CVE-2026-111108 Apache Kafka: Broker OutOfMemoryError via array allocation amplification in code-generated protocol readers

Apache Kafka's code-generated protocol readers pre-size an array's collection from the element count declared by the sender. That count is checked only against the bytes remaining in the request buffer, which assumes about one byte per element; because most elements need several bytes, a request...

CVE-2026-111073 Apache Kafka: PushTelemetry (KIP-714) metrics payloads are decompressed without a size limit, allowing a broker out-of-memory denial of service

The broker-side PushTelemetry API KIP-714 validates only the compressed size of a client's metrics payload against telemetry.max.bytes default 1 MB before decompressing it. ClientTelemetryUtils.decompress then decompresses the payload with no limit on the decompressed output size, growing a heap...

CVE-2026-106079 Session Smart Router and Session Smart Conductor: Improper validation of a field causes privilege escalation when updating the YANG configuration

An Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability in AccessManager in Juniper Networks Session Smart Router and Session Smart Conductor allows an attacker with config-write privileges to achieve arbitrary command execution as root in the YAN...

CVE-2026-110985 Apache Kafka: Broker silently skips JWT signature verification for SASL/OAUTHBEARER when the JWKS endpoint URL is not configured

A Kafka broker using SASL/OAUTHBEARER with the default validator sasl.oauthbearer.jwt.validator.class=DefaultJwtValidator selects its implementation from configuration. When sasl.oauthbearer.jwks.endpoint.url is set, the validator verifies the JWT signature. When that URL is unset the default and...

CVE-2026-103411 Session Smart Router: A malicious DHCP server causes information disclosure and a service crash during DHCP option parsing

An Integer Underflow vulnerability in DhcpMessageDecoder in Juniper Networks Session Smart Router allows an attacker with local network access to cause information disclosure and a denial of service via a malicious DHCP reply...

CVE-2026-110952 Apache Kafka: Broker does not enforce JWT issuer and audience validation for SASL/OAUTHBEARER by default

A Kafka broker that authenticates clients with SASL/OAUTHBEARER using the bundled JWKS-backed validator always verifies the JWT signature, but two further checks are only performed when explicitly configured: - The issuer iss claim is verified only when sasl.oauthbearer.expected.issuer is set. Wh...

CVE-2026-83525 Apache Kafka: Incorrect boolean operator in FetchSnapshot RPC handler allows authenticated network clients to crash the KRaft controller via a malformed request.

Incorrect operator CWE-480 in the FetchSnapshot RPC handler in Apache Kafka from 2.8.0 before 4.2.2, and from 4.3.0 before 4.3.2 on all platforms allows an authenticated attacker with CLUSTERACTION privilege to cause a denial of service controller process termination via a crafted...

CVE-2026-103410 Session Smart Router: Integer overflow causes denial of service during TLS certificate inspection

An Integer Overflow vulnerability in the DPI certificate scanner in Juniper Networks Session Smart Router allows an unauthenticated remote attacker to cause a denial of service via a specially crafted TLS server certificate...

CVE-2026-103409 Session Smart Router: An attacker obtains administrative privileges when an unauthenticated internal endpoint is accessed

A Missing authentication for critical function vulnerability in Juniper Networks Session Smart Router allows an unauthenticated network-based attacker to obtain administrative privileges by passing crafted URL parameters to an insecure endpoint running as root. Note that this vulnerability can on...

CVE-2026-103408 Session Smart Router: An attacker-controlled input causes remote code execution when parsing DHCP options

A Stack Buffer Overflow vulnerability in the DHCP client in Juniper Networks Session Smart Router allows an unauthenticated attacker on the local network to achieve remote code execution via a malicious DHCP reply...

CVE-2026-103407 Session Smart Router and Session Smart Conductor: Unsanitized input allows arbitrary file read, overwrite, or deletion via the PKI management

An Improper Limitation of a Pathname to a Restricted Directory vulnerability in ConfigDirector in Juniper Networks Session Smart Router and Session Smart Conductor allows an authenticated REST user to read, overwrite, or delete arbitrary certificate and key files on the host filesystem via the...

CVE-2026-103406 Session Smart Conductor: An unauthenticated attacker causes arbitrary command execution during key management.

An Improper Neutralization of Special Elements used in an OS Command vulnerability in the AutomatedProvisioner in Juniper Networks Session Smart Conductor allows a remote attacker to execute arbitrary commands as root via a specially crafted salt minion ID...

CVE-2026-103405 Session Smart Router and Session Smart Conductor: Unsanitized input causes HTTP response splitting

An Improper Neutralization of Special Elements in Output Used by a Downstream Component 'Injection' vulnerability in the web server in Juniper Networks Session Smart Router and Session Smart Conductor allows an attacker to inject arbitrary HTTP headers via unsanitized request body parameters...

CVE-2026-103404 Session Smart Conductor: Insecure file permissions cause unauthorized access to sensitive routing credentials

An Incorrect Permission Assignment for Critical Resource vulnerability in RoutingManager in Juniper Networks Session Smart Conductor allows a local user to access sensitive routing credentials via triggering processes that write to the /tmp directory...

CVE-2026-103403 Session Smart Router and Session Smart Conductor: Unvalidated input causes arbitrary file deletion and command execution when deleting audit rules

An Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability in AccessManager in Juniper Networks Session Smart Router and Session Smart Conductor allows an attacker to perform arbitrary file deletion and arbitrary command execution via the deletion of...

CVE-2026-103402 Session Smart Router and Session Smart Conductor: Lack of integrity verification in cache files causes arbitrary code execution and privilege escalation

An Insufficient Verification of Data Authenticity vulnerability in PCLI in Juniper Networks Session Smart Router and Session Smart Conductor allows an attacker with write access to the model cache directory to execute arbitrary code and escalate privileges via the processing of unverified cache...

CVE-2026-103401 Session Smart Router and Session Smart Conductor: An attacker can overwrite arbitrary files as root

An Improper Link Resolution Before File Access 'Link Following' vulnerability in the unauthenticated web server handlers in Juniper Networks Session Smart Router and Session Smart Conductor allows a local unprivileged user to overwrite arbitrary files as root via unauthenticated API endpoints. Th...

CVE-2026-103400 Session Smart Router and Session Smart Conductor: Crafted directory names cause arbitrary filesystem unmounting during service cleanup

An Improper Neutralization of Special Elements in Output Used by a Downstream Component 'Injection' vulnerability in the ember service in Juniper Networks Session Smart Router and Session Smart Conductor allows an attacker with local access to unmount arbitrary filesystems or cause a denial of...

CVE-2026-103394 Session Smart Router: An incomplete operator causes the use of incorrect encryption keys during security policy updates.

An Improper Initialization vulnerability in the SSR software in Juniper Networks Session Smart Router allows an attacker to decrypt traffic or cause a denial of service via security policy assignment...

CVE-2026-103393 Session Smart Router: An attacker can cause an out-of-bounds read during VRRP packet processing

An Out-of-Bounds Read vulnerability in the VRRP implementation in Juniper Networks Session Smart Router allows an L2-adjacent attacker to read stale memory contents or cause a system fault via a specially crafted VRRPv3 advertisement...

CVE-2026-103392 Session Smart Router: A SACK option causes out-of-bounds memory access and TCP payload corruption when TCP sequence stitching is enabled

An Out-of-Bounds Write vulnerability in the TCP header processing in Juniper Networks Session Smart Router allows an attacker to corrupt TCP payload data and potentially cause session desynchronization via a transit TCP packet with an oversized SACK option length...

CVE-2026-93536 X.Org Server GestureBuildSprite Use-After-Free

A use after free caused by missing lifecycle management of gesture sprites in GestureBuildSprite in X.Org X Server before 21.1.25 and XWayland before 24.1.14 could be used by authenticated X clients to crash the X server or potentially execute code...

CVE-2026-103391 Session Smart Router: An attacker-controlled TCP option causes an out-of-bounds write when using the TCP proxy feature

An Out-of-bounds Write vulnerability in the SSR TCP proxy/optimization path in Juniper Networks Session Smart Router allows an attacker to corrupt forwarded packet data and potentially cause a data-plane crash via a transit TCP packet with a crafted TCP option length...

CVE-2026-103390 Session Smart Router and Session Smart Conductor: A malformed HTTP URI causes a service crash during HTTP application identification

An Out-of-Bounds Read vulnerability in the HttpParser component in Juniper Networks Session Smart Router and Session Smart Conductor allows an attacker to cause a denial of service via a specially crafted HTTP request...

CVE-2026-93524 X.Org Server XKB SetMap Key Width/Action Count Desync Out-Of-Bounds Read

A buffer overread in CheckKeySyms in X.Org X Server before 21.1.25 and XWayland before 24.1.14 could be used by authenticated X clients to leak small amounts of information from X server memory or potentially crash the X server...

CVE-2026-93523 X.Org Server XInput2 PassiveUngrabDevice Out-of-Bounds Write

A heap buffer overflow caused by a XIPassiveUngrabDevice request with an out-of-range modifier value in X.Org X Server before 21.1.15 and XWayland before 24.1.14 could be used by authenticated X clients to crash or potentially execute code in X server context...

CVE-2026-118510 Laravel MongoDB `whereDoesntHave` misses deny records for numeric string IDs

A type-handling flaw in the relationship query building of this MongoDB integration library can cause a check for the absence of a related record to be compiled with an identifier of the wrong data type. In an application that relies on such a check to decide which documents a request may see or...

CVE-2026-93522 X.Org Server Glamor CopyArea Heap Buffer Overflow

A heap buffer overflow caused by mismatched size usage in CopyArea CPU-to-FBO path in X.Org X Server before 21.1.15 and XWayland before 24.1.14 could be used by authenticated X clients to crash or potentially execute code in the X server context...

CVE-2026-116778 FOG: Authenticated low-privileged API user can modify Storage Nodes and reach root command execution

FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to 1.5.10.2253 and 1.6.0-RC-1, an authenticated API-enabled user with uType=1 who possesses both the user's API token and the global FOG API token can use PUT /fog/storagenode/id/edit to modify Storage Node...

CVE-2026-116776 USB Test: Heap-based Buffer Overflow in getSectorSize via untrusted DISK_GEOMETRY.BytesPerSector leads to RCE/DoS

USB Test is a lightweight Windows CLI utility for verifying sector integrity and detecting overreported capacity on USB flash drives. Prior to version 1.1.5, getSectorSize in USB Test/src/driveinfo.cpp trusts DISKGEOMETRY.BytesPerSector returned by IOCTLDISKGETDRIVEGEOMETRY without checking wheth...

CVE-2026-56828 Shopper: read-only team permissions allow administrator creation and permission escalation

Shopper is a Headless e-commerce Admin Panel. From 2.8.0 until 2.8.1, three Shopper Livewire admin components retain authorization gaps after the earlier team-settings authorization fix. A staff member with only viewusers and accessdashboard can mutate permissions, create an administrator, or...

CVE-2026-47235 SimulationCraft: Heap-Based Buffer Overflow / Out-of-Bounds Write in SimulationCraft's gem_id Array

SimulationCraft is a tool to explore combat mechanics in World of Warcraft. In builds after release-820-01 and before the identified May 7, 2026 nightly, the bcpapi.cpp loop over the JSON sockets array uses slotdata"sockets".Size without bounding gemidx by MAXGEMSLOTS, which is four in...

CVE-2026-93521 X.Org Server RandR ChangeProviderProperty Heap Buffer Overflow

A buffer overflow in RandR ChangeProviderProperty requests in X.Org X Server before 2.1.25 and XWayland before 24.4.14 could be used by authenticated X clients to crash or execute code within the X server context...

CVE-2026-59979 YosemiteCrew: Missing organization authorization on service and PMS library/template routes

YosemiteCrew provides organization-based service and task management. In the source-reported affected main and dev snapshots, YosemiteCrew's service and PMS task-library/template routes omit organization and permission checks. authorizeCognito in apps/backend/src/middlewares/auth.ts sets the...

CVE-2026-44179 XWiki Pro Macros: excerpt-include title and content injection executes code

XWiki Remote Macros provides XWiki rendering macros that are useful when migrating content from Confluence. From 1.13 until 1.14.5, the excerpt-include macro does not properly escape the included page's title and executes excerpt content with the macro's rights. The title handling in...

CVE-2026-50542 Xibo: IDOR (Broken Object-Level Authorization) on GET /layout/status/{id} Allows Arbitrary Layout Metadata Disclosure

Xibo is an open source digital signage platform with a web content management system and Windows display player software. Prior to 4.4.3, missing access-control checks on GET /layout/status/id allow an authenticated user with any privileges to view the status and metadata of any layout, including...

CVE-2026-118029 Unverified ownership of the default Athena query result location in AWS SDK for pandas

Unverified ownership of the default query result location in the Athena module in AWS SDK for pandas awswrangler before 3.16.1 might allow remote actors to read Athena query results and tamper with result sets returned to the caller via a pre-created S3 bucket. To remediate this issue, users...

CVE-2026-50543 Xibo: Missing Authorization on POST /displaygroup/criteria/{displayGroupId} Allows Arbitrary Scheduling Criteria Injection to Player Devices

Xibo is an open source digital signage platform with a web content management system and Windows display player software. Prior to 4.4.3, missing authorization on POST /displaygroup/criteria/displayGroupId allows an authenticated user to send criteria updates to any display via XMR. These criteri...

CVE-2026-112357 GFI KerioConnect KOFF < 10.0.9p2 Privilege Escalation

GFI KerioConnect Kerio Connect Outlook Connector Offline Edition, 'KOFF', before 10.0.9 Patch 2 contains a local privilege escalation vulnerability caused by weak installer permissions that leave the product directory writable by the built-in Users group. A local non-administrative attacker can...

CVE-2026-50539 Xibo: Missing Object-Level Authorization on /notification/export/{id} Allows Authenticated Users to Download Arbitrary Attachments

Xibo is an open source digital signage platform with a web content management system and Windows display player software. Prior to 4.4.3, missing object-level authorization on /notification/export/id allows an authenticated user to download attachments from any notification, including notificatio...

CVE-2026-112356 GFI KerioConnect < 10.0.9p2 XSS via Link Auto-Formatter

GFI KerioConnect Kerio Connect before 10.0.9 Patch 2 contains a cross-site scripting vulnerability in the Webmail component that allows a remote attacker to spoof link targets or inject HTML into a message as rendered in a victim's authenticated Webmail session by sending a crafted email whose te...

CVE-2026-67187 Ninja Forms WordPress Plugin < 3.15.4 Server-Side Validation Bypass via List Fields

Ninja Forms plugin for WordPress before 3.15.4 contains an incomplete server-side validation vulnerability that allows unauthenticated attackers to submit arbitrary values to Checkbox List, Multi-Select List, Image List, Country, and State fields because NFAbstractsList falls through to a validat...

CVE-2026-115402

OpenVPN ovpn-dco-win 0.6.5 through 2.8.13 allows unprivileged local users to cause a denial of service system crash via a race condition in the TCP connect path...

CVE-2026-93520 X.Org Server XKB ChangeKeycodeRange Heap Out-of-Bounds Write

A heap buffer overflow caused by mismatching size calculations between XkbAllocNames and ChangeKeycodeRange in X.org X server before 2.1.25 and XWayland before 24.1.14 could be used by authenticated X clients to crash or potentially execute code in X server context...

CVE-2026-93519 X.Org Server XFixes Pointer Barrier Event List Buffer Overflow

A buffer overflow when handling pointer barriers in the XFIXES extension in X.Org X server before 21.1.25 and XWayland before 24.1.14 could be used by authenticated X clients to crash or potentially execute code in X server context...

CVE-2026-93518 X.Org Server XKB ResizeKeyType Numeric Truncation

An integer truncation issue in XkbResizeKeyType that could lead to a heap buffer overflow by authenticated X clients in X.org X server before 21.1.25 and XWayland before 24.1.14 could be exploited for crashes or potential code execution in the X server...

CVE-2026-115603 WordPress Advanced Ads – Tracking plugin < 4.0.0 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Advanced Ads GmbH Advanced Ads – Tracking advanced-ads-tracking allows Blind SQL Injection.This issue affects Advanced Ads – Tracking: from n/a before 4.0.0...

CVE-2026-115968 WordPress Ultimate Member plugin <= 2.13.1 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in Ultimate Member Ultimate Member ultimate-member allows Object Injection.This issue affects Ultimate Member: from n/a through 2.13.1...

CVE-2026-116390 WordPress Filter Everything — WordPress & WooCommerce Filters plugin <= 1.9.7 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in stepasyuk Filter Everything — WordPress & WooCommerce Filters filter-everything allows Object Injection.This issue affects Filter Everything — WordPress & WooCommerce Filters: from n/a through 1.9.7...

CVE-2026-116389 WordPress Phoenix Media Rename plugin <= 3.13.5 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in crossi72 Phoenix Media Rename phoenix-media-rename allows Object Injection.This issue affects Phoenix Media Rename: from n/a through 3.13.5...