CVE-2026-128424

A flaw was found in Kroxylicious. The ACL authorizer's rules-file parser unquotes "matching /…/" regular-expression literals using the string unquoting rules, which strips every backslash escape. As a result, an allow rule such as "matching /orders.v1/" is compiled as the regex "orders.v1", which...

CVE-2026-127286

A vulnerability was identified in Zackriya-Solutions Meetily up to 0.4.1. Affected is an unknown function of the file backend/app/main.py. The manipulation leads to missing authentication. The attack is possible to be carried out remotely. The exploit is publicly available and might be used. The...

CVE-2026-100397

SSH challenge tokens are mistakenly accepted as valid credentials during the authentication token validation process. While an SSH challenge token is intended as a short-lived nonce for use in a subsequent SSH key exchange, the function to validate authentication tokens does not differentiate...

CVE-2026-127281

A vulnerability was found in lanyulei ferry 1.0.0-beta.1/1.0.0. Affected is an unknown function of the file middleware/auth.go of the component JWT Validation. The manipulation results in improper authentication. The attack can be executed remotely. The exploit has been made public and could be...

CVE-2026-127279

A vulnerability was detected in AIP-PUB ACPs-community up to 2.2.0. This impacts an unknown function of the file discovery-server/app/main.py of the component Discovery Server. The manipulation results in missing authentication. The attack may be launched remotely. The exploit is now public and m...

CVE-2026-127278

A weakness has been identified in AIP-PUB ACPs-community up to 2.2.0. The impacted element is the function sendverificationcode of the file registry-server/app/account/serviceauth.py of the component verify-code Endpoint. Executing a manipulation of the argument phone can lead to improper...

CVE-2026-127915

The MCUboot TLV iterator bootutiltlviternext in boot/bootutil/src/tlv.c walks image trailer TLVs with a single loop guard it-tlvoff tlvend and advances by sizeofstruct imagetlv + tlv.itlen using the attacker-controlled itlen field, without validating that the entry's header or payload stays withi...

CVE-2026-16664

MCUboot's Zephyr serial-recovery upload handler bsupload in boot/bootserial/src/bootserial.c decodes the host-supplied image field of an MCUmgr image-upload request into imgnum a full 32-bit value and latches it on the off == 0 packet without any range check. It then passes imgnum straight to...

CVE-2026-16659

MCUboot's serial-recovery image-upload handler bsupload in boot/bootserial/src/bootserial.c declares const struct flasharea fap = NULL and assigns it only via flashareaopen part-way through the function. Two early validation failures goto outinvaliddata — a CBOR map that fails to decode, or an...

CVE-2026-16671

splitimagecheck in boot/bootutil/src/loader.c declares a fixed uint8t loaderhash32 buffer and passes it as the outhash out-parameter to bootutilimgvalidate. That routine copies IMAGEHASHSIZE bytes into outhash memcpyouthash, hash, IMAGEHASHSIZE in boot/bootutil/src/imagevalidate.c, where...

CVE-2026-16662

bootsavebootstatus in boot/bootutil/src/bootrecord.c reads the image's EXPECTEDHASHTLV into a stack buffer imagehashIMAGEHASHSIZE that is never zero-initialised. The TLV handler validates only the upper bound len sizeofimagehash and then reads exactly len bytes, so a TLV shorter than IMAGEHASHSIZ...

CVE-2026-128091

When MCUboot is built with the TinyCrypt crypto backend MCUBOOTUSETINYCRYPT, bootutilaesctrdrop in boot/bootutil/include/bootutil/crypto/aesctrtinycrypt.h was an empty stub. The AES-CTR context for this backend is the fully expanded AES-128 key schedule struct tcaeskeyschedstruct. Generic code...

CVE-2026-128321

Tight JPEG decoding in TightVNC and UltraVNC viewers contains a heap-based buffer overflow because an attacker-controlled framebuffer rectangle width is not validated against a fixed-size decoding buffer. A malicious VNC server can cause an out-of-bounds heap write when a user connects, resulting...

CVE-2026-126982

A type allow-list bypass in the BSON serialization library of the MongoDB C Driver allows a type-restriction check to be circumvented when polymorphic data is deserialized into loosely typed members. An unauthorized party who can supply or plant BSON/JSON data that the application later...

CVE-2026-126839

A deserialization type-restriction control in the BSON serialization component can be bypassed because the check used to recognize a class of compiler-generated types relies on an overly permissive heuristic rather than a precise identification. An unauthorized party able to supply BSON content...

CVE-2026-126792

A memory-safety flaw in the key-management request-building component of the library can lead to an out-of-bounds write on the heap. A fixed-size output buffer is used under an assumption about cryptographic key size that is never validated, so when the library is embedded by a caller that suppli...

CVE-2026-128067

Pillow is a Python imaging library. From 2.3.0 through 12.3.0, Pillow applications that save compressed TIFF images through libtiff can pass attacker-controlled image geometry tags to the encoder while allocating its row buffer from the actual image dimensions. The affected TiffImagePlugin.save...

CVE-2026-128066

Pillow is a Python imaging library. From 1.0 through 12.3.0, ImageFileDirectoryv2.load in src/PIL/TiffImagePlugin.py retains a separate bytes object for each out-of-line IFD tag value without limiting the total data read or preventing distinct tags from referencing the same file region. A small...

CVE-2026-128065

@grpc/grpc-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. From 1.14.0 through 1.14.1, XdsServer in @grpc/grpc-js-xds can acknowledge Route and VirtualHost resources while failing to apply their RBACPerRoute override configurations. The override parser is n...

CVE-2026-126367

@grpc/grpc-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Before 1.13.2, and from 1.14.0 through 1.14.1, the @grpc/grpc-js-xds SafeRegexValueMatcher and PathSafeRegexValueMatcher add start and end anchors without grouping a supplied top-level alternation. ...

CVE-2026-126366

MessagePack for Ruby is an implementation of the MessagePack binary serialization format. Prior to 1.8.7, the Java-platform msgpack gem for JRuby allocated arrays and byte buffers directly from attacker-controlled array32, str32, and bin32 declared sizes before confirming that corresponding...

CVE-2026-126365

Astro is a web framework for content-driven websites. Prior to @astrojs/prism 4.1.2, and from @astrojs/markdoc 0.3.0 until 2.1.2, runHighlighterWithAstro returned code unchanged when Prism had no grammar for the requested language, and callers inserted that result as raw HTML. A code block labele...

CVE-2026-126364

Astro is a web framework for content-driven websites. From 5.14.3 until 7.4.7, Astro's /image endpoint compared the requested local-image path with the build output directory without preserving case on case-sensitive filesystems. A sibling directory whose path differed from the output directory...

CVE-2026-93333

Vault's audit devices did not validate the contents of a configured audit log prefix and did not consistently enforce the server-level setting that restricts audit log prefixing. This may allow a privileged operator to inject content into audit logs, potentially leading to forged or misleading...

CVE-2026-93335

Vault Community Edition and Vault Enterprise did not consistently apply explicit ACL policy deny rules to request paths that differ only by a trailing slash. This may allow an authenticated user who holds a broader delete permission on system configuration paths to disable a secrets engine, auth...

CVE-2026-126363

Astro is a web framework for content-driven websites. From 0.2.0 until 7.1.2, the @astrojs/solid-js renderer inserted a named slot into the quoted name attribute of an astro-slot wrapper without HTML escaping. A request-controlled slot name containing a quote could terminate the attribute and...

CVE-2026-92735

HashiCorp Vault and Vault Enterprise are vulnerable to an issue in the integrated storage join process that may allow an unauthenticated attacker with network access to a new, uninitialized node to cause that node to send credentials from its server environment to an attacker-controlled server...

CVE-2026-126362

Astro is a web framework for content-driven websites. From 5.7.3 until 9.1.2, the @astrojs/svelte renderer inserted a named slot into the quoted name attribute of an astro-slot wrapper without HTML escaping. Request-controlled slot names containing a quote could terminate the attribute and inject...

CVE-2026-126361

Astro is a web framework for content-driven websites. Prior to 7.4.5, Astro rendered a string used as a dynamic element name as raw HTML after applying an incomplete character filter. A / in the string could make an HTML parser treat the remainder as attributes, allowing untrusted element-name...

CVE-2026-126360

OpenTelemetry Python provides the Python API and SDK for OpenTelemetry. Prior to 1.45.2, TraceContextTextMapPropagator.extract in opentelemetry-api can perform quadratic-time regular-expression backtracking on a malformed traceparent value containing a trace-context prefix, a long whitespace...

CVE-2026-126359

Hono is a Web application framework that provides support for any JavaScript runtime. From 3.12.0 until 4.13.16, the css helper in hono/css escapes interpolated string values separately and therefore fails to neutralize a closing style tag when element early and cause the remainder of the...

CVE-2026-126358

Hono is a Web application framework that provides support for any JavaScript runtime. From 4.1.4 until 4.13.16, RegExpRouter can omit wildcard middleware in three version-specific cases: since 4.13.0, middleware using the explicit default parameter pattern in /api/:tenant^/+/admin/ is not applied...

CVE-2026-127212

Dokploy before 0.31.1 contains a missing ownership check vulnerability in the readAppMonitoring tRPC procedure that allows authenticated attackers to access container metrics belonging to other organizations by supplying an arbitrary appName. Attackers can query getApplicationStats with any...

CVE-2026-126357

Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.13.16, mount and app.mount can remove a dynamic mount prefix using the route-pattern length rather than the matched-prefix length, allowing a crafted path to be forwarded as a protected inner route...

CVE-2026-126356

Hono is a Web application framework that provides support for any JavaScript runtime. From 4.5.1 until 4.13.16, validator'form' uses a strict whole-header pattern that fails to recognize multipart/form-data when its Content-Type includes another legal parameter or extra whitespace after a...

CVE-2026-126355

Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.13.16, csrf limits origin validation to the content types normally sent by HTML forms and therefore does not validate text/ping requests generated by Chromium hyperlink auditing. Chrome and Edge can...

CVE-2026-126354

Addressable is an alternative implementation to the URI implementation that is part of Ruby's standard library. From 2.2.5 until 2.9.1, Addressable::URI.normalizepath can resolve a path containing leading parent segments and later parent segments to a different path than an RFC 3986 resolver...

CVE-2026-126353

Addressable is an alternative implementation to the URI implementation that is part of Ruby's standard library. From 2.3.0 until 2.9.1, URI template expressions containing several exploded variables generate ambiguous regular expressions that can divide a run of members among the variables in...

CVE-2026-126352

Addressable is an alternative implementation to the URI implementation that is part of Ruby's standard library. From 2.3.0 until 2.9.1, URI templates with several variables in one expression or several adjacent expressions generate ambiguous regular expressions. Affected forms include...

CVE-2026-126351

Addressable is an alternative implementation to the URI implementation that is part of Ruby's standard library. Prior to 2.9.1, Addressable::URI.normalizepath repeatedly scans and rewrites paths while removing only one nested dot segment per pass, producing quadratic work. URInormalize,...

CVE-2026-126350

Addressable is an alternative implementation to the URI implementation that is part of Ruby's standard library. From 2.3.0 until 2.9.1, URI template expressions using the explode modifier with the slash, dot, semicolon, question-mark, or ampersand operators generate ambiguous regular expressions...

CVE-2026-126349

Addressable is an alternative implementation to the URI implementation that is part of Ruby's standard library. From 2.0.0 until 2.9.1, Addressable::IDNA.tounicode can decode Punycode labels that contain bidirectional controls, zero-width characters, control characters, or other default-ignorable...

CVE-2026-126348

Addressable is an alternative implementation to the URI implementation that is part of Ruby's standard library. From 2.0.0 until 2.9.1, the pure-Ruby Addressable::IDNA.tounicode implementation decodes invalid Punycode A-labels instead of returning them unchanged. Labels that decode to ASCII text ...

CVE-2026-126347

Tornado is a Python web framework and asynchronous networking library. In versions through 6.6.0, applications using tornado.web.RedirectHandler with URL templates that allow attacker-controlled substitutions to influence the destination can be vulnerable to an open redirect using three or more...

CVE-2026-126823

A local user with an ordinary account on the same host can place a file in a shared temporary location that the JDBC driver's native library loading routine will accept and load without verifying its origin. Loading the driver class in a Java application may then run code of that user's choosing...

CVE-2026-126346

basic-ftp is an FTP client for Node.js. Prior to 6.2.3, FTPContext.send throws when a command contains carriage return, line feed, or NUL characters, but calls made from response handlers execute synchronously inside the control socket's data event without an exception boundary. In Client.login, ...

CVE-2026-126345

basic-ftp is an FTP client for Node.js. Prior to 6.2.4, the MLSD directory-listing parser in src/parseListMLSD.ts uses untrusted fact names from the FTP server as keys in the plain-object factHandlersByName dictionary without checking that the resolved property is an own handler. A fact named pro...

CVE-2026-126344

@hono/node-server allows running the Hono application on Node.js. From 2.0.0 until 2.1.6, the WebSocket upgrade path resolves a raw request-target beginning with // against a base URL built from the Host header, causing the WHATWG URL parser to treat the request-target as a network-path reference...

CVE-2026-126343

@hono/node-server allows running the Hono application on Node.js. From 2.0.0 until 2.1.6, the WebSocket upgrade handler waits for the Hono application to finish asynchronous middleware or handler work without first attaching an error listener to the socket. If an unauthenticated client resets the...

CVE-2026-126210

@hono/node-server allows running the Hono application on Node.js. Prior to 1.19.18 and from 2.0.0 until 2.1.6, the server passes a raw request-target containing a backslash in its path to the WHATWG URL parser, which treats the backslash as a path separator and resolves dot segments. A reverse...