CVE-2026-9805 FMTSWriteUseIntelLib: FMTS SMM IHISI Buffer Overflow

SMM IHISI command handler, FMTSWriteUseIntelLib, for FMTS command 0x32, read and write data without checking buffer size and could cause buffer overflow...

CVE-2026-57171 Trestle is vulnerable to arbitrary file write via path traversal in author generate commands (Incomplete fix of CVE-2026-46345)

Compliance-trestle Trestle is a Python SDK and command-line tool for managing OSCAL compliance documents. In versions before 3.12.4 and versions 4.0.0 through 4.0.3, the catalog-generate, profile-generate, and ssp-generate author commands write generated Markdown to an attacker-influenced output...

CVE-2026-80202 Kimai before 2.56.0 Authorization Bypass via TimesheetVoter

Kimai before 2.56.0 does not enforce team-membership checks in TimesheetVoter::voteOnAttribute, which maps permissions only to owntimesheet or othertimesheet. As a result, any authenticated user with ROLETEAMLEAD or a role holding editothertimesheet/deleteothertimesheet can read, modify, and...

CVE-2026-80201 Kimai before 2.53.0 API Token Leakage via Invoice Template

Kimai before 2.53.0 fails to block sensitive User methods in the Twig invoice template sandbox, allowing admins to call getApiToken and getPlainApiToken methods. Attackers with template creation permissions can embed these method calls in invoice templates to leak hashed API tokens in rendered...

CVE-2026-80199 Kimai before 2.54.0 Username Enumeration via Timing Oracle

Kimai before 2.54.0 contains a timing oracle vulnerability in TokenAuthenticator that allows unauthenticated attackers to enumerate valid usernames via X-AUTH-USER header. Attackers can measure response time differences when the password hasher runs only for existing users, enabling username...

CVE-2026-80200 Kimai before 2.53.0 Open Redirect via RelayState

Kimai before 2.53.0 contains an open redirect vulnerability in the SAML authentication success handler that accepts unvalidated RelayState POST parameters as redirect destinations. Attackers with IdP access can supply malicious RelayState values to redirect authenticated users to...

CVE-2026-80198 Kimai before 2.56.0 Information Disclosure via config() Twig Function

Kimai versions before 2.56.0 fail to restrict the config Twig function in sandboxed invoice and export templates, allowing administrators to access arbitrary configuration keys. Attackers with admin privileges can upload malicious templates to exfiltrate server-wide secrets including LDAP bind...

CVE-2026-80197 Kimai before 2.57.0 Improper Authorization via Favorite Endpoints

Kimai before 2.57.0 contains an improper authorization vulnerability in the favorite timesheet add and remove endpoints that allows authenticated users to manipulate other users' bookmarks. Attackers can add or remove timesheet entries from another user's favorite list by referencing their...

CVE-2026-80196 Kimai before 2.58.0 Authentication Bypass via Password Reset Link

Kimai before 2.58.0 contains an authentication bypass vulnerability where password reset links remain valid after password changes because the LoginLink signature covers only the user id, not the password hash. Attackers who intercept or cache a password reset link can use it up to 2 additional...

CVE-2026-80195 Kimai before 2.63.0 Team Membership Removal via API

Kimai before 2.63.0 contains a business logic / improper authorization vulnerability in the team update API endpoint PATCH /api/teams/id, which removes all existing team members before validating the submitted replacement member list. An authenticated teamlead or other user with permission to edi...

CVE-2026-80194 Kimai before 2.64.0 Missing Authorization via ProjectViewController export

Kimai before 2.64.0 contains a missing authorization vulnerability in the ProjectViewController export route reportprojectviewexport. The authorization guards are attached to the sibling invoke method rather than at the class level, so the export route inherits no authorization checks. Any...

CVE-2026-80193 Kimai before 2.62.0 Authorization Bypass via QuickEntry

Kimai before 2.62.0 fails to validate createothertimesheet permission in the QuickEntry controller when creating new timesheets. Authenticated users with viewothertimesheet and editothertimesheet permissions can create timesheet records for team members by submitting the QuickEntry form, bypassin...

CVE-2026-80192 better-auth SSO before 1.6.27 Domain Ownership Authentication Bypass

@better-auth/sso before 1.6.27 and before 1.4.8 in the 1.4.x line and before 1.7.0-rc.5 in the 1.7 prerelease line contains two domain-ownership flaws. When domain verification is disabled, automatic organization assignment accepts unverified provider domains, allowing an authenticated organizati...

CVE-2026-80191 GROWI before 8.0.2 Missing Authorization on Attachment Retrieval for Unauthenticated Requests

GROWI applies its page-viewer permission check to attachment requests only when the request carries an authenticated user. retrieveAttachmentFromIdParam in apps/app/src/server/routes/attachment/get.ts guards the check with a condition requiring the user to be non-null, so a request that carries n...

CVE-2026-80189 LeafWiki 0.10.0 through 0.12.0 Uncontrolled Resource Consumption via Unbounded ZIP Extraction

LeafWiki extracts an uploaded ZIP archive without limiting how much data it will write. ZipExtractor.ExtractToDir in internal/importer/zipextractor.go opens each entry and copies it to the destination with io.Copy, which runs to the end of the decompressed stream, so only the size of the uploaded...

CVE-2026-57170 Trestle SSTI in Jinja2 include tags allows arbitrary code execution (Incomplete fix of CVE-2026-46439)

Compliance-trestle Trestle is a Python SDK and command-line tool for managing OSCAL compliance documents. In versions prior to 3.12.4 and 4.0.0 through 4.0.3, the custom Jinja2 include tags mdsectioninclude and mdcleaninclude re-parse the content of an included Markdown file as Jinja2 template co...

CVE-2026-52776 Trestle URLSecurityValidator SSRF allowlist bypass via IPv4-mapped IPv6 and 0.0.0.0

Compliance-trestle Trestle is a tooling platform for managing compliance as code. In versions before 3.12.4 and versions 4.0.0 through 4.0.3, the URLSecurityValidator that guards trestle's remote-fetch paths against server-side request forgery can be bypassed to reach loopback, link-local,...

CVE-2026-54757 Trestle has Server-Side Template Injection (SSTI) via Recursive Template Re-evaluation of Untrusted Data

Compliance-trestle Trestle is a Python SDK and command-line tool for managing OSCAL compliance documents. In versions before 3.12.4 and versions 4.0.0 through 4.0.3, Trestle is vulnerable to server-side template injection that can lead to remote code execution. This occurs because the...

CVE-2026-44476 Doorkeeper OpenID Connect: Dynamic Client Registration feature creates public clients with client_secret

Doorkeeper is an OAuth 2 provider for Ruby on Rails. In version 1.9.0, an attacker who knows only a dynamically registered client's clientid, which is public information, can authenticate as that client at the token endpoint and obtain an access token without providing its clientsecret. This occu...

CVE-2026-41707 Spring Security DPoPProofJwtDecoderFactory vulnerable to DPoP Proof Replay

Authentication Bypass by Capture-replay vulnerability in Spring Spring Security allows Spring Security's DPoPProofJwtDecoderFactory contains a cache-based replay attack vulnerability. The internal cache storing JWT ID claims has a strict size limit, allowing attackers to evict legitimate entries ...

CVE-2026-79912 TOTOLINK N600R cstecgi.cgi getCurrentTime command injection

A vulnerability was detected in TOTOLINK N600R 4.3.0cu.7647B20210106. The impacted element is the function getCurrentTime of the file /cgi-bin/cstecgi.cgi. Performing a manipulation of the argument ntpserver results in command injection. The attack can be initiated remotely. The exploit is now...

CVE-2026-15916 Drupal core - Moderately critical - Information disclosure - SA-CORE-2026-010

Missing Authorization vulnerability in Drupal Drupal core allows Forceful Browsing. This issue affects Drupal core versions: from 0.0.0 to 10.6.13, from 11.3.0 to 11.3.14, from 11.4.0 to 11.4.4, from 0.0.0 to 11.0., from 0.0.0 to 11.1., from 0.0.0 to 11.2...

CVE-2026-15917 Drupal core - Moderately critical - Cross-site scripting - SA-CORE-2026-011

Improper Neutralization of Input During Web Page Generation "Cross-site Scripting" vulnerability in Drupal Drupal core allows Cross-Site Scripting XSS. This issue affects Drupal core versions: from 11.3.0 to 11.3.14, from 11.4.0 to 11.4.4, from 0.0.0 to 11.2...

CVE-2026-55805 Drupal core - Moderately critical - Cross-site scripting - SA-CORE-2026-012

Improper Neutralization of Input During Web Page Generation "Cross-site Scripting" vulnerability in Drupal Drupal core allows Stored XSS. This issue affects Drupal core versions: from 0.0.0 to 10.6.13, from 11.3.0 to 11.3.14, from 11.4.0 to 11.4.4, from 0.0.0 to 11.0., from 0.0.0 to 11.1., from...

CVE-2026-16638 Media Folders - Moderately critical - Cross site scripting - SA-CONTRIB-2026-080

Improper Neutralization of Input During Web Page Generation "Cross-site Scripting" vulnerability in Drupal Media Folders allows Stored XSS. This issue affects Media Folders versions: from 0.0.0 to 1.0.8...

CVE-2026-16639 Internationalization Single Sign-On - Critical - Access bypass - SA-CONTRIB-2026-081

Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Internationalization Single Sign-On allows Authentication Bypass. This issue affects Internationalization Single Sign-On versions: from 0.0.0 to 1.8.0...

CVE-2026-16640 Search API Autocomplete - Moderately critical - Cross-site Scripting - SA-CONTRIB-2026-082

Improper Neutralization of Input During Web Page Generation "Cross-site Scripting" vulnerability in Drupal Search API Autocomplete allows Reflected XSS. This issue affects Search API Autocomplete versions: from 0.0.0 to 1.12.0...

CVE-2026-16646 PanKM - Critical - Unsupported - SA-CONTRIB-2026-083

Vulnerability in Drupal PanKM. This issue affects PanKM versions:...

CVE-2026-16641 Commerce Elavon - Critical - Unsupported - SA-CONTRIB-2026-084

Vulnerability in Drupal Commerce Elavon. This issue affects Commerce Elavon versions:...

CVE-2026-16642 Email Login OTP - Critical - Unsupported - SA-CONTRIB-2026-085

Vulnerability in Drupal Email Login OTP. This issue affects Email Login OTP versions:...

CVE-2026-16643 Lunr exposed filters - Critical - Unsupported - SA-CONTRIB-2026-086

Vulnerability in Drupal Lunr exposed filters. This issue affects Lunr exposed filters versions:...

CVE-2026-16644 Webform REST - Moderately critical - Access bypass - SA-CONTRIB-2026-087

Incorrect Authorization vulnerability in Drupal Webform REST allows Forceful Browsing. This issue affects Webform REST versions: from 0.0.0 to 4.1.0...

CVE-2026-16645 PhotoSwipe - Responsive JavaScript Modal Image Gallery - Moderately critical - Access bypass - SA-CONTRIB-2026-088

Missing Authorization vulnerability in Drupal PhotoSwipe - Responsive JavaScript Modal Image Gallery allows Forceful Browsing. This issue affects PhotoSwipe - Responsive JavaScript Modal Image Gallery versions: from 0.0.0 to 3.2.0...

CVE-2026-15088 Development Environment - Critical - Unsupported - SA-CONTRIB-2026-089

Vulnerability in Drupal Development Environment. This issue affects Development Environment versions:...

CVE-2026-18259 Token Content Access - Moderately critical - Access bypass - SA-CONTRIB-2026-090

Observable Timing Discrepancy vulnerability in Drupal Token Content Access allows Brute Force. This issue affects Token Content Access versions: from 0.0.0 to 3.1.2...

CVE-2026-18260 Disable Login Page - Critical - Unsupported - SA-CONTRIB-2026-091

Vulnerability in Drupal Disable Login Page. This issue affects Disable Login Page versions:...

CVE-2026-18261 Powerful Surveys - Critical - Unsupported - SA-CONTRIB-2026-092

Vulnerability in Drupal Powerful Surveys. This issue affects Powerful Surveys versions:...

CVE-2026-18985 Edit in-place field - Moderately critical - Access bypass - SA-CONTRIB-2026-093

Incorrect Authorization vulnerability in Drupal Edit in-place field allows Forceful Browsing. This issue affects Edit in-place field versions: from 0.0.0 to 2.1.1...

CVE-2026-79911 TOTOLINK N600R CGI cstecgi.cgi setSystemConfig stack-based overflow

A security vulnerability has been detected in TOTOLINK N600R 4.3.0cu.7647B20210106. The affected element is the function setSystemConfig of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. Such manipulation of the argument Hostname leads to stack-based buffer overflow. It is possible t...

CVE-2026-80138 ClipBucket V5 5.5.1 through 5.5.3-#153 OS Command Injection via Installer php_cli_filepath Parameter

ClipBucket V5's web installer fails to properly validate or escape the phpclifilepath parameter before passing it to shell execution. Unauthenticated attackers can submit a crafted POST request to the installer with a malicious phpclifilepath value to execute arbitrary commands as the web server...

CVE-2026-70665 Doorkeeper OpenID Connect: DCR endpoint persists unvalidated client-supplied scopes

Doorkeeper OpenID Connect implements an OpenID Connect authentication provider for Rails applications on top of Doorkeeper. Prior to 1.10.4, the Dynamic Client Registration DCR endpoint persists client-supplied scopes without validating them against the server's configured scope set. Under certai...

CVE-2026-63403 Faktory: Unrecovered panic in command handlers allows full-server denial of service

Faktory is a language-agnostic background job server. In versions prior to 1.10.0, the server is vulnerable to an unauthenticated denial of service in which a single malformed command crashes the entire process. Its wire protocol is line-based, and several command handlers slice or index the...

CVE-2026-73180 Apache Tomcat: Authenticated WebSocket session survives end of HTTP session

Insufficient Session Expiration vulnerability in Apache Tomcat meant that if the session ID for an authenticated HTTP session was changed after a WebSocket connection had been established under that authenticated HTTP session, the WebSokcet session would not be closed as required by the Jakarta...

CVE-2026-63404 Faktory: Insecure predictable /tmp/redis.conf enables local Redis config hijack (network exposure / root RCE primitive)

Faktory is a language-agnostic background job server. In versions prior to 1.10.0, the embedded Redis bootstrapper is vulnerable to an insecure temporary file flaw that lets a local unprivileged user hijack the Redis configuration and escalate to root. It writes its startup configuration to a...

CVE-2026-68763 Apache Tomcat: DoS via allocation leak in HTTP/2 backlog tracking when a stream is reset

Uncontrolled Resource Consumption vulnerability in Apache Tomcat via an allocation leak in the HTTP/2 backlog tracking when a stream is reset This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from 9.0.39 through 9.0.120. The following versions were...

CVE-2026-79845 code-projects Simple Inventory System edit.php sql injection

A vulnerability was identified in code-projects Simple Inventory System 1.0. This vulnerability affects unknown code of the file /InventoryManagement/edit.php. The manipulation of the argument ID leads to sql injection. The attack is possible to be carried out remotely. The exploit is publicly...

CVE-2026-68569 Apache Tomcat: Principal lookup can fail open in some cases

Improper Authentication vulnerability in Apache Tomcat meant that in some circumstances e.g. CLIENT-CERT, SPNEGO that a user would be authenticated even if the user did not exist in the DataSourceRealm. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through...

CVE-2026-80185 Bluez: sdp-xml: bluez 5.86: unprivileged-local and adjacent-le-peer leads to arbitrary code execution as root

BlueZ sdp-xml.c type confusion via RegisterProfileServiceRecord can crash bluetoothd local DoS: a crafted nested ServiceRecord can corrupt the SDP XML parser stack so scalar union data is treated as a sequence pointer, allowing a local caller to crash bluetoothd...

CVE-2026-80186 Bluez: stack overflow in name2utf8 causes dos and potential code execution

A stack-based buffer overflow vulnerability exists in BlueZ, the Linux Bluetooth protocol stack. A remote user within Bluetooth radio range can send a specially crafted Extended Inquiry Response EIR packet that causes a buffer overflow when the target device performs Bluetooth discovery. This...

CVE-2026-68525 Apache Tomcat: Redirect after FORM auth may bypass method specific constraints

Incorrect Authorization vulnerability in Apache Tomcat's FORM authentication process allows the bypassing of a security constraint that limits user has access to a resource POST but not GET. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from...