CVE-2026-75131 NetworkManager-l2tp Privilege Escalation via pppd Username Injection

NetworkManager-l2tp through 1.52.4, fixed in 1.52.6, contains a privilege escalation vulnerability that allows local users with permission to create VPN connections to execute arbitrary code as root by injecting pppd options through a crafted VPN username. Attackers can embed a double-quote...

CVE-2026-96541 Gnome-remote-desktop: gnome-remote-desktop: unauthenticated rdp sockets lack a handshake deadline

A denial-of-service flaw was found in gnome-remote-desktop. An unauthenticated remote attacker can open RDP connections without completing the handshake and retain the connection-throttling slots indefinitely because no pre-authentication handshake deadline is enforced. By exhausting the global...

CVE-2026-71459 Automation-controller: automation-controller-container: automation-controller: jobjobeventschildrensummary rbac bypass exposes cross-tenant job event tree structure

JobJobEventsChildrenSummary view has no model/parentmodel. ModelAccessPermission.checkgetpermissions falls through returns True for any authenticated user. The view uses raw getobjector404Job, pk without DRF object-level permission check. Zero-privilege user reads event tree structure,...

CVE-2026-71458 Automation-controller: automation-controller-container: automation-controller: named-url 404 body oracle enables cross-tenant resource name enumeration

URLModificationMiddleware resolves named-URL lookups against unfiltered Model.objects before RBAC. The 403→404 shim only rewrites 403 responses, leaving the pk=0 miss path with a different 404 detail string. Differential "Not found." vs "No matches..." reveals whether a named resource org,...

CVE-2026-77421 JLine: ReDoS in Nano Editor Regex Search Mode

JLine is a Java library for handling console input. From 3.0.0 until 3.30.15 and 4.3.1, the JLine built-in nano editor's regex search mode passes a user-controlled search term from doSearchString text in builtins/src/main/java/org/jline/builtins/Nano.java to Java's backtracking regular expression...

CVE-2026-92730 LimeSurvey Community Edition 7.0.14 - Reflected XSS in participant CSV import result via invalid attribute column name

LimeSurvey Community Edition 7.0.14 contains a reflected cross-site scripting vulnerability on the administrative survey-participant CSV import result page...

CVE-2026-63132 OpenBao's Recovery Mode Vulnerable To Token Leakage via Timing Attack

OpenBao is an open source identity-based secrets management system. Prior to 2.6.0, OpenBao's handleLogicalRecovery path in http/logical.go compared the highly privileged recovery token with ordinary string equality. A remote unauthenticated attacker able to make repeated recovery mode requests a...

CVE-2026-63131 OpenBao LIST ACL bypass: a trailing-slash LIST request skips a more-specific deny rule (unported Vault v2.0.3 fix)

OpenBao is an open source identity-based secrets management system. Prior to 2.6.0, OpenBao's vault/policy/acl.go could evaluate a broader wildcard ACL grant before more-specific trailing-wildcard ACL paths with capabilities = "deny" for a LIST operation. When a parent path permitted LIST and a...

CVE-2026-77285 OpenBao Agent Writes Secrets to Stdout

OpenBao is an open source identity-based secrets management system. Prior to 2.6.0, OpenBao Agent's exec rendering mode could write secrets from envtemplate to standard output when command/agent/exec/exec.go re-created the template runner after repeated rendering failures, primarily after...

CVE-2026-55632 GoCD is vulnerable to authorization bypass via pipeline structure API

GoCD is a continuous deliver server. From 20.2.0 until 26.1.0, the internal pipeline structure API used for autocompletion while editing pipeline, template, environment, and user-preference configuration returns its users-and-roles mode to regular authenticated users without requiring an...

CVE-2026-52744 GoCD is vulnerable to authorization bypass via fetch artifact autosuggestion API

GoCD is a continuous deliver server. From 20.2.0 until 26.1.0, the internal GoCD UI fetch-artifact auto-suggestion API at /go/api/internal/pipelines//upstream does not adequately authorize access to upstream dependency data. An authenticated user can retrieve inter-pipeline dependency hierarchy...

CVE-2026-92700 Caddy: fileHidden() case-sensitive pattern bypass — exposes "hidden" files via case variation

Caddy is an extensible server platform that uses TLS by default. In version 2.11.3 and earlier, in modules/caddyhttp/fileserver/staticfiles.go, fileHidden uses case-sensitive filepath.Match checks, so case variants can bypass hide rules on case-insensitive filesystems or when mixed-case paths...

CVE-2026-92284 Caddy: Unbounded body buffer via {http.request.body} placeholder — memory exhaustion DoS

Caddy is an extensible server platform that uses TLS by default. In version 2.11.3 and earlier, in modules/caddyhttp/replacer.go, resolving http.request.body reads the complete request body with an unbounded io.Copy before request-body middleware limits apply, allowing memory exhaustion and proce...

CVE-2026-88840 Busybox: busybox: tls ssl_server reads one byte out of bounds when parsing truncated clienthello

BusyBox TLS getclienthello reads past the end of the input buffer when parsing a truncated ClientHello message...

CVE-2026-88839 Busybox: busybox: passwd/group parser writes heap pointers out of bounds due to stale tokenize() endpoint

BusyBox passwd/group tokenize references a stale endpoint pointer after trimming, causing an out-of-bounds write of heap pointers...

CVE-2026-88837 Busybox: busybox: httpd misidentifies yescrypt password hashes as plaintext, inverting authentication

BusyBox httpd treats yescrypt $y$ password hashes as plaintext during Basic Authentication, inverting the authentication check...

CVE-2026-88835 Busybox: busybox: dpkg read_package_field() steps past nul terminator, causing out-of-bounds read on malformed .deb packages

BusyBox dpkg readpackagefield steps past a NUL terminator on malformed .deb packages, causing an out-of-bounds heap read...

CVE-2026-88831 Busybox: busybox: httpd silently fails open when ip deny rules contain invalid cidr prefix lengths

BusyBox httpd IP deny rules with invalid CIDR prefix lengths fail open, leaving a parsed IP with a zeroed mask so the rule matches no clients...

CVE-2026-86867 Cinnamon's kotaemon contains improper authorization checks in multi‑user chat handlers

Cinnamon's Kotaemon all versions up to and including v0.12.0 multi-user chat interface contains multiple vulnerabilities due to incorrect authorization and improper access controls. There are four handler methods in libs/ktem/ktem/pages/chat/control.py that load a Conversation record by its ID...

CVE-2026-86934

An authorization bypass vulnerability in the FileMaker Server Web Publishing Engine allowed requests containing an extended privilege header to bypass the disabled Custom Web Publishing with XML setting and access the XML Web Publishing interface. This vulnerability is addressed in FileMaker Serv...

CVE-2026-86938

A DLL hijacking vulnerability in the FileMaker Pro installer for Windows allowed a local user to execute arbitrary code with elevated administrator privileges by placing a malicious DLL file in the installer directory. This vulnerability is addressed in FileMaker Pro version 26.0.3...

CVE-2026-86926

A heap buffer overflow vulnerability in the FileMaker Server database engine block parsing routine allowed a maliciously crafted .fmp12 database file to cause memory corruption, potentially leading to arbitrary code execution. This vulnerability is addressed in FileMaker Server version 26.0.3...

CVE-2026-86930

An out-of-bounds read vulnerability in FileMaker Server for Linux allowed an attacker uploading a specially crafted image file to a container field to disclose process memory during thumbnail generation in FileMaker WebDirect. This vulnerability is addressed in FileMaker Server version 26.0.3...

CVE-2026-91775 LimeSurvey Community Edition 7.0.14 - Reflected XSS through unescaped LSS survey-import warnings

LimeSurvey fails to safely encode attacker-controlled content from a crafted .lss survey file when displaying import warnings, resulting in XSS in the administrative interface...

CVE-2026-88832 Busybox: busybox: romfs volume id parsing performs unbounded memcpy into fixed-size label buffer, causing heap overflow

BusyBox romfs volume ID parsing uses unbounded strlen on attacker-controlled metadata, causing a heap buffer overflow when processing crafted filesystem images...

CVE-2026-88830 Busybox: busybox: tls montgomery reduction allocates bytes instead of digits, causing a pre-auth heap buffer overflow

A unit confusion in BusyBox TLS Montgomery reduction buffer allocation causes a pre-authentication heap buffer overflow when processing a crafted ClientKeyExchange message...

CVE-2026-96808

In Flatpak before 1.18.1, the revokefs writer, used by the flatpak-system-helper to receive repository data from unprivileged callers, validated file paths by rejecting literal .. components but did not prevent symlink traversal. A malicious local user in an active local session could obtain two...

CVE-2026-96807

In Flatpak before 1.18.1, a malicious sandboxed app can replace /.var/app/$appid/.ld.so with a symlink, causing regenerateldcache to write files at an arbitrary location. The filenames and content are not attacker controlled, making this hard to exploit...

CVE-2026-96514 Neethuharii CafeManagement Login CafePortalLogin.php sql injection

A weakness has been identified in Neethuharii CafeManagement. Impacted is an unknown function of the file CafePortalLogin.php of the component Login Handler. This manipulation of the argument uname causes sql injection. It is possible to initiate the attack remotely. The exploit has been made...

CVE-2026-96804 CVE-2026-96804

MLflow's statsmodel flavor, versions 2.1.0 to 3.14.0, omits the MLFLOWALLOWPICKLEDESERIALIZATION=False security control entirely in loadmodel, which allows a remote attacker to execute arbitrary code via a crafted MLmodel artifact...

CVE-2026-93349 Frictionless OS Command Injection via explore Console Command

Frictionless through 5.20.0rc1 contains an OS command injection vulnerability in the explore console command that allows an attacker who supplies a crafted Data Package descriptor to execute arbitrary operating system commands as the user who explores it. Attackers can place shell metacharacters ...

CVE-2026-96513 Neethuharii CafeManagement AddProductCode.php unrestricted upload

A security flaw has been discovered in Neethuharii CafeManagement. This issue affects some unknown processing of the file AddProductCode.php. The manipulation of the argument image results in unrestricted upload. The attack may be performed from remote. The exploit has been released to the public...

CVE-2026-95848 Moquette fails open when configured authentication or authorization classes cannot load

Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, when a configured authenticator or authorizator class cannot be loaded, Server.initializeAuthenticator and Server.initializeAuthorizatorPolicy treat the failure as though no custom class was configured and fall back to...

CVE-2026-95847 Moquette client IDs can cause cross-session H2 durable-queue corruption

Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, H2PersistentQueue derives a session's message-map name as queue plus the client ID and its metadata-map name as queue plus the client ID plus meta. A durable session whose client ID ends in meta can therefore make its message map collid...

CVE-2026-95846 Moquette publishes Last-Will messages without enforcing write authorization

Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, PostOffice.publishWill publishes a client's Last-Will message without applying the canWrite authorization and reserved-topic checks used for a normal PUBLISH. A client can configure a Will for a topic that the client is not permitted to...

CVE-2026-95845 Moquette unbounded per-session message queues allow memory exhaustion

Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, the broker does not enforce a maximum length for pending per-session message queues. When a fast publisher sends messages to a slow subscriber whose in-flight window is full, queued messages can accumulate without bound in memory or...

CVE-2026-95844 Moquette deeply nested MQTT topics can cause stack exhaustion

Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, Moquette does not limit the depth of topic names and topic filters before processing them through recursive CTrie insertion and matching operations. A remote client can publish or subscribe with a deeply nested topic, causing a...

CVE-2026-95843 Moquette malformed shared subscriptions can crash command processing

Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, PostOffice.subscribe parses a shared-subscription filter through SharedSubscriptionUtils.extractShareName before validating the complete $share/shareName/topicFilter structure. A remote client can send a filter such as $share/grp withou...

CVE-2026-95842 Moquette uncaught MQTT command exceptions can terminate shared session event loops

Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, SessionEventLoop.run catches only InterruptedException, and SessionEventLoopGroup does not restart a terminated loop. An MQTT command that raises an uncaught exception can terminate an event loop shared by multiple client sessions,...

CVE-2026-85724 Moquette pattern ACL wildcard injection allows cross-tenant authorization bypass

Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, when pattern-based ACL rules are configured, AuthorizationsCollector.canDoOperation substitutes client ID and username values directly into rules containing %c or %u and then treats the result as an MQTT topic filter. A client that uses...

CVE-2026-96775 MLflow dspy bypasses pickle deserialization control

MLflow's dspy flavor, versions = 2.0, applies the MLFLOWALLOWPICKLEDESERIALIZATION=False security control only when the modelpath ends in .pkl, which allows a remote attacker to execute arbitrary code via a crafted MLmodel artifact...

CVE-2026-96759 orval before 8.29.0 Code Injection via operationId

orval before 8.29.0 fails to escape the operationId parameter when emitting it into generated TanStack Query mutator options metadata objects. Attackers can inject arbitrary JavaScript code through a crafted operationId in an OpenAPI specification that executes when generated hooks are called...

CVE-2026-96758 orval @orval/core before 8.28.0 Code Injection via Form-Data

orval @orval/core before 8.28.0 contains a code injection vulnerability in the form-data serializer that fails to escape multipart property names in generated template literals. Attackers can inject $... expressions into OpenAPI schema property names that execute as live interpolation when the...

CVE-2026-96757 orval before 8.29.0 Code Injection via unescaped OpenAPI media-type

orval before 8.29.0 fails to escape OpenAPI media-type keys when emitting them into single-quoted Content-Type string literals in generated code. Attackers can inject JavaScript through crafted media-type keys in OpenAPI specifications that executes when generated fetch operations or mock resolve...

CVE-2026-96756 orval before 8.30.0 Code Injection via Factory Generation

orval versions before 8.30.0 contain a code injection vulnerability in the @orval/core factory generator that fails to escape date default values in new Date calls. Attackers can inject arbitrary expressions through apostrophes in OpenAPI schema defaults to execute code with the privileges of the...

CVE-2026-96755 orval @orval/effect 8.14.0 through 8.28.1 Code Injection

orval versions 8.14.0 through 8.28.1 contain a code injection vulnerability in the @orval/effect generator that converts OpenAPI schema defaults into template literals. Attackers can inject arbitrary JavaScript expressions via schema defaults containing $... syntax, which are executed at module...

CVE-2026-96754 orval @orval/hono before 8.29.0 Code Injection via OpenAPI Path

orval versions before 8.29.0 contain a code injection vulnerability in the @orval/hono generator that fails to escape OpenAPI path values in single-quoted route literals. Attackers can craft an OpenAPI document with an apostrophe in a static path segment to inject arbitrary JavaScript code that...

CVE-2026-96656 Plex Media Server arbitrary file write

Plex Media Server before 1.43.3.10861 allows an admin user to write arbitrary files that may be executed on load. The preference TranscoderH264Options is appended verbatim to x264's option string on every transcode. At startup, all .so files are run without signature, execute bit, or symbol check...

CVE-2026-96655 Plex Media Server arbitrary-host SSRF

Plex Media Server before 1.43.3.10861 allows an authenticated user to request arbitrary internal or external addresses via the '/video/:/transcode/universal' path parameter...

CVE-2026-96654 Plex Media Server URL injection

Plex Media Server before 1.43.3.10861 does not correctly neutralize URL values included in 'searchOne,' allowing an attacker to call other plugins' functions and supply their own parameters...