CVE-2026-124318

Treeio through 2.0 contains an insecure deserialization vulnerability in UpdateRecord.getformatstrings and ModuleSetting.loads that allows staff users to execute code via unverified pickle data. Attackers can store a crafted base64 pickle payload in an UpdateRecord formatstrings field through the...

CVE-2026-124317

libexpat through 2.10.0 contains an out-of-bounds read vulnerability in unknowntoUtf8 and unknowntoUtf16 in xmltok.c when handling application-registered unknown encodings. Attackers can supply a document ending in a truncated multibyte sequence so the convert callback reads past the parse buffer...

CVE-2026-124316

Frappe ERPNext before 15.121.4 and 16.x before 16.36.0 contains a missing authorization vulnerability in the whitelisted erpnext.buying.utils.getlinkedmaterialrequests method lacking document or company permission checks. Authenticated users, including portal users or users without roles, can...

CVE-2026-124315

Frappe ERPNext before 15.121.4 and 16.x before 16.36.0 contains a missing authorization vulnerability in the whitelisted getbomitems and getbomdiff methods that skip BOM read permission checks. Any authenticated user, including portal or no-role users, can call getbomitems with a BOM name to...

CVE-2026-124314

Frappe ERPNext before 15.121.4 and 16.x before 16.36.0 contains a missing authorization vulnerability in erpnext.crm.utils.getopenactivities that exposes ToDo and Event records. Any authenticated user, including portal or no-role users, can supply arbitrary refdoctype and refdocname values to...

CVE-2026-124313

Frappe ERPNext before 15.121.4 and 16.x before 16.36.0 contains a missing authorization vulnerability in the whitelisted getlinkedpaymentsfordoc method. Any authenticated user, including portal users, can supply arbitrary company, doctype, and docname values to read Payment Ledger Entry allocatio...

CVE-2026-124312

Fraunhofer HHI VVdeC through 3.2.1 contains a heap out-of-bounds read vulnerability that allows attackers to crash the decoder by supplying a collocated picture of different resolution. Attackers can craft a VVC bitstream enabling TMVP with a smaller collocated reference picture, causing getColIn...

CVE-2026-124311

Fraunhofer HHI VVdeC through 3.2.1 contains a NULL pointer dereference vulnerability in InterPrediction::xPredInterBlk that allows attackers to crash the decoder by switching SPS to enable reference wrap-around. Attackers can supply a crafted VVC bitstream activating a new SPS with...

CVE-2026-124310

Fraunhofer HHI VVdeC before 3.2.1 contains an out-of-bounds read vulnerability that allows attackers to crash the decoder by supplying bitstreams with overlapping slice CTU coverage. Attackers can code a CTU in a second slice so a bi-predicted BDOF coding unit carries a negative reference index,...

CVE-2026-124309

Fraunhofer HHI VVdeC before 3.2.1 contains a heap out-of-bounds read vulnerability in SEIReader::xParseSEIScalableNesting that allows attackers to read past heap allocations by casting the SEI wrapper object instead of its payload. Attackers can supply a crafted VVC bitstream with a scalable...

CVE-2026-124307

Fraunhofer HHI VVdeC before 3.2.1 contains a heap use-after-free vulnerability that allows attackers to corrupt memory by redefining an ALF adaptation parameter set id still referenced by slices. Attackers can supply a crafted VVC bitstream that, with multithreaded decoding, makes worker threads...

CVE-2026-124308

Fraunhofer HHI VVdeC before 3.2.1 contains a heap use-after-free vulnerability in DecLibRecon::createSubPicRefBufs because decompressPicture clears msubPicExtTasks without waiting for pending tasks. Attackers can supply a crafted multi-subpicture VVC bitstream to decoders using two or more thread...

CVE-2026-120984

A flaw was found in the Keycloak server's client management component. When a client is created or imported with authorization services enabled, the system fails to properly clear an internal session attribute used during the setup process. This allows an authenticated attacker with client...

CVE-2026-123964

A vulnerability was detected in OpenBMB Internet of Agents up to 9d78e88e47160eb42ee1ee8538c05e1c2c47877a. This affects the function launchgoal of the file imclient/communication/communicationlayer.py of the component Collaboration Layer. Performing a manipulation of the argument maxturns results...

CVE-2026-123963

A security vulnerability has been detected in OpenBMB Internet of Agents up to 9d78e88e47160eb42ee1ee8538c05e1c2c47877a. The impacted element is the function register of the file imserver/app.py of the component Agent Registry. Such manipulation of the argument desc/name leads to missing...

CVE-2026-121265

SQL::Abstract versions before 2.000003 for Perl allow SQL injection via an arrayref column value in insert and update. With the arraydatatypes option off, which is the default, insert, update and values treat an arrayref column value as literal SQL. Its first element goes into the SQL text...

CVE-2026-123881

A vulnerability was found in OpenBMB Internet of Agents up to 9d78e88e47160eb42ee1ee8538c05e1c2c47877a. This issue affects the function fetchchatrecord of the file imserver/app.py of the component Message Handler. The manipulation of the argument commid results in improper access controls. The...

CVE-2026-118042

Google Guava from 13.0 through 33.7.2 is vulnerable to hash flooding in HashBiMap and in the per-key value sets of LinkedHashMultimap. These collections use chained hash tables with no fallback when a bucket grows long, so inserting keys or values that share a hashCode makes construction quadrati...

CVE-2026-83495

A flaw was found in the Trainer v2 TrainJob API. A user with permissions to create TrainJobs can exploit this by injecting "valueFrom.secretKeyRef" into environment variable definitions. This allows them to read and exfiltrate sensitive information secrets from the namespace, leading to a privile...

CVE-2026-71881

Multiple injection issues in resource metadata fields in GBIF Integrated Publishing Toolkit versions before 3.3.5 allows authenticated remote attackers to execute code in another user's session after user interaction via stored cross-site scripting...

CVE-2026-118786

Improper input validation in non-secure-callable NSC veneer functions of the NXP MCUXpresso SDK rpmsg-lite multicore example multicoreexamples/rpmsglitepingpongtzm up to releases 26.06.00-lts and 26.09.00 may allow a non-secure caller to supply unvalidated pointers and size values, potentially...

CVE-2026-118785

Improper handling of non-secure-world input in NSC veneer functions of NXP MCUXpresso SDK TrustZone-M examples trustzoneexamples, affecting versions through 26.06.00-lts and 26.09.00-pvw2, may allow a non-secure caller to supply unvalidated pointers or untrusted data, causing a timing side-channe...

CVE-2026-50240

A flaw was found in OpenShift Pipelines-as-Code PAC. PAC does not verify whether the creator of a Repository custom resource has permission to create PipelineRuns. A namespace user with only Repository and Secret create/delete permissions can cause PAC to execute attacker-controlled PipelineRuns ...

CVE-2026-123791

A vulnerability was detected in OpenBMB Internet of Agents up to 9d78e88e47160eb42ee1ee8538c05e1c2c47877a. This affects the function primaryfieldquery of the file common/utils/milvusutils.py of the component Agent Registry. The manipulation of the argument key results in improper neutralization o...

CVE-2026-103022

Urwid is a console user interface library for Python. Prior to 4.0.7, handleshortrequest in urwid/display/web.py performs unguarded character encoding on POST input and unguarded UTF-8 decoding on polling update socket output. A remote attacker who obtains a valid X-Urwid-ID session token can...

CVE-2026-94619

FileGator is a multi-user file manager. Prior to 7.15.0, POST /upload in backend/Controllers/UploadController.php uses the request-supplied resumableFilename as an unnamespaced key in shared temporary storage. In a multi-user deployment configured with distinct per-user home directories, a...

CVE-2026-94618

FileGator is a multi-user file manager. Prior to 7.15.0, GET /batchdownload in backend/Controllers/DownloadController.php uses batchDownloadStart to stream a shared temporary archive selected by the request-supplied uniqid without checking that the current session created it. In deployments with...

CVE-2026-119800

Ryot is a self-hosted personal tracking application. Prior to 10.5.6, the collectionContents GraphQL query implemented by collectioncontents in crates/services/collection/src/contentoperations.rs accepts a caller-controlled CollectionContentsInput.collectionid and returns a collection without...

CVE-2026-77442

Ryot is a self-hosted personal tracking application. Prior to 10.4.0, the createOrUpdateUserIntegration GraphQL mutation in crates/services/user/src/integrationoperations.rs allows a low-privileged authenticated user to supply another user's integrationId to createorupdateuserintegration without ...

CVE-2026-104267

Botan is a C++ cryptography library. From 2.7.0 until 3.13.0, Botan's Scrypt implementation on 32-bit platforms computes required memory with unchecked multiplication, allowing attacker-controlled Scrypt parameters to wrap the allocation size and create a buffer smaller than the algorithm...

CVE-2026-48057

Botan is a C++ cryptography library. Prior to 3.13.0, Botan's X.509 Distinguished Name decoder flattens the Attribute-Value Assertions in each Relative Distinguished Name and loses multi-value RDN grouping before DN name-constraint enforcement. An attacker controlling a name-constrained...

CVE-2026-47738

liboqs is a C-language cryptographic library that provides implementations of post-quantum cryptography algorithms. Prior to 0.16.0, OQSKEMencapsderand can dereference an uninitialized encapsderand function pointer when called on NTRU-HPS-2048-509, NTRU-HPS-2048-677, NTRU-HPS-4096-821,...

CVE-2026-44519

liboqs is a C-language cryptographic library that provides implementations of post-quantum cryptography algorithms. Prior to 0.16.0, the ctselect function in src/kem/frodokem/external/util.c for the FrodoKEM-640, FrodoKEM-976, and FrodoKEM-1344 AES and SHAKE reference variants lacks a value barri...

CVE-2026-104254

liboqs is a C-language cryptographic library that provides implementations of post-quantum cryptography algorithms. From 0.11.0 through 0.16.0, builds configured with OQSENABLESIGSTFLLMS=ON can read beyond a caller-supplied signature buffer when an untrusted truncated LMS or HSS-LMS signature...

CVE-2026-123788

A security vulnerability has been detected in chenyme grok2api up to 3.1.6. The impacted element is an unknown function of the file backend/internal/transport/http/inference/voicewshandler.go of the component STT Billing. The manipulation leads to enforcement of behavioral workflow. The attack ma...

CVE-2026-71397

Allocation of Resources Without Limits or Throttling vulnerability in elixir-grpc grpcserver allows unauthenticated attackers to exhaust memory and crash the node via an oversized client-streaming or bidirectional-streaming request body. The streaming read clause of...

CVE-2026-123787

A weakness has been identified in nexmoe VidBee up to 1.3.13/2.0.2. The affected element is an unknown function of the file apps/desktop/src/main/local-api.ts of the component Local HTTP Service. Executing a manipulation can lead to information disclosure. The attack can be launched remotely. The...

CVE-2026-71863

SecureDrop is an open-source whistleblower submission system that media organizations can use to securely accept documents from, and communicate with anonymous sources. From 2.13.0 until 2.16.1, running the securedrop-admin install Ansible playbook with journalist alerts disabled leaves the...

CVE-2026-102610

fast-agent is a framework for building, running, and evaluating AI agents with Model Context Protocol support. Prior to 0.7.21, fast-agent serve uses HTTP transport bound to 0.0.0.0 on port 8000 without authentication, allowing any network client that can reach the /mcp endpoint to invoke the...

CVE-2026-124078

plist.js npm package 'plist' before 5.0.1 contains an uncontrolled resource consumption vulnerability in the binary property-list parser parseBinary that allows unauthenticated attackers to crash a Node.js process by exploiting unmemoized recursive resolution of shared object references for array...

CVE-2026-102657

esm.sh is a no-build content delivery network CDN for web development. Prior to server version 1377, the documented web.NewHandler static file server in web/handler.go joins the URL-decoded r.URL.Path with Config.AppDir without verifying that the result remains inside the configured application...

CVE-2026-102344

Lavish is the new editor for your HTML artifacts. Prior to 0.1.43, the lavish-axi loopback HTTP server did not authenticate requests or validate Host and Origin values on session, artifact, prompt, and polling routes. A website visited while the server is running can use DNS rebinding to send...

CVE-2026-102530

JupyterLab Desktop is the cross-platform desktop application for JupyterLab. Prior to 4.6.2-1, remote-server URLs were inserted into the server-selection dialog and Welcome view without safe encoding. An attacker who convinces a user to submit a crafted URL can execute JavaScript in the Welcome...

CVE-2025-55002

JupyterLab Desktop is the cross-platform desktop application for JupyterLab. Prior to 4.6.2-1, JupyterLab Desktop for macOS shipped with Electron's RunAsNode fuse enabled, allowing ELECTRONRUNASNODE to execute arbitrary Node.js code in the application process. An attacker who can already execute...

CVE-2026-86044

JupyterLab Desktop is the cross-platform desktop application for JupyterLab. Prior to 4.6.2-1, JupyterLab Desktop exposed getServerInfo to the renderer without confirming that the current page still had the local Jupyter server origin. In a local managed session using JupyterLab before 4.4.8, an...

CVE-2025-54991

JupyterLab Desktop is the cross-platform desktop application for JupyterLab. Prior to 4.6.2-1, JupyterLab Desktop for macOS declared the com.apple.security.cs.allow-dyld-environment-variables entitlement, allowing the dynamic linker to honor DYLDINSERTLIBRARIES despite the hardened runtime. An...

CVE-2026-85737

Velociraptor is a tool for collecting host-based state information using Velociraptor Query Language VQL queries. Prior to 0.77.2, SQLPlugin.Call in vql/parsers/sql/sql.go does not enforce plugin-level FILESYSTEMREAD or NETWORK checks before the mysql and postgres branches pass a caller-controlle...

CVE-2026-63439

2FAuth is a web app to manage Two-Factor Authentication 2FA accounts and generate their security codes. Prior to 8.0.0, when AUTHENTICATIONGUARD=reverse-proxy-guard is enabled, ReverseProxyGuard::user reads the default REMOTEUSER identity header, or a custom identity header selected by the...

CVE-2026-63438

2FAuth is a web app to manage Two-Factor Authentication 2FA accounts and generate their security codes. Prior to 8.0.0, when AUTHENTICATIONGUARD=reverse-proxy-guard accepts authentication headers from a client that did not pass through a trusted proxy, RemoteUserProvider::retrieveById creates an...

CVE-2026-63440

2FAuth is a web app to manage Two-Factor Authentication 2FA accounts and generate their security codes. Prior to 8.0.0, the otpauth image-fetch path validates a hostname through ValidatesUrls::isExternalHost and then lets IconService::storeRemoteImage resolve the same hostname again for the HTTP...