CVE-2026-88382

hiredis commit 29ea279 post-v1.5.0 contains an uncontrolled memory allocation vulnerability in its RESP aggregate parser...

CVE-2026-88366

NanoSVG commit 239e102ec contains an incorrect numeric conversion vulnerability in nsvgpathArcTo when parsing SVG arc commands. A specially crafted SVG document containing extreme arc radius values can cause intermediate arc calculations to produce a NaN delta angle. The function subsequently...

CVE-2026-88357

nDPI 5.1.0 contains a memory access issue in the DNS dissector and serializer deserialization code. Specially crafted network input can cause byte-buffer addresses at odd offsets to be cast to uint16t or wider integer pointers and directly dereferenced without alignment checks. This results in...

CVE-2026-88377

Bento4 1.6.0.0 contains an integer underflow vulnerability in the avcC and hvcC configuration atom parsers. A specially crafted MP4 file containing an atom with a declared size smaller than AP4ATOMHEADERSIZE can cause AP4AvccAtom::Create or AP4HvccAtom::Create to underflow the payload-size...

CVE-2026-51996

An issue in geelen mcp-remote 0.1.16 through 0.1.38 allows a remote attacker to execute arbitrary code via the src/lib/utils.ts and the getServerUrlHash function...

CVE-2026-52001

An issue in geelen mcp-remote 0.1.18 through 0.1.38 allows a remote attacker to obtain sensitive information via the SSE transport eventSourceInit fetch wrapper " src/lib/utils.ts...

CVE-2026-88360

libvips 8.19.0 contains a memory access vulnerability when processing little-endian PFM images. If the PFM text header length is not a multiple of four bytes, the mmap-based loader can expose pixel data at an address that is not properly aligned for float access. vipsavgscan subsequently...

CVE-2026-88390

An out-of-bounds write vulnerability in jslGetTokenValueAsString in Espruino 2v29 commit bffc6d0 allows crafted JavaScript input containing an overlong token to trigger a one-byte write beyond the JsLex.token buffer in RELEASE/NOASSERT builds. The out-of-bounds write corrupts the adjacent...

CVE-2026-51994

mcp-remote versions 0.1.32 through 0.1.38 are vulnerable to Server-Side Request Forgery SSRF via the resourcemetadata URL extracted from a remote MCP server's WWW-Authenticate header...

CVE-2026-88369

zserge jsmn commit 25647e6 is vulnerable to Buffer Overflow in example/jsondump.c dump...

CVE-2026-88370

libconfini 1.16.4 contains a heap out-of-bounds write condition involving the bundled loadinibuffer.h utility and stripinicache. The bundled utility allocates exactly inilength bytes, while stripinicache unconditionally writes a NUL terminator at inisourceinilength, requiring an additional writab...

CVE-2026-88383

libical 4.0.6 contains an incompatible function pointer in icalparameterstringtokind. When parsing iCalendar data containing a parameterized property, the function passes icalparametercomparekindmap to bsearch through an incompatible comparator function pointer type. bsearch invokes the callback...

CVE-2026-88384

OpenEXR 3.4.14 contains a NULL Pointer Dereference in the C++ attribute parsing path. A specially crafted EXR file containing an unknown-type attribute with dataSize set to zero causes the parser to create an opaque attribute with a NULL packeddata pointer. The OpaqueAttribute constructor passes...

CVE-2026-88371

ZBar commit 2ea2ca58 contains an undefined-behavior vulnerability in the Code 128 decode6 function. When processing specially crafted Code 128 input, decodee can return -1 for an invalid edge pattern, and decode6 subsequently left-shifts this negative signed value while constructing the edge...

CVE-2026-88385

Mini-XML 4.0.5 contains a memory leak vulnerability in mxmlloaddata during malformed XML parsing. Specially crafted XML input can cause text nodes allocated by mxmlNewText to become unlinked before a parse error transfers control to the cleanup path. These orphaned nodes are not released, resulti...

CVE-2026-51997

An issue in geelen mcp-remote 0.1.16 through 0.1.38 allows a remote attacker to execute arbitrary code via the open functions...

CVE-2026-88361

SumatraPDF 3.6.1 contains an integer overflow vulnerability in EngineMupdf::BuildPageLabelRec when parsing PDF PageLabels /Nums entries...

CVE-2026-96762 kvcache-ai mooncake RPC Path UnmountSegment authorization

A vulnerability was determined in kvcache-ai mooncake up to 0.3.12/0.3.13.post1. This affects the function UnmountSegment of the component RPC Path Handler. This manipulation of the argument clientid/segmentid causes authorization bypass. Remote exploitation of the attack is possible. The exploit...

CVE-2026-82370 Unauthenticated remote command injection in the Brocade SANnav orchestrator HTTP service

Unauthenticated remote command injection in the Brocade SANnav orchestrator HTTP service permits network-adjacent attackers to execute arbitrary administrative switch CLI commands and issue container management instructions. This could allow an attacker to alter Fibre Channel fabric switch...

CVE-2026-96751 pmTicket Project-Management-Software add_project.php setSync sql injection

A vulnerability has been found in pmTicket Project-Management-Software up to 078fa56a782490c5059a0814f84df27984f4d7e2. This affects the function setSync of the file /ajax/addproject.php. Such manipulation of the argument connsettings leads to sql injection. The attack may be launched remotely. Th...

CVE-2026-96739 SEMCMS KindEditor Upload upload_json.php cross site scripting

A flaw has been found in SEMCMS up to 4.2. Affected by this issue is some unknown functionality of the file /Edit/php/uploadjson.php of the component KindEditor Upload Interface. This manipulation of the argument imgFile causes cross site scripting. The attack may be initiated remotely. The explo...

CVE-2026-89078 Double Free in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an authenticated user to execute arbitrary code on the GitLab server due to a double free issue when parsing a...

CVE-2026-92530 Use of Less Trusted Source in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.1 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an authenticated user to spoof merge request authorship and attribute content to arbitrary existing users on t...

CVE-2026-92470 Missing Authorization in GitLab

GitLab has remediated an issue in GitLab EE affecting all versions from 18.7 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an authenticated user to access sensitive CI/CD variable values from debug-mode job traces through the Duo AI...

CVE-2026-92529 Incorrect Authorization in GitLab

GitLab has remediated an issue in GitLab EE affecting all versions from 19.1 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an authenticated user with developer-role permissions to bypass admin-configured AI tool governance controls for...

CVE-2026-92874 Incorrect Authorization in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.3 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an authenticated user with an MCP-scoped token to perform actions beyond the intended scope of that token due ...

CVE-2026-92628 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.6 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under a race condition, the MCP search tool's shared state handling could have caused search results to be returned under an incorrect user context...

CVE-2026-93577 Integer Overflow or Wraparound in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an authenticated user to execute arbitrary code on the GitLab server due to an integer overflow issue when...

CVE-2026-96680 ByteDance Coze Scraper Extension External Message index.js chrome.runtime.onMessageExternal.addListener authorization

A vulnerability was detected in ByteDance Coze Scraper Extension up to 2.0.2. Affected by this vulnerability is the function chrome.runtime.onMessageExternal.addListener of the file static/background/index.js of the component External Message Handler. The manipulation of the argument...

CVE-2026-96678 weiqingwen spring-boot-forum Avatar Upload NewUserFormValidator.java validate path traversal

A security vulnerability has been detected in weiqingwen spring-boot-forum up to 538eecc3c6b85fdf0768ab4e8354b48c0c17d94f. Affected is the function validate of the file src/main/java/com/qingwenwei/util/NewUserFormValidator.java of the component Avatar Upload. The manipulation of the argument...

CVE-2026-70125 Microsoft Office Outlook Remote Code Execution Vulnerability

...

CVE-2026-96676 Fast FAC1900R uhttpd get_alias_name stack-based overflow

A vulnerability was identified in Fast FAC1900R 201908272.0.2. The impacted element is the function getaliasname of the component uhttpd. Such manipulation leads to stack-based buffer overflow. The attack may be performed from remote. The exploit is publicly available and might be used. The vendo...

CVE-2026-96606 LB-Link BL-CPE600EU Configuration Backup Mifi_config.bin information disclosure

A security flaw has been discovered in LB-Link BL-CPE600EU 5.8.13. This vulnerability affects unknown code of the file Mificonfig.bin of the component Configuration Backup Handler. The manipulation results in information disclosure. The attack can be launched remotely. The exploit has been releas...

CVE-2026-59980 hpack: Unbounded variable integer decoding can cause run-away computation on malformed input

hpack is an HTTP/2 Header Encoding for Python. Prior to version 4.2.0, unbounded variable integer decoding can cause run-away computation on malformed input leading to On^2 runtime, effectively blocking further processing with large enough unsanitized input. A fix is available in python-hyper/hpa...

CVE-2026-96604 SoftNews Media Group DataLife Engine Search search.php strip_data sql injection

A vulnerability was identified in SoftNews Media Group DataLife Engine 18.0. This affects the function stripdata of the file engine/modules/search.php of the component Search Module. The manipulation of the argument story leads to sql injection. The attack can be initiated remotely. The exploit i...

CVE-2026-96603 Abdurrab5 online-makeup-store Admin functions.php confirm_user authorization

A vulnerability has been found in Abdurrab5 online-makeup-store. Affected is the function confirmloggedin/confirmuser of the file functions.php of the component Admin Handler. Such manipulation of the argument adminid leads to missing authorization. The attack may be performed from remote. The...

CVE-2026-81537 DataStage on Cloud Pak for Data has several vulnerabilities

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary code due to OS command injection...

CVE-2026-81536 DataStage on Cloud Pak for Data has several vulnerabilities

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to obtain sensitive information due to an XML external entity XXE injection...

CVE-2026-81208 DataStage on Cloud Pak for Data has several vulnerabilities

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow an authenticated user to access sensitive information due to improper handling of encrypted credentials. An attacker could exploit this vulnerability to obtain credentials intended for other users or environments...

CVE-2026-93352 Laravel-Mediable 7.0.0 < 7.0.2 RCE via .pht File Upload

Laravel-Mediable 7.0.0 before 7.0.2 contains an incomplete patch for CVE-2026-49972 in which the .pht extension is absent from the forbiddenextensions blocklist in config/mediable.php. The blocklist introduced to address CVE-2026-49972 includes phpt but omits pht, which Apache executes as PHP via...

CVE-2026-80423 DataStage on Cloud Pak for Data has several vulnerabilities

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to obtain sensitive information due to the exposure of namespace-wide secrets via accessible file mounts...

CVE-2026-19125 EthPress <= 2.3.5 - Unauthenticated Authentication Bypass

The EthPress – Web3 Login plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 2.3.5. This is due to the verifylogin function in app/Login.php containing a missing return statement in the signature verification failure branch — when Signature::verify2...

CVE-2026-86583 Import and export users and customers <= 2.4.17 - Authenticated (Subscriber+) Privilege Escalation via CSV Escape-Character Mismatch in Export/Import Round Trip via display_name and nickname Profile Fields

The Import and export users and customers plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.4.17 via the plugin's own export and re-import workflow. The vulnerability exists because the exporter writes CSV cells using fputcsv with a NUL byte \0 as...

CVE-2026-75887 Openshift/console: openshift/console: unauthenticated path traversal in i18n locale handler

A flaw was found in the OpenShift console. An unauthenticated attacker can exploit a path traversal vulnerability by manipulating the lng and ns query parameters in the /locales/resource.json endpoint. This allows the attacker to read sensitive .json files from the pod filesystem, including plugi...

CVE-2026-96602 Abdurrab5 online-makeup-store Customer Login customerSignin.php sql injection

A flaw has been found in Abdurrab5 online-makeup-store. This impacts an unknown function of the file customerSignin.php of the component Customer Login Handler. This manipulation of the argument username/password causes sql injection. The attack is possible to be carried out remotely. The exploit...

CVE-2026-96601 Abdurrab5 online-makeup-store Admin Login index.php sql injection

A vulnerability was detected in Abdurrab5 online-makeup-store. This affects an unknown function of the file index.php of the component Admin Login Handler. The manipulation of the argument id/password results in sql injection. The attack can be executed remotely. The exploit is now public and may...

CVE-2026-80425 DataStage on Cloud Pak for Data has several vulnerabilities

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command...

CVE-2026-80412 DataStage on Cloud Pak for Data has several vulnerabilities

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary code due to improper escaping of connector property values during OSH script generation...

CVE-2026-80379 DataStage on Cloud Pak for Data has several vulnerabilities

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command...

CVE-2026-6935 Multiple Vulnerabilities in IBM Concert Software

IBM Concert 1.0.0 through 3.0.0 invokes operating system commands without fully qualifying executable paths or adequately restricting search path resolution. As a result, an attacker with local system access can manipulate the search path environment to execute untrusted or malicious code...