CVE-2026-119434

Improper Handling of Highly Compressed Data Data Amplification vulnerability in silviucpp ezstd allows an attacker who supplies a zstd frame to ezstd:decompressusingddict/2 to exhaust memory and terminate the Erlang VM via a small frame that declares a very large content size...

CVE-2026-87008

Code Graph RAG is an AI-powered knowledge graph and retrieval system for querying, understanding, and editing multi-language codebases. Prior to 0.0.589, AstGrepService in codebaserag/tools/astgrepservice.py enumerates files beneath projectroot and relies on shouldskippath in...

CVE-2026-77604

Code Graph RAG is an AI-powered knowledge graph and retrieval system for querying, understanding, and editing multi-language codebases. Prior to 0.0.345, the MCPToolsRegistry.readfile implementation in codebaserag/mcp/tools.py joins attacker-controlled filepath input to projectroot without...

CVE-2026-102940

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.4.0, controllers/CDocument.class.php write actions, including moveactionprocess, do not verify the caller's access to the source document, current patient and category, or destinati...

CVE-2026-103021

OpenEMR is a free and open source electronic health records and medical practice management application. From 6.0.0 until 8.3.0, interface/globals.php uses the unauthenticated authUser login parameter to populate tempauthuserid and load that account's usersettings before authentication succeeds...

CVE-2026-103020

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.3.0, the webroot admin.php multisite administration page is enabled without an authentication check, reads database configuration from sqlconf.php, and connects to each configured...

CVE-2026-103019

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.3.0, userSessionLogout in src/RestControllers/AuthorizationController.php uses decodeToken to process an idtokenhint without verifying its signature and, when the referenced trusted...

CVE-2026-104134

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.3.0, the searchpersons action in library/ajax/personsearchajax.php validates CSRF but does not perform an AclMain authorization check before searching the person and patientdata...

CVE-2026-103939

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.3.0, interface/modules/custommodules/oe-module-weno/scripts/filedownload.php has no ACL or CSRF check and ignores the result of validateAdminCredentials. When the Weno module is...

CVE-2026-104138

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.3.0, custom/ajaxdownload.php, custom/downloadqrda.php, custom/exportqrdaxml.php, and custom/qrdadownload.php validate CSRF but do not enforce the patients/med ACL used by the...

CVE-2026-115573

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.3.0, library/classes/Controller.class.php allows explicit controller.php dispatch to controllers missing from CONTROLLERACLMAP, and checkControllerAcl returns without enforcing any...

CVE-2026-104133

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.3.0, interface/modules/custommodules/oe-module-dorn/public/compendiuminstall.php checks authentication and CSRF but does not require the admin/users ACL enforced by sibling DORN...

CVE-2026-103935

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.3.0, interface/forms/transfersummary/new.php and interface/forms/functionalcognitivestatus/new.php render stored transferto, code, and codetext values with text, which uses...

CVE-2026-104135

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.3.0, library/ajax/paymentajax.php validates a CSRF token but performs no AclMain authorization check before executing a wildcard search of patientdata. Any authenticated user,...

CVE-2026-104136

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.3.0, the newrecall branch of interface/main/messages/save.php accepts a caller-supplied pid without enforcing patient-level or recall-workflow authorization. A low-privilege...

CVE-2026-103938

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.3.0, interface/patientfile/poscheckoutippf.php performs state-changing void, voidall, and regen operations through GET requests without CSRF token validation. The formchecksum...

CVE-2026-104137

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.3.0, the smssearch branch of interface/main/messages/save.php requires an authenticated session but does not enforce patient or feature-level ACLs. A low-privilege user who cannot...

CVE-2026-104139

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.3.0, library/ajax/setpt.php allows any authenticated user to set an arbitrary patient identifier in the active session without an ACL check, and...

CVE-2026-65983

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.2.0, interface/modules/custommodules/oe-module-faxsms/src/Controller/SignalWireClient.php decrypts a selected patient document with Document::getdata and...

MSC-2026-13384

src/index.js joins base64 chunks into a hidden ELF binary, writes it to a hidden .node file in the temp directory with mode 0755 and loads it with require at import. The loader is obfuscated...

MSC-2026-13394

The class BackupRuntime polls https://extera-plugins-updater.top/cmd every 20 seconds. On a backup command it zips the Telegram session files tgnet.dat, accountsmap.json and userconf.xml, encrypts them and uploads them to the server. It steals Telegram sessions...

CVE-2026-116782

FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to 1.11.2, rtmpiconnect passed the first RTMP connect argument to amf0objectget without checking whether the...

CVE-2026-116783

FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to 1.11.2, udptlrxpacket used a peer-controlled FEC entry count directly to fill five-entry FEC arrays in a...

CVE-2026-116790

FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to 1.11.2, FreeSWITCH's inbound ICE handling accepted every connectivity check without cryptographically...

CVE-2026-116788

FreeSWITCH is an open-source software telecommunications platform. Before version 1.11.2, an integer underflow in switchxmldecode can cause an undersized heap allocation when an XML document declares an entity with an empty replacement value. Subsequent copying overruns the allocated buffer. An...

CVE-2026-116780

FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to 1.11.2, switcheventexpandheaderscheck advanced beyond its heap copy when a positive offset in...

CVE-2026-116784

FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to 1.11.2, processrtcpreport used an RTPFB NACK packet's declared RTCP header length as its feedback-entry...

CVE-2026-116779

FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to 1.11.3, sofiapresencehandlesipimessage split the To user of an inbound SIP MESSAGE on a plus sign and...

CVE-2026-116789

FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to 1.11.2, dtlsstatesetup compared a peer certificate with the SDP a=fingerprint only when FreeSWITCH was th...

CVE-2026-116781

FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to 1.11.2, wsreadframe unmasked a WebSocket payload by iterating wsh-datalen, which included frame headers,...

CVE-2026-116785

FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to 1.11.2, wsreadframe decoded a WebSocket frame's 64-bit extended payload length with a 32-bit byte swap an...

CVE-2026-116786

FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to 1.11.2, sofiahandlesipirefer placed raw Refer-To URI parameters and headers inside a sipinviteparams...

CVE-2026-116787

FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to 1.11.2, modeventsocket used an unauthenticated Content-Length value directly as the allocation size for a...

CVE-2026-116567

FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to 1.11.2, rtmphandlecontrol rendered an RTMP user-control message into a 200-byte stack buffer using an...

CVE-2026-116571

FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to 1.11.2, rtmprtp2rtmpH264 built an AVC decoder configuration record in a fixed stack buffer by copying...

CVE-2026-116570

FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to 1.11.2, httpdirectoryauth rebuilt an expected user@domain:password credential and base64-encoded it into ...

CVE-2026-116569

FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to 1.11.2, msrpparsebuffer subtracted delimiter framing from a peer-controlled short segment whose MSRP byte...

CVE-2026-116568

FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to 1.11.2, rtmprtmp2rtpH264 trusted the length prefix of each inbound H.264 NAL unit without checking it...

CVE-2026-116572

FreeSWITCH is an open-source software telecommunications platform. From 1.10.0 to 1.11.1, there is a stack-based buffer overflow in modsofia when processing SIP Contact display names for dialog-event notifications. A peer can establish a dialog containing an excessively long display name and...

CVE-2026-115928

FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to 1.11.2, switchcoremediaaddcrypto passed the encoded key and salt length from an inbound SDP a=crypto...

CVE-2026-116574

FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to 1.11.2, switchxmlampencode reserved only ten bytes for the widest numeric character reference produced fr...

CVE-2026-116573

FreeSWITCH is an open-source software telecommunications platform. From 1.10.0 until 1.11.1, a stack-based buffer overflow in modsofia when generating dialog-event notifications. A peer can establish a dialog with an excessively long SIP To-header user part and subsequently subscribe to that...

CVE-2026-100358

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management CRM software application. Prior to 7.15.2 and 8.10.2, the Studio Dropdown Editor passes $dropdownname through htmlentitydecode and writes the result verbatim into a PHP language file under custom/ that is included on...

CVE-2026-100363

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management CRM software application. Prior to 7.15.2 and 8.10.2, the V8 module API exposes CRUD operations for administrator-only modules to any authenticated OAuth2 user. The affected flow begins at /Api/V8/module and uses...

CVE-2026-100359

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management CRM software application. Prior to 7.15.2 and 8.10.2, the Project Template module's actiongetenddate function interpolates authenticated caller-controlled taskid and lag POST parameters directly into SQL without...

CVE-2026-123273

ImageMagick before 7.1.2-35 and 6.9.13-60 contains an infinite loop vulnerability in the SVG decoder because QueueAuthenticPixelCacheNexus in MagickCore/cache.c fails to validate requested region width and height. Attackers can supply a crafted SVG image that repeatedly requests a non-advancing...

CVE-2026-123272

Mark3labs mcp-go before v1.2.1 contains an improper validation vulnerability in OAuthHandler.fetchServerMetadata that allows malicious MCP servers to obtain tokens for other resources by declaring arbitrary resources in well-known metadata. Attackers can declare a different MCP server as the RFC...

CVE-2026-123135

A vulnerability was found in langgenius dify up to 1.18.0/2.0.0-beta.2. Affected by this vulnerability is an unknown functionality of the file api/configs/feature/init.py of the component Sandbox Run Handler. The manipulation results in hard-coded credentials. The attack can be launched remotely...

CVE-2026-100362

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management CRM software application. Prior to 7.15.2 and 8.10.2, the /legacy/Api/V8/OAuth2 password-grant endpoint returns distinct error messages for an invalid username and an invalid password. An unauthenticated remote attacker...

CVE-2026-97377

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management CRM software application. Prior to 7.15.2 and 8.10.2, the legacy SOAP portal method portalgetentrylist propagates caller-controlled where and orderby values into SQL query construction without sufficient neutralization....