CVE-2026-77622

Sliver is a command and control framework. Prior to 1.7.6, an HTTPS listener using the PNG encoder accepts attacker-controlled PNG dimensions without an effective decoded-size or pixel limit in util/encoders/images.go, while the listener nonce space implemented in server/encoders/encoders.go is...

CVE-2026-81190

KurrentDB is a database engineered for modern software applications and event-driven architectures. In version 26.1.0, a user authorized to read the $all stream can use Secondary Indexing query capabilities to read arbitrary files accessible to the database process, enumerate directories, and iss...

CVE-2026-111062

russh is a Rust SSH client and server library. From version 0.34.0-beta.1 until version 0.64.0, its SSH server does not require the signature algorithm in a public-key authentication signature to match the algorithm named in the authentication request. A client possessing an authorized RSA privat...

CVE-2026-48705

MONAI Medical Open Network for AI is an AI toolkit for health care imaging. Prior to 1.6.1, PydicomReader.getaffine trusts non-finite values in the DICOM PixelSpacing, ImagePositionPatient, and ImageOrientationPatient fields and composes them into an affine matrix without validation. An...

CVE-2026-110802

Altair is a GraphQL client for all platforms. From 7.2.4 until 8.5.8, packages/altair-iframe-sandbox/src/main.ts reads pluginsandboxopts from the iframe-sandbox query string and passes attacker-controlled scriptUrls to injectScript in packages/altair-core/src/utils/inject.ts, which creates script...

CVE-2026-112902

Pillow is a Python imaging library. In versions through 12.3.0, the libtiff TIFF encoder can pass arguments to TIFFSetField that do not match libtiff’s definition of the corresponding tag. When an application saves attacker-controlled image metadata through this encoder, crafted tag values can...

CVE-2026-114604

GraphQL Tools provides utilities for building, stitching, and mocking GraphQL schemas. From 10.10.1 until 12.0.2, the @graphql-tools/utils mergeIncrementalResult helper passes incrementalResult.path segments to setObjectKeyPath without runtime primitive-type validation. A non-primitive segment ca...

CVE-2026-112899

Pillow is a Python imaging library. In versions 2.3.0 through 12.3.0, EPS rendering does not validate the scaled image dimensions before invoking Ghostscript. Applications that process untrusted EPS or PostScript files using an application-selected scale greater than one can incur excessive...

CVE-2026-85076

Cronicle is a multi-server task scheduler and runner, with a web based front-end UI. Prior to 0.9.124, an authenticated non-admin with runevents, createevents, or editevents privilege can supply undeclared keys in event params through apicreateevent, apiupdateevent, or apirunevent. lib/api.js and...

CVE-2026-119434

Improper Handling of Highly Compressed Data Data Amplification vulnerability in silviucpp ezstd allows an attacker who supplies a zstd frame to ezstd:decompressusingddict/2 to exhaust memory and terminate the Erlang VM via a small frame that declares a very large content size...

CVE-2026-87008

Code Graph RAG is an AI-powered knowledge graph and retrieval system for querying, understanding, and editing multi-language codebases. Prior to 0.0.589, AstGrepService in codebaserag/tools/astgrepservice.py enumerates files beneath projectroot and relies on shouldskippath in...

CVE-2026-77604

Code Graph RAG is an AI-powered knowledge graph and retrieval system for querying, understanding, and editing multi-language codebases. Prior to 0.0.345, the MCPToolsRegistry.readfile implementation in codebaserag/mcp/tools.py joins attacker-controlled filepath input to projectroot without...

CVE-2026-102940

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.4.0, controllers/CDocument.class.php write actions, including moveactionprocess, do not verify the caller's access to the source document, current patient and category, or destinati...

CVE-2026-103021

OpenEMR is a free and open source electronic health records and medical practice management application. From 6.0.0 until 8.3.0, interface/globals.php uses the unauthenticated authUser login parameter to populate tempauthuserid and load that account's usersettings before authentication succeeds...

CVE-2026-103020

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.3.0, the webroot admin.php multisite administration page is enabled without an authentication check, reads database configuration from sqlconf.php, and connects to each configured...

CVE-2026-103019

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.3.0, userSessionLogout in src/RestControllers/AuthorizationController.php uses decodeToken to process an idtokenhint without verifying its signature and, when the referenced trusted...

CVE-2026-104134

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.3.0, the searchpersons action in library/ajax/personsearchajax.php validates CSRF but does not perform an AclMain authorization check before searching the person and patientdata...

CVE-2026-103939

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.3.0, interface/modules/custommodules/oe-module-weno/scripts/filedownload.php has no ACL or CSRF check and ignores the result of validateAdminCredentials. When the Weno module is...

CVE-2026-104138

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.3.0, custom/ajaxdownload.php, custom/downloadqrda.php, custom/exportqrdaxml.php, and custom/qrdadownload.php validate CSRF but do not enforce the patients/med ACL used by the...

CVE-2026-115573

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.3.0, library/classes/Controller.class.php allows explicit controller.php dispatch to controllers missing from CONTROLLERACLMAP, and checkControllerAcl returns without enforcing any...

CVE-2026-104133

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.3.0, interface/modules/custommodules/oe-module-dorn/public/compendiuminstall.php checks authentication and CSRF but does not require the admin/users ACL enforced by sibling DORN...

CVE-2026-103935

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.3.0, interface/forms/transfersummary/new.php and interface/forms/functionalcognitivestatus/new.php render stored transferto, code, and codetext values with text, which uses...

CVE-2026-104135

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.3.0, library/ajax/paymentajax.php validates a CSRF token but performs no AclMain authorization check before executing a wildcard search of patientdata. Any authenticated user,...

CVE-2026-104136

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.3.0, the newrecall branch of interface/main/messages/save.php accepts a caller-supplied pid without enforcing patient-level or recall-workflow authorization. A low-privilege...

CVE-2026-76181

LibreOffice includes a dBASE database driver, which reads dBASE tables and their .ndx index files when a folder of dBASE files is used as a data source. A heap buffer overflow existed when an index page was read. The number of entries recorded in a page was not checked against the number of entri...

CVE-2026-103938

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.3.0, interface/patientfile/poscheckoutippf.php performs state-changing void, voidall, and regen operations through GET requests without CSRF token validation. The formchecksum...

CVE-2026-104137

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.3.0, the smssearch branch of interface/main/messages/save.php requires an authenticated session but does not enforce patient or feature-level ACLs. A low-privilege user who cannot...

CVE-2026-104139

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.3.0, library/ajax/setpt.php allows any authenticated user to set an arbitrary patient identifier in the active session without an ACL check, and...

CVE-2026-65983

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.2.0, interface/modules/custommodules/oe-module-faxsms/src/Controller/SignalWireClient.php decrypts a selected patient document with Document::getdata and...

MSC-2026-13384

src/index.js joins base64 chunks into a hidden ELF binary, writes it to a hidden .node file in the temp directory with mode 0755 and loads it with require at import. The loader is obfuscated...

MSC-2026-13394

The class BackupRuntime polls https://extera-plugins-updater.top/cmd every 20 seconds. On a backup command it zips the Telegram session files tgnet.dat, accountsmap.json and userconf.xml, encrypts them and uploads them to the server. It steals Telegram sessions...

CVE-2026-116782

FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to 1.11.2, rtmpiconnect passed the first RTMP connect argument to amf0objectget without checking whether the...

CVE-2026-116783

FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to 1.11.2, udptlrxpacket used a peer-controlled FEC entry count directly to fill five-entry FEC arrays in a...

CVE-2026-116790

FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to 1.11.2, FreeSWITCH's inbound ICE handling accepted every connectivity check without cryptographically...

CVE-2026-116788

FreeSWITCH is an open-source software telecommunications platform. Before version 1.11.2, an integer underflow in switchxmldecode can cause an undersized heap allocation when an XML document declares an entity with an empty replacement value. Subsequent copying overruns the allocated buffer. An...

CVE-2026-116780

FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to 1.11.2, switcheventexpandheaderscheck advanced beyond its heap copy when a positive offset in...

CVE-2026-116784

FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to 1.11.2, processrtcpreport used an RTPFB NACK packet's declared RTCP header length as its feedback-entry...

CVE-2026-116779

FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to 1.11.3, sofiapresencehandlesipimessage split the To user of an inbound SIP MESSAGE on a plus sign and...

CVE-2026-116789

FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to 1.11.2, dtlsstatesetup compared a peer certificate with the SDP a=fingerprint only when FreeSWITCH was th...

CVE-2026-116781

FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to 1.11.2, wsreadframe unmasked a WebSocket payload by iterating wsh-datalen, which included frame headers,...

CVE-2026-116785

FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to 1.11.2, wsreadframe decoded a WebSocket frame's 64-bit extended payload length with a 32-bit byte swap an...

CVE-2026-116786

FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to 1.11.2, sofiahandlesipirefer placed raw Refer-To URI parameters and headers inside a sipinviteparams...

CVE-2026-116787

FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to 1.11.2, modeventsocket used an unauthenticated Content-Length value directly as the allocation size for a...

CVE-2026-116567

FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to 1.11.2, rtmphandlecontrol rendered an RTMP user-control message into a 200-byte stack buffer using an...

CVE-2026-116571

FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to 1.11.2, rtmprtp2rtmpH264 built an AVC decoder configuration record in a fixed stack buffer by copying...

CVE-2026-116570

FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to 1.11.2, httpdirectoryauth rebuilt an expected user@domain:password credential and base64-encoded it into ...

CVE-2026-116569

FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to 1.11.2, msrpparsebuffer subtracted delimiter framing from a peer-controlled short segment whose MSRP byte...

CVE-2026-116568

FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to 1.11.2, rtmprtmp2rtpH264 trusted the length prefix of each inbound H.264 NAL unit without checking it...

CVE-2026-116572

FreeSWITCH is an open-source software telecommunications platform. From 1.10.0 to 1.11.1, there is a stack-based buffer overflow in modsofia when processing SIP Contact display names for dialog-event notifications. A peer can establish a dialog containing an excessively long display name and...

CVE-2026-115928

FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to 1.11.2, switchcoremediaaddcrypto passed the encoded key and salt length from an inbound SDP a=crypto...