CVE-2026-22094 Weak root password in EVbee DC 80

The firmware for the EVbee DC-80 has a weak hardcoded root password, which allows attackers to login as root using the SSH daemon that is exposed to the network...

CVE-2026-22101 Sensitive information leak through hidden menu

The access to the service menu is obfuscated, but possible with only physical access. This menu exposes sensitive information such as serial numbers, MAC addresses, and WiFi network and password...

CVE-2026-102569 ClipBucket v5 through 5.5.3-#197 SQL Injection via videoid Parameter

ClipBucket v5 through 5.5.3-197 contains a time-based blind SQL injection vulnerability in the admin video edit function where the videoid parameter is concatenated into an UPDATE statement without proper escaping. An authenticated administrator with videomoderation permission can inject arbitrar...

CVE-2026-102570 ClipBucket v5 through 5.5.3-#197 SQL Injection via language_id Parameter

ClipBucket v5 through 5.5.3-197 contains a time-based blind SQL injection vulnerability in the language update function where the languageid parameter is concatenated unescaped into the WHERE clause of an UPDATE statement. An authenticated administrator with basicsettings permission can inject...

CVE-2026-102568 Pardus Parental Control before 0.7.0 Incorrect Authorization via PPCActivator.py

Pardus Parental Control before 0.7.0 contains an incorrect authorization vulnerability in the polkit policy that allows unprivileged local users to disable parental controls as root. Attackers can invoke PPCActivator.py with the --disable argument via pkexec to remove all restrictions including D...

CVE-2026-102566 CTranslate2 before 4.8.1 Heap Buffer Overflow via model.bin

CTranslate2 before 4.8.1 contains a heap-based buffer overflow in the binary model loader that fails to validate payload length against allocated buffer size. Attackers can craft malicious model files with oversized payload lengths to write past heap allocation boundaries, causing crashes or...

CVE-2026-102567 CTranslate2 before 4.8.1 Out-of-Bounds Read via Model Deserialization

CTranslate2 before 4.8.1 contains an out-of-bounds heap read vulnerability in the binary model loader when deserializing string fields without null terminators. Attackers can craft malicious model files to trigger heap memory reads past buffer boundaries, causing crashes or disclosing adjacent he...

CVE-2025-33207

NVIDIA ConnectX and Bluefield contain a vulnerability in a control register, where a user with VF access could cause improper access control for the register interface by sending a malicious command to the firmware. A successful exploit of this vulnerability might lead to denial of service...

CVE-2026-102371 wsl-pro-service: Ubuntu Pro token exposed via process command-line arguments

In wsl-pro-service before 0.1.19ubuntu3, the service component which runs as root inside each WSL instance attaches the instance to Ubuntu Pro by executing the pro client with the Ubuntu Pro token passed as a command-line argument pro attach . On systems where /proc is mounted without...

CVE-2026-65102

NVIDIA DeepStream contains a vulnerability where an attacker could cause an integer overflow by supplying crafted tensor dimensions in a YAML configuration file. A successful exploit of this vulnerability might lead to denial of service, information disclosure, data tampering...

CVE-2026-97395 Apache Polaris: Allows authorized table writers to redirect server-side Iceberg FileIO requests to attacker-controlled endpoints using operation-scoped storage credentials

Apache Polaris allows an authenticated principal with permission to create or update Iceberg table properties to set FileIO client settings such as s3.endpoint in table metadata. In versions 1.8.0, when Polaris performs server-side Iceberg operations, including commits and purges, it may use thos...

CVE-2026-86450 Sensitive Data Exposure in Parla Auto's DetaWix Mobile Web Portal

Insertion of sensitive information into sent data vulnerability in Parla Auto Automotive Trading Limited Company DetaWix Mobile Web Portal allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects DetaWix Mobile Web Portal: before v1.0.19...

CVE-2026-102521 lib0 `readFromDataView` out-of-bounds read

The decoder in readFromDataView in lib0 before 0.2.119 can be tricked into reading more than it should from a buffer. The vulnerability allows reading past the decoders' view, thus exposing adjacent process memory. This can be anything that is currently in the head, for example credentials or log...

CVE-2026-71897 Apache DolphinScheduler: Allows unauthorized workflow operations through batch-copy and batch-move endpoints

An improper authorization check in Apache DolphinScheduler allows an authenticated user to use the batch-copy and batch-move endpoints to operate on workflows in projects for which they lack the required permissions. This may allow the user to copy or move workflows from unauthorized projects. Th...

CVE-2026-102360 lib0 `readUint8Array` performs an unbounded read past the end of the decoder’s view, disclosing adjacent process memory

A missing bounds check in the binary decoder in lib0, versions 0.2.1-0.2.117 and earlier and 1.0.0-rc.32 and earlier, lets any unauthenticated remote peer read adjacent process memory and receive it back. readUint8Array never compares the wire-supplied length against the decoder's own view, so on...

CVE-2026-71898 Apache DolphinScheduler: Improper Authorization Allows Project Read-Only Users to Execute Workflows and Tamper with Workflow Definitions

An incorrect authorization check in Apache DolphinScheduler allows an authenticated user with only read permission for a project to modify a workflow instance in that project through the PUT /projects/projectCode/workflow-instances/id endpoint. The endpoint does not enforce the write permission...

CVE-2026-71899 Apache DolphinScheduler: Missing Authorization in query-dynamic-sub-workflows API Leads to Information Disclosure

A missing authorization vulnerability exists in the query-dynamic-sub-workflows API of Apache DolphinScheduler. The API does not properly verify whether the authenticated user has permission to access the workflows being queried. An authenticated user who does not have permission to access a...

CVE-2026-78214 Apache DolphinScheduler: Actuator Endpoint Authentication Bypass via Percent-Encoded Paths

An authentication bypass vulnerability exists in the protection of Actuator endpoints. The application determines whether authentication is required by matching the incoming request path against protected Actuator paths. By sending a specially crafted request containing a percent-encoded path, a...

CVE-2026-81569 Apache DolphinScheduler: Improper Authorization in Sub-Workflow Tasks Allows Unauthorized Workflow Execution

An improper authorization vulnerability exists in the handling of sub-workflow tasks. An authenticated user who does not have permission to access a target project can reference and invoke a workflow belonging to that project through a sub-workflow task. The system does not properly verify whethe...

CVE-2026-4034 TIBCO Administrator Injection Vulnerability

Injection Vulnerability in Tibco Administrator version 5.13.0 & prior allows an authenticated user to submit specially crafted input through the web-based administration console...

CVE-2026-82804 Apache DolphinScheduler: Command Injection in the Alert Script Plugin

The scriptPath parameter is incorporated into a /bin/sh -c command without sufficient neutralization of shell metacharacters, allowing shell command substitution and execution. An authenticated user can exploit this behavior by creating a resource whose filename contains shell command substitutio...

CVE-2026-76875 PyPy pyexpat ExternalEntityParserCreate Use-After-Free

PyPy before versions 3.11.16 and 3.12.14 contains a use-after-free vulnerability in the pyexpat module's ExternalEntityParserCreate function that allows attackers to corrupt memory by supplying a crafted XML document to applications that create external-entity sub-parsers without retaining a...

CVE-2026-100831 Use-after-free in the DOM: UI Events & Focus Handling component

Use-after-free in the DOM: UI Events & Focus Handling component. This vulnerability was fixed in Firefox ESR 153.4 and Firefox 157...

CVE-2026-100832 Use-after-free in the Graphics: Canvas2D component

Use-after-free in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox ESR 153.4, Firefox ESR 115.42, and Firefox ESR 140.17...

CVE-2026-100829 Mitigation bypass in the DOM: Security component

Mitigation bypass in the DOM: Security component. This vulnerability was fixed in Firefox ESR 153.4 and Firefox 157...

CVE-2026-100830 Mitigation bypass in the DOM: Navigation component

Mitigation bypass in the DOM: Navigation component. This vulnerability was fixed in Firefox ESR 153.4 and Firefox 157...

CVE-2026-100828 Mitigation bypass in the Bookmarks & History component

Mitigation bypass in the Bookmarks & History component. This vulnerability was fixed in Firefox ESR 153.4 and Firefox 157...

CVE-2026-100826 Denial-of-service in the Storage: StorageManager component

Denial-of-service in the Storage: StorageManager component. This vulnerability was fixed in Firefox ESR 153.4 and Firefox 157...

CVE-2026-100825 Use-after-free in the JavaScript Engine: JIT component

Use-after-free in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox ESR 153.4 and Firefox 157...

CVE-2026-100824 Privilege escalation in the Places component

Privilege escalation in the Places component. This vulnerability was fixed in Firefox ESR 153.4 and Firefox 157...

CVE-2026-100823 Spoofing issue in the Downloads component in Firefox for Android

Spoofing issue in the Downloads component in Firefox for Android. This vulnerability was fixed in Firefox 157...

CVE-2026-100821 Site isolation issue in the Panning and Zooming component

Site isolation issue in the Panning and Zooming component. This vulnerability was fixed in Firefox ESR 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17...

CVE-2026-100822 Spoofing issue in the Networking: HTTP component

Spoofing issue in the Networking: HTTP component. This vulnerability was fixed in Firefox ESR 153.4 and Firefox 157...

CVE-2026-100820 Privilege escalation in the Address Bar component

Privilege escalation in the Address Bar component. This vulnerability was fixed in Firefox ESR 153.4, Firefox 157, and Firefox ESR 140.17...

CVE-2026-100819 Sandbox escape due to incorrect boundary conditions in the XPCOM component

Sandbox escape due to incorrect boundary conditions in the XPCOM component. This vulnerability was fixed in Firefox ESR 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17...

CVE-2026-100818 Sandbox escape due to use-after-free in the Widget: Gtk component

Sandbox escape due to use-after-free in the Widget: Gtk component. This vulnerability was fixed in Firefox ESR 153.4, Firefox 157, and Firefox ESR 140.17...

CVE-2026-100817 Other issue in the JavaScript: WebAssembly component

Other issue in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 157...

CVE-2026-100816 Site isolation issue in the DOM: Networking component

Site isolation issue in the DOM: Networking component. This vulnerability was fixed in Firefox ESR 153.4 and Firefox 157...

CVE-2026-100814 Incorrect boundary conditions in the JavaScript Engine: JIT component

Incorrect boundary conditions in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox ESR 153.4 and Firefox 157...

CVE-2026-100815 Use-after-free in the CSS Parsing and Computation component

Use-after-free in the CSS Parsing and Computation component. This vulnerability was fixed in Firefox ESR 153.4 and Firefox 157...

CVE-2026-100812 Denial-of-service in the Graphics component

Denial-of-service in the Graphics component. This vulnerability was fixed in Firefox ESR 153.4 and Firefox 157...

CVE-2026-100813 Invalid pointer in the JavaScript Engine: JIT component

Invalid pointer in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 157...

CVE-2026-100810 Other issue in the DevTools component

Other issue in the DevTools component. This vulnerability was fixed in Firefox 157...

CVE-2026-100811 Sandbox escape due to use-after-free in the DOM: Core & HTML component

Sandbox escape due to use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox ESR 153.4, Firefox 157, and Firefox ESR 140.17...

CVE-2026-100809 Same-origin policy bypass in the DevTools component

Same-origin policy bypass in the DevTools component. This vulnerability was fixed in Firefox ESR 153.4 and Firefox 157...

CVE-2026-100808 Mitigation bypass in the DOM: Service Workers component

Mitigation bypass in the DOM: Service Workers component. This vulnerability was fixed in Firefox ESR 153.4 and Firefox 157...

CVE-2026-100807 Privilege escalation in the DOM: Service Workers component

Privilege escalation in the DOM: Service Workers component. This vulnerability was fixed in Firefox ESR 153.4, Firefox 157, and Firefox ESR 140.17...

CVE-2026-100806 Uninitialized memory in the Graphics: WebGPU component

Uninitialized memory in the Graphics: WebGPU component. This vulnerability was fixed in Firefox ESR 153.4 and Firefox 157...

CVE-2026-100805 Race condition, use-after-free in the Audio/Video component

Race condition, use-after-free in the Audio/Video component. This vulnerability was fixed in Firefox 157...

CVE-2026-100803 Same-origin policy bypass in the WebExtensions component

Same-origin policy bypass in the WebExtensions component. This vulnerability was fixed in Firefox ESR 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17...