CVE-2026-114375 leomoon-studios wiki-go Files Rename API files.go RenameFileHandler path traversal

A security flaw has been discovered in leomoon-studios wiki-go up to 1.9.1. Affected is the function RenameFileHandler of the file internal/handlers/files.go of the component Files Rename API. Performing a manipulation of the argument currentPath/newName results in path traversal. The attack can ...

CVE-2026-85518 Openscap: openscap: arbitrary file write via path traversal in source datastream decomposition

A flaw was found in OpenSCAP. When decomposing a Source DataStream SDS file, the application does not properly validate relative file path attributes, leading to a path traversal vulnerability. An attacker can exploit this flaw by tricking a user or automated system into decomposing a crafted...

CVE-2026-112408 Missing bucket ownership verification in Amazon SageMaker Python SDK default_bucket()

Missing verification of source of a communication channel in the defaultbucket function in Amazon SageMaker Python SDK V3 before 3.10.0 and V2 before 2.257.3 might allow remote actors to achieve code execution in the target SageMaker execution environment and obtain IAM credentials via pre-creati...

CVE-2026-114438 Keycloak-services: keycloak-services: required otp enrollment bypassed via update user locale required action ordering

A flaw was found in the Update User Locale required action of the Keycloak identity and access management solution. When this action is ordered before the Configure OTP action in a realm, the system may fail to enforce mandatory multi-factor authentication enrollment during the login process. Thi...

CVE-2026-114374 leomoon-studios wiki-go fetch-metadata Endpoint metadata_api.go server-side request forgery

A vulnerability was identified in leomoon-studios wiki-go up to 1.9.1. This impacts an unknown function of the file internal/handlers/metadataapi.go of the component fetch-metadata Endpoint. Such manipulation leads to server-side request forgery. It is possible to launch the attack remotely. The...

CVE-2026-112381 Apache Traffic Server: Nullptr dereference in net_write_io on a POST half-close with chunked response

Apache Traffic Server can crash with a null pointer dereference when a client POST request is torn down via half-close while a chunked origin response is being reparsed from a reentrant write-ready callback, a timing-dependent race introduced by the CVE-2021-32564 flow-control backports. This iss...

CVE-2026-111817 Apache Traffic Server: Dropping chunked trailers stalls a passthrough transfer until timeout

Apache Traffic Server can stall a chunked transfer that it passes through with its trailers removed proxy.config.http.dropchunkedtrailers until the connection times out, because it waits for the trailer bytes it has already dropped. Trailer dropping is on by default in 10.x. In 8.1.11 and 9.2.x i...

CVE-2026-111812 Apache Traffic Server: origin_server_auth signs client-controlled AWS headers under the proxy's IAM credentials

Apache Traffic Server's originserverauth plugin lets a client force signing of attacker-chosen AWS request headers under the proxy's own credentials. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0. Users are...

CVE-2026-111811 Apache Traffic Server: tsmemcache plugin exposes the shared proxy cache over the network with no authentication

Apache Traffic Server's experimental tsmemcache plugin allows unauthenticated network read, write, and deletion of the shared proxy cache. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0. Users are recommended to...

CVE-2026-111809 Apache Traffic Server: HEAD requests carrying Content-Length or Transfer-Encoding enable request smuggling

Apache Traffic Server allows request smuggling via HEAD requests that carry Content-Length or Transfer-Encoding. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0. Users are recommended to upgrade to version 9.2.16,...

CVE-2026-114362 HarnessRouter Targets Test Endpoint app.py server-side request forgery

A flaw has been found in HarnessRouter up to 0.31.12. This impacts an unknown function of the file gateway/app.py of the component Targets Test Endpoint. Executing a manipulation of the argument baseurl can lead to server-side request forgery. The attack may be performed from remote. Upgrading to...

CVE-2026-111810 Apache Traffic Server: Unthrottled per-header diagnostic logging enables a log-flood denial of service

Apache Traffic Server 9.2.15, 10.1.4 and 10.2.0 write one unthrottled diagnostic log line for every internal @ header they strip, so a request carrying many such headers makes the proxy write far more log data than the request contains. This issue affects Apache Traffic Server: 9.2.15, 10.1.4,...

CVE-2026-111815 Apache Traffic Server: TLS session ticket resumption bypasses per-SNI verify_client STRICT enforcement

Apache Traffic Server can resume a TLS session across SNI virtual hosts without re-verifying a client certificate required by the resumed host's verifyclient STRICT policy. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4,...

CVE-2026-111814 Apache Traffic Server: Default server_session_sharing.match omits MASK_CERT, allowing pooled mTLS identity confusion at the origin

Apache Traffic Server's default outbound session-sharing policy can reuse a pooled TLS session authenticated with one client certificate for a transaction configured to present a different one. This issue affects Apache Traffic Server: from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0...

CVE-2026-111808 Apache Traffic Server: HTTP/2 DATA frame padding underflow lets a client trigger backend worker-pool exhaustion

Apache Traffic Server can be used to exhaust an HTTP/1.1 origin's worker pool via a malformed padded HTTP/2 DATA frame. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0. Users are recommended to upgrade to version...

CVE-2026-111805 Apache Traffic Server: HTTP/2 Content-Length truncation lets a client trigger backend worker-pool exhaustion

Apache Traffic Server can be used to exhaust an HTTP/1.1 origin's worker pool via a truncated HTTP/2 Content-Length value. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0. Users are recommended to upgrade to versio...

CVE-2026-114361 HarnessRouter Identity Mode app.py improper authorization

A vulnerability was detected in HarnessRouter up to 0.31.10. This affects an unknown function of the file gateway/app.py of the component Identity Mode. Performing a manipulation of the argument X-Harness-Org/X-Harness-Member results in improper authorization. The attack is possible to be carried...

CVE-2026-114268 Tenda BE3L Pro WifiBasicSet formWifiBasicSet buffer overflow

A flaw has been found in Tenda BE3L Pro 16.03.60.62. Affected by this vulnerability is the function formWifiBasicSet of the file /goform/WifiBasicSet. This manipulation of the argument security5g causes buffer overflow. It is possible to initiate the attack remotely. The exploit has been publishe...

CVE-2026-114267 SourceCodester Food Order Management System Admin Endpoint authorization

A vulnerability was detected in SourceCodester Food Order Management System 1.0. Affected is an unknown function of the component Admin Endpoint. The manipulation results in missing authorization. The attack may be performed from remote. The exploit is now public and may be used...

CVE-2026-111816 Apache Traffic Server: A malformed 302 response bypasses parse-error rejection through the Transfer-Encoding: chunked carve-out

Apache Traffic Server forwarded a malformed 302 response that should have been rejected as a parse error, because the Transfer-Encoding: chunked carve-out bypassed the rejection path. A response that two peers can read differently is then stored and served, allowing cache poisoning and...

CVE-2025-55702 Apache Traffic Server: An unread Expect: 100-continue request body is framed as a new request

When a client sends a POST with Expect: 100-continue and the origin answers before reading the body, Apache Traffic Server parses the unread body left on the client connection as the next request. An attacker behind a front-end proxy that shares connections to Traffic Server can use this to smugg...

CVE-2026-110803 Session Lock Leak on an Invalid UI Id Allows Denial of Service in Vaadin Framework 8

VaadinService.requestEnd in Vaadin Framework 8 locks the session and then reads the v-uiId request parameter outside the block that releases the lock. A request carrying a non-numeric v-uiId makes Integer.parseInt throw while the session lock is held, so the lock is never released and the contain...

CVE-2026-107588 Multiple Vulnerabilities in the Highcharts Library Bundled with Vaadin Charts

Vaadin Charts renders charts with the Highcharts library and pins an exact version of it, 9.2.2 in Vaadin 22 to 24 and 12.2.0 in Vaadin 25, so an application cannot remove these vulnerabilities by upgrading Highcharts on its own. Highsoft disclosed several vulnerabilities in that library that are...

CVE-2025-31699 Apache Traffic Server: Origin connection still owed a request body is reused, enabling request smuggling

Apache Traffic Server can return an origin connection to the shared pool while the origin is still waiting on a request body the client declared but never fully sent, including when the client used Expect: 100-continue. The origin then reads a later request on that connection as leftover body dat...

CVE-2026-111804 Apache Traffic Server: wasm plugin has a use-after-free and forwards unvalidated guest metric IDs

Apache Traffic Server's experimental wasm plugin has a use-after-free in its transaction-close handler and forwards unvalidated guest-supplied metric IDs to the internal stats API. This issue affects Apache Traffic Server: from 10.0.0 through 10.1.4, 10.2.0. Users are recommended to upgrade to...

CVE-2026-111813 Apache Traffic Server: magick plugin passes client query strings unfiltered to ImageMagick convert in the default configuration

Apache Traffic Server's experimental magick plugin lets an unauthenticated client control ImageMagick convert arguments in its default unsigned configuration. This issue affects Apache Traffic Server: from 8.0.1 through 8.1.11, from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0. Users...

CVE-2026-19947 Missing kernel object permission check in devmux syscalls allows unprivileged user threads to retarget a device multiplexer

The device multiplexer pseudo-driver in drivers/misc/devmux/devmux.c exposes two system calls, devmuxselectget and devmuxselectset. When CONFIGUSERSPACE is enabled, their user-mode verifiers zvrfydevmuxselectget and zvrfydevmuxselectset forwarded directly to the kernel implementations without...

CVE-2026-79976 NULL pointer dereference in the MCTP I2C+GPIO target binding triggerable by a peer I2C controller

The MCTP-over-I2C+GPIO target binding in subsys/pmci/mctp/mctpi2cgpiotarget.c emulates a small pseudo-register file, where the bus controller first writes a register number and then writes or reads payload bytes. The selected register b-regaddr and the data-phase flag b-rxtx were never cleared wh...

CVE-2026-78119 Out-of-bounds write in the Nuvoton NPCX eSPI Target-Attached-Flash receive path from an unvalidated host-supplied packet length

The Nuvoton NPCX eSPI driver parses Target-Attached-Flash TAF requests in espitafparse drivers/espi/espinpcx.c, taking the 12-bit length field directly out of the request header in the FLASHRXBUF FIFO. For write and RPMC OP1 requests it copied DIVROUNDUPlen, 4 words into struct espitafpckt.src, a...

CVE-2026-78118 Race condition on kernel wait queues: unlocked z_waitq_head() read in the timer expiration handler can yield a stale or sentinel thread pointer on SMP

The kernel helper zwaitqhead kernel/include/waitq.h reads the head of a thread wait queue, but on SMP systems it was called from several places without holding the scheduler spinlock schedspinlock that serializes wait-queue mutation. The consequential call site is ztimerexpirationhandler in...

CVE-2026-78117 Race condition on shared HCI TX descriptor in the Infineon PSOC 6 BLESS Bluetooth driver can leak adjacent memory over the air

The Infineon PSOC 6 BLESS HCI driver in drivers/bluetooth/hci/hciinfineonpsoc6bless.c stored the outgoing HCI packet descriptor in a file-scope variable, static cystcblehcitxpacketinfot hcitxpkt. psoc6blesssend cleared and populated that descriptor's packetType, dataLength and data fields before...

CVE-2026-18748 Out-of-bounds read in Bluetooth Classic A2DP codec information element handling

The Bluetooth Classic A2DP host stores a codec Information Element IE in struct bta2dpcodecie, a one-byte len field plus a fixed 8-byte codecie array. When an AVDTP peer sent a codec IE longer than 8 bytes, a2dpprocessconfigind in subsys/bluetooth/host/classic/a2dp.c copied only the first 8 bytes...

CVE-2026-78116 Double free of an RTIO submission in the Broadcom AFBR-S50 sensor driver data-evaluation error path

The Broadcom AFBR-S50 time-of-flight sensor driver double-completes an RTIO submission when sensor data evaluation fails. In datareadyworkhandler drivers/sensor/broadcom/afbrs50/afbrs50.c, a non-STATUSOK return from ArgusEvaluateData calls handleerroronresult, which finalises the request with...

CVE-2026-19676 PECI transfer syscall verifier does not validate embedded user buffer pointers, allowing arbitrary kernel memory read/write from user mode

The user-mode verifier for the pecitransfer system call, zvrfypecitransfer in drivers/peci/pecihandlers.c, checked only the device object permission and copied the caller-supplied struct pecimsg with kusermodefromcopy. That copy validates the outer structure only; the buf pointers and len values...

CVE-2026-105945 Apache Pulsar: Improper Validation of Package Name Components Allows Cross-Tenant Package Access in Filesystem Package Storage

The Pulsar Packages Management Service can be configured to store packages on the local filesystem of the broker by using the filesystem storage provider. Package names consist of a type, tenant, namespace, name and version. Authorization of package operations is based only on the tenant and...

CVE-2026-105944 Apache Pulsar Manager: Missing authentication and authorization and disclosure of the Pulsar admin credential; end of life

Apache Pulsar Manager is a web console for administering Apache Pulsar clusters. It has its own user accounts and login, and it can be configured with an HTTP authentication credential, such as a token, that it uses to call the Pulsar admin API on behalf of its users. Pulsar Manager has the...

CVE-2026-114266 ProjectWorlds Advanced Library Management System profile.php mysqli_query sql injection

A security vulnerability has been detected in ProjectWorlds Advanced Library Management System 1.0. This impacts the function mysqliquery of the file profile.php. The manipulation of the argument adminid leads to sql injection. The attack is possible to be carried out remotely. The exploit has be...

CVE-2026-105942 Apache Pulsar: Original principal of proxied requests authorized with the proxy's authentication data, allowing privilege escalation

When a configured proxy role sends a request to the broker on behalf of another user the original principal, the broker is designed to authorize both the proxy role and the original principal and to allow the request only if both are authorized, so that the original principal cannot exceed its ow...

CVE-2026-105938 Apache Pulsar: Subscription authorization policies not enforced by namespace-level backlog and unsubscribe operations and by topic expire-all

Apache Pulsar namespaces can restrict which roles may use a subscription, either with the Prefix subscription authentication mode, which requires a subscription name to start with the role name, or by granting permission on a subscription to specific roles. Topic-level subscription operations, su...

CVE-2026-105937 Apache Pulsar: Missing authorization of the shadow topic source allows cross-tenant message disclosure and deletion of source topic data

Apache Pulsar shadow topics PIP-180 are topics that read the stored messages of a source topic from that topic's managed ledger. The source topic is selected by setting the reserved topic property PULSAR.SHADOWSOURCE. The admin REST API accepts this property when creating a non-partitioned or...

CVE-2026-113461 mk-oracle: Local privilege escalation via insecure Oracle Home library loading

Local privilege escalation in Checkmk 2.5.0p14 allows a local user with write access to the Oracle client library directory of an Oracle home listed in the 'oratab' file or to the 'oratab' file itself to execute code as root if an agent has the 'mk-oracle' plugin enabled...

CVE-2026-105936 Apache Pulsar: Functions connectors list endpoint does not apply the super-user check of the worker connectors endpoint

The Pulsar Functions worker REST API provides two endpoints that return the catalog of Pulsar IO connectors installed on the functions worker: the worker connectors endpoint /admin/v2/worker/connectors and the deprecated functions connectors endpoint /admin/v2/functions/connectors and...

CVE-2026-105935 Apache Pulsar: Function trigger publishes to the input topic without checking the caller's produce permission

The Pulsar Functions Worker provides a REST API endpoint for triggering a function, which publishes a caller-supplied value to one of the function's configured input topics. The Functions Worker performs this publish with its own broker client, which authenticates with the Worker's configured...

CVE-2026-105934 Apache Pulsar: Missing tenant admin authorization check when truncating a partitioned topic

The Apache Pulsar broker admin REST API provides a truncate operation for persistent topics DELETE /admin/v2/persistent/tenant/namespace/topic/truncate. Truncating a topic moves all subscription cursors of the topic to the end of the topic and deletes the topic's inactive ledgers. Truncating a...

CVE-2026-105933 Apache Pulsar: Namespace encryption requirement not enforced after a failure during topic initialization

Apache Pulsar allows an administrator to require end-to-end message encryption for all topics in a namespace by setting the encryptionrequired namespace policy. When this policy is set, the broker rejects messages that are published without encryption. When the broker loads a persistent topic, it...

CVE-2026-105932 Apache Pulsar: Missing topic policy authorization on non-persistent topic entry filter endpoints

The Apache Pulsar broker admin REST API provides endpoints to read, set and remove the topic-level entry filter policy of a topic. For persistent topics these endpoints check that the caller is authorized for the entry filters topic policy operation. The corresponding endpoints for non-persistent...

CVE-2026-113870 Improper Encoding of Server-Supplied JavaScript Values in MongoDB Compass BSON Parsing

MongoDB Compass improperly escapes certain BSON values when converting a stored view’s aggregation pipeline into editable source. When a user connects to a MongoDB deployment containing a specially crafted view and opens that view for editing, the values can cause arbitrary code to execute with t...

CVE-2026-111401 WordPress Tailored Tools plugin <= 3.0.3 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability in Tailored Media Tailored Tools tailored-tools allows Cross Site Request Forgery.This issue affects Tailored Tools: from n/a through 3.0.3...

CVE-2026-105931 Apache Pulsar: Missing authorization on transaction admin endpoints exposes transaction coordinator and transaction statistics of other tenants

The Apache Pulsar broker exposes a transaction administration REST API under /admin/v3/transactions. When authentication and authorization are enabled, most of the read endpoints of this API verify only that the request is authenticated and that the broker serves the requested topic or transactio...

CVE-2026-105930 Apache Pulsar: Improper Authorization of Function, Source and Sink Package URLs Allows Cross-Tenant Package Download

When package management is enabled, Pulsar Functions, Sources and Sinks can be registered or updated from a package stored in the Pulsar Packages Management Service by supplying a package URL. The Pulsar Functions worker authorized these requests only against the namespace in which the component...