper Authorization in Handler for Custom URL Scheme in Zoom Workplace for Android before version 7.2.1 may allow an unauthenticated user to conduct an escalation of privilege via network access...

CVE-2026-109521 girishsaraf Online-Appointment-Booking-System changebookingstatus.php sql injection

A vulnerability was detected in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5. This affects an unknown function of the file changebookingstatus.php. Performing a manipulation of the argument dateselected results in sql injection. The attack may be...

CVE-2026-12656 1732E ArmorBlock® - Multiple Vulnerabilities

A denial-of-service security issue exists in the affected product and version. The security issue stems from improper handling of network storm traffic, which can interrupt communication, cause device faults, and affect open TCP and UDP ports. A power cycle is required to recover the device to it...

CVE-2026-4869 Potential Privilege Escalation in InstallShield

A potential privilege escalation issue was identified in InstallShield version 2025 R2 and earlier when running compressed Basic MSI setup with Prerequisites from an insecure location. If a local administrator launches a compressed Setup.exe with Prerequisites from an unsecured location, the...

CVE-2026-12655 1732E ArmorBlock® - Multiple Vulnerabilities

A security issue exists within 1732E ArmorBlock® I/O, where an unauthenticated attacker can change the device's webserver password without valid credentials. This could result in admin account takeover or unauthorized modification of device configuration...

CVE-2026-0893 Uncleared Password Keystrokes Vulnerability

AMI APTIOV contains a vulnerability in BIOS where an attacker may cause “Exposure of Sensitive Information to an Unauthorized Actor” by local access. Successful exploitation of this vulnerability can lead to information disclosure, privilege escalation, and further impact on Confidentiality,...

CVE-2025-58774 UEFI OOB Write and Buffer Overflow Vulnerabilities

AMI APTIOV contains vulnerabilities in BIOS where users may cause “Buffer Access with Incorrect Length Value” by local access. Successful exploitation of this vulnerability could lead to buffer overflows, memory corruption, and arbitrary code execution, and also impact Confidentiality, Integrity,...

CVE-2025-58773 UEFI OOB Write and Buffer Overflow Vulnerabilities

AMI APTIOV contains vulnerabilities in BIOS where users may cause "Out-of-bounds Write” by local access. Successful exploitation of this vulnerability could lead to buffer overflows, memory corruption, and arbitrary code execution, and also impact Confidentiality, Integrity, and Availability...