CVE-2026-105330

Use of Hard-coded Cryptographic Key in JWT token authentication in Apache OFBiz 24.09.06 and 24.09.07 on all platforms allows an unauthenticated, network-reachable attacker to obtain full administrative access via a forged JWT signed with the factory-default security.token.key value that...

CVE-2026-105461

Missing check for ORDERMGRUPDATE in ordermgr allows user with only ORDERMGRVIEW permission to update orders. Affected versions before : 24.09.08 Users are recommended to upgrade to version 24.09.08 which fixes this issue...

CVE-2026-109129

Authorization Bypass Through User-Controlled Key in the Order Manager component in Apache OFBiz 24.09.07 on all platforms allows an authenticated user with only view-level order permissions to modify or create OrderPaymentPreference records belonging to orders outside their authorized scope via t...

CVE-2026-109837

Authorization Bypass Through User-Controlled Key in Order Returns in Apache OFBiz 24.09 before 24.09.08 on all platforms allows an authenticated user with low-privileged Order Manager access to associate another party's OrderItem with a ReturnItem on a ReturnHeader they control, via the...

CVE-2026-109856

Direct Request 'Forced Browsing' to Financial Account services in Apache OFBiz 24.09 before 24.09.08 on all platforms allows an authenticated user with any valid low-privilege account to create, modify, and cancel financial account transactions and balances without appropriate permission via dire...

CVE-2026-109928

Incorrect Implementation of Authentication Algorithm in the password-reset and login JWT validation in Apache OFBiz 24.09 before 24.09.08 on all platforms allows an attacker who has obtained a user's password-reset token via email interception, log exposure, or a man-in-the-middle on the mail...

CVE-2026-114229

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' in the Catalog image viewer in Apache OFBiz 24.09 before 24.09.08 on all platforms allows an unauthenticated attacker to execute arbitrary JavaScript in the browser session of a logged-in back-office user via a...

CVE-2026-114233

Incorrect Privilege Assignment in the Order Manager in Apache OFBiz 24.09 before 24.09.08 on all platforms allows an authenticated user who holds only order view permissions ORDERMGRVIEW, without ORDERMGRUPDATE or any role on the order, to modify approved orders, changing a ship group's shipping...

CVE-2026-114235

Direct Request 'Forced Browsing' in the Order component in Apache OFBiz 24.09 before 24.09.08 on all platforms allows an authenticated user with only view access to the Order Manager to modify the shipment tracking number of any order via a direct request to the updateTrackingNumber endpoint. Use...

CVE-2026-114271

Authorization Bypass Through User-Controlled Key in the shopping list services in Apache OFBiz 24.09 before 24.09.08 on all platforms allows an authenticated low-privileged user, such as a self-registered ecommerce customer, to modify another party's shopping list or take ownership of it, and...

CVE-2026-114272

Authorization Bypass Through User-Controlled Key in the content viewing component in Apache OFBiz 24.09 before 24.09.08 on all platforms allows an authenticated user with role-scoped content view permission to read the data of content they are not authorized to view via a ViewSimpleContent reques...

CVE-2026-114277

Authentication bypass by Assumed-Immutable data vulnerability in Apache OFBiz. Apache OFBiz's optional Janrain Engage Social Login integration in the ecommerce component improperly binds authenticated external identities to local user accounts. This issue affects Apache OFBiz: before 24.09.08...

CVE-2026-123023

A flaw has been found in agentscope-ai AgentScope up to 2.0.8. This affects the function checkpermissions of the file src/agentscope/tool/builtin/bash.py of the component Bash Tool. This manipulation causes incorrect authorization. Remote exploitation of the attack is possible. The exploit has be...

CVE-2026-117691

A flaw was found in the SAML HTTP-Redirect binding implementation of Keycloak. The issue occurs because the server processes percent-encoded parameter names like %53AMLResponse while the signature verification logic only checks literal parameter names. An attacker can use this discrepancy to...

CVE-2026-107912

A flaw was found in the management interface of the Quarkus framework, specifically within the quarkus-vertx-http component. The issue occurs when the framework incorrectly combines the management root path with specific permission rules, leading to a situation where security policies are applied...

CVE-2026-123022

A vulnerability was detected in agentscope-ai AgentScope up to 2.0.11. The impacted element is the function subprocess.Popen of the file src/agentscope/mcp/config.py of the component MCP Workspace API. The manipulation of the argument command results in os command injection. The attack may be...

CVE-2026-123059

In Eclipse BaSyx Helm Charts version 2.2.0 of the "aas-basyx-v2-full" chart, deployments with the bundled Keycloak enabled store the client secret of the "basyx-technical-user" OAuth2 client in cleartext in a Kubernetes ConfigMap. This client uses the client-credentials grant and its service...

MSC-2026-13379

The postinstall script runs curl to a requestcatcher.com collector and sends the local user name whoami on each install...

MSC-2026-13383

The postinstall script runs curl to a requestcatcher.com collector and reports each install with the organisation name...

CVE-2026-123119

The Symfony HttpClient component NoPrivateNetworkHttpClient does not pin the checked IP address of cached hosts, allowing for DNS rebinding to bypass private network restrictions, resulting in enumeration of internal hosts and ports in Symfony versions prior to 5.4.56, 6.x prior to 6.4.50, 7.x...

MSC-2026-13382

The requestcatcher-ping command reads /etc/passwd and sends it base64-encoded to a requestcatcher.com collector. The README says it only sends a hello request...

MSC-2026-13380

The requestcatcher-ping command reads /etc/passwd and sends it base64-encoded to a requestcatcher.com collector. The README says it only sends a hello request. The package name imitates csv-generate...

MSC-2026-13381

The requestcatcher-ping command reads /etc/passwd and sends it base64-encoded to a requestcatcher.com collector. The README says it only sends a hello request. The package name imitates csv-generate...

CVE-2026-123020

A security vulnerability has been detected in eosphoros-ai DB-GPT up to 0.8.1. The affected element is the function FileBasedSkill.getprompt of the file packages/dbgpt-core/src/dbgpt/agent/skill/claudeskill/init.py of the component Jinja2 Template Handler. The manipulation leads to improper...

CVE-2026-103866

Inconsistent interpretation of HTTP requests 'HTTP Request/Response smuggling' vulnerability in Apache Sling Engine. The engine's query/form parser accepts non-standard percent-escapes, wrong charsets, and continues request processing on such errors. This issue affects Apache Sling Engine: before...

CVE-2026-103864

Improper output neutralization for logs in Apache Sling Engine. This issue affects Apache Sling Engine: before 3.0.4. Users are recommended to upgrade to version 3.0.4, which fixes the issue...

CVE-2026-103863

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Apache Sling Engine. Content-Type, charset, and redirect changes from an included component evade the protectheaders / checkcontenttype enforcement through setHeader, repeated calls to...

CVE-2026-123047

In Eclipse BaSyx Helm Charts versions 3.0.0-rc.1 to 3.12.1 of the "basyx" chart, deployments with the bundled Keycloak enabled store the passwords of the Keycloak users that the chart creates in cleartext in a Kubernetes ConfigMap. The template "keycloak-init-config.yaml" rendered...

CVE-2026-123019

A weakness has been identified in eosphoros-ai DB-GPT up to 0.8.2. Impacted is the function execmodule of the file hfadapter.py of the component HuggingFace Adapter. Executing a manipulation of the argument trustremotecode can lead to inclusion of functionality from untrusted control sphere. The...

CVE-2026-121489

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in Apache Juneau. The microservice DirectoryResource does not keep request paths inside its configured root directory. When an application enables the resource's view, upload or delete settings all off by...

CVE-2026-96677

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Apache Juneau. HTML document serialization does not HTML-encode variable substitutions in the page chrome header, nav, aside, footer and similar fields. Applications whose chrome includes...

CVE-2026-73117

Improper Neutralization of CRLF Sequences in HTTP Headers 'HTTP Response Splitting' vulnerability in Apache Juneau. The Apache Juneau REST server passed response header values and redirect targets to the servlet container unchecked. An application that sets a response header or redirect target fr...

CVE-2026-73116

Insufficiently Protected Credentials vulnerability in Apache Juneau. The Apache Juneau RestClient followed HTTP redirects while keeping credential headers from the original request, so a server that redirected the client to a different host or port, or from HTTPS to HTTP, could receive headers su...

CVE-2026-73101

Generation of Error Message Containing Sensitive Information vulnerability in Apache Juneau. The REST server sends the internal exception class and message to clients in a "Thrown" response header on every error response, and can include internal exception messages in the error body, even when...

CVE-2026-73100

Insertion of Sensitive Information into Log File vulnerability in Apache Juneau. The default REST server call logger records request headers for requests that end in a server error, without redacting them. Any client able to cause a server error gets headers such as Authorization, Cookie,...

CVE-2026-73099

Cross-Site Request Forgery CSRF vulnerability in Apache Juneau. The REST server accepts a "content" query parameter that replaces the request body, and this is enabled by default on every HTTP method, including GET. A cross-site link can therefore deliver an attacker-chosen request body to an...

CVE-2026-73098

Improper control of dynamically-loaded code vulnerability in Apache Juneau. When Apache Juneau parses a value into a property of type java.lang.Class including parameterized forms, the default class swap loaded the named class with initialization enabled, so input naming a class on the applicatio...

CVE-2026-73095

Allocation of Resources Without Limits or Throttling vulnerability in Apache Juneau. The MessagePack parser, which the REST server enables by default, sizes buffers from length values in the input. An unauthenticated client can send a few bytes that force a multi-gigabyte allocation and an...

CVE-2026-123018

A security flaw has been discovered in eosphoros-ai DB-GPT up to 0.8.2. This issue affects the function executecode of the file codeutils.py of the component CodeAction. Performing a manipulation results in code injection. The attack can be initiated remotely. The exploit has been released to the...

CVE-2026-123036

A flaw was found in ansible-core. When a task marked "nolog: true" fails, the task result is censored before being emitted, but the "exception" field is retained because it is present in the PRESERVE allow-list in lib/ansible/internal/task.py, and the default stdout callback prints it through...

MSC-2026-13373

This package has been identified by Mend as containing potential malicious functionality. The severity of the functionality can change depending on where the library is running user's machine or backend server. The following risks were identified: Code injection testing – an attacker checks if...

MSC-2026-13377

This package has been identified by Mend as containing potential malicious functionality. The severity of the functionality can change depending on where the library is running user's machine or backend server. The following risks were identified: Code injection testing – an attacker checks if...

MSC-2026-13376

This package has been identified by Mend as containing potential malicious functionality. The severity of the functionality can change depending on where the library is running user's machine or backend server. The following risks were identified: • Code injection testing – an attacker checks if...

MSC-2026-13378

This package has been identified by Mend as containing potential malicious functionality. The severity of the functionality can change depending on where the library is running user's machine or backend server. The following risks were identified: • Code injection testing – an attacker checks if...

MSC-2026-13372

This package has been identified by Mend as containing potential malicious functionality. The severity of the functionality can change depending on where the library is running user's machine or backend server. The following risks were identified: • Code injection testing – an attacker checks if...

MSC-2026-13374

This package has been identified by Mend as containing potential malicious functionality. The severity of the functionality can change depending on where the library is running user's machine or backend server. The following risks were identified: • Code injection testing – an attacker checks if...

MSC-2026-13375

This package has been identified by Mend as containing potential malicious functionality. The severity of the functionality can change depending on where the library is running user's machine or backend server. The following risks were identified: • Code injection testing – an attacker checks if...

CVE-2026-118869

An OS command injection vulnerability exists in SHIRASAGI, which may allow an authenticated attacker to execute arbitrary OS commands on the system running the product...

CVE-2026-117679

A cross-site scripting vulnerability exists in SHIRASAGI, which may allow an authenticated attacker to execute arbitrary script in a user's web browser when the user accesses a website using the affected product...

CVE-2026-112072

vault-java-driver, a Java client for HashiCorp Vault, parses Vault's JSON responses with a vendored minimal-json parser that has no nesting depth limit. A deeply nested value raises a StackOverflowError, which escapes catch Exception handlers and kills the reading thread. A Vault token that can...