CVE-2026-125108

Rack is a modular Ruby web server interface. Prior to 2.2.25, 3.1.23, and 3.2.8, Rack::Multipart::Parser.parseboundary can skip a leading empty or quoted boundary parameter in a multipart Content-Type header and accept a later parameter. Rack can therefore parse a request body with a boundary tha...

CVE-2026-77473

AsyncSSH is a Python package which provides an asynchronous client and server implementation of the SSHv2 protocol on top of the Python asyncio framework. Prior to 2.24.1, recursive remote-to-local SFTP copies in SFTPClient.copy in asyncssh/sftp.py, reached through get, mget, and copy, trust...

CVE-2026-102643

AsyncSSH is a Python package which provides an asynchronous client and server implementation of the SSHv2 protocol on top of the Python asyncio framework. Prior to 2.24.1, SFTPServer.mappath uses posixpath.normpath on a client-supplied path and removes only one leading slash before passing the...

CVE-2026-124996

A weakness has been identified in Turboderp-org ExLlamaV3 up to 1.6.3. The impacted element is the function routingselnormkernel of the file exllamav3/exllamav3ext/routing.cu of the component hash-MoE routing. This manipulation of the argument gate.tid2eid causes out-of-bounds read. Remote...

CVE-2026-102289

zizmor is a static analysis tool for CI/CD systems. In version 1.27.0, debug logging serializes the parsed application configuration with a derived Debug implementation for GitHubToken, causing credentials supplied through GHTOKEN, GITHUBTOKEN, ZIZMORGITHUBTOKEN, --gh-token, --github-token, or...

CVE-2026-61812

ModSecurity is an open source, cross platform web application firewall WAF engine for Apache, IIS and Nginx. Prior to 2.9.15 and 3.0.17, t:htmlEntityDecode recognizes only a small subset of named HTML entities, so rules that depend on the transformation can inspect different bytes than a browser ...

CVE-2026-73857

ModSecurity is an open source, cross platform web application firewall WAF engine for Apache, IIS and Nginx. From 3.0.15 until 3.0.17, XML request body processing with SecParseXmlIntoArgs set to On or OnlyArgs can leave XMLNodes::parsingctxarg uninitialized in the SAX end-element callback. A sing...

CVE-2026-104259

ModSecurity is an open source, cross platform web application firewall WAF engine for Apache, IIS and Nginx. Prior to 2.9.15 and 3.0.17, msrefnremoveCommentsexecute in apache2/retfns.c and inplace in src/actions/transformations/removecomments.cc implement t:removeComments by copying the character...

CVE-2026-125107

Muhammara is a node module with c/cpp bindings to modify PDF with JavaScript for node or electron. Prior to 6.0.5, Muhammara PDFParser::CreateFilterForStream in src/deps/PDFWriter/PDFParser.cpp dereferences a null PDFInteger pointer when a PDF stream uses the LZWDecode filter with a DecodeParms...

CVE-2026-125106

Wagtail is an open source content management system built on Django. Prior to 7.0.9, 7.3.4, 7.4.3, and 8.0rc2, a Wagtail CMS user with the submit translations permission can call the Admin API copy for translation action for a source page that the user cannot edit. The action copies the...

CVE-2026-125105

Wagtail is an open source content management system built on Django. Prior to 7.0.9, 7.3.4, 7.4.3, and 8.0rc2, Wagtail applies ETag conditional request processing to the document serve endpoint before document permission and filename checks complete. An unauthenticated attacker who knows a docume...

CVE-2026-123820

Wagtail is an open source content management system built on Django. Prior to 7.0.9, 7.3.4, 7.4.3, and 8.0rc2, the Wagtail Documents and Images API V2 excludes directly restricted collections but fails to exclude their descendant collections, even though descendants inherit ancestor view...

CVE-2026-63644

bird-lg-go is a BIRD looking glass in Go. Prior to version 1.4.7, unsanitized input path enables arbitrary local file read, allowing an unauthenticated remote attacker to read sensitive files such as /etc/shadow and /root/.bashhistory. This issue has been patched in version 1.4.7...

CVE-2026-123819

Wagtail is an open source content management system built on Django. Prior to 7.0.9, 7.3.4, 7.4.3, and 8.0rc2, a CMS user who has add permission for a snippet model but lacks change and view permission for an existing snippet can access the snippet copy view and copy that source object. The copy...

CVE-2026-123818

LMDeploy is a toolkit for compressing, deploying, and serving large language models. From 0.12.3 until 0.15.0, issafeurl validates remote media URLs with urlparse while requests.Session.get interprets backslashes differently when sending the request. An attacker can provide a URL whose validation...

CVE-2026-123817

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, the WebSocket reader retains one bytes object for each transport read while reassembling an incomplete frame. A malicious peer can split a frame into many tiny reads so per-object overhead substantial...

CVE-2026-115864

Monoceros versions before 0.30 for Perl allow a request declaring a large Content-Length to kill a worker by exhausting memory. The request body is read in a loop that asks sysread for all of the remaining declared length at once. Perl grows the read buffer to that size before any data arrives, s...

CVE-2026-123816

pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev101, Api.checkapikey caches successful validation in self.apikeycache using only the attacker-controlled keyid. After a legitimate key populates the cache, a forged API key with the same keyid reaches the...

CVE-2026-123815

pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev102, UnTar.safeextractall in src/pyload/plugins/extractors/UnTar.py validates archive member paths and link targets but does not call TarInfo.isdev to reject special tar member types before calling...

CVE-2026-123814

pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev102, an authenticated non-admin user with the SETTINGS permission can configure WindowsPhoneNotify through /json/saveconfig by setting pushurl, pushid, and enabled. WindowsPhoneNotify.send in...

CVE-2026-123813

pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev102, pyLoad does not invalidate existing Flask sessions when an administrator changes a user's permissions or password through /api/setuserpermission or /api/changepassword. Api.setuserpermission and...

CVE-2026-124033

The export-cluster-logs and export-image-logs commands in the AWS ParallelCluster CLI before version 3.16.0 contain a relative path traversal issue. An authenticated remote user with write access to the log export Amazon S3 bucket could use a crafted S3 object key to write files outside the...

CVE-2026-123812

Dynatrace MCP Server is an MCP server for Dynatrace Observability. Prior to 1.8.7, the createdynatracenotebook registration in src/index.ts performs a persistent document-write action without calling requestHumanApproval, although the project's other write tools use that gate to obtain operator...

CVE-2026-123811

Dynatrace MCP Server is an MCP server for Dynatrace Observability. Prior to 2.0.0, a server started with the --http option accepts JSON-RPC tools/call requests without authentication, session validation, or Host and Origin protections before dispatching them under the server's configured Dynatrac...

CVE-2026-63634

pympp is a Python SDK for the Machine Payments Protocol. Prior to version 0.9.1, when the server acts as the feepayer, pympp validates calldata using ethabi decoding, which is lenient about trailing bytes. The FeePayerPolicy caps gaslimit ≤ 2 M and maxfeepergas ≤ 100 Gwei but does not check...

CVE-2026-123810

Dynatrace MCP Server is an MCP server for Dynatrace Observability. Prior to 2.1.1, several read capabilities interpolate caller-controlled values into DQL without sufficient validation or escaping. The src/capabilities/find-monitored-entity-by-name.ts capability embeds entityNames in string...

CVE-2026-63496

augment-vir is a collection of helper functions. Prior to version 31.73.5, the grep function exported by @augment-vir/node inserts caller-controlled search patterns directly into a double-quoted shell command string without sanitization grep.ts:310. When the constructed command is passed to spawn...

CVE-2026-123809

Dynatrace MCP Server is an MCP server for Dynatrace Observability. Prior to 2.0.0, the createworkflowfornotification tool inserts the caller-controlled teamName, problemType, and channel values into a Dynatrace workflow without neutralizing Jinja2 expressions. A caller can place template...

CVE-2026-63497

titra is an open source time tracking project. In versions 1.0.3 and prior, authenticated API users can abuse the customfields object to inject or overwrite top-level fields in MongoDB documents. At time of publication, there are no publicly known patches...

CVE-2026-124994

A security flaw has been discovered in Turboderp-org ExLlamaV3 up to 1.6.3. The affected element is the function ngramdequant of the file exllamav3/exllamav3ext/ngram.cu of the component NGramEmbedding. The manipulation of the argument headbias results in out-of-bounds read. The attack may be...

CVE-2026-123808

Nuxt UI is an intuitive Vue UI library powered by Reka UI and Tailwind CSS. Prior to 4.8.1, the server-rendered form element produced by UForm in src/runtime/components/Form.vue omits the method and action attributes and relies solely on the hydrated @submit.prevent handler to stop native...

CVE-2026-123807

Signal K Server is a server application that runs on a central hub in a boat. From 2.0.0 until 2.34.0 for Signal K Server and from 1.0.0 until 1.5.3 for @signalk/resources-provider, the v2 REST route GET /signalk/v2/api/resources/:resourceType/:resourceId accepts an unsafe resourceId that can...

CVE-2026-122056

A flaw was found in OpenSCAP. A heap-based buffer overflow can occur when processing a specially crafted Extensible Configuration Checklist Description Format XCCDF document using the sds-compose option. An attacker could exploit this vulnerability to corrupt memory, resulting in an application...

CVE-2026-124992

A vulnerability was identified in nushell up to 0.116.1. Impacted is the function escapebytes of the file crates/nu-json/src/ser.rs of the component Data Conversion Handler. The manipulation leads to improper neutralization of escape, meta, or control sequences. The attack must be carried out...

CVE-2026-119759

TrailBase 0.28.2 before 0.35.10 contains an insecure direct object reference vulnerability that allows authenticated attackers to manipulate the object-store id metadata within std.FileUpload columns without ownership validation during insert and update operations. Attackers can reference another...

CVE-2026-56712

Replicate Cog through 0.23.1 contains a server-side request forgery vulnerability that allows attackers to cause the Cog process to make server-side HTTP requests by submitting prediction inputs with attacker-controlled URLs that are not validated against the resolved destination host or IP befor...

CVE-2026-123806

python-tuf is a Python reference implementation of The Update Framework TUF. Prior to 7.0.0, DelegatedRole.istargetinpathpattern in tuf/api/payload.py uses fnmatch.fnmatch, which applies os.path.normcase before matching and makes delegation path authorization case-insensitive on Windows. When a T...

CVE-2026-84410

In apport before 2.37.0, an improper privilege management vulnerability allows an unprivileged local attacker to gain root privileges on systems where automatic crash reporting is enabled. The automatic crash report processing pipeline runs as root and executes ldd on the attacker-controlled...

CVE-2026-86692

In apport before 2.37.0, a path traversal vulnerability allows an attacker who can supply a crafted crash report to cause unintended file creation or overwrite outside the intended extraction directory when the report is processed with apport-unpack. The key-name validation added for CVE-2026-771...

CVE-2026-119078

Apache Commons Codec's Blake3 class documented the output of its doFinalize methods as depending on any previously finalized bytes, so that consecutive calls would return different output. In fact, doFinalize does not change the hash state: calling it again without supplying more input returns th...

CVE-2026-124077

The GitIdentifiers class in Apache Commons Codec did not reject NUL bytes in tree entry names. Because Git uses a NUL byte to mark the end of each entry name in a tree object, a crafted name could make one tree serialize to the same bytes as a different tree. Two different directory trees could...

CVE-2026-123805

SIPSorcery is a WebRTC, SIP, and VoIP library for C and .NET. Prior to 10.0.14, SctpSackChunk.ParseChunk reads the numGapAckBlocks and numDuplicateTSNs fields from an attacker-controlled SCTP SACK chunk without checking that the corresponding entries fit the declared chunk length. A negotiated...

CVE-2026-124987

A vulnerability has been found in mikefarah yq up to 4.53.3. This affects the function Encode of the file pkg/yqlib/encoderproperties.go. Such manipulation leads to escaping of output. It is possible to launch the attack remotely. The pull request to fix this issue awaits acceptance...

CVE-2026-87857

Temporal Server does not bind a workflow-history pagination token to the namespace and workflow named in the request that presents it. GetWorkflowExecutionHistory and GetWorkflowExecutionHistoryReverse authorize the caller against the namespace in the request, then select history from the branch...

CVE-2026-124834

A security vulnerability has been detected in iomad up to 4.5.15/5.0.11/5.1.8/5.2.4. Affected by this issue is the function storetemporarypassword of the file public/local/iomad/classes/companyuser.php of the component Password Field Handler. Such manipulation leads to information disclosure. The...

CVE-2026-125270

FFmpeg through 9.0.2 contains a heap out-of-bounds read vulnerability in v4l2bufferswframetobuf in libavcodec/v4l2buffers.c that mishandles frames with negative linesize. Attackers can supply bottom-up AVI or PNM/PFM files that are transcoded to a V4L2 M2M encoder, crashing the application or...

CVE-2026-125269

FFmpeg through 9.0.2 contains a double free vulnerability in libavcodec/cbssei.c where cbsseideletemessage leaves a stale extensiondata reference that ffcbsseiaddmessage reuses. Attackers can supply a crafted H.264 stream with a display orientation SEI message followed by payload extension data,...

CVE-2026-125267

FFmpeg before 8.1.3 and 9.x before 9.0.2 contains a heap out-of-bounds write vulnerability in the APAC decoder in libavcodec/apac.c caused by an unreset bitstream index. Attackers can supply a crafted APAC file whose growing bitstreamindex triggers an integer overflow, bypassing the reallocation...

CVE-2026-125268

FFmpeg through 9.0.2 contains an uninitialized memory disclosure vulnerability in the CineForm HD decoder that allows attackers to leak heap memory via unzeroed idwttmp buffers in libavcodec/cfhd.c. Attackers can supply a crafted CFHD file with an ImageHeight tag exceeding coded band heights,...

CVE-2026-125266

FFmpeg through 9.0.2 contains an uninitialized stack memory disclosure vulnerability in oldcodec23 of libavcodec/sanm.c that leaks stack bytes into decoded frames. Attackers can supply a crafted LucasArts SMUSH/SANM animation using codec 23 with an inline table to expose decoder process stack...