CVE-2026-105790 Microsoft UFO: Authenticated Galaxy device registration can bypass WebSocket SSRF IP pinning via redirects

Microsoft UFO is an open-source framework for intelligent automation across devices and platforms. Prior to 3.0.9, authenticated device registration through /api/devices can supply a permitted attacker-controlled WebSocket endpoint while aip/transport/websocket.py applies pinnedaddresses only to...

CVE-2026-105789 Microsoft UFO: Arbitrary file write in the Linux MCP `execute_command` tool

Microsoft UFO is an open-source framework for intelligent automation across devices and platforms. Prior to 3.0.9, the executecommand tool in ufo/client/mcp/httpservers/linuxmcpserver.py treats sort and uniq as read-only commands while the free-form command parameter can select their file-output...

CVE-2026-105788 Microsoft UFO: Authenticated Android shell command injection in Mobile MCP type_text and launch_app

Microsoft UFO is an open-source framework for intelligent automation across devices and platforms. Prior to 3.0.10, the typetext and launchapp tools in ufo/client/mcp/httpservers/mobilemcpserver.py pass the authenticated caller-controlled text and packagename parameters into adb shell command...

CVE-2026-106041 Mooncake Store through 0.3.13.post1 Missing Authorization via NotifyOffloadSuccess RPC

Mooncake Store master through 0.3.13.post1 contains a missing authorization vulnerability that allows unauthenticated attackers to inject completed LOCALDISK replicas through the NotifyOffloadSuccess RPC. Attackers can mount a local disk segment with a self-chosen client UUID, then attach replica...

CVE-2026-106040 Mooncake Store through 0.3.13.post1 Missing Authorization via EvictDiskReplica RPC

Mooncake Store master through 0.3.13.post1 contains a missing authorization vulnerability that allows unauthenticated attackers to erase any object's disk replica via EvictDiskReplica and BatchEvictDiskReplica. Attackers reaching the cororpc master port can evict DISK replicas across all tenants,...

CVE-2026-106039 Mooncake Store through 0.3.13.post1 Missing Authorization in Replication Task RPC

Mooncake Store master through 0.3.13.post1 contains a missing authorization vulnerability that allows unauthenticated attackers to create, steal, and falsely complete replication tasks via the cororpc port. Attackers can invoke CreateCopyTask, CreateMoveTask, FetchTasks, and MarkTaskToComplete wi...

CVE-2026-106038 Mooncake Store through 0.3.13.post1 Unauthenticated Object Deletion via Remove RPCs

Mooncake Store master through 0.3.13.post1 contains a missing authentication vulnerability that allows unauthenticated attackers to force-delete any object via Remove, RemoveByRegex, RemoveAll and BatchRemove on the cororpc port. Attackers can send forged requests with the force flag set to bypas...

CVE-2026-106037 Mooncake through 0.3.13.post1 Missing Authentication in Store REST Service

Mooncake through 0.3.13.post1 contains a missing authentication vulnerability in the Store REST service, which binds to 0.0.0.0 without authentication on any route. Unauthenticated attackers can call routes such as /api/get, /api/put, /api/removeall and /api/mount to read cached KV data with user...

CVE-2026-85523 OS Command Injection in Felisify Informatics' SambaBox

Improper neutralization of special elements used in an OS command 'OS command injection' vulnerability in Felisify Information Technologies Industry and Trade Inc. SambaBox allows OS Command Injection. This issue affects SambaBox: before 5.4.1...

CVE-2026-34498 L4L

Improper input validation vulnerability in Johnson Controls Illustra Standard - L4L China on Windows allows OS Command Injection. This issue affects Illustra Standard - L4L China: before 6.0.0.66394...

CVE-2026-91140 OS command injection in Progress Software Autonomous REST Connector GenAI Agents

An OS command injection vulnerability in the shell-based temporary-file cleanup instructions in Progress Software Autonomous REST Connector GenAI Agents ARCGenAI-Generator version 2.0 allows an attacker who supplies a crafted Swagger/OpenAPI document to execute arbitrary commands on a developer's...

CVE-2026-87975 Privilege abuse in model formsets with editable primary keys

An issue was discovered in Django 6.1 before 6.1.2, 6.0 before 6.0.9, and 5.2 before 5.2.18. django.forms.models.BaseModelFormSet.saveexistingobjects used the presence of a primary key on a submitted form's instance as evidence that the instance belonged to the formset's limiting queryset. An...

CVE-2026-106026 tftp-hpa 5.4 before 6.0 Out-of-Bounds Read via tftpd Remap Jump Rule

tftp-hpa 5.4 before 6.0 contains an out-of-bounds read vulnerability in rewritestring in tftpd/remap.c that walks heap memory during jump label searches. Unauthenticated remote attackers can send read or write requests whose filename matches a remap jump rule to crash the forked in.tftpd request...

CVE-2026-105842 lrzsz before 0.13.0 Heap Buffer Overflow via lrz procheader() Pathname

lrzsz before 0.13.0 contains a heap-based buffer overflow vulnerability in procheader of the lrz receive utility when copying overlong sender-supplied filenames into Pathname. Malicious ZMODEM senders can supply filenames up to 8192 bytes, overflowing the buffer via sprintf in pipe mode or strcpy...

CVE-2026-105840 lrzsz before 0.13.0 Path Traversal via lrz Restricted Mode checkpath()

lrzsz before 0.13.0 contains a path traversal vulnerability in the lrz receive utility's restricted mode that allows malicious ZMODEM senders to write files outside the current directory using absolute pathnames. Because checkpath in src/lrz.c only rejects '../' sequences unless built with...

CVE-2026-105841 lrzsz before 0.13.0 OS Command Injection via lrz Pipe Mode

lrzsz before 0.13.0 contains an OS command injection vulnerability in the lrz receive utility's pipe mode that allows remote senders to execute commands by supplying crafted filenames. When lrz runs under a suffixed name such as lrztar, procheader in src/lrz.c passes the unescaped ZMODEM/YMODEM...

CVE-2026-105839 libmikmod before 3.3.14 Heap Buffer Overflow via OKT Loader OKT_doPBOD

libmikmod before 3.3.14 contains an integer overflow in the Oktalyzer loader OKTdoPBOD that allows attackers to cause heap buffer overflow via crafted track counts. Attackers can supply an OKT module whose SLEN chunk wraps the 16-bit numtrk value, causing PBOD writes past allocated track pointers...

CVE-2026-105838 libmikmod before 3.3.14 Heap Out-of-Bounds Read via IT Module Loader

libmikmod before 3.3.14 contains a heap out-of-bounds read vulnerability in the Impulse Tracker loader loadit.c that allows attackers to read adjacent heap memory via oversized patterns. Attackers can supply a crafted IT module with more than 200 pattern rows, causing ITConvertTrack to read past...

CVE-2026-105837 libmikmod before 3.3.14 Heap Buffer Overflow via DSM Loader Integer Overflow

libmikmod before 3.3.14 contains an integer overflow vulnerability in DSMLoad in loaddsm.c that allows attackers to trigger heap buffer overflow via crafted track counts. Attackers can supply a DSM module whose numchn and numpat product wraps a 16-bit value, overwriting heap memory to cause crash...

CVE-2026-87890 Potential request forgery via spatial lookup byte values

An issue was discovered in Django 6.1 before 6.1.2, 6.0 before 6.0.9, and 5.2 before 5.2.18. An incomplete fix for CVE-2026-15307 in Django spatial lookups allows an attacker who can supply bytes values to cause the Django process to make network requests via a crafted VRT document referencing an...

CVE-2026-84429 Potential denial-of-service vulnerability in HTTP header parsing

An issue was discovered in Django 6.1 before 6.1.2, 6.0 before 6.0.9, and 5.2 before 5.2.18. django.utils.http.parseheaderparameters was subject to a potential denial-of-service attack due to quadratic time complexity when parsing a value with many separators inside a quoted parameter. An...

CVE-2026-77050 Potential denial-of-service vulnerability in get_supported_language_variant()

An issue was discovered in Django 6.1 before 6.1.2, 6.0 before 6.0.9, and 5.2 before 5.2.18. django.utils.translation.getsupportedlanguagevariant is subject to a potential denial-of-service attack when processing many distinct, very long language codes, which are retained as keys in an in-memory...

CVE-2026-82924 PII Enumeration via Missing Rate Limiting in Pusula Communication's Expert Mail

Improper Control of Interaction Frequency vulnerability in Pusula Communication, IT, and Internet Industry and Trade Co. Ltd. Expert Mail allows Brute Force. This issue affects Expert Mail: through 2026-09-18...

CVE-2026-105920 Kusalkasilva Learning-Management-System Student Registration Endpoint student_signup.php sql injection

A vulnerability was determined in Kusalkasilva Learning-Management-System up to ffeb873f8803f1e9664384ff75000c7da45466d2. The impacted element is an unknown function of the file studentsignup.php of the component Student Registration Endpoint. This manipulation causes sql injection. The attack ma...

CVE-2025-15591 Cross-Site Scripting (XSS) vulnerability identified in OpenText™ Content Management

Cross-site Scripting XSS in the Forums feature of OpenText Content Management Content Server could allow a bad actor to inject malicious code into a Forums web page...

CVE-2026-12380 Reflected XSS in Akıllı Ticaret's E-Commerce Pack

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Akıllı Ticaret Software Technologies Ltd. Co. E-Commerce Pack allows Reflected XSS. This issue affects E-Commerce Pack: through 2026-10-06. NOTE: The vendor was contacted early about this disclosur...

CVE-2026-105919 Kusalkasilva Learning-Management-System Administrator Login Endpoint login.php mysql_query sql injection

A vulnerability was found in Kusalkasilva Learning-Management-System up to ffeb873f8803f1e9664384ff75000c7da45466d2. The affected element is the function mysqlquery of the file admin/login.php of the component Administrator Login Endpoint. The manipulation of the argument username/password result...

CVE-2026-105836 QloApps through 1.7.0 Authorization Bypass via ajaxProcessBulkUpdateRooms

QloApps through 1.7.0 contains an authorization bypass vulnerability in AdminProductsController::ajaxProcessBulkUpdateRooms that allows hotel-restricted back-office employees to modify rooms of other hotels. Attackers can submit foreign room IDs in the idrooms parameter to change status, floor,...

CVE-2026-105835 PLANKA 2.2.0 through 2.2.1 TOTP Brute Force via verify-totp Endpoint

PLANKA 2.2.0 through 2.2.1 fails to limit incorrect TOTP codes submitted to POST /api/access-tokens/verify-totp, allowing attackers to brute force two-factor authentication codes. Attackers who know a user's password can reuse the ten-minute pending token to guess six-digit codes until one...

CVE-2026-105834 Rundeck before 6.2.0 Arbitrary File Read via File Resource Model Source

Rundeck before 6.2.0 contains a path traversal vulnerability that allows users holding only the project configure ACL to read arbitrary server files by setting resources.source.N.config.file to any absolute path. Attackers can retrieve file contents through editProjectNodeSourceFile or the...

CVE-2026-106016 Mitigation bypass in the File Handling component

Mitigation bypass in the File Handling component. This vulnerability was fixed in Firefox 157.0.1...

CVE-2026-82531 Smarty before 4.5.8 and 5.x before 5.8.5 PHP Code Injection via extends: Inheritance Cache

Smarty before 4.5.8 and 5.x before 5.8.5 contains a code injection vulnerability where the top-level nocachehash is never restored during extends:/multi-component template inheritance, leaving it null. Attackers can supply assigned data containing a forged SmartyNocache marker that is copied...

CVE-2026-56596 HCL BigFix Service Management is affected by multiple security vulnerabilities.

HCL BigFix Service Management is affected by an Improper Input Validation vulnerability, which could allow an attacker to supply unexpected or malformed data, enabling processing errors, business logic bypasses, and unintended application behavior...

CVE-2026-105918 Kusalkasilva Learning-Management-System Login Endpoint login.php mysql_error sql injection

A vulnerability has been found in Kusalkasilva Learning-Management-System up to ffeb873f8803f1e9664384ff75000c7da45466d2. Impacted is the function mysqlerror of the file login.php of the component Login Endpoint. The manipulation of the argument username/password leads to sql injection. The attac...

CVE-2026-75820 Integer Truncation Leading to Heap Corruption in GNU Aspell

GNU Aspell contains an integer truncation vulnerability in the WritableDict::add function in modules/speller/default/writable.cpp. When loading a personal wordlist, the word length is stored as a single byte, causing truncation for words whose length is a multiple of 256. This leads to heap...

CVE-2026-75819 Out-of-bounds Read in GNU Aspell

GNU Aspell contains an out-of-bounds read vulnerability in ReadOnlyDict::load in readonlyws.cpp. When loading a binary .rws dictionary file, it uses offset fields from the file header as byte indices into a heap buffer without validating their bounds. An attacker can trigger this by convincing a...

CVE-2026-75818 Heap Buffer Overflow in GNU Aspell's prezip utility

GNU Aspell prezip-bin contains a heap-based buffer overflow vulnerability in the decompressor in prog/prezip.c. The decompressor does not properly check buffer space, so a crafted compressed file can cause out-of-bounds read and write operations on the heap. An attacker who convinces a user to...

CVE-2026-103831 Insecure deserialization in the TrueLayer Magento 2 plugin

CVE-2026-103831: Insecure deserialization vulnerability in the Psr16CacheAdapter component of the TrueLayer Magento 2 Plugin, due to the use of PHP's native unserialize function without restrictions on the classes allowed when retrieving data stored in the cache. An attacker who already has the...

CVE-2026-105985 Authenticated RCE via render-components Entry Type overrides

Craft CMS 5.10.13.2 contains an authenticated remote code execution vulnerability in the Control Panel action app/render-components. Any authenticated user with basic Control Panel access can submit request-controlled component classes and property overrides. By first overriding...

CVE-2026-84854 Out of Bound Write on WibuKey for Windows

In the WibuKey driver for Windows below Version 6.72, insufficient validation of user input when calculating the size of a kernel buffer could cause small amounts of data to be written outside the intended kernel buffer. This can lead to a system crash. Under unfavorable circumstances, adjacent...

CVE-2026-80327 Open Redirect in PingGateway Fragment Filter

An open redirect vulnerability exists in the PingGateway Fragment Filter feature. This issue affects PingGateway versions 7.1.0 and later, 2023.2.0 through 2024.11.1, and 2025.3.0 through 2025.11.1. It is fixed in versions 2024.11.2, 2025.11.2, and 2026.3.0 and later...

CVE-2026-98372 xfrm: iptfs: fix stack OOB read in iptfs_skb_reset_frag_walk()

In the Linux kernel, the following vulnerability has been resolved: xfrm: iptfs: fix stack OOB read in iptfsskbresetfragwalk iptfsskbresetfragwalk advances to the fragment containing @offset with an unbounded loop: while offset = walk-past + walk-fragswalk-fragi.len walk-past +=...

CVE-2026-98371 xfrm: iptfs: fix runt reassembly panic from short inner tot_len

In the Linux kernel, the following vulnerability has been resolved: xfrm: iptfs: fix runt reassembly panic from short inner totlen When the start of an inner packet is split across two outer packets such that fewer than 4 bytes land at the end of the first one, inputprocesspayload saves those byt...

CVE-2026-98369 xfrm: add missing rcu_read_lock(), skb_dst_force() and dev_hold() for xfrm_trans_reinject()

In the Linux kernel, the following vulnerability has been resolved: xfrm: add missing rcureadlock, skbdstforce and devhold for xfrmtransreinject syzbot reported a suspicious RCU usage warning in ip6pktdrop: WARNING: suspicious RCU usage in ip6pktdrop include/net/addrconf.h:389 suspicious...

CVE-2026-98370 xfrm: fix compat ALLOCSPI request use-after-free

In the Linux kernel, the following vulnerability has been resolved: xfrm: fix compat ALLOCSPI request use-after-free xfrmstatenetlink builds the ALLOCSPI response with dumponestate, which already calls alloccompat with the response skb and header. xfrmallocuserspi then calls alloccompat again, bu...

CVE-2026-98368 esp: downgrade zerocopy managed frags before mutating skb frags

In the Linux kernel, the following vulnerability has been resolved: esp: downgrade zerocopy managed frags before mutating skb frags On the out-of-place output path esp-inplace == false ESP rewrites the skb frag array: espoutputhead appends a trailer frag and espoutputtail replaces the frags with ...

CVE-2026-98367 RDMA/siw: Clear association under lock if siw_qp_modify fails in siw_accept

In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: Clear association under lock if siwqpmodify fails in siwaccept We need to clear cep before release statelock as siwqpllpclose and siwqpmodify-siwqpllpclose did. Otherwise if siwqpmodify fails in siwaccept, the QP's...

CVE-2026-98366 RDMA/rxe: validate access flags before swapping the MR's PD

In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: validate access flags before swapping the MR's PD rxereregusermr reassigns mr-ibmr.pd first and only then validates the IBMRREREGACCESS argument: if flags & IBMRREREGPD rxeputoldpd; rxegetpd; mr-ibmr.pd = ibpd; if flags...

CVE-2026-98364 xfrm: hold net_device reference under RCU in bundle creation

In the Linux kernel, the following vulnerability has been resolved: xfrm: hold netdevice reference under RCU in bundle creation xfrmbundlecreate and xfrmcreatedummybundle read dst-dev into a local pointer without taking a device reference, then pass it to xfrmfilldst. A concurrent RTMDELLINK...

CVE-2026-98365 RDMA/rxe: Fix integer overflow in mr_check_range() leading to OOB access

In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix integer overflow in mrcheckrange leading to OOB access mrcheckrange validates that iova, iova+length falls within the registered MR range using wraparound-prone arithmetic: if iova ibmr.iova || iova + length...